skillwiki 0.10.22 → 0.10.23

package/dist/cli.js

@@ -9,16 +9,14 @@ import {
   acquireLock,
   acquireOwnedSyncLock,
   appendLastOp,
+  applyRawStructuralMove,
   assessSourceIdentity,
   buildDegradedReasons,
   buildRemoteObjectPath,
-  canonicalEventJson,
   clearLastOp,
   configPath,
   evaluateDirtyVolumeGate,
   evaluateSatelliteRunHealth,
-  eventPathFor,
-  extractCitationMarkers,
   extractTaxonomy,
   findPlugin,
   fixPathTooLong,
@@ -30,11 +28,11 @@ import {
   mergeTaxonomyConflict,
   normalizeRemoteRoot,
   planAndMaybePruneRemoteObjects,
+  planRawStructuralMove,
   probeRemoteHealth,
   readCliPackageJson,
   readLastOp,
   readLock,
-  readLogEvents,
   readSatelliteLatestRunFromText,
   reconcileTaxonomyDocument,
   releaseLock,
@@ -43,6 +41,7 @@ import {
   renderProjectIndex,
   resolveInitTimePath,
   resolveRuntimePath,
+  rewriteRawSourceReferences,
   runAudit,
   runConfigGet,
   runConfigList,
@@ -78,12 +77,11 @@ import {
   safeWritePage,
   satelliteLatestRunPath,
   scanConflictMarkerBlocksInText,
+  snapshotMaintainedPageState,
   snapshotterHealthChecks,
   taxonomyCommentForPage,
-  upsertIndexEntry,
-  validateLogEvent,
-  writeLogEvent
-} from "./chunk-7YDWC6D3.js";
+  upsertIndexEntry
+} from "./chunk-SYKSL3JQ.js";
 import {
   normalizeDistTag,
   readCache,
@@ -96,16 +94,10 @@ import {
   UNMANAGED_START,
   assertTargetInsideVault,
   atomicWriteText,
-  extractFrontmatter,
   prepareTypedPage,
-  readPage,
-  redactSensitiveContent,
   renderRootIndex,
-  scanSensitiveContent,
-  scanVault,
-  splitFrontmatter,
   writeRootIndexProjection
-} from "./chunk-54JVBNWK.js";
+} from "./chunk-QBZYEEBD.js";
 import {
   runManagedWritePreflight,
   runManagedWriteTransaction
@@ -138,6 +130,38 @@ import {
   supersedeStaleReviewRequiredJournals,
   writeDotenv
 } from "./chunk-PQG26AGJ.js";
+import {
+  applySourceDisposition,
+  decodeSourceActionApproval,
+  encodeSourceActionApproval,
+  inventorySources,
+  planSourceDisposition,
+  runSourcesPending
+} from "./chunk-EQPU2BPM.js";
+import {
+  authorizeRawOperation,
+  buildSourceReferenceIndex,
+  buildSourceRelocationProjection,
+  canonicalEventJson,
+  classifyRawPath,
+  eventPathFor,
+  extractCitationMarkers,
+  lifecycleDestination,
+  operationId,
+  readLogEvents,
+  readSourceRelocations,
+  resolveExistingRegularFileInsideVault,
+  validateLogEvent,
+  writeLogEvent
+} from "./chunk-QNTBNNEL.js";
+import {
+  extractFrontmatter,
+  readPage,
+  redactSensitiveContent,
+  scanSensitiveContent,
+  scanVault,
+  splitFrontmatter
+} from "./chunk-6ZDKTNLA.js";
 import {
   ExitCode,
   MetaSchema,
@@ -150,7 +174,7 @@ import {
 } from "./chunk-C2DKFJFA.js";
 
 // src/cli.ts
-import { join as join38 } from "path";
+import { join as join39 } from "path";
 import { Command } from "commander";
 
 // src/utils/output.ts
@@ -212,10 +236,10 @@ async function runHash(input) {
   const split = splitFrontmatter(text);
   if (!split.ok) return { exitCode: ExitCode.MISSING_CLOSING_DELIMITER, result: split };
   const bodyBytes = Buffer.from(split.data.body, "utf8");
-  const sha256 = createHash("sha256").update(bodyBytes).digest("hex");
+  const sha2562 = createHash("sha256").update(bodyBytes).digest("hex");
   return {
     exitCode: ExitCode.OK,
-    result: ok({ path: input.file, sha256, byte_count: bodyBytes.byteLength, humanHint: sha256 })
+    result: ok({ path: input.file, sha256: sha2562, byte_count: bodyBytes.byteLength, humanHint: sha2562 })
   };
 }
 
@@ -590,7 +614,7 @@ async function runLang(input) {
 
 // src/commands/init.ts
 import { mkdir as mkdir3, readFile as readFile3, readdir as readdir2, writeFile as writeFile2 } from "fs/promises";
-import { join as join5 } from "path";
+import { join as join5, dirname as dirname3 } from "path";
 var DEFAULT_TAXONOMY = [
   "research",
   "comparison",
@@ -608,6 +632,12 @@ var VAULT_DIRS = [
   "raw/papers",
   "raw/transcripts",
   "raw/assets",
+  "raw/archived/articles",
+  "raw/archived/papers",
+  "raw/archived/transcripts",
+  "raw/duplicates/articles",
+  "raw/duplicates/papers",
+  "raw/duplicates/transcripts",
   "entities",
   "concepts",
   "comparisons",
@@ -620,6 +650,8 @@ var VAULT_DIRS = [
 var ATTACHMENT_FOLDER = "raw/assets";
 var NEW_FILE_FOLDER = "raw/transcripts";
 var TEMPLATE_FOLDER = "_Templates";
+var WEB_CLIPPER_TEMPLATE_REL = `${TEMPLATE_FOLDER}/web-clipper/llm-wiki-clippings.json`;
+var WEB_CLIPPER_README_REL = `${TEMPLATE_FOLDER}/web-clipper/readme.txt`;
 function extractDomainFromSchema(text) {
   const m = text.match(/^##\s+Domain\s*\n([\s\S]*?)(?=\n\n|\n##|\s*$)/m);
   if (!m) return "";
@@ -746,6 +778,23 @@ async function runInit(input) {
       return { exitCode: ExitCode.WRITE_FAILED, result: err("WRITE_FAILED", { file: fileName, message: String(e) }) };
     }
   }
+  async function copyTemplateOrPreserve(fileName, sourceName) {
+    const destination = join5(target, fileName);
+    try {
+      await readFile3(destination);
+      preserved.push(fileName);
+      return void 0;
+    } catch {
+    }
+    try {
+      await mkdir3(dirname3(destination), { recursive: true });
+      await writeFile2(destination, await readFile3(join5(input.templates, sourceName)));
+      created.push(fileName);
+      return void 0;
+    } catch (e) {
+      return { exitCode: ExitCode.WRITE_FAILED, result: err("WRITE_FAILED", { file: fileName, message: String(e) }) };
+    }
+  }
   const err1 = await writeOrPreserve("index.md", async () => {
     const tpl = await readFile3(join5(input.templates, "index.md"), "utf8");
     return tpl.replace("{{INIT_DATE}}", today);
@@ -773,6 +822,16 @@ async function runInit(input) {
     ].join("\n");
   });
   if (errTemplate) return errTemplate;
+  const errWebClipperTemplate = await copyTemplateOrPreserve(
+    WEB_CLIPPER_TEMPLATE_REL,
+    "web-clipper/llm-wiki-clippings.json"
+  );
+  if (errWebClipperTemplate) return errWebClipperTemplate;
+  const errWebClipperReadme = await copyTemplateOrPreserve(
+    WEB_CLIPPER_README_REL,
+    "web-clipper/readme.txt"
+  );
+  if (errWebClipperReadme) return errWebClipperReadme;
   const err22 = await writeOrPreserve("log.md", async () => {
     const tpl = await readFile3(join5(input.templates, "log.md"), "utf8");
     return tpl.replace(/\{\{INIT_DATE\}\}/g, today).replace("{{DOMAIN}}", domain).replace("{{WIKI_LANG}}", canonicalLang);
@@ -804,7 +863,9 @@ async function runInit(input) {
     `lang: ${canonicalLang}`,
     `created: ${created.length}, preserved: ${preserved.length}`,
     `discovered tags: ${discovered_tags}`,
-    skipEnv ? "env: skipped" : `env: ${envWritten}`
+    skipEnv ? "env: skipped" : `env: ${envWritten}`,
+    `web clipper template: ${WEB_CLIPPER_TEMPLATE_REL}`,
+    "web clipper import: open Obsidian Web Clipper Settings and import the JSON in each browser profile"
   ].join("\n");
   if (created.length > 0) {
     appendLastOp(target, {
@@ -828,7 +889,11 @@ async function runInit(input) {
       imported_from_hermes: importedFromHermes,
       discovered_tags,
       humanHint,
-      templates_created: created.includes(`${TEMPLATE_FOLDER}/tpl-ad-hoc-capture.md`)
+      templates_created: created.includes(`${TEMPLATE_FOLDER}/tpl-ad-hoc-capture.md`),
+      web_clipper_template_path: WEB_CLIPPER_TEMPLATE_REL,
+      web_clipper_readme_path: WEB_CLIPPER_README_REL,
+      web_clipper_template_created: created.includes(WEB_CLIPPER_TEMPLATE_REL),
+      web_clipper_template_preserved: preserved.includes(WEB_CLIPPER_TEMPLATE_REL)
     })
   };
 }
@@ -1198,21 +1263,21 @@ function rollbackPath(vault, path, stage2, stage3) {
 function hasMarkers(path, text) {
   const lines = text.split(/\r?\n/);
   let open2 = false;
-  let sep3 = false;
+  let sep4 = false;
   for (const line of lines) {
     if (line.startsWith("<<<<<<< ")) {
       open2 = true;
-      sep3 = false;
+      sep4 = false;
       continue;
     }
     if (line === "=======" && open2) {
-      sep3 = true;
+      sep4 = true;
       continue;
     }
-    if (line.startsWith(">>>>>>> ") && open2 && sep3) return true;
+    if (line.startsWith(">>>>>>> ") && open2 && sep4) return true;
     if (line.startsWith(">>>>>>> ")) {
       open2 = false;
-      sep3 = false;
+      sep4 = false;
     }
   }
   return false;
@@ -1489,16 +1554,6 @@ async function runLogMaterialize(input) {
 // src/commands/log-migrate-legacy.ts
 import { readFileSync as readFileSync6 } from "fs";
 import { join as join10 } from "path";
-
-// src/utils/operation-id.ts
-import { createHash as createHash2 } from "crypto";
-function operationId(namespace, parts) {
-  const hash = createHash2("sha256").update(namespace).update("\0");
-  for (const part of parts) hash.update(part).update("\0");
-  return hash.digest("hex");
-}
-
-// src/commands/log-migrate-legacy.ts
 var BLOCK_RE = /^## \[(\d{4}-\d{2}-\d{2})\][^\n]*$/gm;
 var PUBLISH_RE = /<!--\s*skillwiki-(?:page-publish|project-page-publish):([a-f0-9]{64})\s*-->/i;
 function splitLegacyBlocks(text) {
@@ -2797,7 +2852,7 @@ function selfCheckReport(report) {
   if (lint.summary.info !== sumBySeverity("info")) {
     errors.push(`lint.summary.info=${lint.summary.info} but info bucket counts sum to ${sumBySeverity("info")}`);
   }
-  for (const component of ["doctor", "lint", "vault_sync", "query_readiness", "source_freshness"]) {
+  for (const component of ["doctor", "lint", "vault_sync", "query_readiness", "source_freshness", "source_lifecycle"]) {
     if (!report.coverage[component]) errors.push(`missing coverage entry for ${component}`);
   }
   for (const flag of report.risk_flags) {
@@ -2817,6 +2872,7 @@ function buildHumanHint(report) {
   }
   lines.push(`vault_sync: ${report.components.vault_sync.summary.pass} pass, ${report.components.vault_sync.summary.warn} warn, ${report.components.vault_sync.summary.error} error`);
   lines.push(`query_readiness: ${report.components.query_readiness.status} (${report.components.query_readiness.summary.score}/100)`);
+  lines.push(`source_lifecycle: ${report.components.source_lifecycle.summary.pending} pending, ${report.components.source_lifecycle.summary.deferred} deferred, ${report.components.source_lifecycle.summary.reviewed_no_op} reviewed-no-op`);
   if (report.risk_flags.length > 0) {
     lines.push("risk flags:");
     for (const flag of report.risk_flags) {
@@ -2876,7 +2932,8 @@ function buildIncompleteReport(input, syncMode) {
       lint: { state: "unknown", status: "unknown", reason: "lint summary still running" },
       vault_sync: vaultSyncCoverage,
       query_readiness: { state: "unknown", status: "unknown", reason: "health run not complete" },
-      source_freshness: { state: "unknown", status: "unknown", reason: "health run not complete" }
+      source_freshness: { state: "unknown", status: "unknown", reason: "health run not complete" },
+      source_lifecycle: { state: "unknown", status: "unknown", reason: "health run not complete" }
     },
     components: {
       doctor: {
@@ -2904,6 +2961,11 @@ function buildIncompleteReport(input, syncMode) {
         status: "unknown",
         blocking: false,
         summary: { stale_pages: 0, file_source_url: 0, stale_sections: 0 }
+      },
+      source_lifecycle: {
+        status: "unknown",
+        blocking: false,
+        summary: { pending: 0, deferred: 0, reviewed_no_op: 0, archived_raw: 0, preserved_duplicates: 0, legacy_archive_raw: 0, legacy_schema: 0, invalid_schema: 0, oldest_pending: null, fresh_pending_examples: [] }
       }
     },
     risk_flags: [],
@@ -2958,6 +3020,26 @@ async function runHealth(input) {
       stale_sections: bucketCount(lint.result.data.buckets, "stale_sections")
     }
   };
+  const sourceInventory = await inventorySources({ vault: input.vault });
+  const sourceItems = sourceInventory.output?.items ?? [];
+  const pendingItems = sourceItems.filter((item) => item.lifecycle_status === "pending" && item.storage_status === "active");
+  const pendingDates = pendingItems.map((item) => item.captured).filter((value) => value !== null).sort();
+  const sourceLifecycle = {
+    status: pendingItems.length > 0 ? "info" : "pass",
+    blocking: false,
+    summary: {
+      pending: pendingItems.length,
+      deferred: sourceItems.filter((item) => item.lifecycle_status === "deferred").length,
+      reviewed_no_op: sourceItems.filter((item) => item.lifecycle_status === "reviewed-no-op").length,
+      archived_raw: sourceItems.filter((item) => item.storage_status === "archived").length,
+      preserved_duplicates: sourceItems.filter((item) => item.storage_status === "duplicate").length,
+      legacy_archive_raw: sourceItems.filter((item) => item.storage_status === "legacy-archived").length,
+      legacy_schema: sourceItems.filter((item) => item.schema_status === "legacy").length,
+      invalid_schema: sourceItems.filter((item) => item.schema_status === "invalid").length,
+      oldest_pending: pendingDates[0] ?? null,
+      fresh_pending_examples: pendingItems.filter((item) => item.age_bucket === "fresh").slice(0, 3).map((item) => item.raw_path)
+    }
+  };
   const doctorComponent = {
     status: doctorStatus,
     blocking: false,
@@ -3002,14 +3084,16 @@ async function runHealth(input) {
       lint: { state: "checked", status: lintComponent.status },
       vault_sync: vaultSyncCoverage,
       query_readiness: { state: "checked", status: queryReadiness.status },
-      source_freshness: { state: "checked", status: sourceFreshness.status }
+      source_freshness: { state: "checked", status: sourceFreshness.status },
+      source_lifecycle: { state: "checked", status: sourceLifecycle.status }
     },
     components: {
       doctor: doctorComponent,
       lint: lintComponent,
       vault_sync: vaultSync,
       query_readiness: queryReadiness,
-      source_freshness: sourceFreshness
+      source_freshness: sourceFreshness,
+      source_lifecycle: sourceLifecycle
     },
     risk_flags: riskFlags,
     details_included: false,
@@ -3056,7 +3140,7 @@ async function runHealth(input) {
 }
 
 // src/commands/archive.ts
-import { rename as rename2, mkdir as mkdir6, readFile as readFile7, writeFile as writeFile5 } from "fs/promises";
+import { rename as rename2, mkdir as mkdir6, readFile as readFile7 } from "fs/promises";
 import { join as join18, dirname as dirname5 } from "path";
 
 // src/utils/delete-intent.ts
@@ -3127,18 +3211,21 @@ async function runArchive(input) {
   let relPath = lookup(scan.data.typedKnowledge);
   let isRaw = false;
   if (!relPath) {
-    relPath = lookup(scan.data.raw);
+    relPath = input.page.includes("/") ? lookup(scan.data.raw) : void 0;
     isRaw = relPath != null;
   }
   if (!relPath) return { exitCode: ExitCode.ARCHIVE_TARGET_NOT_FOUND, result: err("ARCHIVE_TARGET_NOT_FOUND", { page: input.page }) };
   if (relPath.startsWith("_archive/")) return { exitCode: ExitCode.ARCHIVE_ALREADY_ARCHIVED, result: err("ARCHIVE_ALREADY_ARCHIVED", { page: relPath }) };
   const slug = relPath.replace(/\.md$/, "").split("/").pop();
-  const archivePath = join18("_archive", relPath).replace(/\\/g, "/");
+  const rawArchive = isRaw ? lifecycleDestination(relPath, "archive") : void 0;
+  if (rawArchive && !rawArchive.ok) return { exitCode: ExitCode.USAGE, result: rawArchive };
+  const archivePath = isRaw ? rawArchive.data : join18("_archive", relPath).replace(/\\/g, "/");
   const remoteRoot = normalizeRemoteRoot(input.remote);
   const remoteObjectPath = buildRemoteObjectPath(remoteRoot, relPath);
   let cascade;
-  if (input.cascade) {
+  if (input.cascade || isRaw) {
     const wikilinkRefs = [];
+    const citationRefs = [];
     const sourceArrayRefs = [];
     for (const page of scan.data.typedKnowledge) {
       if (page.relPath === relPath) continue;
@@ -3147,12 +3234,15 @@ async function runArchive(input) {
       if (!split.ok) continue;
       const wl = countWikilinks(split.data.body, slug);
       if (wl > 0) wikilinkRefs.push({ page: page.relPath, count: wl });
+      const rewritten = isRaw ? rewriteRawSourceReferences(text, relPath, archivePath) : void 0;
+      const citationCount = rewritten?.bodyCitationCount ?? 0;
+      if (citationCount > 0) citationRefs.push({ page: page.relPath, count: citationCount });
       const fm = extractFrontmatter(text);
       if (!fm.ok) continue;
       const sources = fm.data.sources;
-      if (Array.isArray(sources) && sources.includes(relPath)) {
+      if (Array.isArray(sources) && (isRaw ? rewritten.sourcesBefore.some((source, index) => source !== rewritten.sourcesAfter[index]) : sources.includes(relPath))) {
         const before = sources.filter((s) => typeof s === "string");
-        const after = before.filter((s) => s !== relPath);
+        const after = isRaw ? rewritten.sourcesAfter : before.filter((s) => s !== relPath);
         sourceArrayRefs.push({ page: page.relPath, sources_before: before, sources_after: after });
       }
     }
@@ -3167,9 +3257,23 @@ async function runArchive(input) {
         if (e instanceof Error && "code" in e && e.code !== "ENOENT") throw e;
       }
     }
-    cascade = { wikilink_refs: wikilinkRefs, index_refs: indexRefs, source_array_refs: sourceArrayRefs };
-  }
-  if (input.cascade && !input.apply) {
+    cascade = { wikilink_refs: wikilinkRefs, citation_refs: citationRefs, index_refs: indexRefs, source_array_refs: sourceArrayRefs };
+  }
+  let rawPlan;
+  if (isRaw) {
+    rawPlan = await planRawStructuralMove({ vault: input.vault, operation: "archive", source: relPath, destination: archivePath });
+    if (!rawPlan.ok) return { exitCode: ExitCode.WRITE_FAILED, result: rawPlan };
+  }
+  const citationState = isRaw ? await snapshotMaintainedPageState(scan.data.allMarkdown) : [];
+  const rawApprovalToken = rawPlan?.ok ? operationId("raw-archive-approval", [
+    rawPlan.data.operation_id,
+    rawPlan.data.approval_token,
+    rawPlan.data.source_sha256,
+    archivePath,
+    ...citationState
+  ]) : void 0;
+  const rawStructuralApproval = rawPlan?.ok ? rawPlan.data.approval_token : void 0;
+  if ((input.cascade || isRaw) && !input.apply) {
     const summary = `DRY-RUN \u2014 would archive ${relPath}; ${cascade.wikilink_refs.length} wikilink ref(s), ${cascade.index_refs.length} index ref(s), ${cascade.source_array_refs.length} source array ref(s).`;
     return {
       exitCode: ExitCode.OK,
@@ -3178,37 +3282,73 @@ async function runArchive(input) {
         archived_to: archivePath,
         index_updated: false,
         applied: false,
+        ...rawApprovalToken ? { approval_token: rawApprovalToken } : {},
         cascade,
         ...remoteObjectPath ? { remote: { plannedDeletes: [remoteObjectPath], deleted: [] } } : {},
         humanHint: summary + (remoteObjectPath ? ` (remote planned ${input.remoteDelete ? "delete" : "preview"}: ${remoteObjectPath})` : "")
       })
     };
   }
-  if (input.cascade && input.apply && cascade) {
+  if (isRaw) {
+    if (!input.approve || !rawStructuralApproval || input.approve !== rawApprovalToken) {
+      return { exitCode: ExitCode.USAGE, result: err("APPROVAL_INVALID", { message: "raw archive requires the live dry-run --approve token" }) };
+    }
+    const moved = await applyRawStructuralMove({
+      vault: input.vault,
+      operation: "archive",
+      source: relPath,
+      destination: archivePath,
+      approve: rawStructuralApproval,
+      command: "skillwiki archive",
+      citationChanges: [.../* @__PURE__ */ new Set([...cascade?.source_array_refs.map((ref) => ref.page) ?? [], ...cascade?.citation_refs.map((ref) => ref.page) ?? []])]
+    });
+    if (!moved.ok) return { exitCode: ExitCode.WRITE_FAILED, result: moved };
+  }
+  if ((input.cascade || isRaw) && input.apply && cascade) {
     for (const ref of cascade.source_array_refs) {
       const absPath = join18(input.vault, ref.page);
       const text = await readFile7(absPath, "utf8");
-      const split = splitFrontmatter(text);
-      if (!split.ok) continue;
-      const before = split.data.rawFrontmatter;
-      const newSourcesYaml = ref.sources_after.length === 0 ? "sources: []" : "sources:\n" + ref.sources_after.map((s) => `  - ${s}`).join("\n");
-      const fmRewritten = before.replace(
-        /^sources:\s*(?:\[[^\]]*\]|(?:\r?\n(?:\s*-\s.*))+)/m,
-        newSourcesYaml
-      );
-      if (fmRewritten === before) continue;
       if (!arraysEqual(ref.sources_after, ref.sources_before)) {
-        await writeFile5(absPath, `---
+        let updated;
+        if (isRaw) {
+          updated = rewriteRawSourceReferences(text, relPath, archivePath).text;
+        } else {
+          const split = splitFrontmatter(text);
+          if (!split.ok) continue;
+          const newSourcesYaml = ref.sources_after.length === 0 ? "sources: []" : "sources:\n" + ref.sources_after.map((s) => `  - ${s}`).join("\n");
+          const fmRewritten = split.data.rawFrontmatter.replace(
+            /^sources:\s*(?:\[[^\]]*\]|(?:\r?\n(?:\s*-\s.*))+)/m,
+            newSourcesYaml
+          );
+          if (fmRewritten === split.data.rawFrontmatter) continue;
+          updated = `---
 ${fmRewritten}
----${split.data.body}`, "utf8");
+---${split.data.body}`;
+        }
+        const write = await safeWritePage(absPath, updated);
+        if (!write.ok) return { exitCode: ExitCode.WRITE_FAILED, result: write };
+      }
+    }
+    if (isRaw) {
+      for (const ref of cascade.citation_refs) {
+        if (cascade.source_array_refs.some((sourceRef) => sourceRef.page === ref.page)) continue;
+        const absPath = join18(input.vault, ref.page);
+        const original = await readFile7(absPath, "utf8");
+        const updated = rewriteRawSourceReferences(original, relPath, archivePath).text;
+        if (updated !== original) {
+          const write = await safeWritePage(absPath, updated);
+          if (!write.ok) return { exitCode: ExitCode.WRITE_FAILED, result: write };
+        }
       }
     }
   }
-  await mkdir6(dirname5(join18(input.vault, archivePath)), { recursive: true });
-  await rename2(join18(input.vault, relPath), join18(input.vault, archivePath));
+  if (!isRaw) {
+    await mkdir6(dirname5(join18(input.vault, archivePath)), { recursive: true });
+    await rename2(join18(input.vault, relPath), join18(input.vault, archivePath));
+  }
   let indexUpdated = false;
   if (!isRaw) {
-    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-Q6WL76SO.js");
+    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-FRWTZB5Y.js");
     const before = await readFile7(join18(input.vault, "index.md"), "utf8").catch(() => "");
     const fullTarget = relPath.replace(/\.md$/, "");
     const bare = fullTarget.split("/").pop() ?? fullTarget;
@@ -3241,7 +3381,7 @@ ${fmRewritten}
     }
     remote = pruned.data;
   }
-  const applied = input.cascade ? true : void 0;
+  const applied = input.cascade || isRaw ? true : void 0;
   const cascadeNote = input.cascade ? ` (cascade: ${cascade.source_array_refs.length} src arrays updated, ${cascade.wikilink_refs.length} wikilinks reported)` : "";
   const remoteNote = remote ? ` (remote ${input.remoteDelete ? `deleted ${remote.deleted.length}` : `planned ${remote.plannedDeletes.length}`})` : "";
   return {
@@ -3298,6 +3438,15 @@ async function runRemove(input) {
       result: err("FILE_NOT_FOUND", { page: input.page })
     };
   }
+  if (relPath.startsWith("raw/")) {
+    return {
+      exitCode: ExitCode.USAGE,
+      result: err("RAW_DISPOSAL_REQUIRES_EXACT_TARGET_APPROVAL", {
+        path: relPath,
+        message: "ordinary remove never deletes raw evidence; use sources dispose with an exact target and approved preview"
+      })
+    };
+  }
   if (relPath.startsWith("_archive/")) {
     return {
       exitCode: ExitCode.USAGE,
@@ -3317,10 +3466,10 @@ async function runRemove(input) {
   const tombstonePath = await writeDeleteIntent(input.vault, intent);
   await unlink2(join19(input.vault, relPath));
   if (relPath.endsWith(".md") && !relPath.startsWith("raw/")) {
-    const { readFile: readFile18 } = await import("fs/promises");
+    const { readFile: readFile20 } = await import("fs/promises");
     const { join: pathJoin } = await import("path");
-    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-Q6WL76SO.js");
-    const before = await readFile18(pathJoin(input.vault, "index.md"), "utf8").catch(() => "");
+    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-FRWTZB5Y.js");
+    const before = await readFile20(pathJoin(input.vault, "index.md"), "utf8").catch(() => "");
     const fullTarget = relPath.replace(/\.md$/, "");
     const bare = fullTarget.split("/").pop() ?? fullTarget;
     const hadIndexEntry = before.includes(`[[${fullTarget}]]`) || before.includes(`[[${bare}]]`);
@@ -3358,7 +3507,7 @@ async function runRemove(input) {
 }
 
 // src/commands/drift.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash2 } from "crypto";
 
 // src/utils/fetch.ts
 async function controlledFetch(url, opts) {
@@ -3437,7 +3586,7 @@ async function runDrift(input) {
       });
       continue;
     }
-    const currentHash = createHash3("sha256").update(Buffer.from(resp.data.body, "utf8")).digest("hex");
+    const currentHash = createHash2("sha256").update(Buffer.from(resp.data.body, "utf8")).digest("hex");
     const identity = assessSourceIdentity({
       rawPath: raw.relPath,
       sourceUrl,
@@ -3455,29 +3604,13 @@ async function runDrift(input) {
       continue;
     }
     const drifted2 = currentHash !== storedHash;
-    if (drifted2 && input.apply) {
-      const newFm = rawFrontmatter.replace(/^sha256:\s*[a-f0-9]+$/m, `sha256: ${currentHash}`);
-      const newText = `---
-${newFm}
----
-${body}`;
-      await safeWritePage(raw.absPath, newText);
-      results.push({
-        raw_path: raw.relPath,
-        source_url: sourceUrl,
-        stored_sha256: storedHash,
-        current_sha256: currentHash,
-        status: "updated"
-      });
-    } else {
-      results.push({
-        raw_path: raw.relPath,
-        source_url: sourceUrl,
-        stored_sha256: storedHash,
-        current_sha256: currentHash,
-        status: drifted2 ? "drifted" : "unchanged"
-      });
-    }
+    results.push({
+      raw_path: raw.relPath,
+      source_url: sourceUrl,
+      stored_sha256: storedHash,
+      current_sha256: currentHash,
+      status: drifted2 ? "drifted" : "unchanged"
+    });
   }
   const drifted = results.filter((r) => r.status === "drifted");
   const fetchFailed = results.filter((r) => r.status === "fetch_failed");
@@ -3496,14 +3629,7 @@ ${body}`;
   }
   if (fetchFailed.length > 0) hintLines.push(`fetch_failed: ${fetchFailed.length}`, ...fetchFailed.map((f) => `  ${f.raw_path}: ${f.fetch_error}`));
   if (updated.length > 0) hintLines.push(`updated: ${updated.length}`, ...updated.map((u) => `  ${u.raw_path}`));
-  if (input.apply && updated.length > 0) {
-    appendLastOp(input.vault, {
-      operation: "drift-apply",
-      summary: `updated ${updated.length} raw sources`,
-      files: updated.map((u) => u.raw_path),
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
-    });
-  }
+  if (input.apply && drifted.length > 0) hintLines.push("raw evidence is immutable; use attended reingest to create a new capture and archive the prior bytes");
   return {
     exitCode,
     result: ok({ scanned: results.length, drifted, fetch_failed: fetchFailed, identity_conflicts: identityConflicts, updated, newFiles: newResults, unchanged, humanHint: hintLines.join("\n") })
@@ -3977,7 +4103,7 @@ async function runTranscripts(input) {
 }
 
 // src/commands/compound.ts
-import { writeFile as writeFile7, mkdir as mkdir7, readdir as readdir6, unlink as unlink3 } from "fs/promises";
+import { writeFile as writeFile6, mkdir as mkdir7, readdir as readdir6, unlink as unlink3 } from "fs/promises";
 import { join as join23 } from "path";
 import { existsSync as existsSync7 } from "fs";
 import { readFile as readFile10 } from "fs/promises";
@@ -4138,7 +4264,7 @@ async function runCompound(input) {
       if (!existsSync7(compoundDir)) {
         await mkdir7(compoundDir, { recursive: true });
       }
-      await writeFile7(compoundPath, content, "utf8");
+      await writeFile6(compoundPath, content, "utf8");
     }
     promoted.push(`${slug}.md`);
   }
@@ -4262,7 +4388,7 @@ no compound entries found`;
 }
 
 // src/commands/session-brief.ts
-import { mkdir as mkdir8, readFile as readFile11, writeFile as writeFile8 } from "fs/promises";
+import { mkdir as mkdir8, readFile as readFile11, writeFile as writeFile7 } from "fs/promises";
 import { join as join24, relative, sep } from "path";
 var MAX_WORDS = 900;
 async function runSessionBrief(input) {
@@ -4282,7 +4408,8 @@ async function runSessionBrief(input) {
       baseHealthWarnings,
       satelliteHealth,
       sessionPins,
-      memoryTopics
+      memoryTopics,
+      pendingSources
     ] = await Promise.all([
       loadTranscriptInfo(scan.data.raw),
       loadWorkItems(scan.data.workItems),
@@ -4290,7 +4417,8 @@ async function runSessionBrief(input) {
       loadHealthWarnings(input.vault),
       loadSatelliteHealth(input.vault),
       loadSessionPins(input.vault, project),
-      project ? loadMemoryTopics(input.vault, project) : Promise.resolve([])
+      project ? loadMemoryTopics(input.vault, project) : Promise.resolve([]),
+      loadPendingSources(input.vault, today)
     ]);
     const healthWarnings = [
       ...baseHealthWarnings,
@@ -4313,6 +4441,7 @@ async function runSessionBrief(input) {
       sessionPins,
       latestLogs,
       unclaimedCaptures,
+      pendingSources,
       activeWork,
       latestDigest,
       projectLogs,
@@ -4347,6 +4476,7 @@ async function runSessionBrief(input) {
         log_updated: logUpdated,
         generated_at: generatedAt,
         session_pins: sessionPins,
+        pending_sources: pendingSources,
         memory_topics: memoryTopics,
         humanHint
       })
@@ -4412,6 +4542,17 @@ async function loadTranscriptInfo(rawPages) {
   }
   return out;
 }
+async function loadPendingSources(vault, today) {
+  const inventory = await inventorySources({ vault, today });
+  if (!inventory.output) return [];
+  return inventory.output.items.filter((item) => item.storage_status === "active" && item.lifecycle_status === "pending").slice(0, 5).map((item) => ({
+    path: item.raw_path,
+    title: item.title,
+    summary: item.source_url ?? `${item.schema_status} source awaiting integration`,
+    date: item.captured ?? "",
+    status: item.schema_status
+  }));
+}
 async function loadWorkItems(workItemPages) {
   const out = [];
   for (const page of workItemPages.filter((p) => p.relPath.endsWith("/spec.md"))) {
@@ -4482,6 +4623,7 @@ function renderBrief(input) {
   appendPinnedContextSection(lines, input.sessionPins);
   appendSection(lines, "Active Work", input.activeWork, "No active project work found.");
   appendSection(lines, "Unclaimed Captures", input.unclaimedCaptures, "No unclaimed task or bug captures found.");
+  appendSection(lines, "Recent Pending Sources", input.pendingSources, "No pending articles or papers found.");
   appendSection(lines, "Recent Session Logs", input.project ? input.projectLogs : input.latestLogs, "No recent session logs found.");
   appendSection(lines, "Latest Agent Memory Trends", input.latestDigest, "No agent memory trends digest found.");
   appendMemoryTopicsSection(lines, input.project, input.memoryTopics);
@@ -4492,6 +4634,7 @@ function renderBrief(input) {
     "- `skillwiki status`",
     input.project ? `- \`skillwiki project-index ${input.project}\`` : '- `skillwiki query "active work"`',
     "- `skillwiki transcripts --since <date>`",
+    "- `skillwiki sources pending`",
     ""
   );
   return lines.join("\n").trimEnd() + "\n";
@@ -4613,9 +4756,9 @@ async function writeBriefArtifacts(vault, input) {
   const previousComparable = comparableBrief(await readIfExists(metaPath));
   const nextComparable = comparableBrief(committed);
   const materialChange = previousComparable !== nextComparable;
-  await writeFile8(metaPath, committed, "utf8");
-  await writeFile8(cacheMdPath, input.brief, "utf8");
-  await writeFile8(cacheJsonPath, `${JSON.stringify({
+  await writeFile7(metaPath, committed, "utf8");
+  await writeFile7(cacheMdPath, input.brief, "utf8");
+  await writeFile7(cacheJsonPath, `${JSON.stringify({
     project: input.project,
     brief: input.brief,
     word_count: input.wordCount,
@@ -4732,7 +4875,7 @@ function dateFromPath(path) {
 // src/commands/ingest.ts
 import { readFile as readFile13, open, unlink as unlink4, mkdir as mkdir9 } from "fs/promises";
 import { join as join26 } from "path";
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 
 // src/commands/page-publish.ts
 import { readFileSync as readFileSync12, realpathSync } from "fs";
@@ -4740,13 +4883,13 @@ import { readFile as readFile12 } from "fs/promises";
 import { join as join25, resolve as resolve3 } from "path";
 
 // src/utils/publication-approval.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 var APPROVAL_CONTRACT = "skillwiki-publication-approval-v1";
 var APPROVAL_TOKEN_VERSION = "swpub1";
 var SHA256_HEX = /^[0-9a-f]{64}$/;
 var PUBLISHERS = /* @__PURE__ */ new Set(["page", "project-page"]);
 function sha256Hex(bytes) {
-  return createHash4("sha256").update(bytes).digest("hex");
+  return createHash3("sha256").update(bytes).digest("hex");
 }
 function normalizeLogNote(note) {
   if (note === void 0) return "";
@@ -5545,13 +5688,13 @@ function isUrl(source) {
 function todayIso() {
   return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
 }
-function buildRawContent(sourceUrl, ingested, sha256, body) {
+function buildRawContent(sourceUrl, ingested, sha2562, body) {
   const lines = [
     "---",
     sourceUrl !== null ? `source_url: "${sourceUrl}"` : "source_url:",
     `created: ${ingested}`,
     `ingested: ${ingested}`,
-    `sha256: ${sha256}`,
+    `sha256: ${sha2562}`,
     `ingested_by: wiki-ingest`,
     "---",
     "",
@@ -5757,7 +5900,7 @@ async function runIngest(input, pagePublishDeps = defaultPagePublishDeps()) {
       })
     };
   }
-  const sha256 = createHash5("sha256").update(Buffer.from(sourceContent, "utf8")).digest("hex");
+  const sha2562 = createHash4("sha256").update(Buffer.from(sourceContent, "utf8")).digest("hex");
   const today = todayIso();
   const slug = slugify2(input.title);
   const tags = input.tags && input.tags.length > 0 ? input.tags : [];
@@ -5788,7 +5931,7 @@ async function runIngest(input, pagePublishDeps = defaultPagePublishDeps()) {
     path: rawAbsPath,
     sourceUrl,
     sourceContent,
-    sha256,
+    sha256: sha2562,
     today
   });
   if (!resolvedRaw.ok) {
@@ -5845,11 +5988,11 @@ async function runIngest(input, pagePublishDeps = defaultPagePublishDeps()) {
       result: ok({
         raw_path: rawRelPath,
         typed_path: typedRelPath,
-        sha256,
+        sha256: sha2562,
         dry_run: true,
         humanHint: [
           "DRY RUN \u2014 would create:",
-          `  ${rawRelPath} (sha256: ${sha256.slice(0, 12)}...)`,
+          `  ${rawRelPath} (sha256: ${sha2562.slice(0, 12)}...)`,
           `  ${typedRelPath}`,
           `  type: ${input.type}, tags: [${tags.join(", ")}]`,
           input.provenance ? `  provenance: ${input.provenance}` : ""
@@ -5877,7 +6020,7 @@ async function runIngest(input, pagePublishDeps = defaultPagePublishDeps()) {
         path: rawAbsPath,
         sourceUrl,
         sourceContent,
-        sha256,
+        sha256: sha2562,
         today,
         capture: resolvedRaw.data
       });
@@ -5944,11 +6087,11 @@ async function runIngest(input, pagePublishDeps = defaultPagePublishDeps()) {
         result: ok({
           raw_path: rawRelPath,
           typed_path: typedRelPath,
-          sha256,
+          sha256: sha2562,
           dry_run: false,
           humanHint: [
             "created:",
-            `  ${rawRelPath} (sha256: ${sha256.slice(0, 12)}...)`,
+            `  ${rawRelPath} (sha256: ${sha2562.slice(0, 12)}...)`,
             `  ${typedRelPath}`
           ].join("\n"),
           publication: published.result.data
@@ -8128,7 +8271,7 @@ function runSyncJournalClearStale(input) {
 
 // src/commands/snapshot-maintenance.ts
 import { existsSync as existsSync10, mkdirSync as mkdirSync4, appendFileSync } from "fs";
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 import { execSync as execSync3, spawn } from "child_process";
 import { platform as platform2 } from "os";
 import { join as join31, resolve as resolvePath2 } from "path";
@@ -8153,7 +8296,7 @@ function computeApprovalId(plan) {
     targets,
     normalizeReason(plan.operator_reason)
   ].join("|");
-  return "smap1-" + createHash6("sha256").update(payload).digest("hex").slice(0, 32);
+  return "smap1-" + createHash5("sha256").update(payload).digest("hex").slice(0, 32);
 }
 function normalizeReason(reason) {
   return reason.trim().replace(/\s+/g, " ");
@@ -8700,7 +8843,7 @@ async function runStatus(input) {
 }
 
 // src/commands/seed.ts
-import { mkdir as mkdir11, writeFile as writeFile9, stat as stat4 } from "fs/promises";
+import { mkdir as mkdir11, writeFile as writeFile8, stat as stat4 } from "fs/promises";
 import { join as join34 } from "path";
 var TODAY = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
 var EXAMPLE_PAGES = {
@@ -8783,7 +8926,7 @@ async function runSeed(input) {
       skipped.push(relPath);
     } catch {
       await mkdir11(join34(absPath, ".."), { recursive: true });
-      await writeFile9(absPath, content, "utf8");
+      await writeFile8(absPath, content, "utf8");
       created.push(relPath);
     }
   }
@@ -8793,7 +8936,7 @@ async function runSeed(input) {
     skipped.push("raw/articles/example-source.md");
   } catch {
     await mkdir11(join34(rawPath, ".."), { recursive: true });
-    await writeFile9(rawPath, EXAMPLE_RAW, "utf8");
+    await writeFile8(rawPath, EXAMPLE_RAW, "utf8");
     created.push("raw/articles/example-source.md");
   }
   if (created.length > 0) {
@@ -8815,7 +8958,7 @@ async function runSeed(input) {
 }
 
 // src/commands/canvas.ts
-import { readFile as readFile17, writeFile as writeFile10 } from "fs/promises";
+import { readFile as readFile17, writeFile as writeFile9 } from "fs/promises";
 import { existsSync as existsSync12 } from "fs";
 import { join as join35 } from "path";
 var NODE_WIDTH = 240;
@@ -8935,7 +9078,7 @@ async function runCanvasGenerate(input) {
   const canvas = { nodes, edges };
   const outPath = join35(input.vault, "vault-graph.canvas");
   try {
-    await writeFile10(outPath, JSON.stringify(canvas, null, 2));
+    await writeFile9(outPath, JSON.stringify(canvas, null, 2));
   } catch (e) {
     return {
       exitCode: ExitCode.WRITE_FAILED,
@@ -8954,11 +9097,252 @@ written: ${outPath}`
   };
 }
 
+// src/commands/source-disposition.ts
+async function runSourceDisposition(input) {
+  if (!input.write) {
+    const plan = await planSourceDisposition(input);
+    return { exitCode: plan.ok ? ExitCode.OK : ExitCode.USAGE, result: plan };
+  }
+  if (!input.approve) return { exitCode: ExitCode.USAGE, result: { ok: false, error: "APPROVAL_INVALID", detail: { message: "--write requires --approve" } } };
+  const applied = await applySourceDisposition({ ...input, approve: input.approve });
+  if (!applied.ok) return { exitCode: ExitCode.USAGE, result: applied };
+  return { exitCode: ExitCode.OK, result: ok({ ...applied.data, humanHint: `${input.status} recorded for ${input.rawPath}` }) };
+}
+
+// src/utils/source-disposal.ts
+import { createHash as createHash6 } from "crypto";
+import { readFile as readFile19, unlink as unlink5 } from "fs/promises";
+
+// src/utils/raw-asset-reference-index.ts
+import { readdir as readdir7, readFile as readFile18 } from "fs/promises";
+import { join as join36, relative as relative4, sep as sep3 } from "path";
+var PREVIEW_EXTENSIONS = /* @__PURE__ */ new Set(["png", "jpg", "jpeg", "gif", "webp", "svg", "bmp", "avif", "pdf", "mp3", "wav", "m4a", "mp4", "webm"]);
+async function walkFiles(root, dir = root) {
+  let entries;
+  try {
+    entries = await readdir7(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const entry of entries) {
+    const path = join36(dir, entry.name);
+    if (entry.isDirectory()) out.push(...await walkFiles(root, path));
+    else if (entry.isFile()) out.push(relative4(root, path).split(sep3).join("/"));
+  }
+  return out;
+}
+function supportedPreview(path) {
+  const ext = path.includes(".") ? path.slice(path.lastIndexOf(".") + 1).toLowerCase() : "";
+  return PREVIEW_EXTENSIONS.has(ext);
+}
+function addInbound(map, target, source) {
+  const refs = map.get(target) ?? /* @__PURE__ */ new Set();
+  refs.add(source);
+  map.set(target, refs);
+}
+async function buildRawAssetReferenceIndex(vault) {
+  const assetRoot = join36(vault, "raw", "assets");
+  const relativeAssets = await walkFiles(assetRoot);
+  const assets = relativeAssets.map((path) => `raw/assets/${path}`).sort((a, b) => a.localeCompare(b));
+  const assetSet = new Set(assets);
+  const byBasename = /* @__PURE__ */ new Map();
+  for (const asset of assets) {
+    const name = asset.slice(asset.lastIndexOf("/") + 1);
+    byBasename.set(name, [...byBasename.get(name) ?? [], asset]);
+  }
+  const scan = await scanVault(vault);
+  if (!scan.ok) return { assets, inbound: /* @__PURE__ */ new Map(), references: [] };
+  const inboundSets = /* @__PURE__ */ new Map();
+  const references = [];
+  for (const page of scan.data.allMarkdown) {
+    let text;
+    try {
+      text = await readFile18(page.absPath, "utf8");
+    } catch {
+      continue;
+    }
+    for (const match of text.matchAll(/!\[\[([^\]|#]+)(?:[|#][^\]]*)?\]\]/g)) {
+      const target = match[1].trim();
+      if (target.startsWith("raw/assets/")) {
+        const exists = assetSet.has(target);
+        references.push({ source_path: page.relPath, target, kind: "obsidian-embed", exists, preview_supported: supportedPreview(target) });
+        if (exists) addInbound(inboundSets, target, page.relPath);
+      } else if (!target.includes("/")) {
+        const candidates = (byBasename.get(target) ?? []).sort((a, b) => a.localeCompare(b));
+        if (candidates.length > 0) {
+          references.push({ source_path: page.relPath, target, kind: "ambiguous-embed", exists: candidates.length === 1, preview_supported: supportedPreview(target), candidates });
+          if (candidates.length === 1) addInbound(inboundSets, candidates[0], page.relPath);
+        }
+      }
+    }
+    for (const match of text.matchAll(/!\[[^\]]*\]\(([^)\s]+)(?:\s+"[^"]*")?\)/g)) {
+      const target = match[1].trim().replace(/^<|>$/g, "");
+      if (/^https?:\/\//i.test(target)) {
+        references.push({ source_path: page.relPath, target, kind: "external-image", exists: true, preview_supported: supportedPreview(new URL(target).pathname) });
+      } else if (target.startsWith("raw/assets/")) {
+        const exists = assetSet.has(target);
+        references.push({ source_path: page.relPath, target, kind: "markdown-image", exists, preview_supported: supportedPreview(target) });
+        if (exists) addInbound(inboundSets, target, page.relPath);
+      }
+    }
+  }
+  references.sort((a, b) => a.target.localeCompare(b.target) || a.source_path.localeCompare(b.source_path));
+  const inbound = new Map([...inboundSets.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([target, refs]) => [target, [...refs].sort()]));
+  return { assets, inbound, references };
+}
+
+// src/utils/source-disposal.ts
+function sha256(bytes) {
+  return createHash6("sha256").update(bytes).digest("hex");
+}
+function exactTarget(path) {
+  if (/[?*\[\]{}]/.test(path) || !path.includes("/") || path.endsWith("/")) return err("RAW_DISPOSAL_TARGET_INVALID", { path, message: "exact file path required; globs, basenames, and directories are refused" });
+  const classified = classifyRawPath(path);
+  if (!classified.ok) return classified;
+  return ok(true);
+}
+async function planSourceDisposal(input) {
+  const exact = exactTarget(input.rawPath);
+  if (!exact.ok) return exact;
+  const authorized = authorizeRawOperation({
+    operationClass: "destructive-remove",
+    trigger: "attended-apply",
+    source: input.rawPath,
+    explicitExactTarget: true
+  });
+  if (!authorized.ok) return authorized;
+  const reason = input.reason.normalize("NFC").trim();
+  if (!reason) return err("RAW_DISPOSAL_TARGET_INVALID", { field: "reason" });
+  const sensitive = scanSensitiveContent(reason);
+  if (sensitive.length > 0) return err("SENSITIVE_CONTENT_DETECTED", { findings: sensitive });
+  const target = await resolveExistingRegularFileInsideVault(input.vault, input.rawPath);
+  if (!target.ok) return err("RAW_DISPOSAL_TARGET_INVALID", { path: input.rawPath, cause: target });
+  const bytes = await readFile19(target.data);
+  const size = bytes.byteLength;
+  let typedReferences = [];
+  let otherReferences = [];
+  let assetInboundReferences = [];
+  if (input.rawPath.startsWith("raw/assets/")) {
+    const assets = await buildRawAssetReferenceIndex(input.vault);
+    assetInboundReferences = assets.inbound.get(input.rawPath) ?? [];
+  } else if (input.rawPath.endsWith(".md")) {
+    const scan = await scanVault(input.vault);
+    if (!scan.ok) return scan;
+    const typedPaths = new Set(scan.data.typedKnowledge.map((page) => page.relPath));
+    const relocations = await readSourceRelocations(input.vault);
+    if (!relocations.ok) return relocations;
+    const refs = await buildSourceReferenceIndex({
+      typedPages: scan.data.typedKnowledge,
+      otherPages: scan.data.allMarkdown.filter((page) => !typedPaths.has(page.relPath) && !page.relPath.startsWith("raw/")),
+      availableRawPaths: scan.data.raw.map((page) => page.relPath),
+      relocationProjection: buildSourceRelocationProjection(relocations.data)
+    });
+    typedReferences = refs.integratedBy.get(input.rawPath) ?? [];
+    otherReferences = refs.referencedElsewhereBy.get(input.rawPath) ?? [];
+  }
+  const completeHash = sha256(bytes);
+  const occurredAt = input.now ?? (/* @__PURE__ */ new Date()).toISOString();
+  const deleteIntentPath = `meta/delete-intents/${pathToIntentFilename(input.rawPath)}`;
+  const operation_id = operationId("source-disposal", [input.rawPath, completeHash, reason, ...typedReferences, ...otherReferences, ...assetInboundReferences]);
+  const base = {
+    raw_path: input.rawPath,
+    complete_sha256: completeHash,
+    size_bytes: size,
+    typed_references: typedReferences,
+    other_references: otherReferences,
+    asset_inbound_references: assetInboundReferences,
+    delete_intent_path: deleteIntentPath,
+    recoverability: "Recoverable only from Git/S3 history or another backup after deletion; the delete intent prevents automatic resurrection.",
+    reason,
+    operation_id,
+    occurred_at: occurredAt
+  };
+  return ok({ ...base, approval_token: encodeSourceActionApproval({ contract: "source-disposal/v1", ...base }), write: false });
+}
+async function applySourceDisposal(input) {
+  if (!input.attended) return err("RAW_DISPOSAL_ATTENDED_REQUIRED", { message: "permanent disposal is refused in scheduled/headless sessions" });
+  const authorized = authorizeRawOperation({
+    operationClass: "destructive-remove",
+    trigger: "attended-apply",
+    source: input.rawPath,
+    explicitExactTarget: true
+  });
+  if (!authorized.ok) return authorized;
+  const decoded = decodeSourceActionApproval(input.approve);
+  if (!decoded.ok) return decoded;
+  const occurredAt = typeof decoded.data.occurred_at === "string" ? decoded.data.occurred_at : void 0;
+  const planned = await planSourceDisposal({ vault: input.vault, rawPath: input.rawPath, reason: input.reason, now: occurredAt });
+  if (!planned.ok) return planned;
+  if (planned.data.approval_token !== input.approve) return err("APPROVAL_INVALID", { message: "source disposal approval does not match live target or references" });
+  const event = await writeLogEvent(input.vault, {
+    schema: "skillwiki-log-event/v1",
+    operation_id: planned.data.operation_id,
+    occurred_at: planned.data.occurred_at,
+    host_id: input.hostId ?? "local",
+    actor: input.actor ?? "skillwiki-cli",
+    kind: "source-disposal-approved",
+    target: input.rawPath,
+    note: input.reason,
+    metadata: {
+      raw_path: input.rawPath,
+      complete_sha256: planned.data.complete_sha256,
+      typed_references: planned.data.typed_references,
+      other_references: planned.data.other_references,
+      asset_inbound_references: planned.data.asset_inbound_references,
+      delete_intent_path: planned.data.delete_intent_path
+    }
+  });
+  if (!event.ok) return event;
+  const tombstonePath = await writeDeleteIntent(input.vault, buildDeleteIntent({
+    path: input.rawPath,
+    action: "remove",
+    actor: input.actor ?? "skillwiki-cli",
+    source: "cli",
+    reason: input.reason,
+    created: planned.data.occurred_at
+  }));
+  const target = await resolveExistingRegularFileInsideVault(input.vault, input.rawPath);
+  if (!target.ok) return err("APPROVAL_INVALID", { message: "source disposal target is no longer a safe exact file", cause: target });
+  await unlink5(target.data);
+  const completedOperationId = operationId("source-disposal-completed", [planned.data.operation_id]);
+  const completed = await writeLogEvent(input.vault, {
+    schema: "skillwiki-log-event/v1",
+    operation_id: completedOperationId,
+    occurred_at: planned.data.occurred_at,
+    host_id: input.hostId ?? "local",
+    actor: input.actor ?? "skillwiki-cli",
+    kind: "source-disposal-completed",
+    target: input.rawPath,
+    note: input.reason,
+    metadata: {
+      approval_operation_id: planned.data.operation_id,
+      raw_path: input.rawPath,
+      complete_sha256: planned.data.complete_sha256,
+      delete_intent_path: planned.data.delete_intent_path
+    }
+  });
+  if (!completed.ok) return completed;
+  return ok({ removed: input.rawPath, tombstone_path: tombstonePath, event_path: completed.data.path, operation_id: planned.data.operation_id });
+}
+
+// src/commands/source-disposal.ts
+async function runSourceDisposal(input) {
+  if (!input.write) {
+    const plan = await planSourceDisposal(input);
+    return { exitCode: plan.ok ? ExitCode.OK : ExitCode.USAGE, result: plan };
+  }
+  if (!input.approve) return { exitCode: ExitCode.USAGE, result: { ok: false, error: "APPROVAL_INVALID", detail: { message: "--write requires --approve" } } };
+  const applied = await applySourceDisposal({ ...input, approve: input.approve, attended: input.attended === true });
+  if (!applied.ok) return { exitCode: ExitCode.USAGE, result: applied };
+  return { exitCode: ExitCode.OK, result: ok({ ...applied.data, humanHint: `permanently disposed ${input.rawPath}; ${applied.data.tombstone_path}` }) };
+}
+
 // src/commands/fleet-health.ts
 import { existsSync as existsSync13, readFileSync as readFileSync16 } from "fs";
 import { execSync as nodeExecSync } from "child_process";
 import { hostname as nodeHostname, platform as nodePlatform } from "os";
-import { join as join36 } from "path";
+import { join as join37 } from "path";
 var SSH_TIMEOUT_MS = 15e3;
 var TIMER_UNIT = "agent-memory-trends.timer";
 var SERVICE_UNIT = "agent-memory-trends.service";
@@ -9188,7 +9572,7 @@ async function runFleetHealth(input) {
   const home = input.home ?? env.HOME ?? "";
   const osHostname = input.osHostname ?? env.HOSTNAME ?? nodeHostname();
   const vault = input.vault ?? env.WIKI_PATH;
-  const file = input.file ?? (vault ? join36(vault, FLEET_REL_PATH) : void 0);
+  const file = input.file ?? (vault ? join37(vault, FLEET_REL_PATH) : void 0);
   if (!file) {
     return {
       exitCode: ExitCode.NO_VAULT_CONFIGURED,
@@ -9237,7 +9621,7 @@ async function runFleetHealth(input) {
         healthy
       });
     } else {
-      if (!hasDeclaredSshAccess(t.host, localHostId, t.sshAlias)) {
+      if (!localHostId || !hasDeclaredSshAccess(t.host, localHostId, t.sshAlias)) {
         rows.push({
           host: t.id,
           timer: "unknown",
@@ -9273,14 +9657,14 @@ async function runFleetHealth(input) {
 
 // src/utils/auto-commit.ts
 import { existsSync as existsSync14 } from "fs";
-import { join as join37 } from "path";
+import { join as join38 } from "path";
 async function postCommit(vault, exitCode) {
   if (exitCode !== 0) return;
   const home = process.env.HOME ?? "";
   const dotenv = await parseDotenvFile(configPath(home));
   const autoCommit = process.env.AUTO_COMMIT ?? dotenv["AUTO_COMMIT"];
   if (autoCommit === "false") return;
-  if (!existsSync14(join37(vault, ".git"))) return;
+  if (!existsSync14(join38(vault, ".git"))) return;
   const lastOps = readLastOp(vault);
   if (lastOps.length === 0) return;
   const porcelain = git(vault, ["status", "--porcelain", "--", ...VAULT_COMMIT_PATHSPEC]);
@@ -9464,7 +9848,7 @@ program.command("validate <file>").description("validate vault page frontmatter
   emit(await runValidate({ file, apply: !!opts.apply, vault }), vault);
 });
 program.command("graph").description("graph subcommands").command("build <vault>").option("--out <path>", "graph output path (default: <vault>/.skillwiki/graph.json)").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
-  const out = opts.out ?? join38(vault, ".skillwiki", "graph.json");
+  const out = opts.out ?? join39(vault, ".skillwiki", "graph.json");
   return emitGuardedVaultWrite(vault, "graph build", () => runGraphBuild({ vault, out }));
 });
 var canvasCmd = program.command("canvas").description("manage Obsidian canvas files");
@@ -9478,10 +9862,76 @@ program.command("overlap [vault]").description("detect typed-knowledge pages tha
   if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
   else emit(await runOverlap({ vault: v.vault }), v.vault);
 });
-program.command("query <text> [vault]").description("score and rank vault pages by relevance to a query").option("--limit <n>", "max results to return", (s) => parseInt(s, 10), 10).option("--wiki <name>", "wiki profile name").action(async (text, vault, opts) => {
+program.command("query <text> [vault]").description("score and rank vault pages by relevance to a query").option("--limit <n>", "max results to return", (s) => parseInt(s, 10), 10).option("--include-pending", "include a separate pending-evidence channel").option("--wiki <name>", "wiki profile name").action(async (text, vault, opts) => {
   const v = await resolveVaultArg(vault, opts.wiki);
   if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
-  else emit(await runQuery({ text, vault: v.vault, limit: opts.limit }), v.vault);
+  else emit(await runQuery({ text, vault: v.vault, limit: opts.limit, includePending: opts.includePending }), v.vault, { postCommit: false });
+});
+var sourcesCmd = program.command("sources").description("inspect raw-source lifecycle state");
+sourcesCmd.command("pending [vault]").description("list captured articles and papers awaiting typed integration").option("--since <date>", "include sources captured on or after YYYY-MM-DD").option("--older-than <days>", "include sources at least this many days old", (s) => parseInt(s, 10)).option("--match <text>", "literal title, URL, or path match").option("--ingested-by <channel>", "manual, wiki-ingest, proj-work, or unknown").option("--scope <scope>", "articles, papers, or all", "all").option("--sort <order>", "newest or oldest", "newest").option("--limit <n>", "max items to return", (s) => parseInt(s, 10), 50).option("--all", "return the complete matching inventory").option("--include-integrated", "also return actively integrated sources").option("--include-archived", "also return raw/archived sources").option("--include-duplicates", "also return raw/duplicates sources").option("--include-legacy-archived", "also return legacy _archive/raw sources").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
+  const v = await resolveVaultArg(vault, opts.wiki);
+  if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
+  else emit(await runSourcesPending({
+    vault: v.vault,
+    since: opts.since,
+    olderThan: opts.olderThan,
+    match: opts.match,
+    ingestedBy: opts.ingestedBy,
+    scope: opts.scope,
+    sort: opts.sort,
+    limit: opts.limit,
+    all: opts.all,
+    includeIntegrated: opts.includeIntegrated,
+    includeArchived: opts.includeArchived,
+    includeDuplicates: opts.includeDuplicates,
+    includeLegacyArchived: opts.includeLegacyArchived
+  }), v.vault, { postCommit: false });
+});
+sourcesCmd.command("disposition <raw-path> [vault]").description("record an append-only editorial decision for an exact raw source").requiredOption("--status <status>", "reviewed-no-op, deferred, duplicate, out-of-scope, superseded, or reopened").requiredOption("--reason <text>", "editorial reason").option("--review-after <date>", "future review date for deferred").option("--duplicate-of <raw-path>", "canonical exact raw path for duplicate").option("--write", "write the approved disposition event").option("--approve <token>", "approve the exact state-bound disposition plan").option("--wiki <name>", "wiki profile name").action(async (rawPath, vault, opts) => {
+  const v = await resolveVaultArg(vault, opts.wiki);
+  if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
+  else if (!opts.write) emit(await runSourceDisposition({
+    vault: v.vault,
+    rawPath,
+    status: opts.status,
+    reason: opts.reason,
+    reviewAfter: opts.reviewAfter,
+    duplicateOf: opts.duplicateOf,
+    write: false
+  }), v.vault, { postCommit: false });
+  else return emitManagedVaultWrite(
+    v.vault,
+    "sources disposition",
+    (receipt) => runSourceDisposition({
+      vault: v.vault,
+      rawPath,
+      status: opts.status,
+      reason: opts.reason,
+      reviewAfter: opts.reviewAfter,
+      duplicateOf: opts.duplicateOf,
+      write: true,
+      approve: opts.approve
+    }),
+    { allowImmutableRecord: true }
+  );
+});
+sourcesCmd.command("dispose <raw-path> [vault]").description("permanently delete one exact raw object after an attended approved preview").requiredOption("--reason <text>", "permanent-disposal reason").option("--write", "apply the approved exact-target disposal").option("--approve <token>", "approve the exact state-bound disposal plan").option("--wiki <name>", "wiki profile name").action(async (rawPath, vault, opts) => {
+  const v = await resolveVaultArg(vault, opts.wiki);
+  if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
+  else if (!opts.write) emit(await runSourceDisposal({ vault: v.vault, rawPath, reason: opts.reason, write: false }), v.vault, { postCommit: false });
+  else return emitManagedVaultWrite(
+    v.vault,
+    "sources dispose",
+    () => runSourceDisposal({
+      vault: v.vault,
+      rawPath,
+      reason: opts.reason,
+      write: true,
+      approve: opts.approve,
+      attended: process.stdin.isTTY === true && process.stdout.isTTY === true
+    }),
+    { allowImmutableRecord: true }
+  );
 });
 program.command("orphans [vault]").description("find pages not referenced by any other page").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => emit(await runOrphans({
   vault,
@@ -9647,15 +10097,15 @@ program.command("topic-map-check [vault]").description("check whether a topic ma
   if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
   else emit(await runTopicMapCheck({ vault: v.vault, threshold: opts.threshold }), v.vault);
 });
-program.command("stale [vault]").description("identify stale transcripts and incomplete work items").option("--archive", "move stale items to _archive/", false).option("--days <n>", "staleness threshold in days", (s) => parseInt(s, 10), 3).option("--force-scan", "infer kind/project from filename and content when frontmatter is missing", false).option("--project <slug>", "scope to a single project").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
+program.command("stale [vault]").description("identify stale transcripts and incomplete work items").option("--archive", "preview lifecycle-first archives for stale items", false).option("--apply", "apply an approved stale archive preview", false).option("--approve <token>", "approve the exact state-bound stale archive plan").option("--days <n>", "staleness threshold in days", (s) => parseInt(s, 10), 3).option("--force-scan", "infer kind/project from filename and content when frontmatter is missing", false).option("--project <slug>", "scope to a single project").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
   const v = await resolveVaultArg(vault, opts.wiki);
   if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
-  else if (opts.archive) return emitGuardedVaultWrite(
+  else if (opts.archive && opts.apply) return emitManagedVaultWrite(
     v.vault,
     "stale --archive",
-    () => runStale({ vault: v.vault, days: opts.days, archive: true, forceScan: !!opts.forceScan, project: opts.project })
+    () => runStale({ vault: v.vault, days: opts.days, archive: true, apply: true, approve: opts.approve, forceScan: !!opts.forceScan, project: opts.project })
   );
-  else emit(await runStale({ vault: v.vault, days: opts.days, archive: false, forceScan: !!opts.forceScan, project: opts.project }), v.vault);
+  else emit(await runStale({ vault: v.vault, days: opts.days, archive: !!opts.archive, apply: false, forceScan: !!opts.forceScan, project: opts.project }), v.vault, { postCommit: false });
 });
 program.command("claim <transcript> [vault]").description("claim an unclaimed transcript by creating a work item with source: link").option("--project <slug>", "project slug (overrides transcript frontmatter)").option("--slug <slug>", "work-item slug (defaults to transcript filename without date/kind prefix)").option("--wiki <name>", "wiki profile name").action(async (transcript, vault, opts) => {
   const v = await resolveVaultArg(vault, opts.wiki);
@@ -9786,6 +10236,21 @@ projectionsCmd.command("repair-legacy [vault]").description("repair one supporte
 program.command("lint [vault]").description("run all vault health checks").option("--days <n>", "stale threshold", (s) => parseInt(s, 10), 90).option("--lines <n>", "pagesize threshold", (s) => parseInt(s, 10), 200).option("--log-threshold <n>", "log rotation threshold", (s) => parseInt(s, 10), 500).option("--fix", "auto-fix supported lint violations").option("--only <bucket>", "run only the specified lint bucket").option("--summary", "emit bounded bucket counts instead of full item arrays", false).option("--examples <n>", "example count per bucket in summary mode", (s) => parseInt(s, 10), 3).option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
   const v = await resolveVaultArg(vault, opts.wiki);
   if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
+  else if (opts.fix && opts.summary) return emitGuardedVaultWrite(
+    v.vault,
+    "lint --fix",
+    () => runLint({
+      vault: v.vault,
+      source: vault ? "flag" : void 0,
+      days: opts.days,
+      lines: opts.lines,
+      logThreshold: opts.logThreshold,
+      fix: true,
+      only: opts.only,
+      summary: true,
+      examplesLimit: opts.examples
+    })
+  );
   else if (opts.fix) return emitGuardedVaultWrite(
     v.vault,
     "lint --fix",
@@ -9797,8 +10262,7 @@ program.command("lint [vault]").description("run all vault health checks").optio
       logThreshold: opts.logThreshold,
       fix: true,
       only: opts.only,
-      summary: !!opts.summary,
-      examplesLimit: opts.summary ? opts.examples : void 0
+      summary: false
     })
   );
   else if (opts.summary) emit(await runLint({
@@ -9865,10 +10329,10 @@ program.command("status [vault]").description("output vault diagnostics").option
     langEnvValue: process.env.WIKI_LANG
   }), v.vault);
 });
-program.command("archive <page> [vault]").description("archive a typed-knowledge or raw page").option("--wiki <name>", "wiki profile name").option("--cascade", "scan vault for references (wikilinks + sources arrays); preview by default", false).option("--apply", "with --cascade: mutate sources arrays and archive (without --apply, --cascade is preview-only)", false).option("--remote <remote>", "rclone remote root to prune the archived source path, for example seaweed-wiki:cloud/wiki").option("--remote-delete", "delete the archived source path from the remote after local archive", false).option("--max-remote-deletes <n>", "maximum remote object deletes allowed", "1").action(async (page, vault, opts) => {
+program.command("archive <page> [vault]").description("archive a typed-knowledge or raw page").option("--wiki <name>", "wiki profile name").option("--cascade", "scan vault for references (wikilinks + sources arrays); preview by default", false).option("--apply", "with --cascade: mutate sources arrays and archive (without --apply, --cascade is preview-only)", false).option("--approve <token>", "approve an exact state-bound raw archive plan").option("--remote <remote>", "rclone remote root to prune the archived source path, for example seaweed-wiki:cloud/wiki").option("--remote-delete", "delete the archived source path from the remote after local archive", false).option("--max-remote-deletes <n>", "maximum remote object deletes allowed", "1").action(async (page, vault, opts) => {
   const v = await resolveVaultArg(vault, opts.wiki);
   if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
-  else if (opts.cascade && !opts.apply) emit(await runArchive({
+  else if (!opts.apply && (opts.cascade || String(page).startsWith("raw/"))) emit(await runArchive({
     vault: v.vault,
     page,
     cascade: true,
@@ -9885,6 +10349,7 @@ program.command("archive <page> [vault]").description("archive a typed-knowledge
       page,
       cascade: !!opts.cascade,
       apply: !!opts.apply,
+      approve: opts.approve,
       remote: opts.remote,
       remoteDelete: !!opts.remoteDelete,
       maxRemoteDeletes: Number.parseInt(opts.maxRemoteDeletes, 10)
@@ -9917,15 +10382,16 @@ program.command("drift [vault]").description("detect content drift in raw source
   );
   else emit(await runDrift({ vault: v.vault, apply: false, newSince: opts.new }), v.vault);
 });
-program.command("dedup [vault]").description("detect duplicate raw sources by sha256").option("--apply", "rewire citations and remove duplicate raw files", false).option("--canonical-policy <policy>", "canonical policy: stable-path or scan-order", "stable-path").option("--manifest-out <path>", "write raw dedup delete manifest before applying").option("--manifest-in <path>", "read existing raw dedup delete manifest for remote pruning").option("--remote <remote>", "rclone remote root, for example seaweed-wiki:cloud/wiki").option("--remote-delete", "delete manifest duplicate paths from the remote", false).option("--max-remote-deletes <n>", "maximum remote object deletes allowed", "50").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
+program.command("dedup [vault]").description("detect duplicate raw sources by sha256").option("--apply", "rewire citations and preserve duplicate raw files under raw/duplicates", false).option("--approve <token>", "approve the exact state-bound dedup plan").option("--canonical-policy <policy>", "canonical policy: stable-path or scan-order", "stable-path").option("--manifest-out <path>", "write raw dedup delete manifest before applying").option("--manifest-in <path>", "read existing raw dedup delete manifest for remote pruning").option("--remote <remote>", "rclone remote root, for example seaweed-wiki:cloud/wiki").option("--remote-delete", "delete manifest duplicate paths from the remote", false).option("--max-remote-deletes <n>", "maximum remote object deletes allowed", "50").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
   const v = await resolveVaultArg(vault, opts.wiki);
   if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
-  else if (opts.apply || opts.manifestOut) return emitGuardedVaultWrite(
+  else if (opts.apply || opts.manifestOut) return emitManagedVaultWrite(
     v.vault,
     opts.apply ? "dedup --apply" : "dedup --manifest-out",
     () => runDedup({
       vault: v.vault,
       apply: opts.apply,
+      approve: opts.approve,
       canonicalPolicy: opts.canonicalPolicy,
       manifestOut: opts.manifestOut,
       manifestIn: opts.manifestIn,
@@ -9937,6 +10403,7 @@ program.command("dedup [vault]").description("detect duplicate raw sources by sh
   else emit(await runDedup({
     vault: v.vault,
     apply: opts.apply,
+    approve: opts.approve,
     canonicalPolicy: opts.canonicalPolicy,
     manifestOut: opts.manifestOut,
     manifestIn: opts.manifestIn,