skillwiki 0.10.21 → 0.10.23

package/dist/cli.js

@@ -9,16 +9,14 @@ import {
   acquireLock,
   acquireOwnedSyncLock,
   appendLastOp,
+  applyRawStructuralMove,
   assessSourceIdentity,
   buildDegradedReasons,
   buildRemoteObjectPath,
-  canonicalEventJson,
   clearLastOp,
   configPath,
   evaluateDirtyVolumeGate,
   evaluateSatelliteRunHealth,
-  eventPathFor,
-  extractCitationMarkers,
   extractTaxonomy,
   findPlugin,
   fixPathTooLong,
@@ -30,11 +28,11 @@ import {
   mergeTaxonomyConflict,
   normalizeRemoteRoot,
   planAndMaybePruneRemoteObjects,
+  planRawStructuralMove,
   probeRemoteHealth,
   readCliPackageJson,
   readLastOp,
   readLock,
-  readLogEvents,
   readSatelliteLatestRunFromText,
   reconcileTaxonomyDocument,
   releaseLock,
@@ -43,6 +41,7 @@ import {
   renderProjectIndex,
   resolveInitTimePath,
   resolveRuntimePath,
+  rewriteRawSourceReferences,
   runAudit,
   runConfigGet,
   runConfigList,
@@ -78,12 +77,11 @@ import {
   safeWritePage,
   satelliteLatestRunPath,
   scanConflictMarkerBlocksInText,
+  snapshotMaintainedPageState,
   snapshotterHealthChecks,
   taxonomyCommentForPage,
-  upsertIndexEntry,
-  validateLogEvent,
-  writeLogEvent
-} from "./chunk-UNPZDCWN.js";
+  upsertIndexEntry
+} from "./chunk-SYKSL3JQ.js";
 import {
   normalizeDistTag,
   readCache,
@@ -96,20 +94,14 @@ import {
   UNMANAGED_START,
   assertTargetInsideVault,
   atomicWriteText,
-  extractFrontmatter,
   prepareTypedPage,
-  readPage,
-  redactSensitiveContent,
   renderRootIndex,
-  scanSensitiveContent,
-  scanVault,
-  splitFrontmatter,
   writeRootIndexProjection
-} from "./chunk-I5JD3BQZ.js";
+} from "./chunk-QBZYEEBD.js";
 import {
   runManagedWritePreflight,
   runManagedWriteTransaction
-} from "./chunk-65Q5UGND.js";
+} from "./chunk-BASWDOQB.js";
 import {
   FLEET_REL_PATH,
   canSupersedeJournal,
@@ -137,18 +129,52 @@ import {
   snapshotterAliasForLocalHost,
   supersedeStaleReviewRequiredJournals,
   writeDotenv
-} from "./chunk-GNS2ZV5P.js";
+} from "./chunk-PQG26AGJ.js";
+import {
+  applySourceDisposition,
+  decodeSourceActionApproval,
+  encodeSourceActionApproval,
+  inventorySources,
+  planSourceDisposition,
+  runSourcesPending
+} from "./chunk-EQPU2BPM.js";
+import {
+  authorizeRawOperation,
+  buildSourceReferenceIndex,
+  buildSourceRelocationProjection,
+  canonicalEventJson,
+  classifyRawPath,
+  eventPathFor,
+  extractCitationMarkers,
+  lifecycleDestination,
+  operationId,
+  readLogEvents,
+  readSourceRelocations,
+  resolveExistingRegularFileInsideVault,
+  validateLogEvent,
+  writeLogEvent
+} from "./chunk-QNTBNNEL.js";
+import {
+  extractFrontmatter,
+  readPage,
+  redactSensitiveContent,
+  scanSensitiveContent,
+  scanVault,
+  splitFrontmatter
+} from "./chunk-6ZDKTNLA.js";
 import {
   ExitCode,
   MetaSchema,
   RawSourceSchema,
+  TypedKnowledgeSchema,
+  detectSchema,
   err,
   isBlockedHost,
   ok
-} from "./chunk-Y6KRDGI2.js";
+} from "./chunk-C2DKFJFA.js";
 
 // src/cli.ts
-import { join as join36 } from "path";
+import { join as join39 } from "path";
 import { Command } from "commander";
 
 // src/utils/output.ts
@@ -210,10 +236,10 @@ async function runHash(input) {
   const split = splitFrontmatter(text);
   if (!split.ok) return { exitCode: ExitCode.MISSING_CLOSING_DELIMITER, result: split };
   const bodyBytes = Buffer.from(split.data.body, "utf8");
-  const sha256 = createHash("sha256").update(bodyBytes).digest("hex");
+  const sha2562 = createHash("sha256").update(bodyBytes).digest("hex");
   return {
     exitCode: ExitCode.OK,
-    result: ok({ path: input.file, sha256, byte_count: bodyBytes.byteLength, humanHint: sha256 })
+    result: ok({ path: input.file, sha256: sha2562, byte_count: bodyBytes.byteLength, humanHint: sha2562 })
   };
 }
 
@@ -588,7 +614,7 @@ async function runLang(input) {
 
 // src/commands/init.ts
 import { mkdir as mkdir3, readFile as readFile3, readdir as readdir2, writeFile as writeFile2 } from "fs/promises";
-import { join as join5 } from "path";
+import { join as join5, dirname as dirname3 } from "path";
 var DEFAULT_TAXONOMY = [
   "research",
   "comparison",
@@ -606,6 +632,12 @@ var VAULT_DIRS = [
   "raw/papers",
   "raw/transcripts",
   "raw/assets",
+  "raw/archived/articles",
+  "raw/archived/papers",
+  "raw/archived/transcripts",
+  "raw/duplicates/articles",
+  "raw/duplicates/papers",
+  "raw/duplicates/transcripts",
   "entities",
   "concepts",
   "comparisons",
@@ -618,6 +650,8 @@ var VAULT_DIRS = [
 var ATTACHMENT_FOLDER = "raw/assets";
 var NEW_FILE_FOLDER = "raw/transcripts";
 var TEMPLATE_FOLDER = "_Templates";
+var WEB_CLIPPER_TEMPLATE_REL = `${TEMPLATE_FOLDER}/web-clipper/llm-wiki-clippings.json`;
+var WEB_CLIPPER_README_REL = `${TEMPLATE_FOLDER}/web-clipper/readme.txt`;
 function extractDomainFromSchema(text) {
   const m = text.match(/^##\s+Domain\s*\n([\s\S]*?)(?=\n\n|\n##|\s*$)/m);
   if (!m) return "";
@@ -744,6 +778,23 @@ async function runInit(input) {
       return { exitCode: ExitCode.WRITE_FAILED, result: err("WRITE_FAILED", { file: fileName, message: String(e) }) };
     }
   }
+  async function copyTemplateOrPreserve(fileName, sourceName) {
+    const destination = join5(target, fileName);
+    try {
+      await readFile3(destination);
+      preserved.push(fileName);
+      return void 0;
+    } catch {
+    }
+    try {
+      await mkdir3(dirname3(destination), { recursive: true });
+      await writeFile2(destination, await readFile3(join5(input.templates, sourceName)));
+      created.push(fileName);
+      return void 0;
+    } catch (e) {
+      return { exitCode: ExitCode.WRITE_FAILED, result: err("WRITE_FAILED", { file: fileName, message: String(e) }) };
+    }
+  }
   const err1 = await writeOrPreserve("index.md", async () => {
     const tpl = await readFile3(join5(input.templates, "index.md"), "utf8");
     return tpl.replace("{{INIT_DATE}}", today);
@@ -771,6 +822,16 @@ async function runInit(input) {
     ].join("\n");
   });
   if (errTemplate) return errTemplate;
+  const errWebClipperTemplate = await copyTemplateOrPreserve(
+    WEB_CLIPPER_TEMPLATE_REL,
+    "web-clipper/llm-wiki-clippings.json"
+  );
+  if (errWebClipperTemplate) return errWebClipperTemplate;
+  const errWebClipperReadme = await copyTemplateOrPreserve(
+    WEB_CLIPPER_README_REL,
+    "web-clipper/readme.txt"
+  );
+  if (errWebClipperReadme) return errWebClipperReadme;
   const err22 = await writeOrPreserve("log.md", async () => {
     const tpl = await readFile3(join5(input.templates, "log.md"), "utf8");
     return tpl.replace(/\{\{INIT_DATE\}\}/g, today).replace("{{DOMAIN}}", domain).replace("{{WIKI_LANG}}", canonicalLang);
@@ -802,7 +863,9 @@ async function runInit(input) {
     `lang: ${canonicalLang}`,
     `created: ${created.length}, preserved: ${preserved.length}`,
     `discovered tags: ${discovered_tags}`,
-    skipEnv ? "env: skipped" : `env: ${envWritten}`
+    skipEnv ? "env: skipped" : `env: ${envWritten}`,
+    `web clipper template: ${WEB_CLIPPER_TEMPLATE_REL}`,
+    "web clipper import: open Obsidian Web Clipper Settings and import the JSON in each browser profile"
   ].join("\n");
   if (created.length > 0) {
     appendLastOp(target, {
@@ -826,7 +889,11 @@ async function runInit(input) {
       imported_from_hermes: importedFromHermes,
       discovered_tags,
       humanHint,
-      templates_created: created.includes(`${TEMPLATE_FOLDER}/tpl-ad-hoc-capture.md`)
+      templates_created: created.includes(`${TEMPLATE_FOLDER}/tpl-ad-hoc-capture.md`),
+      web_clipper_template_path: WEB_CLIPPER_TEMPLATE_REL,
+      web_clipper_readme_path: WEB_CLIPPER_README_REL,
+      web_clipper_template_created: created.includes(WEB_CLIPPER_TEMPLATE_REL),
+      web_clipper_template_preserved: preserved.includes(WEB_CLIPPER_TEMPLATE_REL)
     })
   };
 }
@@ -1000,7 +1067,7 @@ import { mkdtempSync, writeFileSync, rmSync } from "fs";
 import { tmpdir } from "os";
 import { join as join7 } from "path";
 var ENTRY_RE = /^## \[/m;
-var OPERATION_MARKER_RE = /<!--\s*skillwiki-(?:page-publish|log-op):([a-f0-9]{64})\s*-->/i;
+var OPERATION_MARKER_RE = /<!--\s*skillwiki-(?:page-publish|project-page-publish|log-op):([a-f0-9]{64})\s*-->/i;
 function splitLog(text) {
   const normalized = text.replace(/\r\n/g, "\n");
   const match = ENTRY_RE.exec(normalized);
@@ -1196,21 +1263,21 @@ function rollbackPath(vault, path, stage2, stage3) {
 function hasMarkers(path, text) {
   const lines = text.split(/\r?\n/);
   let open2 = false;
-  let sep2 = false;
+  let sep4 = false;
   for (const line of lines) {
     if (line.startsWith("<<<<<<< ")) {
       open2 = true;
-      sep2 = false;
+      sep4 = false;
       continue;
     }
     if (line === "=======" && open2) {
-      sep2 = true;
+      sep4 = true;
       continue;
     }
-    if (line.startsWith(">>>>>>> ") && open2 && sep2) return true;
+    if (line.startsWith(">>>>>>> ") && open2 && sep4) return true;
     if (line.startsWith(">>>>>>> ")) {
       open2 = false;
-      sep2 = false;
+      sep4 = false;
     }
   }
   return false;
@@ -1322,10 +1389,12 @@ function marker(event) {
   return `<!-- skillwiki-log-event:${event.operation_id} -->`;
 }
 function bodyFor(event) {
-  if (event.kind === "page-publish") {
+  if (event.kind === "page-publish" || event.kind === "project-page-publish") {
     const tax = Array.isArray(event.metadata.taxonomy_added) ? event.metadata.taxonomy_added : [];
+    const project = typeof event.metadata.project === "string" ? event.metadata.project : void 0;
     return [
       `- Published: [[${event.target.replace(/\.md$/, "")}]]`,
+      ...event.kind === "project-page-publish" && project ? [`- Project: [[${project}]]`] : [],
       `- Taxonomy: ${tax.length > 0 ? `added ${tax.join(", ")}` : "no additions"}`,
       event.note ? `- Note: ${event.note}` : ""
     ].filter(Boolean).join("\n");
@@ -1485,18 +1554,8 @@ async function runLogMaterialize(input) {
 // src/commands/log-migrate-legacy.ts
 import { readFileSync as readFileSync6 } from "fs";
 import { join as join10 } from "path";
-
-// src/utils/operation-id.ts
-import { createHash as createHash2 } from "crypto";
-function operationId(namespace, parts) {
-  const hash = createHash2("sha256").update(namespace).update("\0");
-  for (const part of parts) hash.update(part).update("\0");
-  return hash.digest("hex");
-}
-
-// src/commands/log-migrate-legacy.ts
 var BLOCK_RE = /^## \[(\d{4}-\d{2}-\d{2})\][^\n]*$/gm;
-var PUBLISH_RE = /<!--\s*skillwiki-page-publish:([a-f0-9]{64})\s*-->/i;
+var PUBLISH_RE = /<!--\s*skillwiki-(?:page-publish|project-page-publish):([a-f0-9]{64})\s*-->/i;
 function splitLegacyBlocks(text) {
   const matches = [...text.matchAll(BLOCK_RE)];
   if (matches.length === 0) return [];
@@ -2793,7 +2852,7 @@ function selfCheckReport(report) {
   if (lint.summary.info !== sumBySeverity("info")) {
     errors.push(`lint.summary.info=${lint.summary.info} but info bucket counts sum to ${sumBySeverity("info")}`);
   }
-  for (const component of ["doctor", "lint", "vault_sync", "query_readiness", "source_freshness"]) {
+  for (const component of ["doctor", "lint", "vault_sync", "query_readiness", "source_freshness", "source_lifecycle"]) {
     if (!report.coverage[component]) errors.push(`missing coverage entry for ${component}`);
   }
   for (const flag of report.risk_flags) {
@@ -2813,6 +2872,7 @@ function buildHumanHint(report) {
   }
   lines.push(`vault_sync: ${report.components.vault_sync.summary.pass} pass, ${report.components.vault_sync.summary.warn} warn, ${report.components.vault_sync.summary.error} error`);
   lines.push(`query_readiness: ${report.components.query_readiness.status} (${report.components.query_readiness.summary.score}/100)`);
+  lines.push(`source_lifecycle: ${report.components.source_lifecycle.summary.pending} pending, ${report.components.source_lifecycle.summary.deferred} deferred, ${report.components.source_lifecycle.summary.reviewed_no_op} reviewed-no-op`);
   if (report.risk_flags.length > 0) {
     lines.push("risk flags:");
     for (const flag of report.risk_flags) {
@@ -2872,7 +2932,8 @@ function buildIncompleteReport(input, syncMode) {
       lint: { state: "unknown", status: "unknown", reason: "lint summary still running" },
       vault_sync: vaultSyncCoverage,
       query_readiness: { state: "unknown", status: "unknown", reason: "health run not complete" },
-      source_freshness: { state: "unknown", status: "unknown", reason: "health run not complete" }
+      source_freshness: { state: "unknown", status: "unknown", reason: "health run not complete" },
+      source_lifecycle: { state: "unknown", status: "unknown", reason: "health run not complete" }
     },
     components: {
       doctor: {
@@ -2900,6 +2961,11 @@ function buildIncompleteReport(input, syncMode) {
         status: "unknown",
         blocking: false,
         summary: { stale_pages: 0, file_source_url: 0, stale_sections: 0 }
+      },
+      source_lifecycle: {
+        status: "unknown",
+        blocking: false,
+        summary: { pending: 0, deferred: 0, reviewed_no_op: 0, archived_raw: 0, preserved_duplicates: 0, legacy_archive_raw: 0, legacy_schema: 0, invalid_schema: 0, oldest_pending: null, fresh_pending_examples: [] }
       }
     },
     risk_flags: [],
@@ -2954,6 +3020,26 @@ async function runHealth(input) {
       stale_sections: bucketCount(lint.result.data.buckets, "stale_sections")
     }
   };
+  const sourceInventory = await inventorySources({ vault: input.vault });
+  const sourceItems = sourceInventory.output?.items ?? [];
+  const pendingItems = sourceItems.filter((item) => item.lifecycle_status === "pending" && item.storage_status === "active");
+  const pendingDates = pendingItems.map((item) => item.captured).filter((value) => value !== null).sort();
+  const sourceLifecycle = {
+    status: pendingItems.length > 0 ? "info" : "pass",
+    blocking: false,
+    summary: {
+      pending: pendingItems.length,
+      deferred: sourceItems.filter((item) => item.lifecycle_status === "deferred").length,
+      reviewed_no_op: sourceItems.filter((item) => item.lifecycle_status === "reviewed-no-op").length,
+      archived_raw: sourceItems.filter((item) => item.storage_status === "archived").length,
+      preserved_duplicates: sourceItems.filter((item) => item.storage_status === "duplicate").length,
+      legacy_archive_raw: sourceItems.filter((item) => item.storage_status === "legacy-archived").length,
+      legacy_schema: sourceItems.filter((item) => item.schema_status === "legacy").length,
+      invalid_schema: sourceItems.filter((item) => item.schema_status === "invalid").length,
+      oldest_pending: pendingDates[0] ?? null,
+      fresh_pending_examples: pendingItems.filter((item) => item.age_bucket === "fresh").slice(0, 3).map((item) => item.raw_path)
+    }
+  };
   const doctorComponent = {
     status: doctorStatus,
     blocking: false,
@@ -2998,14 +3084,16 @@ async function runHealth(input) {
       lint: { state: "checked", status: lintComponent.status },
       vault_sync: vaultSyncCoverage,
       query_readiness: { state: "checked", status: queryReadiness.status },
-      source_freshness: { state: "checked", status: sourceFreshness.status }
+      source_freshness: { state: "checked", status: sourceFreshness.status },
+      source_lifecycle: { state: "checked", status: sourceLifecycle.status }
     },
     components: {
       doctor: doctorComponent,
       lint: lintComponent,
       vault_sync: vaultSync,
       query_readiness: queryReadiness,
-      source_freshness: sourceFreshness
+      source_freshness: sourceFreshness,
+      source_lifecycle: sourceLifecycle
     },
     risk_flags: riskFlags,
     details_included: false,
@@ -3052,7 +3140,7 @@ async function runHealth(input) {
 }
 
 // src/commands/archive.ts
-import { rename as rename2, mkdir as mkdir6, readFile as readFile7, writeFile as writeFile5 } from "fs/promises";
+import { rename as rename2, mkdir as mkdir6, readFile as readFile7 } from "fs/promises";
 import { join as join18, dirname as dirname5 } from "path";
 
 // src/utils/delete-intent.ts
@@ -3123,18 +3211,21 @@ async function runArchive(input) {
   let relPath = lookup(scan.data.typedKnowledge);
   let isRaw = false;
   if (!relPath) {
-    relPath = lookup(scan.data.raw);
+    relPath = input.page.includes("/") ? lookup(scan.data.raw) : void 0;
     isRaw = relPath != null;
   }
   if (!relPath) return { exitCode: ExitCode.ARCHIVE_TARGET_NOT_FOUND, result: err("ARCHIVE_TARGET_NOT_FOUND", { page: input.page }) };
   if (relPath.startsWith("_archive/")) return { exitCode: ExitCode.ARCHIVE_ALREADY_ARCHIVED, result: err("ARCHIVE_ALREADY_ARCHIVED", { page: relPath }) };
   const slug = relPath.replace(/\.md$/, "").split("/").pop();
-  const archivePath = join18("_archive", relPath).replace(/\\/g, "/");
+  const rawArchive = isRaw ? lifecycleDestination(relPath, "archive") : void 0;
+  if (rawArchive && !rawArchive.ok) return { exitCode: ExitCode.USAGE, result: rawArchive };
+  const archivePath = isRaw ? rawArchive.data : join18("_archive", relPath).replace(/\\/g, "/");
   const remoteRoot = normalizeRemoteRoot(input.remote);
   const remoteObjectPath = buildRemoteObjectPath(remoteRoot, relPath);
   let cascade;
-  if (input.cascade) {
+  if (input.cascade || isRaw) {
     const wikilinkRefs = [];
+    const citationRefs = [];
     const sourceArrayRefs = [];
     for (const page of scan.data.typedKnowledge) {
       if (page.relPath === relPath) continue;
@@ -3143,12 +3234,15 @@ async function runArchive(input) {
       if (!split.ok) continue;
       const wl = countWikilinks(split.data.body, slug);
       if (wl > 0) wikilinkRefs.push({ page: page.relPath, count: wl });
+      const rewritten = isRaw ? rewriteRawSourceReferences(text, relPath, archivePath) : void 0;
+      const citationCount = rewritten?.bodyCitationCount ?? 0;
+      if (citationCount > 0) citationRefs.push({ page: page.relPath, count: citationCount });
       const fm = extractFrontmatter(text);
       if (!fm.ok) continue;
       const sources = fm.data.sources;
-      if (Array.isArray(sources) && sources.includes(relPath)) {
+      if (Array.isArray(sources) && (isRaw ? rewritten.sourcesBefore.some((source, index) => source !== rewritten.sourcesAfter[index]) : sources.includes(relPath))) {
         const before = sources.filter((s) => typeof s === "string");
-        const after = before.filter((s) => s !== relPath);
+        const after = isRaw ? rewritten.sourcesAfter : before.filter((s) => s !== relPath);
         sourceArrayRefs.push({ page: page.relPath, sources_before: before, sources_after: after });
       }
     }
@@ -3163,9 +3257,23 @@ async function runArchive(input) {
         if (e instanceof Error && "code" in e && e.code !== "ENOENT") throw e;
       }
     }
-    cascade = { wikilink_refs: wikilinkRefs, index_refs: indexRefs, source_array_refs: sourceArrayRefs };
-  }
-  if (input.cascade && !input.apply) {
+    cascade = { wikilink_refs: wikilinkRefs, citation_refs: citationRefs, index_refs: indexRefs, source_array_refs: sourceArrayRefs };
+  }
+  let rawPlan;
+  if (isRaw) {
+    rawPlan = await planRawStructuralMove({ vault: input.vault, operation: "archive", source: relPath, destination: archivePath });
+    if (!rawPlan.ok) return { exitCode: ExitCode.WRITE_FAILED, result: rawPlan };
+  }
+  const citationState = isRaw ? await snapshotMaintainedPageState(scan.data.allMarkdown) : [];
+  const rawApprovalToken = rawPlan?.ok ? operationId("raw-archive-approval", [
+    rawPlan.data.operation_id,
+    rawPlan.data.approval_token,
+    rawPlan.data.source_sha256,
+    archivePath,
+    ...citationState
+  ]) : void 0;
+  const rawStructuralApproval = rawPlan?.ok ? rawPlan.data.approval_token : void 0;
+  if ((input.cascade || isRaw) && !input.apply) {
     const summary = `DRY-RUN \u2014 would archive ${relPath}; ${cascade.wikilink_refs.length} wikilink ref(s), ${cascade.index_refs.length} index ref(s), ${cascade.source_array_refs.length} source array ref(s).`;
     return {
       exitCode: ExitCode.OK,
@@ -3174,37 +3282,73 @@ async function runArchive(input) {
         archived_to: archivePath,
         index_updated: false,
         applied: false,
+        ...rawApprovalToken ? { approval_token: rawApprovalToken } : {},
         cascade,
         ...remoteObjectPath ? { remote: { plannedDeletes: [remoteObjectPath], deleted: [] } } : {},
         humanHint: summary + (remoteObjectPath ? ` (remote planned ${input.remoteDelete ? "delete" : "preview"}: ${remoteObjectPath})` : "")
       })
     };
   }
-  if (input.cascade && input.apply && cascade) {
+  if (isRaw) {
+    if (!input.approve || !rawStructuralApproval || input.approve !== rawApprovalToken) {
+      return { exitCode: ExitCode.USAGE, result: err("APPROVAL_INVALID", { message: "raw archive requires the live dry-run --approve token" }) };
+    }
+    const moved = await applyRawStructuralMove({
+      vault: input.vault,
+      operation: "archive",
+      source: relPath,
+      destination: archivePath,
+      approve: rawStructuralApproval,
+      command: "skillwiki archive",
+      citationChanges: [.../* @__PURE__ */ new Set([...cascade?.source_array_refs.map((ref) => ref.page) ?? [], ...cascade?.citation_refs.map((ref) => ref.page) ?? []])]
+    });
+    if (!moved.ok) return { exitCode: ExitCode.WRITE_FAILED, result: moved };
+  }
+  if ((input.cascade || isRaw) && input.apply && cascade) {
     for (const ref of cascade.source_array_refs) {
       const absPath = join18(input.vault, ref.page);
       const text = await readFile7(absPath, "utf8");
-      const split = splitFrontmatter(text);
-      if (!split.ok) continue;
-      const before = split.data.rawFrontmatter;
-      const newSourcesYaml = ref.sources_after.length === 0 ? "sources: []" : "sources:\n" + ref.sources_after.map((s) => `  - ${s}`).join("\n");
-      const fmRewritten = before.replace(
-        /^sources:\s*(?:\[[^\]]*\]|(?:\r?\n(?:\s*-\s.*))+)/m,
-        newSourcesYaml
-      );
-      if (fmRewritten === before) continue;
       if (!arraysEqual(ref.sources_after, ref.sources_before)) {
-        await writeFile5(absPath, `---
+        let updated;
+        if (isRaw) {
+          updated = rewriteRawSourceReferences(text, relPath, archivePath).text;
+        } else {
+          const split = splitFrontmatter(text);
+          if (!split.ok) continue;
+          const newSourcesYaml = ref.sources_after.length === 0 ? "sources: []" : "sources:\n" + ref.sources_after.map((s) => `  - ${s}`).join("\n");
+          const fmRewritten = split.data.rawFrontmatter.replace(
+            /^sources:\s*(?:\[[^\]]*\]|(?:\r?\n(?:\s*-\s.*))+)/m,
+            newSourcesYaml
+          );
+          if (fmRewritten === split.data.rawFrontmatter) continue;
+          updated = `---
 ${fmRewritten}
----${split.data.body}`, "utf8");
+---${split.data.body}`;
+        }
+        const write = await safeWritePage(absPath, updated);
+        if (!write.ok) return { exitCode: ExitCode.WRITE_FAILED, result: write };
+      }
+    }
+    if (isRaw) {
+      for (const ref of cascade.citation_refs) {
+        if (cascade.source_array_refs.some((sourceRef) => sourceRef.page === ref.page)) continue;
+        const absPath = join18(input.vault, ref.page);
+        const original = await readFile7(absPath, "utf8");
+        const updated = rewriteRawSourceReferences(original, relPath, archivePath).text;
+        if (updated !== original) {
+          const write = await safeWritePage(absPath, updated);
+          if (!write.ok) return { exitCode: ExitCode.WRITE_FAILED, result: write };
+        }
       }
     }
   }
-  await mkdir6(dirname5(join18(input.vault, archivePath)), { recursive: true });
-  await rename2(join18(input.vault, relPath), join18(input.vault, archivePath));
+  if (!isRaw) {
+    await mkdir6(dirname5(join18(input.vault, archivePath)), { recursive: true });
+    await rename2(join18(input.vault, relPath), join18(input.vault, archivePath));
+  }
   let indexUpdated = false;
   if (!isRaw) {
-    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-HAXDEM2F.js");
+    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-FRWTZB5Y.js");
     const before = await readFile7(join18(input.vault, "index.md"), "utf8").catch(() => "");
     const fullTarget = relPath.replace(/\.md$/, "");
     const bare = fullTarget.split("/").pop() ?? fullTarget;
@@ -3237,7 +3381,7 @@ ${fmRewritten}
     }
     remote = pruned.data;
   }
-  const applied = input.cascade ? true : void 0;
+  const applied = input.cascade || isRaw ? true : void 0;
   const cascadeNote = input.cascade ? ` (cascade: ${cascade.source_array_refs.length} src arrays updated, ${cascade.wikilink_refs.length} wikilinks reported)` : "";
   const remoteNote = remote ? ` (remote ${input.remoteDelete ? `deleted ${remote.deleted.length}` : `planned ${remote.plannedDeletes.length}`})` : "";
   return {
@@ -3294,6 +3438,15 @@ async function runRemove(input) {
       result: err("FILE_NOT_FOUND", { page: input.page })
     };
   }
+  if (relPath.startsWith("raw/")) {
+    return {
+      exitCode: ExitCode.USAGE,
+      result: err("RAW_DISPOSAL_REQUIRES_EXACT_TARGET_APPROVAL", {
+        path: relPath,
+        message: "ordinary remove never deletes raw evidence; use sources dispose with an exact target and approved preview"
+      })
+    };
+  }
   if (relPath.startsWith("_archive/")) {
     return {
       exitCode: ExitCode.USAGE,
@@ -3313,10 +3466,10 @@ async function runRemove(input) {
   const tombstonePath = await writeDeleteIntent(input.vault, intent);
   await unlink2(join19(input.vault, relPath));
   if (relPath.endsWith(".md") && !relPath.startsWith("raw/")) {
-    const { readFile: readFile17 } = await import("fs/promises");
+    const { readFile: readFile20 } = await import("fs/promises");
     const { join: pathJoin } = await import("path");
-    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-HAXDEM2F.js");
-    const before = await readFile17(pathJoin(input.vault, "index.md"), "utf8").catch(() => "");
+    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-FRWTZB5Y.js");
+    const before = await readFile20(pathJoin(input.vault, "index.md"), "utf8").catch(() => "");
     const fullTarget = relPath.replace(/\.md$/, "");
     const bare = fullTarget.split("/").pop() ?? fullTarget;
     const hadIndexEntry = before.includes(`[[${fullTarget}]]`) || before.includes(`[[${bare}]]`);
@@ -3354,7 +3507,7 @@ async function runRemove(input) {
 }
 
 // src/commands/drift.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash2 } from "crypto";
 
 // src/utils/fetch.ts
 async function controlledFetch(url, opts) {
@@ -3433,7 +3586,7 @@ async function runDrift(input) {
       });
       continue;
     }
-    const currentHash = createHash3("sha256").update(Buffer.from(resp.data.body, "utf8")).digest("hex");
+    const currentHash = createHash2("sha256").update(Buffer.from(resp.data.body, "utf8")).digest("hex");
     const identity = assessSourceIdentity({
       rawPath: raw.relPath,
       sourceUrl,
@@ -3451,29 +3604,13 @@ async function runDrift(input) {
       continue;
     }
     const drifted2 = currentHash !== storedHash;
-    if (drifted2 && input.apply) {
-      const newFm = rawFrontmatter.replace(/^sha256:\s*[a-f0-9]+$/m, `sha256: ${currentHash}`);
-      const newText = `---
-${newFm}
----
-${body}`;
-      await safeWritePage(raw.absPath, newText);
-      results.push({
-        raw_path: raw.relPath,
-        source_url: sourceUrl,
-        stored_sha256: storedHash,
-        current_sha256: currentHash,
-        status: "updated"
-      });
-    } else {
-      results.push({
-        raw_path: raw.relPath,
-        source_url: sourceUrl,
-        stored_sha256: storedHash,
-        current_sha256: currentHash,
-        status: drifted2 ? "drifted" : "unchanged"
-      });
-    }
+    results.push({
+      raw_path: raw.relPath,
+      source_url: sourceUrl,
+      stored_sha256: storedHash,
+      current_sha256: currentHash,
+      status: drifted2 ? "drifted" : "unchanged"
+    });
   }
   const drifted = results.filter((r) => r.status === "drifted");
   const fetchFailed = results.filter((r) => r.status === "fetch_failed");
@@ -3492,14 +3629,7 @@ ${body}`;
   }
   if (fetchFailed.length > 0) hintLines.push(`fetch_failed: ${fetchFailed.length}`, ...fetchFailed.map((f) => `  ${f.raw_path}: ${f.fetch_error}`));
   if (updated.length > 0) hintLines.push(`updated: ${updated.length}`, ...updated.map((u) => `  ${u.raw_path}`));
-  if (input.apply && updated.length > 0) {
-    appendLastOp(input.vault, {
-      operation: "drift-apply",
-      summary: `updated ${updated.length} raw sources`,
-      files: updated.map((u) => u.raw_path),
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
-    });
-  }
+  if (input.apply && drifted.length > 0) hintLines.push("raw evidence is immutable; use attended reingest to create a new capture and archive the prior bytes");
   return {
     exitCode,
     result: ok({ scanned: results.length, drifted, fetch_failed: fetchFailed, identity_conflicts: identityConflicts, updated, newFiles: newResults, unchanged, humanHint: hintLines.join("\n") })
@@ -3973,7 +4103,7 @@ async function runTranscripts(input) {
 }
 
 // src/commands/compound.ts
-import { writeFile as writeFile7, mkdir as mkdir7, readdir as readdir6, unlink as unlink3 } from "fs/promises";
+import { writeFile as writeFile6, mkdir as mkdir7, readdir as readdir6, unlink as unlink3 } from "fs/promises";
 import { join as join23 } from "path";
 import { existsSync as existsSync7 } from "fs";
 import { readFile as readFile10 } from "fs/promises";
@@ -4134,7 +4264,7 @@ async function runCompound(input) {
       if (!existsSync7(compoundDir)) {
         await mkdir7(compoundDir, { recursive: true });
       }
-      await writeFile7(compoundPath, content, "utf8");
+      await writeFile6(compoundPath, content, "utf8");
     }
     promoted.push(`${slug}.md`);
   }
@@ -4258,7 +4388,7 @@ no compound entries found`;
 }
 
 // src/commands/session-brief.ts
-import { mkdir as mkdir8, readFile as readFile11, writeFile as writeFile8 } from "fs/promises";
+import { mkdir as mkdir8, readFile as readFile11, writeFile as writeFile7 } from "fs/promises";
 import { join as join24, relative, sep } from "path";
 var MAX_WORDS = 900;
 async function runSessionBrief(input) {
@@ -4278,7 +4408,8 @@ async function runSessionBrief(input) {
       baseHealthWarnings,
       satelliteHealth,
       sessionPins,
-      memoryTopics
+      memoryTopics,
+      pendingSources
     ] = await Promise.all([
       loadTranscriptInfo(scan.data.raw),
       loadWorkItems(scan.data.workItems),
@@ -4286,7 +4417,8 @@ async function runSessionBrief(input) {
       loadHealthWarnings(input.vault),
       loadSatelliteHealth(input.vault),
       loadSessionPins(input.vault, project),
-      project ? loadMemoryTopics(input.vault, project) : Promise.resolve([])
+      project ? loadMemoryTopics(input.vault, project) : Promise.resolve([]),
+      loadPendingSources(input.vault, today)
     ]);
     const healthWarnings = [
       ...baseHealthWarnings,
@@ -4309,6 +4441,7 @@ async function runSessionBrief(input) {
       sessionPins,
       latestLogs,
       unclaimedCaptures,
+      pendingSources,
       activeWork,
       latestDigest,
       projectLogs,
@@ -4343,6 +4476,7 @@ async function runSessionBrief(input) {
         log_updated: logUpdated,
         generated_at: generatedAt,
         session_pins: sessionPins,
+        pending_sources: pendingSources,
         memory_topics: memoryTopics,
         humanHint
       })
@@ -4408,6 +4542,17 @@ async function loadTranscriptInfo(rawPages) {
   }
   return out;
 }
+async function loadPendingSources(vault, today) {
+  const inventory = await inventorySources({ vault, today });
+  if (!inventory.output) return [];
+  return inventory.output.items.filter((item) => item.storage_status === "active" && item.lifecycle_status === "pending").slice(0, 5).map((item) => ({
+    path: item.raw_path,
+    title: item.title,
+    summary: item.source_url ?? `${item.schema_status} source awaiting integration`,
+    date: item.captured ?? "",
+    status: item.schema_status
+  }));
+}
 async function loadWorkItems(workItemPages) {
   const out = [];
   for (const page of workItemPages.filter((p) => p.relPath.endsWith("/spec.md"))) {
@@ -4478,6 +4623,7 @@ function renderBrief(input) {
   appendPinnedContextSection(lines, input.sessionPins);
   appendSection(lines, "Active Work", input.activeWork, "No active project work found.");
   appendSection(lines, "Unclaimed Captures", input.unclaimedCaptures, "No unclaimed task or bug captures found.");
+  appendSection(lines, "Recent Pending Sources", input.pendingSources, "No pending articles or papers found.");
   appendSection(lines, "Recent Session Logs", input.project ? input.projectLogs : input.latestLogs, "No recent session logs found.");
   appendSection(lines, "Latest Agent Memory Trends", input.latestDigest, "No agent memory trends digest found.");
   appendMemoryTopicsSection(lines, input.project, input.memoryTopics);
@@ -4488,6 +4634,7 @@ function renderBrief(input) {
     "- `skillwiki status`",
     input.project ? `- \`skillwiki project-index ${input.project}\`` : '- `skillwiki query "active work"`',
     "- `skillwiki transcripts --since <date>`",
+    "- `skillwiki sources pending`",
     ""
   );
   return lines.join("\n").trimEnd() + "\n";
@@ -4609,9 +4756,9 @@ async function writeBriefArtifacts(vault, input) {
   const previousComparable = comparableBrief(await readIfExists(metaPath));
   const nextComparable = comparableBrief(committed);
   const materialChange = previousComparable !== nextComparable;
-  await writeFile8(metaPath, committed, "utf8");
-  await writeFile8(cacheMdPath, input.brief, "utf8");
-  await writeFile8(cacheJsonPath, `${JSON.stringify({
+  await writeFile7(metaPath, committed, "utf8");
+  await writeFile7(cacheMdPath, input.brief, "utf8");
+  await writeFile7(cacheJsonPath, `${JSON.stringify({
     project: input.project,
     brief: input.brief,
     word_count: input.wordCount,
@@ -4731,9 +4878,236 @@ import { join as join26 } from "path";
 import { createHash as createHash4 } from "crypto";
 
 // src/commands/page-publish.ts
-import { realpathSync } from "fs";
+import { readFileSync as readFileSync12, realpathSync } from "fs";
 import { readFile as readFile12 } from "fs/promises";
 import { join as join25, resolve as resolve3 } from "path";
+
+// src/utils/publication-approval.ts
+import { createHash as createHash3 } from "crypto";
+var APPROVAL_CONTRACT = "skillwiki-publication-approval-v1";
+var APPROVAL_TOKEN_VERSION = "swpub1";
+var SHA256_HEX = /^[0-9a-f]{64}$/;
+var PUBLISHERS = /* @__PURE__ */ new Set(["page", "project-page"]);
+function sha256Hex(bytes) {
+  return createHash3("sha256").update(bytes).digest("hex");
+}
+function normalizeLogNote(note) {
+  if (note === void 0) return "";
+  return note.normalize("NFC").trim();
+}
+function isPlainObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function canonicalApprovalJson(payload) {
+  const ordered = {
+    contract: payload.contract,
+    publisher: payload.publisher,
+    draft_sha256: payload.draft_sha256,
+    target: payload.target
+  };
+  if (payload.publisher === "project-page" && payload.project !== void 0) {
+    ordered.project = payload.project;
+  }
+  ordered.log_note = payload.log_note;
+  ordered.prior_target_sha256 = payload.prior_target_sha256;
+  return JSON.stringify(ordered);
+}
+function base64UrlEncode(text) {
+  return Buffer.from(text, "utf8").toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function base64UrlDecode(segment) {
+  if (!/^[A-Za-z0-9_-]+$/.test(segment)) {
+    return err("APPROVAL_INVALID", { message: "payload is not base64url" });
+  }
+  const padded = segment + "=".repeat((4 - segment.length % 4) % 4);
+  const b64 = padded.replace(/-/g, "+").replace(/_/g, "/");
+  try {
+    return ok(Buffer.from(b64, "base64").toString("utf8"));
+  } catch (error) {
+    return err("APPROVAL_INVALID", { message: `payload decode failed: ${String(error)}` });
+  }
+}
+function validatePayloadShape(value) {
+  if (!isPlainObject2(value)) {
+    return err("APPROVAL_INVALID", { message: "payload must be a JSON object" });
+  }
+  if (value.contract !== APPROVAL_CONTRACT) {
+    return err("APPROVAL_INVALID", { message: "unknown approval contract version" });
+  }
+  if (typeof value.publisher !== "string" || !PUBLISHERS.has(value.publisher)) {
+    return err("APPROVAL_INVALID", { message: "unknown publisher kind" });
+  }
+  const publisher = value.publisher;
+  if (typeof value.draft_sha256 !== "string" || !SHA256_HEX.test(value.draft_sha256)) {
+    return err("APPROVAL_INVALID", { message: "draft_sha256 must be 64 lowercase hex chars" });
+  }
+  if (typeof value.target !== "string" || value.target.length === 0 || value.target.length > 500) {
+    return err("APPROVAL_INVALID", { message: "invalid target" });
+  }
+  if (typeof value.log_note !== "string" || /[\r\n]/.test(value.log_note)) {
+    return err("APPROVAL_INVALID", { message: "log_note must be a single line string" });
+  }
+  if (Buffer.byteLength(value.log_note, "utf8") > 500) {
+    return err("APPROVAL_INVALID", { message: "log_note exceeds 500 UTF-8 bytes" });
+  }
+  const prior = value.prior_target_sha256;
+  if (typeof prior !== "string" || prior !== "absent" && !SHA256_HEX.test(prior)) {
+    return err("APPROVAL_INVALID", { message: "prior_target_sha256 must be hex or absent" });
+  }
+  if (publisher === "project-page") {
+    if (typeof value.project !== "string" || !/^[a-z0-9][a-z0-9-]*$/.test(value.project)) {
+      return err("APPROVAL_INVALID", { message: "project-page token requires a valid project slug" });
+    }
+    return ok({
+      contract: APPROVAL_CONTRACT,
+      publisher,
+      draft_sha256: value.draft_sha256,
+      target: value.target,
+      project: value.project,
+      log_note: value.log_note,
+      prior_target_sha256: prior
+    });
+  }
+  if (value.project !== void 0 && value.project !== null) {
+    return err("APPROVAL_INVALID", { message: "page publisher token must omit project" });
+  }
+  return ok({
+    contract: APPROVAL_CONTRACT,
+    publisher,
+    draft_sha256: value.draft_sha256,
+    target: value.target,
+    log_note: value.log_note,
+    prior_target_sha256: prior
+  });
+}
+function buildApprovalPayload(input) {
+  const base = {
+    contract: APPROVAL_CONTRACT,
+    publisher: input.publisher,
+    draft_sha256: input.draft_sha256,
+    target: input.target,
+    log_note: normalizeLogNote(input.log_note),
+    prior_target_sha256: input.prior_target_sha256,
+    ...input.publisher === "project-page" ? { project: input.project } : {}
+  };
+  return validatePayloadShape(base);
+}
+function encodeApprovalToken(payload) {
+  const validated = validatePayloadShape(payload);
+  if (!validated.ok) return validated;
+  const json = canonicalApprovalJson(validated.data);
+  const middle = base64UrlEncode(json);
+  const checksum = sha256Hex(middle);
+  return ok(`${APPROVAL_TOKEN_VERSION}.${middle}.${checksum}`);
+}
+function decodeApprovalToken(token) {
+  if (typeof token !== "string" || token.length === 0) {
+    return err("APPROVAL_INVALID", { message: "empty approval token" });
+  }
+  if (token.includes("\n") || token.includes("---\n") || token.includes("```")) {
+    return err("APPROVAL_INVALID", { message: "token must not contain raw draft content" });
+  }
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return err("APPROVAL_INVALID", { message: "token must have three segments" });
+  }
+  const [version, middle, checksum] = parts;
+  if (version !== APPROVAL_TOKEN_VERSION) {
+    return err("APPROVAL_INVALID", { message: "unknown token version" });
+  }
+  if (!SHA256_HEX.test(checksum)) {
+    return err("APPROVAL_INVALID", { message: "checksum must be 64 lowercase hex chars" });
+  }
+  const expectedChecksum = sha256Hex(middle);
+  if (expectedChecksum !== checksum) {
+    return err("APPROVAL_INVALID", { message: "checksum mismatch" });
+  }
+  const decoded = base64UrlDecode(middle);
+  if (!decoded.ok) return decoded;
+  let parsed;
+  try {
+    parsed = JSON.parse(decoded.data);
+  } catch {
+    return err("APPROVAL_INVALID", { message: "payload is not valid JSON" });
+  }
+  const shaped = validatePayloadShape(parsed);
+  if (!shaped.ok) return shaped;
+  if (base64UrlEncode(canonicalApprovalJson(shaped.data)) !== middle) {
+    return err("APPROVAL_INVALID", { message: "payload is not in canonical form" });
+  }
+  return shaped;
+}
+function verifyApprovalToken(token, expected) {
+  const decoded = decodeApprovalToken(token);
+  if (!decoded.ok) return decoded;
+  const payload = decoded.data;
+  if (payload.publisher !== expected.publisher) {
+    return err("APPROVAL_MISMATCH", {
+      field: "publisher",
+      expected: expected.publisher,
+      actual: payload.publisher
+    });
+  }
+  if (payload.draft_sha256 !== expected.draft_sha256) {
+    return err("APPROVAL_MISMATCH", {
+      field: "draft_sha256",
+      expected: expected.draft_sha256,
+      actual: payload.draft_sha256
+    });
+  }
+  if (payload.target !== expected.target) {
+    return err("APPROVAL_MISMATCH", {
+      field: "target",
+      expected: expected.target,
+      actual: payload.target
+    });
+  }
+  if (payload.prior_target_sha256 !== expected.prior_target_sha256) {
+    return err("APPROVAL_MISMATCH", {
+      field: "prior_target_sha256",
+      expected: expected.prior_target_sha256,
+      actual: payload.prior_target_sha256
+    });
+  }
+  const expectedNote = normalizeLogNote(expected.log_note);
+  if (payload.log_note !== expectedNote) {
+    return err("APPROVAL_MISMATCH", {
+      field: "log_note",
+      expected: expectedNote,
+      actual: payload.log_note
+    });
+  }
+  if (expected.publisher === "project-page") {
+    if (payload.project !== expected.project) {
+      return err("APPROVAL_MISMATCH", {
+        field: "project",
+        expected: expected.project,
+        actual: payload.project
+      });
+    }
+  } else if (payload.project !== void 0) {
+    return err("APPROVAL_MISMATCH", {
+      field: "project",
+      expected: null,
+      actual: payload.project
+    });
+  }
+  return ok(payload);
+}
+function operationIdFromApproval(payload) {
+  const namespace = `${payload.contract}:${payload.publisher}`;
+  return operationId(namespace, [
+    payload.draft_sha256,
+    payload.target,
+    payload.project ?? "",
+    payload.log_note
+  ]);
+}
+function redactApprovalTokens(text) {
+  return text.replace(/swpub1\.[A-Za-z0-9_-]+\.[0-9a-f]{64}/g, "swpub1.[REDACTED]");
+}
+
+// src/commands/page-publish.ts
 var DEFAULT_DEPS2 = {
   afterStage: async () => void 0,
   preflight: (input) => runManagedWritePreflight(input)
@@ -4758,6 +5132,16 @@ function errorExitCode(error) {
       return ExitCode.SYNC_LOCK_HELD;
     case "PREFLIGHT_FAILED":
       return ExitCode.PREFLIGHT_FAILED;
+    case "APPROVAL_REQUIRED":
+      return ExitCode.APPROVAL_REQUIRED;
+    case "APPROVAL_INVALID":
+      return ExitCode.APPROVAL_INVALID;
+    case "APPROVAL_MISMATCH":
+      return ExitCode.APPROVAL_MISMATCH;
+    case "TARGET_DRIFT":
+      return ExitCode.TARGET_DRIFT;
+    case "USAGE":
+      return ExitCode.USAGE;
     case "EVENT_IDENTITY_COLLISION":
     case "WRITE_FAILED":
       return ExitCode.WRITE_FAILED;
@@ -4765,9 +5149,6 @@ function errorExitCode(error) {
       return ExitCode.INVALID_FRONTMATTER;
   }
 }
-function publicationId(target, content, logNote = "") {
-  return operationId("skillwiki-page-publish-v1", [target, content, logNote]);
-}
 function resolveRootAggregateMode(env = process.env) {
   if (env.SKILLWIKI_ROOT_AGGREGATE_MODE === "source-only") return "source-only";
   return "dual";
@@ -4780,7 +5161,7 @@ function prepareFrozenPublication(input, source) {
   if (input.logNote !== void 0 && /[\r\n]/.test(input.logNote)) {
     return err("SCHEME_REJECTED", { message: "log note must be one line" });
   }
-  const logNote = input.logNote?.trim() || void 0;
+  const logNote = normalizeLogNote(input.logNote) || void 0;
   if (logNote && Buffer.byteLength(logNote, "utf8") > 500) {
     return err("SCHEME_REJECTED", { message: "log note must be one line and at most 500 UTF-8 bytes" });
   }
@@ -4790,14 +5171,41 @@ function prepareFrozenPublication(input, source) {
   const date = (input.now ?? /* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const taxonomyComment = taxonomyCommentForPage(input.target, date);
   if (!taxonomyComment.ok) return taxonomyComment;
+  const draftSha256 = sha256Hex(input.content);
+  let priorTargetSha256 = input.priorTargetSha256;
+  if (priorTargetSha256 === void 0) {
+    try {
+      const existing = readFileSync12(target.data.absolutePath, "utf8");
+      priorTargetSha256 = sha256Hex(existing);
+    } catch (error) {
+      if (error.code === "ENOENT") priorTargetSha256 = "absent";
+      else {
+        return err("WRITE_FAILED", {
+          path: target.data.absolutePath,
+          message: String(error)
+        });
+      }
+    }
+  }
+  const approvalPayload = buildApprovalPayload({
+    publisher: "page",
+    draft_sha256: draftSha256,
+    target: input.target,
+    log_note: logNote ?? "",
+    prior_target_sha256: priorTargetSha256
+  });
+  if (!approvalPayload.ok) return approvalPayload;
   return ok({
     page: page.data,
     source,
     targetPath: target.data.absolutePath,
     logNote,
-    operationId: publicationId(input.target, input.content, logNote),
+    operationId: operationIdFromApproval(approvalPayload.data),
     date,
-    taxonomyComment: taxonomyComment.data
+    taxonomyComment: taxonomyComment.data,
+    draftSha256,
+    priorTargetSha256,
+    approvalPayload: approvalPayload.data
   });
 }
 function preparePagePublicationFromContent(input) {
@@ -4944,7 +5352,7 @@ function redactDetail(detail) {
   if (detail === void 0) return void 0;
   try {
     const encoded = JSON.stringify(detail);
-    return JSON.parse(redactSensitiveContent(encoded).text);
+    return JSON.parse(redactApprovalTokens(redactSensitiveContent(encoded).text));
   } catch {
     return { message: "unserializable error detail omitted" };
   }
@@ -4964,7 +5372,7 @@ function phaseFailure(stage, input, published, cause, context = {}, exitCode = E
     })
   };
 }
-function successReceipt(input, taxonomyAdded, pageChanged, indexUpdated, logAppended, filesChanged, dryRun = false, receipt = null) {
+function successReceipt(input, taxonomyAdded, pageChanged, indexUpdated, logAppended, filesChanged, dryRun = false, receipt = null, approvalToken) {
   return {
     exitCode: ExitCode.OK,
     result: ok({
@@ -4980,6 +5388,9 @@ function successReceipt(input, taxonomyAdded, pageChanged, indexUpdated, logAppe
       files_changed: filesChanged,
       base_oid: receipt?.base_oid ?? null,
       write_mode: receipt?.mode ?? null,
+      draft_sha256: input.draftSha256,
+      target_before: input.priorTargetSha256,
+      ...approvalToken ? { approval_token: approvalToken } : {},
       ...receipt ? {
         mutation_vault: receipt.mutation_vault,
         git_vault: receipt.git_vault,
@@ -5053,6 +5464,8 @@ async function previewPreparedPagePublication(input, vault) {
     ...index.data.changed ? ["index.md"] : [],
     ...logAppended ? ["log.md"] : []
   ];
+  const token = encodeApprovalToken(input.approvalPayload);
+  if (!token.ok) return { exitCode: errorExitCode(token.error), result: token };
   return successReceipt(
     input,
     reconciled.data.added,
@@ -5060,7 +5473,9 @@ async function previewPreparedPagePublication(input, vault) {
     index.data.changed,
     logAppended,
     filesChanged,
-    true
+    true,
+    null,
+    token.data
   );
 }
 async function publishPreparedPageWithReceipt(input, vault, writeReceipt, deps = DEFAULT_DEPS2) {
@@ -5223,9 +5638,30 @@ async function publishPreparedPage(input, vault, deps = DEFAULT_DEPS2) {
   });
 }
 async function runPagePublish(input, deps = DEFAULT_DEPS2) {
+  if (input.approve && !input.write) {
+    return {
+      exitCode: ExitCode.USAGE,
+      result: err("USAGE", { message: "--approve requires --write" })
+    };
+  }
   const prepared = await preparePagePublication(input);
   if (!prepared.ok) return { exitCode: errorExitCode(prepared.error), result: prepared };
   if (!input.write) return previewPreparedPagePublication(prepared.data, input.vault);
+  if (input.approve) {
+    const verified = verifyApprovalToken(input.approve, {
+      publisher: "page",
+      draft_sha256: prepared.data.draftSha256,
+      target: prepared.data.page.target,
+      log_note: prepared.data.logNote ?? "",
+      prior_target_sha256: prepared.data.priorTargetSha256
+    });
+    if (!verified.ok) {
+      return {
+        exitCode: errorExitCode(verified.error),
+        result: err(verified.error, redactDetail(verified.detail))
+      };
+    }
+  }
   return publishPreparedPage(prepared.data, input.vault, deps);
 }
 
@@ -5252,13 +5688,13 @@ function isUrl(source) {
 function todayIso() {
   return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
 }
-function buildRawContent(sourceUrl, ingested, sha256, body) {
+function buildRawContent(sourceUrl, ingested, sha2562, body) {
   const lines = [
     "---",
     sourceUrl !== null ? `source_url: "${sourceUrl}"` : "source_url:",
     `created: ${ingested}`,
     `ingested: ${ingested}`,
-    `sha256: ${sha256}`,
+    `sha256: ${sha2562}`,
     `ingested_by: wiki-ingest`,
     "---",
     "",
@@ -5372,7 +5808,7 @@ async function acquireRawCaptureLock(path) {
       if (error.code !== "EEXIST") {
         return err("WRITE_FAILED", { path: lockPath, phase: "raw-lock", message: String(error) });
       }
-      await new Promise((resolve4) => setTimeout(resolve4, 10));
+      await new Promise((resolve6) => setTimeout(resolve6, 10));
     }
   }
   return err("WRITE_FAILED", { path: lockPath, phase: "raw-lock", message: "raw capture lock held" });
@@ -5464,7 +5900,7 @@ async function runIngest(input, pagePublishDeps = defaultPagePublishDeps()) {
       })
     };
   }
-  const sha256 = createHash4("sha256").update(Buffer.from(sourceContent, "utf8")).digest("hex");
+  const sha2562 = createHash4("sha256").update(Buffer.from(sourceContent, "utf8")).digest("hex");
   const today = todayIso();
   const slug = slugify2(input.title);
   const tags = input.tags && input.tags.length > 0 ? input.tags : [];
@@ -5495,7 +5931,7 @@ async function runIngest(input, pagePublishDeps = defaultPagePublishDeps()) {
     path: rawAbsPath,
     sourceUrl,
     sourceContent,
-    sha256,
+    sha256: sha2562,
     today
   });
   if (!resolvedRaw.ok) {
@@ -5552,11 +5988,11 @@ async function runIngest(input, pagePublishDeps = defaultPagePublishDeps()) {
       result: ok({
         raw_path: rawRelPath,
         typed_path: typedRelPath,
-        sha256,
+        sha256: sha2562,
         dry_run: true,
         humanHint: [
           "DRY RUN \u2014 would create:",
-          `  ${rawRelPath} (sha256: ${sha256.slice(0, 12)}...)`,
+          `  ${rawRelPath} (sha256: ${sha2562.slice(0, 12)}...)`,
           `  ${typedRelPath}`,
           `  type: ${input.type}, tags: [${tags.join(", ")}]`,
           input.provenance ? `  provenance: ${input.provenance}` : ""
@@ -5584,7 +6020,7 @@ async function runIngest(input, pagePublishDeps = defaultPagePublishDeps()) {
         path: rawAbsPath,
         sourceUrl,
         sourceContent,
-        sha256,
+        sha256: sha2562,
         today,
         capture: resolvedRaw.data
       });
@@ -5651,11 +6087,11 @@ async function runIngest(input, pagePublishDeps = defaultPagePublishDeps()) {
         result: ok({
           raw_path: rawRelPath,
           typed_path: typedRelPath,
-          sha256,
+          sha256: sha2562,
           dry_run: false,
           humanHint: [
             "created:",
-            `  ${rawRelPath} (sha256: ${sha256.slice(0, 12)}...)`,
+            `  ${rawRelPath} (sha256: ${sha2562.slice(0, 12)}...)`,
             `  ${typedRelPath}`
           ].join("\n"),
           publication: published.result.data
@@ -6005,82 +6441,1361 @@ async function runTagReconcile(input) {
   };
 }
 
-// src/commands/sync.ts
-import { existsSync as existsSync8 } from "fs";
-import { join as join28 } from "path";
-import { execFileSync as execFileSync3 } from "child_process";
-
-// src/utils/vault-git-pathspec.ts
-var VAULT_GENERATED_COMMIT_PATHS = [
-  ".skillwiki/last-op.json",
-  ".skillwiki/memory",
-  ".skillwiki/memory-topics.json"
-];
-var VAULT_GENERATED_COMMIT_EXCLUDES = [
-  ...VAULT_GENERATED_COMMIT_PATHS.map((path) => `:!${path}`)
-];
-var VAULT_COMMIT_PATHSPEC = [".", ...VAULT_GENERATED_COMMIT_EXCLUDES];
-function stageVaultContentChanges(vault) {
-  gitStrict(vault, ["add", "-A", "--", "."]);
-  for (const generatedPath of VAULT_GENERATED_COMMIT_PATHS) {
-    try {
-      gitStrict(vault, ["reset", "HEAD", "--", generatedPath]);
-    } catch (_e) {
-    }
-  }
-}
+// src/commands/project-page-publish.ts
+import { realpathSync as realpathSync4 } from "fs";
+import { mkdir as mkdir10, readFile as readFile15 } from "fs/promises";
+import { dirname as dirname8, join as join29, resolve as resolve5 } from "path";
 
-// src/commands/sync.ts
-function parseDirtyPaths(porcelain) {
-  if (!porcelain) return [];
-  return porcelain.split("\n").map((line) => line.trimEnd()).filter((line) => line.length >= 4).map((line) => {
-    const payload = line.length >= 3 && line[2] === " " ? line.slice(3) : line.length >= 2 && line[1] === " " ? line.slice(2) : line;
-    const arrow = payload.lastIndexOf(" -> ");
-    return arrow >= 0 ? payload.slice(arrow + 4) : payload;
-  }).filter((path) => path.length > 0);
+// src/utils/architecture-page.ts
+import { lstatSync, realpathSync as realpathSync2 } from "fs";
+import { dirname as dirname6, posix as posix2, relative as relative2, resolve as resolve4, sep as sep2 } from "path";
+var PROJECT_SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
+var ARCH_TARGET_RE = /^projects\/([a-z0-9][a-z0-9-]*)\/architecture\/([a-z0-9][a-z0-9._-]*\.md)$/;
+function invalidFrontmatter(target, issues) {
+  return err("INVALID_FRONTMATTER", {
+    target,
+    errors: issues.map((issue) => ({ path: issue.path.join("."), message: issue.message }))
+  });
 }
-function splitNonEmptyLines(text) {
-  if (!text) return [];
-  return text.split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
+function validateProjectSlug(slug) {
+  if (!PROJECT_SLUG_RE.test(slug)) {
+    return err("VAULT_PATH_INVALID", { project: slug, message: "invalid project slug" });
+  }
+  return ok(slug);
 }
-function isTrackedNotePath(path) {
-  if (!path.endsWith(".md")) return false;
-  return !/^\.(skillwiki|claude|obsidian|antigravitycli|playwright-cli)\//.test(path);
+function validateArchitectureTarget(target, project) {
+  const slug = validateProjectSlug(project);
+  if (!slug.ok) return slug;
+  if (target.length === 0 || posix2.isAbsolute(target) || target.includes("\\") || posix2.normalize(target) !== target || target.split("/").some((segment) => segment === "" || segment === "." || segment === "..")) {
+    return err("VAULT_PATH_INVALID", { target, message: "unsafe architecture target" });
+  }
+  const match = ARCH_TARGET_RE.exec(target);
+  if (!match) {
+    return err("VAULT_PATH_INVALID", {
+      target,
+      message: "target must be projects/{slug}/architecture/{filename}.md"
+    });
+  }
+  if (match[1] !== project) {
+    return err("VAULT_PATH_INVALID", {
+      target,
+      project,
+      message: "project slug does not match architecture target path"
+    });
+  }
+  return ok(target);
 }
-function refHasPath(vault, ref, path) {
+function assertArchitectureTargetInsideVault(vault, target, project) {
+  const validated = validateArchitectureTarget(target, project);
+  if (!validated.ok) return validated;
+  let vaultReal;
   try {
-    execFileSync3("git", ["cat-file", "-e", `${ref}:${path}`], {
-      cwd: vault,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    return true;
+    vaultReal = realpathSync2(vault);
   } catch {
-    return false;
+    return err("VAULT_PATH_INVALID", { target, message: "vault realpath failed" });
   }
-}
-function runSyncStatus(input) {
-  const vault = input.vault;
-  const includeStashes = input.includeStashes ?? false;
-  if (!existsSync8(join28(vault, ".git"))) {
-    return {
-      exitCode: ExitCode.VAULT_PATH_INVALID,
-      result: ok({
-        is_git_repo: false,
-        dirty: 0,
-        ahead: 0,
-        behind: 0,
-        unpromoted_note_paths: 0,
-        unpromoted_note_examples: [],
-        last_commit: "never",
-        status: "not_a_repo",
-        humanHint: "not a git repository"
-      })
-    };
+  const absolutePath = resolve4(vaultReal, target);
+  const parent = dirname6(absolutePath);
+  let parentReal;
+  try {
+    parentReal = realpathSync2(parent);
+  } catch {
+    return err("VAULT_PATH_INVALID", { target, message: "target parent realpath failed" });
   }
-  enableGitLongPathsOnWindows(vault);
-  const porcelain = git(vault, ["status", "--porcelain"]);
-  const dirty = porcelain ? porcelain.split("\n").filter((l) => l.trim().length > 0).length : 0;
-  const dirtyPaths = parseDirtyPaths(porcelain);
+  const parentRelative = relative2(vaultReal, parentReal).split(sep2).join("/");
+  if (parentRelative === ".." || parentRelative.startsWith("../")) {
+    return err("VAULT_PATH_INVALID", { target, message: "target parent escapes vault" });
+  }
+  if (parentReal !== parent) {
+    return err("VAULT_PATH_INVALID", { target, message: "target parent may not be a symlink alias" });
+  }
+  let existingRealPath;
+  try {
+    const targetStat = lstatSync(absolutePath);
+    if (targetStat.isSymbolicLink()) {
+      return err("VAULT_PATH_INVALID", { target, message: "target may not be a symlink" });
+    }
+    if (!targetStat.isFile()) {
+      return err("VAULT_PATH_INVALID", { target, message: "existing target must be a regular file" });
+    }
+    try {
+      existingRealPath = realpathSync2(absolutePath);
+    } catch {
+      return err("VAULT_PATH_INVALID", { target, message: "target realpath failed" });
+    }
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      return err("VAULT_PATH_INVALID", { target, message: "target lstat failed" });
+    }
+  }
+  return ok({ absolutePath, existingRealPath });
+}
+function provenanceIncludesProject(provenanceProjects, project) {
+  if (!provenanceProjects) return false;
+  const wanted = `[[${project}]]`;
+  return provenanceProjects.some((entry) => entry === wanted || entry === project);
+}
+function prepareArchitecturePage(content, target, project, opts = { isNew: true }) {
+  const safeTarget = validateArchitectureTarget(target, project);
+  if (!safeTarget.ok) return safeTarget;
+  const sensitive = scanSensitiveContent(content, { file: target });
+  if (sensitive.length > 0) {
+    return err("SENSITIVE_CONTENT_DETECTED", { file: target, findings: sensitive });
+  }
+  const frontmatter = extractFrontmatter(content);
+  if (!frontmatter.ok) return frontmatter;
+  const detected = detectSchema(frontmatter.data);
+  if (detected.schema !== "typed-knowledge") {
+    return err("SCHEME_REJECTED", {
+      target,
+      message: "architecture pages must use typed-knowledge frontmatter"
+    });
+  }
+  const parsed = TypedKnowledgeSchema.safeParse(frontmatter.data);
+  if (!parsed.success) return invalidFrontmatter(target, parsed.error.issues);
+  if (parsed.data.type !== "concept") {
+    return err("SCHEME_REJECTED", {
+      target,
+      type: parsed.data.type,
+      message: "architecture pages require type: concept"
+    });
+  }
+  const provenance = parsed.data.provenance;
+  if (provenance !== "project" && provenance !== "mixed") {
+    return err("SCHEME_REJECTED", {
+      target,
+      provenance,
+      message: "architecture pages require provenance: project or mixed"
+    });
+  }
+  if (!provenanceIncludesProject(parsed.data.provenance_projects, project)) {
+    return err("SCHEME_REJECTED", {
+      target,
+      project,
+      message: "provenance_projects must include the target project"
+    });
+  }
+  const tags = [...parsed.data.tags];
+  if (opts.isNew && !tags.includes("adr")) {
+    return err("SCHEME_REJECTED", {
+      target,
+      message: "newly created architecture pages require the adr tag"
+    });
+  }
+  return ok({
+    target,
+    project,
+    title: parsed.data.title,
+    type: "concept",
+    tags,
+    content,
+    isNew: opts.isNew
+  });
+}
+
+// src/utils/publication-operation-journal.ts
+import {
+  chmodSync,
+  existsSync as existsSync8,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync13,
+  realpathSync as realpathSync3,
+  renameSync as renameSync3,
+  unlinkSync,
+  writeFileSync as writeFileSync5
+} from "fs";
+import { homedir } from "os";
+import { dirname as dirname7, join as join28 } from "path";
+var PUBLICATION_JOURNAL_SCHEMA = "skillwiki-publication-operation-v1";
+var PHASE_ORDER2 = [
+  "locked",
+  "taxonomy",
+  "page",
+  "verified",
+  "project-index",
+  "unlocked",
+  "event",
+  "log",
+  "complete"
+];
+function phaseIndex2(phase) {
+  return PHASE_ORDER2.indexOf(phase);
+}
+function isValidPhase(phase) {
+  return PHASE_ORDER2.includes(phase);
+}
+function vaultIdentity(vaultPath) {
+  let real;
+  try {
+    real = realpathSync3(vaultPath);
+  } catch {
+    real = vaultPath;
+  }
+  return sha256Hex(real).slice(0, 16);
+}
+function publicationJournalRoot(home = process.env.HOME || homedir()) {
+  return join28(home, ".skillwiki", "publication-operations");
+}
+function resolveJournalPaths(vaultPath, operationId2, home = process.env.HOME || homedir()) {
+  const identity = vaultIdentity(vaultPath);
+  const rootDir = publicationJournalRoot(home);
+  const vaultDir = join28(rootDir, identity);
+  return {
+    rootDir,
+    vaultDir,
+    journalPath: join28(vaultDir, `${operationId2}.json`)
+  };
+}
+function ensurePrivateDir(dir) {
+  mkdirSync3(dir, { recursive: true, mode: 448 });
+  try {
+    chmodSync(dir, 448);
+  } catch {
+  }
+}
+function atomicWriteJson(path, body) {
+  ensurePrivateDir(dirname7(path));
+  const tmp = `${path}.tmp.${process.pid}.${Date.now()}`;
+  writeFileSync5(tmp, body, { encoding: "utf8", mode: 384 });
+  try {
+    chmodSync(tmp, 384);
+  } catch {
+  }
+  renameSync3(tmp, path);
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+}
+function identityEqual(a, b) {
+  return a.publisher === b.publisher && a.draft_sha256 === b.draft_sha256 && a.target === b.target && (a.project ?? "") === (b.project ?? "") && a.log_note_sha256 === b.log_note_sha256;
+}
+function validateRecord(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return err("SCHEME_REJECTED", { message: "journal record must be an object" });
+  }
+  const rec = value;
+  if (rec.schema !== PUBLICATION_JOURNAL_SCHEMA) {
+    return err("SCHEME_REJECTED", { message: "unknown journal schema" });
+  }
+  if (typeof rec.operation_id !== "string" || !/^[0-9a-f]{64}$/.test(rec.operation_id)) {
+    return err("SCHEME_REJECTED", { message: "invalid operation_id" });
+  }
+  if (typeof rec.phase !== "string" || !isValidPhase(rec.phase)) {
+    return err("SCHEME_REJECTED", { message: "invalid phase" });
+  }
+  if (typeof rec.vault_identity !== "string" || !/^[0-9a-f]{16}$/.test(rec.vault_identity)) {
+    return err("SCHEME_REJECTED", { message: "invalid vault_identity" });
+  }
+  if (typeof rec.published !== "boolean" || typeof rec.verified !== "boolean") {
+    return err("SCHEME_REJECTED", { message: "published/verified must be booleans" });
+  }
+  if (!Array.isArray(rec.files_changed) || !rec.files_changed.every((f) => typeof f === "string")) {
+    return err("SCHEME_REJECTED", { message: "files_changed must be string[]" });
+  }
+  if (typeof rec.updated_at !== "string") {
+    return err("SCHEME_REJECTED", { message: "updated_at must be a string" });
+  }
+  const id = rec.identity;
+  if (typeof id !== "object" || id === null || Array.isArray(id)) {
+    return err("SCHEME_REJECTED", { message: "identity must be an object" });
+  }
+  const identity = id;
+  if (identity.publisher !== "page" && identity.publisher !== "project-page") {
+    return err("SCHEME_REJECTED", { message: "invalid identity.publisher" });
+  }
+  for (const field of ["draft_sha256", "target", "log_note_sha256"]) {
+    if (typeof identity[field] !== "string") {
+      return err("SCHEME_REJECTED", { message: `invalid identity.${field}` });
+    }
+  }
+  if (identity.prior_target_sha256 !== void 0 && typeof identity.prior_target_sha256 !== "string") {
+    return err("SCHEME_REJECTED", { message: "invalid identity.prior_target_sha256" });
+  }
+  for (const forbidden of ["token", "approval_token", "page_body", "content", "log_note", "credential", "password"]) {
+    if (forbidden in rec || forbidden in identity) {
+      return err("SCHEME_REJECTED", { message: `journal must not contain ${forbidden}` });
+    }
+  }
+  return ok({
+    schema: PUBLICATION_JOURNAL_SCHEMA,
+    operation_id: rec.operation_id,
+    phase: rec.phase,
+    vault_identity: rec.vault_identity,
+    identity: {
+      publisher: identity.publisher,
+      draft_sha256: identity.draft_sha256,
+      target: identity.target,
+      ...typeof identity.project === "string" ? { project: identity.project } : {},
+      log_note_sha256: identity.log_note_sha256,
+      ...typeof identity.prior_target_sha256 === "string" ? { prior_target_sha256: identity.prior_target_sha256 } : {}
+    },
+    published: rec.published,
+    verified: rec.verified,
+    files_changed: [...rec.files_changed],
+    updated_at: rec.updated_at
+  });
+}
+function buildIdentitySummary(input) {
+  return {
+    publisher: input.publisher,
+    draft_sha256: input.draft_sha256,
+    target: input.target,
+    ...input.publisher === "project-page" && input.project ? { project: input.project } : {},
+    log_note_sha256: sha256Hex(input.log_note),
+    prior_target_sha256: input.prior_target_sha256
+  };
+}
+function readPublicationJournal(vaultPath, operationId2, home = process.env.HOME || homedir()) {
+  const { journalPath: journalPath2 } = resolveJournalPaths(vaultPath, operationId2, home);
+  if (!existsSync8(journalPath2)) return ok(null);
+  let text;
+  try {
+    text = readFileSync13(journalPath2, "utf8");
+  } catch (error) {
+    return err("WRITE_FAILED", { message: `read journal failed: ${String(error)}` });
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return err("SCHEME_REJECTED", { message: "malformed journal JSON" });
+  }
+  return validateRecord(parsed);
+}
+function createPublicationJournal(input) {
+  const home = input.home ?? process.env.HOME ?? homedir();
+  const paths = resolveJournalPaths(input.vaultPath, input.operationId, home);
+  if (existsSync8(paths.journalPath)) {
+    return err("WRITE_FAILED", { message: "journal already exists", path: paths.journalPath });
+  }
+  const record = {
+    schema: PUBLICATION_JOURNAL_SCHEMA,
+    operation_id: input.operationId,
+    phase: "locked",
+    vault_identity: vaultIdentity(input.vaultPath),
+    identity: input.identity,
+    published: false,
+    verified: false,
+    files_changed: [],
+    updated_at: (input.now ?? /* @__PURE__ */ new Date()).toISOString()
+  };
+  const body = `${JSON.stringify(record, null, 2)}
+`;
+  try {
+    ensurePrivateDir(paths.vaultDir);
+    atomicWriteJson(paths.journalPath, body);
+  } catch (error) {
+    return err("WRITE_FAILED", { message: `create journal failed: ${String(error)}` });
+  }
+  return ok(record);
+}
+function advancePublicationJournal(input) {
+  const home = input.home ?? process.env.HOME ?? homedir();
+  const existing = readPublicationJournal(input.vaultPath, input.operationId, home);
+  if (!existing.ok) return existing;
+  if (!existing.data) {
+    return err("RECOVERY_EVIDENCE_MISSING", {
+      operation_id: input.operationId,
+      message: "publication journal not found"
+    });
+  }
+  const current = existing.data;
+  if (!identityEqual(current.identity, input.identity)) {
+    return err("APPROVAL_MISMATCH", {
+      message: "journal identity does not match approved payload",
+      operation_id: input.operationId
+    });
+  }
+  const from = phaseIndex2(current.phase);
+  const to = phaseIndex2(input.nextPhase);
+  if (to < from) {
+    return err("SCHEME_REJECTED", {
+      message: "phase regression refused",
+      from: current.phase,
+      to: input.nextPhase
+    });
+  }
+  if (to === from && input.nextPhase !== current.phase) {
+    return err("SCHEME_REJECTED", { message: "invalid phase transition" });
+  }
+  const record = {
+    ...current,
+    phase: input.nextPhase,
+    published: input.published ?? current.published,
+    verified: input.verified ?? current.verified,
+    files_changed: input.filesChanged ? [.../* @__PURE__ */ new Set([...current.files_changed, ...input.filesChanged])].sort() : current.files_changed,
+    updated_at: (input.now ?? /* @__PURE__ */ new Date()).toISOString()
+  };
+  const paths = resolveJournalPaths(input.vaultPath, input.operationId, home);
+  try {
+    atomicWriteJson(paths.journalPath, `${JSON.stringify(record, null, 2)}
+`);
+  } catch (error) {
+    return err("WRITE_FAILED", { message: `update journal failed: ${String(error)}` });
+  }
+  return ok(record);
+}
+function deletePublicationJournal(vaultPath, operationId2, home = process.env.HOME || homedir()) {
+  const { journalPath: journalPath2 } = resolveJournalPaths(vaultPath, operationId2, home);
+  if (!existsSync8(journalPath2)) return ok({ deleted: false });
+  try {
+    unlinkSync(journalPath2);
+    return ok({ deleted: true });
+  } catch (error) {
+    return err("WRITE_FAILED", { message: `delete journal failed: ${String(error)}` });
+  }
+}
+function completePublicationJournal(input) {
+  const advanced = advancePublicationJournal({
+    ...input,
+    nextPhase: "complete",
+    published: true,
+    verified: true
+  });
+  if (!advanced.ok) return advanced;
+  const deleted = deletePublicationJournal(
+    input.vaultPath,
+    input.operationId,
+    input.home ?? process.env.HOME ?? homedir()
+  );
+  if (!deleted.ok) return deleted;
+  return ok({ completed: true });
+}
+
+// src/commands/project-page-publish.ts
+var DEFAULT_DEPS3 = {
+  afterStage: async () => void 0,
+  preflight: (input) => runManagedWritePreflight(input)
+};
+function errorExitCode3(error) {
+  switch (error) {
+    case "FILE_NOT_FOUND":
+      return ExitCode.FILE_NOT_FOUND;
+    case "MISSING_CLOSING_DELIMITER":
+      return ExitCode.MISSING_CLOSING_DELIMITER;
+    case "SCHEME_REJECTED":
+    case "NO_TAXONOMY_BLOCK":
+      return ExitCode.SCHEME_REJECTED;
+    case "VAULT_PATH_INVALID":
+      return ExitCode.VAULT_PATH_INVALID;
+    case "SENSITIVE_CONTENT_DETECTED":
+      return ExitCode.SENSITIVE_CONTENT_DETECTED;
+    case "SYNC_LOCK_HELD":
+      return ExitCode.SYNC_LOCK_HELD;
+    case "PREFLIGHT_FAILED":
+      return ExitCode.PREFLIGHT_FAILED;
+    case "APPROVAL_REQUIRED":
+      return ExitCode.APPROVAL_REQUIRED;
+    case "APPROVAL_INVALID":
+      return ExitCode.APPROVAL_INVALID;
+    case "APPROVAL_MISMATCH":
+      return ExitCode.APPROVAL_MISMATCH;
+    case "TARGET_DRIFT":
+      return ExitCode.TARGET_DRIFT;
+    case "RECOVERY_EVIDENCE_MISSING":
+      return ExitCode.RECOVERY_EVIDENCE_MISSING;
+    case "PROJECT_NOT_FOUND":
+      return ExitCode.PROJECT_NOT_FOUND;
+    case "USAGE":
+      return ExitCode.USAGE;
+    case "EVENT_IDENTITY_COLLISION":
+    case "WRITE_FAILED":
+      return ExitCode.WRITE_FAILED;
+    default:
+      return ExitCode.INVALID_FRONTMATTER;
+  }
+}
+function redactDetail2(detail) {
+  if (detail === void 0) return void 0;
+  try {
+    const encoded = JSON.stringify(detail);
+    const redacted = redactApprovalTokens(redactSensitiveContent(encoded).text);
+    return JSON.parse(redacted);
+  } catch {
+    return { message: "unserializable error detail omitted" };
+  }
+}
+async function observeStage2(deps, stage) {
+  try {
+    await deps.afterStage(stage);
+    return void 0;
+  } catch (error) {
+    return err("WRITE_FAILED", {
+      message: redactApprovalTokens(`stage hook failed at ${stage}: ${String(error)}`)
+    });
+  }
+}
+async function readPriorTargetSha(targetPath) {
+  try {
+    const text = await readFile15(targetPath, "utf8");
+    return ok(sha256Hex(text));
+  } catch (error) {
+    if (error.code === "ENOENT") return ok("absent");
+    return err("WRITE_FAILED", { path: targetPath, message: String(error) });
+  }
+}
+function validateLogNote(logNote) {
+  if (logNote !== void 0 && /[\r\n]/.test(logNote)) {
+    return err("SCHEME_REJECTED", { message: "log note must be one line" });
+  }
+  const normalized = normalizeLogNote(logNote);
+  if (normalized && Buffer.byteLength(normalized, "utf8") > 500) {
+    return err("SCHEME_REJECTED", { message: "log note must be one line and at most 500 UTF-8 bytes" });
+  }
+  if (normalized && scanSensitiveContent(normalized, { file: "project-page-publish log note" }).length > 0) {
+    return err("SENSITIVE_CONTENT_DETECTED", {
+      message: "log note contains sensitive authentication material"
+    });
+  }
+  return ok(normalized);
+}
+async function prepareProjectPagePublication(input) {
+  let content;
+  try {
+    content = await readFile15(input.draftPath, "utf8");
+  } catch (error) {
+    return err("FILE_NOT_FOUND", { path: input.draftPath, message: String(error) });
+  }
+  let draftRealPath;
+  try {
+    draftRealPath = realpathSync4(input.draftPath);
+  } catch (error) {
+    return err("VAULT_PATH_INVALID", {
+      path: input.draftPath,
+      message: `draft realpath failed: ${String(error)}`
+    });
+  }
+  const target = assertArchitectureTargetInsideVault(input.vault, input.target, input.project);
+  if (!target.ok) return target;
+  if (resolve5(input.draftPath) === target.data.absolutePath || target.data.existingRealPath !== void 0 && draftRealPath === target.data.existingRealPath) {
+    return err("VAULT_PATH_INVALID", { message: "draft must not alias the final target" });
+  }
+  const isNew = target.data.existingRealPath === void 0;
+  const page = prepareArchitecturePage(content, input.target, input.project, { isNew });
+  if (!page.ok) return page;
+  const logNote = validateLogNote(input.logNote);
+  if (!logNote.ok) return logNote;
+  const prior = await readPriorTargetSha(target.data.absolutePath);
+  if (!prior.ok) return prior;
+  const draftSha256 = sha256Hex(content);
+  const approvalPayload = buildApprovalPayload({
+    publisher: "project-page",
+    draft_sha256: draftSha256,
+    target: input.target,
+    project: input.project,
+    log_note: logNote.data,
+    prior_target_sha256: prior.data
+  });
+  if (!approvalPayload.ok) return approvalPayload;
+  const date = (input.now ?? /* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  const taxonomyComment = taxonomyCommentForPage(input.target, date);
+  if (!taxonomyComment.ok) return taxonomyComment;
+  const identity = buildIdentitySummary({
+    publisher: "project-page",
+    draft_sha256: draftSha256,
+    target: input.target,
+    project: input.project,
+    log_note: logNote.data,
+    prior_target_sha256: prior.data
+  });
+  return ok({
+    page: page.data,
+    source: { kind: "file", realPath: draftRealPath },
+    targetPath: target.data.absolutePath,
+    logNote: logNote.data,
+    draftSha256,
+    priorTargetSha256: prior.data,
+    approvalPayload: approvalPayload.data,
+    operationId: operationIdFromApproval(approvalPayload.data),
+    identity,
+    date,
+    taxonomyComment: taxonomyComment.data
+  });
+}
+function successReceipt2(prepared, opts) {
+  return {
+    exitCode: ExitCode.OK,
+    result: ok({
+      approval_required: true,
+      ...opts.approvalToken ? { approval_token: opts.approvalToken } : {},
+      operation_id: prepared.operationId,
+      project: prepared.page.project,
+      target: prepared.page.target,
+      page_type: prepared.page.type,
+      tags: [...prepared.page.tags],
+      taxonomy_added: [...opts.taxonomyAdded],
+      page_changed: opts.pageChanged,
+      project_index_changed: opts.projectIndexChanged,
+      log_appended: opts.logAppended,
+      dry_run: opts.dryRun,
+      files_changed: opts.filesChanged,
+      draft_sha256: prepared.draftSha256,
+      target_before: prepared.priorTargetSha256,
+      base_oid: opts.receipt?.base_oid ?? null,
+      write_mode: opts.receipt?.mode ?? null,
+      ...opts.receipt ? {
+        mutation_vault: opts.receipt.mutation_vault,
+        git_vault: opts.receipt.git_vault,
+        convergence_source: opts.receipt.convergence_source
+      } : {},
+      ...opts.receipt?.convergence_vault ? { convergence_vault: opts.receipt.convergence_vault } : {},
+      ...opts.receipt?.host_id ? { host_id: opts.receipt.host_id } : {},
+      humanHint: opts.dryRun ? `dry run: would publish ${prepared.page.target} (${prepared.operationId.slice(0, 12)})` : `published ${prepared.page.target} (${prepared.operationId.slice(0, 12)})`
+    })
+  };
+}
+function phaseFailure2(stage, prepared, published, verified, cause, context = {}, exitCode = ExitCode.WRITE_FAILED) {
+  return {
+    exitCode: exitCode === ExitCode.WRITE_FAILED ? errorExitCode3(cause.error) || ExitCode.WRITE_FAILED : exitCode,
+    result: err(cause.error === "EVENT_IDENTITY_COLLISION" ? "WRITE_FAILED" : cause.error, {
+      ...context,
+      stage,
+      published,
+      verified,
+      target: prepared.page.target,
+      operation_id: prepared.operationId,
+      retry_safe: stage !== "target" && cause.error !== "TARGET_DRIFT",
+      cause_error: cause.error,
+      cause_detail: redactDetail2(cause.detail)
+    })
+  };
+}
+async function previewProjectPagePublication(prepared, vault) {
+  const schemaPath = join29(vault, "SCHEMA.md");
+  let schemaText;
+  try {
+    schemaText = await readFile15(schemaPath, "utf8");
+  } catch (error) {
+    return {
+      exitCode: ExitCode.FILE_NOT_FOUND,
+      result: err("FILE_NOT_FOUND", { path: schemaPath, message: String(error) })
+    };
+  }
+  const reconciled = reconcileTaxonomyDocument(schemaText, {
+    tags: prepared.page.tags,
+    comment: prepared.taxonomyComment
+  });
+  if (!reconciled.ok) return { exitCode: errorExitCode3(reconciled.error), result: reconciled };
+  const prior = await readPriorTargetSha(prepared.targetPath);
+  if (!prior.ok) return { exitCode: errorExitCode3(prior.error), result: prior };
+  const pageChanged = prior.data === "absent" || prior.data !== prepared.draftSha256;
+  const projectIndex = await renderProjectIndex(vault, prepared.page.project, { today: prepared.date });
+  if (!projectIndex.ok) {
+    if (projectIndex.error !== "PROJECT_NOT_FOUND") {
+      return { exitCode: errorExitCode3(projectIndex.error), result: projectIndex };
+    }
+  }
+  let projectIndexChanged = true;
+  if (projectIndex.ok) {
+    const indexPath = join29(vault, projectIndex.data.index_path);
+    try {
+      const existing = await readFile15(indexPath, "utf8");
+      projectIndexChanged = existing !== projectIndex.data.text || pageChanged;
+    } catch {
+      projectIndexChanged = true;
+    }
+  }
+  const logPath = join29(vault, "log.md");
+  let logAppended = true;
+  try {
+    const logText = await readFile15(logPath, "utf8");
+    logAppended = !logText.includes(`<!-- skillwiki-project-page-publish:${prepared.operationId} -->`);
+  } catch {
+    return {
+      exitCode: ExitCode.FILE_NOT_FOUND,
+      result: err("FILE_NOT_FOUND", { path: logPath })
+    };
+  }
+  const token = encodeApprovalToken(prepared.approvalPayload);
+  if (!token.ok) return { exitCode: errorExitCode3(token.error), result: token };
+  const filesChanged = [
+    ...reconciled.data.changed ? ["SCHEMA.md"] : [],
+    ...pageChanged ? [prepared.page.target] : [],
+    ...projectIndexChanged ? [`projects/${prepared.page.project}/knowledge.md`] : [],
+    ...logAppended ? ["log.md"] : []
+  ];
+  return successReceipt2(prepared, {
+    taxonomyAdded: reconciled.data.added,
+    pageChanged,
+    projectIndexChanged,
+    logAppended,
+    filesChanged,
+    dryRun: true,
+    approvalToken: token.data
+  });
+}
+function emptyLockedState2() {
+  return {
+    taxonomyAdded: [],
+    pageChanged: false,
+    projectIndexChanged: false,
+    published: false,
+    verified: false,
+    changed: /* @__PURE__ */ new Set()
+  };
+}
+async function revalidatePriorUnderLock(prepared, vault) {
+  const fresh = assertArchitectureTargetInsideVault(vault, prepared.page.target, prepared.page.project);
+  if (!fresh.ok) return fresh;
+  if (fresh.data.absolutePath !== prepared.targetPath) {
+    return err("VAULT_PATH_INVALID", { message: "target canonical path changed after preparation" });
+  }
+  if (prepared.source.kind === "file" && fresh.data.existingRealPath !== void 0 && fresh.data.existingRealPath === prepared.source.realPath) {
+    return err("VAULT_PATH_INVALID", { message: "draft now aliases the final target" });
+  }
+  const prior = await readPriorTargetSha(fresh.data.absolutePath);
+  if (!prior.ok) return prior;
+  if (prior.data !== prepared.priorTargetSha256) {
+    if (prior.data === prepared.draftSha256) {
+      return ok({ absolutePath: fresh.data.absolutePath });
+    }
+    return err("TARGET_DRIFT", {
+      message: "target changed since approval",
+      expected_prior: prepared.priorTargetSha256,
+      actual: prior.data
+    });
+  }
+  return ok({ absolutePath: fresh.data.absolutePath });
+}
+var PHASE_RANK = {
+  locked: 0,
+  taxonomy: 1,
+  page: 2,
+  verified: 3,
+  "project-index": 4,
+  unlocked: 5,
+  event: 6,
+  log: 7,
+  complete: 8
+};
+function phaseAtLeast(current, needed) {
+  if (!current || !isValidPhase(current)) return false;
+  return PHASE_RANK[current] >= PHASE_RANK[needed];
+}
+async function runLockedStages(prepared, vault, deps, journalHome) {
+  const state = emptyLockedState2();
+  const home = journalHome;
+  const revalidated = await revalidatePriorUnderLock(prepared, vault);
+  if (!revalidated.ok) {
+    return {
+      ok: false,
+      exitCode: errorExitCode3(revalidated.error),
+      stage: "target",
+      state,
+      cause: revalidated
+    };
+  }
+  let currentPhase = "locked";
+  const existingJournal = readPublicationJournal(vault, prepared.operationId, home);
+  if (!existingJournal.ok) {
+    return {
+      ok: false,
+      exitCode: errorExitCode3(existingJournal.error),
+      stage: "journal",
+      state,
+      cause: existingJournal
+    };
+  }
+  if (!existingJournal.data) {
+    const journal = createPublicationJournal({
+      vaultPath: vault,
+      operationId: prepared.operationId,
+      identity: prepared.identity,
+      home
+    });
+    if (!journal.ok) {
+      return {
+        ok: false,
+        exitCode: errorExitCode3(journal.error),
+        stage: "journal",
+        state,
+        cause: journal
+      };
+    }
+  } else {
+    currentPhase = existingJournal.data.phase;
+    state.published = existingJournal.data.published || phaseAtLeast(currentPhase, "page");
+    state.verified = existingJournal.data.verified || phaseAtLeast(currentPhase, "verified");
+    for (const f of existingJournal.data.files_changed) state.changed.add(f);
+  }
+  const journalHook = await observeStage2(deps, "journal");
+  if (journalHook) {
+    return { ok: false, exitCode: ExitCode.WRITE_FAILED, stage: "journal", state, cause: journalHook };
+  }
+  const schemaPath = join29(vault, "SCHEMA.md");
+  {
+    let schemaText;
+    try {
+      schemaText = await readFile15(schemaPath, "utf8");
+    } catch (error) {
+      return {
+        ok: false,
+        exitCode: ExitCode.WRITE_FAILED,
+        stage: "taxonomy",
+        state,
+        cause: err("WRITE_FAILED", { message: String(error) })
+      };
+    }
+    const reconciled = reconcileTaxonomyDocument(schemaText, {
+      tags: prepared.page.tags,
+      comment: prepared.taxonomyComment
+    });
+    if (!reconciled.ok) {
+      return {
+        ok: false,
+        exitCode: errorExitCode3(reconciled.error),
+        stage: "taxonomy",
+        state,
+        cause: reconciled
+      };
+    }
+    state.taxonomyAdded = reconciled.data.added;
+    if (reconciled.data.changed) {
+      const schemaWrite = await atomicWriteText(schemaPath, reconciled.data.text);
+      if (!schemaWrite.ok) {
+        return { ok: false, exitCode: ExitCode.WRITE_FAILED, stage: "taxonomy", state, cause: schemaWrite };
+      }
+      if (schemaWrite.data.changed) state.changed.add("SCHEMA.md");
+    }
+    if (!phaseAtLeast(currentPhase, "taxonomy")) {
+      advancePublicationJournal({
+        vaultPath: vault,
+        operationId: prepared.operationId,
+        identity: prepared.identity,
+        nextPhase: "taxonomy",
+        filesChanged: [...state.changed],
+        home
+      });
+      currentPhase = "taxonomy";
+    }
+    const taxonomyHook = await observeStage2(deps, "taxonomy");
+    if (taxonomyHook) {
+      return { ok: false, exitCode: ExitCode.WRITE_FAILED, stage: "taxonomy", state, cause: taxonomyHook };
+    }
+  }
+  if (!phaseAtLeast(currentPhase, "page")) {
+    try {
+      await mkdir10(dirname8(prepared.targetPath), { recursive: true });
+    } catch (error) {
+      return {
+        ok: false,
+        exitCode: ExitCode.WRITE_FAILED,
+        stage: "page",
+        state,
+        cause: err("WRITE_FAILED", { message: String(error) })
+      };
+    }
+    const pageWrite = await safeWritePage(prepared.targetPath, prepared.page.content);
+    if (!pageWrite.ok) {
+      return { ok: false, exitCode: errorExitCode3(pageWrite.error), stage: "page", state, cause: pageWrite };
+    }
+    state.pageChanged = pageWrite.data.changed;
+    if (state.pageChanged) state.changed.add(prepared.page.target);
+    state.published = true;
+    advancePublicationJournal({
+      vaultPath: vault,
+      operationId: prepared.operationId,
+      identity: prepared.identity,
+      nextPhase: "page",
+      published: true,
+      filesChanged: [...state.changed],
+      home
+    });
+    currentPhase = "page";
+    const pageHook = await observeStage2(deps, "page");
+    if (pageHook) {
+      return { ok: false, exitCode: ExitCode.WRITE_FAILED, stage: "page", state, cause: pageHook };
+    }
+  } else {
+    state.published = true;
+  }
+  if (!phaseAtLeast(currentPhase, "verified")) {
+    let visible;
+    let visibleSchema;
+    try {
+      [visible, visibleSchema] = await Promise.all([
+        readFile15(prepared.targetPath, "utf8"),
+        readFile15(schemaPath, "utf8")
+      ]);
+    } catch (error) {
+      return {
+        ok: false,
+        exitCode: ExitCode.WRITE_FAILED,
+        stage: "verify",
+        state,
+        cause: err("WRITE_FAILED", { message: String(error) })
+      };
+    }
+    const visiblePage = prepareArchitecturePage(visible, prepared.page.target, prepared.page.project, {
+      isNew: false
+    });
+    const visibleTaxonomy = extractTaxonomy(visibleSchema);
+    if (!visiblePage.ok || visible !== prepared.page.content || sha256Hex(visible) !== prepared.draftSha256 || !visibleTaxonomy.ok || prepared.page.tags.some((tag) => !visibleTaxonomy.data.includes(tag))) {
+      return {
+        ok: false,
+        exitCode: ExitCode.WRITE_FAILED,
+        stage: "verify",
+        state,
+        cause: err("WRITE_FAILED", { message: "published bytes or taxonomy verification failed" })
+      };
+    }
+    state.verified = true;
+    advancePublicationJournal({
+      vaultPath: vault,
+      operationId: prepared.operationId,
+      identity: prepared.identity,
+      nextPhase: "verified",
+      published: true,
+      verified: true,
+      filesChanged: [...state.changed],
+      home
+    });
+    currentPhase = "verified";
+    const verifyHook = await observeStage2(deps, "verify");
+    if (verifyHook) {
+      return { ok: false, exitCode: ExitCode.WRITE_FAILED, stage: "verify", state, cause: verifyHook };
+    }
+  } else {
+    state.verified = true;
+  }
+  if (!phaseAtLeast(currentPhase, "project-index")) {
+    const rendered = await renderProjectIndex(vault, prepared.page.project, { today: prepared.date });
+    if (!rendered.ok) {
+      return {
+        ok: false,
+        exitCode: errorExitCode3(rendered.error),
+        stage: "project-index",
+        state,
+        cause: rendered
+      };
+    }
+    const knowledgePath = join29(vault, rendered.data.index_path);
+    try {
+      await mkdir10(dirname8(knowledgePath), { recursive: true });
+    } catch (error) {
+      return {
+        ok: false,
+        exitCode: ExitCode.WRITE_FAILED,
+        stage: "project-index",
+        state,
+        cause: err("WRITE_FAILED", { message: String(error) })
+      };
+    }
+    const knowledgeWrite = await atomicWriteText(knowledgePath, rendered.data.text);
+    if (!knowledgeWrite.ok) {
+      return {
+        ok: false,
+        exitCode: ExitCode.WRITE_FAILED,
+        stage: "project-index",
+        state,
+        cause: knowledgeWrite
+      };
+    }
+    state.projectIndexChanged = knowledgeWrite.data.changed;
+    if (state.projectIndexChanged) state.changed.add(rendered.data.index_path);
+    try {
+      const visibleIndex = await readFile15(knowledgePath, "utf8");
+      if (visibleIndex !== rendered.data.text) {
+        return {
+          ok: false,
+          exitCode: ExitCode.WRITE_FAILED,
+          stage: "project-index",
+          state,
+          cause: err("WRITE_FAILED", { message: "project knowledge.md verification failed" })
+        };
+      }
+    } catch (error) {
+      return {
+        ok: false,
+        exitCode: ExitCode.WRITE_FAILED,
+        stage: "project-index",
+        state,
+        cause: err("WRITE_FAILED", { message: String(error) })
+      };
+    }
+    advancePublicationJournal({
+      vaultPath: vault,
+      operationId: prepared.operationId,
+      identity: prepared.identity,
+      nextPhase: "project-index",
+      published: true,
+      verified: true,
+      filesChanged: [...state.changed],
+      home
+    });
+    currentPhase = "project-index";
+    const indexHook = await observeStage2(deps, "project-index");
+    if (indexHook) {
+      return {
+        ok: false,
+        exitCode: ExitCode.WRITE_FAILED,
+        stage: "project-index",
+        state,
+        cause: indexHook
+      };
+    }
+  }
+  return { ok: true, data: state };
+}
+function renderProjectPublicationLog(prepared, added) {
+  return [
+    `## [${prepared.date}] project-page-publish | ${prepared.page.target}`,
+    "",
+    `- Published: [[${prepared.page.target.replace(/\.md$/, "")}]]`,
+    `- Project: [[${prepared.page.project}]]`,
+    `- Taxonomy: ${added.length > 0 ? `added ${added.join(", ")}` : "no additions"}`,
+    ...prepared.logNote ? [`- Note: ${prepared.logNote}`] : []
+  ].join("\n");
+}
+async function publishWithReceipt(prepared, vault, writeReceipt, deps, journalHome) {
+  const canonicalVault = resolve5(vault);
+  if (writeReceipt.mutation_vault !== canonicalVault) {
+    return {
+      exitCode: ExitCode.PREFLIGHT_FAILED,
+      result: err("PREFLIGHT_FAILED", {
+        reason: "mutation-vault-receipt-mismatch",
+        expected: writeReceipt.mutation_vault,
+        actual: canonicalVault
+      })
+    };
+  }
+  if (writeReceipt.base_oid) {
+    const head = writeReceipt.git_vault ? git(writeReceipt.git_vault, ["rev-parse", "HEAD"]) : null;
+    if (head !== writeReceipt.base_oid) {
+      return {
+        exitCode: ExitCode.PREFLIGHT_FAILED,
+        result: err("PREFLIGHT_FAILED", {
+          reason: "base-oid-drift",
+          expected: writeReceipt.base_oid,
+          actual: head,
+          git_vault: writeReceipt.git_vault
+        })
+      };
+    }
+  }
+  const aggregateMode = resolveRootAggregateMode();
+  let lock;
+  try {
+    lock = acquireOwnedSyncLock(vault, {
+      summary: `project-page publish ${prepared.page.target}`,
+      ttlMinutes: 1
+    });
+  } catch (error) {
+    return {
+      exitCode: ExitCode.WRITE_FAILED,
+      result: err("WRITE_FAILED", { stage: "lock", message: String(error) })
+    };
+  }
+  if (!lock.ok) return { exitCode: errorExitCode3(lock.error), result: lock };
+  let primary;
+  let released;
+  try {
+    primary = await runLockedStages(prepared, vault, deps, journalHome);
+  } catch (error) {
+    primary = {
+      ok: false,
+      exitCode: ExitCode.WRITE_FAILED,
+      stage: "taxonomy",
+      state: emptyLockedState2(),
+      cause: err("WRITE_FAILED", { message: `unexpected primary-stage failure: ${String(error)}` })
+    };
+  } finally {
+    released = releaseOwnedSyncLock(lock.data);
+  }
+  const primaryState = primary?.ok ? primary.data : primary?.state;
+  if (released === void 0 || !released.ok || !released.data.released) {
+    return phaseFailure2(
+      "unlock",
+      prepared,
+      primaryState?.published ?? false,
+      primaryState?.verified ?? false,
+      released && !released.ok ? released : err("WRITE_FAILED", { message: "lock release did not run" })
+    );
+  }
+  {
+    const journalNow = readPublicationJournal(vault, prepared.operationId, journalHome);
+    const phase = journalNow.ok && journalNow.data ? journalNow.data.phase : void 0;
+    if (!phaseAtLeast(phase, "unlocked")) {
+      advancePublicationJournal({
+        vaultPath: vault,
+        operationId: prepared.operationId,
+        identity: prepared.identity,
+        nextPhase: "unlocked",
+        published: primaryState?.published,
+        verified: primaryState?.verified,
+        filesChanged: primaryState ? [...primaryState.changed] : void 0,
+        home: journalHome
+      });
+    }
+  }
+  const unlockHook = await observeStage2(deps, "unlock");
+  if (unlockHook) {
+    return phaseFailure2(
+      "unlock",
+      prepared,
+      primaryState?.published ?? false,
+      primaryState?.verified ?? false,
+      unlockHook
+    );
+  }
+  if (primary === void 0) {
+    return phaseFailure2(
+      "taxonomy",
+      prepared,
+      false,
+      false,
+      err("WRITE_FAILED", { message: "locked publication produced no result" })
+    );
+  }
+  if (!primary.ok) {
+    return phaseFailure2(
+      primary.stage,
+      prepared,
+      primary.state.published,
+      primary.state.verified,
+      primary.cause,
+      void 0,
+      primary.exitCode
+    );
+  }
+  const state = primary.data;
+  const event = await writeLogEvent(vault, {
+    schema: "skillwiki-log-event/v1",
+    operation_id: prepared.operationId,
+    occurred_at: `${prepared.date}T00:00:00.000Z`,
+    host_id: writeReceipt.host_id ?? "standalone",
+    actor: "skillwiki-cli",
+    kind: "project-page-publish",
+    target: prepared.page.target,
+    note: prepared.logNote || `Published ${prepared.page.title}`,
+    metadata: {
+      page_type: prepared.page.type,
+      project: prepared.page.project,
+      tags: [...prepared.page.tags].sort(),
+      draft_sha256: prepared.draftSha256
+      // Do not embed mutable base_oid in identity-critical fields; receipt still carries it.
+    }
+  });
+  if (!event.ok) {
+    return phaseFailure2(
+      "event",
+      prepared,
+      true,
+      true,
+      event,
+      void 0,
+      event.error === "EVENT_IDENTITY_COLLISION" ? ExitCode.WRITE_FAILED : errorExitCode3(event.error)
+    );
+  }
+  if (event.data.created) state.changed.add(event.data.path);
+  {
+    const journalNow = readPublicationJournal(vault, prepared.operationId, journalHome);
+    const phase = journalNow.ok && journalNow.data ? journalNow.data.phase : void 0;
+    if (!phaseAtLeast(phase, "event")) {
+      advancePublicationJournal({
+        vaultPath: vault,
+        operationId: prepared.operationId,
+        identity: prepared.identity,
+        nextPhase: "event",
+        published: true,
+        verified: true,
+        filesChanged: [...state.changed],
+        home: journalHome
+      });
+    }
+  }
+  const eventHook = await observeStage2(deps, "event");
+  if (eventHook) return phaseFailure2("event", prepared, true, true, eventHook);
+  let logAppended = false;
+  if (aggregateMode === "dual") {
+    const log = await runLogAppend({
+      vault,
+      content: renderProjectPublicationLog(prepared, state.taxonomyAdded),
+      operationId: prepared.operationId,
+      strictLock: true,
+      recordLastOp: false,
+      eventKind: "project-page-publish"
+    });
+    if (!log.result.ok) return phaseFailure2("log", prepared, true, true, log.result);
+    if (log.exitCode !== ExitCode.OK) {
+      return phaseFailure2(
+        "log",
+        prepared,
+        true,
+        true,
+        err("WRITE_FAILED", { message: "log append returned inconsistent success state" })
+      );
+    }
+    logAppended = log.result.data.appended;
+    if (logAppended) state.changed.add("log.md");
+    {
+      const journalNow = readPublicationJournal(vault, prepared.operationId, journalHome);
+      const phase = journalNow.ok && journalNow.data ? journalNow.data.phase : void 0;
+      if (!phaseAtLeast(phase, "log")) {
+        advancePublicationJournal({
+          vaultPath: vault,
+          operationId: prepared.operationId,
+          identity: prepared.identity,
+          nextPhase: "log",
+          published: true,
+          verified: true,
+          filesChanged: [...state.changed],
+          home: journalHome
+        });
+      }
+    }
+    const logHook = await observeStage2(deps, "log");
+    if (logHook) return phaseFailure2("log", prepared, true, true, logHook);
+  }
+  const completed = completePublicationJournal({
+    vaultPath: vault,
+    operationId: prepared.operationId,
+    identity: prepared.identity,
+    filesChanged: [...state.changed],
+    home: journalHome
+  });
+  if (!completed.ok) {
+    if (completed.error !== "RECOVERY_EVIDENCE_MISSING") {
+      return phaseFailure2("journal-cleanup", prepared, true, true, completed);
+    }
+  }
+  const cleanupHook = await observeStage2(deps, "journal-cleanup");
+  if (cleanupHook) return phaseFailure2("journal-cleanup", prepared, true, true, cleanupHook);
+  return successReceipt2(prepared, {
+    taxonomyAdded: state.taxonomyAdded,
+    pageChanged: state.pageChanged,
+    projectIndexChanged: state.projectIndexChanged,
+    logAppended,
+    filesChanged: [...state.changed],
+    dryRun: false,
+    receipt: writeReceipt
+  });
+}
+async function publishPrepared(prepared, vault, deps, journalHome) {
+  return runManagedWriteTransaction({
+    vault,
+    command: `project-page publish ${prepared.page.target}`,
+    allowImmutableRecord: true,
+    preflight: deps.preflight,
+    mutate: async (receipt) => publishWithReceipt(prepared, vault, receipt, deps, journalHome)
+  });
+}
+async function runProjectPagePublish(input, deps = DEFAULT_DEPS3) {
+  if (input.approve && !input.write) {
+    return {
+      exitCode: ExitCode.USAGE,
+      result: err("USAGE", { message: "--approve requires --write" })
+    };
+  }
+  if (input.write && !input.approve) {
+    return {
+      exitCode: ExitCode.APPROVAL_REQUIRED,
+      result: err("APPROVAL_REQUIRED", {
+        message: "project-page publish --write requires --approve <token> from a prior dry-run",
+        project: input.project,
+        target: input.target
+      })
+    };
+  }
+  const prepared = await prepareProjectPagePublication(input);
+  if (!prepared.ok) return { exitCode: errorExitCode3(prepared.error), result: prepared };
+  if (!input.write) {
+    return previewProjectPagePublication(prepared.data, input.vault);
+  }
+  const verified = verifyApprovalToken(input.approve, {
+    publisher: "project-page",
+    draft_sha256: prepared.data.draftSha256,
+    target: prepared.data.page.target,
+    project: prepared.data.page.project,
+    log_note: prepared.data.logNote,
+    prior_target_sha256: prepared.data.priorTargetSha256
+  });
+  if (!verified.ok) {
+    return {
+      exitCode: errorExitCode3(verified.error),
+      result: err(verified.error, redactDetail2(verified.detail))
+    };
+  }
+  return publishPrepared(prepared.data, input.vault, deps, input.journalHome);
+}
+
+// src/commands/sync.ts
+import { existsSync as existsSync9 } from "fs";
+import { join as join30 } from "path";
+import { execFileSync as execFileSync3 } from "child_process";
+
+// src/utils/vault-git-pathspec.ts
+var VAULT_GENERATED_COMMIT_PATHS = [
+  ".skillwiki/last-op.json",
+  ".skillwiki/memory",
+  ".skillwiki/memory-topics.json"
+];
+var VAULT_GENERATED_COMMIT_EXCLUDES = [
+  ...VAULT_GENERATED_COMMIT_PATHS.map((path) => `:!${path}`)
+];
+var VAULT_COMMIT_PATHSPEC = [".", ...VAULT_GENERATED_COMMIT_EXCLUDES];
+function stageVaultContentChanges(vault) {
+  gitStrict(vault, ["add", "-A", "--", "."]);
+  for (const generatedPath of VAULT_GENERATED_COMMIT_PATHS) {
+    try {
+      gitStrict(vault, ["reset", "HEAD", "--", generatedPath]);
+    } catch (_e) {
+    }
+  }
+}
+
+// src/commands/sync.ts
+function parseDirtyPaths(porcelain) {
+  if (!porcelain) return [];
+  return porcelain.split("\n").map((line) => line.trimEnd()).filter((line) => line.length >= 4).map((line) => {
+    const payload = line.length >= 3 && line[2] === " " ? line.slice(3) : line.length >= 2 && line[1] === " " ? line.slice(2) : line;
+    const arrow = payload.lastIndexOf(" -> ");
+    return arrow >= 0 ? payload.slice(arrow + 4) : payload;
+  }).filter((path) => path.length > 0);
+}
+function splitNonEmptyLines(text) {
+  if (!text) return [];
+  return text.split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
+}
+function isTrackedNotePath(path) {
+  if (!path.endsWith(".md")) return false;
+  return !/^\.(skillwiki|claude|obsidian|antigravitycli|playwright-cli)\//.test(path);
+}
+function refHasPath(vault, ref, path) {
+  try {
+    execFileSync3("git", ["cat-file", "-e", `${ref}:${path}`], {
+      cwd: vault,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function runSyncStatus(input) {
+  const vault = input.vault;
+  const includeStashes = input.includeStashes ?? false;
+  if (!existsSync9(join30(vault, ".git"))) {
+    return {
+      exitCode: ExitCode.VAULT_PATH_INVALID,
+      result: ok({
+        is_git_repo: false,
+        dirty: 0,
+        ahead: 0,
+        behind: 0,
+        unpromoted_note_paths: 0,
+        unpromoted_note_examples: [],
+        last_commit: "never",
+        status: "not_a_repo",
+        humanHint: "not a git repository"
+      })
+    };
+  }
+  enableGitLongPathsOnWindows(vault);
+  const porcelain = git(vault, ["status", "--porcelain"]);
+  const dirty = porcelain ? porcelain.split("\n").filter((l) => l.trim().length > 0).length : 0;
+  const dirtyPaths = parseDirtyPaths(porcelain);
   const untrackedPaths = splitNonEmptyLines(git(vault, ["ls-files", "--others", "--exclude-standard"]));
   const revOutput = git(vault, ["rev-list", "--left-right", "--count", "origin/HEAD...HEAD"]);
   let ahead = 0;
@@ -6168,7 +7883,7 @@ function runSyncStatus(input) {
 }
 async function runSyncPush(input) {
   const vault = input.vault;
-  if (!existsSync8(join28(vault, ".git"))) {
+  if (!existsSync9(join30(vault, ".git"))) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: err("NOT_A_GIT_REPO", { path: vault })
@@ -6328,7 +8043,7 @@ function enableGitLongPathsOnWindows(vault) {
 }
 async function runSyncPull(input) {
   const vault = input.vault;
-  if (!existsSync8(join28(vault, ".git"))) {
+  if (!existsSync9(join30(vault, ".git"))) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: err("NOT_A_GIT_REPO", { path: vault })
@@ -6443,7 +8158,7 @@ function runSyncPeers(input) {
 }
 function runSyncLock(input) {
   const vault = input.vault;
-  if (!existsSync8(vault)) {
+  if (!existsSync9(vault)) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: err("VAULT_PATH_INVALID", { path: vault })
@@ -6478,7 +8193,7 @@ function runSyncLock(input) {
 }
 function runSyncUnlock(input) {
   const vault = input.vault;
-  if (!existsSync8(vault)) {
+  if (!existsSync9(vault)) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: err("VAULT_PATH_INVALID", { path: vault })
@@ -6555,11 +8270,11 @@ function runSyncJournalClearStale(input) {
 }
 
 // src/commands/snapshot-maintenance.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync3, appendFileSync } from "fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync4, appendFileSync } from "fs";
 import { createHash as createHash5 } from "crypto";
 import { execSync as execSync3, spawn } from "child_process";
 import { platform as platform2 } from "os";
-import { join as join29, resolve as resolvePath2 } from "path";
+import { join as join31, resolve as resolvePath2 } from "path";
 var MAINTENANCE_SCHEMA_VERSION = 1;
 var MAINTENANCE_COMMAND = "snapshot-maintenance journal clear-stale";
 function canonicalize(p) {
@@ -6622,7 +8337,7 @@ async function runSnapshotMaintenanceDryRun(input) {
     audit(makeAuditEvent(input, fleetLoad.hostId, now, "refusal", "MAINTENANCE_WRONG_WORKTREE"));
     return { exitCode: ExitCode.PROTECTED_SNAPSHOTTER_WRITE_BLOCKED, result: refusalErr("MAINTENANCE_WRONG_WORKTREE", `requested path '${requested}' is not the configured snapshot worktree '${canonicalize(configuredWorktree)}'`) };
   }
-  if (!existsSync9(requested) || !existsSync9(join29(requested, ".git"))) {
+  if (!existsSync10(requested) || !existsSync10(join31(requested, ".git"))) {
     audit(makeAuditEvent(input, fleetLoad.hostId, now, "refusal", "MAINTENANCE_MISSING_GIT_REPO"));
     return { exitCode: ExitCode.PROTECTED_SNAPSHOTTER_WRITE_BLOCKED, result: refusalErr("MAINTENANCE_MISSING_GIT_REPO", `snapshot worktree is not a git repository: ${requested}`) };
   }
@@ -6702,14 +8417,14 @@ async function resolveLiveVault(input) {
   return resolved.ok ? canonicalize(resolved.data.path) : void 0;
 }
 function snapshotMaintenanceAuditLogPath(home) {
-  const stateDir = platform2() === "darwin" ? join29(home, "Library", "Application Support", "vault-sync") : join29(home, ".local", "state", "vault-sync");
-  return join29(stateDir, "snapshot-maintenance-audit.jsonl");
+  const stateDir = platform2() === "darwin" ? join31(home, "Library", "Application Support", "vault-sync") : join31(home, ".local", "state", "vault-sync");
+  return join31(stateDir, "snapshot-maintenance-audit.jsonl");
 }
 function defaultAuditSink(home) {
   return (event) => {
     try {
       const logPath = snapshotMaintenanceAuditLogPath(home);
-      mkdirSync3(join29(logPath, ".."), { recursive: true });
+      mkdirSync4(join31(logPath, ".."), { recursive: true });
       appendFileSync(logPath, JSON.stringify(event) + "\n", { encoding: "utf8" });
     } catch {
     }
@@ -6869,8 +8584,8 @@ function releaseSnapshotFlock(handle) {
 }
 
 // src/commands/backup.ts
-import { statSync as statSync2, readdirSync as readdirSync2, readFileSync as readFileSync13, mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "fs";
-import { join as join30, relative as relative2, dirname as dirname6 } from "path";
+import { statSync as statSync2, readdirSync as readdirSync2, readFileSync as readFileSync15, mkdirSync as mkdirSync5, writeFileSync as writeFileSync6 } from "fs";
+import { join as join32, relative as relative3, dirname as dirname9 } from "path";
 import { PutObjectCommand, HeadObjectCommand, ListObjectsV2Command, GetObjectCommand, DeleteObjectsCommand } from "@aws-sdk/client-s3";
 
 // src/utils/s3-client.ts
@@ -6894,11 +8609,11 @@ var SKIP_DIRS = /* @__PURE__ */ new Set([".git", ".obsidian", "_archive", "node_
 function* walkMarkdown(dir, base) {
   for (const entry of readdirSync2(dir, { withFileTypes: true })) {
     if (SKIP_DIRS.has(entry.name)) continue;
-    const full = join30(dir, entry.name);
+    const full = join32(dir, entry.name);
     if (entry.isDirectory()) {
       yield* walkMarkdown(full, base);
     } else if (entry.name.endsWith(".md")) {
-      yield relative2(base, full).replace(/\\/g, "/");
+      yield relative3(base, full).replace(/\\/g, "/");
     }
   }
 }
@@ -6917,7 +8632,7 @@ async function runBackupSync(input) {
   let failed = 0;
   const files = [...walkMarkdown(input.vault, input.vault)];
   for (const relPath of files) {
-    const absPath = join30(input.vault, relPath);
+    const absPath = join32(input.vault, relPath);
     const localStat = statSync2(absPath);
     let needsUpload = true;
     try {
@@ -6936,7 +8651,7 @@ async function runBackupSync(input) {
       continue;
     }
     try {
-      const body = readFileSync13(absPath);
+      const body = readFileSync15(absPath);
       await client.send(new PutObjectCommand({ Bucket: input.bucket, Key: relPath, Body: body }));
       uploaded++;
     } catch {
@@ -6993,7 +8708,7 @@ async function runBackupRestore(input) {
     const objects = list.Contents ?? [];
     for (const obj of objects) {
       if (!obj.Key) continue;
-      const localPath = join30(target, obj.Key);
+      const localPath = join32(target, obj.Key);
       try {
         const localStat = statSync2(localPath);
         if (obj.LastModified && localStat.mtime > obj.LastModified) {
@@ -7006,8 +8721,8 @@ async function runBackupRestore(input) {
         const resp = await client.send(new GetObjectCommand({ Bucket: input.bucket, Key: obj.Key }));
         const body = await resp.Body?.transformToByteArray();
         if (body) {
-          mkdirSync4(dirname6(localPath), { recursive: true });
-          writeFileSync5(localPath, Buffer.from(body));
+          mkdirSync5(dirname9(localPath), { recursive: true });
+          writeFileSync6(localPath, Buffer.from(body));
           downloaded++;
         }
       } catch {
@@ -7039,11 +8754,11 @@ async function runBackupRestore(input) {
 }
 
 // src/commands/status.ts
-import { existsSync as existsSync10, statSync as statSync3 } from "fs";
-import { readFile as readFile15 } from "fs/promises";
-import { join as join31 } from "path";
+import { existsSync as existsSync11, statSync as statSync3 } from "fs";
+import { readFile as readFile16 } from "fs/promises";
+import { join as join33 } from "path";
 async function runStatus(input) {
-  if (!existsSync10(input.vault)) {
+  if (!existsSync11(input.vault)) {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { vault: input.vault }) };
   }
   const scan = await scanVault(input.vault);
@@ -7068,7 +8783,7 @@ async function runStatus(input) {
   const compound = scan.data.compound.length;
   let schemaVersion = "v1";
   try {
-    const schemaContent = await readFile15(join31(input.vault, "SCHEMA.md"), "utf8");
+    const schemaContent = await readFile16(join33(input.vault, "SCHEMA.md"), "utf8");
     const versionMatch = schemaContent.match(/version:\s*["']?([^"'\s\n]+)/i);
     if (versionMatch) schemaVersion = versionMatch[1];
   } catch {
@@ -7128,8 +8843,8 @@ async function runStatus(input) {
 }
 
 // src/commands/seed.ts
-import { mkdir as mkdir10, writeFile as writeFile9, stat as stat4 } from "fs/promises";
-import { join as join32 } from "path";
+import { mkdir as mkdir11, writeFile as writeFile8, stat as stat4 } from "fs/promises";
+import { join as join34 } from "path";
 var TODAY = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
 var EXAMPLE_PAGES = {
   "entities/example-project.md": `---
@@ -7198,30 +8913,30 @@ Real sources are immutable after ingestion \u2014 never edit them.
 `;
 async function runSeed(input) {
   try {
-    await stat4(join32(input.vault, "SCHEMA.md"));
+    await stat4(join34(input.vault, "SCHEMA.md"));
   } catch {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { root: input.vault, reason: "SCHEMA.md missing \u2014 run `skillwiki init` first" }) };
   }
   const created = [];
   const skipped = [];
   for (const [relPath, content] of Object.entries(EXAMPLE_PAGES)) {
-    const absPath = join32(input.vault, relPath);
+    const absPath = join34(input.vault, relPath);
     try {
       await stat4(absPath);
       skipped.push(relPath);
     } catch {
-      await mkdir10(join32(absPath, ".."), { recursive: true });
-      await writeFile9(absPath, content, "utf8");
+      await mkdir11(join34(absPath, ".."), { recursive: true });
+      await writeFile8(absPath, content, "utf8");
       created.push(relPath);
     }
   }
-  const rawPath = join32(input.vault, "raw", "articles", "example-source.md");
+  const rawPath = join34(input.vault, "raw", "articles", "example-source.md");
   try {
     await stat4(rawPath);
     skipped.push("raw/articles/example-source.md");
   } catch {
-    await mkdir10(join32(rawPath, ".."), { recursive: true });
-    await writeFile9(rawPath, EXAMPLE_RAW, "utf8");
+    await mkdir11(join34(rawPath, ".."), { recursive: true });
+    await writeFile8(rawPath, EXAMPLE_RAW, "utf8");
     created.push("raw/articles/example-source.md");
   }
   if (created.length > 0) {
@@ -7243,9 +8958,9 @@ async function runSeed(input) {
 }
 
 // src/commands/canvas.ts
-import { readFile as readFile16, writeFile as writeFile10 } from "fs/promises";
-import { existsSync as existsSync11 } from "fs";
-import { join as join33 } from "path";
+import { readFile as readFile17, writeFile as writeFile9 } from "fs/promises";
+import { existsSync as existsSync12 } from "fs";
+import { join as join35 } from "path";
 var NODE_WIDTH = 240;
 var NODE_HEIGHT = 60;
 var COLUMN_SPACING = 400;
@@ -7323,8 +9038,8 @@ function buildCanvasEdges(adjacency) {
   return edges;
 }
 async function runCanvasGenerate(input) {
-  const graphPath = input.graphPath ?? join33(input.vault, ".skillwiki", "graph.json");
-  if (!existsSync11(graphPath)) {
+  const graphPath = input.graphPath ?? join35(input.vault, ".skillwiki", "graph.json");
+  if (!existsSync12(graphPath)) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
       result: err("FILE_NOT_FOUND", {
@@ -7335,7 +9050,7 @@ async function runCanvasGenerate(input) {
   }
   let raw;
   try {
-    raw = await readFile16(graphPath, "utf8");
+    raw = await readFile17(graphPath, "utf8");
   } catch (e) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
@@ -7361,9 +9076,9 @@ async function runCanvasGenerate(input) {
   const nodes = buildCanvasNodes(paths);
   const edges = buildCanvasEdges(graph.adjacency);
   const canvas = { nodes, edges };
-  const outPath = join33(input.vault, "vault-graph.canvas");
+  const outPath = join35(input.vault, "vault-graph.canvas");
   try {
-    await writeFile10(outPath, JSON.stringify(canvas, null, 2));
+    await writeFile9(outPath, JSON.stringify(canvas, null, 2));
   } catch (e) {
     return {
       exitCode: ExitCode.WRITE_FAILED,
@@ -7382,11 +9097,252 @@ written: ${outPath}`
   };
 }
 
+// src/commands/source-disposition.ts
+async function runSourceDisposition(input) {
+  if (!input.write) {
+    const plan = await planSourceDisposition(input);
+    return { exitCode: plan.ok ? ExitCode.OK : ExitCode.USAGE, result: plan };
+  }
+  if (!input.approve) return { exitCode: ExitCode.USAGE, result: { ok: false, error: "APPROVAL_INVALID", detail: { message: "--write requires --approve" } } };
+  const applied = await applySourceDisposition({ ...input, approve: input.approve });
+  if (!applied.ok) return { exitCode: ExitCode.USAGE, result: applied };
+  return { exitCode: ExitCode.OK, result: ok({ ...applied.data, humanHint: `${input.status} recorded for ${input.rawPath}` }) };
+}
+
+// src/utils/source-disposal.ts
+import { createHash as createHash6 } from "crypto";
+import { readFile as readFile19, unlink as unlink5 } from "fs/promises";
+
+// src/utils/raw-asset-reference-index.ts
+import { readdir as readdir7, readFile as readFile18 } from "fs/promises";
+import { join as join36, relative as relative4, sep as sep3 } from "path";
+var PREVIEW_EXTENSIONS = /* @__PURE__ */ new Set(["png", "jpg", "jpeg", "gif", "webp", "svg", "bmp", "avif", "pdf", "mp3", "wav", "m4a", "mp4", "webm"]);
+async function walkFiles(root, dir = root) {
+  let entries;
+  try {
+    entries = await readdir7(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const entry of entries) {
+    const path = join36(dir, entry.name);
+    if (entry.isDirectory()) out.push(...await walkFiles(root, path));
+    else if (entry.isFile()) out.push(relative4(root, path).split(sep3).join("/"));
+  }
+  return out;
+}
+function supportedPreview(path) {
+  const ext = path.includes(".") ? path.slice(path.lastIndexOf(".") + 1).toLowerCase() : "";
+  return PREVIEW_EXTENSIONS.has(ext);
+}
+function addInbound(map, target, source) {
+  const refs = map.get(target) ?? /* @__PURE__ */ new Set();
+  refs.add(source);
+  map.set(target, refs);
+}
+async function buildRawAssetReferenceIndex(vault) {
+  const assetRoot = join36(vault, "raw", "assets");
+  const relativeAssets = await walkFiles(assetRoot);
+  const assets = relativeAssets.map((path) => `raw/assets/${path}`).sort((a, b) => a.localeCompare(b));
+  const assetSet = new Set(assets);
+  const byBasename = /* @__PURE__ */ new Map();
+  for (const asset of assets) {
+    const name = asset.slice(asset.lastIndexOf("/") + 1);
+    byBasename.set(name, [...byBasename.get(name) ?? [], asset]);
+  }
+  const scan = await scanVault(vault);
+  if (!scan.ok) return { assets, inbound: /* @__PURE__ */ new Map(), references: [] };
+  const inboundSets = /* @__PURE__ */ new Map();
+  const references = [];
+  for (const page of scan.data.allMarkdown) {
+    let text;
+    try {
+      text = await readFile18(page.absPath, "utf8");
+    } catch {
+      continue;
+    }
+    for (const match of text.matchAll(/!\[\[([^\]|#]+)(?:[|#][^\]]*)?\]\]/g)) {
+      const target = match[1].trim();
+      if (target.startsWith("raw/assets/")) {
+        const exists = assetSet.has(target);
+        references.push({ source_path: page.relPath, target, kind: "obsidian-embed", exists, preview_supported: supportedPreview(target) });
+        if (exists) addInbound(inboundSets, target, page.relPath);
+      } else if (!target.includes("/")) {
+        const candidates = (byBasename.get(target) ?? []).sort((a, b) => a.localeCompare(b));
+        if (candidates.length > 0) {
+          references.push({ source_path: page.relPath, target, kind: "ambiguous-embed", exists: candidates.length === 1, preview_supported: supportedPreview(target), candidates });
+          if (candidates.length === 1) addInbound(inboundSets, candidates[0], page.relPath);
+        }
+      }
+    }
+    for (const match of text.matchAll(/!\[[^\]]*\]\(([^)\s]+)(?:\s+"[^"]*")?\)/g)) {
+      const target = match[1].trim().replace(/^<|>$/g, "");
+      if (/^https?:\/\//i.test(target)) {
+        references.push({ source_path: page.relPath, target, kind: "external-image", exists: true, preview_supported: supportedPreview(new URL(target).pathname) });
+      } else if (target.startsWith("raw/assets/")) {
+        const exists = assetSet.has(target);
+        references.push({ source_path: page.relPath, target, kind: "markdown-image", exists, preview_supported: supportedPreview(target) });
+        if (exists) addInbound(inboundSets, target, page.relPath);
+      }
+    }
+  }
+  references.sort((a, b) => a.target.localeCompare(b.target) || a.source_path.localeCompare(b.source_path));
+  const inbound = new Map([...inboundSets.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([target, refs]) => [target, [...refs].sort()]));
+  return { assets, inbound, references };
+}
+
+// src/utils/source-disposal.ts
+function sha256(bytes) {
+  return createHash6("sha256").update(bytes).digest("hex");
+}
+function exactTarget(path) {
+  if (/[?*\[\]{}]/.test(path) || !path.includes("/") || path.endsWith("/")) return err("RAW_DISPOSAL_TARGET_INVALID", { path, message: "exact file path required; globs, basenames, and directories are refused" });
+  const classified = classifyRawPath(path);
+  if (!classified.ok) return classified;
+  return ok(true);
+}
+async function planSourceDisposal(input) {
+  const exact = exactTarget(input.rawPath);
+  if (!exact.ok) return exact;
+  const authorized = authorizeRawOperation({
+    operationClass: "destructive-remove",
+    trigger: "attended-apply",
+    source: input.rawPath,
+    explicitExactTarget: true
+  });
+  if (!authorized.ok) return authorized;
+  const reason = input.reason.normalize("NFC").trim();
+  if (!reason) return err("RAW_DISPOSAL_TARGET_INVALID", { field: "reason" });
+  const sensitive = scanSensitiveContent(reason);
+  if (sensitive.length > 0) return err("SENSITIVE_CONTENT_DETECTED", { findings: sensitive });
+  const target = await resolveExistingRegularFileInsideVault(input.vault, input.rawPath);
+  if (!target.ok) return err("RAW_DISPOSAL_TARGET_INVALID", { path: input.rawPath, cause: target });
+  const bytes = await readFile19(target.data);
+  const size = bytes.byteLength;
+  let typedReferences = [];
+  let otherReferences = [];
+  let assetInboundReferences = [];
+  if (input.rawPath.startsWith("raw/assets/")) {
+    const assets = await buildRawAssetReferenceIndex(input.vault);
+    assetInboundReferences = assets.inbound.get(input.rawPath) ?? [];
+  } else if (input.rawPath.endsWith(".md")) {
+    const scan = await scanVault(input.vault);
+    if (!scan.ok) return scan;
+    const typedPaths = new Set(scan.data.typedKnowledge.map((page) => page.relPath));
+    const relocations = await readSourceRelocations(input.vault);
+    if (!relocations.ok) return relocations;
+    const refs = await buildSourceReferenceIndex({
+      typedPages: scan.data.typedKnowledge,
+      otherPages: scan.data.allMarkdown.filter((page) => !typedPaths.has(page.relPath) && !page.relPath.startsWith("raw/")),
+      availableRawPaths: scan.data.raw.map((page) => page.relPath),
+      relocationProjection: buildSourceRelocationProjection(relocations.data)
+    });
+    typedReferences = refs.integratedBy.get(input.rawPath) ?? [];
+    otherReferences = refs.referencedElsewhereBy.get(input.rawPath) ?? [];
+  }
+  const completeHash = sha256(bytes);
+  const occurredAt = input.now ?? (/* @__PURE__ */ new Date()).toISOString();
+  const deleteIntentPath = `meta/delete-intents/${pathToIntentFilename(input.rawPath)}`;
+  const operation_id = operationId("source-disposal", [input.rawPath, completeHash, reason, ...typedReferences, ...otherReferences, ...assetInboundReferences]);
+  const base = {
+    raw_path: input.rawPath,
+    complete_sha256: completeHash,
+    size_bytes: size,
+    typed_references: typedReferences,
+    other_references: otherReferences,
+    asset_inbound_references: assetInboundReferences,
+    delete_intent_path: deleteIntentPath,
+    recoverability: "Recoverable only from Git/S3 history or another backup after deletion; the delete intent prevents automatic resurrection.",
+    reason,
+    operation_id,
+    occurred_at: occurredAt
+  };
+  return ok({ ...base, approval_token: encodeSourceActionApproval({ contract: "source-disposal/v1", ...base }), write: false });
+}
+async function applySourceDisposal(input) {
+  if (!input.attended) return err("RAW_DISPOSAL_ATTENDED_REQUIRED", { message: "permanent disposal is refused in scheduled/headless sessions" });
+  const authorized = authorizeRawOperation({
+    operationClass: "destructive-remove",
+    trigger: "attended-apply",
+    source: input.rawPath,
+    explicitExactTarget: true
+  });
+  if (!authorized.ok) return authorized;
+  const decoded = decodeSourceActionApproval(input.approve);
+  if (!decoded.ok) return decoded;
+  const occurredAt = typeof decoded.data.occurred_at === "string" ? decoded.data.occurred_at : void 0;
+  const planned = await planSourceDisposal({ vault: input.vault, rawPath: input.rawPath, reason: input.reason, now: occurredAt });
+  if (!planned.ok) return planned;
+  if (planned.data.approval_token !== input.approve) return err("APPROVAL_INVALID", { message: "source disposal approval does not match live target or references" });
+  const event = await writeLogEvent(input.vault, {
+    schema: "skillwiki-log-event/v1",
+    operation_id: planned.data.operation_id,
+    occurred_at: planned.data.occurred_at,
+    host_id: input.hostId ?? "local",
+    actor: input.actor ?? "skillwiki-cli",
+    kind: "source-disposal-approved",
+    target: input.rawPath,
+    note: input.reason,
+    metadata: {
+      raw_path: input.rawPath,
+      complete_sha256: planned.data.complete_sha256,
+      typed_references: planned.data.typed_references,
+      other_references: planned.data.other_references,
+      asset_inbound_references: planned.data.asset_inbound_references,
+      delete_intent_path: planned.data.delete_intent_path
+    }
+  });
+  if (!event.ok) return event;
+  const tombstonePath = await writeDeleteIntent(input.vault, buildDeleteIntent({
+    path: input.rawPath,
+    action: "remove",
+    actor: input.actor ?? "skillwiki-cli",
+    source: "cli",
+    reason: input.reason,
+    created: planned.data.occurred_at
+  }));
+  const target = await resolveExistingRegularFileInsideVault(input.vault, input.rawPath);
+  if (!target.ok) return err("APPROVAL_INVALID", { message: "source disposal target is no longer a safe exact file", cause: target });
+  await unlink5(target.data);
+  const completedOperationId = operationId("source-disposal-completed", [planned.data.operation_id]);
+  const completed = await writeLogEvent(input.vault, {
+    schema: "skillwiki-log-event/v1",
+    operation_id: completedOperationId,
+    occurred_at: planned.data.occurred_at,
+    host_id: input.hostId ?? "local",
+    actor: input.actor ?? "skillwiki-cli",
+    kind: "source-disposal-completed",
+    target: input.rawPath,
+    note: input.reason,
+    metadata: {
+      approval_operation_id: planned.data.operation_id,
+      raw_path: input.rawPath,
+      complete_sha256: planned.data.complete_sha256,
+      delete_intent_path: planned.data.delete_intent_path
+    }
+  });
+  if (!completed.ok) return completed;
+  return ok({ removed: input.rawPath, tombstone_path: tombstonePath, event_path: completed.data.path, operation_id: planned.data.operation_id });
+}
+
+// src/commands/source-disposal.ts
+async function runSourceDisposal(input) {
+  if (!input.write) {
+    const plan = await planSourceDisposal(input);
+    return { exitCode: plan.ok ? ExitCode.OK : ExitCode.USAGE, result: plan };
+  }
+  if (!input.approve) return { exitCode: ExitCode.USAGE, result: { ok: false, error: "APPROVAL_INVALID", detail: { message: "--write requires --approve" } } };
+  const applied = await applySourceDisposal({ ...input, approve: input.approve, attended: input.attended === true });
+  if (!applied.ok) return { exitCode: ExitCode.USAGE, result: applied };
+  return { exitCode: ExitCode.OK, result: ok({ ...applied.data, humanHint: `permanently disposed ${input.rawPath}; ${applied.data.tombstone_path}` }) };
+}
+
 // src/commands/fleet-health.ts
-import { existsSync as existsSync12, readFileSync as readFileSync14 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync16 } from "fs";
 import { execSync as nodeExecSync } from "child_process";
 import { hostname as nodeHostname, platform as nodePlatform } from "os";
-import { join as join34 } from "path";
+import { join as join37 } from "path";
 var SSH_TIMEOUT_MS = 15e3;
 var TIMER_UNIT = "agent-memory-trends.timer";
 var SERVICE_UNIT = "agent-memory-trends.service";
@@ -7483,9 +9439,9 @@ function applyServiceFailedOverlay(run, serviceFailed) {
 function probeLocal(vaultPath, deps) {
   const latestPath = satelliteLatestRunPath(vaultPath);
   let parsed = null;
-  if (existsSync12(latestPath)) {
+  if (existsSync13(latestPath)) {
     try {
-      const wire = readSatelliteLatestRunFromText(readFileSync14(latestPath, "utf8"));
+      const wire = readSatelliteLatestRunFromText(readFileSync16(latestPath, "utf8"));
       if (wire) {
         parsed = {
           status: wire.status,
@@ -7616,7 +9572,7 @@ async function runFleetHealth(input) {
   const home = input.home ?? env.HOME ?? "";
   const osHostname = input.osHostname ?? env.HOSTNAME ?? nodeHostname();
   const vault = input.vault ?? env.WIKI_PATH;
-  const file = input.file ?? (vault ? join34(vault, FLEET_REL_PATH) : void 0);
+  const file = input.file ?? (vault ? join37(vault, FLEET_REL_PATH) : void 0);
   if (!file) {
     return {
       exitCode: ExitCode.NO_VAULT_CONFIGURED,
@@ -7665,7 +9621,7 @@ async function runFleetHealth(input) {
         healthy
       });
     } else {
-      if (!hasDeclaredSshAccess(t.host, localHostId, t.sshAlias)) {
+      if (!localHostId || !hasDeclaredSshAccess(t.host, localHostId, t.sshAlias)) {
         rows.push({
           host: t.id,
           timer: "unknown",
@@ -7700,15 +9656,15 @@ async function runFleetHealth(input) {
 }
 
 // src/utils/auto-commit.ts
-import { existsSync as existsSync13 } from "fs";
-import { join as join35 } from "path";
+import { existsSync as existsSync14 } from "fs";
+import { join as join38 } from "path";
 async function postCommit(vault, exitCode) {
   if (exitCode !== 0) return;
   const home = process.env.HOME ?? "";
   const dotenv = await parseDotenvFile(configPath(home));
   const autoCommit = process.env.AUTO_COMMIT ?? dotenv["AUTO_COMMIT"];
   if (autoCommit === "false") return;
-  if (!existsSync13(join35(vault, ".git"))) return;
+  if (!existsSync14(join38(vault, ".git"))) return;
   const lastOps = readLastOp(vault);
   if (lastOps.length === 0) return;
   const porcelain = git(vault, ["status", "--porcelain", "--", ...VAULT_COMMIT_PATHSPEC]);
@@ -7732,9 +9688,9 @@ async function postCommit(vault, exitCode) {
 }
 
 // src/commands/write-preflight.ts
-import { existsSync as existsSync14, readFileSync as readFileSync15, statSync as statSync4 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync17, statSync as statSync4 } from "fs";
 async function runWritePreflightCommand(input) {
-  if (!existsSync14(input.vault) || !statSync4(input.vault).isDirectory()) {
+  if (!existsSync15(input.vault) || !statSync4(input.vault).isDirectory()) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: err(GateError.VAULT_PATH_INVALID, { path: input.vault })
@@ -7742,13 +9698,13 @@ async function runWritePreflightCommand(input) {
   }
   let priorText = input.priorArtifactText;
   if (input.priorArtifactFile) {
-    if (!existsSync14(input.priorArtifactFile)) {
+    if (!existsSync15(input.priorArtifactFile)) {
       return {
         exitCode: ExitCode.FILE_NOT_FOUND,
         result: err("FILE_NOT_FOUND", { path: input.priorArtifactFile })
       };
     }
-    priorText = readFileSync15(input.priorArtifactFile, "utf8");
+    priorText = readFileSync17(input.priorArtifactFile, "utf8");
   }
   const checkList = input.checks ? input.checks.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
   const result = runWritePreflight({
@@ -7862,7 +9818,7 @@ async function emitManagedVaultWrite(vault, command, mutate, opts) {
   if (dirty) {
     return emit(dirty, void 0, { postCommit: false });
   }
-  const { runManagedWriteTransaction: runManagedWriteTransaction2 } = await import("./managed-write-preflight-CTXX2MHQ.js");
+  const { runManagedWriteTransaction: runManagedWriteTransaction2 } = await import("./managed-write-preflight-4LPVMP42.js");
   const run = await runManagedWriteTransaction2({
     vault,
     command,
@@ -7892,7 +9848,7 @@ program.command("validate <file>").description("validate vault page frontmatter
   emit(await runValidate({ file, apply: !!opts.apply, vault }), vault);
 });
 program.command("graph").description("graph subcommands").command("build <vault>").option("--out <path>", "graph output path (default: <vault>/.skillwiki/graph.json)").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
-  const out = opts.out ?? join36(vault, ".skillwiki", "graph.json");
+  const out = opts.out ?? join39(vault, ".skillwiki", "graph.json");
   return emitGuardedVaultWrite(vault, "graph build", () => runGraphBuild({ vault, out }));
 });
 var canvasCmd = program.command("canvas").description("manage Obsidian canvas files");
@@ -7906,10 +9862,76 @@ program.command("overlap [vault]").description("detect typed-knowledge pages tha
   if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
   else emit(await runOverlap({ vault: v.vault }), v.vault);
 });
-program.command("query <text> [vault]").description("score and rank vault pages by relevance to a query").option("--limit <n>", "max results to return", (s) => parseInt(s, 10), 10).option("--wiki <name>", "wiki profile name").action(async (text, vault, opts) => {
+program.command("query <text> [vault]").description("score and rank vault pages by relevance to a query").option("--limit <n>", "max results to return", (s) => parseInt(s, 10), 10).option("--include-pending", "include a separate pending-evidence channel").option("--wiki <name>", "wiki profile name").action(async (text, vault, opts) => {
+  const v = await resolveVaultArg(vault, opts.wiki);
+  if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
+  else emit(await runQuery({ text, vault: v.vault, limit: opts.limit, includePending: opts.includePending }), v.vault, { postCommit: false });
+});
+var sourcesCmd = program.command("sources").description("inspect raw-source lifecycle state");
+sourcesCmd.command("pending [vault]").description("list captured articles and papers awaiting typed integration").option("--since <date>", "include sources captured on or after YYYY-MM-DD").option("--older-than <days>", "include sources at least this many days old", (s) => parseInt(s, 10)).option("--match <text>", "literal title, URL, or path match").option("--ingested-by <channel>", "manual, wiki-ingest, proj-work, or unknown").option("--scope <scope>", "articles, papers, or all", "all").option("--sort <order>", "newest or oldest", "newest").option("--limit <n>", "max items to return", (s) => parseInt(s, 10), 50).option("--all", "return the complete matching inventory").option("--include-integrated", "also return actively integrated sources").option("--include-archived", "also return raw/archived sources").option("--include-duplicates", "also return raw/duplicates sources").option("--include-legacy-archived", "also return legacy _archive/raw sources").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
+  const v = await resolveVaultArg(vault, opts.wiki);
+  if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
+  else emit(await runSourcesPending({
+    vault: v.vault,
+    since: opts.since,
+    olderThan: opts.olderThan,
+    match: opts.match,
+    ingestedBy: opts.ingestedBy,
+    scope: opts.scope,
+    sort: opts.sort,
+    limit: opts.limit,
+    all: opts.all,
+    includeIntegrated: opts.includeIntegrated,
+    includeArchived: opts.includeArchived,
+    includeDuplicates: opts.includeDuplicates,
+    includeLegacyArchived: opts.includeLegacyArchived
+  }), v.vault, { postCommit: false });
+});
+sourcesCmd.command("disposition <raw-path> [vault]").description("record an append-only editorial decision for an exact raw source").requiredOption("--status <status>", "reviewed-no-op, deferred, duplicate, out-of-scope, superseded, or reopened").requiredOption("--reason <text>", "editorial reason").option("--review-after <date>", "future review date for deferred").option("--duplicate-of <raw-path>", "canonical exact raw path for duplicate").option("--write", "write the approved disposition event").option("--approve <token>", "approve the exact state-bound disposition plan").option("--wiki <name>", "wiki profile name").action(async (rawPath, vault, opts) => {
+  const v = await resolveVaultArg(vault, opts.wiki);
+  if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
+  else if (!opts.write) emit(await runSourceDisposition({
+    vault: v.vault,
+    rawPath,
+    status: opts.status,
+    reason: opts.reason,
+    reviewAfter: opts.reviewAfter,
+    duplicateOf: opts.duplicateOf,
+    write: false
+  }), v.vault, { postCommit: false });
+  else return emitManagedVaultWrite(
+    v.vault,
+    "sources disposition",
+    (receipt) => runSourceDisposition({
+      vault: v.vault,
+      rawPath,
+      status: opts.status,
+      reason: opts.reason,
+      reviewAfter: opts.reviewAfter,
+      duplicateOf: opts.duplicateOf,
+      write: true,
+      approve: opts.approve
+    }),
+    { allowImmutableRecord: true }
+  );
+});
+sourcesCmd.command("dispose <raw-path> [vault]").description("permanently delete one exact raw object after an attended approved preview").requiredOption("--reason <text>", "permanent-disposal reason").option("--write", "apply the approved exact-target disposal").option("--approve <token>", "approve the exact state-bound disposal plan").option("--wiki <name>", "wiki profile name").action(async (rawPath, vault, opts) => {
   const v = await resolveVaultArg(vault, opts.wiki);
   if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
-  else emit(await runQuery({ text, vault: v.vault, limit: opts.limit }), v.vault);
+  else if (!opts.write) emit(await runSourceDisposal({ vault: v.vault, rawPath, reason: opts.reason, write: false }), v.vault, { postCommit: false });
+  else return emitManagedVaultWrite(
+    v.vault,
+    "sources dispose",
+    () => runSourceDisposal({
+      vault: v.vault,
+      rawPath,
+      reason: opts.reason,
+      write: true,
+      approve: opts.approve,
+      attended: process.stdin.isTTY === true && process.stdout.isTTY === true
+    }),
+    { allowImmutableRecord: true }
+  );
 });
 program.command("orphans [vault]").description("find pages not referenced by any other page").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => emit(await runOrphans({
   vault,
@@ -8014,7 +10036,7 @@ tagCmd.command("reconcile [vault]").description("preview or add prospective page
   );
 });
 var pageCmd = program.command("page").description("validate and publish typed vault pages");
-pageCmd.command("publish <draft> [vault]").description("preview or publish an unpublished typed-page draft").requiredOption("--target <path>", "vault-relative typed page target").option("--log-note <text>", "single-line publication log note").option("--write", "publish SCHEMA, page, index, and log", false).option("--wiki <name>", "wiki profile name").action(async (draft, vault, opts) => {
+pageCmd.command("publish <draft> [vault]").description("preview or publish an unpublished typed-page draft").requiredOption("--target <path>", "vault-relative typed page target").option("--log-note <text>", "single-line publication log note").option("--write", "publish SCHEMA, page, index, and log", false).option("--approve <token>", "target-bound approval token from a prior dry-run").option("--wiki <name>", "wiki profile name").action(async (draft, vault, opts) => {
   const resolved = await resolveVaultArg(vault, opts.wiki);
   if (!resolved.ok) return emit({ exitCode: resolved.exitCode, result: resolved.payload });
   const input = {
@@ -8022,7 +10044,8 @@ pageCmd.command("publish <draft> [vault]").description("preview or publish an un
     draftPath: draft,
     target: opts.target,
     logNote: opts.logNote,
-    write: !!opts.write
+    write: !!opts.write,
+    approve: opts.approve
   };
   if (!opts.write) return emit(await runPagePublish(input), resolved.vault, { postCommit: false });
   return emitGuardedVaultWrite(
@@ -8032,6 +10055,27 @@ pageCmd.command("publish <draft> [vault]").description("preview or publish an un
     { postCommit: false }
   );
 });
+var projectPageCmd = program.command("project-page").description("publish project-local architecture pages");
+projectPageCmd.command("publish <draft> [vault]").description("preview or publish a Layer-3 architecture page under projects/{slug}/architecture/").requiredOption("--project <slug>", "project slug").requiredOption("--target <path>", "vault-relative architecture target").option("--log-note <text>", "single-line publication log note").option("--write", "publish SCHEMA, page, project knowledge index, and log", false).option("--approve <token>", "required with --write; token from a prior dry-run").option("--wiki <name>", "wiki profile name").action(async (draft, vault, opts) => {
+  const resolved = await resolveVaultArg(vault, opts.wiki);
+  if (!resolved.ok) return emit({ exitCode: resolved.exitCode, result: resolved.payload });
+  const input = {
+    vault: resolved.vault,
+    draftPath: draft,
+    project: opts.project,
+    target: opts.target,
+    logNote: opts.logNote,
+    write: !!opts.write,
+    approve: opts.approve
+  };
+  if (!opts.write) return emit(await runProjectPagePublish(input), resolved.vault, { postCommit: false });
+  return emitGuardedVaultWrite(
+    resolved.vault,
+    "project-page publish",
+    () => runProjectPagePublish(input),
+    { postCommit: false }
+  );
+});
 var indexCmd = program.command("index").description("root index projection and checks");
 indexCmd.command("rebuild [vault]").description("preview or write deterministic root index.md projection").option("--write", "write projected index.md", false).option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
   const v = await resolveVaultArg(vault, opts.wiki);
@@ -8053,15 +10097,15 @@ program.command("topic-map-check [vault]").description("check whether a topic ma
   if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
   else emit(await runTopicMapCheck({ vault: v.vault, threshold: opts.threshold }), v.vault);
 });
-program.command("stale [vault]").description("identify stale transcripts and incomplete work items").option("--archive", "move stale items to _archive/", false).option("--days <n>", "staleness threshold in days", (s) => parseInt(s, 10), 3).option("--force-scan", "infer kind/project from filename and content when frontmatter is missing", false).option("--project <slug>", "scope to a single project").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
+program.command("stale [vault]").description("identify stale transcripts and incomplete work items").option("--archive", "preview lifecycle-first archives for stale items", false).option("--apply", "apply an approved stale archive preview", false).option("--approve <token>", "approve the exact state-bound stale archive plan").option("--days <n>", "staleness threshold in days", (s) => parseInt(s, 10), 3).option("--force-scan", "infer kind/project from filename and content when frontmatter is missing", false).option("--project <slug>", "scope to a single project").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
   const v = await resolveVaultArg(vault, opts.wiki);
   if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
-  else if (opts.archive) return emitGuardedVaultWrite(
+  else if (opts.archive && opts.apply) return emitManagedVaultWrite(
     v.vault,
     "stale --archive",
-    () => runStale({ vault: v.vault, days: opts.days, archive: true, forceScan: !!opts.forceScan, project: opts.project })
+    () => runStale({ vault: v.vault, days: opts.days, archive: true, apply: true, approve: opts.approve, forceScan: !!opts.forceScan, project: opts.project })
   );
-  else emit(await runStale({ vault: v.vault, days: opts.days, archive: false, forceScan: !!opts.forceScan, project: opts.project }), v.vault);
+  else emit(await runStale({ vault: v.vault, days: opts.days, archive: !!opts.archive, apply: false, forceScan: !!opts.forceScan, project: opts.project }), v.vault, { postCommit: false });
 });
 program.command("claim <transcript> [vault]").description("claim an unclaimed transcript by creating a work item with source: link").option("--project <slug>", "project slug (overrides transcript frontmatter)").option("--slug <slug>", "work-item slug (defaults to transcript filename without date/kind prefix)").option("--wiki <name>", "wiki profile name").action(async (transcript, vault, opts) => {
   const v = await resolveVaultArg(vault, opts.wiki);
@@ -8192,6 +10236,21 @@ projectionsCmd.command("repair-legacy [vault]").description("repair one supporte
 program.command("lint [vault]").description("run all vault health checks").option("--days <n>", "stale threshold", (s) => parseInt(s, 10), 90).option("--lines <n>", "pagesize threshold", (s) => parseInt(s, 10), 200).option("--log-threshold <n>", "log rotation threshold", (s) => parseInt(s, 10), 500).option("--fix", "auto-fix supported lint violations").option("--only <bucket>", "run only the specified lint bucket").option("--summary", "emit bounded bucket counts instead of full item arrays", false).option("--examples <n>", "example count per bucket in summary mode", (s) => parseInt(s, 10), 3).option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
   const v = await resolveVaultArg(vault, opts.wiki);
   if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
+  else if (opts.fix && opts.summary) return emitGuardedVaultWrite(
+    v.vault,
+    "lint --fix",
+    () => runLint({
+      vault: v.vault,
+      source: vault ? "flag" : void 0,
+      days: opts.days,
+      lines: opts.lines,
+      logThreshold: opts.logThreshold,
+      fix: true,
+      only: opts.only,
+      summary: true,
+      examplesLimit: opts.examples
+    })
+  );
   else if (opts.fix) return emitGuardedVaultWrite(
     v.vault,
     "lint --fix",
@@ -8203,8 +10262,7 @@ program.command("lint [vault]").description("run all vault health checks").optio
       logThreshold: opts.logThreshold,
       fix: true,
       only: opts.only,
-      summary: !!opts.summary,
-      examplesLimit: opts.summary ? opts.examples : void 0
+      summary: false
     })
   );
   else if (opts.summary) emit(await runLint({
@@ -8271,10 +10329,10 @@ program.command("status [vault]").description("output vault diagnostics").option
     langEnvValue: process.env.WIKI_LANG
   }), v.vault);
 });
-program.command("archive <page> [vault]").description("archive a typed-knowledge or raw page").option("--wiki <name>", "wiki profile name").option("--cascade", "scan vault for references (wikilinks + sources arrays); preview by default", false).option("--apply", "with --cascade: mutate sources arrays and archive (without --apply, --cascade is preview-only)", false).option("--remote <remote>", "rclone remote root to prune the archived source path, for example seaweed-wiki:cloud/wiki").option("--remote-delete", "delete the archived source path from the remote after local archive", false).option("--max-remote-deletes <n>", "maximum remote object deletes allowed", "1").action(async (page, vault, opts) => {
+program.command("archive <page> [vault]").description("archive a typed-knowledge or raw page").option("--wiki <name>", "wiki profile name").option("--cascade", "scan vault for references (wikilinks + sources arrays); preview by default", false).option("--apply", "with --cascade: mutate sources arrays and archive (without --apply, --cascade is preview-only)", false).option("--approve <token>", "approve an exact state-bound raw archive plan").option("--remote <remote>", "rclone remote root to prune the archived source path, for example seaweed-wiki:cloud/wiki").option("--remote-delete", "delete the archived source path from the remote after local archive", false).option("--max-remote-deletes <n>", "maximum remote object deletes allowed", "1").action(async (page, vault, opts) => {
   const v = await resolveVaultArg(vault, opts.wiki);
   if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
-  else if (opts.cascade && !opts.apply) emit(await runArchive({
+  else if (!opts.apply && (opts.cascade || String(page).startsWith("raw/"))) emit(await runArchive({
     vault: v.vault,
     page,
     cascade: true,
@@ -8291,6 +10349,7 @@ program.command("archive <page> [vault]").description("archive a typed-knowledge
       page,
       cascade: !!opts.cascade,
       apply: !!opts.apply,
+      approve: opts.approve,
       remote: opts.remote,
       remoteDelete: !!opts.remoteDelete,
       maxRemoteDeletes: Number.parseInt(opts.maxRemoteDeletes, 10)
@@ -8323,15 +10382,16 @@ program.command("drift [vault]").description("detect content drift in raw source
   );
   else emit(await runDrift({ vault: v.vault, apply: false, newSince: opts.new }), v.vault);
 });
-program.command("dedup [vault]").description("detect duplicate raw sources by sha256").option("--apply", "rewire citations and remove duplicate raw files", false).option("--canonical-policy <policy>", "canonical policy: stable-path or scan-order", "stable-path").option("--manifest-out <path>", "write raw dedup delete manifest before applying").option("--manifest-in <path>", "read existing raw dedup delete manifest for remote pruning").option("--remote <remote>", "rclone remote root, for example seaweed-wiki:cloud/wiki").option("--remote-delete", "delete manifest duplicate paths from the remote", false).option("--max-remote-deletes <n>", "maximum remote object deletes allowed", "50").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
+program.command("dedup [vault]").description("detect duplicate raw sources by sha256").option("--apply", "rewire citations and preserve duplicate raw files under raw/duplicates", false).option("--approve <token>", "approve the exact state-bound dedup plan").option("--canonical-policy <policy>", "canonical policy: stable-path or scan-order", "stable-path").option("--manifest-out <path>", "write raw dedup delete manifest before applying").option("--manifest-in <path>", "read existing raw dedup delete manifest for remote pruning").option("--remote <remote>", "rclone remote root, for example seaweed-wiki:cloud/wiki").option("--remote-delete", "delete manifest duplicate paths from the remote", false).option("--max-remote-deletes <n>", "maximum remote object deletes allowed", "50").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
   const v = await resolveVaultArg(vault, opts.wiki);
   if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
-  else if (opts.apply || opts.manifestOut) return emitGuardedVaultWrite(
+  else if (opts.apply || opts.manifestOut) return emitManagedVaultWrite(
     v.vault,
     opts.apply ? "dedup --apply" : "dedup --manifest-out",
     () => runDedup({
       vault: v.vault,
       apply: opts.apply,
+      approve: opts.approve,
       canonicalPolicy: opts.canonicalPolicy,
       manifestOut: opts.manifestOut,
       manifestIn: opts.manifestIn,
@@ -8343,6 +10403,7 @@ program.command("dedup [vault]").description("detect duplicate raw sources by sh
   else emit(await runDedup({
     vault: v.vault,
     apply: opts.apply,
+    approve: opts.approve,
     canonicalPolicy: opts.canonicalPolicy,
     manifestOut: opts.manifestOut,
     manifestIn: opts.manifestIn,