skillwiki 0.10.41 → 0.10.43

package/dist/{chunk-BS556WUE.js → chunk-APDMYPM6.js}

@@ -61,7 +61,8 @@ var ExitCode = {
   APPROVAL_INVALID: 56,
   APPROVAL_MISMATCH: 57,
   TARGET_DRIFT: 58,
-  RECOVERY_EVIDENCE_MISSING: 59
+  RECOVERY_EVIDENCE_MISSING: 59,
+  SYNC_PARTIAL_DECLINE: 60
 };
 
 // ../shared/src/json-output.ts

package/dist/{chunk-NDR2OY4K.js → chunk-BUHQMIOD.js}

@@ -6,7 +6,7 @@ import {
 import {
   renderRootIndex,
   writeRootIndexProjection
-} from "./chunk-QVO332CT.js";
+} from "./chunk-NL2MUWNF.js";
 import {
   CONFIG_KEYS,
   acquireOwnedSyncLock,
@@ -34,15 +34,15 @@ import {
   snapshotterAliasForLocalHost,
   toUndirectedWeighted,
   writeDotenv
-} from "./chunk-XRBUABGE.js";
+} from "./chunk-NPHRDXHD.js";
 import {
   atomicWriteText,
   prepareTypedPage
-} from "./chunk-IFMHQETQ.js";
+} from "./chunk-CTN66CDX.js";
 import {
   eventPathFor,
   writeLogEvent
-} from "./chunk-E3JBAURS.js";
+} from "./chunk-RPZIGMMH.js";
 import {
   CompoundSchema,
   ExitCode,
@@ -63,7 +63,7 @@ import {
   scanVault,
   splitFrontmatter,
   systemdPropertyFor
-} from "./chunk-BS556WUE.js";
+} from "./chunk-APDMYPM6.js";
 
 // src/commands/log-append.ts
 import { readFile, stat } from "fs/promises";
@@ -3211,6 +3211,7 @@ var HYGIENE_COMMANDS = /* @__PURE__ */ new Set([
   "doctor",
   "health",
   "lint",
+  "lint --fix",
   "status",
   "path",
   "fleet context",
@@ -4849,7 +4850,7 @@ async function runQuery(input) {
   }).filter((r) => r.score > 0).sort((a, b) => b.score - a.score || a.path.localeCompare(b.path)).slice(0, limit);
   let pendingSources;
   if (input.includePending) {
-    const { runSourcesPending } = await import("./sources-LIJAUXFU.js");
+    const { runSourcesPending } = await import("./sources-Z4VMD2YO.js");
     const pending = await runSourcesPending({
       vault: input.vault,
       match: input.text,

package/dist/{chunk-IFMHQETQ.js → chunk-CTN66CDX.js}

@@ -8,7 +8,7 @@ import {
   ok,
   scanSensitiveContent,
   scanVault
-} from "./chunk-BS556WUE.js";
+} from "./chunk-APDMYPM6.js";
 
 // src/utils/atomic-write.ts
 import { randomBytes } from "crypto";

package/dist/{chunk-JUUZJJIF.js → chunk-DHGHISVY.js}

@@ -8,7 +8,7 @@ import {
   readLogEvents,
   resolveExistingRegularFileInsideVault,
   writeLogEvent
-} from "./chunk-E3JBAURS.js";
+} from "./chunk-RPZIGMMH.js";
 import {
   ExitCode,
   RawSourceSchema,
@@ -19,7 +19,7 @@ import {
   scanSensitiveContent,
   scanVault,
   splitFrontmatter
-} from "./chunk-BS556WUE.js";
+} from "./chunk-APDMYPM6.js";
 
 // src/utils/source-lifecycle.ts
 import { basename } from "path";

package/dist/{chunk-LACQJ6RD.js → chunk-G5M65BHV.js}

@@ -22,12 +22,12 @@ import {
   runSyncLintDelta,
   runVaultSyncPullHelper,
   supersedeStaleReviewRequiredJournals
-} from "./chunk-XRBUABGE.js";
+} from "./chunk-NPHRDXHD.js";
 import {
   ExitCode,
   err,
   ok
-} from "./chunk-BS556WUE.js";
+} from "./chunk-APDMYPM6.js";
 
 // src/utils/managed-write-preflight.ts
 import { existsSync as existsSync3 } from "fs";
@@ -434,9 +434,15 @@ var STASH_AUDIT_CLASSIFICATIONS = [
 var STASH_AUDIT_FORMATS = ["wiki-sync", "vault-sync", "manual", "unknown"];
 var STASH_RECENT_MINUTES = 120;
 var MANAGED_WRITER_SPECS = [
-  ["wiki-push", /(?:^|[\s/\\])wiki-push(?:\.[a-z0-9_-]+)?(?:\s|$)/i],
-  ["rclone", /(?:^|[\s/\\])rclone(?:\.[a-z0-9_-]+)?(?:\s|$)/i],
-  ["vault-sync", /(?:^|[\s/\\])vault-sync(?:\.[a-z0-9_-]+)?(?:\s|$)/i]
+  // Real runner only: wiki-push.sh on Unix, wiki-push/wiki-push.exe as a
+  // Windows image name. Bare text mentions never match.
+  ["wiki-push", /(?:^wiki-push(?:\.exe)?$)|(?:wiki-push\.sh(?:\s|$))/i],
+  // Write verbs only on Unix; Windows image name only (tasklist exposes
+  // no arguments). Read-only verbs and `rclone mount` (FUSE consumer)
+  // never match.
+  ["rclone", /(?:^rclone(?:\.exe)?$)|(?:\brclone(?:\.exe)?\s+(?:copy|sync|move|delete|purge|deletefile|copyto|moveto|dedupe|mkdir|rmdir|rmdirs|touch|settier|bisync|copyurl)(?:\s|$))/i],
+  // Writing helper scripts on Unix; Windows image name only.
+  ["vault-sync", /(?:^vault-sync(?:\.exe)?$)|(?:wiki-(?:snapshot|pull-with-auto-resolve|git-repair-v3)\.sh(?:\s|$))/i]
 ];
 var MANAGED_WRITER_KINDS = MANAGED_WRITER_SPECS.map(([kind]) => kind);
 function classifyStash(ageMinutes, sessionId, currentSession) {

package/dist/{chunk-QVO332CT.js → chunk-NL2MUWNF.js}

@@ -3,11 +3,11 @@ import {
   ROOT_INDEX_SECTION_ORDER,
   atomicWriteText,
   buildRootIndexUniverse
-} from "./chunk-IFMHQETQ.js";
+} from "./chunk-CTN66CDX.js";
 import {
   err,
   ok
-} from "./chunk-BS556WUE.js";
+} from "./chunk-APDMYPM6.js";
 
 // src/utils/index-projection.ts
 import { readFile } from "fs/promises";

package/dist/{chunk-XRBUABGE.js → chunk-NPHRDXHD.js}

@@ -2,7 +2,7 @@
 import {
   atomicWriteText,
   buildRootIndexUniverse
-} from "./chunk-IFMHQETQ.js";
+} from "./chunk-CTN66CDX.js";
 import {
   authorizeRawOperation,
   buildSourceReferenceIndex,
@@ -22,7 +22,7 @@ import {
   resolveExistingRegularFileInsideVault,
   stripFencedBlocks,
   writeLogEvent
-} from "./chunk-E3JBAURS.js";
+} from "./chunk-RPZIGMMH.js";
 import {
   ExitCode,
   FleetManifestSchema,
@@ -40,7 +40,7 @@ import {
   scanVault,
   splitFrontmatter,
   vaultIoConcurrency
-} from "./chunk-BS556WUE.js";
+} from "./chunk-APDMYPM6.js";
 
 // src/utils/sync-lock.ts
 import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "fs";
@@ -2996,8 +2996,10 @@ async function fixPathTooLong(input) {
   ];
   for (const f of fixed) hintLines.push(`  ${f.from} -> ${f.to}`);
   for (const u of unresolved) hintLines.push(`  unresolved: ${u}`);
+  const nonRawUnresolved = unresolved.filter((p) => !p.startsWith("raw/"));
+  const rawUnresolved = unresolved.filter((p) => p.startsWith("raw/"));
   return {
-    exitCode: unresolved.length > 0 ? ExitCode.LINT_HAS_ERRORS : ExitCode.OK,
+    exitCode: nonRawUnresolved.length > 0 ? ExitCode.LINT_HAS_ERRORS : ExitCode.OK,
     result: ok({ fixed, unresolved, rewired, humanHint: hintLines.join("\n") })
   };
 }
@@ -4479,6 +4481,15 @@ ${newBody}`;
         if (remaining.length > 0) buckets.path_too_long = remaining;
         else delete buckets.path_too_long;
       }
+      if (buckets.path_too_long) {
+        const rawRemaining = buckets.path_too_long.filter((v) => v.relPath.startsWith("raw/"));
+        if (rawRemaining.length > 0) {
+          unresolved.push(...rawRemaining.map((v) => v.relPath));
+          const nonRaw = buckets.path_too_long.filter((v) => !v.relPath.startsWith("raw/"));
+          if (nonRaw.length > 0) buckets.path_too_long = nonRaw;
+          else delete buckets.path_too_long;
+        }
+      }
     }
     if (shouldFix("frontmatter_yaml_invalid") && buckets.frontmatter_yaml_invalid) {
       const invalidItems = buckets.frontmatter_yaml_invalid;

package/dist/{chunk-E3JBAURS.js → chunk-RPZIGMMH.js}

@@ -6,7 +6,7 @@ import {
   readPage,
   scanSensitiveContent,
   splitFrontmatter
-} from "./chunk-BS556WUE.js";
+} from "./chunk-APDMYPM6.js";
 
 // src/utils/log-events.ts
 import { mkdir, open, readFile, readdir } from "fs/promises";

package/dist/cli.js

@@ -39,7 +39,7 @@ import {
   scanConflictMarkerBlocksInText,
   snapshotterHealthChecks,
   upsertIndexEntry
-} from "./chunk-NDR2OY4K.js";
+} from "./chunk-BUHQMIOD.js";
 import {
   normalizeDistTag,
   readCache,
@@ -52,7 +52,7 @@ import {
   UNMANAGED_START,
   renderRootIndex,
   writeRootIndexProjection
-} from "./chunk-QVO332CT.js";
+} from "./chunk-NL2MUWNF.js";
 import {
   VAULT_COMMIT_PATHSPEC,
   runManagedWritePreflight,
@@ -64,7 +64,7 @@ import {
   runSyncStatus,
   runSyncUnlock,
   stageVaultContentChanges
-} from "./chunk-LACQJ6RD.js";
+} from "./chunk-G5M65BHV.js";
 import {
   FLEET_REL_PATH,
   acquireOwnedSyncLock,
@@ -127,12 +127,12 @@ import {
   supersedeStaleReviewRequiredJournals,
   taxonomyCommentForPage,
   writeDotenv
-} from "./chunk-XRBUABGE.js";
+} from "./chunk-NPHRDXHD.js";
 import {
   assertTargetInsideVault,
   atomicWriteText,
   prepareTypedPage
-} from "./chunk-IFMHQETQ.js";
+} from "./chunk-CTN66CDX.js";
 import {
   applySourceDisposition,
   decodeSourceActionApproval,
@@ -140,7 +140,7 @@ import {
   inventorySources,
   planSourceDisposition,
   runSourcesPending
-} from "./chunk-JUUZJJIF.js";
+} from "./chunk-DHGHISVY.js";
 import {
   authorizeRawOperation,
   buildSourceReferenceIndex,
@@ -156,7 +156,7 @@ import {
   resolveExistingRegularFileInsideVault,
   validateLogEvent,
   writeLogEvent
-} from "./chunk-E3JBAURS.js";
+} from "./chunk-RPZIGMMH.js";
 import {
   ExitCode,
   MetaSchema,
@@ -173,7 +173,7 @@ import {
   scanSensitiveContent,
   scanVault,
   splitFrontmatter
-} from "./chunk-BS556WUE.js";
+} from "./chunk-APDMYPM6.js";
 
 // src/cli.ts
 import { join as join38 } from "path";
@@ -1355,7 +1355,8 @@ async function runDerivedConflictResolution(input) {
   }
   const classes = paths.map((p) => ({ path: p, klass: classifyDerivedPath(p) }));
   const unknown = classes.filter((c) => c.klass === "unknown").map((c) => c.path);
-  if (unknown.length > 0) {
+  const derived = classes.filter((c) => c.klass !== "unknown");
+  if (unknown.length > 0 && derived.length === 0) {
     return {
       exitCode: ExitCode.SYNC_PULL_FAILED,
       result: ok({
@@ -1367,6 +1368,53 @@ async function runDerivedConflictResolution(input) {
       })
     };
   }
+  if (unknown.length > 0 && derived.length > 0) {
+    const snapshots2 = /* @__PURE__ */ new Map();
+    for (const { path } of derived) {
+      snapshots2.set(path, {
+        stage2: stageOid(vault, 2, path),
+        stage3: stageOid(vault, 3, path)
+      });
+    }
+    const staged2 = [];
+    try {
+      for (const { path, klass } of derived) {
+        const resolved = await resolveOne(vault, path, klass);
+        if (!resolved.ok) throw new Error(`${path}: ${resolved.error}`);
+        if (hasMarkers(path, resolved.data)) {
+          throw new Error(`${path}: conflict markers remain after resolve`);
+        }
+        writeFileSync2(join8(vault, path), resolved.data, "utf8");
+        execFileSync2("git", ["add", "--", path], { cwd: vault, stdio: ["pipe", "pipe", "pipe"] });
+        staged2.push(path);
+      }
+      return {
+        exitCode: ExitCode.SYNC_PARTIAL_DECLINE,
+        result: ok({
+          resolved: false,
+          resolved_paths: staged2,
+          unknown_paths: unknown,
+          rolled_back: false,
+          humanHint: `partial-decline: resolved ${staged2.length} derived path(s), ${unknown.length} unknown path(s) need manual review: ${unknown.join(", ")}`
+        })
+      };
+    } catch (error) {
+      for (const path of staged2) {
+        const snap = snapshots2.get(path);
+        if (snap) rollbackPath(vault, path, snap.stage2, snap.stage3);
+      }
+      return {
+        exitCode: ExitCode.SYNC_PULL_FAILED,
+        result: ok({
+          resolved: false,
+          resolved_paths: [],
+          unknown_paths: unknown,
+          rolled_back: true,
+          humanHint: `partial-decline resolve failed: ${String(error)}`
+        })
+      };
+    }
+  }
   const snapshots = /* @__PURE__ */ new Map();
   for (const { path } of classes) {
     snapshots.set(path, {
@@ -3429,7 +3477,7 @@ ${fmRewritten}
   }
   let indexUpdated = false;
   if (!isRaw) {
-    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-ZXFN5DT4.js");
+    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-RWF5M7U7.js");
     const before = await readFile7(join18(input.vault, "index.md"), "utf8").catch(() => "");
     const fullTarget = relPath.replace(/\.md$/, "");
     const bare = fullTarget.split("/").pop() ?? fullTarget;
@@ -3549,7 +3597,7 @@ async function runRemove(input) {
   if (relPath.endsWith(".md") && !relPath.startsWith("raw/")) {
     const { readFile: readFile20 } = await import("fs/promises");
     const { join: pathJoin } = await import("path");
-    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-ZXFN5DT4.js");
+    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-RWF5M7U7.js");
     const before = await readFile20(pathJoin(input.vault, "index.md"), "utf8").catch(() => "");
     const fullTarget = relPath.replace(/\.md$/, "");
     const bare = fullTarget.split("/").pop() ?? fullTarget;
@@ -9494,7 +9542,7 @@ async function emitManagedVaultWrite(vault, command, mutate, opts) {
   if (dirty) {
     return emit(dirty, void 0, { postCommit: false });
   }
-  const { runManagedWriteTransaction: runManagedWriteTransaction2 } = await import("./managed-write-preflight-ANQPMOF4.js");
+  const { runManagedWriteTransaction: runManagedWriteTransaction2 } = await import("./managed-write-preflight-ZDBELXAM.js");
   const run = await runManagedWriteTransaction2({
     vault,
     command,

package/dist/{index-projection-ZXFN5DT4.js → index-projection-RWF5M7U7.js}

@@ -4,9 +4,9 @@ import {
   UNMANAGED_START,
   renderRootIndex,
   writeRootIndexProjection
-} from "./chunk-QVO332CT.js";
-import "./chunk-IFMHQETQ.js";
-import "./chunk-BS556WUE.js";
+} from "./chunk-NL2MUWNF.js";
+import "./chunk-CTN66CDX.js";
+import "./chunk-APDMYPM6.js";
 export {
   UNMANAGED_END,
   UNMANAGED_START,

package/dist/{managed-write-preflight-ANQPMOF4.js → managed-write-preflight-ZDBELXAM.js}

@@ -2,11 +2,11 @@
 import {
   runManagedWritePreflight,
   runManagedWriteTransaction
-} from "./chunk-LACQJ6RD.js";
-import "./chunk-XRBUABGE.js";
-import "./chunk-IFMHQETQ.js";
-import "./chunk-E3JBAURS.js";
-import "./chunk-BS556WUE.js";
+} from "./chunk-G5M65BHV.js";
+import "./chunk-NPHRDXHD.js";
+import "./chunk-CTN66CDX.js";
+import "./chunk-RPZIGMMH.js";
+import "./chunk-APDMYPM6.js";
 export {
   runManagedWritePreflight,
   runManagedWriteTransaction

package/dist/skillwiki-mcp.js

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import {
   runSkillwikiMcpStdio
-} from "./chunk-NDR2OY4K.js";
+} from "./chunk-BUHQMIOD.js";
 import "./chunk-7I2TPIV5.js";
-import "./chunk-QVO332CT.js";
-import "./chunk-XRBUABGE.js";
-import "./chunk-IFMHQETQ.js";
-import "./chunk-E3JBAURS.js";
-import "./chunk-BS556WUE.js";
+import "./chunk-NL2MUWNF.js";
+import "./chunk-NPHRDXHD.js";
+import "./chunk-CTN66CDX.js";
+import "./chunk-RPZIGMMH.js";
+import "./chunk-APDMYPM6.js";
 
 // src/mcp-entry.ts
 runSkillwikiMcpStdio().catch((error) => {

package/dist/sources-Z4VMD2YO.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import {
+  runSourcesPending
+} from "./chunk-DHGHISVY.js";
+import "./chunk-RPZIGMMH.js";
+import "./chunk-APDMYPM6.js";
+export {
+  runSourcesPending
+};

package/dist/vault-sync/scripts/wiki-pull-with-auto-resolve.sh

@@ -199,28 +199,64 @@ verify_no_tracked_conflict_markers() {
 # Composite derived-artifact resolver (log, root index, project index, taxonomy).
 # Delegates the complete conflict set to skillwiki sync resolve-derived; no
 # blanket checkout --ours for archive/snapshot mixed sets.
+#
+# M4: Returns 0 on full resolve (all paths resolved), 60 on partial-decline
+# (derived subset resolved, unknown paths remain), 1 on failure/decline.
+# On partial-decline (60), sets RESOLVED_PATHS to the newline-separated list
+# of paths the resolver actually rewrote (for the inventory skip set).
 try_auto_resolve_derived_conflicts() {
     local op_id="$1"
     local cli_ts="${SCRIPT_DIR}/../../cli/src/cli.ts"
     local cmd_rc=1
+    local resolver_out
+    RESOLVED_PATHS=""
     if [ -z "$op_id" ]; then
         return 1
     fi
     # Prefer monorepo CLI when present (packaged install uses adjacent dist later).
     if [ -f "$cli_ts" ] && command -v npx >/dev/null 2>&1; then
-        if VAULT_SYNC_OPERATION_ID="$op_id" \
-          npx --yes tsx "$cli_ts" sync resolve-derived "$WIKI_DIR" --operation-id "$op_id" >>"$LOG_FILE" 2>&1; then
+        resolver_out="$(VAULT_SYNC_OPERATION_ID="$op_id" \
+          npx --yes tsx "$cli_ts" sync resolve-derived "$WIKI_DIR" --operation-id "$op_id" 2>>"$LOG_FILE")"
+        cmd_rc=$?
+        printf '%s\n' "$resolver_out" >>"$LOG_FILE"
+        if [ "$cmd_rc" -eq 0 ]; then
             log "AUTO-RESOLVE composite derived artifacts op=$op_id"
             return 0
+        elif [ "$cmd_rc" -eq 60 ]; then
+            RESOLVED_PATHS="$(printf '%s\n' "$resolver_out" | python3 -c '
+import json,sys
+try:
+    d=json.load(sys.stdin)
+    data=d.get("data") or {}
+    for p in (data.get("resolved_paths") or []):
+        print(p)
+except: pass
+' 2>/dev/null)"
+            log "PARTIAL-RESOLVE derived artifacts op=$op_id unknowns remain"
+            return 60
         fi
-        cmd_rc=$?
         log "WARN monorepo resolve-derived failed rc=$cmd_rc op=$op_id"
     fi
     if command -v skillwiki >/dev/null 2>&1; then
-        if VAULT_SYNC_OPERATION_ID="$op_id" \
-          skillwiki sync resolve-derived "$WIKI_DIR" --operation-id "$op_id" >>"$LOG_FILE" 2>&1; then
+        resolver_out="$(VAULT_SYNC_OPERATION_ID="$op_id" \
+          skillwiki sync resolve-derived "$WIKI_DIR" --operation-id "$op_id" 2>>"$LOG_FILE")"
+        cmd_rc=$?
+        printf '%s\n' "$resolver_out" >>"$LOG_FILE"
+        if [ "$cmd_rc" -eq 0 ]; then
             log "AUTO-RESOLVE composite derived artifacts op=$op_id (skillwiki)"
             return 0
+        elif [ "$cmd_rc" -eq 60 ]; then
+            RESOLVED_PATHS="$(printf '%s\n' "$resolver_out" | python3 -c '
+import json,sys
+try:
+    d=json.load(sys.stdin)
+    data=d.get("data") or {}
+    for p in (data.get("resolved_paths") or []):
+        print(p)
+except: pass
+' 2>/dev/null)"
+            log "PARTIAL-RESOLVE derived artifacts op=$op_id unknowns remain (skillwiki)"
+            return 60
         fi
     fi
     return 1
@@ -588,6 +624,26 @@ while [ $REBASE_RC -ne 0 ]; do
         continue
     fi
 
+    # M4: Partial-decline — derived subset resolved, unknown paths remain.
+    # The unknown paths must go through the manual-conflict path (retry/handoff).
+    # The derived paths are already git-added; rebase --continue will fail on
+    # the remaining unknowns, so we go straight to handle_manual_conflict.
+    if [ "$?" -eq 60 ]; then
+        local unknown_conflicts
+        unknown_conflicts="$(git diff --name-only --diff-filter=U 2>/dev/null)"
+        if [ -n "$unknown_conflicts" ]; then
+            STOPPED_SHA=$(cat "$WIKI_DIR/.git/rebase-merge/stopped-sha" 2>/dev/null || echo "")
+            if [ -z "$STOPPED_SHA" ]; then
+                vault_sync_op_mark_review_required "$WIKI_DIR" "$OP_ID" "missing-stopped-sha-partial"
+                log "WARN cannot determine stopped-sha — surfacing partial-decline conflicts"
+                exit 1
+            fi
+            COMMIT_MSG=$(git log --format=%s -1 "$STOPPED_SHA" 2>/dev/null || echo "")
+            handle_manual_conflict "$COMMIT_MSG" "$unknown_conflicts"
+            continue
+        fi
+    fi
+
     # Composite resolver declined (unknown paths or failure). Manual path:
     # one owned stale-target retry, else handoff — no blanket --ours.
     STOPPED_SHA=$(cat "$WIKI_DIR/.git/rebase-merge/stopped-sha" 2>/dev/null || echo "")
@@ -634,6 +690,33 @@ if [ -n "$OWNED_STASH_OID" ]; then
 
       vault_sync_op_stash_drop_owned "$WIKI_DIR" "$OWNED_STASH_OID" 2>>"$LOG_FILE" || true
       log "STASH apply derived conflicts auto-resolved"
+    elif [ -n "$CONFLICTS" ] && [ "$?" -eq 60 ]; then
+      # M4: Partial-decline during stash-apply. The resolver resolved the
+      # derived subset and returned resolved_paths. Unknown paths remain
+      # conflicted — surface as review-required.
+      if [ -n "$(git diff --name-only --diff-filter=U 2>/dev/null)" ]; then
+        vault_sync_op_mark_review_required "$WIKI_DIR" "$OP_ID" "stash-restore-partial-decline"
+        log "FAIL stash apply partial-decline left unknown conflicts"
+        exit 1
+      fi
+      # Merge resolved_paths (from the resolver) into the skip set so the
+      # inventory byte-equality check does not fail on content-transformed
+      # derived paths. The conflict set alone is insufficient because the
+      # resolver regenerates derived files that may not have been in the
+      # stash-apply conflict set (derived-conflicts.ts:100-134).
+      SKIP_CONTENT="$(printf '%s\n' $CONFLICTS)"
+      if [ -n "${RESOLVED_PATHS:-}" ]; then
+        SKIP_CONTENT="${SKIP_CONTENT}
+${RESOLVED_PATHS}"
+      fi
+      if ! vault_sync_op_verify_inventory "$WIKI_DIR" "$OP_ID" "$OWNED_STASH_OID" "$SKIP_CONTENT" 2>>"$LOG_FILE"; then
+        vault_sync_op_mark_review_required "$WIKI_DIR" "$OP_ID" "inventory-verify-failed-partial"
+        log "FAIL inventory verification after partial-decline oid=$OWNED_STASH_OID"
+        exit 1
+      fi
+
+      vault_sync_op_stash_drop_owned "$WIKI_DIR" "$OWNED_STASH_OID" 2>>"$LOG_FILE" || true
+      log "STASH apply partial-decline resolved derived subset"
     else
       vault_sync_op_mark_review_required "$WIKI_DIR" "$OP_ID" "semantic-conflict"
       log "FAIL stash apply after rebase oid=$OWNED_STASH_OID"

package/dist/vault-sync/scripts/wiki-push.sh

@@ -44,11 +44,72 @@ PUSH_DEDUP_DISABLE="${WIKI_PUSH_FAIL_DEDUP_DISABLE:-0}"
 PUSH_DEDUP_COOLDOWN_SECONDS="${WIKI_PUSH_FAIL_DEDUP_COOLDOWN_SECONDS:-900}"
 PUSH_DEDUP_STATE_FILE="$(platform_cache_dir)/wiki-push-fail-dedup.state"
 PUSH_DEDUP_PAUSE_MARKER="$(platform_cache_dir)/wiki-push.paused"
+# M3: durable terminal-state file for health checks. Survives log rotation
+# (1 MB x5) and is readable by status.sh / doctor at any time. Records the
+# outcome of the most recent push attempt: OK or refused+reason.
+PUSH_RESULT_FILE="$(platform_cache_dir)/wiki-push-result.state"
 
-mkdir -p "$(dirname "$LOCK_FILE")" "$(dirname "$LOG_FILE")"
+mkdir -p "$(dirname "$LOCK_FILE")" "$(dirname "$LOG_FILE")" "$(dirname "$PUSH_RESULT_FILE")"
 
 log() { printf '%s %s\n' "$(date -u +%FT%TZ)" "$*" >>"$LOG_FILE"; }
 
+# M3: Write a machine-readable push result record. This is the durable
+# terminal-state file that status.sh / doctor read to determine push health.
+# Format: key=value lines (same .env convention as operation journals).
+#   result=ok|refused
+#   reason=<refuse class, or empty for ok>
+#   timestamp=<ISO 8601 UTC>
+#   duration=<seconds, or empty>
+write_push_result() {
+    local result="$1" reason="$2" duration="${3:-}"
+    local ts
+    ts="$(date -u +%FT%TZ)"
+    {
+        printf 'result=%s\n' "$result"
+        printf 'reason=%s\n' "$reason"
+        printf 'timestamp=%s\n' "$ts"
+        if [ -n "$duration" ]; then
+            printf 'duration=%s\n' "$duration"
+        fi
+    } > "$PUSH_RESULT_FILE" 2>/dev/null || true
+}
+
+# M3: Unified refuse handler. Logs the FAIL line, writes the terminal-state
+# record, runs the P1 dedup cooldown check (wired to ALL refuse classes, not
+# just conflict markers), and exits non-zero so the scheduler/monitoring can
+# see the refusal. The P1 dedup suppresses duplicate FAIL lines within the
+# cooldown window and escalates to a pause marker when the cooldown expires.
+#
+# Exit codes: 1 for guard refusals (the launchd plist uses StartInterval, not
+# KeepAlive, so non-zero exits are pure signal -- no backoff/disable loops).
+refuse_push() {
+    local reason="$1" message="$2"
+    local dedup_state
+    dedup_state="$(push_dedup_cooldown_check)"
+    case "$dedup_state" in
+        first)
+            log "FAIL $message"
+            push_dedup_touch_state
+            ;;
+        expired)
+            log "FAIL $message"
+            log "cooldown expired — pausing push (refusal persists past ${PUSH_DEDUP_COOLDOWN_SECONDS}s)"
+            push_dedup_write_pause_marker
+            push_dedup_touch_state
+            ;;
+        cooldown)
+            # Within cooldown: suppress the duplicate FAIL line. The first
+            # FAIL line in the incident is already logged; subsequent
+            # invocations within the cooldown are silent.
+            ;;
+        disabled)
+            log "FAIL $message"
+            ;;
+    esac
+    write_push_result "refused" "$reason"
+    exit 1
+}
+
 # Terminal-state check: if the pause marker exists from a prior incident,
 # the launchd job is already unloaded. Honor the pause — log once and exit
 # without re-scanning or re-attempting the push. The user clears this by
@@ -117,40 +178,10 @@ conflict_marker_guard() {
     local findings
     findings="$(mktemp)" || { log "FAIL could not create conflict-marker scan temp file"; return 1; }
     if ! vault_sync_scan_conflict_markers "$WIKI_DIR" "$findings"; then
-        local dedup_state
-        dedup_state="$(push_dedup_cooldown_check)"
-        case "$dedup_state" in
-            first)
-                # First detection: log the FAIL line, mark the state file so
-                # subsequent invocations within the cooldown window are silent.
-                log "FAIL conflict marker blocks present; refusing S3 push"
-                vault_sync_log_conflict_marker_findings "$findings" "$LOG_FILE"
-                push_dedup_touch_state
-                ;;
-            expired)
-                # Past the cooldown: log the FAIL line + escalation notice,
-                # write the pause marker, refresh the state file so the next
-                # cooldown starts from this moment.
-                log "FAIL conflict marker blocks present; refusing S3 push"
-                vault_sync_log_conflict_marker_findings "$findings" "$LOG_FILE"
-                log "cooldown expired — pausing push (markers persist past ${PUSH_DEDUP_COOLDOWN_SECONDS}s)"
-                push_dedup_write_pause_marker
-                push_dedup_touch_state
-                ;;
-            cooldown)
-                # Within cooldown: suppress the duplicate FAIL line. The first
-                # FAIL line in the incident (state=first) is already logged;
-                # subsequent invocations within the cooldown are silent.
-                ;;
-            disabled)
-                # Dedup is off: log the FAIL line (legacy behavior), do not
-                # touch any state file or pause marker.
-                log "FAIL conflict marker blocks present; refusing S3 push"
-                vault_sync_log_conflict_marker_findings "$findings" "$LOG_FILE"
-                ;;
-        esac
+        # M3: delegate to the unified refuse_push handler (dedup + result file + non-zero exit).
+        vault_sync_log_conflict_marker_findings "$findings" "$LOG_FILE"
         rm -f "$findings"
-        return 1
+        refuse_push "conflict-markers" "conflict marker blocks present; refusing S3 push"
     fi
     push_dedup_clear_state
     rm -f "$findings"
@@ -327,19 +358,16 @@ fi
 
 # Guard: wiki dir present.
 if [ ! -d "$WIKI_DIR" ]; then
-    log "ERROR: WIKI_DIR not found at $WIKI_DIR"
-    exit 0
+    refuse_push "wiki-dir-missing" "WIKI_DIR not found at $WIKI_DIR"
 fi
 
 # Guard: filter file present (it's not strictly required, but missing it would push .git/).
 if [ ! -f "$FILTERS" ]; then
-    log "ERROR: filter file missing at $FILTERS — refusing to push without exclusions"
-    exit 0
+    refuse_push "filter-file-missing" "filter file missing at $FILTERS -- refusing to push without exclusions"
 fi
 # Projection-authority transport: non-authority leaves must not push root aggregates.
 if ! grep -qxF -- '- /index.md' "$FILTERS" || ! grep -qxF -- '- /log.md' "$FILTERS"; then
-    log "ERROR: filter file missing root aggregate exclusions (- /index.md and - /log.md)"
-    exit 1
+    refuse_push "filter-root-aggregate-missing" "filter file missing root aggregate exclusions (- /index.md and - /log.md)"
 fi
 
 # Acquire lockfile (non-blocking).
@@ -355,9 +383,8 @@ fi
 START=$(date +%s)
 
 if ! CASE_CONFLICTS=$(cd "$WIKI_DIR" && git_case_conflicts); then
-    log "ERROR: case-only path collision detected — refusing rclone push"
     printf '%s\n' "$CASE_CONFLICTS" >>"$LOG_FILE"
-    exit 0
+    refuse_push "case-collision" "case-only path collision detected -- refusing rclone push"
 fi
 
 # Fix Windows-hostile markdown paths before publishing to S3.
@@ -368,17 +395,13 @@ if command -v skillwiki >/dev/null 2>&1; then
     PATH_FIX_RC=$?
     printf '%s\n' "$PATH_FIX_OUTPUT" >>"$LOG_FILE"
     if [ "$PATH_FIX_RC" -ne 0 ]; then
-        log "ERROR: path_too_long fix failed exit=$PATH_FIX_RC — refusing rclone push"
-        exit 0
+        refuse_push "path-fix-failed" "path_too_long fix failed exit=$PATH_FIX_RC -- refusing rclone push"
     fi
 else
-    log "ERROR: skillwiki CLI not found — refusing push because path_too_long guard cannot run"
-    exit 0
+    refuse_push "skillwiki-not-found" "skillwiki CLI not found -- refusing push because path_too_long guard cannot run"
 fi
 
-if ! conflict_marker_guard; then
-    exit 1
-fi
+conflict_marker_guard
 
 # Lint delta gate: block S3 publication only on newly introduced lint errors.
 # Inherited debt is logged. Malformed/missing delta evidence fails closed.
@@ -402,20 +425,17 @@ except Exception:
     print("DELTA_RESOLVED=-1")
 ' 2>/dev/null)" || { DELTA_FULL=-1; DELTA_BASE=-1; DELTA_NEW=-1; DELTA_RESOLVED=-1; }
     if [ "${DELTA_NEW:--1}" = "-1" ] || [ "${DELTA_FULL:--1}" = "-1" ]; then
-        log "FAIL lint-delta evidence missing or malformed — refusing S3 push"
-        exit 1
+        refuse_push "lint-delta-malformed" "lint-delta evidence missing or malformed -- refusing S3 push"
     fi
     log "LINT-DELTA full=$DELTA_FULL base=$DELTA_BASE new=$DELTA_NEW resolved=$DELTA_RESOLVED"
     if [ "$DELTA_NEW" -gt 0 ]; then
-        log "FAIL lint-delta new_errors=$DELTA_NEW blocks S3 push (full=$DELTA_FULL)"
-        exit 1
+        refuse_push "lint-delta-new-errors" "lint-delta new_errors=$DELTA_NEW blocks S3 push (full=$DELTA_FULL)"
     fi
     if [ "$DELTA_FULL" -gt 0 ]; then
         log "WARN inherited lint debt full_errors=$DELTA_FULL (new_errors=0) — push allowed"
     fi
 else
-    log "FAIL skillwiki CLI not found — lint-delta gate cannot run; refusing S3 push"
-    exit 1
+    refuse_push "skillwiki-not-found" "skillwiki CLI not found -- lint-delta gate cannot run; refusing S3 push"
 fi
 
 # rclone copy (NOT sync) → never bulk-deletes on remote.
@@ -449,9 +469,11 @@ if [ "$RC" -eq 0 ]; then
     else
         log "OK push (no changes) duration=${DURATION}s"
     fi
+    write_push_result "ok" "" "$DURATION"
 else
     log "FAIL rclone exit=$RC duration=${DURATION}s"
     printf '%s\n' "$OUTPUT" >>"$LOG_FILE"
+    write_push_result "refused" "rclone-failed" "$DURATION"
 fi
 
 if [ "$RC" -eq 0 ]; then
@@ -468,4 +490,10 @@ if [ "$RC" -eq 0 ]; then
     rm -f "$PUSH_DEDUP_PAUSE_MARKER" 2>/dev/null || true
 fi
 
+# M3: exit non-zero on rclone failure so the scheduler/monitoring sees it.
+# The launchd plist uses StartInterval (not KeepAlive), so non-zero exits
+# are pure signal -- no backoff/disable loops.
+if [ "$RC" -ne 0 ]; then
+    exit 1
+fi
 exit 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.41",
+  "version": "0.10.43",
   "type": "module",
   "bin": {
     "skillwiki": "dist/cli.js",

package/skills/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.41",
+  "version": "0.10.43",
   "skills": "./",
   "description": "Project-aware Karpathy-style knowledge base for Claude Code: 19 prompt-only skills (wiki-*, proj-*, using-skillwiki) backed by the deterministic `skillwiki` CLI.",
   "author": {

package/skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.41",
+  "version": "0.10.43",
   "description": "Project-aware Karpathy-style knowledge base for Codex with 19 prompt-only skills backed by the deterministic skillwiki CLI.",
   "author": {
     "name": "karlorz",

package/skills/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skillwiki/skills",
-  "version": "0.10.41",
+  "version": "0.10.43",
   "private": true,
   "files": [
     "wiki-*",

package/dist/sources-LIJAUXFU.js

@@ -1,9 +0,0 @@
-#!/usr/bin/env node
-import {
-  runSourcesPending
-} from "./chunk-JUUZJJIF.js";
-import "./chunk-E3JBAURS.js";
-import "./chunk-BS556WUE.js";
-export {
-  runSourcesPending
-};