skillwiki 0.10.109 → 0.10.111

package/dist/cli.js

@@ -1,4 +1,14 @@
 #!/usr/bin/env node
+import {
+  runFetchGuard,
+  runFetchGuardSync
+} from "./chunk-I2J3IJB7.js";
+import {
+  buildDeleteIntent,
+  normalizeVaultRelPath,
+  pathToIntentFilename,
+  writeDeleteIntent
+} from "./chunk-QESNTTVY.js";
 import {
   CAPTURE_HYGIENE_CONTRACT,
   DEFAULT_CAPTURE_BUDGET,
@@ -65,7 +75,15 @@ import {
   upsertIndexEntry,
   vectorIndexStatus,
   withMcpClient
-} from "./chunk-LDEZQXH6.js";
+} from "./chunk-OJJBZDPR.js";
+import {
+  applySourceDisposition,
+  decodeSourceActionApproval,
+  encodeSourceActionApproval,
+  inventorySources,
+  planSourceDisposition,
+  runSourcesPending
+} from "./chunk-JQV5KNPT.js";
 import {
   normalizeDistTag,
   readCache,
@@ -78,7 +96,7 @@ import {
   UNMANAGED_START,
   renderRootIndex,
   writeRootIndexProjection
-} from "./chunk-DTTKCCQ4.js";
+} from "./chunk-MRPJ7X7W.js";
 import {
   FLEET_REL_PATH,
   REDACTED_MALFORMED_REFERENCE,
@@ -118,13 +136,10 @@ import {
   normalizeProjectSlug,
   normalizeRemoteRoot,
   parseActiveWorkPath,
-  parseDotenvFile,
-  parseDotenvText,
   parseJournalEnv,
   planAndMaybePruneRemoteObjects,
   planRawStructuralMove,
   probeS3Reachability,
-  profileKey,
   readJournal,
   readLastOp,
   readSkillWikiConfig,
@@ -135,7 +150,6 @@ import {
   resolveFleetHostId,
   resolveInitTimePath,
   resolveRuntimePath,
-  resolveSkillwikiHome,
   resolveWikiS3Remote,
   rewriteRawSourceReferences,
   runAudit,
@@ -169,22 +183,8 @@ import {
   snapshotterAliasForLocalHost,
   stageVaultContentChanges,
   supersedeStaleReviewRequiredJournals,
-  taxonomyCommentForPage,
-  writeDotenv
-} from "./chunk-FYAKMULW.js";
-import {
-  assertTargetInsideVault,
-  atomicWriteText,
-  prepareTypedPage
-} from "./chunk-HMHMCPCE.js";
-import {
-  applySourceDisposition,
-  decodeSourceActionApproval,
-  encodeSourceActionApproval,
-  inventorySources,
-  planSourceDisposition,
-  runSourcesPending
-} from "./chunk-QU2IXZRN.js";
+  taxonomyCommentForPage
+} from "./chunk-HBJLFPQP.js";
 import {
   authorizeRawOperation,
   buildSourceReferenceIndex,
@@ -201,31 +201,54 @@ import {
   resolveExistingRegularFileInsideVault,
   validateLogEvent,
   writeLogEvent
-} from "./chunk-JCDAEZVD.js";
+} from "./chunk-5IBLXGLY.js";
+import {
+  assertTargetInsideVault,
+  prepareTypedPage
+} from "./chunk-I6IRJCUJ.js";
 import {
-  ExitCode,
-  MetaSchema,
-  RawSourceSchema,
-  TypedKnowledgeSchema,
-  detectSchema,
-  err,
   extractFrontmatter,
-  isBlockedHost,
   mapWithConcurrency,
-  ok,
   readPage,
   readPageCached,
   redactSensitiveContent,
   resolveReadOnlyVaultRoot,
-  resolveSessionKind,
   scanSensitiveContent,
   scanVault,
   splitFrontmatter,
   vaultIoConcurrency
-} from "./chunk-GJC2CI3W.js";
+} from "./chunk-X5GL2FCU.js";
+import {
+  CLIP_MIGRATION_HINT,
+  refreshInstalledClipPlist
+} from "./chunk-TDBUJUYH.js";
+import {
+  CLIP_NOT_CONFIGURED,
+  loadClipOutboxConfig
+} from "./chunk-6OQLBNKR.js";
+import {
+  parseDotenvFile,
+  parseDotenvText,
+  profileKey,
+  resolveSkillwikiHome,
+  writeDotenv
+} from "./chunk-PYPPG7RF.js";
+import {
+  atomicWriteText
+} from "./chunk-GQWCTJTU.js";
+import {
+  ExitCode,
+  MetaSchema,
+  RawSourceSchema,
+  TypedKnowledgeSchema,
+  detectSchema,
+  err,
+  ok,
+  resolveSessionKind
+} from "./chunk-UIEQIJXP.js";
 
 // src/cli.ts
-import { join as join45 } from "path";
+import { join as join44 } from "path";
 import { Command } from "commander";
 
 // src/utils/output.ts
@@ -341,48 +364,6 @@ async function runHash(input) {
   };
 }
 
-// src/commands/fetch-guard.ts
-var REDACT_PARAMS = /* @__PURE__ */ new Set(["api_key", "token", "key", "auth", "password", "secret", "access_token"]);
-var PATH_TOKEN_RE = /[A-Fa-f0-9]{32,}|[A-Za-z0-9_\-]{40,}/g;
-function runFetchGuard(input) {
-  return Promise.resolve(runFetchGuardSync(input));
-}
-function runFetchGuardSync(input) {
-  let u;
-  try {
-    u = new URL(input.url);
-  } catch {
-    return { exitCode: ExitCode.MALFORMED_URL, result: err("MALFORMED_URL", { url: input.url }) };
-  }
-  const sanitized = sanitizeUrl(u);
-  if (u.protocol !== "https:") {
-    return {
-      exitCode: ExitCode.SCHEME_REJECTED,
-      result: err("SCHEME_REJECTED", { sanitized_url: sanitized, scheme: u.protocol })
-    };
-  }
-  if (isBlockedHost(u.hostname)) {
-    return {
-      exitCode: ExitCode.HOST_BLOCKED,
-      result: err("HOST_BLOCKED", { sanitized_url: sanitized, host: u.hostname })
-    };
-  }
-  return { exitCode: ExitCode.OK, result: ok({ allowed: true, sanitized_url: sanitized, humanHint: `ALLOWED: ${sanitized}` }) };
-}
-function sanitizeUrl(u) {
-  const clone = new URL(u.toString());
-  if (clone.username || clone.password) {
-    clone.username = "";
-    clone.password = "";
-  }
-  for (const k of Array.from(clone.searchParams.keys())) {
-    if (REDACT_PARAMS.has(k.toLowerCase())) clone.searchParams.set(k, "REDACTED");
-  }
-  let s = clone.toString();
-  s = s.replace(PATH_TOKEN_RE, "REDACTED");
-  return s;
-}
-
 // src/commands/eval.ts
 import { execFileSync } from "child_process";
 import { existsSync, mkdtempSync, rmSync } from "fs";
@@ -1288,7 +1269,7 @@ gitignore: ${gi.written ? "merged" : "unchanged"} (write-gitignore only)`,
     skipEnv ? "env: skipped" : `env: ${envWritten}`,
     input.noGitignore ? "gitignore: skipped" : `gitignore: ${gitignoreWritten ? "written" : "unchanged"}`,
     `web clipper template: ${WEB_CLIPPER_TEMPLATE_REL}`,
-    "web clipper import: open Obsidian Web Clipper Settings and import the JSON in each browser profile"
+    "web clipper import: create ~/Obsidian/clip-outbox (not ~/wiki), import the JSON in each browser profile, select that outbox vault, keep Add to Obsidian"
   ].join("\n");
   if (created.length > 0) {
     appendLastOp(target, {
@@ -3587,6 +3568,92 @@ async function runHealth(input) {
   return { exitCode, result: ok(report) };
 }
 
+// src/commands/clip-outbox.ts
+async function runClipOutboxStatus(home) {
+  const resolved = await loadClipOutboxConfig(home);
+  if (!resolved.ok) {
+    return {
+      exitCode: ExitCode.INVALID_CONFIG_VALUE,
+      result: err("INVALID_CONFIG_VALUE", { message: resolved.message })
+    };
+  }
+  if (!resolved.enabled) {
+    return {
+      exitCode: ExitCode.OK,
+      result: ok({ enabled: false, humanHint: CLIP_NOT_CONFIGURED })
+    };
+  }
+  const { readJournal: readJournal2 } = await import("./journal-QU5IDXQF.js");
+  let queue;
+  try {
+    queue = (await readJournal2(resolved.config.stateRoot)).map(({ captureId, state, reason, attempts }) => ({ captureId, state, reason, attempts }));
+  } catch {
+    return { exitCode: ExitCode.PREFLIGHT_FAILED, result: err("PREFLIGHT_FAILED", { message: "clip journal unreadable; retain it for attended recovery" }) };
+  }
+  return {
+    exitCode: ExitCode.OK,
+    result: ok({
+      enabled: true,
+      queue,
+      humanHint: [`clip-outbox enabled root=${resolved.config.root} mode=${resolved.config.mode}`, ...queue.map((e) => `${e.captureId}: ${e.state}${e.reason ? ` (${e.reason})` : ""}; attempts=${e.attempts ?? 0}`)].join("\n")
+    })
+  };
+}
+async function runClipOutboxInstall(input) {
+  try {
+    const { migrateClipOutbox } = await import("./migrate-PIB4QA54.js");
+    return { exitCode: ExitCode.OK, result: ok(await migrateClipOutbox(input)) };
+  } catch (e) {
+    return { exitCode: ExitCode.PREFLIGHT_FAILED, result: err("PREFLIGHT_FAILED", { message: e instanceof Error ? e.message : "clip migration failed" }) };
+  }
+}
+async function runClipOutboxWatch(home) {
+  const resolved = await loadClipOutboxConfig(home);
+  if (!resolved.ok || !resolved.enabled) return { exitCode: ExitCode.INVALID_CONFIG_VALUE, result: err("INVALID_CONFIG_VALUE", { message: resolved.ok ? CLIP_NOT_CONFIGURED : resolved.message }) };
+  if (process.platform !== "darwin") return { exitCode: ExitCode.PREFLIGHT_FAILED, result: err("PREFLIGHT_FAILED", { message: "clip-outbox watch requires macOS FSEvents" }) };
+  let client;
+  try {
+    const { S3Client: S3Client3 } = await import("@aws-sdk/client-s3");
+    const { loadClipCredentials, validateRuntime } = await import("./runtime-GLMI5OCT.js");
+    const { createS3CreateOnlyPut, parseDestination } = await import("./upload-HTE62TOV.js");
+    const { postReadyHint } = await import("./ready-S7F53Q2D.js");
+    const { startClipWorker } = await import("./watcher-MHG46J3R.js");
+    const cfg = resolved.config;
+    const credentials = await loadClipCredentials(home, cfg);
+    await validateRuntime(home, cfg, credentials.s3.endpoint);
+    const destination = parseDestination(cfg.destination);
+    client = new S3Client3({ endpoint: credentials.s3.endpoint, region: credentials.s3.region, credentials: credentials.s3, forcePathStyle: true, maxAttempts: 1 });
+    let finish;
+    const done = new Promise((r) => {
+      finish = r;
+    });
+    let failed = false;
+    const worker = await startClipWorker(cfg, {
+      put: createS3CreateOnlyPut({ client, bucket: destination.bucket, prefix: destination.prefix }),
+      ready: (hint) => postReadyHint({ url: cfg.readyUrl, token: credentials.readyToken, hint }),
+      validate: () => validateRuntime(home, cfg, credentials.s3.endpoint),
+      onError: () => {
+        failed = true;
+        finish();
+      }
+    });
+    process.once("SIGTERM", finish);
+    process.once("SIGINT", finish);
+    try {
+      await done;
+    } finally {
+      process.removeListener("SIGTERM", finish);
+      process.removeListener("SIGINT", finish);
+      await worker.stop();
+    }
+    return failed ? { exitCode: ExitCode.PREFLIGHT_FAILED, result: err("PREFLIGHT_FAILED", { message: "clip worker stopped; inspect configuration and retained journal" }) } : { exitCode: ExitCode.OK, result: ok({ humanHint: "Clip worker stopped; snapshots and journal retained." }) };
+  } catch {
+    return { exitCode: ExitCode.PREFLIGHT_FAILED, result: err("PREFLIGHT_FAILED", { message: "clip worker startup failed; check configuration, protected credential references, conditional-create evidence and worker lock" }) };
+  } finally {
+    client?.destroy();
+  }
+}
+
 // src/commands/connect.ts
 import { chmod, mkdir as mkdir5, readFile as readFile6, stat as stat3 } from "fs/promises";
 import { join as join18 } from "path";
@@ -3896,50 +3963,8 @@ async function runConnect(input) {
 }
 
 // src/commands/archive.ts
-import { rename as rename2, mkdir as mkdir7, readFile as readFile8 } from "fs/promises";
-import { join as join20, dirname as dirname5 } from "path";
-
-// src/utils/delete-intent.ts
-import { mkdir as mkdir6, writeFile as writeFile4, readdir as readdir4, readFile as readFile7 } from "fs/promises";
-import { join as join19 } from "path";
-var DELETE_INTENT_SCHEMA = "vault-delete-intent/v1";
-var DELETE_INTENT_DIR = "meta/delete-intents";
-function normalizeVaultRelPath(path) {
-  const p = path.replace(/\\/g, "/").replace(/^\/+/, "");
-  if (!p || p.includes("..") || p.startsWith(".git/")) {
-    throw new Error(`invalid vault-relative path: ${path}`);
-  }
-  return p;
-}
-function pathToIntentFilename(path) {
-  const p = normalizeVaultRelPath(path);
-  return `${p.replace(/\//g, "__")}.json`;
-}
-function intentHostId() {
-  return process.env.SKILLWIKI_HOST_ID ?? process.env.AGENT_HOST_ID ?? "unknown";
-}
-function buildDeleteIntent(input) {
-  return {
-    schema: DELETE_INTENT_SCHEMA,
-    path: normalizeVaultRelPath(input.path),
-    action: input.action,
-    created: input.created ?? (/* @__PURE__ */ new Date()).toISOString(),
-    host: input.host ?? intentHostId(),
-    actor: input.actor,
-    reason: input.reason,
-    source: input.source,
-    expires: input.expires ?? null
-  };
-}
-async function writeDeleteIntent(vault, intent) {
-  const dir = join19(vault, DELETE_INTENT_DIR);
-  await mkdir6(dir, { recursive: true });
-  const rel = `${DELETE_INTENT_DIR}/${pathToIntentFilename(intent.path)}`;
-  await writeFile4(join19(vault, rel), JSON.stringify(intent, null, 2) + "\n", "utf8");
-  return rel;
-}
-
-// src/commands/archive.ts
+import { rename as rename2, mkdir as mkdir6, readFile as readFile7 } from "fs/promises";
+import { join as join19, dirname as dirname5 } from "path";
 function countWikilinks(body, slug) {
   const escaped = slug.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const re = new RegExp(`\\[\\[${escaped}(?:[|#][^\\]]*)?\\]\\]`, "g");
@@ -3975,7 +4000,7 @@ async function runArchive(input) {
   const slug = relPath.replace(/\.md$/, "").split("/").pop();
   const rawArchive = isRaw ? lifecycleDestination(relPath, "archive") : void 0;
   if (rawArchive && !rawArchive.ok) return { exitCode: ExitCode.USAGE, result: rawArchive };
-  const archivePath = isRaw ? rawArchive.data : join20("_archive", relPath).replace(/\\/g, "/");
+  const archivePath = isRaw ? rawArchive.data : join19("_archive", relPath).replace(/\\/g, "/");
   const remoteRoot = normalizeRemoteRoot(input.remote);
   const remoteObjectPath = buildRemoteObjectPath(remoteRoot, relPath);
   let cascade;
@@ -4005,7 +4030,7 @@ async function runArchive(input) {
     const indexRefs = [];
     if (!isRaw) {
       try {
-        const idx = await readFile8(join20(input.vault, "index.md"), "utf8");
+        const idx = await readFile7(join19(input.vault, "index.md"), "utf8");
         idx.split("\n").forEach((line, i) => {
           if (line.includes(`[[${slug}]]`)) indexRefs.push({ line: i + 1, text: line });
         });
@@ -4063,8 +4088,8 @@ async function runArchive(input) {
   const rewrittenCascadePages = [];
   if ((input.cascade || isRaw) && input.apply && cascade) {
     for (const ref of cascade.source_array_refs) {
-      const absPath = join20(input.vault, ref.page);
-      const text = await readFile8(absPath, "utf8");
+      const absPath = join19(input.vault, ref.page);
+      const text = await readFile7(absPath, "utf8");
       if (!arraysEqual(ref.sources_after, ref.sources_before)) {
         let updated;
         if (isRaw) {
@@ -4090,8 +4115,8 @@ ${fmRewritten}
     if (isRaw) {
       for (const ref of cascade.citation_refs) {
         if (cascade.source_array_refs.some((sourceRef) => sourceRef.page === ref.page)) continue;
-        const absPath = join20(input.vault, ref.page);
-        const original = await readFile8(absPath, "utf8");
+        const absPath = join19(input.vault, ref.page);
+        const original = await readFile7(absPath, "utf8");
         const updated = rewriteRawSourceReferences(original, relPath, archivePath).text;
         if (updated !== original) {
           const write = await safeWritePage(absPath, updated);
@@ -4102,13 +4127,13 @@ ${fmRewritten}
     }
   }
   if (!isRaw) {
-    await mkdir7(dirname5(join20(input.vault, archivePath)), { recursive: true });
-    await rename2(join20(input.vault, relPath), join20(input.vault, archivePath));
+    await mkdir6(dirname5(join19(input.vault, archivePath)), { recursive: true });
+    await rename2(join19(input.vault, relPath), join19(input.vault, archivePath));
   }
   let indexUpdated = false;
   if (!isRaw) {
-    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-ESBJOBS7.js");
-    const before = await readFile8(join20(input.vault, "index.md"), "utf8").catch(() => "");
+    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-2K672CBO.js");
+    const before = await readFile7(join19(input.vault, "index.md"), "utf8").catch(() => "");
     const fullTarget = relPath.replace(/\.md$/, "");
     const bare = fullTarget.split("/").pop() ?? fullTarget;
     const hadIndexEntry = before.includes(`[[${fullTarget}]]`) || before.includes(`[[${bare}]]`);
@@ -4162,7 +4187,7 @@ ${fmRewritten}
 
 // src/commands/remove.ts
 import { unlink as unlink2, access } from "fs/promises";
-import { join as join21 } from "path";
+import { join as join20 } from "path";
 async function pathExists(abs) {
   try {
     await access(abs);
@@ -4188,7 +4213,7 @@ async function runRemove(input) {
   if (!relPath) {
     try {
       const candidate = normalizeVaultRelPath(input.page);
-      if (await pathExists(join21(input.vault, candidate))) {
+      if (await pathExists(join20(input.vault, candidate))) {
         relPath = candidate;
       }
     } catch {
@@ -4226,12 +4251,12 @@ async function runRemove(input) {
     reason: input.reason
   });
   const tombstonePath = await writeDeleteIntent(input.vault, intent);
-  await unlink2(join21(input.vault, relPath));
+  await unlink2(join20(input.vault, relPath));
   if (relPath.endsWith(".md") && !relPath.startsWith("raw/")) {
-    const { readFile: readFile24 } = await import("fs/promises");
+    const { readFile: readFile23 } = await import("fs/promises");
     const { join: pathJoin } = await import("path");
-    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-ESBJOBS7.js");
-    const before = await readFile24(pathJoin(input.vault, "index.md"), "utf8").catch(() => "");
+    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-2K672CBO.js");
+    const before = await readFile23(pathJoin(input.vault, "index.md"), "utf8").catch(() => "");
     const fullTarget = relPath.replace(/\.md$/, "");
     const bare = fullTarget.split("/").pop() ?? fullTarget;
     const hadIndexEntry = before.includes(`[[${fullTarget}]]`) || before.includes(`[[${bare}]]`);
@@ -4580,7 +4605,7 @@ ${migratedBody}${newFooter}`;
 
 // src/commands/update.ts
 import { execSync } from "child_process";
-import { join as join22 } from "path";
+import { join as join21 } from "path";
 function parseCoreSemver(version) {
   const m = version.match(/^(\d+)\.(\d+)\.(\d+)/);
   if (!m) return null;
@@ -4624,6 +4649,8 @@ function migrationNotesForUpgrade(previousVersion, newVersion) {
       "- frozen-leaf hosts write via HTTP MCP only; do not local-write raw/transcripts/ or vault git"
     );
   }
+  const next = parseCoreSemver(newVersion);
+  if (next && isAtLeast(next, 0, 10, 111)) notes.push(CLIP_MIGRATION_HINT);
   return notes;
 }
 function resolveGlobalSkillsRoot() {
@@ -4632,7 +4659,7 @@ function resolveGlobalSkillsRoot() {
       encoding: "utf8",
       timeout: 5e3
     }).trim();
-    return join22(globalRoot, "skillwiki", "skills");
+    return join21(globalRoot, "skillwiki", "skills");
   } catch {
     return null;
   }
@@ -4660,7 +4687,7 @@ async function runUpdate(input) {
   const pkg2 = readCliPackageJson();
   const currentVersion = pkg2.version;
   const tag = normalizeDistTag(input.distTag);
-  const target = join22(input.home, ".claude", "skills");
+  const target = join21(input.home, ".claude", "skills");
   let latest;
   try {
     latest = execSync(`npm view skillwiki@${tag} version`, {
@@ -4693,7 +4720,8 @@ async function runUpdate(input) {
         version_warnings: [],
         skills_refreshed: false,
         deferred_to_plugin: false,
-        humanHint: `Already on npm@${tag}: v${currentVersion}`
+        humanHint: `Already on npm@${tag}: v${currentVersion}
+${CLIP_MIGRATION_HINT}`
       })
     };
   }
@@ -4724,6 +4752,12 @@ async function runUpdate(input) {
   for (const line of migrationNotesForUpgrade(currentVersion, latest)) {
     hintLines.push(line);
   }
+  try {
+    const clipHint = await refreshInstalledClipPlist(input.home);
+    if (clipHint) hintLines.push(clipHint);
+  } catch (e) {
+    hintLines.push(`clip plist refresh skipped: ${e instanceof Error ? e.message : "migration failed"}`);
+  }
   return {
     exitCode: ExitCode.OK,
     result: ok({
@@ -4741,13 +4775,13 @@ async function runUpdate(input) {
 // src/commands/self-update.ts
 import { execSync as execSync2 } from "child_process";
 import { existsSync as existsSync8, readFileSync as readFileSync11 } from "fs";
-import { join as join23 } from "path";
+import { join as join22 } from "path";
 var DEFAULT_SOURCE_ROOT_SUFFIX = "/Desktop/code/llm-wiki";
 async function runSelfUpdate(input) {
   const currentVersion = readCliPackageJson().version;
   const sourceRoot = input.sourceRoot ?? `${input.home}${DEFAULT_SOURCE_ROOT_SUFFIX}`;
   const distTag = normalizeDistTag(input.distTag);
-  const localPkgPath = join23(sourceRoot, "packages", "cli", "package.json");
+  const localPkgPath = join22(sourceRoot, "packages", "cli", "package.json");
   const hasLocalSource = existsSync8(localPkgPath);
   if (input.check) {
     let availableVersion = null;
@@ -4879,21 +4913,21 @@ async function runSelfUpdate(input) {
 }
 
 // src/commands/transcripts.ts
-import { readdir as readdir5, stat as stat4, readFile as readFile10 } from "fs/promises";
-import { join as join24 } from "path";
+import { readdir as readdir4, stat as stat4, readFile as readFile9 } from "fs/promises";
+import { join as join23 } from "path";
 async function runTranscripts(input) {
-  const dir = join24(input.vault, "raw", "transcripts");
+  const dir = join23(input.vault, "raw", "transcripts");
   let entries;
   try {
-    entries = await readdir5(dir, { withFileTypes: true });
+    entries = await readdir4(dir, { withFileTypes: true });
   } catch {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: { ok: false, error: "VAULT_PATH_INVALID", detail: `raw/transcripts/ not found: ${dir}` } };
   }
   const transcripts = [];
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-    const filePath = join24(dir, entry.name);
-    const content = await readFile10(filePath, "utf8");
+    const filePath = join23(dir, entry.name);
+    const content = await readFile9(filePath, "utf8");
     const fm = extractFrontmatter(content);
     if (!fm.ok) continue;
     const ingested = typeof fm.data.ingested === "string" ? fm.data.ingested : "";
@@ -4910,8 +4944,8 @@ async function runTranscripts(input) {
 }
 
 // src/commands/claims-audit.ts
-import { readFile as readFile11 } from "fs/promises";
-import { join as join25 } from "path";
+import { readFile as readFile10 } from "fs/promises";
+import { join as join24 } from "path";
 function safeProjectPresentation(raw) {
   if (safeDiagnosticValue(raw) === REDACTED_MALFORMED_REFERENCE) {
     return REDACTED_MALFORMED_REFERENCE;
@@ -4951,9 +4985,9 @@ async function runClaimsAudit(input) {
     return !input.project || slugByDir.get(relDir) === input.project;
   });
   const claimSourceResults = await mapWithConcurrency(scopedSpecDirs, vaultIoConcurrency(), async (relDir) => {
-    const specPath = join25(input.vault, relDir, "spec.md");
+    const specPath = join24(input.vault, relDir, "spec.md");
     try {
-      const specText = await readFile11(specPath, "utf8");
+      const specText = await readFile10(specPath, "utf8");
       const fm = extractFrontmatter(specText);
       if (!fm.ok) return null;
       return {
@@ -5047,10 +5081,10 @@ async function runClaimsAudit(input) {
 }
 
 // src/commands/compound.ts
-import { writeFile as writeFile6, mkdir as mkdir8, readdir as readdir6, unlink as unlink3 } from "fs/promises";
-import { join as join26 } from "path";
+import { writeFile as writeFile5, mkdir as mkdir7, readdir as readdir5, unlink as unlink3 } from "fs/promises";
+import { join as join25 } from "path";
 import { existsSync as existsSync9 } from "fs";
-import { readFile as readFile12 } from "fs/promises";
+import { readFile as readFile11 } from "fs/promises";
 var RETRO_HEADING_RE = /^## \[(\d{4}-\d{2}-\d{2})(?:\s+[^\]]+)?\] retro \| loop cycle(?: (\d+))?: (.+)$/;
 var FIELD_RE = {
   improve: /^-\s+\*?\*?Improve:?\*?\*?\s*(.+)$/m,
@@ -5148,17 +5182,17 @@ function extractRetroFields(date, cycleName, block) {
   };
 }
 async function runCompound(input) {
-  const logPath = join26(input.vault, "log.md");
+  const logPath = join25(input.vault, "log.md");
   let logText;
   try {
-    logText = await readFile12(logPath, "utf8");
+    logText = await readFile11(logPath, "utf8");
   } catch {
     return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: logPath }) };
   }
   const entries = parseRetroEntries(logText);
   const promoted = [];
   const skipped = [];
-  const compoundDir = join26(input.vault, "projects", input.project, "compound");
+  const compoundDir = join25(input.vault, "projects", input.project, "compound");
   for (const entry of entries) {
     const generalizeValue = entry.generalize.trim();
     if (!/^yes/i.test(generalizeValue)) {
@@ -5166,7 +5200,7 @@ async function runCompound(input) {
       continue;
     }
     const slug = slugify(entry.cycleName);
-    const compoundPath = join26(compoundDir, `${slug}.md`);
+    const compoundPath = join25(compoundDir, `${slug}.md`);
     if (existsSync9(compoundPath)) {
       skipped.push(entry.date);
       continue;
@@ -5206,9 +5240,9 @@ async function runCompound(input) {
     const content = frontmatter + "\n" + body;
     if (!input.dryRun) {
       if (!existsSync9(compoundDir)) {
-        await mkdir8(compoundDir, { recursive: true });
+        await mkdir7(compoundDir, { recursive: true });
       }
-      await writeFile6(compoundPath, content, "utf8");
+      await writeFile5(compoundPath, content, "utf8");
     }
     promoted.push(`${slug}.md`);
   }
@@ -5227,7 +5261,7 @@ async function runCompound(input) {
   };
 }
 async function runCompoundDelete(input) {
-  const projectDir = join26(input.vault, "projects", input.project);
+  const projectDir = join25(input.vault, "projects", input.project);
   if (!existsSync9(projectDir)) {
     return {
       exitCode: ExitCode.PROJECT_NOT_FOUND,
@@ -5235,7 +5269,7 @@ async function runCompoundDelete(input) {
     };
   }
   const entryName = input.entry.replace(/\.md$/, "");
-  const compoundPath = join26(projectDir, "compound", `${entryName}.md`);
+  const compoundPath = join25(projectDir, "compound", `${entryName}.md`);
   if (!existsSync9(compoundPath)) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
@@ -5269,7 +5303,7 @@ knowledge.md regenerated`
   };
 }
 async function runCompoundList(input) {
-  const compoundDir = join26(input.vault, "projects", input.project, "compound");
+  const compoundDir = join25(input.vault, "projects", input.project, "compound");
   if (!existsSync9(compoundDir)) {
     return {
       exitCode: ExitCode.OK,
@@ -5284,7 +5318,7 @@ no compound directory found`
   }
   let dirents;
   try {
-    dirents = await readdir6(compoundDir, { withFileTypes: true });
+    dirents = await readdir5(compoundDir, { withFileTypes: true });
   } catch {
     return {
       exitCode: ExitCode.OK,
@@ -5300,10 +5334,10 @@ could not read compound directory`
   const entries = [];
   for (const dirent of dirents) {
     if (!dirent.isFile() || !dirent.name.endsWith(".md")) continue;
-    const filePath = join26(compoundDir, dirent.name);
+    const filePath = join25(compoundDir, dirent.name);
     let text;
     try {
-      text = await readFile12(filePath, "utf8");
+      text = await readFile11(filePath, "utf8");
     } catch {
       continue;
     }
@@ -5332,8 +5366,8 @@ no compound entries found`;
 }
 
 // src/commands/session-brief.ts
-import { mkdir as mkdir9, readFile as readFile13, writeFile as writeFile7 } from "fs/promises";
-import { join as join27, relative, sep } from "path";
+import { mkdir as mkdir8, readFile as readFile12, writeFile as writeFile6 } from "fs/promises";
+import { join as join26, relative, sep } from "path";
 var MAX_WORDS = 900;
 async function runSessionBrief(input) {
   const { root: scanRoot } = resolveReadOnlyVaultRoot(input.vault);
@@ -5447,7 +5481,7 @@ async function resolveProject(input) {
   const envProject = input.env?.SKILLWIKI_PROJECT;
   if (envProject) return envProject;
   const cwd = input.cwd ?? process.cwd();
-  const projectDotenv = await readProjectSlug(join27(cwd, ".skillwiki", ".env"));
+  const projectDotenv = await readProjectSlug(join26(cwd, ".skillwiki", ".env"));
   if (projectDotenv) return projectDotenv;
   const inferred = inferProjectFromPath(input.vault, cwd);
   if (inferred) return inferred;
@@ -5456,7 +5490,7 @@ async function resolveProject(input) {
 async function readProjectSlug(file) {
   let text;
   try {
-    text = await readFile13(file, "utf8");
+    text = await readFile12(file, "utf8");
   } catch {
     return void 0;
   }
@@ -5547,7 +5581,7 @@ async function loadTrendPages(typedPages, pathPattern) {
   return out;
 }
 async function loadSessionPins(vault, project) {
-  const text = await readIfExists(join27(vault, "meta", "session-pins.md"));
+  const text = await readIfExists(join26(vault, "meta", "session-pins.md"));
   if (!text) return [];
   const fm = extractFrontmatter(text);
   if (!fm.ok) return [];
@@ -5693,7 +5727,7 @@ function satelliteHealthWarning(health) {
   return null;
 }
 async function loadHealthWarnings(vault) {
-  const text = await readIfExists(join27(vault, ".skillwiki", "health.json"));
+  const text = await readIfExists(join26(vault, ".skillwiki", "health.json"));
   if (!text) return [];
   try {
     const parsed = JSON.parse(text);
@@ -5706,7 +5740,7 @@ async function loadHealthWarnings(vault) {
   }
 }
 async function loadMemoryTopics(vault, project) {
-  const text = await readIfExists(join27(vault, ".skillwiki", "memory", project, "topics.json"));
+  const text = await readIfExists(join26(vault, ".skillwiki", "memory", project, "topics.json"));
   if (!text) return [];
   try {
     const parsed = JSON.parse(text);
@@ -5731,18 +5765,18 @@ async function loadMemoryTopics(vault, project) {
   }
 }
 async function writeBriefArtifacts(vault, input) {
-  const metaPath = join27(vault, "meta", "latest-session-brief.md");
-  const cacheMdPath = join27(vault, ".skillwiki", "session-brief.md");
-  const cacheJsonPath = join27(vault, ".skillwiki", "session-brief.json");
-  await mkdir9(join27(vault, "meta"), { recursive: true });
-  await mkdir9(join27(vault, ".skillwiki"), { recursive: true });
+  const metaPath = join26(vault, "meta", "latest-session-brief.md");
+  const cacheMdPath = join26(vault, ".skillwiki", "session-brief.md");
+  const cacheJsonPath = join26(vault, ".skillwiki", "session-brief.json");
+  await mkdir8(join26(vault, "meta"), { recursive: true });
+  await mkdir8(join26(vault, ".skillwiki"), { recursive: true });
   const committed = renderCommittedBrief(input);
   const previousComparable = comparableBrief(await readIfExists(metaPath));
   const nextComparable = comparableBrief(committed);
   const materialChange = previousComparable !== nextComparable;
-  await writeFile7(metaPath, committed, "utf8");
-  await writeFile7(cacheMdPath, input.brief, "utf8");
-  await writeFile7(cacheJsonPath, `${JSON.stringify({
+  await writeFile6(metaPath, committed, "utf8");
+  await writeFile6(cacheMdPath, input.brief, "utf8");
+  await writeFile6(cacheJsonPath, `${JSON.stringify({
     project: input.project,
     brief: input.brief,
     word_count: input.wordCount,
@@ -5808,7 +5842,7 @@ function renderCommittedBrief(input) {
   ].filter((line) => line !== "").join("\n");
 }
 async function rebuildRootIndexProjection(vault) {
-  const before = await readIfExists(join27(vault, "index.md"));
+  const before = await readIfExists(join26(vault, "index.md"));
   if (!before) return false;
   const projection = await renderRootIndex({ vault, currentText: before });
   if (!projection.ok) return false;
@@ -5818,7 +5852,7 @@ async function rebuildRootIndexProjection(vault) {
 }
 async function readIfExists(path) {
   try {
-    return await readFile13(path, "utf8");
+    return await readFile12(path, "utf8");
   } catch {
     return "";
   }
@@ -5860,14 +5894,14 @@ function dateFromPath(path) {
 }
 
 // src/commands/ingest.ts
-import { readFile as readFile16, open, unlink as unlink4, mkdir as mkdir11 } from "fs/promises";
-import { join as join32 } from "path";
+import { readFile as readFile15, open, unlink as unlink4, mkdir as mkdir10 } from "fs/promises";
+import { join as join31 } from "path";
 import { createHash as createHash5 } from "crypto";
 
 // src/commands/page-publish.ts
 import { readFileSync as readFileSync13, realpathSync as realpathSync2 } from "fs";
-import { mkdir as mkdir10, readFile as readFile15 } from "fs/promises";
-import { dirname as dirname8, join as join31, resolve as resolve4 } from "path";
+import { mkdir as mkdir9, readFile as readFile14 } from "fs/promises";
+import { dirname as dirname8, join as join30, resolve as resolve4 } from "path";
 
 // src/utils/publication-approval.ts
 import { createHash as createHash4 } from "crypto";
@@ -6095,8 +6129,8 @@ function redactApprovalTokens(text) {
 }
 
 // src/publish/pipeline.ts
-import { readFile as readFile14 } from "fs/promises";
-import { dirname as dirname7, join as join30, resolve as resolve3 } from "path";
+import { readFile as readFile13 } from "fs/promises";
+import { dirname as dirname7, join as join29, resolve as resolve3 } from "path";
 
 // src/utils/publication-operation-journal.ts
 import {
@@ -6109,7 +6143,7 @@ import {
   unlinkSync,
   writeFileSync as writeFileSync5
 } from "fs";
-import { dirname as dirname6, join as join28 } from "path";
+import { dirname as dirname6, join as join27 } from "path";
 var PUBLICATION_JOURNAL_SCHEMA = "skillwiki-publication-operation-v1";
 var PHASE_ORDER2 = [
   "locked",
@@ -6138,16 +6172,16 @@ function vaultIdentity(vaultPath) {
   return sha256Hex(real).slice(0, 16);
 }
 function publicationJournalRoot(home = resolveSkillwikiHome()) {
-  return join28(resolveSkillwikiHome(home), ".skillwiki", "publication-operations");
+  return join27(resolveSkillwikiHome(home), ".skillwiki", "publication-operations");
 }
 function resolveJournalPaths(vaultPath, operationId2, home = resolveSkillwikiHome()) {
   const identity = vaultIdentity(vaultPath);
   const rootDir = publicationJournalRoot(home);
-  const vaultDir = join28(rootDir, identity);
+  const vaultDir = join27(rootDir, identity);
   return {
     rootDir,
     vaultDir,
-    journalPath: join28(vaultDir, `${operationId2}.json`)
+    journalPath: join27(vaultDir, `${operationId2}.json`)
   };
 }
 function ensurePrivateDir(dir) {
@@ -6368,7 +6402,7 @@ function completePublicationJournal(input) {
 }
 
 // src/publish/hold-gates.ts
-import { join as join29 } from "path";
+import { join as join28 } from "path";
 function evaluateSchemaGate(content, target, publisherKind) {
   const frontmatter = extractFrontmatter(content);
   if (!frontmatter.ok) return false;
@@ -6404,7 +6438,7 @@ function evaluateSchemaGate(content, target, publisherKind) {
   return false;
 }
 function evaluateBrokenWikilinkGate(body, scan, ownTarget) {
-  const draftPage = { absPath: join29(scan.root, ownTarget), relPath: ownTarget };
+  const draftPage = { absPath: join28(scan.root, ownTarget), relPath: ownTarget };
   const resolver = buildWikilinkResolver([...scan.allMarkdown, draftPage]);
   const wikilinks = extractBodyWikilinks(body);
   for (const link of wikilinks) {
@@ -6591,7 +6625,7 @@ function phaseAtLeast(current, needed) {
 }
 async function readPageChanged(targetPath, content) {
   try {
-    return ok(await readFile14(targetPath, "utf8") !== content);
+    return ok(await readFile13(targetPath, "utf8") !== content);
   } catch (error) {
     if (error.code === "ENOENT") return ok(true);
     return err("WRITE_FAILED", { path: targetPath, message: String(error) });
@@ -6599,7 +6633,7 @@ async function readPageChanged(targetPath, content) {
 }
 async function readPriorTargetSha(targetPath) {
   try {
-    const text = await readFile14(targetPath, "utf8");
+    const text = await readFile13(targetPath, "utf8");
     return ok(sha256Hex(text));
   } catch (error) {
     if (error.code === "ENOENT") return ok("absent");
@@ -6632,10 +6666,10 @@ function successReceipt(strategy, prepared, details) {
   };
 }
 async function runPipelinePreview(strategy, prepared, vault) {
-  const schemaPath = join30(vault, "SCHEMA.md");
+  const schemaPath = join29(vault, "SCHEMA.md");
   let schemaText;
   try {
-    schemaText = await readFile14(schemaPath, "utf8");
+    schemaText = await readFile13(schemaPath, "utf8");
   } catch (error) {
     const result = err("FILE_NOT_FOUND", { path: schemaPath, message: String(error) });
     return { exitCode: ExitCode.FILE_NOT_FOUND, result };
@@ -6659,10 +6693,10 @@ async function runPipelinePreview(strategy, prepared, vault) {
   if (!indices.ok) {
     return { exitCode: indices.exitCode, result: indices.result };
   }
-  const logPath = join30(vault, "log.md");
+  const logPath = join29(vault, "log.md");
   let logAppended;
   try {
-    const logText = await readFile14(logPath, "utf8");
+    const logText = await readFile13(logPath, "utf8");
     const marker = strategy.publisherKind === "page" ? `<!-- skillwiki-page-publish:${prepared.operationId} -->` : `<!-- skillwiki-project-page-publish:${prepared.operationId} -->`;
     logAppended = !logText.includes(marker);
   } catch (error) {
@@ -6753,10 +6787,10 @@ async function runPipelineLockedPrimaryStages(strategy, prepared, vault, deps, j
       return { ok: false, exitCode: ExitCode.WRITE_FAILED, stage: "journal", state, cause: journalHook };
     }
   }
-  const schemaPath = join30(vault, "SCHEMA.md");
+  const schemaPath = join29(vault, "SCHEMA.md");
   let schemaText;
   try {
-    schemaText = await readFile14(schemaPath, "utf8");
+    schemaText = await readFile13(schemaPath, "utf8");
   } catch (error) {
     return {
       ok: false,
@@ -6805,8 +6839,8 @@ async function runPipelineLockedPrimaryStages(strategy, prepared, vault, deps, j
   if (!strategy.usesJournal || !phaseAtLeast(currentPhase, "page")) {
     if (strategy.publisherKind === "project-page") {
       try {
-        const { mkdir: mkdir14 } = await import("fs/promises");
-        await mkdir14(dirname7(prepared.targetPath), { recursive: true });
+        const { mkdir: mkdir13 } = await import("fs/promises");
+        await mkdir13(dirname7(prepared.targetPath), { recursive: true });
       } catch (error) {
         return {
           ok: false,
@@ -6854,8 +6888,8 @@ async function runPipelineLockedPrimaryStages(strategy, prepared, vault, deps, j
     let visibleSchema;
     try {
       [visible, visibleSchema] = await Promise.all([
-        readFile14(prepared.targetPath, "utf8"),
-        readFile14(schemaPath, "utf8")
+        readFile13(prepared.targetPath, "utf8"),
+        readFile13(schemaPath, "utf8")
       ]);
     } catch (error) {
       return {
@@ -7247,16 +7281,16 @@ async function refreshProjectIndexForTarget(vault, projectSlugs, today) {
   for (const slug of projectSlugs) {
     const rendered = await renderProjectIndex(vault, slug, { today });
     if (!rendered.ok) return rendered;
-    const indexPath = join31(vault, rendered.data.index_path);
+    const indexPath = join30(vault, rendered.data.index_path);
     try {
-      await mkdir10(dirname8(indexPath), { recursive: true });
+      await mkdir9(dirname8(indexPath), { recursive: true });
     } catch (error) {
       return err("WRITE_FAILED", { path: indexPath, message: String(error) });
     }
     const written = await atomicWriteText(indexPath, rendered.data.text);
     if (!written.ok) return written;
     try {
-      const visible = await readFile15(indexPath, "utf8");
+      const visible = await readFile14(indexPath, "utf8");
       if (visible !== rendered.data.text) {
         return err("WRITE_FAILED", { path: indexPath, message: "project index verification failed" });
       }
@@ -7357,7 +7391,7 @@ function preparePagePublicationFromContent(input) {
 async function preparePagePublication(input) {
   let content;
   try {
-    content = await readFile15(input.draftPath, "utf8");
+    content = await readFile14(input.draftPath, "utf8");
   } catch (error) {
     return err("FILE_NOT_FOUND", { path: input.draftPath, message: String(error) });
   }
@@ -7445,10 +7479,10 @@ var PAGE_PUBLISH_STRATEGY = {
     return void 0;
   },
   async previewIndices(prepared, vault, pageChanged) {
-    const indexPath = join31(vault, "index.md");
+    const indexPath = join30(vault, "index.md");
     let indexText;
     try {
-      indexText = await readFile15(indexPath, "utf8");
+      indexText = await readFile14(indexPath, "utf8");
     } catch (error) {
       const result = err("FILE_NOT_FOUND", { path: indexPath, message: String(error) });
       return { ok: false, exitCode: ExitCode.FILE_NOT_FOUND, result };
@@ -7466,7 +7500,7 @@ var PAGE_PUBLISH_STRATEGY = {
       if (!renderedProject.ok) {
         return { ok: false, exitCode: errorExitCode(renderedProject.error), result: renderedProject };
       }
-      const projectIndexPath = join31(vault, renderedProject.data.index_path);
+      const projectIndexPath = join30(vault, renderedProject.data.index_path);
       const projectIndexChanged = await readPageChanged(projectIndexPath, renderedProject.data.text);
       if (!projectIndexChanged.ok) {
         return { ok: false, exitCode: errorExitCode(projectIndexChanged.error), result: projectIndexChanged };
@@ -7654,7 +7688,7 @@ function buildTypedContent(title, ingested, type, tags, rawRelPath, provenance)
 }
 async function resolveRawCapture(input) {
   try {
-    const existing = await readFile16(input.path, "utf8");
+    const existing = await readFile15(input.path, "utf8");
     const frontmatter = extractFrontmatter(existing);
     if (!frontmatter.ok) {
       return err("INGEST_VALIDATION_FAILED", {
@@ -7793,7 +7827,7 @@ async function runIngest(input, pagePublishDeps = defaultPagePublishDeps()) {
     sourceContent = fetchResult.data.body;
   } else {
     try {
-      sourceContent = await readFile16(input.source, "utf8");
+      sourceContent = await readFile15(input.source, "utf8");
     } catch {
       return {
         exitCode: ExitCode.FILE_NOT_FOUND,
@@ -7818,7 +7852,7 @@ async function runIngest(input, pagePublishDeps = defaultPagePublishDeps()) {
   const rawRelPath = `raw/articles/${slug}.md`;
   const typedDir = TYPE_DIR[input.type] ?? `${input.type}s`;
   const typedRelPath = `${typedDir}/${slug}.md`;
-  const rawAbsPath = join32(input.vault, rawRelPath);
+  const rawAbsPath = join31(input.vault, rawRelPath);
   const identity = assessSourceIdentity({
     rawPath: rawRelPath,
     sourceUrl: sourceUrl ?? void 0,
@@ -7862,11 +7896,11 @@ async function runIngest(input, pagePublishDeps = defaultPagePublishDeps()) {
   );
   if (!input.dryRun) {
     try {
-      await mkdir11(join32(input.vault, typedDir), { recursive: true });
+      await mkdir10(join31(input.vault, typedDir), { recursive: true });
     } catch (error) {
       return {
         exitCode: ExitCode.WRITE_FAILED,
-        result: err("WRITE_FAILED", { path: join32(input.vault, typedDir), message: String(error) })
+        result: err("WRITE_FAILED", { path: join31(input.vault, typedDir), message: String(error) })
       };
     }
   }
@@ -7920,11 +7954,11 @@ async function runIngest(input, pagePublishDeps = defaultPagePublishDeps()) {
     preflight: pagePublishDeps.preflight,
     mutate: async (receipt) => {
       try {
-        await mkdir11(join32(input.vault, "raw", "articles"), { recursive: true });
+        await mkdir10(join31(input.vault, "raw", "articles"), { recursive: true });
       } catch (error) {
         return {
           exitCode: ExitCode.WRITE_FAILED,
-          result: err("WRITE_FAILED", { path: join32(input.vault, "raw", "articles"), message: String(error) })
+          result: err("WRITE_FAILED", { path: join31(input.vault, "raw", "articles"), message: String(error) })
         };
       }
       const rawWrite = await writeResolvedRaw({
@@ -8160,8 +8194,8 @@ ${body}`;
 }
 
 // src/commands/tag-reconcile.ts
-import { readFile as readFile17 } from "fs/promises";
-import { join as join33, posix } from "path";
+import { readFile as readFile16 } from "fs/promises";
+import { join as join32, posix } from "path";
 var TYPED_TARGET_RE = /^(entities|concepts|comparisons|queries|meta)\/[a-z0-9][a-z0-9./_-]*\.md$/;
 function errorExitCode2(error) {
   switch (error) {
@@ -8204,7 +8238,7 @@ function asTagArray(frontmatter, path) {
 async function readTagsFromFile(path) {
   let text;
   try {
-    text = await readFile17(path, "utf8");
+    text = await readFile16(path, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") {
       return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path }) };
@@ -8225,7 +8259,7 @@ async function resolveRequestedTags(input, page) {
       result: err("INVALID_FRONTMATTER", { message: "explicit tags must be an array of strings" })
     };
   }
-  const source = input.from ?? (explicit.length === 0 ? join33(input.vault, page) : void 0);
+  const source = input.from ?? (explicit.length === 0 ? join32(input.vault, page) : void 0);
   if (!source) return { exitCode: ExitCode.OK, result: ok({ tags: [...new Set(explicit)].sort() }) };
   const sourced = await readTagsFromFile(source);
   if (!sourced.result.ok) return { exitCode: sourced.exitCode, result: sourced.result };
@@ -8236,7 +8270,7 @@ async function resolveRequestedTags(input, page) {
 }
 async function readSchema(schemaPath) {
   try {
-    return { exitCode: ExitCode.OK, result: ok(await readFile17(schemaPath, "utf8")) };
+    return { exitCode: ExitCode.OK, result: ok(await readFile16(schemaPath, "utf8")) };
   } catch (error) {
     if (error.code === "ENOENT") {
       return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: schemaPath }) };
@@ -8264,7 +8298,7 @@ function previewResult(page, tags, reconciled, dryRun, filesChanged) {
   };
 }
 async function reconcileTagsWhileLocked(input, page, tags, comment) {
-  const schemaPath = join33(input.vault, "SCHEMA.md");
+  const schemaPath = join32(input.vault, "SCHEMA.md");
   const current = await readSchema(schemaPath);
   if (!current.result.ok) return { exitCode: current.exitCode, result: current.result };
   const next = reconcileTaxonomyDocument(current.result.data, { tags, comment });
@@ -8275,7 +8309,7 @@ async function reconcileTagsWhileLocked(input, page, tags, comment) {
   }
   let verifiedText;
   try {
-    verifiedText = await readFile17(schemaPath, "utf8");
+    verifiedText = await readFile16(schemaPath, "utf8");
   } catch (error) {
     return {
       exitCode: ExitCode.WRITE_FAILED,
@@ -8301,7 +8335,7 @@ async function runTagReconcile(input) {
   const comment = taxonomyCommentForPage(page.data, date, input.reason);
   if (!comment.ok) return { exitCode: ExitCode.SCHEME_REJECTED, result: comment };
   if (!input.write) {
-    const schema = await readSchema(join33(input.vault, "SCHEMA.md"));
+    const schema = await readSchema(join32(input.vault, "SCHEMA.md"));
     if (!schema.result.ok) return { exitCode: schema.exitCode, result: schema.result };
     const preview = reconcileTaxonomyDocument(schema.result.data, { tags, comment: comment.data });
     return previewResult(page.data, tags, preview, true, []);
@@ -8354,8 +8388,8 @@ async function runTagReconcile(input) {
 
 // src/commands/project-page-publish.ts
 import { realpathSync as realpathSync4 } from "fs";
-import { mkdir as mkdir12, readFile as readFile18 } from "fs/promises";
-import { dirname as dirname10, join as join34, resolve as resolve6 } from "path";
+import { mkdir as mkdir11, readFile as readFile17 } from "fs/promises";
+import { dirname as dirname10, join as join33, resolve as resolve6 } from "path";
 
 // src/utils/architecture-page.ts
 import { lstatSync, realpathSync as realpathSync3 } from "fs";
@@ -8527,7 +8561,7 @@ function validateLogNote(logNote) {
 async function prepareProjectPagePublication(input) {
   let content;
   try {
-    content = await readFile18(input.draftPath, "utf8");
+    content = await readFile17(input.draftPath, "utf8");
   } catch (error) {
     return err("FILE_NOT_FOUND", { path: input.draftPath, message: String(error) });
   }
@@ -8660,9 +8694,9 @@ var PROJECT_PAGE_PUBLISH_STRATEGY = {
   async updateIndicesLocked(prepared, vault, state, observe) {
     const rendered = await renderProjectIndex(vault, prepared.page.project, { today: prepared.date });
     if (!rendered.ok) return rendered;
-    const knowledgePath = join34(vault, rendered.data.index_path);
+    const knowledgePath = join33(vault, rendered.data.index_path);
     try {
-      await mkdir12(dirname10(knowledgePath), { recursive: true });
+      await mkdir11(dirname10(knowledgePath), { recursive: true });
     } catch (error) {
       return err("WRITE_FAILED", { message: String(error) });
     }
@@ -8671,7 +8705,7 @@ var PROJECT_PAGE_PUBLISH_STRATEGY = {
     state.projectIndexUpdated = knowledgeWrite.data.changed;
     if (state.projectIndexUpdated) state.changed.add(rendered.data.index_path);
     try {
-      const visibleIndex = await readFile18(knowledgePath, "utf8");
+      const visibleIndex = await readFile17(knowledgePath, "utf8");
       if (visibleIndex !== rendered.data.text) {
         return err("WRITE_FAILED", { message: "project knowledge.md verification failed" });
       }
@@ -8691,9 +8725,9 @@ var PROJECT_PAGE_PUBLISH_STRATEGY = {
     }
     let projectIndexChanged = true;
     if (projectIndex.ok) {
-      const indexPath = join34(vault, projectIndex.data.index_path);
+      const indexPath = join33(vault, projectIndex.data.index_path);
       try {
-        const existing = await readFile18(indexPath, "utf8");
+        const existing = await readFile17(indexPath, "utf8");
         projectIndexChanged = existing !== projectIndex.data.text || pageChanged;
       } catch {
         projectIndexChanged = true;
@@ -8853,7 +8887,7 @@ import { existsSync as existsSync11, writeFileSync as writeFileSync6, mkdirSync
 import { createHash as createHash6 } from "crypto";
 import { execSync as execSync3, spawn } from "child_process";
 import { platform as platform2 } from "os";
-import { join as join35, resolve as resolvePath } from "path";
+import { join as join34, resolve as resolvePath } from "path";
 var MAINTENANCE_SCHEMA_VERSION = 1;
 var MAINTENANCE_COMMAND = "snapshot-maintenance journal clear-stale";
 var REPAIR_COMMAND = "snapshot-maintenance projection-conflict repair";
@@ -8918,7 +8952,7 @@ async function runSnapshotMaintenanceDryRun(input) {
     audit(makeAuditEvent(input, fleetLoad.hostId, now, "refusal", "MAINTENANCE_WRONG_WORKTREE"));
     return { exitCode: ExitCode.PROTECTED_SNAPSHOTTER_WRITE_BLOCKED, result: refusalErr("MAINTENANCE_WRONG_WORKTREE", `requested path '${requested}' is not the configured snapshot worktree '${canonicalize(configuredWorktree)}'`) };
   }
-  if (!existsSync11(requested) || !existsSync11(join35(requested, ".git"))) {
+  if (!existsSync11(requested) || !existsSync11(join34(requested, ".git"))) {
     audit(makeAuditEvent(input, fleetLoad.hostId, now, "refusal", "MAINTENANCE_MISSING_GIT_REPO"));
     return { exitCode: ExitCode.PROTECTED_SNAPSHOTTER_WRITE_BLOCKED, result: refusalErr("MAINTENANCE_MISSING_GIT_REPO", `snapshot worktree is not a git repository: ${requested}`) };
   }
@@ -8998,14 +9032,14 @@ async function resolveLiveVault(input) {
   return resolved.ok ? canonicalize(resolved.data.path) : void 0;
 }
 function snapshotMaintenanceAuditLogPath(home) {
-  const stateDir = platform2() === "darwin" ? join35(home, "Library", "Application Support", "vault-sync") : join35(home, ".local", "state", "vault-sync");
-  return join35(stateDir, "snapshot-maintenance-audit.jsonl");
+  const stateDir = platform2() === "darwin" ? join34(home, "Library", "Application Support", "vault-sync") : join34(home, ".local", "state", "vault-sync");
+  return join34(stateDir, "snapshot-maintenance-audit.jsonl");
 }
 function defaultAuditSink(home) {
   return (event) => {
     try {
       const logPath = snapshotMaintenanceAuditLogPath(home);
-      mkdirSync4(join35(logPath, ".."), { recursive: true });
+      mkdirSync4(join34(logPath, ".."), { recursive: true });
       appendFileSync(logPath, JSON.stringify(event) + "\n", { encoding: "utf8" });
     } catch {
     }
@@ -9153,9 +9187,9 @@ function nonMergeSequencerActive(repo) {
   const gitDir = git(repo, ["rev-parse", "--absolute-git-dir"]);
   if (!gitDir) return false;
   for (const m of ["CHERRY_PICK_HEAD", "REVERT_HEAD"]) {
-    if (existsSync11(join35(gitDir, m))) return true;
+    if (existsSync11(join34(gitDir, m))) return true;
   }
-  return existsSync11(join35(gitDir, "rebase-merge")) || existsSync11(join35(gitDir, "rebase-apply"));
+  return existsSync11(join34(gitDir, "rebase-merge")) || existsSync11(join34(gitDir, "rebase-apply"));
 }
 function extraUnmergedPaths(unmerged) {
   const allow = new Set(PROJECTION_CONFLICT_ALLOWLIST);
@@ -9194,7 +9228,7 @@ async function authorizeRepairContext(input) {
     audit(makeAuditEvent(input, fleetLoad.hostId, now, "refusal", "MAINTENANCE_WRONG_WORKTREE", void 0, REPAIR_COMMAND));
     return { exitCode: ExitCode.PROTECTED_SNAPSHOTTER_WRITE_BLOCKED, result: refusalErr("MAINTENANCE_WRONG_WORKTREE", `requested path '${requested}' is not the configured snapshot worktree '${canonicalize(configuredWorktree)}'`) };
   }
-  if (!existsSync11(requested) || !existsSync11(join35(requested, ".git"))) {
+  if (!existsSync11(requested) || !existsSync11(join34(requested, ".git"))) {
     audit(makeAuditEvent(input, fleetLoad.hostId, now, "refusal", "MAINTENANCE_MISSING_GIT_REPO", void 0, REPAIR_COMMAND));
     return { exitCode: ExitCode.PROTECTED_SNAPSHOTTER_WRITE_BLOCKED, result: refusalErr("MAINTENANCE_MISSING_GIT_REPO", `snapshot worktree is not a git repository: ${requested}`) };
   }
@@ -9295,8 +9329,8 @@ async function performProjectionRepair(input, plan, audit, now) {
     return { exitCode: ExitCode.WRITE_FAILED, result: rendered };
   }
   try {
-    writeFileSync6(join35(plan.snapshot_worktree, "index.md"), rendered.data.index);
-    writeFileSync6(join35(plan.snapshot_worktree, "log.md"), rendered.data.log);
+    writeFileSync6(join34(plan.snapshot_worktree, "index.md"), rendered.data.index);
+    writeFileSync6(join34(plan.snapshot_worktree, "log.md"), rendered.data.log);
     gitStrict(plan.snapshot_worktree, ["add", "--", "index.md", "log.md"]);
     gitStrict(plan.snapshot_worktree, [
       "commit",
@@ -9404,7 +9438,7 @@ function releaseSnapshotFlock(handle) {
 
 // src/commands/backup.ts
 import { statSync as statSync3, readdirSync as readdirSync2, readFileSync as readFileSync15, mkdirSync as mkdirSync5, writeFileSync as writeFileSync7 } from "fs";
-import { join as join36, relative as relative3, dirname as dirname11 } from "path";
+import { join as join35, relative as relative3, dirname as dirname11 } from "path";
 import { PutObjectCommand, HeadObjectCommand, ListObjectsV2Command, GetObjectCommand, DeleteObjectsCommand } from "@aws-sdk/client-s3";
 
 // src/utils/s3-client.ts
@@ -9428,7 +9462,7 @@ var SKIP_DIRS = /* @__PURE__ */ new Set([".git", ".obsidian", "_archive", "node_
 function* walkMarkdown(dir, base) {
   for (const entry of readdirSync2(dir, { withFileTypes: true })) {
     if (SKIP_DIRS.has(entry.name)) continue;
-    const full = join36(dir, entry.name);
+    const full = join35(dir, entry.name);
     if (entry.isDirectory()) {
       yield* walkMarkdown(full, base);
     } else if (entry.name.endsWith(".md")) {
@@ -9451,7 +9485,7 @@ async function runBackupSync(input) {
   let failed = 0;
   const files = [...walkMarkdown(input.vault, input.vault)];
   for (const relPath of files) {
-    const absPath = join36(input.vault, relPath);
+    const absPath = join35(input.vault, relPath);
     const localStat = statSync3(absPath);
     let needsUpload = true;
     try {
@@ -9527,7 +9561,7 @@ async function runBackupRestore(input) {
     const objects = list.Contents ?? [];
     for (const obj of objects) {
       if (!obj.Key) continue;
-      const localPath = join36(target, obj.Key);
+      const localPath = join35(target, obj.Key);
       try {
         const localStat = statSync3(localPath);
         if (obj.LastModified && localStat.mtime > obj.LastModified) {
@@ -9574,8 +9608,8 @@ async function runBackupRestore(input) {
 
 // src/commands/status.ts
 import { existsSync as existsSync12, statSync as statSync4 } from "fs";
-import { readFile as readFile19 } from "fs/promises";
-import { join as join37 } from "path";
+import { readFile as readFile18 } from "fs/promises";
+import { join as join36 } from "path";
 var FUSE_NO_MIRROR_NOTE = "FUSE vault with no read mirror - status scan may be slow";
 async function runStatus(input) {
   if (!existsSync12(input.vault)) {
@@ -9614,7 +9648,7 @@ async function runStatus(input) {
   const compound = scan.data.compound.length;
   let schemaVersion = "v1";
   try {
-    const schemaContent = await readFile19(join37(scanRoot, "SCHEMA.md"), "utf8");
+    const schemaContent = await readFile18(join36(scanRoot, "SCHEMA.md"), "utf8");
     const versionMatch = schemaContent.match(/version:\s*["']?([^"'\s\n]+)/i);
     if (versionMatch) schemaVersion = versionMatch[1];
   } catch {
@@ -9682,13 +9716,13 @@ async function runStatus(input) {
 
 // src/commands/copy-status.ts
 import { existsSync as existsSync13, realpathSync as realpathSync5 } from "fs";
-import { isAbsolute as isAbsolute2, join as join39, relative as relative5, resolve as resolve8 } from "path";
+import { isAbsolute as isAbsolute2, join as join38, relative as relative5, resolve as resolve8 } from "path";
 
 // src/utils/fetch-projection.ts
-import { isAbsolute, join as join38, resolve as resolve7 } from "path";
+import { isAbsolute, join as join37, resolve as resolve7 } from "path";
 function inspectConfiguredFetchProjection(home) {
   if (!home) return { configured: false };
-  const config = readSkillWikiConfig(join38(home, ".skillwiki", ".env"));
+  const config = readSkillWikiConfig(join37(home, ".skillwiki", ".env"));
   const configured = config["vault_sync.fetch_projection"];
   if (!configured || configured === "none") return { configured: false };
   if (!isAbsolute(configured)) {
@@ -9699,7 +9733,7 @@ function inspectConfiguredFetchProjection(home) {
 
 // src/utils/live-drift.ts
 import { createHash as createHash7 } from "crypto";
-import { readFile as readFile20 } from "fs/promises";
+import { readFile as readFile19 } from "fs/promises";
 import { relative as relative4, sep as sep3 } from "path";
 
 // src/utils/git-promotion.ts
@@ -9744,7 +9778,7 @@ async function measureAuthoritativeLiveDrift(liveVault, projection) {
     const rel = relative4(liveVault, page.absPath).split(sep3).join("/");
     if (!isGitPromotablePath(rel)) continue;
     livePromotable.add(rel);
-    const bytes = await readFile20(page.absPath);
+    const bytes = await readFile19(page.absPath);
     if (projectionBlobs.get(rel) !== gitBlobOid(bytes)) content += 1;
   }
   for (const rel of projectionBlobs.keys()) {
@@ -9761,11 +9795,20 @@ async function measureAuthoritativeLiveDrift(liveVault, projection) {
 
 // src/copy-status/copy-status.ts
 function liveRecord(p) {
+  if (p.writable === false) {
+    return {
+      state: "blocked",
+      reachable: p.reachable,
+      writable: false,
+      blocked_reason: "s3_write_probe_failed",
+      detail: p.detail ?? "S3 write probe failed"
+    };
+  }
   if (p.unknown || p.reachable === void 0) {
     return { state: "unknown", reachable: p.reachable, detail: p.detail ?? "S3/MCP unmeasured" };
   }
   if (p.reachable) {
-    return { state: "ok", reachable: true, detail: p.detail ?? "S3 reachable" };
+    return { state: "ok", reachable: true, ...p.writable === true ? { writable: true } : {}, detail: p.detail ?? "S3 reachable" };
   }
   return { state: "unknown", reachable: false, detail: p.detail ?? "S3 unreachable" };
 }
@@ -9930,13 +9973,21 @@ function defaultCopyStatusDeps(input) {
   const projectionWarning = selection.configured ? `configured fetch projection ignored for Git status; using live vault${projectionProblem ? ` (${projectionProblem})` : ""}` : void 0;
   const invalidProjectionDetail = projectionProblem ?? "configured fetch projection is not a git repository";
   const gitRootProblem = () => {
-    if (!existsSync13(join39(gitVault, ".git"))) {
+    if (!existsSync13(join38(gitVault, ".git"))) {
       return "vault is not a git repository";
     }
     return void 0;
   };
   return {
     probeLive() {
+      if (input.s3Writable === false) {
+        return {
+          reachable: input.s3Ok,
+          writable: false,
+          detail: `MCP S3 write probe failed${input.s3WritableError ? ` (${input.s3WritableError})` : ""}`
+        };
+      }
+      if (input.s3Ok === true && input.s3Writable === true) return { reachable: true, writable: true, detail: "MCP S3 readable and writable" };
       if (input.s3Ok === true) return { reachable: true, detail: "MCP S3 ok" };
       if (input.s3Ok === false) return { reachable: false, detail: "MCP S3 not ok" };
       const remote = resolveWikiS3Remote({ home: input.home });
@@ -10002,7 +10053,7 @@ function defaultCopyStatusDeps(input) {
           detail: projectionProblem ?? "live drift requires a configured fetch projection"
         };
       }
-      if (!existsSync13(join39(configuredProjection, ".git"))) {
+      if (!existsSync13(join38(configuredProjection, ".git"))) {
         return {
           unknown: true,
           reason_code: "fetch_projection_invalid",
@@ -10022,8 +10073,8 @@ async function runCopyStatusCommand(input) {
 }
 
 // src/commands/seed.ts
-import { mkdir as mkdir13, writeFile as writeFile8, stat as stat5 } from "fs/promises";
-import { join as join40 } from "path";
+import { mkdir as mkdir12, writeFile as writeFile7, stat as stat5 } from "fs/promises";
+import { join as join39 } from "path";
 var TODAY = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
 var EXAMPLE_PAGES = {
   "entities/example-project.md": `---
@@ -10092,30 +10143,30 @@ Real sources are immutable after ingestion \u2014 never edit them.
 `;
 async function runSeed(input) {
   try {
-    await stat5(join40(input.vault, "SCHEMA.md"));
+    await stat5(join39(input.vault, "SCHEMA.md"));
   } catch {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { root: input.vault, reason: "SCHEMA.md missing \u2014 run `skillwiki init` first" }) };
   }
   const created = [];
   const skipped = [];
   for (const [relPath, content] of Object.entries(EXAMPLE_PAGES)) {
-    const absPath = join40(input.vault, relPath);
+    const absPath = join39(input.vault, relPath);
     try {
       await stat5(absPath);
       skipped.push(relPath);
     } catch {
-      await mkdir13(join40(absPath, ".."), { recursive: true });
-      await writeFile8(absPath, content, "utf8");
+      await mkdir12(join39(absPath, ".."), { recursive: true });
+      await writeFile7(absPath, content, "utf8");
       created.push(relPath);
     }
   }
-  const rawPath = join40(input.vault, "raw", "articles", "example-source.md");
+  const rawPath = join39(input.vault, "raw", "articles", "example-source.md");
   try {
     await stat5(rawPath);
     skipped.push("raw/articles/example-source.md");
   } catch {
-    await mkdir13(join40(rawPath, ".."), { recursive: true });
-    await writeFile8(rawPath, EXAMPLE_RAW, "utf8");
+    await mkdir12(join39(rawPath, ".."), { recursive: true });
+    await writeFile7(rawPath, EXAMPLE_RAW, "utf8");
     created.push("raw/articles/example-source.md");
   }
   if (created.length > 0) {
@@ -10137,9 +10188,9 @@ async function runSeed(input) {
 }
 
 // src/commands/canvas.ts
-import { readFile as readFile21, writeFile as writeFile9 } from "fs/promises";
+import { readFile as readFile20, writeFile as writeFile8 } from "fs/promises";
 import { existsSync as existsSync14 } from "fs";
-import { join as join41 } from "path";
+import { join as join40 } from "path";
 var NODE_WIDTH = 240;
 var NODE_HEIGHT = 60;
 var COLUMN_SPACING = 400;
@@ -10217,7 +10268,7 @@ function buildCanvasEdges(adjacency) {
   return edges;
 }
 async function runCanvasGenerate(input) {
-  const graphPath = input.graphPath ?? join41(input.vault, ".skillwiki", "graph.json");
+  const graphPath = input.graphPath ?? join40(input.vault, ".skillwiki", "graph.json");
   if (!existsSync14(graphPath)) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
@@ -10229,7 +10280,7 @@ async function runCanvasGenerate(input) {
   }
   let raw;
   try {
-    raw = await readFile21(graphPath, "utf8");
+    raw = await readFile20(graphPath, "utf8");
   } catch (e) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
@@ -10255,9 +10306,9 @@ async function runCanvasGenerate(input) {
   const nodes = buildCanvasNodes(paths);
   const edges = buildCanvasEdges(graph.adjacency);
   const canvas = { nodes, edges };
-  const outPath = join41(input.vault, "vault-graph.canvas");
+  const outPath = join40(input.vault, "vault-graph.canvas");
   try {
-    await writeFile9(outPath, JSON.stringify(canvas, null, 2));
+    await writeFile8(outPath, JSON.stringify(canvas, null, 2));
   } catch (e) {
     return {
       exitCode: ExitCode.WRITE_FAILED,
@@ -10400,22 +10451,22 @@ async function runSourceDisposition(input) {
 
 // src/utils/source-disposal.ts
 import { createHash as createHash8 } from "crypto";
-import { readFile as readFile23, unlink as unlink5 } from "fs/promises";
+import { readFile as readFile22, unlink as unlink5 } from "fs/promises";
 
 // src/utils/raw-asset-reference-index.ts
-import { readdir as readdir7, readFile as readFile22 } from "fs/promises";
-import { join as join42, relative as relative6, sep as sep4 } from "path";
+import { readdir as readdir6, readFile as readFile21 } from "fs/promises";
+import { join as join41, relative as relative6, sep as sep4 } from "path";
 var PREVIEW_EXTENSIONS = /* @__PURE__ */ new Set(["png", "jpg", "jpeg", "gif", "webp", "svg", "bmp", "avif", "pdf", "mp3", "wav", "m4a", "mp4", "webm"]);
 async function walkFiles(root, dir = root) {
   let entries;
   try {
-    entries = await readdir7(dir, { withFileTypes: true });
+    entries = await readdir6(dir, { withFileTypes: true });
   } catch {
     return [];
   }
   const out = [];
   for (const entry of entries) {
-    const path = join42(dir, entry.name);
+    const path = join41(dir, entry.name);
     if (entry.isDirectory()) out.push(...await walkFiles(root, path));
     else if (entry.isFile()) out.push(relative6(root, path).split(sep4).join("/"));
   }
@@ -10431,7 +10482,7 @@ function addInbound(map, target, source) {
   map.set(target, refs);
 }
 async function buildRawAssetReferenceIndex(vault) {
-  const assetRoot = join42(vault, "raw", "assets");
+  const assetRoot = join41(vault, "raw", "assets");
   const relativeAssets = await walkFiles(assetRoot);
   const assets = relativeAssets.map((path) => `raw/assets/${path}`).sort((a, b) => a.localeCompare(b));
   const assetSet = new Set(assets);
@@ -10447,7 +10498,7 @@ async function buildRawAssetReferenceIndex(vault) {
   for (const page of scan.data.allMarkdown) {
     let text;
     try {
-      text = await readFile22(page.absPath, "utf8");
+      text = await readFile21(page.absPath, "utf8");
     } catch {
       continue;
     }
@@ -10507,7 +10558,7 @@ async function planSourceDisposal(input) {
   if (sensitive.length > 0) return err("SENSITIVE_CONTENT_DETECTED", { findings: sensitive });
   const target = await resolveExistingRegularFileInsideVault(input.vault, input.rawPath);
   if (!target.ok) return err("RAW_DISPOSAL_TARGET_INVALID", { path: input.rawPath, cause: target });
-  const bytes = await readFile23(target.data);
+  const bytes = await readFile22(target.data);
   const size = bytes.byteLength;
   let typedReferences = [];
   let otherReferences = [];
@@ -10631,7 +10682,7 @@ async function runSourceDisposal(input) {
 import { existsSync as existsSync15, readFileSync as readFileSync16 } from "fs";
 import { execSync as nodeExecSync } from "child_process";
 import { hostname as nodeHostname, platform as nodePlatform } from "os";
-import { join as join43 } from "path";
+import { join as join42 } from "path";
 var SSH_TIMEOUT_MS = 15e3;
 var TIMER_UNIT = "agent-memory-trends.timer";
 var SERVICE_UNIT = "agent-memory-trends.service";
@@ -10861,7 +10912,7 @@ async function runFleetHealth(input) {
   const home = resolveSkillwikiHome(input.home, env);
   const osHostname = input.osHostname ?? env.HOSTNAME ?? nodeHostname();
   const vault = input.vault ?? env.WIKI_PATH;
-  const file = input.file ?? (vault ? join43(vault, FLEET_REL_PATH) : void 0);
+  const file = input.file ?? (vault ? join42(vault, FLEET_REL_PATH) : void 0);
   if (!file) {
     return {
       exitCode: ExitCode.NO_VAULT_CONFIGURED,
@@ -10946,7 +10997,7 @@ async function runFleetHealth(input) {
 
 // src/utils/auto-commit.ts
 import { existsSync as existsSync16 } from "fs";
-import { isAbsolute as isAbsolute3, join as join44, normalize } from "path";
+import { isAbsolute as isAbsolute3, join as join43, normalize } from "path";
 function isValidLastOpPath(file) {
   if (!file || typeof file !== "string") return false;
   const trimmed = file.trim();
@@ -10967,7 +11018,7 @@ async function postCommit(vault, exitCode) {
   const dotenv = await parseDotenvFile(configPath(home));
   const autoCommit = process.env.AUTO_COMMIT ?? dotenv["AUTO_COMMIT"];
   if (autoCommit === "false") return;
-  if (!existsSync16(join44(vault, ".git"))) return;
+  if (!existsSync16(join43(vault, ".git"))) return;
   const lastOps = readLastOp(vault);
   if (lastOps.length === 0) return;
   const porcelain = git(vault, ["status", "--porcelain", "--", ...VAULT_COMMIT_PATHSPEC]);
@@ -11015,8 +11066,8 @@ function preflight(error) {
 }
 async function runMcpAuthIssueHost(input) {
   const isTty = input.isTty ?? Boolean(process.stdin.isTTY && process.stdout.isTTY);
-  const readFile24 = input.readFile ?? readFileSync17;
-  const writeFile10 = input.writeFile ?? writeFileSync8;
+  const readFile23 = input.readFile ?? readFileSync17;
+  const writeFile9 = input.writeFile ?? writeFileSync8;
   const stderrWrite = input.stderrWrite ?? ((s) => {
     process.stderr.write(s);
   });
@@ -11030,7 +11081,7 @@ async function runMcpAuthIssueHost(input) {
   if (write && !isTty) return preflight("NO_TTY");
   let yamlText = "";
   try {
-    yamlText = readFile24(mapPath, "utf8");
+    yamlText = readFile23(mapPath, "utf8");
   } catch (error) {
     if (!isEnoent(error)) throw error;
   }
@@ -11052,7 +11103,7 @@ async function runMcpAuthIssueHost(input) {
   const appended = appendHostHash(yamlText, hashHex, hostId, granted.vaults);
   if ("error" in appended) return preflight(appended.error);
   try {
-    writeFile10(mapPath, appended.yaml, { encoding: "utf8", mode: 416 });
+    writeFile9(mapPath, appended.yaml, { encoding: "utf8", mode: 416 });
   } catch (error) {
     if (isEnoent(error)) {
       return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND") };
@@ -11212,7 +11263,7 @@ async function emitManagedVaultWrite(vault, command, mutate, opts) {
   if (dirty) {
     return emit(dirty, void 0, { postCommit: false });
   }
-  const { runManagedWriteTransaction: runManagedWriteTransaction2 } = await import("./managed-write-preflight-MAIGWFQJ.js");
+  const { runManagedWriteTransaction: runManagedWriteTransaction2 } = await import("./managed-write-preflight-GRSHQYKC.js");
   const run = await runManagedWriteTransaction2({
     vault,
     command,
@@ -11242,7 +11293,7 @@ program.command("validate <file>").description("validate vault page frontmatter
   emit(await runValidate({ file, apply: !!opts.apply, vault }), vault);
 });
 program.command("graph").description("graph subcommands").command("build <vault>").option("--out <path>", "graph output path (default: <vault>/.skillwiki/graph.json)").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
-  const out = opts.out ?? join45(vault, ".skillwiki", "graph.json");
+  const out = opts.out ?? join44(vault, ".skillwiki", "graph.json");
   return emitGuardedVaultWrite(vault, "graph build", () => runGraphBuild({ vault, out }));
 });
 var canvasCmd = program.command("canvas").description("manage Obsidian canvas files");
@@ -11856,6 +11907,10 @@ program.command("doctor").description("diagnose skillwiki setup issues").option(
   checkMcp: !!opts.checkMcp,
   env: process.env
 })));
+var clipOutboxCmd = program.command("clip-outbox").description("dedicated file-level web-clip outbox");
+clipOutboxCmd.command("status").description("show whether the clip-outbox channel is configured").action(async () => emit(await runClipOutboxStatus(resolveSkillwikiHome())));
+clipOutboxCmd.command("watch").description("run the enabled dedicated outbox worker using macOS FSEvents").action(async () => emit(await runClipOutboxWatch(resolveSkillwikiHome())));
+clipOutboxCmd.command("install-or-migrate").description("refresh the packaged launchd plist without enabling the channel").option("--load", "attended launchd bootstrap; requires existing enabled=true", false).option("--conditional-create-proven", "attest the deployed SeaweedFS If-None-Match:* race test passed", false).action(async (opts) => emit(await runClipOutboxInstall({ home: resolveSkillwikiHome(), load: opts.load, conditionalCreateProven: opts.conditionalCreateProven })));
 program.command("connect").description(CONNECT_DESCRIPTION).option("--from-file <path>", "chat-attached env file (not Drive / \u4E91\u76D8)").option("--from-stdin", "read env file from stdin (no echo)").option("--dry-run", "validate without writing ~/.skillwiki/.env").option("--force", "overwrite a different existing token").action(async (opts) => emit(await runConnect({
   home: resolveSkillwikiHome(),
   fromFile: opts.fromFile,