skillwiki 0.10.11 → 0.10.13

package/dist/{index-projection-VNJ3TLEK.js → index-projection-MHXG7QO2.js}

@@ -1,10 +1,14 @@
 #!/usr/bin/env node
 import {
+  UNMANAGED_END,
+  UNMANAGED_START,
   renderRootIndex,
   writeRootIndexProjection
-} from "./chunk-U34B2XQJ.js";
+} from "./chunk-NMUYMNNB.js";
 import "./chunk-C5OLZRRM.js";
 export {
+  UNMANAGED_END,
+  UNMANAGED_START,
   renderRootIndex,
   writeRootIndexProjection
 };

package/dist/{managed-write-preflight-7TWSEZJZ.js → managed-write-preflight-4SWWFT75.js}

@@ -2,8 +2,8 @@
 import {
   runManagedWritePreflight,
   runManagedWriteTransaction
-} from "./chunk-3ZVZ2YEE.js";
-import "./chunk-TYN2IHBY.js";
+} from "./chunk-IIUMTKKA.js";
+import "./chunk-E3PMAHS3.js";
 import "./chunk-C5OLZRRM.js";
 export {
   runManagedWritePreflight,

package/dist/skillwiki-mcp.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   runSkillwikiMcpStdio
-} from "./chunk-P2FCRGKU.js";
+} from "./chunk-X2CPXF4T.js";
 import "./chunk-7I2TPIV5.js";
-import "./chunk-U34B2XQJ.js";
-import "./chunk-TYN2IHBY.js";
+import "./chunk-NMUYMNNB.js";
+import "./chunk-E3PMAHS3.js";
 import "./chunk-C5OLZRRM.js";
 
 // src/mcp-entry.ts

package/dist/vault-sync/scripts/lib/delete-intent.sh

@@ -72,3 +72,30 @@ delete_intent_list_active_paths_from_git() {
     delete_intent_list_active_paths "$tmp"
     rm -rf "$tmp"
 }
+
+# Print the sorted unique exact intersection between active tombstone paths and
+# a successful remote inventory. Both inputs are newline-delimited
+# vault-relative path files. This helper is pure: no network, logging, or
+# mutation outside its temporary sort files.
+delete_intent_plan_remote_paths() {
+    local active_paths_file="${1:-}"
+    local remote_paths_file="${2:-}"
+    [ -f "$active_paths_file" ] || return 1
+    [ -f "$remote_paths_file" ] || return 1
+
+    local tmp_dir active_sorted remote_sorted rc
+    tmp_dir="$(mktemp -d)" || return 1
+    active_sorted="$tmp_dir/active.paths"
+    remote_sorted="$tmp_dir/remote.paths"
+
+    if ! LC_ALL=C sort -u "$active_paths_file" > "$active_sorted" \
+        || ! LC_ALL=C sort -u "$remote_paths_file" > "$remote_sorted"; then
+        rm -rf "$tmp_dir"
+        return 1
+    fi
+
+    LC_ALL=C comm -12 "$active_sorted" "$remote_sorted"
+    rc=$?
+    rm -rf "$tmp_dir"
+    return "$rc"
+}

package/dist/vault-sync/scripts/lib/git-operation-journal.sh

@@ -38,24 +38,40 @@ vault_sync_op_set_field() {
 vault_sync_op_set_fields() {
   local repo="$1" op_id="$2"
   shift 2
-  local file tmp
+  local file tmp updates source
   file="$(vault_sync_op_journal_path "$repo" "$op_id")" || return 1
   tmp="$(mktemp)" || return 1
-  if [ -f "$file" ]; then
-    cp "$file" "$tmp" || { rm -f "$tmp"; return 1; }
-  else
-    : >"$tmp"
-  fi
+  updates="$(mktemp)" || { rm -f "$tmp"; return 1; }
   while [ "$#" -ge 2 ]; do
-    awk -F= -v k="$1" -v v="$2" '
-      BEGIN{found=0}
-      $1==k {print k"="v; found=1; next}
-      {print}
-      END{if(!found) print k"="v}
-    ' "$tmp" >"${tmp}.new" || { rm -f "$tmp" "${tmp}.new"; return 1; }
-    mv "${tmp}.new" "$tmp"
+    printf '%s=%s\n' "$1" "$2" >>"$updates" || { rm -f "$tmp" "$updates"; return 1; }
     shift 2
   done
+  source="$file"
+  [ -f "$source" ] || source=/dev/null
+  awk -F= '
+    FNR==NR {
+      key=$1
+      if (!(key in replacement)) order[++count]=key
+      replacement[key]=substr($0, index($0,"=")+1)
+      next
+    }
+    {
+      key=$1
+      if (key in replacement) {
+        print key"="replacement[key]
+        seen[key]=1
+        next
+      }
+      print
+    }
+    END {
+      for (i=1; i<=count; i++) {
+        key=order[i]
+        if (!(key in seen)) print key"="replacement[key]
+      }
+    }
+  ' "$updates" "$source" >"$tmp" || { rm -f "$tmp" "$updates"; return 1; }
+  rm -f "$updates"
   mv "$tmp" "$file"
 }
 
@@ -160,6 +176,83 @@ vault_sync_op_find_review_required() {
   return 1
 }
 
+# Mark one obsolete review-required handoff complete while preserving its audit
+# trail. Caller must establish that no live owner is mutating the journal.
+vault_sync_op_mark_superseded_stale_review_required() {
+  local repo="$1" op_id="$2" by="${3:-vault-sync-managed-preflight}"
+  local reason="$4" prior_reason="$5" now
+  if [ -z "$prior_reason" ] && [ -n "$reason" ] && [ "$reason" != "superseded-stale-review-required" ]; then
+    prior_reason="$reason"
+  fi
+  now="$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date +%Y-%m-%dT%H:%M:%S)"
+  vault_sync_op_set_fields "$repo" "$op_id" \
+    "phase" "complete" \
+    "handoff" "1" \
+    "reason" "superseded-stale-review-required" \
+    "prior_reason" "$prior_reason" \
+    "superseded_at" "$now" \
+    "cleared_by" "$by" \
+    "cleared_reason" "operator-or-preflight $now"
+}
+
+# Auto-supersede review-required handoffs whose target is already an ancestor
+# of HEAD. Unrelated dirty WIP is preserved; active sequencers and unmerged
+# paths fail closed. Returns nonzero while any applicable handoff remains open.
+vault_sync_op_supersede_stale_review_required() {
+  local repo="$1" by="${2:-vault-sync-managed-preflight}"
+  local current_git_dir git_dir unmerged jdir jf op_id phase handoff journal_git_dir target unresolved
+  local reason prior_reason key value
+
+  current_git_dir="$(git -C "$repo" rev-parse --absolute-git-dir 2>/dev/null)" || return 1
+  git_dir="$current_git_dir"
+  if [ -d "$git_dir/rebase-merge" ] || [ -d "$git_dir/rebase-apply" ] \
+    || [ -f "$git_dir/MERGE_HEAD" ] || [ -f "$git_dir/CHERRY_PICK_HEAD" ] \
+    || [ -f "$git_dir/REVERT_HEAD" ]; then
+    return 1
+  fi
+  unmerged="$(git -C "$repo" ls-files -u 2>/dev/null | head -1 || true)"
+  [ -z "$unmerged" ] || return 1
+
+  jdir="$(vault_sync_op_journal_dir "$repo")" || return 1
+  [ -d "$jdir" ] || return 0
+  unresolved=""
+  for jf in "$jdir"/*.env; do
+    [ -f "$jf" ] || continue
+    op_id="$(basename "$jf" .env)"
+    phase=""
+    handoff=""
+    journal_git_dir=""
+    target=""
+    reason=""
+    prior_reason=""
+    while IFS='=' read -r key value; do
+      case "$key" in
+        phase) phase="$value" ;;
+        handoff) handoff="$value" ;;
+        worktree_git_dir) journal_git_dir="$value" ;;
+        target_oid) target="$value" ;;
+        reason) reason="$value" ;;
+        prior_reason) prior_reason="$value" ;;
+      esac
+    done <"$jf"
+    [ "$phase" = "review-required" ] && [ "$handoff" = "1" ] || continue
+    if [ -n "$journal_git_dir" ] && [ "$journal_git_dir" != "$current_git_dir" ]; then
+      continue
+    fi
+    if [ -z "$target" ]; then
+      [ -n "$unresolved" ] || unresolved="$op_id"
+      continue
+    fi
+    if git -C "$repo" merge-base --is-ancestor "$target" HEAD 2>/dev/null; then
+      vault_sync_op_mark_superseded_stale_review_required \
+        "$repo" "$op_id" "$by" "$reason" "$prior_reason" || return 1
+    else
+      [ -n "$unresolved" ] || unresolved="$op_id"
+    fi
+  done
+  [ -z "$unresolved" ]
+}
+
 vault_sync_op_preflight_blocker() {
   local repo="$1" unmerged op_id git_dir
   unmerged="$(git -C "$repo" diff --name-only --diff-filter=U 2>/dev/null || true)"

package/dist/vault-sync/scripts/lib/managed-write-lock.sh

@@ -62,7 +62,7 @@ vault_sync_managed_lock_safe_to_reclaim() {
 
   # Never reclaim during an active/leftover sequencer.
   if [ -d "$git_dir/rebase-merge" ] || [ -d "$git_dir/rebase-apply" ] \
-    || [ -d "$git_dir/MERGE_HEAD" ] || [ -f "$git_dir/CHERRY_PICK_HEAD" ] \
+    || [ -f "$git_dir/MERGE_HEAD" ] || [ -f "$git_dir/CHERRY_PICK_HEAD" ] \
     || [ -f "$git_dir/REVERT_HEAD" ]; then
     return 1
   fi
@@ -72,13 +72,16 @@ vault_sync_managed_lock_safe_to_reclaim() {
     return 1
   fi
 
-  # When journal helpers are loaded, refuse reclaim while review-required handoff
-  # journals exist. Standalone lock tests may not source the journal library.
-  if command -v vault_sync_op_find_review_required >/dev/null 2>&1; then
+  # When journal helpers are loaded, a dead owner may close handoffs whose
+  # target is already in HEAD, then continue reclaim in this same acquire.
+  # Live owners never reach this function; active sequencers/unmerged paths
+  # already failed closed above. Any unresolved handoff still blocks reclaim.
+  if command -v vault_sync_op_supersede_stale_review_required >/dev/null 2>&1; then
+    vault_sync_op_supersede_stale_review_required \
+      "$repo" "vault-sync-managed-lock-reclaim" 2>/dev/null || return 1
+  elif command -v vault_sync_op_find_review_required >/dev/null 2>&1; then
     review_op="$(vault_sync_op_find_review_required "$repo" 2>/dev/null || true)"
-    if [ -n "$review_op" ]; then
-      return 1
-    fi
+    [ -z "$review_op" ] || return 1
   fi
 
   return 0

package/dist/vault-sync/scripts/wiki-snapshot.sh

@@ -78,9 +78,11 @@ LOG_FILE="${WIKI_SNAPSHOT_LOG:-$DEFAULT_LOG_DIR/wiki-snapshot.log}"
 CLOUD_REMOTE="${CLOUD_REMOTE:-cloud:cloud/wiki}"
 REPAIR_SCRIPT="${WIKI_GIT_REPAIR_SCRIPT:-$SCRIPT_DIR/wiki-git-repair-v3.sh}"
 MAX_S3_ONLY_NOTES="${WIKI_SNAPSHOT_MAX_S3_ONLY_NOTES:-200}"
+MAX_TOMBSTONE_PRUNES="${WIKI_SNAPSHOT_MAX_TOMBSTONE_PRUNES:-10}"
 DATE=$(date +%Y%m%d_%H%M%S)
 RCLONE_LOG="/tmp/rclone-${DATE}.log"
 SNAPSHOT_DIRECT_S3_NOT_GIT_COUNT=0
+SNAPSHOT_REMOTE_INVENTORY_READY=0
 
 fetch_origin_main_ref() {
     # The snapshot guards read origin/main directly. Use an explicit destination
@@ -88,25 +90,63 @@ fetch_origin_main_ref() {
     git fetch --quiet origin +refs/heads/main:refs/remotes/origin/main
 }
 
+snapshot_refresh_origin_main() {
+    (
+        cd "$SNAPSHOT_WORKTREE" || exit 1
+        fetch_origin_main_ref
+    )
+}
+
+snapshot_load_active_delete_intent_paths() {
+    local output_file="${1:-}"
+    [ -n "$output_file" ] || return 1
+    : > "$output_file" || return 1
+
+    if command -v delete_intent_list_active_paths_from_git >/dev/null 2>&1 \
+        && git -C "$SNAPSHOT_WORKTREE" rev-parse --verify --quiet origin/main >/dev/null 2>&1; then
+        delete_intent_list_active_paths_from_git "$SNAPSHOT_WORKTREE" origin/main > "$output_file"
+        return $?
+    fi
+    if command -v delete_intent_list_active_paths >/dev/null 2>&1; then
+        delete_intent_list_active_paths "$SNAPSHOT_WORKTREE" > "$output_file"
+        return $?
+    fi
+    return 1
+}
+
 snapshot_direct_s3_preflight() {
+    local inventory_output="${1:-}"
+    local active_paths_file="${2:-}"
     local tmp_dir
-    tmp_dir="$(mktemp -d)"
-    # Ensure tmp_dir is cleaned up on any return path or interrupt.
-    trap 'rm -rf "$tmp_dir"' RETURN
-    local direct_paths="$tmp_dir/direct-s3.paths"
+    tmp_dir="$(mktemp -d)" || {
+        echo "[wiki-snapshot] WARN: direct-S3 preflight could not create temporary state"
+        SNAPSHOT_REMOTE_INVENTORY_READY=0
+        return 0
+    }
+    local direct_paths
+    if [ -n "$inventory_output" ]; then
+        direct_paths="$inventory_output"
+    else
+        direct_paths="$tmp_dir/direct-s3.paths"
+    fi
     local direct_notes="$tmp_dir/direct-s3-notes.paths"
     local git_paths="$tmp_dir/git.paths"
+    local direct_not_git_candidates="$tmp_dir/direct-s3-not-git-candidates.paths"
     local direct_not_git="$tmp_dir/direct-s3-not-git.paths"
+    local active_sorted="$tmp_dir/active.paths"
+
+    SNAPSHOT_REMOTE_INVENTORY_READY=0
 
-    if ! rclone lsf "$CLOUD_REMOTE" --recursive --files-only 2>/dev/null | LC_ALL=C sort > "$direct_paths"; then
+    if ! rclone lsf "$CLOUD_REMOTE" --recursive --files-only 2>/dev/null | LC_ALL=C sort -u > "$direct_paths"; then
         echo "[wiki-snapshot] WARN: direct-S3 preflight could not list $CLOUD_REMOTE"
+        rm -rf "$tmp_dir"
         return 0
     fi
+    SNAPSHOT_REMOTE_INVENTORY_READY=1
 
     grep -vE '^(\.skillwiki/|\.claude/|\.obsidian/|\.antigravitycli/|\.playwright-cli/|raw/\._\.DS_Store$|\._\.DS_Store$)' "$direct_paths" | LC_ALL=C sort -u > "$direct_notes" || true
     (
         cd "$SNAPSHOT_WORKTREE" || exit 1
-        fetch_origin_main_ref 2>/dev/null || true
         if git rev-parse --verify --quiet origin/main >/dev/null 2>&1; then
             git -c core.quotePath=false ls-tree -r --name-only origin/main
         else
@@ -114,23 +154,48 @@ snapshot_direct_s3_preflight() {
         fi | LC_ALL=C sort -u
     ) > "$git_paths" 2>/dev/null || {
         echo "[wiki-snapshot] WARN: direct-S3 preflight could not list tracked files in snapshot worktree $SNAPSHOT_WORKTREE"
+        rm -rf "$tmp_dir"
         return 0
     }
 
-    LC_ALL=C comm -23 "$direct_notes" "$git_paths" > "$direct_not_git"
+    LC_ALL=C comm -23 "$direct_notes" "$git_paths" > "$direct_not_git_candidates"
+    if [ -n "$active_paths_file" ] && [ -f "$active_paths_file" ]; then
+        LC_ALL=C sort -u "$active_paths_file" > "$active_sorted"
+        LC_ALL=C comm -23 "$direct_not_git_candidates" "$active_sorted" > "$direct_not_git"
+    else
+        LC_ALL=C sort -u "$direct_not_git_candidates" > "$direct_not_git"
+    fi
     SNAPSHOT_DIRECT_S3_NOT_GIT_COUNT="$(wc -l < "$direct_not_git" | tr -d ' ')"
     if [ "$SNAPSHOT_DIRECT_S3_NOT_GIT_COUNT" != "0" ]; then
         echo "[wiki-snapshot] WARN: direct-S3-not-git warning: $SNAPSHOT_DIRECT_S3_NOT_GIT_COUNT note path(s) exist in direct S3 but not in $SNAPSHOT_WORKTREE"
         sed -n '1,20p' "$direct_not_git" | sed 's/^/[wiki-snapshot] WARN: direct-S3-not-git: /'
+        rm -rf "$tmp_dir"
         return 2
     fi
 
+    rm -rf "$tmp_dir"
     return 0
 }
 
 handle_direct_s3_preflight_before_sync() {
-    snapshot_direct_s3_preflight
+    local tmp_dir active_paths
+    tmp_dir="$(mktemp -d)" || {
+        log "ERROR: could not create direct-S3 preflight state"
+        return 1
+    }
+    active_paths="$tmp_dir/active.paths"
+    if ! snapshot_refresh_origin_main 2>/dev/null; then
+        log "WARNING: could not refresh origin/main before direct-S3 preflight; using the existing ref"
+    fi
+    if ! snapshot_load_active_delete_intent_paths "$active_paths"; then
+        rm -rf "$tmp_dir"
+        log "ERROR: active delete-intent inventory unavailable before direct-S3 preflight"
+        return 1
+    fi
+
+    snapshot_direct_s3_preflight "" "$active_paths"
     local rc=$?
+    rm -rf "$tmp_dir"
     if [ "$rc" -eq 0 ]; then
         return 0
     fi
@@ -197,7 +262,34 @@ if [ "$DRY_RUN" = true ]; then
     echo "  CLOUD_REMOTE      = $CLOUD_REMOTE"
     echo "  REPAIR_SCRIPT     = $REPAIR_SCRIPT"
     echo "[wiki-snapshot] DRY RUN: --max-delete guard verified (present in $0)"
-    snapshot_direct_s3_preflight || true
+    dry_run_tmp="$(mktemp -d)" || exit 1
+    dry_run_active="$dry_run_tmp/active.paths"
+    dry_run_remote="$dry_run_tmp/remote.paths"
+    dry_run_plan="$dry_run_tmp/remote-present.paths"
+    case "$MAX_TOMBSTONE_PRUNES" in
+        ''|*[!0-9]*)
+            echo "[wiki-snapshot] ERROR: invalid WIKI_SNAPSHOT_MAX_TOMBSTONE_PRUNES=$MAX_TOMBSTONE_PRUNES; expected a non-negative integer" >&2
+            rm -rf "$dry_run_tmp"
+            exit 1
+            ;;
+    esac
+    snapshot_refresh_origin_main 2>/dev/null || true
+    snapshot_load_active_delete_intent_paths "$dry_run_active" || : > "$dry_run_active"
+    snapshot_direct_s3_preflight "$dry_run_remote" "$dry_run_active" || true
+    if [ "$SNAPSHOT_REMOTE_INVENTORY_READY" = "1" ] \
+        && delete_intent_plan_remote_paths "$dry_run_active" "$dry_run_remote" > "$dry_run_plan"; then
+        dry_run_active_count="$(wc -l < "$dry_run_active" | tr -d ' ')"
+        dry_run_remote_count="$(wc -l < "$dry_run_plan" | tr -d ' ')"
+        dry_run_absent_count=$((dry_run_active_count - dry_run_remote_count))
+        dry_run_deferred_count=0
+        if [ "$dry_run_remote_count" -gt "$MAX_TOMBSTONE_PRUNES" ] 2>/dev/null; then
+            dry_run_deferred_count=$((dry_run_remote_count - MAX_TOMBSTONE_PRUNES))
+        fi
+        echo "[wiki-snapshot] DRY RUN: delete-intent active=$dry_run_active_count remote_present=$dry_run_remote_count already_absent=$dry_run_absent_count deferred=$dry_run_deferred_count"
+    else
+        echo "[wiki-snapshot] DRY RUN: delete-intent remote inventory unavailable; optional pruning would be skipped"
+    fi
+    rm -rf "$dry_run_tmp"
     echo "[wiki-snapshot] DRY RUN: would acquire $LOCK_FILE, rclone sync, git commit, push."
     echo "[wiki-snapshot] DRY RUN: Complete. No changes made."
     exit 0
@@ -217,6 +309,16 @@ log() {
     echo "$(date '+%Y-%m-%d %H:%M:%S') $1" | tee -a "$LOG_FILE"
 }
 
+validate_tombstone_prune_cap() {
+    case "$MAX_TOMBSTONE_PRUNES" in
+        ''|*[!0-9]*)
+            log "ERROR: invalid WIKI_SNAPSHOT_MAX_TOMBSTONE_PRUNES=$MAX_TOMBSTONE_PRUNES; expected a non-negative integer"
+            return 1
+            ;;
+    esac
+    return 0
+}
+
 raw_dedup_guard() {
     if [ "${WIKI_SNAPSHOT_RAW_DEDUP_GUARD:-1}" = "0" ]; then
         log "raw_dedup guard skipped by WIKI_SNAPSHOT_RAW_DEDUP_GUARD=0"
@@ -293,6 +395,10 @@ refresh_git_baseline() {
 
 log "=== Wiki Snapshot: $DATE ==="
 
+if ! validate_tombstone_prune_cap; then
+    exit 1
+fi
+
 # Check disk space (need at least 100MB free)
 AVAILABLE_KB=$(df -k "$SNAPSHOT_WORKTREE" | awk 'NR==2 {print $4}')
 if [ "$AVAILABLE_KB" -lt 102400 ]; then
@@ -392,61 +498,156 @@ fi
 # --- Delete-intent no-resurrect ---
 # Git is SSOT for intentional absences. After S3→worktree sync, strip any path
 # that has an active tombstone on origin/main and optionally prune S3.
+snapshot_remote_path_exists_exact() {
+    local rel_path="${1:-}"
+    local parent_path base_name remote_parent output_file rc
+    [ -n "$rel_path" ] || return 2
+
+    base_name="${rel_path##*/}"
+    if [ "$rel_path" = "$base_name" ]; then
+        remote_parent="${CLOUD_REMOTE%/}"
+    else
+        parent_path="${rel_path%/*}"
+        remote_parent="${CLOUD_REMOTE%/}/$parent_path"
+    fi
+
+    output_file="$(mktemp)" || return 2
+    if ! rclone lsf "$remote_parent" --files-only --max-depth 1 --retries 1 > "$output_file" 2>>"$LOG_FILE"; then
+        rm -f "$output_file"
+        return 2
+    fi
+    if grep -Fxq -- "$base_name" "$output_file"; then
+        rc=0
+    else
+        rc=1
+    fi
+    rm -f "$output_file"
+    return "$rc"
+}
+
 snapshot_apply_delete_intents() {
-    if ! command -v delete_intent_list_active_paths_from_git >/dev/null 2>&1 \
-        && ! command -v delete_intent_list_active_paths >/dev/null 2>&1; then
-        log "WARNING: delete-intent helpers unavailable; skipping tombstone no-resurrect"
+    local paths_file="${1:-}"
+    local remote_inventory_file="${2:-}"
+    local inventory_ready="${3:-0}"
+    if [ ! -f "$paths_file" ]; then
+        log "ERROR: active delete-intent inventory file missing; refusing snapshot promotion"
+        return 1
+    fi
+
+    if [ ! -s "$paths_file" ]; then
+        log "delete-intent: no active tombstones"
         return 0
     fi
 
     # Re-materialize ledger from git so rclone sync cannot drop git-only intents,
-    # then list from the worktree (single parse — avoid re-git-show of every blob).
-    (
-        cd "$SNAPSHOT_WORKTREE" || exit 0
-        fetch_origin_main_ref 2>/dev/null || true
+    # and fail closed if the authoritative ledger cannot be restored.
+    if ! (
+        cd "$SNAPSHOT_WORKTREE" || exit 1
         if git rev-parse --verify --quiet origin/main >/dev/null 2>&1; then
-            git checkout origin/main -- meta/delete-intents/ 2>/dev/null || true
+            git checkout origin/main -- meta/delete-intents/
         fi
-    )
+    ) 2>>"$LOG_FILE"; then
+        log "ERROR: could not restore authoritative delete-intent ledger from origin/main"
+        return 1
+    fi
 
-    local paths_file pruned=0
-    paths_file="$(mktemp)"
-    if command -v delete_intent_list_active_paths >/dev/null 2>&1; then
-        delete_intent_list_active_paths "$SNAPSHOT_WORKTREE" > "$paths_file" 2>/dev/null || true
-    elif command -v delete_intent_list_active_paths_from_git >/dev/null 2>&1; then
-        delete_intent_list_active_paths_from_git "$SNAPSHOT_WORKTREE" origin/main > "$paths_file" 2>/dev/null || true
+    local active_count remote_present_count attempted pruned already_absent failed deferred
+    local rel_path plan_file recheck_rc
+    active_count="$(wc -l < "$paths_file" | tr -d ' ')"
+    remote_present_count=0
+    attempted=0
+    pruned=0
+    already_absent=0
+    failed=0
+    deferred=0
+
+    while IFS= read -r rel_path; do
+        [ -z "$rel_path" ] && continue
+        if [ -e "$SNAPSHOT_WORKTREE/$rel_path" ]; then
+            rm -f -- "$SNAPSHOT_WORKTREE/$rel_path"
+            log "delete-intent: stripped resurrected path from worktree: $rel_path"
+        fi
+    done < "$paths_file"
+
+    if [ "$inventory_ready" != "1" ] || [ ! -f "$remote_inventory_file" ]; then
+        log "WARNING: delete-intent remote inventory unavailable; optional S3 pruning skipped"
+        log "delete-intent: no-resurrect pass complete active=$active_count inventory_ready=0 remote_present=0 attempted=0 pruned=0 already_absent=0 failed=0 deferred=0"
+        return 0
     fi
 
-    if [ ! -s "$paths_file" ]; then
-        rm -f "$paths_file"
-        log "delete-intent: no active tombstones"
+    plan_file="$(mktemp)" || {
+        log "WARNING: could not create delete-intent prune plan; optional S3 pruning skipped"
+        return 0
+    }
+    if ! delete_intent_plan_remote_paths "$paths_file" "$remote_inventory_file" > "$plan_file"; then
+        rm -f "$plan_file"
+        log "WARNING: could not plan delete-intent remote intersection; optional S3 pruning skipped"
         return 0
     fi
 
-    local rel_path
+    remote_present_count="$(wc -l < "$plan_file" | tr -d ' ')"
+    already_absent=$((active_count - remote_present_count))
+
     while IFS= read -r rel_path; do
         [ -z "$rel_path" ] && continue
-        if [ -e "$SNAPSHOT_WORKTREE/$rel_path" ]; then
-            rm -f "$SNAPSHOT_WORKTREE/$rel_path"
-            log "delete-intent: stripped resurrected path from worktree: $rel_path"
+        if [ "$attempted" -ge "$MAX_TOMBSTONE_PRUNES" ]; then
+            break
         fi
-        # Bounded S3 prune for tombstoned paths still present on remote.
-        if [ "$pruned" -lt 10 ]; then
-            if rclone deletefile "${CLOUD_REMOTE%/}/$rel_path" >>"$LOG_FILE" 2>&1; then
-                log "delete-intent: pruned S3 object $rel_path"
-                pruned=$((pruned + 1))
-            fi
+        attempted=$((attempted + 1))
+        if rclone deletefile "${CLOUD_REMOTE%/}/$rel_path" --retries 1 >>"$LOG_FILE" 2>&1; then
+            pruned=$((pruned + 1))
+            log "delete-intent: pruned S3 object $rel_path"
+            continue
         fi
-    done < "$paths_file"
 
-    rm -f "$paths_file"
-    log "delete-intent: no-resurrect pass complete (s3_pruned=$pruned)"
+        snapshot_remote_path_exists_exact "$rel_path"
+        recheck_rc=$?
+        if [ "$recheck_rc" -eq 1 ]; then
+            already_absent=$((already_absent + 1))
+            log "delete-intent: delete race resolved as already absent: $rel_path"
+        elif [ "$recheck_rc" -eq 0 ]; then
+            failed=$((failed + 1))
+            log "WARNING: delete-intent prune failed and object remains present: $rel_path"
+        else
+            failed=$((failed + 1))
+            log "WARNING: delete-intent prune failed and exact recheck was unavailable: $rel_path"
+        fi
+    done < "$plan_file"
+
+    deferred=$((remote_present_count - attempted))
+    rm -f "$plan_file"
+    log "delete-intent: no-resurrect pass complete active=$active_count inventory_ready=1 remote_present=$remote_present_count attempted=$attempted pruned=$pruned already_absent=$already_absent failed=$failed deferred=$deferred"
     return 0
 }
 
-snapshot_apply_delete_intents
+snapshot_reconcile_delete_intents() {
+    local tmp_dir active_paths remote_inventory rc
+    tmp_dir="$(mktemp -d)" || {
+        log "ERROR: could not create delete-intent reconciliation state"
+        return 1
+    }
+    active_paths="$tmp_dir/active.paths"
+    remote_inventory="$tmp_dir/remote.paths"
+
+    if ! snapshot_refresh_origin_main 2>/dev/null; then
+        log "WARNING: could not refresh origin/main before delete-intent reconciliation; using the existing ref"
+    fi
+    if ! snapshot_load_active_delete_intent_paths "$active_paths"; then
+        rm -rf "$tmp_dir"
+        log "ERROR: could not load active delete-intent paths; refusing snapshot promotion"
+        return 1
+    fi
 
-snapshot_direct_s3_preflight || true
+    snapshot_direct_s3_preflight "$remote_inventory" "$active_paths" || true
+    snapshot_apply_delete_intents "$active_paths" "$remote_inventory" "$SNAPSHOT_REMOTE_INVENTORY_READY"
+    rc=$?
+    rm -rf "$tmp_dir"
+    return "$rc"
+}
+
+if ! snapshot_reconcile_delete_intents; then
+    exit 1
+fi
 
 # Change to git dir for operations
 cd "$SNAPSHOT_WORKTREE" || { log "ERROR: Failed to cd to $SNAPSHOT_WORKTREE"; exit 1; }
@@ -514,7 +715,9 @@ if [ "$needs_repair" = true ]; then
         exit 1
     fi
     rm -f "$RCLONE_LOG"
-    snapshot_apply_delete_intents
+    if ! snapshot_reconcile_delete_intents; then
+        exit 1
+    fi
 fi
 
 if ! raw_dedup_guard; then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.11",
+  "version": "0.10.13",
   "type": "module",
   "bin": {
     "skillwiki": "dist/cli.js",

package/skills/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.11",
+  "version": "0.10.13",
   "skills": "./",
   "description": "Project-aware Karpathy-style knowledge base for Claude Code: 19 prompt-only skills (wiki-*, proj-*, using-skillwiki) backed by the deterministic `skillwiki` CLI.",
   "author": {

package/skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.11",
+  "version": "0.10.13",
   "description": "Project-aware Karpathy-style knowledge base for Codex with 19 prompt-only skills backed by the deterministic skillwiki CLI.",
   "author": {
     "name": "karlorz",