skillwiki 0.10.22 → 0.10.23

package/dist/{chunk-7YDWC6D3.js → chunk-SYKSL3JQ.js}

@@ -6,20 +6,10 @@ import {
 import {
   atomicWriteText,
   buildRootIndexUniverse,
-  extractFrontmatter,
-  mapWithConcurrency,
   prepareTypedPage,
-  readPage,
-  readPageCached,
-  redactSensitiveContent,
   renderRootIndex,
-  resolveReadOnlyVaultRoot,
-  scanSensitiveContent,
-  scanVault,
-  splitFrontmatter,
-  vaultIoConcurrency,
   writeRootIndexProjection
-} from "./chunk-54JVBNWK.js";
+} from "./chunk-QBZYEEBD.js";
 import {
   CONFIG_KEYS,
   git,
@@ -35,6 +25,39 @@ import {
   snapshotterAliasForLocalHost,
   writeDotenv
 } from "./chunk-PQG26AGJ.js";
+import {
+  authorizeRawOperation,
+  buildSourceReferenceIndex,
+  buildSourceRelocationProjection,
+  classifyRawPath,
+  eventPathFor,
+  extractCitationMarkers,
+  hasOrphanedCitations,
+  hasWikilinkCitations,
+  isLegacyCitationStyle,
+  lifecycleDestination,
+  normalizeRawSourceTarget,
+  operationId,
+  rawSourceTargetExists,
+  rawSourceTargetExistsSync,
+  readSourceRelocations,
+  resolveAbsentTargetInsideVault,
+  resolveExistingRegularFileInsideVault,
+  stripFencedBlocks,
+  writeLogEvent
+} from "./chunk-QNTBNNEL.js";
+import {
+  extractFrontmatter,
+  mapWithConcurrency,
+  readPage,
+  readPageCached,
+  redactSensitiveContent,
+  resolveReadOnlyVaultRoot,
+  scanSensitiveContent,
+  scanVault,
+  splitFrontmatter,
+  vaultIoConcurrency
+} from "./chunk-6ZDKTNLA.js";
 import {
   CompoundSchema,
   ExitCode,
@@ -52,9 +75,9 @@ import {
 } from "./chunk-C2DKFJFA.js";
 
 // src/commands/log-append.ts
-import { readFile as readFile2, stat } from "fs/promises";
+import { readFile, stat } from "fs/promises";
 import { hostname } from "os";
-import { join as join4 } from "path";
+import { join as join3 } from "path";
 
 // src/utils/last-op.ts
 import { readFileSync, writeFileSync, mkdirSync, unlinkSync, existsSync } from "fs";
@@ -165,143 +188,6 @@ function releaseLogLock(handle) {
   }
 }
 
-// src/utils/log-events.ts
-import { mkdir, open, readFile, readdir } from "fs/promises";
-import { join as join3 } from "path";
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function canonicalize(value) {
-  if (Array.isArray(value)) return value.map(canonicalize);
-  if (!isPlainObject(value)) return value;
-  const out = {};
-  for (const key of Object.keys(value).sort()) {
-    out[key] = canonicalize(value[key]);
-  }
-  return out;
-}
-function eventPathFor(event) {
-  const day = event.occurred_at.slice(0, 10);
-  return `meta/log-events/${day}/${event.operation_id}.json`;
-}
-function validateLogEvent(event) {
-  if (event.schema !== "skillwiki-log-event/v1") {
-    return err("SCHEME_REJECTED", { message: "invalid event schema" });
-  }
-  if (!/^[0-9a-f]{64}$/.test(event.operation_id)) {
-    return err("SCHEME_REJECTED", { message: "operation_id must be 64 hex chars" });
-  }
-  if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(event.occurred_at)) {
-    return err("SCHEME_REJECTED", { message: "occurred_at must be UTC ISO with milliseconds" });
-  }
-  for (const field of ["host_id", "actor", "kind", "target", "note"]) {
-    const v = event[field];
-    if (typeof v !== "string" || v.trim().length === 0 || v.length > 500) {
-      return err("SCHEME_REJECTED", { message: `invalid ${field}` });
-    }
-  }
-  if (!isPlainObject(event.metadata)) {
-    return err("SCHEME_REJECTED", { message: "metadata must be a plain object" });
-  }
-  const sensitive = scanSensitiveContent(JSON.stringify(event));
-  if (sensitive.length > 0) {
-    return err("SENSITIVE_CONTENT_DETECTED", { findings: sensitive });
-  }
-  return ok({
-    schema: "skillwiki-log-event/v1",
-    operation_id: event.operation_id,
-    occurred_at: event.occurred_at,
-    host_id: event.host_id,
-    actor: event.actor,
-    kind: event.kind,
-    target: event.target,
-    note: event.note,
-    metadata: canonicalize(event.metadata)
-  });
-}
-function canonicalEventJson(event) {
-  const ordered = {
-    schema: event.schema,
-    operation_id: event.operation_id,
-    occurred_at: event.occurred_at,
-    host_id: event.host_id,
-    actor: event.actor,
-    kind: event.kind,
-    target: event.target,
-    note: event.note,
-    metadata: event.metadata
-  };
-  return `${JSON.stringify(ordered, null, 2)}
-`;
-}
-async function writeLogEvent(vault, event) {
-  const validated = validateLogEvent(event);
-  if (!validated.ok) return validated;
-  const rel = eventPathFor(validated.data);
-  const abs = join3(vault, rel);
-  await mkdir(join3(vault, "meta", "log-events", validated.data.occurred_at.slice(0, 10)), {
-    recursive: true
-  });
-  const body = canonicalEventJson(validated.data);
-  try {
-    const handle = await open(abs, "wx");
-    try {
-      await handle.writeFile(body, "utf8");
-    } finally {
-      await handle.close();
-    }
-    return ok({ path: rel, created: true });
-  } catch (error) {
-    if (error.code === "EEXIST") {
-      let existing;
-      try {
-        existing = await readFile(abs, "utf8");
-      } catch (readErr) {
-        return err("WRITE_FAILED", { path: rel, message: String(readErr) });
-      }
-      if (existing === body) return ok({ path: rel, created: false });
-      return err("EVENT_IDENTITY_COLLISION", { path: rel });
-    }
-    return err("WRITE_FAILED", { path: rel, message: String(error) });
-  }
-}
-async function readLogEvents(vault) {
-  const root = join3(vault, "meta", "log-events");
-  let days;
-  try {
-    days = (await readdir(root, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => d.name).sort();
-  } catch {
-    return ok([]);
-  }
-  const events = [];
-  for (const day of days) {
-    const files = (await readdir(join3(root, day))).filter((f) => f.endsWith(".json")).sort();
-    for (const file of files) {
-      const text = await readFile(join3(root, day, file), "utf8");
-      let parsed;
-      try {
-        parsed = JSON.parse(text);
-      } catch {
-        return err("SCHEME_REJECTED", { path: `meta/log-events/${day}/${file}`, message: "invalid JSON" });
-      }
-      const validated = validateLogEvent(parsed);
-      if (!validated.ok) return validated;
-      if (eventPathFor(validated.data) !== `meta/log-events/${day}/${file}`) {
-        return err("SCHEME_REJECTED", {
-          path: `meta/log-events/${day}/${file}`,
-          message: "path/identity mismatch"
-        });
-      }
-      events.push(validated.data);
-    }
-  }
-  events.sort((a, b) => {
-    if (a.occurred_at !== b.occurred_at) return a.occurred_at < b.occurred_at ? -1 : 1;
-    return a.operation_id < b.operation_id ? -1 : a.operation_id > b.operation_id ? 1 : 0;
-  });
-  return ok(events);
-}
-
 // src/commands/log-append.ts
 var ENTRY_RE = /^## \[(\d{4})-\d{2}-\d{2}\]/gm;
 function countLogEntries(logText) {
@@ -309,29 +195,29 @@ function countLogEntries(logText) {
   for (const _ of logText.matchAll(ENTRY_RE)) count += 1;
   return count;
 }
-function operationMarkers(operationId) {
-  if (!/^[0-9a-f]{64}$/.test(operationId)) {
+function operationMarkers(operationId2) {
+  if (!/^[0-9a-f]{64}$/.test(operationId2)) {
     return err("USAGE", { message: "operationId must be a SHA-256 hex string" });
   }
   return ok([
-    `<!-- skillwiki-log-op:${operationId} -->`,
-    `<!-- skillwiki-page-publish:${operationId} -->`,
-    `<!-- skillwiki-project-page-publish:${operationId} -->`
+    `<!-- skillwiki-log-op:${operationId2} -->`,
+    `<!-- skillwiki-page-publish:${operationId2} -->`,
+    `<!-- skillwiki-project-page-publish:${operationId2} -->`
   ]);
 }
-function preferredMarker(operationId, eventKind) {
+function preferredMarker(operationId2, eventKind) {
   if (!eventKind || eventKind === "page-publish") {
-    return `<!-- skillwiki-page-publish:${operationId} -->`;
+    return `<!-- skillwiki-page-publish:${operationId2} -->`;
   }
   if (eventKind === "project-page-publish") {
-    return `<!-- skillwiki-project-page-publish:${operationId} -->`;
+    return `<!-- skillwiki-project-page-publish:${operationId2} -->`;
   }
-  return `<!-- skillwiki-log-op:${operationId} -->`;
+  return `<!-- skillwiki-log-op:${operationId2} -->`;
 }
 async function appendWhileLocked(logPath, content, markers, writeMarker) {
   let logText;
   try {
-    logText = await readFile2(logPath, "utf8");
+    logText = await readFile(logPath, "utf8");
   } catch {
     return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: logPath }) };
   }
@@ -370,7 +256,7 @@ ${appendedContent}
 }
 async function runLogAppend(input) {
   try {
-    await stat(join4(input.vault, "SCHEMA.md"));
+    await stat(join3(input.vault, "SCHEMA.md"));
   } catch {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { vault: input.vault }) };
   }
@@ -443,7 +329,7 @@ async function runLogAppend(input) {
     return { exitCode: ExitCode.LOG_APPEND_LOCK_HELD, result: err("LOG_APPEND_LOCK_HELD", { vault: input.vault }) };
   }
   const lockHandle = acquired.data;
-  const logPath = join4(input.vault, "log.md");
+  const logPath = join3(input.vault, "log.md");
   let outcome;
   let released;
   try {
@@ -494,7 +380,7 @@ async function runLogAppend(input) {
 
 // src/utils/sync-lock.ts
 import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, renameSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync3 } from "fs";
-import { join as join5 } from "path";
+import { join as join4 } from "path";
 import { createHash, randomBytes as randomBytes2 } from "crypto";
 function getEnvSessionId() {
   if (process.env.CLAUDE_SESSION_ID) return process.env.CLAUDE_SESSION_ID;
@@ -517,7 +403,7 @@ function getCliSessionId(cwd) {
   return `cli-${getCwdHash(cwd)}`;
 }
 function lockPath(vault) {
-  return join5(vault, ".skillwiki", "sync.lock");
+  return join4(vault, ".skillwiki", "sync.lock");
 }
 function readLock(vault) {
   const path = lockPath(vault);
@@ -536,7 +422,7 @@ function isStale(lock, now) {
 }
 function acquireLock(vault, opts = {}) {
   const path = lockPath(vault);
-  const dir = join5(vault, ".skillwiki");
+  const dir = join4(vault, ".skillwiki");
   if (!existsSync3(dir)) {
     mkdirSync3(dir, { recursive: true });
   }
@@ -621,7 +507,7 @@ function acquireOwnedSyncLock(vault, opts) {
   };
   const path = lockPath(vault);
   try {
-    mkdirSync3(join5(vault, ".skillwiki"), { recursive: true });
+    mkdirSync3(join4(vault, ".skillwiki"), { recursive: true });
   } catch (error) {
     return err("WRITE_FAILED", { path, message: String(error) });
   }
@@ -653,12 +539,12 @@ function releaseOwnedSyncLock(handle) {
 
 // src/commands/validate.ts
 import { createHash as createHash2 } from "crypto";
-import { readFile as readFile4 } from "fs/promises";
+import { readFile as readFile3 } from "fs/promises";
 import { resolve, relative, sep } from "path";
 
 // src/utils/index-entry.ts
-import { readFile as readFile3 } from "fs/promises";
-import { join as join6 } from "path";
+import { readFile as readFile2 } from "fs/promises";
+import { join as join5 } from "path";
 var TYPE_SECTION = {
   entity: "Entities",
   concept: "Concepts",
@@ -702,10 +588,10 @@ function renderIndexUpsert(text, input) {
   });
 }
 async function upsertIndexEntry(input) {
-  const path = join6(input.vault, "index.md");
+  const path = join5(input.vault, "index.md");
   let before = "";
   try {
-    before = await readFile3(path, "utf8");
+    before = await readFile2(path, "utf8");
   } catch {
     before = "";
   }
@@ -740,7 +626,7 @@ var SCHEMAS = {
 async function runValidate(input) {
   let text;
   try {
-    text = await readFile4(input.file, "utf8");
+    text = await readFile3(input.file, "utf8");
   } catch {
     return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: input.file }) };
   }
@@ -797,7 +683,7 @@ ${errors.map((e) => `  ${e.path}: ${e.message}`).join("\n")}` })
     if (relPath.startsWith("..")) {
       return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { reason: `file ${input.file} is not inside vault ${input.vault}` }) };
     }
-    const operationId = createHash2("sha256").update("skillwiki-validate-apply-v1\0").update(relPath).update("\0").update(text).digest("hex");
+    const operationId2 = createHash2("sha256").update("skillwiki-validate-apply-v1\0").update(relPath).update("\0").update(text).digest("hex");
     if (det.schema === "typed-knowledge" || det.schema === "meta") {
       const prepared = prepareTypedPage(text, relPath);
       if (!prepared.ok) {
@@ -852,7 +738,7 @@ ${errors.map((e) => `  ${e.path}: ${e.message}`).join("\n")}` })
     const logged = await runLogAppend({
       vault: input.vault,
       content: `## [${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}] validate | added: ${relPath}`,
-      operationId,
+      operationId: operationId2,
       strictLock: true
     });
     if (!logged.result.ok) {
@@ -880,7 +766,7 @@ ${errors.map((e) => `  ${e.path}: ${e.message}`).join("\n")}` })
 }
 
 // src/commands/graph.ts
-import { writeFile, mkdir as mkdir2 } from "fs/promises";
+import { writeFile, mkdir } from "fs/promises";
 import { dirname } from "path";
 
 // src/parsers/wikilinks.ts
@@ -1035,7 +921,7 @@ async function runGraphBuild(input) {
   const adamicAdar = computeAdamicAdar(adjacency);
   const edge_count = Object.values(adjacency).reduce((acc, arr) => acc + arr.length, 0);
   try {
-    await mkdir2(dirname(input.out), { recursive: true });
+    await mkdir(dirname(input.out), { recursive: true });
     await writeFile(input.out, JSON.stringify({ adjacency, adamicAdar }, null, 2));
   } catch (e) {
     return { exitCode: ExitCode.WRITE_FAILED, result: err("WRITE_FAILED", { message: String(e) }) };
@@ -1079,7 +965,7 @@ function computeAdamicAdar(adj) {
 }
 
 // src/utils/wiki-path.ts
-import { join as join7 } from "path";
+import { join as join6 } from "path";
 async function resolveInitTimePath(input) {
   const chain = [];
   if (input.flag !== void 0 && input.flag.length > 0) {
@@ -1092,27 +978,27 @@ async function resolveInitTimePath(input) {
     return { path: input.envValue, source: "env", ...input.explain ? { chain } : {} };
   }
   if (input.explain) chain.push({ source: "env", matched: false });
-  const sw = await parseDotenvFile(join7(input.home, ".skillwiki", ".env"));
+  const sw = await parseDotenvFile(join6(input.home, ".skillwiki", ".env"));
   if (sw.WIKI_PATH !== void 0) {
     if (input.explain) chain.push({ source: "skillwiki-dotenv", matched: true, value: sw.WIKI_PATH });
     return { path: sw.WIKI_PATH, source: "skillwiki-dotenv", ...input.explain ? { chain } : {} };
   }
   if (input.explain) chain.push({ source: "skillwiki-dotenv", matched: false });
-  const hermes = await parseDotenvFile(join7(input.home, ".hermes", ".env"));
+  const hermes = await parseDotenvFile(join6(input.home, ".hermes", ".env"));
   if (hermes.WIKI_PATH !== void 0) {
     if (input.explain) chain.push({ source: "hermes-dotenv", matched: true, value: hermes.WIKI_PATH });
     return { path: hermes.WIKI_PATH, source: "hermes-dotenv", ...input.explain ? { chain } : {} };
   }
   if (input.explain) chain.push({ source: "hermes-dotenv", matched: false });
   if (input.cwd) {
-    const projCfg = await parseDotenvFile(join7(input.cwd, ".skillwiki", ".env"));
+    const projCfg = await parseDotenvFile(join6(input.cwd, ".skillwiki", ".env"));
     if (projCfg.WIKI_PATH !== void 0) {
       if (input.explain) chain.push({ source: "project-dotenv", matched: true, value: projCfg.WIKI_PATH });
       return { path: projCfg.WIKI_PATH, source: "project-dotenv", ...input.explain ? { chain } : {} };
     }
   }
   if (input.explain) chain.push({ source: "project-dotenv", matched: false });
-  const fallback = join7(input.home, "wiki");
+  const fallback = join6(input.home, "wiki");
   if (input.explain) chain.push({ source: "default", matched: true, value: fallback });
   return { path: fallback, source: "default", ...input.explain ? { chain } : {} };
 }
@@ -1123,7 +1009,7 @@ async function resolveRuntimePath(input) {
     return ok({ path: input.flag, source: "flag", ...input.explain ? { chain } : {} });
   }
   if (input.explain) chain.push({ source: "flag", matched: false });
-  const swGlobal = await parseDotenvFile(join7(input.home, ".skillwiki", ".env"));
+  const swGlobal = await parseDotenvFile(join6(input.home, ".skillwiki", ".env"));
   const wikiName = input.wiki;
   if (wikiName !== void 0 && wikiName.length > 0) {
     if (wikiName.toLowerCase() === "default") {
@@ -1167,7 +1053,7 @@ async function resolveRuntimePath(input) {
   }
   if (input.explain) chain.push({ source: "env", matched: false });
   if (input.cwd) {
-    const projCfg = await parseDotenvFile(join7(input.cwd, ".skillwiki", ".env"));
+    const projCfg = await parseDotenvFile(join6(input.cwd, ".skillwiki", ".env"));
     if (projCfg.WIKI_PATH !== void 0) {
       if (input.explain) chain.push({ source: "project-dotenv", matched: true, value: projCfg.WIKI_PATH });
       return ok({ path: projCfg.WIKI_PATH, source: "project-dotenv", ...input.explain ? { chain } : {} });
@@ -1287,156 +1173,12 @@ function simulateRemoval(adj, removed) {
 }
 
 // src/commands/audit.ts
-import { readFile as readFile5, stat as stat3 } from "fs/promises";
-import { dirname as dirname2, resolve as resolve2, join as join9 } from "path";
-
-// src/parsers/citations.ts
-var FENCE2 = /```[\s\S]*?```/g;
-var INLINE_CODE = /``[^`\n]+``|`[^`\n]+`/g;
-var MARKER_RE = /\^\[(raw\/[^\]]+)\]/g;
-var FRONTMATTER = /^---\n[\s\S]*?\n---\n?/;
-function stripFences(body) {
-  return body.replace(FENCE2, "").replace(INLINE_CODE, "");
-}
-var TILDE_FENCE = /~~~[\s\S]*?~~~/g;
-function stripFencedBlocks(body) {
-  return body.replace(FENCE2, "").replace(TILDE_FENCE, "");
-}
-function extractCitationMarkers(body) {
-  const stripped = stripFences(body);
-  const out = [];
-  let m;
-  while ((m = MARKER_RE.exec(stripped)) !== null) {
-    if (m[1] === "raw/...") continue;
-    out.push({ marker: m[0], target: m[1] });
-  }
-  return out;
-}
-function hasSourcesFooter(body) {
-  return /^## Sources\s*$/m.test(stripFencedBlocks(body));
-}
-function isLegacyCitationStyle(body) {
-  const markers = extractCitationMarkers(body);
-  if (markers.length === 0) return false;
-  if (!hasSourcesFooter(body)) return true;
-  const lines = stripFences(body.replace(FRONTMATTER, "")).split("\n");
-  let inSources = false;
-  let lastNonBlankWasTable = false;
-  for (const line of lines) {
-    if (/^## Sources\b/.test(line.trim())) {
-      inSources = true;
-      continue;
-    }
-    if (inSources) continue;
-    const matches = [...line.matchAll(MARKER_RE)];
-    if (matches.length === 0) {
-      if (line.trim().length > 0) lastNonBlankWasTable = /^\|/.test(line.trim());
-      continue;
-    }
-    const markerOnly = line.replace(MARKER_RE, "").trim();
-    if (markerOnly.length === 0 && !lastNonBlankWasTable) return true;
-    lastNonBlankWasTable = false;
-    const lastMatch = matches[matches.length - 1];
-    const afterLast = line.slice(lastMatch.index + lastMatch[0].length).replace(MARKER_RE, "").trim();
-    if (afterLast.length > 0) return true;
-    const beforeFirst = line.slice(0, matches[0].index).trim();
-    if (beforeFirst.length > 0 && !/[.!?]["'"]*\s*$/.test(beforeFirst)) return true;
-  }
-  return false;
-}
-function hasOrphanedCitations(body) {
-  const noFm = body.replace(FRONTMATTER, "");
-  const stripped = stripFences(noFm);
-  const lines = stripped.split("\n");
-  const rawLines = noFm.split("\n");
-  let inSources = false;
-  let sourcesEnded = false;
-  let sourcesStartLine = -1;
-  let lastNonBlankInSources = -1;
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-    const trimmed = line.trim();
-    if (/^## Sources\b/.test(trimmed)) {
-      inSources = true;
-      sourcesStartLine = i;
-      continue;
-    }
-    if (!inSources || sourcesEnded) continue;
-    if (trimmed.length === 0) {
-      if (lastNonBlankInSources >= 0) {
-        sourcesEnded = true;
-      }
-      continue;
-    }
-    const isListItem = /^\s*(?:[-*]|\d+\.)\s+/.test(line);
-    const hasMarker = /\^\[raw\//.test(line);
-    const hasBacktickRawPath = /`raw\/[^`]+`/.test(rawLines[i]);
-    if (isListItem && hasMarker) {
-      lastNonBlankInSources = i;
-    } else if (isListItem && hasBacktickRawPath) {
-      lastNonBlankInSources = i;
-    } else if (hasMarker && !isListItem) {
-      return true;
-    } else {
-      sourcesEnded = true;
-    }
-  }
-  if (sourcesStartLine === -1) return false;
-  if (sourcesEnded) {
-    const scanStart = Math.max(lastNonBlankInSources + 1, sourcesStartLine + 1);
-    for (let i = scanStart; i < lines.length; i++) {
-      if (/\^\[raw\//.test(lines[i])) {
-        return true;
-      }
-    }
-  }
-  return false;
-}
-function hasWikilinkCitations(body) {
-  const stripped = stripFences(body);
-  return /\[\[raw\/[^\]]+\]\]/.test(stripped);
-}
-
-// src/utils/raw-source.ts
-import { existsSync as existsSync4 } from "fs";
-import { stat as stat2 } from "fs/promises";
-import { join as join8 } from "path";
-function normalizeRawSourceTarget(entry) {
-  let target = entry.trim().replace(/^"/, "").replace(/"$/, "").replace(/^'/, "").replace(/'$/, "");
-  target = target.replace(/^\^\[/, "").replace(/\]$/, "");
-  if (!target.startsWith("raw/") && !target.startsWith("_archive/raw/")) return null;
-  return target;
-}
-function rawSourceTargetCandidates(vault, target) {
-  const normalized = normalizeRawSourceTarget(target);
-  if (!normalized) return [];
-  const candidates = [join8(vault, normalized)];
-  if (!normalized.endsWith(".md")) candidates.push(join8(vault, `${normalized}.md`));
-  if (normalized.startsWith("raw/")) {
-    candidates.push(join8(vault, "_archive", normalized));
-    if (!normalized.endsWith(".md")) candidates.push(join8(vault, "_archive", `${normalized}.md`));
-  }
-  return [...new Set(candidates)];
-}
-function rawSourceTargetExistsSync(vault, target) {
-  return rawSourceTargetCandidates(vault, target).some((candidate) => existsSync4(candidate));
-}
-async function rawSourceTargetExists(vault, target) {
-  for (const candidate of rawSourceTargetCandidates(vault, target)) {
-    try {
-      await stat2(candidate);
-      return true;
-    } catch {
-    }
-  }
-  return false;
-}
-
-// src/commands/audit.ts
+import { readFile as readFile4, stat as stat2 } from "fs/promises";
+import { dirname as dirname2, resolve as resolve2, join as join7 } from "path";
 async function runAudit(input) {
   let text;
   try {
-    text = await readFile5(input.file, "utf8");
+    text = await readFile4(input.file, "utf8");
   } catch {
     return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: input.file }) };
   }
@@ -1489,7 +1231,7 @@ async function findVaultRoot(start) {
   let cur = start;
   for (let i = 0; i < 20; i++) {
     try {
-      await stat3(join9(cur, "SCHEMA.md"));
+      await stat2(join7(cur, "SCHEMA.md"));
       return cur;
     } catch {
     }
@@ -1581,8 +1323,8 @@ ${broken.map((b) => `  ${b.page}:[[${b.slug}]] (line ${b.line})`).join("\n")}` }
 }
 
 // src/commands/tag-audit.ts
-import { readFile as readFile6 } from "fs/promises";
-import { join as join10 } from "path";
+import { readFile as readFile5 } from "fs/promises";
+import { join as join8 } from "path";
 
 // src/parsers/taxonomy.ts
 import yaml from "js-yaml";
@@ -1607,12 +1349,12 @@ function parseTaxonomyDocument(schemaText) {
   const nextHeading = /^#{1,2}[ \t]+/m.exec(unboundedTail);
   const sectionEnd = nextHeading?.index === void 0 ? schemaText.length : afterHeading + nextHeading.index;
   const sectionText = schemaText.slice(afterHeading, sectionEnd);
-  const open2 = /^```yaml[ \t]*\r?$/m.exec(sectionText);
-  if (!open2 || open2.index === void 0) {
+  const open = /^```yaml[ \t]*\r?$/m.exec(sectionText);
+  if (!open || open.index === void 0) {
     return err("NO_TAXONOMY_BLOCK", { message: "Fenced YAML taxonomy block not found" });
   }
-  const openStart = afterHeading + open2.index;
-  const yamlStart = openStart + open2[0].length + 1;
+  const openStart = afterHeading + open.index;
+  const yamlStart = openStart + open[0].length + 1;
   const afterOpen = schemaText.slice(yamlStart, sectionEnd);
   const close = /^```[ \t]*\r?$/m.exec(afterOpen);
   if (!close || close.index === void 0) {
@@ -1735,7 +1477,7 @@ async function runTagAudit(input) {
   const scanResult = input.scan ? ok(input.scan) : await scanVault(input.vault);
   if (!scanResult.ok) return { exitCode: ExitCode.VAULT_PATH_INVALID, result: scanResult };
   const scan = scanResult.data;
-  const schemaText = await readFile6(join10(input.vault, "SCHEMA.md"), "utf8");
+  const schemaText = await readFile5(join8(input.vault, "SCHEMA.md"), "utf8");
   const tax = extractTaxonomy(schemaText);
   if (!tax.ok) return { exitCode: ExitCode.INVALID_FRONTMATTER, result: tax };
   const allowed = new Set(tax.data);
@@ -1767,8 +1509,8 @@ async function runTagAudit(input) {
 }
 
 // src/commands/index-check.ts
-import { readFile as readFile7 } from "fs/promises";
-import { join as join11 } from "path";
+import { readFile as readFile6 } from "fs/promises";
+import { join as join9 } from "path";
 function normalizeIndexTarget(raw) {
   return raw.replace(/\.md$/, "").replace(/^\.?\//, "");
 }
@@ -1780,7 +1522,7 @@ async function runIndexCheck(input) {
   }
   let indexText = "";
   try {
-    indexText = await readFile7(join11(input.vault, "index.md"), "utf8");
+    indexText = await readFile6(join9(input.vault, "index.md"), "utf8");
   } catch {
   }
   const indexTargets = /* @__PURE__ */ new Set();
@@ -1834,20 +1576,20 @@ async function runIndexCheck(input) {
 }
 
 // src/commands/project-index.ts
-import { readdir as readdir2, readFile as readFile8, mkdir as mkdir3 } from "fs/promises";
-import { join as join12, dirname as dirname3, basename } from "path";
+import { readdir, readFile as readFile7, mkdir as mkdir2 } from "fs/promises";
+import { join as join10, dirname as dirname3, basename } from "path";
 var LAYER2_DIRS = ["entities", "concepts", "comparisons", "queries", "meta"];
 var PROJECT_LOCAL_DIRS = ["requirements", "work", "architecture", "history"];
 async function scanMarkdownTree(rootAbs, rootRel) {
   const found = [];
   let entries;
   try {
-    entries = await readdir2(rootAbs, { withFileTypes: true });
+    entries = await readdir(rootAbs, { withFileTypes: true });
   } catch {
     return found;
   }
   for (const entry of entries) {
-    const abs = join12(rootAbs, entry.name);
+    const abs = join10(rootAbs, entry.name);
     const rel = `${rootRel}/${entry.name}`;
     if (entry.isDirectory()) {
       found.push(...await scanMarkdownTree(abs, rel));
@@ -1876,23 +1618,23 @@ function projectLocalType(slug, page, data) {
   return typeof data.type === "string" ? data.type : "project";
 }
 async function renderProjectIndex(vault, slug, opts = {}) {
-  const projectDir = join12(vault, "projects", slug);
+  const projectDir = join10(vault, "projects", slug);
   try {
-    await readdir2(projectDir);
+    await readdir(projectDir);
   } catch {
     return err("PROJECT_NOT_FOUND", { slug, path: projectDir });
   }
   const wikilinkPattern = `[[${slug}]]`;
   const entries = [];
-  const compoundDir = join12(vault, "projects", slug, "compound");
+  const compoundDir = join10(vault, "projects", slug, "compound");
   try {
-    const compoundFiles = await readdir2(compoundDir, { withFileTypes: true });
+    const compoundFiles = await readdir(compoundDir, { withFileTypes: true });
     for (const entry of compoundFiles) {
       if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-      const filePath = join12(compoundDir, entry.name);
+      const filePath = join10(compoundDir, entry.name);
       let text;
       try {
-        text = await readFile8(filePath, "utf8");
+        text = await readFile7(filePath, "utf8");
       } catch {
         continue;
       }
@@ -1909,16 +1651,16 @@ async function renderProjectIndex(vault, slug, opts = {}) {
   for (const dir of LAYER2_DIRS) {
     let files;
     try {
-      files = await readdir2(join12(vault, dir), { withFileTypes: true });
+      files = await readdir(join10(vault, dir), { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of files) {
       if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-      const filePath = join12(vault, dir, entry.name);
+      const filePath = join10(vault, dir, entry.name);
       let text;
       try {
-        text = await readFile8(filePath, "utf8");
+        text = await readFile7(filePath, "utf8");
       } catch {
         continue;
       }
@@ -1934,14 +1676,14 @@ async function renderProjectIndex(vault, slug, opts = {}) {
     }
   }
   for (const dir of PROJECT_LOCAL_DIRS) {
-    const rootAbs = join12(projectDir, dir);
+    const rootAbs = join10(projectDir, dir);
     const rootRel = `projects/${slug}/${dir}`;
     const pages = await scanMarkdownTree(rootAbs, rootRel);
     for (const page of pages) {
-      const filePath = join12(vault, page);
+      const filePath = join10(vault, page);
       let text;
       try {
-        text = await readFile8(filePath, "utf8");
+        text = await readFile7(filePath, "utf8");
       } catch {
         continue;
       }
@@ -2014,7 +1756,7 @@ Autogenerated by \`skillwiki project-index\` on ${today}.
 }
 async function runProjectIndex(input) {
   const slug = input.slug;
-  const projectDir = join12(input.vault, "projects", slug);
+  const projectDir = join10(input.vault, "projects", slug);
   const rendered = await renderProjectIndex(input.vault, slug);
   if (!rendered.ok) {
     return {
@@ -2022,12 +1764,12 @@ async function runProjectIndex(input) {
       result: rendered
     };
   }
-  const indexPath = join12(projectDir, "knowledge.md");
+  const indexPath = join10(projectDir, "knowledge.md");
   const entries = rendered.data.entries;
   let existing = false;
   let stale = false;
   try {
-    const existingText = await readFile8(indexPath, "utf8");
+    const existingText = await readFile7(indexPath, "utf8");
     existing = true;
     const existingEntries = existingText.split("\n").filter((l) => l.startsWith("- [["));
     const existingPages = new Set(existingEntries.map((l) => {
@@ -2040,7 +1782,7 @@ async function runProjectIndex(input) {
   }
   if (input.apply) {
     try {
-      await mkdir3(dirname3(indexPath), { recursive: true });
+      await mkdir2(dirname3(indexPath), { recursive: true });
     } catch (e) {
       return {
         exitCode: ExitCode.WRITE_FAILED,
@@ -2072,8 +1814,8 @@ ${entries.map((e) => `  ${e.type}: [[${e.page.replace(/\.md$/, "")}]] \u2014 ${e
 }
 
 // src/commands/stale.ts
-import { readdir as readdir3, rename, mkdir as mkdir4, readFile as readFile9 } from "fs/promises";
-import { join as join13 } from "path";
+import { readdir as readdir2, rename, mkdir as mkdir4, readFile as readFile9 } from "fs/promises";
+import { join as join11 } from "path";
 
 // src/parsers/expiry-annotations.ts
 var HEADING_RE = /^#{1,6}\s+(.+)$/;
@@ -2109,6 +1851,144 @@ function parseExpiryAnnotations(content, pagePath) {
   return annotations;
 }
 
+// src/utils/raw-structural-transaction.ts
+import { createHash as createHash3 } from "crypto";
+import { copyFile, mkdir as mkdir3, readFile as readFile8, unlink } from "fs/promises";
+import { constants } from "fs";
+import { dirname as dirname4 } from "path";
+function sha256(bytes) {
+  return createHash3("sha256").update(bytes).digest("hex");
+}
+function token(plan) {
+  const payload = Buffer.from(JSON.stringify(plan), "utf8").toString("base64url");
+  return `swraw1.${payload}.${sha256(Buffer.from(payload, "utf8"))}`;
+}
+async function planRawStructuralMove(input) {
+  const sourcePath = classifyRawPath(input.source);
+  if (!sourcePath.ok) return sourcePath;
+  const destinationPath = classifyRawPath(input.destination);
+  if (!destinationPath.ok) return destinationPath;
+  if (sourcePath.data.category === "assets" || destinationPath.data.category === "assets") {
+    return err("RAW_ASSET_PATH_FROZEN", {
+      source: input.source,
+      destination: input.destination,
+      message: "referenced asset paths are stable; routine raw lifecycle moves never move assets"
+    });
+  }
+  if (sourcePath.data.storage !== "active") {
+    return err("RAW_SOURCE_NOT_ACTIVE", { path: input.source, storage: sourcePath.data.storage });
+  }
+  if (sourcePath.data.category !== destinationPath.data.category) {
+    return err("RAW_MOVE_CATEGORY_MISMATCH", {
+      source: input.source,
+      destination: input.destination,
+      source_category: sourcePath.data.category,
+      destination_category: destinationPath.data.category
+    });
+  }
+  const expectedStorage = input.operation === "archive" ? "archived" : input.operation === "deduplicate" ? "duplicate" : "active";
+  if (destinationPath.data.storage !== expectedStorage) {
+    return err("RAW_MOVE_DESTINATION_INVALID", {
+      operation: input.operation,
+      destination: input.destination,
+      expected_storage: expectedStorage,
+      actual_storage: destinationPath.data.storage
+    });
+  }
+  const allowed = authorizeRawOperation({
+    operationClass: "preserve-move",
+    trigger: "attended-apply",
+    source: input.source,
+    destination: input.destination
+  });
+  if (!allowed.ok) return allowed;
+  if (input.source === input.destination) return err("RAW_MOVE_NOOP", { path: input.source });
+  const sourceResolved = await resolveExistingRegularFileInsideVault(input.vault, input.source);
+  if (!sourceResolved.ok) return err("RAW_SOURCE_UNSAFE", { path: input.source, cause: sourceResolved });
+  const destinationResolved = await resolveAbsentTargetInsideVault(input.vault, input.destination);
+  if (!destinationResolved.ok) {
+    return destinationResolved.error === "RAW_DESTINATION_EXISTS" ? destinationResolved : err("RAW_DESTINATION_UNSAFE", { path: input.destination, cause: destinationResolved });
+  }
+  const sourceBytes = await readFile8(sourceResolved.data);
+  const sourceSha = sha256(sourceBytes);
+  const operation_id = operationId("raw-structural", [input.operation, input.source, input.destination, sourceSha]);
+  const base = {
+    operation: input.operation,
+    source: input.source,
+    destination: input.destination,
+    source_sha256: sourceSha,
+    destination_state: "absent",
+    operation_id
+  };
+  return ok({ ...base, approval_token: token(base) });
+}
+async function applyRawStructuralMove(input) {
+  const planned = await planRawStructuralMove(input);
+  if (!planned.ok) return planned;
+  if (input.approve !== planned.data.approval_token) {
+    return err("APPROVAL_INVALID", { message: "raw structural approval does not match live state" });
+  }
+  const sourceResolved = await resolveExistingRegularFileInsideVault(input.vault, input.source);
+  if (!sourceResolved.ok) return err("RAW_SOURCE_UNSAFE", { path: input.source, cause: sourceResolved });
+  const destinationResolved = await resolveAbsentTargetInsideVault(input.vault, input.destination);
+  if (!destinationResolved.ok) {
+    return destinationResolved.error === "RAW_DESTINATION_EXISTS" ? destinationResolved : err("RAW_DESTINATION_UNSAFE", { path: input.destination, cause: destinationResolved });
+  }
+  const sourceAbs = sourceResolved.data;
+  const destinationAbs = destinationResolved.data;
+  await mkdir3(dirname4(destinationAbs), { recursive: true });
+  try {
+    await copyFile(sourceAbs, destinationAbs, constants.COPYFILE_EXCL);
+  } catch (error) {
+    return err("RAW_MOVE_COPY_FAILED", { source: input.source, destination: input.destination, message: String(error) });
+  }
+  const destinationBytes = await readFile8(destinationAbs);
+  const destinationSha = sha256(destinationBytes);
+  if (destinationSha !== planned.data.source_sha256) {
+    return err("RAW_MOVE_HASH_MISMATCH", { source: input.source, destination: input.destination, source_sha256: planned.data.source_sha256, destination_sha256: destinationSha });
+  }
+  const occurredAt = input.now ?? (/* @__PURE__ */ new Date()).toISOString();
+  const event = await (input.writeEvent ?? writeLogEvent)(input.vault, {
+    schema: "skillwiki-log-event/v1",
+    operation_id: planned.data.operation_id,
+    occurred_at: occurredAt,
+    host_id: input.hostId ?? "local",
+    actor: input.actor ?? "skillwiki-cli",
+    kind: "source-relocation",
+    target: input.destination,
+    note: input.reason ?? `${input.operation} ${input.source} to ${input.destination}`,
+    metadata: {
+      operation: input.operation,
+      previous_path: input.source,
+      current_path: input.destination,
+      source_sha256: planned.data.source_sha256,
+      destination_sha256: destinationSha,
+      command: input.command ?? "skillwiki",
+      authority: "attended-apply",
+      citation_changes: input.citationChanges ?? []
+    }
+  });
+  if (!event.ok) return event;
+  try {
+    await unlink(sourceAbs);
+  } catch (error) {
+    return err("RAW_MOVE_SOURCE_RETAINED", {
+      source: input.source,
+      destination: input.destination,
+      event_path: event.data.path,
+      message: String(error)
+    });
+  }
+  return ok({
+    operation: planned.data.operation,
+    source: planned.data.source,
+    destination: planned.data.destination,
+    source_sha256: planned.data.source_sha256,
+    destination_sha256: destinationSha,
+    event_path: event.data.path
+  });
+}
+
 // src/commands/stale.ts
 function daysSince(isoDate) {
   return Math.floor((Date.now() - Date.parse(isoDate)) / 864e5);
@@ -2122,10 +2002,10 @@ async function runStale(input) {
   const archived = [];
   const workDirs = /* @__PURE__ */ new Map();
   const workDirsBySlug = /* @__PURE__ */ new Map();
-  const projectsDir = join13(input.vault, "projects");
+  const projectsDir = join11(input.vault, "projects");
   let projectSlugs = [];
   try {
-    projectSlugs = (await readdir3(projectsDir, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => d.name);
+    projectSlugs = (await readdir2(projectsDir, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
   }
   if (input.project) {
@@ -2135,10 +2015,10 @@ async function runStale(input) {
     projectSlugs = [input.project];
   }
   for (const slug of projectSlugs) {
-    const workPath = join13(projectsDir, slug, "work");
+    const workPath = join11(projectsDir, slug, "work");
     let entries;
     try {
-      entries = await readdir3(workPath, { withFileTypes: true });
+      entries = await readdir2(workPath, { withFileTypes: true });
     } catch {
       continue;
     }
@@ -2146,11 +2026,11 @@ async function runStale(input) {
     for (const e of entries) {
       if (!e.isDirectory()) continue;
       const relDir = `projects/${slug}/work/${e.name}`;
-      const absDir = join13(workPath, e.name);
+      const absDir = join11(workPath, e.name);
       let status = "";
       let files;
       try {
-        files = await readdir3(absDir);
+        files = await readdir2(absDir);
       } catch {
         workDirs.set(relDir, "");
         slugDirs.set(e.name, "");
@@ -2159,7 +2039,7 @@ async function runStale(input) {
       for (const f of files) {
         if (!f.endsWith(".md")) continue;
         try {
-          const fm = extractFrontmatter(await readFile9(join13(absDir, f), "utf8"));
+          const fm = extractFrontmatter(await readFile9(join11(absDir, f), "utf8"));
           if (fm.ok && typeof fm.data.status === "string") {
             status = fm.data.status;
             break;
@@ -2255,7 +2135,7 @@ async function runStale(input) {
     }
   }
   await mapWithConcurrency([...workDirs.keys()], vaultIoConcurrency(), async (relDir) => {
-    const specPath = join13(input.vault, relDir, "spec.md");
+    const specPath = join11(input.vault, relDir, "spec.md");
     try {
       const specContent = await readFile9(specPath, "utf8");
       const specFm = extractFrontmatter(specContent);
@@ -2286,7 +2166,7 @@ async function runStale(input) {
     if (daysSince(dateStr) < input.days) continue;
     let files;
     try {
-      files = await readdir3(join13(input.vault, relDir));
+      files = await readdir2(join11(input.vault, relDir));
     } catch {
       continue;
     }
@@ -2356,48 +2236,92 @@ async function runStale(input) {
   staleSections.push(...staleSectionResults.flat());
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   if (input.archive) {
-    const archiveDir = join13(input.vault, "_archive", today);
-    await mkdir4(archiveDir, { recursive: true });
-    const citedRawPaths = /* @__PURE__ */ new Set();
-    for (const page of scan.typedKnowledge) {
-      const text = await readPageCached(page, input.pageTextCache).catch(() => "");
-      for (const line of text.split("\n")) {
-        for (const m of line.matchAll(/\^\[(raw\/[^\]]+)\]/g)) {
-          citedRawPaths.add(m[1]);
-        }
-        for (const m of line.matchAll(/raw\/[^\s,\]"]+\.md/g)) {
-          citedRawPaths.add(m[0]);
-        }
-      }
-    }
+    const archiveDir = join11(input.vault, "_archive", today);
+    const relocations = await readSourceRelocations(input.vault);
+    if (!relocations.ok) return { exitCode: ExitCode.WRITE_FAILED, result: relocations };
+    const typedPaths = new Set(scan.typedKnowledge.map((page) => page.relPath));
+    const references = await buildSourceReferenceIndex({
+      typedPages: scan.typedKnowledge,
+      otherPages: scan.allMarkdown.filter((page) => !typedPaths.has(page.relPath) && !page.relPath.startsWith("raw/")),
+      availableRawPaths: scan.raw.map((page) => page.relPath),
+      relocationProjection: buildSourceRelocationProjection(relocations.data)
+    });
+    const citedRawPaths = /* @__PURE__ */ new Set([
+      ...references.integratedBy.keys(),
+      ...references.referencedElsewhereBy.keys()
+    ]);
+    const rawPlans = [];
     for (const t of staleTranscripts) {
       if (citedRawPaths.has(t.path) || citedRawPaths.has(t.path.replace(/\.md$/, ""))) continue;
-      const dest = join13(archiveDir, t.path.split("/").pop());
-      try {
-        await rename(join13(input.vault, t.path), dest);
-        archived.push(t.path);
-      } catch {
-      }
+      const destination = lifecycleDestination(t.path, "archive");
+      if (!destination.ok) return { exitCode: ExitCode.WRITE_FAILED, result: destination };
+      const plan = await planRawStructuralMove({ vault: input.vault, operation: "archive", source: t.path, destination: destination.data });
+      if (!plan.ok) return { exitCode: ExitCode.WRITE_FAILED, result: plan };
+      rawPlans.push({
+        from: t.path,
+        to: destination.data,
+        approval: plan.data.approval_token,
+        sourceSha256: plan.data.source_sha256
+      });
+    }
+    const workPlans = [...incompleteWorkItems, ...doneWorkItems].map((w) => w.path).sort();
+    const approvalToken = operationId("stale-archive-approval", [
+      today,
+      ...rawPlans.flatMap((plan) => [plan.from, plan.to, plan.sourceSha256, plan.approval]),
+      ...workPlans
+    ]);
+    if (!input.apply) {
+      const total2 = stale.length + staleTranscripts.length + unclaimedTranscripts.length + incompleteWorkItems.length + doneWorkItems.length + staleSections.length;
+      return { exitCode: total2 > 0 ? ExitCode.STALE_PAGE : ExitCode.OK, result: ok({
+        stale: [...stale, ...staleTranscripts.map((t) => ({ page: t.path, reason: t.reason })), ...unclaimedTranscripts.map((t) => ({ page: t.path, reason: t.reason })), ...incompleteWorkItems.map((w) => ({ page: w.path, reason: w.reason })), ...doneWorkItems.map((w) => ({ page: w.path, reason: w.reason }))],
+        stale_transcripts: staleTranscripts,
+        unclaimed_transcripts: unclaimedTranscripts,
+        incomplete_work_items: incompleteWorkItems,
+        done_work_items: doneWorkItems,
+        stale_sections: staleSections,
+        archived: [],
+        planned_archives: rawPlans.map((plan) => ({ from: plan.from, to: plan.to })),
+        approval_token: approvalToken,
+        humanHint: `DRY-RUN \u2014 ${rawPlans.length} raw transcript archive(s) and ${workPlans.length} work archive(s) require --apply --approve ${approvalToken}`
+      }) };
+    }
+    if (input.approve !== approvalToken) {
+      return { exitCode: ExitCode.USAGE, result: { ok: false, error: "APPROVAL_INVALID", detail: { message: "stale archive approval does not match live state", approval_token: approvalToken } } };
+    }
+    await mkdir4(archiveDir, { recursive: true });
+    for (const plan of rawPlans) {
+      const moved = await applyRawStructuralMove({
+        vault: input.vault,
+        operation: "archive",
+        source: plan.from,
+        destination: plan.to,
+        approve: plan.approval,
+        command: "skillwiki stale --archive --apply"
+      });
+      if (!moved.ok) return { exitCode: ExitCode.WRITE_FAILED, result: moved };
+      archived.push(plan.from);
     }
     for (const w of [...incompleteWorkItems, ...doneWorkItems]) {
       const parts = w.path.split("/");
       if (parts.length >= 4 && parts[0] === "projects") {
         const slug = parts[1];
         const itemName = parts[3];
-        const histDir = join13(input.vault, "projects", slug, "history", "archived-work");
+        const histDir = join11(input.vault, "projects", slug, "history", "archived-work");
         await mkdir4(histDir, { recursive: true });
-        const dest = join13(histDir, itemName);
+        const dest = join11(histDir, itemName);
         try {
-          await rename(join13(input.vault, w.path), dest);
+          await rename(join11(input.vault, w.path), dest);
           archived.push(w.path);
-        } catch {
+        } catch (error) {
+          return { exitCode: ExitCode.WRITE_FAILED, result: err("WRITE_FAILED", { path: w.path, destination: dest, message: String(error) }) };
         }
       } else {
-        const dest = join13(archiveDir, w.path.replace(/\//g, "_"));
+        const dest = join11(archiveDir, w.path.replace(/\//g, "_"));
         try {
-          await rename(join13(input.vault, w.path), dest);
+          await rename(join11(input.vault, w.path), dest);
           archived.push(w.path);
-        } catch {
+        } catch (error) {
+          return { exitCode: ExitCode.WRITE_FAILED, result: err("WRITE_FAILED", { path: w.path, destination: dest, message: String(error) }) };
         }
       }
     }
@@ -2450,16 +2374,48 @@ async function runPagesize(input) {
 }
 
 // src/commands/log-rotate.ts
-import { readFile as readFile10, rename as rename2, writeFile as writeFile2, stat as stat4 } from "fs/promises";
-import { join as join14 } from "path";
+import { access, readFile as readFile10, rename as rename2, writeFile as writeFile2, stat as stat3 } from "fs/promises";
+import { join as join12 } from "path";
 var ENTRY_RE2 = /^## \[(\d{4})-\d{2}-\d{2}\]/gm;
+var FULL_DATE_RE = /^## \[(\d{4}-\d{2}-\d{2})\]/gm;
+async function pathExists(p) {
+  try {
+    await access(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function archiveNameForExistingYearLog(existingText, fallbackYear) {
+  const dates = [...existingText.matchAll(FULL_DATE_RE)].map((m) => m[1]);
+  if (dates.length === 0) {
+    return `log-archive-${fallbackYear}-unknown.md`;
+  }
+  const first = dates[0];
+  const last = dates[dates.length - 1];
+  const lastMd = last.slice(5);
+  return `log-archive-${first}-to-${lastMd}.md`;
+}
+async function sidelineExistingYearLog(vault, rotatedPath, fallbackYear) {
+  if (!await pathExists(rotatedPath)) return void 0;
+  const existingText = await readFile10(rotatedPath, "utf8");
+  let archiveName = archiveNameForExistingYearLog(existingText, fallbackYear);
+  let archivePath = join12(vault, archiveName);
+  if (await pathExists(archivePath)) {
+    const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+    archiveName = archiveName.replace(/\.md$/, `-${stamp}.md`);
+    archivePath = join12(vault, archiveName);
+  }
+  await rename2(rotatedPath, archivePath);
+  return archiveName;
+}
 async function runLogRotate(input) {
   try {
-    await stat4(join14(input.vault, "SCHEMA.md"));
+    await stat3(join12(input.vault, "SCHEMA.md"));
   } catch {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { vault: input.vault }) };
   }
-  const logPath = join14(input.vault, "log.md");
+  const logPath = join12(input.vault, "log.md");
   let logText;
   try {
     logText = await readFile10(logPath, "utf8");
@@ -2471,37 +2427,56 @@ async function runLogRotate(input) {
   if (entries < input.threshold) {
     return { exitCode: ExitCode.OK, result: ok({ entries, threshold: input.threshold, rotated: false, humanHint: `${entries}/${input.threshold} entries \u2014 no rotation needed` }) };
   }
+  const newestYear = matches[matches.length - 1][1];
+  const rotatedName = `log-${newestYear}.md`;
+  const rotatedPath = join12(input.vault, rotatedName);
+  const yearExists = await pathExists(rotatedPath);
   if (!input.apply) {
+    const hint = yearExists ? `${entries}/${input.threshold} entries \u2014 rotation needed (use --apply); existing ${rotatedName} will be sidelined to log-archive-* first` : `${entries}/${input.threshold} entries \u2014 rotation needed (use --apply)`;
     return {
       exitCode: ExitCode.LOG_ROTATE_NEEDED,
-      result: ok({ entries, threshold: input.threshold, rotated: false, humanHint: `${entries}/${input.threshold} entries \u2014 rotation needed (use --apply)` })
+      result: ok({ entries, threshold: input.threshold, rotated: false, humanHint: hint })
     };
   }
-  const newestYear = matches[matches.length - 1][1];
-  const rotatedName = `log-${newestYear}.md`;
-  const rotatedPath = join14(input.vault, rotatedName);
+  let archivedExistingTo;
   try {
+    archivedExistingTo = await sidelineExistingYearLog(input.vault, rotatedPath, newestYear);
     await rename2(logPath, rotatedPath);
     const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+    const sidelineNote = archivedExistingTo ? `
+- Prior ${rotatedName} preserved as ${archivedExistingTo}
+` : "";
     const fresh = `# Vault Log
 
 Chronological action log. Newest entries last. Skill writes append entries; lint may rotate.
 
 ## [${today}] rotate | Log rotated from ${entries} entries
 
-- Previous log moved to ${rotatedName}
-`;
+- Previous log moved to ${rotatedName}${sidelineNote}`;
     await writeFile2(logPath, fresh, "utf8");
   } catch (e) {
     return { exitCode: ExitCode.WRITE_FAILED, result: err("WRITE_FAILED", { message: String(e) }) };
   }
+  const files = ["log.md", rotatedName];
+  if (archivedExistingTo) files.push(archivedExistingTo);
+  const summary = archivedExistingTo ? `rotated ${entries} entries to ${rotatedName}; archived existing to ${archivedExistingTo}` : `rotated ${entries} entries to ${rotatedName}`;
   appendLastOp(input.vault, {
     operation: "log-rotate",
-    summary: `rotated ${entries} entries to ${rotatedName}`,
-    files: ["log.md", rotatedName],
+    summary,
+    files,
     timestamp: (/* @__PURE__ */ new Date()).toISOString()
   });
-  return { exitCode: ExitCode.OK, result: ok({ entries, threshold: input.threshold, rotated: true, rotated_to: rotatedName, humanHint: `rotated ${entries} entries to ${rotatedName}` }) };
+  return {
+    exitCode: ExitCode.OK,
+    result: ok({
+      entries,
+      threshold: input.threshold,
+      rotated: true,
+      rotated_to: rotatedName,
+      archived_existing_to: archivedExistingTo,
+      humanHint: summary
+    })
+  };
 }
 
 // src/commands/topic-map-check.ts
@@ -2525,12 +2500,12 @@ async function runTopicMapCheck(input) {
 
 // src/commands/index-link-format.ts
 import { readFile as readFile11 } from "fs/promises";
-import { join as join15 } from "path";
+import { join as join13 } from "path";
 var MD_LINK_RE = /\[[^\[\]]+\]\([^)]+\.md\)/;
 async function runIndexLinkFormat(input) {
   let text = "";
   try {
-    text = await readFile11(join15(input.vault, "index.md"), "utf8");
+    text = await readFile11(join13(input.vault, "index.md"), "utf8");
   } catch {
   }
   const markdown_links = [];
@@ -2543,9 +2518,9 @@ ${markdown_links.map((l) => `  line ${l.line}: ${l.text}`).join("\n")}`;
 }
 
 // src/commands/dedup.ts
-import { createHash as createHash3 } from "crypto";
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4, unlinkSync as unlinkSync4 } from "fs";
-import { dirname as dirname4, join as join16, resolve as resolve3 } from "path";
+import { createHash as createHash5 } from "crypto";
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname5, join as join14, posix, resolve as resolve3 } from "path";
 
 // src/utils/rclone.ts
 import { execFile } from "child_process";
@@ -2594,6 +2569,140 @@ async function defaultRcloneRunner(args) {
   }
 }
 
+// src/utils/safe-write.ts
+import { readFile as readFile12, writeFile as writeFile3 } from "fs/promises";
+var DEFAULT_MIN_BODY_RATIO = 0.5;
+var DEFAULT_MIN_OLD_BODY_BYTES = 200;
+function bodyBytes(text) {
+  const split = splitFrontmatter(text);
+  if (!split.ok) return Buffer.byteLength(text, "utf8");
+  return Buffer.byteLength(split.data.body, "utf8");
+}
+async function readIfExists(absPath) {
+  try {
+    return await readFile12(absPath, "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return null;
+    throw e;
+  }
+}
+async function safeWritePage(absPath, newContent, opts = {}) {
+  const minRatio = opts.minBodyRatio === void 0 ? DEFAULT_MIN_BODY_RATIO : opts.minBodyRatio;
+  const minOldBytes = opts.minOldBodyBytes ?? DEFAULT_MIN_OLD_BODY_BYTES;
+  let oldContent;
+  try {
+    oldContent = await readIfExists(absPath);
+  } catch (e) {
+    return err("WRITE_FAILED", { path: absPath, phase: "read-existing", message: String(e) });
+  }
+  const isNew = oldContent === null;
+  const oldBodyBytes = isNew ? 0 : bodyBytes(oldContent);
+  const newBodyBytes = bodyBytes(newContent);
+  const bodyRatio = oldBodyBytes > 0 ? newBodyBytes / oldBodyBytes : null;
+  let guardSkippedSmall = false;
+  if (!isNew && minRatio !== null && bodyRatio !== null && bodyRatio < minRatio) {
+    if (oldBodyBytes < minOldBytes) {
+      guardSkippedSmall = true;
+    } else {
+      return err("BODY_TRUNCATION_GUARD", {
+        path: absPath,
+        oldBodyBytes,
+        newBodyBytes,
+        bodyRatio,
+        minBodyRatio: minRatio,
+        hint: "Refusing to write \u2014 new body lost too much content. Likely a parse-modify-serialize bug or a write race. Verify the page source before retrying."
+      });
+    }
+  }
+  const written = await atomicWriteText(absPath, newContent);
+  if (!written.ok) return written;
+  return ok({
+    changed: written.data.changed,
+    isNew,
+    oldBodyBytes,
+    newBodyBytes,
+    bodyRatio,
+    guardSkippedSmall
+  });
+}
+
+// src/utils/raw-reference-rewrite.ts
+function withoutMarkdownExtension(path) {
+  return path.endsWith(".md") ? path.slice(0, -3) : path;
+}
+function replacementFor(value, oldPath, newPath) {
+  const oldNoExtension = withoutMarkdownExtension(oldPath);
+  const newNoExtension = withoutMarkdownExtension(newPath);
+  if (value === oldPath) return newPath;
+  if (value === oldNoExtension) return newNoExtension;
+  if (value === `^[${oldPath}]`) return `^[${newPath}]`;
+  if (value === `^[${oldNoExtension}]`) return `^[${newNoExtension}]`;
+  return null;
+}
+function renderSources(values) {
+  if (values.length === 0) return "sources: []";
+  return `sources:
+${values.map((value) => `  - ${value}`).join("\n")}`;
+}
+function rewriteRawSourceReferences(text, oldPath, newPath) {
+  const split = splitFrontmatter(text);
+  const oldNoExtension = withoutMarkdownExtension(oldPath);
+  const newNoExtension = withoutMarkdownExtension(newPath);
+  const body = split.ok ? split.data.body : text;
+  let rewrittenBody = body;
+  let bodyCitationCount = 0;
+  for (const [oldMarker, newMarker] of [
+    [`^[${oldPath}]`, `^[${newPath}]`],
+    [`^[${oldNoExtension}]`, `^[${newNoExtension}]`]
+  ]) {
+    const count = rewrittenBody.split(oldMarker).length - 1;
+    if (count > 0) {
+      rewrittenBody = rewrittenBody.replaceAll(oldMarker, newMarker);
+      bodyCitationCount += count;
+    }
+  }
+  if (!split.ok) {
+    return { text: rewrittenBody, changed: rewrittenBody !== text, sourcesBefore: [], sourcesAfter: [], bodyCitationCount };
+  }
+  const frontmatter = extractFrontmatter(text);
+  const sourcesBefore = frontmatter.ok && Array.isArray(frontmatter.data.sources) ? frontmatter.data.sources.filter((value) => typeof value === "string") : [];
+  const sourcesAfter = sourcesBefore.map((value) => replacementFor(value, oldPath, newPath) ?? value);
+  const sourcesChanged = sourcesBefore.some((value, index) => value !== sourcesAfter[index]);
+  let rewrittenFrontmatter = split.data.rawFrontmatter;
+  if (sourcesChanged) {
+    rewrittenFrontmatter = rewrittenFrontmatter.replace(
+      /^sources:\s*(?:\[[^\]]*\]|(?:\r?\n(?:\s*-\s.*))+)/m,
+      renderSources(sourcesAfter)
+    );
+  }
+  if (!sourcesChanged && rewrittenBody === body) {
+    return { text, changed: false, sourcesBefore, sourcesAfter, bodyCitationCount };
+  }
+  const rewritten = `---
+${rewrittenFrontmatter}
+---${rewrittenBody}`;
+  return {
+    text: rewritten,
+    changed: rewritten !== text,
+    sourcesBefore,
+    sourcesAfter,
+    bodyCitationCount
+  };
+}
+
+// src/utils/maintained-page-state.ts
+import { createHash as createHash4 } from "crypto";
+import { readFile as readFile13 } from "fs/promises";
+async function snapshotMaintainedPageState(pages) {
+  const entries = await Promise.all(
+    pages.filter((page) => !page.relPath.startsWith("raw/")).map(async (page) => {
+      const bytes = await readFile13(page.absPath);
+      return `${page.relPath}:${createHash4("sha256").update(bytes).digest("hex")}`;
+    })
+  );
+  return entries.sort();
+}
+
 // src/commands/dedup.ts
 async function runDedup(input) {
   if (input.canonicalPolicy && input.canonicalPolicy !== "scan-order" && input.canonicalPolicy !== "stable-path") {
@@ -2614,7 +2723,11 @@ async function runDedup(input) {
   }
   const hashMap = /* @__PURE__ */ new Map();
   let totalFiles = 0;
-  const rawEntries = await mapWithConcurrency(scan.raw, vaultIoConcurrency(), async (raw) => {
+  const activeRaw = scan.raw.filter((raw) => {
+    const classified = classifyRawPath(raw.relPath);
+    return classified.ok && classified.data.storage === "active" && classified.data.category !== "assets";
+  });
+  const rawEntries = await mapWithConcurrency(activeRaw, vaultIoConcurrency(), async (raw) => {
     const fm = extractFrontmatter(await readPageCached(raw, input.pageTextCache));
     if (!fm.ok) return null;
     const sha = typeof fm.data.sha256 === "string" ? fm.data.sha256 : null;
@@ -2629,77 +2742,101 @@ async function runDedup(input) {
     else hashMap.set(entry.sha, [entry.relPath]);
   }
   const canonicalPolicy = input.canonicalPolicy ?? "stable-path";
-  const duplicates = [...hashMap.entries()].filter(([, files]) => files.length > 1).map(([sha256, files]) => ({ sha256, files: orderFiles(files, canonicalPolicy) }));
+  const duplicates = [...hashMap.entries()].filter(([, files]) => files.length > 1).map(([sha2562, files]) => ({ sha256: sha2562, files: orderFiles(files, canonicalPolicy) }));
   const rewired = [];
   const removed = [];
+  const relocated = [];
   const unsafe = [];
   const safeEntries = manifestFromFile?.ok ? manifestFromFile.data.entries : buildSafeEntries(input.vault, duplicates, unsafe);
+  if (manifestFromFile?.ok) {
+    const validatedManifest = validateManifestLocalState(input.vault, manifestFromFile.data);
+    if (!validatedManifest.ok) return { exitCode: ExitCode.USAGE, result: validatedManifest };
+  }
   const manifest = safeEntries.length > 0 ? {
     version: 1,
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
     vault: resolve3(input.vault),
     entries: safeEntries
   } : void 0;
-  const remote = await planAndMaybePruneRemote(input, safeEntries);
-  if (!remote.ok) {
-    return {
-      exitCode: remote.error === "SYNC_PUSH_FAILED" ? ExitCode.SYNC_PUSH_FAILED : ExitCode.USAGE,
-      result: remote
-    };
+  const remoteDeleteCount = safeEntries.reduce((count, entry) => count + entry.duplicates.length, 0);
+  if (input.remoteDelete && (!Number.isInteger(input.maxRemoteDeletes) || (input.maxRemoteDeletes ?? 0) < remoteDeleteCount)) {
+    return { exitCode: ExitCode.USAGE, result: err("USAGE", { message: `planned remote deletes ${remoteDeleteCount} exceed --max-remote-deletes ${input.maxRemoteDeletes ?? 0}` }) };
+  }
+  const structuralPlans = [];
+  for (const entry of safeEntries) {
+    for (const duplicate of entry.duplicates) {
+      if (!existsSync4(join14(input.vault, duplicate))) continue;
+      const destination = dedupDestination(input.vault, duplicate);
+      const plan = await planRawStructuralMove({ vault: input.vault, operation: "deduplicate", source: duplicate, destination });
+      if (!plan.ok) return { exitCode: ExitCode.WRITE_FAILED, result: plan };
+      structuralPlans.push({ source: duplicate, destination, canonical: entry.canonical, approval: plan.data.approval_token, source_sha256: plan.data.source_sha256 });
+    }
+  }
+  const citationState = await snapshotMaintainedPageState(scan.allMarkdown);
+  const approvalToken = structuralPlans.length > 0 ? operationId("raw-dedup-approval", [
+    ...structuralPlans.flatMap((plan) => [plan.source, plan.destination, plan.source_sha256]),
+    ...citationState
+  ]) : void 0;
+  if (input.apply && structuralPlans.length > 0 && input.approve !== approvalToken) {
+    return { exitCode: ExitCode.USAGE, result: err("APPROVAL_INVALID", { message: "dedup apply requires the live dry-run --approve token", approval_token: approvalToken }) };
   }
   if (input.manifestOut && manifest) {
     try {
-      mkdirSync4(dirname4(input.manifestOut), { recursive: true });
+      mkdirSync4(dirname5(input.manifestOut), { recursive: true });
       writeFileSync4(input.manifestOut, `${JSON.stringify(manifest, null, 2)}
 `, "utf-8");
     } catch (e) {
       return { exitCode: ExitCode.WRITE_FAILED, result: err("WRITE_FAILED", { path: input.manifestOut, message: String(e) }) };
     }
   }
-  if (input.apply && safeEntries.length > 0) {
+  if (input.apply && structuralPlans.length > 0) {
     const replacements = /* @__PURE__ */ new Map();
-    for (const entry of safeEntries) {
-      for (const duplicate of entry.duplicates) {
-        replacements.set(duplicate, entry.canonical);
-      }
-    }
+    for (const plan of structuralPlans) replacements.set(plan.source, plan.canonical);
+    const pendingWrites = [];
     for (const page of scan.allMarkdown.filter((p) => !p.relPath.startsWith("raw/"))) {
-      const text = readFileSync4(join16(input.vault, page.relPath), "utf-8");
+      const text = readFileSync4(join14(input.vault, page.relPath), "utf-8");
       let updated = text;
       let changed = false;
       for (const [oldPath, newPath] of replacements) {
-        const oldMarker = `^[${oldPath}]`;
-        const newMarker = `^[${newPath}]`;
-        if (updated.includes(oldMarker)) {
-          updated = updated.replaceAll(oldMarker, newMarker);
-          changed = true;
-        }
-        const oldFm = `- "^[${oldPath}]"`;
-        const newFm = `- "^[${newPath}]"`;
-        if (updated.includes(oldFm)) {
-          updated = updated.replaceAll(oldFm, newFm);
-          changed = true;
-        }
+        const rewritten = rewriteRawSourceReferences(updated, oldPath, newPath);
+        updated = rewritten.text;
+        changed = changed || rewritten.changed;
       }
       if (changed) {
-        writeFileSync4(join16(input.vault, page.relPath), updated);
+        pendingWrites.push({ page: page.relPath, text: updated });
         rewired.push(page.relPath);
       }
     }
-    for (const oldPath of replacements.keys()) {
-      const fullPath = join16(input.vault, oldPath);
-      try {
-        unlinkSync4(fullPath);
-        removed.push(oldPath);
-      } catch {
-      }
+    for (const plan of structuralPlans) {
+      const moved = await applyRawStructuralMove({
+        vault: input.vault,
+        operation: "deduplicate",
+        source: plan.source,
+        destination: plan.destination,
+        approve: plan.approval,
+        command: "skillwiki dedup --apply",
+        citationChanges: pendingWrites.map((write) => write.page)
+      });
+      if (!moved.ok) return { exitCode: ExitCode.WRITE_FAILED, result: moved };
+      relocated.push({ from: plan.source, to: plan.destination });
+    }
+    for (const pending of pendingWrites) {
+      const write = await safeWritePage(join14(input.vault, pending.page), pending.text);
+      if (!write.ok) return { exitCode: ExitCode.WRITE_FAILED, result: write };
     }
   }
-  if (input.apply && (rewired.length > 0 || removed.length > 0)) {
+  const remote = await planAndMaybePruneRemote({ ...input, remoteDelete: input.apply || input.manifestIn ? input.remoteDelete : false }, safeEntries);
+  if (!remote.ok) {
+    return {
+      exitCode: remote.error === "SYNC_PUSH_FAILED" ? ExitCode.SYNC_PUSH_FAILED : ExitCode.USAGE,
+      result: remote
+    };
+  }
+  if (input.apply && (rewired.length > 0 || relocated.length > 0)) {
     appendLastOp(input.vault, {
       operation: "dedup",
-      summary: `rewired ${rewired.length} pages, removed ${removed.length} duplicates`,
-      files: [...rewired, ...removed],
+      summary: `rewired ${rewired.length} pages, preserved ${relocated.length} duplicates under raw/duplicates`,
+      files: [...rewired, ...relocated.flatMap((move) => [move.from, move.to])],
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     });
   }
@@ -2710,7 +2847,7 @@ async function runDedup(input) {
     for (const d of duplicates) hintLines.push(`  ${d.sha256.slice(0, 12)}... \u2192 ${d.files.join(", ")}`);
     if (input.apply) {
       hintLines.push(`rewired: ${rewired.length} pages`);
-      hintLines.push(`removed: ${removed.length} raw files`);
+      hintLines.push(`preserved duplicates: ${relocated.length} raw files`);
     }
     if (unsafe.length > 0) hintLines.push(`unsafe: ${unsafe.length} groups skipped`);
     if (remote.data.plannedDeletes.length > 0) {
@@ -2730,10 +2867,21 @@ async function runDedup(input) {
       remote: remote.data,
       rewired,
       removed,
+      relocated,
+      ...approvalToken ? { approval_token: approvalToken } : {},
       humanHint: hintLines.join("\n")
     })
   };
 }
+function dedupDestination(vault, source) {
+  const base = lifecycleDestination(source, "deduplicate");
+  if (!base.ok) throw new Error(`unsupported raw dedup path: ${source}`);
+  if (!existsSync4(join14(vault, base.data))) return base.data;
+  const contentHash = createHash5("sha256").update(readFileSync4(join14(vault, source))).digest("hex").slice(0, 8);
+  const ext = posix.extname(base.data);
+  const stem = ext ? base.data.slice(0, -ext.length) : base.data;
+  return `${stem}--${contentHash}${ext}`;
+}
 function orderFiles(files, policy) {
   if (policy === "scan-order") return [...files];
   return [...files].sort(compareStableRawPath);
@@ -2781,10 +2929,13 @@ function buildSafeEntries(vault, duplicates, unsafe) {
   return entries;
 }
 function hashRawBody(vault, relPath) {
-  const text = readFileSync4(join16(vault, relPath), "utf-8");
+  const text = readFileSync4(join14(vault, relPath), "utf-8");
+  return hashRawBodyText(text);
+}
+function hashRawBodyText(text) {
   const split = splitFrontmatter(text);
   const body = split.ok ? split.data.body : text;
-  return createHash3("sha256").update(body).digest("hex");
+  return createHash5("sha256").update(body).digest("hex");
 }
 function readManifest(path) {
   try {
@@ -2797,69 +2948,50 @@ function readManifest(path) {
     return err("INVALID_FRONTMATTER", { path, message: String(e) });
   }
 }
+function validateManifestLocalState(vault, manifest) {
+  if (resolve3(manifest.vault) !== resolve3(vault)) {
+    return err("APPROVAL_INVALID", {
+      message: "dedup manifest belongs to a different vault",
+      manifest_vault: manifest.vault,
+      vault: resolve3(vault)
+    });
+  }
+  for (const entry of manifest.entries) {
+    if (!/^[a-f0-9]{64}$/i.test(entry.sha256) || !/^[a-f0-9]{64}$/i.test(entry.bodyHash)) {
+      return err("APPROVAL_INVALID", { message: "dedup manifest contains an invalid hash", canonical: entry.canonical });
+    }
+    const paths = [entry.canonical, ...entry.duplicates];
+    if (new Set(paths).size !== paths.length) {
+      return err("APPROVAL_INVALID", { message: "dedup manifest contains repeated or self-duplicate paths", canonical: entry.canonical });
+    }
+    for (const path of paths) {
+      const classified = typeof path === "string" ? classifyRawPath(path) : err("RAW_PATH_INVALID", { path });
+      if (!classified.ok || classified.data.path !== path || classified.data.storage !== "active" || classified.data.category === "assets") {
+        return err("APPROVAL_INVALID", { message: "dedup manifest contains an invalid active raw source path", path });
+      }
+    }
+    const canonicalExists = existsSync4(join14(vault, entry.canonical));
+    const liveDuplicates = entry.duplicates.filter((path) => existsSync4(join14(vault, path)));
+    if (!canonicalExists && liveDuplicates.length > 0) {
+      return err("APPROVAL_INVALID", { message: "dedup manifest canonical is missing while a local duplicate exists", canonical: entry.canonical });
+    }
+    for (const path of canonicalExists ? [entry.canonical, ...liveDuplicates] : liveDuplicates) {
+      const text = readFileSync4(join14(vault, path), "utf8");
+      const fm = extractFrontmatter(text);
+      const declaredSha = fm.ok && typeof fm.data.sha256 === "string" ? fm.data.sha256 : null;
+      if (declaredSha !== entry.sha256 || hashRawBodyText(text) !== entry.bodyHash) {
+        return err("APPROVAL_INVALID", { message: "dedup manifest does not match live local raw state", path });
+      }
+    }
+  }
+  return ok(true);
+}
 async function planAndMaybePruneRemote(input, entries) {
   const remoteRoot = normalizeRemoteRoot(input.remote);
   const plannedDeletes = remoteRoot ? entries.flatMap((entry) => entry.duplicates.map((path) => `${remoteRoot}/${path}`)) : [];
   return planAndMaybePruneRemoteObjects(plannedDeletes, { ...input, defaultMaxDeletes: 50 });
 }
 
-// src/utils/safe-write.ts
-import { readFile as readFile12, writeFile as writeFile3 } from "fs/promises";
-var DEFAULT_MIN_BODY_RATIO = 0.5;
-var DEFAULT_MIN_OLD_BODY_BYTES = 200;
-function bodyBytes(text) {
-  const split = splitFrontmatter(text);
-  if (!split.ok) return Buffer.byteLength(text, "utf8");
-  return Buffer.byteLength(split.data.body, "utf8");
-}
-async function readIfExists(absPath) {
-  try {
-    return await readFile12(absPath, "utf8");
-  } catch (e) {
-    if (e.code === "ENOENT") return null;
-    throw e;
-  }
-}
-async function safeWritePage(absPath, newContent, opts = {}) {
-  const minRatio = opts.minBodyRatio === void 0 ? DEFAULT_MIN_BODY_RATIO : opts.minBodyRatio;
-  const minOldBytes = opts.minOldBodyBytes ?? DEFAULT_MIN_OLD_BODY_BYTES;
-  let oldContent;
-  try {
-    oldContent = await readIfExists(absPath);
-  } catch (e) {
-    return err("WRITE_FAILED", { path: absPath, phase: "read-existing", message: String(e) });
-  }
-  const isNew = oldContent === null;
-  const oldBodyBytes = isNew ? 0 : bodyBytes(oldContent);
-  const newBodyBytes = bodyBytes(newContent);
-  const bodyRatio = oldBodyBytes > 0 ? newBodyBytes / oldBodyBytes : null;
-  let guardSkippedSmall = false;
-  if (!isNew && minRatio !== null && bodyRatio !== null && bodyRatio < minRatio) {
-    if (oldBodyBytes < minOldBytes) {
-      guardSkippedSmall = true;
-    } else {
-      return err("BODY_TRUNCATION_GUARD", {
-        path: absPath,
-        oldBodyBytes,
-        newBodyBytes,
-        bodyRatio,
-        minBodyRatio: minRatio,
-        hint: "Refusing to write \u2014 new body lost too much content. Likely a parse-modify-serialize bug or a write race. Verify the page source before retrying."
-      });
-    }
-  }
-  const written = await atomicWriteText(absPath, newContent);
-  if (!written.ok) return written;
-  return ok({
-    changed: written.data.changed,
-    isNew,
-    oldBodyBytes,
-    newBodyBytes,
-    bodyRatio,
-    guardSkippedSmall
-  });
-}
-
 // src/commands/frontmatter-fix.ts
 function isoToday() {
   return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
@@ -2938,9 +3070,8 @@ ${newBody}`;
 
 // src/commands/lint.ts
 import { existsSync as existsSync6 } from "fs";
-import { readFile as readFile14, readdir as readdir4 } from "fs/promises";
-import { createHash as createHash5 } from "crypto";
-import { join as join18, relative as relative2, sep as sep2 } from "path";
+import { readFile as readFile15, readdir as readdir3 } from "fs/promises";
+import { join as join16, relative as relative2, sep as sep2 } from "path";
 
 // src/commands/sparse-community.ts
 async function runSparseCommunity(input) {
@@ -2956,7 +3087,7 @@ async function runSparseCommunity(input) {
 }
 
 // src/commands/raw-body-dedup.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 async function runRawBodyDedup(vault, scan, pageTextCache) {
   const scanResult = scan ? ok(scan) : await scanVault(vault);
   if (!scanResult.ok) return { exitCode: ExitCode.VAULT_PATH_INVALID, result: scanResult };
@@ -2965,7 +3096,7 @@ async function runRawBodyDedup(vault, scan, pageTextCache) {
     const text = await readPageCached(raw, pageTextCache);
     const split = splitFrontmatter(text);
     if (!split.ok) return null;
-    const bodyHash = createHash4("sha256").update(split.data.body).digest("hex");
+    const bodyHash = createHash6("sha256").update(split.data.body).digest("hex");
     const fm = extractFrontmatter(text);
     let fmSha256 = null;
     if (fm.ok && typeof fm.data.sha256 === "string" && fm.data.sha256.length === 64) {
@@ -2998,8 +3129,8 @@ async function runRawBodyDedup(vault, scan, pageTextCache) {
 
 // src/commands/path-too-long.ts
 import { existsSync as existsSync5 } from "fs";
-import { mkdir as mkdir5, readFile as readFile13, rename as rename3, unlink } from "fs/promises";
-import { dirname as dirname5, join as join17, posix, resolve as resolve4 } from "path";
+import { mkdir as mkdir5, readFile as readFile14, rename as rename3, unlink as unlink2 } from "fs/promises";
+import { dirname as dirname6, join as join15, posix as posix2, resolve as resolve4 } from "path";
 var MAX_PATH_LENGTH = 240;
 var WINDOWS_ABSOLUTE_PATH_LIMIT = 259;
 async function runPathTooLong(input) {
@@ -3025,6 +3156,10 @@ async function fixPathTooLong(input) {
   const fixed = [];
   const unresolved = [];
   for (const violation of violations) {
+    if (violation.relPath.startsWith("raw/")) {
+      unresolved.push(violation.relPath);
+      continue;
+    }
     const target = await resolveFixTarget(input.vault, violation.relPath, violation.suggestedRelPath, maxFixLength);
     if (!target || target.relPath === violation.relPath || target.relPath.length > maxFixLength) {
       unresolved.push(violation.relPath);
@@ -3032,10 +3167,10 @@ async function fixPathTooLong(input) {
     }
     try {
       if (target.mode === "dedupe") {
-        await unlink(join17(input.vault, violation.relPath));
+        await unlink2(join15(input.vault, violation.relPath));
       } else {
-        await mkdir5(dirname5(join17(input.vault, target.relPath)), { recursive: true });
-        await rename3(join17(input.vault, violation.relPath), join17(input.vault, target.relPath));
+        await mkdir5(dirname6(join15(input.vault, target.relPath)), { recursive: true });
+        await rename3(join15(input.vault, violation.relPath), join15(input.vault, target.relPath));
       }
       fixed.push({ from: violation.relPath, to: target.relPath });
     } catch {
@@ -3049,7 +3184,7 @@ async function fixPathTooLong(input) {
       for (const page of afterScan.data.allMarkdown) {
         if (!shouldRewriteReferences(page.relPath)) continue;
         try {
-          const original = await readFile13(page.absPath, "utf8");
+          const original = await readFile14(page.absPath, "utf8");
           let updated = original;
           for (const fix of fixed) {
             updated = replacePathReferences(updated, fix.from, fix.to);
@@ -3112,9 +3247,9 @@ function truncateFilename(relPath, maxLength = MAX_PATH_LENGTH) {
 async function resolveFixTarget(vault, original, preferred, maxLength) {
   for (const candidate of candidateRelPaths(preferred, maxLength)) {
     if (candidate === original || candidate.length > maxLength) continue;
-    const candidatePath = join17(vault, candidate);
+    const candidatePath = join15(vault, candidate);
     if (!existsSync5(candidatePath)) return { relPath: candidate, mode: "rename" };
-    if (await hasSameContent(join17(vault, original), candidatePath)) {
+    if (await hasSameContent(join15(vault, original), candidatePath)) {
       return { relPath: candidate, mode: "dedupe" };
     }
   }
@@ -3123,8 +3258,8 @@ async function resolveFixTarget(vault, original, preferred, maxLength) {
 function candidateRelPaths(preferred, maxLength) {
   const candidates = [preferred];
   if (preferred.length > maxLength) return candidates;
-  const dir = posix.dirname(preferred) === "." ? "" : posix.dirname(preferred);
-  const filename = posix.basename(preferred);
+  const dir = posix2.dirname(preferred) === "." ? "" : posix2.dirname(preferred);
+  const filename = posix2.basename(preferred);
   const ext = filename.endsWith(".md") ? ".md" : "";
   const base = ext ? filename.slice(0, -3) : filename;
   const dirPrefix = dir ? `${dir}/` : "";
@@ -3138,7 +3273,7 @@ function candidateRelPaths(preferred, maxLength) {
 }
 async function hasSameContent(a, b) {
   try {
-    const [left, right] = await Promise.all([readFile13(a), readFile13(b)]);
+    const [left, right] = await Promise.all([readFile14(a), readFile14(b)]);
     return left.equals(right);
   } catch {
     return false;
@@ -3151,8 +3286,8 @@ function shouldRewriteReferences(relPath) {
 }
 function replacePathReferences(content, oldRelPath, newRelPath) {
   let updated = content.replaceAll(oldRelPath, newRelPath);
-  const oldStem = posix.basename(oldRelPath).replace(/\.md$/, "");
-  const newStem = posix.basename(newRelPath).replace(/\.md$/, "");
+  const oldStem = posix2.basename(oldRelPath).replace(/\.md$/, "");
+  const newStem = posix2.basename(newRelPath).replace(/\.md$/, "");
   if (oldStem !== newStem) {
     const oldStemEscaped = oldStem.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     const stemWikilinkRe = new RegExp(`\\[\\[${oldStemEscaped}(\\|[^\\]]*)?\\]\\]`, "g");
@@ -3181,7 +3316,8 @@ function buildCliSurface() {
   program.command("graph");
   program.command("canvas");
   program.command("overlap").option("--wiki <name>");
-  program.command("query").option("--limit <n>").option("--wiki <name>");
+  program.command("query").option("--limit <n>").option("--include-pending").option("--wiki <name>");
+  program.command("sources");
   program.command("orphans").option("--wiki <name>");
   program.command("audit");
   program.command("install").option("--target <dir>").option("--dry-run").option("--skills-root <dir>").option("--symlink");
@@ -3193,7 +3329,7 @@ function buildCliSurface() {
   program.command("index-check").option("--wiki <name>");
   program.command("index-link-format").option("--wiki <name>");
   program.command("topic-map-check").option("--threshold <n>").option("--wiki <name>");
-  program.command("stale").option("--archive").option("--days <n>").option("--force-scan").option("--project <slug>").option("--wiki <name>");
+  program.command("stale").option("--archive").option("--apply").option("--approve <token>").option("--days <n>").option("--force-scan").option("--project <slug>").option("--wiki <name>");
   program.command("claim").option("--project <slug>").option("--slug <slug>").option("--wiki <name>");
   program.command("pagesize").option("--lines <n>").option("--wiki <name>");
   program.command("log-rotate").option("--threshold <n>").option("--apply").option("--wiki <name>");
@@ -3208,10 +3344,10 @@ function buildCliSurface() {
   program.command("health").option("--wiki <name>").option("--sync <mode>").option("--no-fail").option("--out <path>").option("--examples <n>");
   program.command("doctor").option("--check-snapshotter");
   program.command("status").option("--wiki <name>");
-  program.command("archive").option("--wiki <name>").option("--cascade").option("--apply").option("--remote <remote>").option("--remote-delete").option("--max-remote-deletes <n>");
+  program.command("archive").option("--wiki <name>").option("--cascade").option("--apply").option("--approve <token>").option("--remote <remote>").option("--remote-delete").option("--max-remote-deletes <n>");
   program.command("remove").option("--wiki <name>").option("--remote <remote>").option("--remote-delete").option("--max-remote-deletes <n>").option("--reason <text>");
   program.command("drift").option("--apply").option("--new <date>").option("--wiki <name>");
-  program.command("dedup").option("--apply").option("--canonical-policy <policy>").option("--manifest-out <path>").option("--manifest-in <path>").option("--remote <remote>").option("--remote-delete").option("--max-remote-deletes <n>").option("--wiki <name>");
+  program.command("dedup").option("--apply").option("--approve <token>").option("--canonical-policy <policy>").option("--manifest-out <path>").option("--manifest-in <path>").option("--remote <remote>").option("--remote-delete").option("--max-remote-deletes <n>").option("--wiki <name>");
   program.command("migrate-citations").option("--dry-run").option("--wiki <name>");
   program.command("frontmatter-fix").option("--dry-run").option("--wiki <name>");
   program.command("update").option("--tag <tag>");
@@ -3236,6 +3372,10 @@ function buildCliSurface() {
   program.command("mcp");
   const graphCmd = program.commands.find((c) => c.name() === "graph");
   graphCmd.command("build").option("--out <path>").option("--wiki <name>");
+  const sourcesCmd = program.commands.find((c) => c.name() === "sources");
+  sourcesCmd.command("pending").option("--since <date>").option("--older-than <days>").option("--match <text>").option("--ingested-by <channel>").option("--scope <scope>").option("--sort <order>").option("--limit <n>").option("--all").option("--include-integrated").option("--include-archived").option("--include-duplicates").option("--include-legacy-archived").option("--wiki <name>");
+  sourcesCmd.command("disposition").requiredOption("--status <status>").requiredOption("--reason <text>").option("--review-after <date>").option("--duplicate-of <raw-path>").option("--write").option("--approve <token>").option("--wiki <name>");
+  sourcesCmd.command("dispose").requiredOption("--reason <text>").option("--write").option("--approve <token>").option("--wiki <name>");
   const canvasCmd = program.commands.find((c) => c.name() === "canvas");
   canvasCmd.command("generate").option("--graph-path <path>").option("--wiki <name>");
   const configCmd = program.commands.find((c) => c.name() === "config");
@@ -3576,17 +3716,6 @@ function readMirrorHintLines(vault) {
     "if results look stale, refresh the read mirror or rerun with SKILLWIKI_DISABLE_VAULT_READ_MIRROR=1 for a live scan; live scans may be slower"
   ];
 }
-function recomputeRawSha256IfPresent(content) {
-  const split = splitFrontmatter(content);
-  if (!split.ok) return content;
-  if (!/^sha256:\s*[0-9a-f]{64}$/m.test(split.data.rawFrontmatter)) return content;
-  const sha256 = createHash5("sha256").update(Buffer.from(split.data.body, "utf8")).digest("hex");
-  const rawFrontmatter = split.data.rawFrontmatter.replace(/^sha256:\s*[0-9a-f]{64}$/m, `sha256: ${sha256}`);
-  return `---
-${rawFrontmatter}
----
-${split.data.body}`;
-}
 function appendLintFixLastOp(vault, fixed) {
   if (fixed.length === 0) return;
   appendLastOp(vault, {
@@ -3625,10 +3754,10 @@ function summarizeLintOutput(output, examplesLimit = 3) {
   };
 }
 async function walkMarkdownFiles(absDir, vaultRoot) {
-  const entries = await readdir4(absDir, { withFileTypes: true });
+  const entries = await readdir3(absDir, { withFileTypes: true });
   const pages = [];
   for (const entry of entries) {
-    const absPath = join18(absDir, entry.name);
+    const absPath = join16(absDir, entry.name);
     if (entry.isDirectory()) {
       if (entry.name === ".git" || entry.name === "node_modules") continue;
       pages.push(...await walkMarkdownFiles(absPath, vaultRoot));
@@ -3639,12 +3768,12 @@ async function walkMarkdownFiles(absDir, vaultRoot) {
   return pages;
 }
 async function collectCliRefsPages(vault) {
-  if (!existsSync6(join18(vault, "SCHEMA.md"))) {
+  if (!existsSync6(join16(vault, "SCHEMA.md"))) {
     return err("VAULT_PATH_INVALID", { root: vault, reason: "SCHEMA.md missing" });
   }
   const pages = [];
   for (const dir of CLI_REFS_TYPED_DIRS) {
-    const absDir = join18(vault, dir);
+    const absDir = join16(vault, dir);
     if (!existsSync6(absDir)) continue;
     pages.push(...await walkMarkdownFiles(absDir, vault));
   }
@@ -3764,9 +3893,13 @@ async function applyFileSourceUrlFix(input, scan, fileSourceUrlFlags, fileSource
   if (!input.fix || fileSourceUrlFrontmatterFlags.size === 0) return fileSourceUrlFlags;
   const fileFixed = [];
   for (const relPath of fileSourceUrlFrontmatterFlags) {
+    if (relPath.startsWith("raw/")) {
+      unresolved.push(relPath);
+      continue;
+    }
     try {
       const absPath = `${input.vault}/${relPath}`;
-      const raw = await readFile14(absPath, "utf8");
+      const raw = await readFile15(absPath, "utf8");
       const parts = raw.split("---", 3);
       if (parts.length < 3) {
         unresolved.push(relPath);
@@ -4159,8 +4292,8 @@ async function runLint(input) {
     const readKnowledgeContent = (slug) => {
       const existing = knowledgeContentCache.get(slug);
       if (existing) return existing;
-      const knowledgePath = join18(lintVault, "projects", slug, "knowledge.md");
-      const pending = existsSync6(knowledgePath) ? readFile14(knowledgePath, "utf8").catch(() => null) : Promise.resolve(null);
+      const knowledgePath = join16(lintVault, "projects", slug, "knowledge.md");
+      const pending = existsSync6(knowledgePath) ? readFile15(knowledgePath, "utf8").catch(() => null) : Promise.resolve(null);
       knowledgeContentCache.set(slug, pending);
       return pending;
     };
@@ -4237,8 +4370,11 @@ async function runLint(input) {
           const raw = await readPage(page);
           const redacted = redactSensitiveContent(raw, { file: page.relPath });
           if (!redacted.changed) continue;
-          const next = recomputeRawSha256IfPresent(redacted.text);
-          const w = await safeWritePage(page.absPath, next, { minBodyRatio: null });
+          if (page.relPath.startsWith("raw/")) {
+            unresolved.push(page.relPath);
+            continue;
+          }
+          const w = await safeWritePage(page.absPath, redacted.text, { minBodyRatio: null });
           if (!w.ok) {
             unresolved.push(page.relPath);
             continue;
@@ -4266,7 +4402,7 @@ async function runLint(input) {
       for (const relPath of legacyPages) {
         try {
           const absPath = `${input.vault}/${relPath}`;
-          const raw = await readFile14(absPath, "utf8");
+          const raw = await readFile15(absPath, "utf8");
           const split = splitFrontmatter(raw);
           if (!split.ok) {
             unresolved.push(relPath);
@@ -4365,7 +4501,7 @@ ${newBody}`;
       for (const relPath of noOverview) {
         try {
           const absPath = `${input.vault}/${relPath}`;
-          const raw = await readFile14(absPath, "utf8");
+          const raw = await readFile15(absPath, "utf8");
           const split = splitFrontmatter(raw);
           if (!split.ok) {
             unresolved.push(relPath);
@@ -4406,7 +4542,7 @@ ${trimmedBody}`;
       for (const relPath of missingTldrFlags) {
         try {
           const absPath = `${input.vault}/${relPath}`;
-          const raw = await readFile14(absPath, "utf8");
+          const raw = await readFile15(absPath, "utf8");
           const split = splitFrontmatter(raw);
           if (!split.ok) {
             unresolved.push(relPath);
@@ -4456,7 +4592,7 @@ ${lines.join("\n")}`;
       for (const relPath of wikilinkCitationFlags) {
         try {
           const absPath = `${input.vault}/${relPath}`;
-          const raw = await readFile14(absPath, "utf8");
+          const raw = await readFile15(absPath, "utf8");
           const split = splitFrontmatter(raw);
           if (!split.ok) {
             unresolved.push(relPath);
@@ -4561,6 +4697,11 @@ ${newBody}`;
       const invalidItems = buckets.frontmatter_yaml_invalid;
       const remaining = [];
       for (const item of invalidItems) {
+        if (item.path.startsWith("raw/")) {
+          unresolved.push(item.path);
+          remaining.push(item);
+          continue;
+        }
         const page = scan.allMarkdown.find((p) => p.relPath === item.path);
         if (!page) {
           unresolved.push(item.path);
@@ -4797,14 +4938,14 @@ async function runSyncLintDelta(input) {
 }
 
 // src/commands/config.ts
-import { readFile as readFile15 } from "fs/promises";
+import { readFile as readFile16 } from "fs/promises";
 import { existsSync as existsSync7 } from "fs";
-import { join as join19 } from "path";
+import { join as join17 } from "path";
 function validateKey(key) {
   return CONFIG_KEYS.includes(key) || isValidWikiProfileKey(key) || isVaultSyncKey(key);
 }
 function configPath(home) {
-  return join19(home, ".skillwiki", ".env");
+  return join17(home, ".skillwiki", ".env");
 }
 async function runConfigGet(input) {
   if (!validateKey(input.key)) {
@@ -4828,7 +4969,7 @@ async function runConfigSet(input) {
   try {
     let originalContent;
     try {
-      originalContent = await readFile15(filePath, "utf8");
+      originalContent = await readFile16(filePath, "utf8");
     } catch {
     }
     const existing = originalContent !== void 0 ? parseDotenvText(originalContent) : {};
@@ -4865,19 +5006,19 @@ async function runConfigPath(input) {
 
 // src/commands/doctor.ts
 import { existsSync as existsSync13, lstatSync, readlinkSync, readdirSync as readdirSync3, statSync as statSync2, readFileSync as readFileSync10 } from "fs";
-import { join as join25, resolve as resolve5 } from "path";
+import { join as join23, resolve as resolve5 } from "path";
 import { execSync as execSync2 } from "child_process";
 import { platform as platform2 } from "os";
 
 // src/utils/plugin-registry.ts
 import { existsSync as existsSync8, readdirSync, readFileSync as readFileSync5 } from "fs";
-import { join as join20 } from "path";
-var REGISTRY_PATH = join20(".claude", "plugins", "installed_plugins.json");
-var CODEX_CONFIG_PATH = join20(".codex", "config.toml");
+import { join as join18 } from "path";
+var REGISTRY_PATH = join18(".claude", "plugins", "installed_plugins.json");
+var CODEX_CONFIG_PATH = join18(".codex", "config.toml");
 var PLUGIN_KEY = "skillwiki@llm-wiki";
 function readInstalledPlugins(home) {
   try {
-    const raw = readFileSync5(join20(home, REGISTRY_PATH), "utf8");
+    const raw = readFileSync5(join18(home, REGISTRY_PATH), "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -4913,7 +5054,7 @@ function findPluginInstallations(home, key = PLUGIN_KEY) {
 function findCodexPlugin(home, key, pluginName, marketplace) {
   const config = readCodexPluginConfig(home, key, marketplace);
   if (!config?.enabled) return null;
-  const cacheRoot = join20(home, ".codex", "plugins", "cache", marketplace, pluginName);
+  const cacheRoot = join18(home, ".codex", "plugins", "cache", marketplace, pluginName);
   if (!existsSync8(cacheRoot)) return null;
   let versions;
   try {
@@ -4929,7 +5070,7 @@ function findCodexPlugin(home, key, pluginName, marketplace) {
     key,
     pluginName,
     marketplace,
-    installPath: join20(cacheRoot, version),
+    installPath: join18(cacheRoot, version),
     version,
     sourceType: config.sourceType,
     source: config.source
@@ -4946,7 +5087,7 @@ function parsePluginKey(key) {
 function readCodexPluginConfig(home, key, marketplace) {
   let raw;
   try {
-    raw = readFileSync5(join20(home, CODEX_CONFIG_PATH), "utf8");
+    raw = readFileSync5(join18(home, CODEX_CONFIG_PATH), "utf8");
   } catch {
     return null;
   }
@@ -4989,7 +5130,7 @@ function parseTomlScalar(rawValue) {
 
 // src/utils/conflict-markers.ts
 import { existsSync as existsSync9, readdirSync as readdirSync2, readFileSync as readFileSync6 } from "fs";
-import { join as join21 } from "path";
+import { join as join19 } from "path";
 function scanConflictMarkerBlocksInText(relPath, text) {
   const findings = [];
   const lines = text.split(/\r?\n/);
@@ -5040,7 +5181,7 @@ function walkMarkdownFiles2(root, dir, rel, out) {
   for (const entry of entries) {
     if (entry.isDirectory()) {
       if (PRUNE_DIRS.has(entry.name)) continue;
-      walkMarkdownFiles2(root, join21(dir, entry.name), rel ? `${rel}/${entry.name}` : entry.name, out);
+      walkMarkdownFiles2(root, join19(dir, entry.name), rel ? `${rel}/${entry.name}` : entry.name, out);
     } else if (entry.isFile() && entry.name.endsWith(".md")) {
       out.push(rel ? `${rel}/${entry.name}` : entry.name);
     }
@@ -5054,7 +5195,7 @@ function scanVaultConflictMarkers(vaultRoot) {
   for (const rel of relPaths) {
     let text;
     try {
-      text = readFileSync6(join21(vaultRoot, rel), "utf8");
+      text = readFileSync6(join19(vaultRoot, rel), "utf8");
     } catch {
       continue;
     }
@@ -5065,7 +5206,7 @@ function scanVaultConflictMarkers(vaultRoot) {
 
 // src/utils/remote-health.ts
 import { existsSync as existsSync10, readFileSync as readFileSync7 } from "fs";
-import { join as join22 } from "path";
+import { join as join20 } from "path";
 import { execFileSync } from "child_process";
 var REMOTE_PROBE_TIMEOUT_MS = 3e3;
 var defaultExec = (file, args, cwd) => execFileSync(file, args, {
@@ -5076,7 +5217,7 @@ var defaultExec = (file, args, cwd) => execFileSync(file, args, {
 }).trim();
 function readWikiS3RemoteConfigured(home) {
   try {
-    const content = readFileSync7(join22(home, ".skillwiki", ".env"), "utf8");
+    const content = readFileSync7(join20(home, ".skillwiki", ".env"), "utf8");
     for (const line of content.split(/\r?\n/)) {
       const trimmed = line.trim();
       if (!trimmed || trimmed.startsWith("#")) continue;
@@ -5101,7 +5242,7 @@ function resolveWikiS3Remote(input) {
   return readWikiS3RemoteConfigured(input.home);
 }
 function probeGithubReachability(vaultPath, exec = defaultExec) {
-  if (!existsSync10(join22(vaultPath, ".git"))) return "unknown";
+  if (!existsSync10(join20(vaultPath, ".git"))) return "unknown";
   try {
     exec("git", ["remote", "get-url", "origin"], vaultPath);
   } catch {
@@ -5167,10 +5308,10 @@ function probeRemoteHealth(input) {
 
 // src/utils/satellite-run-health.ts
 import { existsSync as existsSync11, readFileSync as readFileSync8 } from "fs";
-import { join as join23 } from "path";
+import { join as join21 } from "path";
 var SATELLITE_STALE_MS = 26 * 60 * 60 * 1e3;
 function satelliteLatestRunPath(vault) {
-  return join23(vault, ".skillwiki", "agent-memory-trends", "latest-run.json");
+  return join21(vault, ".skillwiki", "agent-memory-trends", "latest-run.json");
 }
 function isFailedRunStatus(status) {
   return status === "fail" || status === "failure";
@@ -5223,8 +5364,8 @@ function evaluateSatelliteRunHealth(vault, now) {
 // src/utils/s3-mount-health.ts
 import { execSync } from "child_process";
 import { platform } from "os";
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync5, unlinkSync as unlinkSync5, readFileSync as readFile16 } from "fs";
-import { join as join24 } from "path";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync5, unlinkSync as unlinkSync4, readFileSync as readFile17 } from "fs";
+import { join as join22 } from "path";
 var OS = platform();
 function findRcloneMountPid() {
   try {
@@ -5382,7 +5523,7 @@ function detectFuseMount(vaultPath) {
   return null;
 }
 function writeTest(dir) {
-  const testFile = join24(dir, `.doctor-write-test-${process.pid}.tmp`);
+  const testFile = join22(dir, `.doctor-write-test-${process.pid}.tmp`);
   const payload = `skillwiki doctor write test \u2014 ${Date.now()} \u2014 ${Math.random().toString(36).slice(2)}`;
   const start = Date.now();
   try {
@@ -5393,24 +5534,24 @@ function writeTest(dir) {
   const writeMs = Date.now() - start;
   const readStart = Date.now();
   try {
-    const back = readFile16(testFile, "utf8");
+    const back = readFile17(testFile, "utf8");
     const readMs = Date.now() - readStart;
     if (back !== payload) {
       try {
-        unlinkSync5(testFile);
+        unlinkSync4(testFile);
       } catch {
       }
       return { success: false, writeMs, readMs, size: Buffer.byteLength(payload, "utf8"), error: "content mismatch \u2014 wrote and read-back differ" };
     }
   } catch (e) {
     try {
-      unlinkSync5(testFile);
+      unlinkSync4(testFile);
     } catch {
     }
     return { success: false, writeMs, readMs: Date.now() - readStart, size: 0, error: `read failed: ${e.message}` };
   }
   try {
-    unlinkSync5(testFile);
+    unlinkSync4(testFile);
   } catch {
   }
   return { success: true, writeMs, readMs: Date.now() - readStart, size: Buffer.byteLength(payload, "utf8") };
@@ -5482,12 +5623,12 @@ function detectCliChannels(argv, home) {
   }
   const plugin = findPlugin(home);
   if (plugin) {
-    const pluginBin = join25(plugin.installPath, "bin", "skillwiki");
+    const pluginBin = join23(plugin.installPath, "bin", "skillwiki");
     if (existsSync13(pluginBin)) {
       channels.push({ name: "plugin", path: pluginBin, isDevLink: false });
     }
   }
-  const installBin = join25(home, ".claude", "skills", "bin", "skillwiki");
+  const installBin = join23(home, ".claude", "skills", "bin", "skillwiki");
   if (existsSync13(installBin)) {
     channels.push({ name: "install", path: installBin, isDevLink: false });
   }
@@ -5577,9 +5718,9 @@ function checkVaultStructure(resolvedPath) {
     return check("error", "vault_structure", "Vault structure valid", "Cannot check \u2014 vault directory does not exist");
   }
   const missing = [];
-  if (!existsSync13(join25(resolvedPath, "SCHEMA.md"))) missing.push("SCHEMA.md");
+  if (!existsSync13(join23(resolvedPath, "SCHEMA.md"))) missing.push("SCHEMA.md");
   for (const dir of ["raw", "entities", "concepts", "meta"]) {
-    if (!existsSync13(join25(resolvedPath, dir))) missing.push(dir + "/");
+    if (!existsSync13(join23(resolvedPath, dir))) missing.push(dir + "/");
   }
   if (missing.length === 0) {
     return check("pass", "vault_structure", "Vault structure valid", "All required files and directories present");
@@ -5587,7 +5728,7 @@ function checkVaultStructure(resolvedPath) {
   return check("warn", "vault_structure", "Vault structure valid", `Missing: ${missing.join(", ")} \u2014 run \`skillwiki init\` to add CodeWiki structure`);
 }
 function checkSkillsInstalled(home, cwd) {
-  const srcDir = cwd ? join25(cwd, "packages", "skills") : void 0;
+  const srcDir = cwd ? join23(cwd, "packages", "skills") : void 0;
   if (srcDir && existsSync13(srcDir)) {
     const found = findInstalledSkillMd(srcDir);
     if (found.length > 0) {
@@ -5601,7 +5742,7 @@ function checkSkillsInstalled(home, cwd) {
       return check("pass", "skills_installed", "Skills installed", `${found.length} SKILL.md file(s) found (plugin v${plugin.version})`);
     }
   }
-  const skillsDir = join25(home, ".claude", "skills");
+  const skillsDir = join23(home, ".claude", "skills");
   if (existsSync13(skillsDir)) {
     const found = findInstalledSkillMd(skillsDir);
     if (found.length > 0) {
@@ -5612,10 +5753,10 @@ function checkSkillsInstalled(home, cwd) {
 }
 function checkDuplicateSkills(home) {
   const plugin = findPlugin(home);
-  const skillsDir = join25(home, ".claude", "skills");
+  const skillsDir = join23(home, ".claude", "skills");
   const agentSkillDirs = [
-    { label: "~/.codex/skills/", path: join25(home, ".codex", "skills") },
-    { label: "~/.agents/skills/", path: join25(home, ".agents", "skills") }
+    { label: "~/.codex/skills/", path: join23(home, ".codex", "skills") },
+    { label: "~/.agents/skills/", path: join23(home, ".agents", "skills") }
   ];
   if (!plugin) {
     return check("pass", "skills_duplicate", "Skills not duplicated", "Single install channel");
@@ -5718,7 +5859,7 @@ async function checkProfiles(home) {
 }
 async function checkProjectLocalOverride(cwd) {
   const dir = cwd ?? process.cwd();
-  const envPath = join25(dir, ".skillwiki", ".env");
+  const envPath = join23(dir, ".skillwiki", ".env");
   if (existsSync13(envPath)) {
     return check("pass", "project_local", "Project-local config", `Found: ${envPath}`);
   }
@@ -5728,7 +5869,7 @@ function checkVaultGitRemote(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("error", "vault_git_remote", "Vault git remote", "Cannot check \u2014 WIKI_PATH not resolved");
   }
-  if (!existsSync13(join25(resolvedPath, ".git"))) {
+  if (!existsSync13(join23(resolvedPath, ".git"))) {
     return check("warn", "vault_git_remote", "Vault git remote", "Vault is not a git repository \u2014 sync features unavailable");
   }
   try {
@@ -5751,9 +5892,9 @@ function checkObsidianTemplates(resolvedPath) {
     return check("error", "obsidian_templates", "Obsidian templates", "Cannot check \u2014 WIKI_PATH not resolved");
   }
   const missing = [];
-  if (!existsSync13(join25(resolvedPath, "_Templates"))) missing.push("_Templates/");
-  if (!existsSync13(join25(resolvedPath, ".obsidian", "templates.json"))) missing.push(".obsidian/templates.json");
-  if (!existsSync13(join25(resolvedPath, ".obsidian", "app.json"))) missing.push(".obsidian/app.json");
+  if (!existsSync13(join23(resolvedPath, "_Templates"))) missing.push("_Templates/");
+  if (!existsSync13(join23(resolvedPath, ".obsidian", "templates.json"))) missing.push(".obsidian/templates.json");
+  if (!existsSync13(join23(resolvedPath, ".obsidian", "app.json"))) missing.push(".obsidian/app.json");
   if (missing.length === 0) {
     return check("pass", "obsidian_templates", "Obsidian templates", "Template folder and config present");
   }
@@ -5763,7 +5904,7 @@ function checkDotStoreClean(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("error", "dsstore_clean", "No .DS_Store in raw/", "Cannot check \u2014 WIKI_PATH not resolved");
   }
-  const rawDir = join25(resolvedPath, "raw");
+  const rawDir = join23(resolvedPath, "raw");
   if (!existsSync13(rawDir)) {
     return check("pass", "dsstore_clean", "No .DS_Store in raw/", "raw/ directory not found \u2014 check skipped");
   }
@@ -5779,7 +5920,7 @@ function checkDotStoreClean(resolvedPath) {
       if (entry.name === ".DS_Store") {
         found.push(rel ? `${rel}/.DS_Store` : ".DS_Store");
       } else if (entry.isDirectory()) {
-        walk(join25(dir, entry.name), rel ? `${rel}/${entry.name}` : entry.name);
+        walk(join23(dir, entry.name), rel ? `${rel}/${entry.name}` : entry.name);
       }
     }
   })(rawDir, "");
@@ -5810,7 +5951,7 @@ function checkSyncLastPush(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("error", "sync_last_push", "Vault sync recency", "Cannot check \u2014 WIKI_PATH not resolved");
   }
-  if (!existsSync13(join25(resolvedPath, ".git"))) {
+  if (!existsSync13(join23(resolvedPath, ".git"))) {
     return check("pass", "sync_last_push", "Vault sync recency", "No git repo \u2014 sync check skipped");
   }
   let timestamp;
@@ -5859,7 +6000,7 @@ function checkVaultGitDirty(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("pass", "vault_git_dirty", "Vault git dirty state", "No vault path \u2014 check skipped");
   }
-  if (!existsSync13(join25(resolvedPath, ".git"))) {
+  if (!existsSync13(join23(resolvedPath, ".git"))) {
     return check("pass", "vault_git_dirty", "Vault git dirty state", "No git repo \u2014 check skipped");
   }
   try {
@@ -5928,7 +6069,7 @@ function remoteMainHash(resolvedPath) {
 }
 function checkStaleRemoteMain(resolvedPath) {
   if (resolvedPath === void 0) return void 0;
-  if (!existsSync13(join25(resolvedPath, ".git"))) return void 0;
+  if (!existsSync13(join23(resolvedPath, ".git"))) return void 0;
   const localOrigin = gitRefHash(resolvedPath, "origin/main");
   if (!localOrigin) return void 0;
   const remoteMain = remoteMainHash(resolvedPath);
@@ -5944,7 +6085,7 @@ function checkVaultLocalGit(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("warn", "vault_local_git", "Vault local git", "Cannot check \u2014 WIKI_PATH not resolved");
   }
-  if (!existsSync13(join25(resolvedPath, ".git"))) {
+  if (!existsSync13(join23(resolvedPath, ".git"))) {
     return check("warn", "vault_local_git", "Vault local git", "Not a git repository - sync features unavailable");
   }
   try {
@@ -5963,7 +6104,7 @@ function checkVaultGithubRemote(resolvedPath, exec) {
   if (resolvedPath === void 0) {
     return check("pass", "vault_github_remote", "Vault GitHub remote", "No vault path \u2014 check skipped");
   }
-  if (!existsSync13(join25(resolvedPath, ".git"))) {
+  if (!existsSync13(join23(resolvedPath, ".git"))) {
     return check("pass", "vault_github_remote", "Vault GitHub remote", "No git repo \u2014 check skipped");
   }
   const state = probeGithubReachability(resolvedPath, exec);
@@ -6007,7 +6148,7 @@ function checkVaultPromotionLag(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("pass", "vault_promotion_lag", "Vault promotion lag", "No vault path \u2014 check skipped");
   }
-  if (!existsSync13(join25(resolvedPath, ".git"))) {
+  if (!existsSync13(join23(resolvedPath, ".git"))) {
     return check("pass", "vault_promotion_lag", "Vault promotion lag", "No git repo \u2014 check skipped");
   }
   try {
@@ -6034,7 +6175,7 @@ function checkVaultGitComparison(resolvedPath, id, label, range, nonZeroSuffix,
   if (resolvedPath === void 0) {
     return check("pass", id, label, "No vault path \u2014 check skipped");
   }
-  if (!existsSync13(join25(resolvedPath, ".git"))) {
+  if (!existsSync13(join23(resolvedPath, ".git"))) {
     return check("pass", id, label, "No git repo \u2014 check skipped");
   }
   if (!hasOriginMain(resolvedPath)) {
@@ -6151,11 +6292,11 @@ async function checkFleetIdentity(input) {
 }
 function pullLogPaths(home) {
   const paths = platform2() === "darwin" ? [
-    join25(home, "Library", "Logs", "wiki-pull.log"),
-    join25(home, ".local", "state", "vault-sync", "log", "wiki-pull.log")
+    join23(home, "Library", "Logs", "wiki-pull.log"),
+    join23(home, ".local", "state", "vault-sync", "log", "wiki-pull.log")
   ] : [
-    join25(home, ".local", "state", "vault-sync", "log", "wiki-pull.log"),
-    join25(home, "Library", "Logs", "wiki-pull.log")
+    join23(home, ".local", "state", "vault-sync", "log", "wiki-pull.log"),
+    join23(home, "Library", "Logs", "wiki-pull.log")
   ];
   return [...new Set(paths)];
 }
@@ -6195,7 +6336,7 @@ function checkS3MountPerf(resolvedPath) {
     return check("pass", "s3_mount_perf", "S3 mount performance", "local disk");
   }
   const mountPoint = fuse.mountPoint;
-  const conceptsDir = join25(resolvedPath, "concepts");
+  const conceptsDir = join23(resolvedPath, "concepts");
   if (!existsSync13(conceptsDir)) {
     return check("pass", "s3_mount_perf", "S3 mount performance", `S3 FUSE mount (${mountPoint}), no concepts/ to benchmark`);
   }
@@ -6378,7 +6519,7 @@ function checkWriteTest(resolvedPath) {
   if (!fuse) {
     return check("pass", "s3_write_test", "S3 write test", "local disk \u2014 check skipped");
   }
-  const conceptsDir = join25(resolvedPath, "concepts");
+  const conceptsDir = join23(resolvedPath, "concepts");
   if (!existsSync13(conceptsDir)) {
     return check("pass", "s3_write_test", "S3 write test", "no concepts/ dir to test \u2014 check skipped");
   }
@@ -6480,7 +6621,7 @@ function checkVaultSyncPullHelper(home, env) {
   );
 }
 function checkVaultSyncReviewRequiredJournals(vaultPath) {
-  if (!vaultPath || !existsSync13(join25(vaultPath, ".git"))) {
+  if (!vaultPath || !existsSync13(join23(vaultPath, ".git"))) {
     return check("pass", "vault_sync_review_required_journals", "Review-required journals", "No git vault \u2014 check skipped");
   }
   try {
@@ -6501,7 +6642,7 @@ function checkVaultSyncReviewRequiredJournals(vaultPath) {
 }
 function readVaultSyncConfig(home) {
   try {
-    const content = readFileSync10(join25(home, ".skillwiki", ".env"), "utf8");
+    const content = readFileSync10(join23(home, ".skillwiki", ".env"), "utf8");
     let installed = false;
     let role;
     let serviceScope;
@@ -6630,7 +6771,7 @@ function snapshotterHealthChecks(scope, logDir, env) {
   let completionOutcome = "unknown";
   const logRecords = fixture ? fixture.log_records : (() => {
     try {
-      const content = readFileSync10(join25(logDir, "wiki-snapshot.log"), "utf8");
+      const content = readFileSync10(join23(logDir, "wiki-snapshot.log"), "utf8");
       return content.split(/\r?\n/).filter(Boolean);
     } catch {
       return [];
@@ -6700,10 +6841,10 @@ function vaultSyncChecks(input) {
     ];
   }
   const isMac = os === "darwin";
-  const logDir = input.logDir ?? (isMac ? join25(home, "Library", "Logs") : join25(home, ".local", "state", "vault-sync", "log"));
-  const shareDir = input.shareDir ?? (isMac ? join25(home, "Library", "Application Support", "vault-sync", "bin") : join25(home, ".local", "share", "vault-sync", "bin"));
-  const filterPath = input.filterPath ?? join25(home, ".config", "rclone", "wiki-push-filters.txt");
-  const packagedSnapshotPath = join25(shareDir, "wiki-snapshot.sh");
+  const logDir = input.logDir ?? (isMac ? join23(home, "Library", "Logs") : join23(home, ".local", "state", "vault-sync", "log"));
+  const shareDir = input.shareDir ?? (isMac ? join23(home, "Library", "Application Support", "vault-sync", "bin") : join23(home, ".local", "share", "vault-sync", "bin"));
+  const filterPath = input.filterPath ?? join23(home, ".config", "rclone", "wiki-push-filters.txt");
+  const packagedSnapshotPath = join23(shareDir, "wiki-snapshot.sh");
   const legacySnapshotPath = "/root/.hermes/scripts/wiki-snapshot-v3.sh";
   const snapshotPath = input.snapshotScriptPath ?? (existsSync13(packagedSnapshotPath) ? packagedSnapshotPath : legacySnapshotPath);
   if (input.vaultSyncRole === "snapshotter") {
@@ -6759,7 +6900,7 @@ function vaultSyncChecks(input) {
     }
     return [c12, ...healthChecks, cFetch2, c42, c52];
   }
-  const pushScriptPath = join25(shareDir, "wiki-push.sh");
+  const pushScriptPath = join23(shareDir, "wiki-push.sh");
   const c1 = existsSync13(pushScriptPath) ? check("pass", "vault_sync_installed", "Vault sync installed", `Found: ${pushScriptPath}`) : check("error", "vault_sync_installed", "Vault sync installed", `Script not found at ${pushScriptPath} \u2014 run vault-sync-install`);
   let c2;
   try {
@@ -6811,7 +6952,7 @@ function vaultSyncChecks(input) {
       "Scheduler check failed \u2014 run vault-sync-install"
     );
   }
-  const logFile = join25(logDir, "wiki-push.log");
+  const logFile = join23(logDir, "wiki-push.log");
   let c3;
   try {
     const logContent = readFileSync10(logFile, "utf8");
@@ -6882,7 +7023,7 @@ function vaultSyncChecks(input) {
       `Log directory not found at ${logDir}`
     );
   }
-  const fetchLogFile = join25(logDir, "wiki-fetch.log");
+  const fetchLogFile = join23(logDir, "wiki-fetch.log");
   let cFetch;
   try {
     const logContent = readFileSync10(fetchLogFile, "utf8");
@@ -7026,15 +7167,15 @@ function findSkillMd(dir) {
   }
   for (const entry of entries) {
     if (entry.isFile() && entry.name === "SKILL.md") {
-      results.push(join25(dir, entry.name));
+      results.push(join23(dir, entry.name));
     } else if (entry.isDirectory()) {
-      results.push(...findSkillMd(join25(dir, entry.name)));
+      results.push(...findSkillMd(join23(dir, entry.name)));
     }
   }
   return results;
 }
 function findInstalledSkillMd(dir) {
-  const directSkills = findSkillNames(dir).map((name) => join25(dir, name, "SKILL.md"));
+  const directSkills = findSkillNames(dir).map((name) => join23(dir, name, "SKILL.md"));
   return directSkills.length > 0 ? directSkills : findSkillMd(dir);
 }
 function findSkillNames(dir) {
@@ -7046,7 +7187,7 @@ function findSkillNames(dir) {
     return results;
   }
   for (const entry of entries) {
-    if (entry.isDirectory() && existsSync13(join25(dir, entry.name, "SKILL.md"))) {
+    if (entry.isDirectory() && existsSync13(join23(dir, entry.name, "SKILL.md"))) {
       results.push(entry.name);
     }
   }
@@ -7094,7 +7235,7 @@ async function vaultMetrics(resolvedPath) {
   }
   let logLines = 0;
   try {
-    logLines = readFileSync10(join25(scanRoot, "log.md"), "utf8").split("\n").length;
+    logLines = readFileSync10(join23(scanRoot, "log.md"), "utf8").split("\n").length;
   } catch {
   }
   return [
@@ -7229,7 +7370,7 @@ function readCliPackageJson(baseUrl = import.meta.url) {
 // src/utils/vault-write-gates.ts
 import { execFileSync as execFileSync2 } from "child_process";
 import { existsSync as existsSync14, readdirSync as readdirSync4, readFileSync as readFileSync12, statSync as statSync3 } from "fs";
-import { join as join26, relative as relative3 } from "path";
+import { join as join24, relative as relative3 } from "path";
 var DEFAULT_DIRTY_VOLUME_THRESHOLD = 50;
 var DEFAULT_CAPTURE_BUDGET = 20;
 var DEFAULT_NO_DECISION_STREAK = 3;
@@ -7328,7 +7469,7 @@ function measureDirtyVolume(vault) {
     if (!rel) continue;
     if (code === "??") {
       untracked += 1;
-      const abs = join26(vault, rel);
+      const abs = join24(vault, rel);
       if (existsSync14(abs) && statSync3(abs).isDirectory()) {
         const files = listFilesRecursive(abs);
         expanded += files.length;
@@ -7365,7 +7506,7 @@ function listFilesRecursive(dir) {
   }
   for (const name of entries) {
     if (name === ".git") continue;
-    const p = join26(dir, name);
+    const p = join24(dir, name);
     try {
       const st = statSync3(p);
       if (st.isDirectory()) out.push(...listFilesRecursive(p));
@@ -7496,7 +7637,7 @@ function listProjectDayCaptures(vault, project, day) {
       return;
     }
     for (const name of entries) {
-      const abs = join26(dir, name);
+      const abs = join24(dir, name);
       const rel = relBase ? `${relBase}/${name}` : name;
       try {
         const st = statSync3(abs);
@@ -7506,16 +7647,16 @@ function listProjectDayCaptures(vault, project, day) {
       }
     }
   };
-  walk(join26(vault, "raw", "transcripts"), "raw/transcripts");
-  walk(join26(vault, "projects", slug, "raw", "transcripts"), `projects/${slug}/raw/transcripts`);
-  walk(join26(vault, "projects", slug, "requirements"), `projects/${slug}/requirements`);
-  const workRoot = join26(vault, "projects", slug, "work");
+  walk(join24(vault, "raw", "transcripts"), "raw/transcripts");
+  walk(join24(vault, "projects", slug, "raw", "transcripts"), `projects/${slug}/raw/transcripts`);
+  walk(join24(vault, "projects", slug, "requirements"), `projects/${slug}/requirements`);
+  const workRoot = join24(vault, "projects", slug, "work");
   if (existsSync14(workRoot)) {
     try {
       for (const name of readdirSync4(workRoot)) {
         if (!name.startsWith(day)) continue;
         if (!/investigate|pilot-q|research|cycle|dev-loop/.test(name)) continue;
-        const abs = join26(workRoot, name);
+        const abs = join24(workRoot, name);
         if (statSync3(abs).isDirectory()) {
           for (const f of listFilesRecursive(abs)) {
             const rel = relative3(vault, f).replace(/\\/g, "/");
@@ -7621,8 +7762,8 @@ function runWritePreflight(input) {
 // src/commands/observe.ts
 import { mkdir as mkdir6, writeFile as writeFile4 } from "fs/promises";
 import { existsSync as existsSync15, statSync as statSync4 } from "fs";
-import { join as join27 } from "path";
-import { createHash as createHash6 } from "crypto";
+import { join as join25 } from "path";
+import { createHash as createHash7 } from "crypto";
 var ALLOWED_KINDS = /* @__PURE__ */ new Set(["note", "bug", "task", "idea", "session-log"]);
 function slugify(text) {
   const words = text.trim().split(/\s+/).slice(0, 6).join("-").toLowerCase().replace(/[^a-z0-9-]/g, "").replace(/-+/g, "-").replace(/^-|-$/g, "");
@@ -7670,7 +7811,7 @@ async function runObserve(input) {
       };
     }
   }
-  const transcriptsDir = join27(input.vault, "raw", "transcripts");
+  const transcriptsDir = join25(input.vault, "raw", "transcripts");
   try {
     await mkdir6(transcriptsDir, { recursive: true });
   } catch {
@@ -7682,16 +7823,16 @@ async function runObserve(input) {
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const slug = slugify(input.text);
   const fileName = `${today}-observation-${slug}.md`;
-  const filePath = join27(transcriptsDir, fileName);
+  const filePath = join25(transcriptsDir, fileName);
   const body = `
 ${input.text.trim()}
 `;
-  const sha256 = createHash6("sha256").update(Buffer.from(body, "utf8")).digest("hex");
+  const sha2562 = createHash7("sha256").update(Buffer.from(body, "utf8")).digest("hex");
   const frontmatterLines = [
     "---",
     "source_url:",
     `ingested: ${today}`,
-    `sha256: ${sha256}`,
+    `sha256: ${sha2562}`,
     `kind: ${kind}`
   ];
   if (input.project) {
@@ -7714,17 +7855,17 @@ ${input.text.trim()}
     timestamp: (/* @__PURE__ */ new Date()).toISOString()
   });
   const relPath = `raw/transcripts/${fileName}`;
-  const humanHint = `created ${relPath} (${sha256.slice(0, 12)}...)`;
+  const humanHint = `created ${relPath} (${sha2562.slice(0, 12)}...)`;
   return {
     exitCode: ExitCode.OK,
-    result: ok({ path: relPath, sha256, humanHint })
+    result: ok({ path: relPath, sha256: sha2562, humanHint })
   };
 }
 
 // src/commands/memory.ts
-import { createHash as createHash7 } from "crypto";
-import { mkdir as mkdir7, readFile as readFile17, readdir as readdir5, stat as stat5, writeFile as writeFile5 } from "fs/promises";
-import { basename as basename2, extname, join as join28, relative as relative4, sep as sep3 } from "path";
+import { createHash as createHash8 } from "crypto";
+import { mkdir as mkdir7, readFile as readFile18, readdir as readdir4, stat as stat4, writeFile as writeFile5 } from "fs/promises";
+import { basename as basename2, extname, join as join26, relative as relative4, sep as sep3 } from "path";
 
 // src/utils/memory-authority.ts
 var TIER_RANK = {
@@ -7843,8 +7984,8 @@ async function runMemoryIndex(input) {
   }
   const generatedAt = (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "Z");
   const relCachePath = memoryCacheRelPath(input.project);
-  const absCachePath = join28(input.vault, relCachePath);
-  await mkdir7(join28(input.vault, ".skillwiki", "memory", input.project), { recursive: true });
+  const absCachePath = join26(input.vault, relCachePath);
+  await mkdir7(join26(input.vault, ".skillwiki", "memory", input.project), { recursive: true });
   await writeFile5(absCachePath, `${JSON.stringify({
     generated_at: generatedAt,
     project: input.project,
@@ -8036,7 +8177,7 @@ async function buildMemoryIndexState(pages, project) {
 }
 async function checkMemoryIndex(vault, project, current) {
   const relCachePath = memoryCacheRelPath(project);
-  const cacheText = await readIfExists2(join28(vault, relCachePath));
+  const cacheText = await readIfExists2(join26(vault, relCachePath));
   if (!cacheText) {
     return {
       ok: true,
@@ -8153,7 +8294,7 @@ async function readMemoryPage(page, project, warnings) {
       title,
       summary: summarize(body),
       updated,
-      hash: createHash7("sha256").update(Buffer.from(body, "utf8")).digest("hex"),
+      hash: createHash8("sha256").update(Buffer.from(body, "utf8")).digest("hex"),
       topics,
       project,
       ...stringField(fm.data.memory_kind) ? { memory_kind: stringField(fm.data.memory_kind) } : {},
@@ -8355,7 +8496,7 @@ function matchPastFailureTarget(target, candidateBody) {
   }
   if (!FAILURE_MARKER_RE.test(candidateBody)) return null;
   const candidateTokens = new Set(tokenizeForMatch(candidate));
-  const overlappingTokens = target.distinctiveTokens.filter((token) => candidateTokens.has(token));
+  const overlappingTokens = target.distinctiveTokens.filter((token2) => candidateTokens.has(token2));
   if (overlappingTokens.length >= 2) {
     return { reason: `distinctive target terms overlapped prior failure memory (${overlappingTokens.slice(0, 4).join(", ")})` };
   }
@@ -8371,7 +8512,7 @@ function extractCodeLikeNeedles(value) {
   return (value.match(/[A-Za-z0-9_.:-]*[_.:-][A-Za-z0-9_.:-]+/g) ?? []).filter((needle) => /[A-Za-z]/.test(needle));
 }
 function extractDistinctiveTargetTokens(value) {
-  return uniqueStrings(tokenizeForMatch(value).filter((token) => token.length >= 4).filter((token) => !/^\d+$/.test(token)).filter((token) => !COMMON_FAILURE_MATCH_TOKENS.has(token)));
+  return uniqueStrings(tokenizeForMatch(value).filter((token2) => token2.length >= 4).filter((token2) => !/^\d+$/.test(token2)).filter((token2) => !COMMON_FAILURE_MATCH_TOKENS.has(token2)));
 }
 function hasDistinctiveNeedle(value) {
   return extractDistinctiveTargetTokens(value).length > 0;
@@ -8429,23 +8570,23 @@ function renderMemoryIndexStatusHint(status) {
 }
 async function readIfExists2(path) {
   try {
-    return await readFile17(path, "utf8");
+    return await readFile18(path, "utf8");
   } catch {
     return "";
   }
 }
 async function collectImportFiles(source) {
-  const st = await stat5(source);
+  const st = await stat4(source);
   if (st.isFile()) return isImportCandidate(source) ? [source] : [];
   const files = [];
   await walkImportFiles(source, files);
   return files.sort((a, b) => a.localeCompare(b));
 }
 async function walkImportFiles(dir, out) {
-  const entries = await readdir5(dir, { withFileTypes: true });
+  const entries = await readdir4(dir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.name === ".git" || entry.name === "node_modules") continue;
-    const path = join28(dir, entry.name);
+    const path = join26(dir, entry.name);
     if (entry.isDirectory()) {
       await walkImportFiles(path, out);
     } else if (entry.isFile() && isImportCandidate(path)) {
@@ -8458,9 +8599,9 @@ function isImportCandidate(path) {
   return ext === ".md" || ext === ".txt";
 }
 async function buildImportEntry(file, sourceRoot, project, today, maxBytes) {
-  const st = await stat5(file);
+  const st = await stat4(file);
   const sourceKind = classifyImportSource(file);
-  const hash = createHash7("sha256").update(await readFile17(file)).digest("hex");
+  const hash = createHash8("sha256").update(await readFile18(file)).digest("hex");
   const baseEntry = {
     source_path: file,
     source_kind: sourceKind,
@@ -8483,7 +8624,7 @@ async function buildImportEntry(file, sourceRoot, project, today, maxBytes) {
       reason: "policy_source_not_imported"
     };
   }
-  const text = await readFile17(file, "utf8");
+  const text = await readFile18(file, "utf8");
   const extracted = extractImportText(text, sourceKind);
   if (!extracted) {
     return {
@@ -8512,8 +8653,8 @@ async function writeImportCapture(vault, entry, today) {
   const content = hiddenString(entry, "__content");
   const project = hiddenString(entry, "__project");
   const relPath = await availableImportPath(vault, entry.proposed_path);
-  const absPath = join28(vault, relPath);
-  await mkdir7(join28(vault, "raw", "transcripts"), { recursive: true });
+  const absPath = join26(vault, relPath);
+  await mkdir7(join26(vault, "raw", "transcripts"), { recursive: true });
   await writeFile5(absPath, renderImportCapture(entry, content, project, today), "utf8");
   const validation = await runValidate({ file: absPath });
   return {
@@ -8529,7 +8670,7 @@ async function availableImportPath(vault, proposed) {
   const stem = proposed.slice(0, -ext.length);
   let candidate = proposed;
   let i = 2;
-  while (await readIfExists2(join28(vault, candidate))) {
+  while (await readIfExists2(join26(vault, candidate))) {
     candidate = `${stem}-${i}${ext}`;
     i++;
   }
@@ -8714,10 +8855,10 @@ function memoryCacheRelPath(project) {
 }
 async function readMemoryCache(vault, project) {
   if (project) {
-    const projectCache = await readIfExists2(join28(vault, memoryCacheRelPath(project)));
+    const projectCache = await readIfExists2(join26(vault, memoryCacheRelPath(project)));
     if (projectCache) return projectCache;
   }
-  return readIfExists2(join28(vault, ".skillwiki", "memory-topics.json"));
+  return readIfExists2(join26(vault, ".skillwiki", "memory-topics.json"));
 }
 function dedupePages(pages) {
   const seen = /* @__PURE__ */ new Set();
@@ -8808,8 +8949,8 @@ function slugify2(value) {
 }
 
 // src/commands/query.ts
-import { readFile as readFile18, stat as stat6 } from "fs/promises";
-import { join as join29 } from "path";
+import { readFile as readFile19, stat as stat5 } from "fs/promises";
+import { join as join27 } from "path";
 var W_KEYWORD = 2;
 var W_SOURCE_OVERLAP = 4;
 var W_WIKILINK = 3;
@@ -8875,8 +9016,22 @@ async function runQuery(input) {
       type: page.type
     };
   }).filter((r) => r.score > 0).sort((a, b) => b.score - a.score || a.path.localeCompare(b.path)).slice(0, limit);
-  const humanHint = results.length === 0 ? "no matching pages found" : results.map((r) => `${r.path} (score: ${r.score})`).join("\n");
-  return { exitCode: ExitCode.OK, result: ok({ results, humanHint }) };
+  let pendingSources;
+  if (input.includePending) {
+    const { runSourcesPending } = await import("./sources-L2SQV63E.js");
+    const pending = await runSourcesPending({
+      vault: input.vault,
+      match: input.text,
+      limit: input.limit ?? 10
+    });
+    pendingSources = pending.result.ok ? pending.result.data.items : [];
+  }
+  const humanHint = results.length === 0 ? pendingSources && pendingSources.length > 0 ? `no matching typed pages found
+${pendingSources.length} matching pending source(s)` : "no matching pages found" : results.map((r) => `${r.path} (score: ${r.score})`).join("\n");
+  return {
+    exitCode: ExitCode.OK,
+    result: ok({ results, ...pendingSources ? { pending_sources: pendingSources } : {}, humanHint })
+  };
 }
 function scoreSourceOverlap(page, allPages, seedPaths) {
   if (page.sources.length === 0) return 0;
@@ -8930,10 +9085,10 @@ function computeKeywordScore(terms, title, tags, body) {
   return score;
 }
 async function loadOrBuildGraph(vault) {
-  const graphPath = join29(vault, ".skillwiki", "graph.json");
+  const graphPath = join27(vault, ".skillwiki", "graph.json");
   let needsBuild = false;
   try {
-    const fileStat = await stat6(graphPath);
+    const fileStat = await stat5(graphPath);
     const ageHours = (Date.now() - fileStat.mtimeMs) / (1e3 * 60 * 60);
     if (ageHours > 24) needsBuild = true;
   } catch {
@@ -8944,7 +9099,7 @@ async function loadOrBuildGraph(vault) {
     if (buildResult.exitCode !== 0) return null;
   }
   try {
-    const raw = await readFile18(graphPath, "utf8");
+    const raw = await readFile19(graphPath, "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -8959,7 +9114,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z } from "zod";
 
 // src/mcp/vault-resolve.ts
-import { join as join30, resolve as resolve7 } from "path";
+import { join as join28, resolve as resolve7 } from "path";
 
 // src/mcp/allowlist.ts
 import { resolve as resolve6, sep as sep4 } from "path";
@@ -9021,7 +9176,7 @@ async function resolveMcpVault(input) {
   return ok({ vault: vaultPath, source });
 }
 function defaultGraphOut(vault) {
-  return join30(vault, ".skillwiki", "graph.json");
+  return join28(vault, ".skillwiki", "graph.json");
 }
 
 // src/mcp/result-format.ts
@@ -9038,7 +9193,7 @@ function formatToolResult(payload) {
 // src/mcp/audit-log.ts
 import { appendFileSync, mkdirSync as mkdirSync5 } from "fs";
 import { homedir } from "os";
-import { join as join31 } from "path";
+import { join as join29 } from "path";
 function auditEnabled() {
   const v = process.env.SKILLWIKI_MCP_AUDIT;
   if (v === "0" || v === "false") return false;
@@ -9050,7 +9205,7 @@ function auditSink() {
 function auditFilePath() {
   const custom = process.env.SKILLWIKI_MCP_AUDIT_FILE;
   if (custom && custom.length > 0) return custom;
-  return join31(homedir(), ".skillwiki", "mcp-audit.jsonl");
+  return join29(homedir(), ".skillwiki", "mcp-audit.jsonl");
 }
 function auditMcpToolCall(entry) {
   if (!auditEnabled()) return;
@@ -9060,7 +9215,7 @@ function auditMcpToolCall(entry) {
     return;
   }
   const path = auditFilePath();
-  mkdirSync5(join31(path, ".."), { recursive: true });
+  mkdirSync5(join29(path, ".."), { recursive: true });
   appendFileSync(path, line, "utf8");
 }
 async function runMcpToolHandler(tool, input, fn) {
@@ -9280,8 +9435,8 @@ function registerMcpMutatingTools(server) {
 }
 
 // src/mcp/resources.ts
-import { readFile as readFile20 } from "fs/promises";
-import { join as join33 } from "path";
+import { readFile as readFile21 } from "fs/promises";
+import { join as join31 } from "path";
 import { ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 
 // src/mcp/lint-bucket.ts
@@ -9409,8 +9564,8 @@ async function fetchQueryPreview(input) {
 }
 
 // src/mcp/graph-html.ts
-import { readFile as readFile19 } from "fs/promises";
-import { join as join32 } from "path";
+import { readFile as readFile20 } from "fs/promises";
+import { join as join30 } from "path";
 import { existsSync as existsSync16 } from "fs";
 var TYPE_COLORS = {
   entities: "#e74c3c",
@@ -9479,7 +9634,7 @@ ${nodeSvg}
   return { html, node_count: nodes.length, edge_count: edges.length, truncated };
 }
 async function fetchGraphHtmlReport(input) {
-  const graphPath = input.graphPath ?? join32(input.vault, ".skillwiki", "graph.json");
+  const graphPath = input.graphPath ?? join30(input.vault, ".skillwiki", "graph.json");
   const maxNodes = Math.min(Math.max(10, input.maxNodes ?? 120), 500);
   if (!existsSync16(graphPath)) {
     return {
@@ -9489,7 +9644,7 @@ async function fetchGraphHtmlReport(input) {
   }
   let raw;
   try {
-    raw = await readFile19(graphPath, "utf8");
+    raw = await readFile20(graphPath, "utf8");
   } catch (e) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
@@ -9553,7 +9708,7 @@ async function fetchStaleSummary(input) {
 
 // src/mcp/resources.ts
 async function readVaultFile(vault, rel) {
-  return readFile20(join33(vault, rel), "utf8");
+  return readFile21(join31(vault, rel), "utf8");
 }
 async function tailLines(text, lines) {
   const parts = text.split(/\r?\n/);
@@ -9639,9 +9794,9 @@ function registerMcpResources(server) {
       if (!v.ok) {
         return { contents: [{ uri: uri.href, mimeType: "text/plain", text: JSON.stringify(v) }] };
       }
-      const path = join33(v.data.vault, ".skillwiki", "graph.json");
+      const path = join31(v.data.vault, ".skillwiki", "graph.json");
       try {
-        const raw = await readFile20(path, "utf8");
+        const raw = await readFile21(path, "utf8");
         const graph = JSON.parse(raw);
         const adjacency = graph.adjacency ?? {};
         const nodes = Object.keys(adjacency);
@@ -9954,11 +10109,6 @@ export {
   readLastOp,
   appendLastOp,
   clearLastOp,
-  eventPathFor,
-  validateLogEvent,
-  canonicalEventJson,
-  writeLogEvent,
-  readLogEvents,
   runLogAppend,
   renderIndexUpsert,
   upsertIndexEntry,
@@ -9974,7 +10124,6 @@ export {
   resolveInitTimePath,
   resolveRuntimePath,
   runOrphans,
-  extractCitationMarkers,
   runAudit,
   findPlugin,
   extractTaxonomy,
@@ -9986,6 +10135,8 @@ export {
   runIndexCheck,
   renderProjectIndex,
   runProjectIndex,
+  planRawStructuralMove,
+  applyRawStructuralMove,
   runStale,
   runPagesize,
   runLogRotate,
@@ -9996,8 +10147,10 @@ export {
   buildRemoteObjectPath,
   isValidRemoteDeleteCap,
   planAndMaybePruneRemoteObjects,
-  runDedup,
   safeWritePage,
+  rewriteRawSourceReferences,
+  snapshotMaintainedPageState,
+  runDedup,
   runFrontmatterFix,
   fixPathTooLong,
   assessSourceIdentity,