skillwiki 0.10.6 → 0.10.8

package/dist/{chunk-NJFCTMYZ.js → chunk-AVCGIWSL.js}

@@ -32,7 +32,7 @@ import {
   satelliteGateFromFleetLoad,
   snapshotterAliasForLocalHost,
   writeDotenv
-} from "./chunk-R6BKJWVC.js";
+} from "./chunk-TYN2IHBY.js";
 import {
   CompoundSchema,
   ExitCode,
@@ -47,8 +47,9 @@ import {
 } from "./chunk-C5OLZRRM.js";
 
 // src/commands/log-append.ts
-import { readFile, stat } from "fs/promises";
-import { join as join3 } from "path";
+import { readFile as readFile2, stat } from "fs/promises";
+import { hostname } from "os";
+import { join as join4 } from "path";
 
 // src/utils/last-op.ts
 import { readFileSync, writeFileSync, mkdirSync, unlinkSync, existsSync } from "fs";
@@ -159,36 +160,187 @@ function releaseLogLock(handle) {
   }
 }
 
+// src/utils/log-events.ts
+import { mkdir, open, readFile, readdir } from "fs/promises";
+import { join as join3 } from "path";
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function canonicalize(value) {
+  if (Array.isArray(value)) return value.map(canonicalize);
+  if (!isPlainObject(value)) return value;
+  const out = {};
+  for (const key of Object.keys(value).sort()) {
+    out[key] = canonicalize(value[key]);
+  }
+  return out;
+}
+function eventPathFor(event) {
+  const day = event.occurred_at.slice(0, 10);
+  return `meta/log-events/${day}/${event.operation_id}.json`;
+}
+function validateLogEvent(event) {
+  if (event.schema !== "skillwiki-log-event/v1") {
+    return err("SCHEME_REJECTED", { message: "invalid event schema" });
+  }
+  if (!/^[0-9a-f]{64}$/.test(event.operation_id)) {
+    return err("SCHEME_REJECTED", { message: "operation_id must be 64 hex chars" });
+  }
+  if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(event.occurred_at)) {
+    return err("SCHEME_REJECTED", { message: "occurred_at must be UTC ISO with milliseconds" });
+  }
+  for (const field of ["host_id", "actor", "kind", "target", "note"]) {
+    const v = event[field];
+    if (typeof v !== "string" || v.trim().length === 0 || v.length > 500) {
+      return err("SCHEME_REJECTED", { message: `invalid ${field}` });
+    }
+  }
+  if (!isPlainObject(event.metadata)) {
+    return err("SCHEME_REJECTED", { message: "metadata must be a plain object" });
+  }
+  const sensitive = scanSensitiveContent(JSON.stringify(event));
+  if (sensitive.length > 0) {
+    return err("SENSITIVE_CONTENT_DETECTED", { findings: sensitive });
+  }
+  return ok({
+    schema: "skillwiki-log-event/v1",
+    operation_id: event.operation_id,
+    occurred_at: event.occurred_at,
+    host_id: event.host_id,
+    actor: event.actor,
+    kind: event.kind,
+    target: event.target,
+    note: event.note,
+    metadata: canonicalize(event.metadata)
+  });
+}
+function canonicalEventJson(event) {
+  const ordered = {
+    schema: event.schema,
+    operation_id: event.operation_id,
+    occurred_at: event.occurred_at,
+    host_id: event.host_id,
+    actor: event.actor,
+    kind: event.kind,
+    target: event.target,
+    note: event.note,
+    metadata: event.metadata
+  };
+  return `${JSON.stringify(ordered, null, 2)}
+`;
+}
+async function writeLogEvent(vault, event) {
+  const validated = validateLogEvent(event);
+  if (!validated.ok) return validated;
+  const rel = eventPathFor(validated.data);
+  const abs = join3(vault, rel);
+  await mkdir(join3(vault, "meta", "log-events", validated.data.occurred_at.slice(0, 10)), {
+    recursive: true
+  });
+  const body = canonicalEventJson(validated.data);
+  try {
+    const handle = await open(abs, "wx");
+    try {
+      await handle.writeFile(body, "utf8");
+    } finally {
+      await handle.close();
+    }
+    return ok({ path: rel, created: true });
+  } catch (error) {
+    if (error.code === "EEXIST") {
+      let existing;
+      try {
+        existing = await readFile(abs, "utf8");
+      } catch (readErr) {
+        return err("WRITE_FAILED", { path: rel, message: String(readErr) });
+      }
+      if (existing === body) return ok({ path: rel, created: false });
+      return err("EVENT_IDENTITY_COLLISION", { path: rel });
+    }
+    return err("WRITE_FAILED", { path: rel, message: String(error) });
+  }
+}
+async function readLogEvents(vault) {
+  const root = join3(vault, "meta", "log-events");
+  let days;
+  try {
+    days = (await readdir(root, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => d.name).sort();
+  } catch {
+    return ok([]);
+  }
+  const events = [];
+  for (const day of days) {
+    const files = (await readdir(join3(root, day))).filter((f) => f.endsWith(".json")).sort();
+    for (const file of files) {
+      const text = await readFile(join3(root, day, file), "utf8");
+      let parsed;
+      try {
+        parsed = JSON.parse(text);
+      } catch {
+        return err("SCHEME_REJECTED", { path: `meta/log-events/${day}/${file}`, message: "invalid JSON" });
+      }
+      const validated = validateLogEvent(parsed);
+      if (!validated.ok) return validated;
+      if (eventPathFor(validated.data) !== `meta/log-events/${day}/${file}`) {
+        return err("SCHEME_REJECTED", {
+          path: `meta/log-events/${day}/${file}`,
+          message: "path/identity mismatch"
+        });
+      }
+      events.push(validated.data);
+    }
+  }
+  events.sort((a, b) => {
+    if (a.occurred_at !== b.occurred_at) return a.occurred_at < b.occurred_at ? -1 : 1;
+    return a.operation_id < b.operation_id ? -1 : a.operation_id > b.operation_id ? 1 : 0;
+  });
+  return ok(events);
+}
+
 // src/commands/log-append.ts
 var ENTRY_RE = /^## \[(\d{4})-\d{2}-\d{2}\]/gm;
-function operationMarker(operationId) {
+function countLogEntries(logText) {
+  let count = 0;
+  for (const _ of logText.matchAll(ENTRY_RE)) count += 1;
+  return count;
+}
+function operationMarkers(operationId) {
   if (!/^[0-9a-f]{64}$/.test(operationId)) {
     return err("USAGE", { message: "operationId must be a SHA-256 hex string" });
   }
-  return ok(`<!-- skillwiki-page-publish:${operationId} -->`);
+  return ok([
+    `<!-- skillwiki-log-op:${operationId} -->`,
+    `<!-- skillwiki-page-publish:${operationId} -->`
+  ]);
+}
+function preferredMarker(operationId, eventKind) {
+  if (!eventKind || eventKind === "page-publish") {
+    return `<!-- skillwiki-page-publish:${operationId} -->`;
+  }
+  return `<!-- skillwiki-log-op:${operationId} -->`;
 }
-async function appendWhileLocked(logPath, content, marker) {
+async function appendWhileLocked(logPath, content, markers, writeMarker) {
   let logText;
   try {
-    logText = await readFile(logPath, "utf8");
+    logText = await readFile2(logPath, "utf8");
   } catch {
     return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: logPath }) };
   }
-  const entriesBefore = [...logText.matchAll(ENTRY_RE)].length;
-  if (marker && logText.includes(marker)) {
+  const entriesBefore = countLogEntries(logText);
+  if (markers?.some((marker) => logText.includes(marker))) {
     return {
       exitCode: ExitCode.OK,
       result: ok({
         entries_before: entriesBefore,
         entries_after: entriesBefore,
         appended: false,
-        humanHint: `publication operation already appended (${entriesBefore} entries)`
+        humanHint: `operation already appended (${entriesBefore} entries)`
       })
     };
   }
   const body = logText.replace(/\s+$/, "");
-  const appendedContent = marker ? `${content}
-${marker}` : content;
+  const appendedContent = writeMarker ? `${content}
+${writeMarker}` : content;
   const written = await atomicWriteText(logPath, `${body}
 
 ${appendedContent}
@@ -209,7 +361,7 @@ ${appendedContent}
 }
 async function runLogAppend(input) {
   try {
-    await stat(join3(input.vault, "SCHEMA.md"));
+    await stat(join4(input.vault, "SCHEMA.md"));
   } catch {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { vault: input.vault }) };
   }
@@ -224,11 +376,55 @@ async function runLogAppend(input) {
       result: err("SENSITIVE_CONTENT_DETECTED", { file: "log.md", findings: sensitive })
     };
   }
-  let marker;
+  let markers;
+  let writeMarker;
   if (input.operationId !== void 0) {
-    const operation = operationMarker(input.operationId);
+    const operation = operationMarkers(input.operationId);
     if (!operation.ok) return { exitCode: ExitCode.USAGE, result: operation };
-    marker = operation.data;
+    markers = operation.data;
+    writeMarker = preferredMarker(input.operationId, input.eventKind);
+  }
+  let eventCreated;
+  let eventPath;
+  if (input.writeEvent === true && input.operationId) {
+    const day = input.eventMetadata?.day || content.match(/\[(\d{4}-\d{2}-\d{2})\]/)?.[1] || (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+    const event = await writeLogEvent(input.vault, {
+      schema: "skillwiki-log-event/v1",
+      operation_id: input.operationId,
+      occurred_at: `${day}T00:00:00.000Z`,
+      host_id: hostname() || "localhost",
+      actor: "skillwiki-cli",
+      kind: input.eventKind || "log-append",
+      target: input.eventTarget || "log.md",
+      note: input.eventNote || content.split("\n")[0].slice(0, 500),
+      metadata: {
+        ...input.eventMetadata || {}
+      }
+    });
+    if (!event.ok) {
+      if (event.error === "EVENT_IDENTITY_COLLISION") {
+        eventCreated = false;
+        eventPath = eventPathFor({
+          schema: "skillwiki-log-event/v1",
+          operation_id: input.operationId,
+          occurred_at: `${day}T00:00:00.000Z`,
+          host_id: "localhost",
+          actor: "skillwiki-cli",
+          kind: input.eventKind || "log-append",
+          target: input.eventTarget || "log.md",
+          note: "collision",
+          metadata: {}
+        });
+      } else {
+        return {
+          exitCode: event.error === "SENSITIVE_CONTENT_DETECTED" ? ExitCode.SENSITIVE_CONTENT_DETECTED : ExitCode.WRITE_FAILED,
+          result: event
+        };
+      }
+    } else {
+      eventCreated = event.data.created;
+      eventPath = event.data.path;
+    }
   }
   const acquired = await acquireLogLock(input.vault, input.strictLock ? { reclaimStale: false } : {});
   if (!acquired.ok) {
@@ -238,11 +434,11 @@ async function runLogAppend(input) {
     return { exitCode: ExitCode.LOG_APPEND_LOCK_HELD, result: err("LOG_APPEND_LOCK_HELD", { vault: input.vault }) };
   }
   const lockHandle = acquired.data;
-  const logPath = join3(input.vault, "log.md");
+  const logPath = join4(input.vault, "log.md");
   let outcome;
   let released;
   try {
-    outcome = await appendWhileLocked(logPath, content, marker);
+    outcome = await appendWhileLocked(logPath, content, markers, writeMarker);
   } catch (error) {
     outcome = {
       exitCode: ExitCode.WRITE_FAILED,
@@ -257,10 +453,16 @@ async function runLogAppend(input) {
       result: err("WRITE_FAILED", { stage: "log-unlock" })
     };
   }
-  if (outcome === void 0) {
-    return {
-      exitCode: ExitCode.WRITE_FAILED,
-      result: err("WRITE_FAILED", { stage: "log-append" })
+  if (outcome.result.ok) {
+    const alreadyApplied = !outcome.result.data.appended && eventCreated === false;
+    outcome = {
+      exitCode: outcome.exitCode,
+      result: ok({
+        ...outcome.result.data,
+        ...eventCreated !== void 0 ? { event_created: eventCreated } : {},
+        ...eventPath ? { event_path: eventPath } : {},
+        humanHint: alreadyApplied ? `operation already applied (${outcome.result.data.entries_before} entries)` : outcome.result.data.humanHint
+      })
     };
   }
   if (outcome.result.ok && outcome.result.data.appended && input.recordLastOp !== false) {
@@ -283,7 +485,7 @@ async function runLogAppend(input) {
 
 // src/utils/sync-lock.ts
 import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, renameSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync3 } from "fs";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 import { createHash, randomBytes as randomBytes2 } from "crypto";
 function getEnvSessionId() {
   if (process.env.CLAUDE_SESSION_ID) return process.env.CLAUDE_SESSION_ID;
@@ -306,7 +508,7 @@ function getCliSessionId(cwd) {
   return `cli-${getCwdHash(cwd)}`;
 }
 function lockPath(vault) {
-  return join4(vault, ".skillwiki", "sync.lock");
+  return join5(vault, ".skillwiki", "sync.lock");
 }
 function readLock(vault) {
   const path = lockPath(vault);
@@ -325,7 +527,7 @@ function isStale(lock, now) {
 }
 function acquireLock(vault, opts = {}) {
   const path = lockPath(vault);
-  const dir = join4(vault, ".skillwiki");
+  const dir = join5(vault, ".skillwiki");
   if (!existsSync3(dir)) {
     mkdirSync3(dir, { recursive: true });
   }
@@ -410,7 +612,7 @@ function acquireOwnedSyncLock(vault, opts) {
   };
   const path = lockPath(vault);
   try {
-    mkdirSync3(join4(vault, ".skillwiki"), { recursive: true });
+    mkdirSync3(join5(vault, ".skillwiki"), { recursive: true });
   } catch (error) {
     return err("WRITE_FAILED", { path, message: String(error) });
   }
@@ -442,12 +644,12 @@ function releaseOwnedSyncLock(handle) {
 
 // src/commands/validate.ts
 import { createHash as createHash2 } from "crypto";
-import { readFile as readFile3 } from "fs/promises";
+import { readFile as readFile4 } from "fs/promises";
 import { resolve, relative, sep } from "path";
 
 // src/utils/index-entry.ts
-import { readFile as readFile2 } from "fs/promises";
-import { join as join5 } from "path";
+import { readFile as readFile3 } from "fs/promises";
+import { join as join6 } from "path";
 var TYPE_SECTION = {
   entity: "Entities",
   concept: "Concepts",
@@ -491,10 +693,10 @@ function renderIndexUpsert(text, input) {
   });
 }
 async function upsertIndexEntry(input) {
-  const path = join5(input.vault, "index.md");
+  const path = join6(input.vault, "index.md");
   let before = "";
   try {
-    before = await readFile2(path, "utf8");
+    before = await readFile3(path, "utf8");
   } catch {
     before = "";
   }
@@ -529,7 +731,7 @@ var SCHEMAS = {
 async function runValidate(input) {
   let text;
   try {
-    text = await readFile3(input.file, "utf8");
+    text = await readFile4(input.file, "utf8");
   } catch {
     return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: input.file }) };
   }
@@ -669,7 +871,7 @@ ${errors.map((e) => `  ${e.path}: ${e.message}`).join("\n")}` })
 }
 
 // src/commands/graph.ts
-import { writeFile, mkdir } from "fs/promises";
+import { writeFile, mkdir as mkdir2 } from "fs/promises";
 import { dirname } from "path";
 
 // src/parsers/wikilinks.ts
@@ -824,7 +1026,7 @@ async function runGraphBuild(input) {
   const adamicAdar = computeAdamicAdar(adjacency);
   const edge_count = Object.values(adjacency).reduce((acc, arr) => acc + arr.length, 0);
   try {
-    await mkdir(dirname(input.out), { recursive: true });
+    await mkdir2(dirname(input.out), { recursive: true });
     await writeFile(input.out, JSON.stringify({ adjacency, adamicAdar }, null, 2));
   } catch (e) {
     return { exitCode: ExitCode.WRITE_FAILED, result: err("WRITE_FAILED", { message: String(e) }) };
@@ -868,7 +1070,7 @@ function computeAdamicAdar(adj) {
 }
 
 // src/utils/wiki-path.ts
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 async function resolveInitTimePath(input) {
   const chain = [];
   if (input.flag !== void 0 && input.flag.length > 0) {
@@ -881,27 +1083,27 @@ async function resolveInitTimePath(input) {
     return { path: input.envValue, source: "env", ...input.explain ? { chain } : {} };
   }
   if (input.explain) chain.push({ source: "env", matched: false });
-  const sw = await parseDotenvFile(join6(input.home, ".skillwiki", ".env"));
+  const sw = await parseDotenvFile(join7(input.home, ".skillwiki", ".env"));
   if (sw.WIKI_PATH !== void 0) {
     if (input.explain) chain.push({ source: "skillwiki-dotenv", matched: true, value: sw.WIKI_PATH });
     return { path: sw.WIKI_PATH, source: "skillwiki-dotenv", ...input.explain ? { chain } : {} };
   }
   if (input.explain) chain.push({ source: "skillwiki-dotenv", matched: false });
-  const hermes = await parseDotenvFile(join6(input.home, ".hermes", ".env"));
+  const hermes = await parseDotenvFile(join7(input.home, ".hermes", ".env"));
   if (hermes.WIKI_PATH !== void 0) {
     if (input.explain) chain.push({ source: "hermes-dotenv", matched: true, value: hermes.WIKI_PATH });
     return { path: hermes.WIKI_PATH, source: "hermes-dotenv", ...input.explain ? { chain } : {} };
   }
   if (input.explain) chain.push({ source: "hermes-dotenv", matched: false });
   if (input.cwd) {
-    const projCfg = await parseDotenvFile(join6(input.cwd, ".skillwiki", ".env"));
+    const projCfg = await parseDotenvFile(join7(input.cwd, ".skillwiki", ".env"));
     if (projCfg.WIKI_PATH !== void 0) {
       if (input.explain) chain.push({ source: "project-dotenv", matched: true, value: projCfg.WIKI_PATH });
       return { path: projCfg.WIKI_PATH, source: "project-dotenv", ...input.explain ? { chain } : {} };
     }
   }
   if (input.explain) chain.push({ source: "project-dotenv", matched: false });
-  const fallback = join6(input.home, "wiki");
+  const fallback = join7(input.home, "wiki");
   if (input.explain) chain.push({ source: "default", matched: true, value: fallback });
   return { path: fallback, source: "default", ...input.explain ? { chain } : {} };
 }
@@ -912,7 +1114,7 @@ async function resolveRuntimePath(input) {
     return ok({ path: input.flag, source: "flag", ...input.explain ? { chain } : {} });
   }
   if (input.explain) chain.push({ source: "flag", matched: false });
-  const swGlobal = await parseDotenvFile(join6(input.home, ".skillwiki", ".env"));
+  const swGlobal = await parseDotenvFile(join7(input.home, ".skillwiki", ".env"));
   const wikiName = input.wiki;
   if (wikiName !== void 0 && wikiName.length > 0) {
     if (wikiName.toLowerCase() === "default") {
@@ -956,7 +1158,7 @@ async function resolveRuntimePath(input) {
   }
   if (input.explain) chain.push({ source: "env", matched: false });
   if (input.cwd) {
-    const projCfg = await parseDotenvFile(join6(input.cwd, ".skillwiki", ".env"));
+    const projCfg = await parseDotenvFile(join7(input.cwd, ".skillwiki", ".env"));
     if (projCfg.WIKI_PATH !== void 0) {
       if (input.explain) chain.push({ source: "project-dotenv", matched: true, value: projCfg.WIKI_PATH });
       return ok({ path: projCfg.WIKI_PATH, source: "project-dotenv", ...input.explain ? { chain } : {} });
@@ -1076,8 +1278,8 @@ function simulateRemoval(adj, removed) {
 }
 
 // src/commands/audit.ts
-import { readFile as readFile4, stat as stat3 } from "fs/promises";
-import { dirname as dirname2, resolve as resolve2, join as join8 } from "path";
+import { readFile as readFile5, stat as stat3 } from "fs/promises";
+import { dirname as dirname2, resolve as resolve2, join as join9 } from "path";
 
 // src/parsers/citations.ts
 var FENCE2 = /```[\s\S]*?```/g;
@@ -1189,7 +1391,7 @@ function hasWikilinkCitations(body) {
 // src/utils/raw-source.ts
 import { existsSync as existsSync4 } from "fs";
 import { stat as stat2 } from "fs/promises";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 function normalizeRawSourceTarget(entry) {
   let target = entry.trim().replace(/^"/, "").replace(/"$/, "").replace(/^'/, "").replace(/'$/, "");
   target = target.replace(/^\^\[/, "").replace(/\]$/, "");
@@ -1199,11 +1401,11 @@ function normalizeRawSourceTarget(entry) {
 function rawSourceTargetCandidates(vault, target) {
   const normalized = normalizeRawSourceTarget(target);
   if (!normalized) return [];
-  const candidates = [join7(vault, normalized)];
-  if (!normalized.endsWith(".md")) candidates.push(join7(vault, `${normalized}.md`));
+  const candidates = [join8(vault, normalized)];
+  if (!normalized.endsWith(".md")) candidates.push(join8(vault, `${normalized}.md`));
   if (normalized.startsWith("raw/")) {
-    candidates.push(join7(vault, "_archive", normalized));
-    if (!normalized.endsWith(".md")) candidates.push(join7(vault, "_archive", `${normalized}.md`));
+    candidates.push(join8(vault, "_archive", normalized));
+    if (!normalized.endsWith(".md")) candidates.push(join8(vault, "_archive", `${normalized}.md`));
   }
   return [...new Set(candidates)];
 }
@@ -1225,7 +1427,7 @@ async function rawSourceTargetExists(vault, target) {
 async function runAudit(input) {
   let text;
   try {
-    text = await readFile4(input.file, "utf8");
+    text = await readFile5(input.file, "utf8");
   } catch {
     return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: input.file }) };
   }
@@ -1278,7 +1480,7 @@ async function findVaultRoot(start) {
   let cur = start;
   for (let i = 0; i < 20; i++) {
     try {
-      await stat3(join8(cur, "SCHEMA.md"));
+      await stat3(join9(cur, "SCHEMA.md"));
       return cur;
     } catch {
     }
@@ -1370,8 +1572,8 @@ ${broken.map((b) => `  ${b.page}:[[${b.slug}]] (line ${b.line})`).join("\n")}` }
 }
 
 // src/commands/tag-audit.ts
-import { readFile as readFile5 } from "fs/promises";
-import { join as join9 } from "path";
+import { readFile as readFile6 } from "fs/promises";
+import { join as join10 } from "path";
 
 // src/parsers/taxonomy.ts
 import yaml from "js-yaml";
@@ -1396,12 +1598,12 @@ function parseTaxonomyDocument(schemaText) {
   const nextHeading = /^#{1,2}[ \t]+/m.exec(unboundedTail);
   const sectionEnd = nextHeading?.index === void 0 ? schemaText.length : afterHeading + nextHeading.index;
   const sectionText = schemaText.slice(afterHeading, sectionEnd);
-  const open = /^```yaml[ \t]*\r?$/m.exec(sectionText);
-  if (!open || open.index === void 0) {
+  const open2 = /^```yaml[ \t]*\r?$/m.exec(sectionText);
+  if (!open2 || open2.index === void 0) {
     return err("NO_TAXONOMY_BLOCK", { message: "Fenced YAML taxonomy block not found" });
   }
-  const openStart = afterHeading + open.index;
-  const yamlStart = openStart + open[0].length + 1;
+  const openStart = afterHeading + open2.index;
+  const yamlStart = openStart + open2[0].length + 1;
   const afterOpen = schemaText.slice(yamlStart, sectionEnd);
   const close = /^```[ \t]*\r?$/m.exec(afterOpen);
   if (!close || close.index === void 0) {
@@ -1524,7 +1726,7 @@ async function runTagAudit(input) {
   const scanResult = input.scan ? ok(input.scan) : await scanVault(input.vault);
   if (!scanResult.ok) return { exitCode: ExitCode.VAULT_PATH_INVALID, result: scanResult };
   const scan = scanResult.data;
-  const schemaText = await readFile5(join9(input.vault, "SCHEMA.md"), "utf8");
+  const schemaText = await readFile6(join10(input.vault, "SCHEMA.md"), "utf8");
   const tax = extractTaxonomy(schemaText);
   if (!tax.ok) return { exitCode: ExitCode.INVALID_FRONTMATTER, result: tax };
   const allowed = new Set(tax.data);
@@ -1556,8 +1758,8 @@ async function runTagAudit(input) {
 }
 
 // src/commands/index-check.ts
-import { readFile as readFile6 } from "fs/promises";
-import { join as join10 } from "path";
+import { readFile as readFile7 } from "fs/promises";
+import { join as join11 } from "path";
 function normalizeIndexTarget(raw) {
   return raw.replace(/\.md$/, "").replace(/^\.?\//, "");
 }
@@ -1569,7 +1771,7 @@ async function runIndexCheck(input) {
   }
   let indexText = "";
   try {
-    indexText = await readFile6(join10(input.vault, "index.md"), "utf8");
+    indexText = await readFile7(join11(input.vault, "index.md"), "utf8");
   } catch {
   }
   const indexTargets = /* @__PURE__ */ new Set();
@@ -1623,20 +1825,20 @@ async function runIndexCheck(input) {
 }
 
 // src/commands/project-index.ts
-import { readdir, readFile as readFile7, mkdir as mkdir2 } from "fs/promises";
-import { join as join11, dirname as dirname3, basename } from "path";
+import { readdir as readdir2, readFile as readFile8, mkdir as mkdir3 } from "fs/promises";
+import { join as join12, dirname as dirname3, basename } from "path";
 var LAYER2_DIRS = ["entities", "concepts", "comparisons", "queries", "meta"];
 var PROJECT_LOCAL_DIRS = ["requirements", "work", "architecture", "history"];
 async function scanMarkdownTree(rootAbs, rootRel) {
   const found = [];
   let entries;
   try {
-    entries = await readdir(rootAbs, { withFileTypes: true });
+    entries = await readdir2(rootAbs, { withFileTypes: true });
   } catch {
     return found;
   }
   for (const entry of entries) {
-    const abs = join11(rootAbs, entry.name);
+    const abs = join12(rootAbs, entry.name);
     const rel = `${rootRel}/${entry.name}`;
     if (entry.isDirectory()) {
       found.push(...await scanMarkdownTree(abs, rel));
@@ -1665,23 +1867,23 @@ function projectLocalType(slug, page, data) {
   return typeof data.type === "string" ? data.type : "project";
 }
 async function renderProjectIndex(vault, slug, opts = {}) {
-  const projectDir = join11(vault, "projects", slug);
+  const projectDir = join12(vault, "projects", slug);
   try {
-    await readdir(projectDir);
+    await readdir2(projectDir);
   } catch {
     return err("PROJECT_NOT_FOUND", { slug, path: projectDir });
   }
   const wikilinkPattern = `[[${slug}]]`;
   const entries = [];
-  const compoundDir = join11(vault, "projects", slug, "compound");
+  const compoundDir = join12(vault, "projects", slug, "compound");
   try {
-    const compoundFiles = await readdir(compoundDir, { withFileTypes: true });
+    const compoundFiles = await readdir2(compoundDir, { withFileTypes: true });
     for (const entry of compoundFiles) {
       if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-      const filePath = join11(compoundDir, entry.name);
+      const filePath = join12(compoundDir, entry.name);
       let text;
       try {
-        text = await readFile7(filePath, "utf8");
+        text = await readFile8(filePath, "utf8");
       } catch {
         continue;
       }
@@ -1698,16 +1900,16 @@ async function renderProjectIndex(vault, slug, opts = {}) {
   for (const dir of LAYER2_DIRS) {
     let files;
     try {
-      files = await readdir(join11(vault, dir), { withFileTypes: true });
+      files = await readdir2(join12(vault, dir), { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of files) {
       if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-      const filePath = join11(vault, dir, entry.name);
+      const filePath = join12(vault, dir, entry.name);
       let text;
       try {
-        text = await readFile7(filePath, "utf8");
+        text = await readFile8(filePath, "utf8");
       } catch {
         continue;
       }
@@ -1723,14 +1925,14 @@ async function renderProjectIndex(vault, slug, opts = {}) {
     }
   }
   for (const dir of PROJECT_LOCAL_DIRS) {
-    const rootAbs = join11(projectDir, dir);
+    const rootAbs = join12(projectDir, dir);
     const rootRel = `projects/${slug}/${dir}`;
     const pages = await scanMarkdownTree(rootAbs, rootRel);
     for (const page of pages) {
-      const filePath = join11(vault, page);
+      const filePath = join12(vault, page);
       let text;
       try {
-        text = await readFile7(filePath, "utf8");
+        text = await readFile8(filePath, "utf8");
       } catch {
         continue;
       }
@@ -1803,7 +2005,7 @@ Autogenerated by \`skillwiki project-index\` on ${today}.
 }
 async function runProjectIndex(input) {
   const slug = input.slug;
-  const projectDir = join11(input.vault, "projects", slug);
+  const projectDir = join12(input.vault, "projects", slug);
   const rendered = await renderProjectIndex(input.vault, slug);
   if (!rendered.ok) {
     return {
@@ -1811,12 +2013,12 @@ async function runProjectIndex(input) {
       result: rendered
     };
   }
-  const indexPath = join11(projectDir, "knowledge.md");
+  const indexPath = join12(projectDir, "knowledge.md");
   const entries = rendered.data.entries;
   let existing = false;
   let stale = false;
   try {
-    const existingText = await readFile7(indexPath, "utf8");
+    const existingText = await readFile8(indexPath, "utf8");
     existing = true;
     const existingEntries = existingText.split("\n").filter((l) => l.startsWith("- [["));
     const existingPages = new Set(existingEntries.map((l) => {
@@ -1829,7 +2031,7 @@ async function runProjectIndex(input) {
   }
   if (input.apply) {
     try {
-      await mkdir2(dirname3(indexPath), { recursive: true });
+      await mkdir3(dirname3(indexPath), { recursive: true });
     } catch (e) {
       return {
         exitCode: ExitCode.WRITE_FAILED,
@@ -1861,8 +2063,8 @@ ${entries.map((e) => `  ${e.type}: [[${e.page.replace(/\.md$/, "")}]] \u2014 ${e
 }
 
 // src/commands/stale.ts
-import { readdir as readdir2, rename, mkdir as mkdir3, readFile as readFile8 } from "fs/promises";
-import { join as join12 } from "path";
+import { readdir as readdir3, rename, mkdir as mkdir4, readFile as readFile9 } from "fs/promises";
+import { join as join13 } from "path";
 
 // src/parsers/expiry-annotations.ts
 var HEADING_RE = /^#{1,6}\s+(.+)$/;
@@ -1911,10 +2113,10 @@ async function runStale(input) {
   const archived = [];
   const workDirs = /* @__PURE__ */ new Map();
   const workDirsBySlug = /* @__PURE__ */ new Map();
-  const projectsDir = join12(input.vault, "projects");
+  const projectsDir = join13(input.vault, "projects");
   let projectSlugs = [];
   try {
-    projectSlugs = (await readdir2(projectsDir, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => d.name);
+    projectSlugs = (await readdir3(projectsDir, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
   }
   if (input.project) {
@@ -1924,10 +2126,10 @@ async function runStale(input) {
     projectSlugs = [input.project];
   }
   for (const slug of projectSlugs) {
-    const workPath = join12(projectsDir, slug, "work");
+    const workPath = join13(projectsDir, slug, "work");
     let entries;
     try {
-      entries = await readdir2(workPath, { withFileTypes: true });
+      entries = await readdir3(workPath, { withFileTypes: true });
     } catch {
       continue;
     }
@@ -1935,11 +2137,11 @@ async function runStale(input) {
     for (const e of entries) {
       if (!e.isDirectory()) continue;
       const relDir = `projects/${slug}/work/${e.name}`;
-      const absDir = join12(workPath, e.name);
+      const absDir = join13(workPath, e.name);
       let status = "";
       let files;
       try {
-        files = await readdir2(absDir);
+        files = await readdir3(absDir);
       } catch {
         workDirs.set(relDir, "");
         slugDirs.set(e.name, "");
@@ -1948,7 +2150,7 @@ async function runStale(input) {
       for (const f of files) {
         if (!f.endsWith(".md")) continue;
         try {
-          const fm = extractFrontmatter(await readFile8(join12(absDir, f), "utf8"));
+          const fm = extractFrontmatter(await readFile9(join13(absDir, f), "utf8"));
           if (fm.ok && typeof fm.data.status === "string") {
             status = fm.data.status;
             break;
@@ -2044,9 +2246,9 @@ async function runStale(input) {
     }
   }
   await mapWithConcurrency([...workDirs.keys()], vaultIoConcurrency(), async (relDir) => {
-    const specPath = join12(input.vault, relDir, "spec.md");
+    const specPath = join13(input.vault, relDir, "spec.md");
     try {
-      const specContent = await readFile8(specPath, "utf8");
+      const specContent = await readFile9(specPath, "utf8");
       const specFm = extractFrontmatter(specContent);
       if (specFm.ok && typeof specFm.data.source === "string") {
         const sourcePath = specFm.data.source;
@@ -2075,7 +2277,7 @@ async function runStale(input) {
     if (daysSince(dateStr) < input.days) continue;
     let files;
     try {
-      files = await readdir2(join12(input.vault, relDir));
+      files = await readdir3(join13(input.vault, relDir));
     } catch {
       continue;
     }
@@ -2145,8 +2347,8 @@ async function runStale(input) {
   staleSections.push(...staleSectionResults.flat());
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   if (input.archive) {
-    const archiveDir = join12(input.vault, "_archive", today);
-    await mkdir3(archiveDir, { recursive: true });
+    const archiveDir = join13(input.vault, "_archive", today);
+    await mkdir4(archiveDir, { recursive: true });
     const citedRawPaths = /* @__PURE__ */ new Set();
     for (const page of scan.typedKnowledge) {
       const text = await readPageCached(page, input.pageTextCache).catch(() => "");
@@ -2161,9 +2363,9 @@ async function runStale(input) {
     }
     for (const t of staleTranscripts) {
       if (citedRawPaths.has(t.path) || citedRawPaths.has(t.path.replace(/\.md$/, ""))) continue;
-      const dest = join12(archiveDir, t.path.split("/").pop());
+      const dest = join13(archiveDir, t.path.split("/").pop());
       try {
-        await rename(join12(input.vault, t.path), dest);
+        await rename(join13(input.vault, t.path), dest);
         archived.push(t.path);
       } catch {
       }
@@ -2173,18 +2375,18 @@ async function runStale(input) {
       if (parts.length >= 4 && parts[0] === "projects") {
         const slug = parts[1];
         const itemName = parts[3];
-        const histDir = join12(input.vault, "projects", slug, "history", "archived-work");
-        await mkdir3(histDir, { recursive: true });
-        const dest = join12(histDir, itemName);
+        const histDir = join13(input.vault, "projects", slug, "history", "archived-work");
+        await mkdir4(histDir, { recursive: true });
+        const dest = join13(histDir, itemName);
         try {
-          await rename(join12(input.vault, w.path), dest);
+          await rename(join13(input.vault, w.path), dest);
           archived.push(w.path);
         } catch {
         }
       } else {
-        const dest = join12(archiveDir, w.path.replace(/\//g, "_"));
+        const dest = join13(archiveDir, w.path.replace(/\//g, "_"));
         try {
-          await rename(join12(input.vault, w.path), dest);
+          await rename(join13(input.vault, w.path), dest);
           archived.push(w.path);
         } catch {
         }
@@ -2239,19 +2441,19 @@ async function runPagesize(input) {
 }
 
 // src/commands/log-rotate.ts
-import { readFile as readFile9, rename as rename2, writeFile as writeFile2, stat as stat4 } from "fs/promises";
-import { join as join13 } from "path";
+import { readFile as readFile10, rename as rename2, writeFile as writeFile2, stat as stat4 } from "fs/promises";
+import { join as join14 } from "path";
 var ENTRY_RE2 = /^## \[(\d{4})-\d{2}-\d{2}\]/gm;
 async function runLogRotate(input) {
   try {
-    await stat4(join13(input.vault, "SCHEMA.md"));
+    await stat4(join14(input.vault, "SCHEMA.md"));
   } catch {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { vault: input.vault }) };
   }
-  const logPath = join13(input.vault, "log.md");
+  const logPath = join14(input.vault, "log.md");
   let logText;
   try {
-    logText = await readFile9(logPath, "utf8");
+    logText = await readFile10(logPath, "utf8");
   } catch {
     return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: logPath }) };
   }
@@ -2268,7 +2470,7 @@ async function runLogRotate(input) {
   }
   const newestYear = matches[matches.length - 1][1];
   const rotatedName = `log-${newestYear}.md`;
-  const rotatedPath = join13(input.vault, rotatedName);
+  const rotatedPath = join14(input.vault, rotatedName);
   try {
     await rename2(logPath, rotatedPath);
     const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
@@ -2313,13 +2515,13 @@ async function runTopicMapCheck(input) {
 }
 
 // src/commands/index-link-format.ts
-import { readFile as readFile10 } from "fs/promises";
-import { join as join14 } from "path";
+import { readFile as readFile11 } from "fs/promises";
+import { join as join15 } from "path";
 var MD_LINK_RE = /\[[^\[\]]+\]\([^)]+\.md\)/;
 async function runIndexLinkFormat(input) {
   let text = "";
   try {
-    text = await readFile10(join14(input.vault, "index.md"), "utf8");
+    text = await readFile11(join15(input.vault, "index.md"), "utf8");
   } catch {
   }
   const markdown_links = [];
@@ -2334,7 +2536,7 @@ ${markdown_links.map((l) => `  line ${l.line}: ${l.text}`).join("\n")}`;
 // src/commands/dedup.ts
 import { createHash as createHash3 } from "crypto";
 import { mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4, unlinkSync as unlinkSync4 } from "fs";
-import { dirname as dirname4, join as join15, resolve as resolve3 } from "path";
+import { dirname as dirname4, join as join16, resolve as resolve3 } from "path";
 
 // src/utils/rclone.ts
 import { execFile } from "child_process";
@@ -2453,7 +2655,7 @@ async function runDedup(input) {
       }
     }
     for (const page of scan.allMarkdown.filter((p) => !p.relPath.startsWith("raw/"))) {
-      const text = readFileSync4(join15(input.vault, page.relPath), "utf-8");
+      const text = readFileSync4(join16(input.vault, page.relPath), "utf-8");
       let updated = text;
       let changed = false;
       for (const [oldPath, newPath] of replacements) {
@@ -2471,12 +2673,12 @@ async function runDedup(input) {
         }
       }
       if (changed) {
-        writeFileSync4(join15(input.vault, page.relPath), updated);
+        writeFileSync4(join16(input.vault, page.relPath), updated);
         rewired.push(page.relPath);
       }
     }
     for (const oldPath of replacements.keys()) {
-      const fullPath = join15(input.vault, oldPath);
+      const fullPath = join16(input.vault, oldPath);
       try {
         unlinkSync4(fullPath);
         removed.push(oldPath);
@@ -2570,7 +2772,7 @@ function buildSafeEntries(vault, duplicates, unsafe) {
   return entries;
 }
 function hashRawBody(vault, relPath) {
-  const text = readFileSync4(join15(vault, relPath), "utf-8");
+  const text = readFileSync4(join16(vault, relPath), "utf-8");
   const split = splitFrontmatter(text);
   const body = split.ok ? split.data.body : text;
   return createHash3("sha256").update(body).digest("hex");
@@ -2593,7 +2795,7 @@ async function planAndMaybePruneRemote(input, entries) {
 }
 
 // src/utils/safe-write.ts
-import { readFile as readFile11, writeFile as writeFile3 } from "fs/promises";
+import { readFile as readFile12, writeFile as writeFile3 } from "fs/promises";
 var DEFAULT_MIN_BODY_RATIO = 0.5;
 var DEFAULT_MIN_OLD_BODY_BYTES = 200;
 function bodyBytes(text) {
@@ -2603,7 +2805,7 @@ function bodyBytes(text) {
 }
 async function readIfExists(absPath) {
   try {
-    return await readFile11(absPath, "utf8");
+    return await readFile12(absPath, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return null;
     throw e;
@@ -2727,9 +2929,9 @@ ${newBody}`;
 
 // src/commands/lint.ts
 import { existsSync as existsSync6 } from "fs";
-import { readFile as readFile13, readdir as readdir3 } from "fs/promises";
+import { readFile as readFile14, readdir as readdir4 } from "fs/promises";
 import { createHash as createHash5 } from "crypto";
-import { join as join17, relative as relative2, sep as sep2 } from "path";
+import { join as join18, relative as relative2, sep as sep2 } from "path";
 
 // src/commands/sparse-community.ts
 async function runSparseCommunity(input) {
@@ -2787,8 +2989,8 @@ async function runRawBodyDedup(vault, scan, pageTextCache) {
 
 // src/commands/path-too-long.ts
 import { existsSync as existsSync5 } from "fs";
-import { mkdir as mkdir4, readFile as readFile12, rename as rename3, unlink } from "fs/promises";
-import { dirname as dirname5, join as join16, posix, resolve as resolve4 } from "path";
+import { mkdir as mkdir5, readFile as readFile13, rename as rename3, unlink } from "fs/promises";
+import { dirname as dirname5, join as join17, posix, resolve as resolve4 } from "path";
 var MAX_PATH_LENGTH = 240;
 var WINDOWS_ABSOLUTE_PATH_LIMIT = 259;
 async function runPathTooLong(input) {
@@ -2821,10 +3023,10 @@ async function fixPathTooLong(input) {
     }
     try {
       if (target.mode === "dedupe") {
-        await unlink(join16(input.vault, violation.relPath));
+        await unlink(join17(input.vault, violation.relPath));
       } else {
-        await mkdir4(dirname5(join16(input.vault, target.relPath)), { recursive: true });
-        await rename3(join16(input.vault, violation.relPath), join16(input.vault, target.relPath));
+        await mkdir5(dirname5(join17(input.vault, target.relPath)), { recursive: true });
+        await rename3(join17(input.vault, violation.relPath), join17(input.vault, target.relPath));
       }
       fixed.push({ from: violation.relPath, to: target.relPath });
     } catch {
@@ -2838,7 +3040,7 @@ async function fixPathTooLong(input) {
       for (const page of afterScan.data.allMarkdown) {
         if (!shouldRewriteReferences(page.relPath)) continue;
         try {
-          const original = await readFile12(page.absPath, "utf8");
+          const original = await readFile13(page.absPath, "utf8");
           let updated = original;
           for (const fix of fixed) {
             updated = replacePathReferences(updated, fix.from, fix.to);
@@ -2901,9 +3103,9 @@ function truncateFilename(relPath, maxLength = MAX_PATH_LENGTH) {
 async function resolveFixTarget(vault, original, preferred, maxLength) {
   for (const candidate of candidateRelPaths(preferred, maxLength)) {
     if (candidate === original || candidate.length > maxLength) continue;
-    const candidatePath = join16(vault, candidate);
+    const candidatePath = join17(vault, candidate);
     if (!existsSync5(candidatePath)) return { relPath: candidate, mode: "rename" };
-    if (await hasSameContent(join16(vault, original), candidatePath)) {
+    if (await hasSameContent(join17(vault, original), candidatePath)) {
       return { relPath: candidate, mode: "dedupe" };
     }
   }
@@ -2927,7 +3129,7 @@ function candidateRelPaths(preferred, maxLength) {
 }
 async function hasSameContent(a, b) {
   try {
-    const [left, right] = await Promise.all([readFile12(a), readFile12(b)]);
+    const [left, right] = await Promise.all([readFile13(a), readFile13(b)]);
     return left.equals(right);
   } catch {
     return false;
@@ -2974,7 +3176,7 @@ function buildCliSurface() {
   program.command("orphans").option("--wiki <name>");
   program.command("audit");
   program.command("install").option("--target <dir>").option("--dry-run").option("--skills-root <dir>").option("--symlink");
-  program.command("path").option("--vault <dir>").option("--target <dir>").option("--wiki <name>").option("--init-time").option("--explain");
+  program.command("path").option("--vault <dir>").option("--target <dir>").option("--wiki <name>").option("--init-time").option("--explain").option("--plain");
   program.command("lang").option("--lang <code>").option("--explain");
   program.command("init").option("--target <dir>").requiredOption("--domain <text>").option("--taxonomy <csv>").option("--lang <code>").option("--force").option("--no-env").option("--profile <name>");
   program.command("links").option("--wiki <name>");
@@ -2986,7 +3188,9 @@ function buildCliSurface() {
   program.command("claim").option("--project <slug>").option("--slug <slug>").option("--wiki <name>");
   program.command("pagesize").option("--lines <n>").option("--wiki <name>");
   program.command("log-rotate").option("--threshold <n>").option("--apply").option("--wiki <name>");
-  program.command("log-append").requiredOption("--content <text>").option("--wiki <name>");
+  program.command("log-append").requiredOption("--content <text>").option("--operation-id <id>").option("--write-event").option("--wiki <name>");
+  program.command("work-complete").requiredOption("--work-item <path>").option("--operation-id <id>").option("--no-commit").option("--wiki <name>");
+  program.command("work-validate").requiredOption("--work-item <path>").option("--require-complete").option("--wiki <name>");
   program.command("lint").option("--days <n>").option("--lines <n>").option("--log-threshold <n>").option("--fix").option("--only <bucket>").option("--summary").option("--examples <n>").option("--wiki <name>");
   program.command("config");
   program.command("health").option("--wiki <name>").option("--sync <mode>").option("--no-fail").option("--out <path>").option("--examples <n>");
@@ -3388,10 +3592,10 @@ function summarizeLintOutput(output, examplesLimit = 3) {
   };
 }
 async function walkMarkdownFiles(absDir, vaultRoot) {
-  const entries = await readdir3(absDir, { withFileTypes: true });
+  const entries = await readdir4(absDir, { withFileTypes: true });
   const pages = [];
   for (const entry of entries) {
-    const absPath = join17(absDir, entry.name);
+    const absPath = join18(absDir, entry.name);
     if (entry.isDirectory()) {
       if (entry.name === ".git" || entry.name === "node_modules") continue;
       pages.push(...await walkMarkdownFiles(absPath, vaultRoot));
@@ -3402,12 +3606,12 @@ async function walkMarkdownFiles(absDir, vaultRoot) {
   return pages;
 }
 async function collectCliRefsPages(vault) {
-  if (!existsSync6(join17(vault, "SCHEMA.md"))) {
+  if (!existsSync6(join18(vault, "SCHEMA.md"))) {
     return err("VAULT_PATH_INVALID", { root: vault, reason: "SCHEMA.md missing" });
   }
   const pages = [];
   for (const dir of CLI_REFS_TYPED_DIRS) {
-    const absDir = join17(vault, dir);
+    const absDir = join18(vault, dir);
     if (!existsSync6(absDir)) continue;
     pages.push(...await walkMarkdownFiles(absDir, vault));
   }
@@ -3529,7 +3733,7 @@ async function applyFileSourceUrlFix(input, scan, fileSourceUrlFlags, fileSource
   for (const relPath of fileSourceUrlFrontmatterFlags) {
     try {
       const absPath = `${input.vault}/${relPath}`;
-      const raw = await readFile13(absPath, "utf8");
+      const raw = await readFile14(absPath, "utf8");
       const parts = raw.split("---", 3);
       if (parts.length < 3) {
         unresolved.push(relPath);
@@ -3922,8 +4126,8 @@ async function runLint(input) {
     const readKnowledgeContent = (slug) => {
       const existing = knowledgeContentCache.get(slug);
       if (existing) return existing;
-      const knowledgePath = join17(lintVault, "projects", slug, "knowledge.md");
-      const pending = existsSync6(knowledgePath) ? readFile13(knowledgePath, "utf8").catch(() => null) : Promise.resolve(null);
+      const knowledgePath = join18(lintVault, "projects", slug, "knowledge.md");
+      const pending = existsSync6(knowledgePath) ? readFile14(knowledgePath, "utf8").catch(() => null) : Promise.resolve(null);
       knowledgeContentCache.set(slug, pending);
       return pending;
     };
@@ -4029,7 +4233,7 @@ async function runLint(input) {
       for (const relPath of legacyPages) {
         try {
           const absPath = `${input.vault}/${relPath}`;
-          const raw = await readFile13(absPath, "utf8");
+          const raw = await readFile14(absPath, "utf8");
           const split = splitFrontmatter(raw);
           if (!split.ok) {
             unresolved.push(relPath);
@@ -4128,7 +4332,7 @@ ${newBody}`;
       for (const relPath of noOverview) {
         try {
           const absPath = `${input.vault}/${relPath}`;
-          const raw = await readFile13(absPath, "utf8");
+          const raw = await readFile14(absPath, "utf8");
           const split = splitFrontmatter(raw);
           if (!split.ok) {
             unresolved.push(relPath);
@@ -4169,7 +4373,7 @@ ${trimmedBody}`;
       for (const relPath of missingTldrFlags) {
         try {
           const absPath = `${input.vault}/${relPath}`;
-          const raw = await readFile13(absPath, "utf8");
+          const raw = await readFile14(absPath, "utf8");
           const split = splitFrontmatter(raw);
           if (!split.ok) {
             unresolved.push(relPath);
@@ -4219,7 +4423,7 @@ ${lines.join("\n")}`;
       for (const relPath of wikilinkCitationFlags) {
         try {
           const absPath = `${input.vault}/${relPath}`;
-          const raw = await readFile13(absPath, "utf8");
+          const raw = await readFile14(absPath, "utf8");
           const split = splitFrontmatter(raw);
           if (!split.ok) {
             unresolved.push(relPath);
@@ -4560,14 +4764,14 @@ async function runSyncLintDelta(input) {
 }
 
 // src/commands/config.ts
-import { readFile as readFile14 } from "fs/promises";
+import { readFile as readFile15 } from "fs/promises";
 import { existsSync as existsSync7 } from "fs";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 function validateKey(key) {
   return CONFIG_KEYS.includes(key) || isValidWikiProfileKey(key);
 }
 function configPath(home) {
-  return join18(home, ".skillwiki", ".env");
+  return join19(home, ".skillwiki", ".env");
 }
 async function runConfigGet(input) {
   if (!validateKey(input.key)) {
@@ -4585,7 +4789,7 @@ async function runConfigSet(input) {
   try {
     let originalContent;
     try {
-      originalContent = await readFile14(filePath, "utf8");
+      originalContent = await readFile15(filePath, "utf8");
     } catch {
     }
     const existing = originalContent !== void 0 ? parseDotenvText(originalContent) : {};
@@ -4622,19 +4826,19 @@ async function runConfigPath(input) {
 
 // src/commands/doctor.ts
 import { existsSync as existsSync13, lstatSync, readlinkSync, readdirSync as readdirSync3, statSync as statSync2, readFileSync as readFileSync10 } from "fs";
-import { join as join24, resolve as resolve5 } from "path";
+import { join as join25, resolve as resolve5 } from "path";
 import { execSync as execSync2 } from "child_process";
 import { platform as platform2 } from "os";
 
 // src/utils/plugin-registry.ts
 import { existsSync as existsSync8, readdirSync, readFileSync as readFileSync5 } from "fs";
-import { join as join19 } from "path";
-var REGISTRY_PATH = join19(".claude", "plugins", "installed_plugins.json");
-var CODEX_CONFIG_PATH = join19(".codex", "config.toml");
+import { join as join20 } from "path";
+var REGISTRY_PATH = join20(".claude", "plugins", "installed_plugins.json");
+var CODEX_CONFIG_PATH = join20(".codex", "config.toml");
 var PLUGIN_KEY = "skillwiki@llm-wiki";
 function readInstalledPlugins(home) {
   try {
-    const raw = readFileSync5(join19(home, REGISTRY_PATH), "utf8");
+    const raw = readFileSync5(join20(home, REGISTRY_PATH), "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -4670,7 +4874,7 @@ function findPluginInstallations(home, key = PLUGIN_KEY) {
 function findCodexPlugin(home, key, pluginName, marketplace) {
   const config = readCodexPluginConfig(home, key, marketplace);
   if (!config?.enabled) return null;
-  const cacheRoot = join19(home, ".codex", "plugins", "cache", marketplace, pluginName);
+  const cacheRoot = join20(home, ".codex", "plugins", "cache", marketplace, pluginName);
   if (!existsSync8(cacheRoot)) return null;
   let versions;
   try {
@@ -4686,7 +4890,7 @@ function findCodexPlugin(home, key, pluginName, marketplace) {
     key,
     pluginName,
     marketplace,
-    installPath: join19(cacheRoot, version),
+    installPath: join20(cacheRoot, version),
     version,
     sourceType: config.sourceType,
     source: config.source
@@ -4703,7 +4907,7 @@ function parsePluginKey(key) {
 function readCodexPluginConfig(home, key, marketplace) {
   let raw;
   try {
-    raw = readFileSync5(join19(home, CODEX_CONFIG_PATH), "utf8");
+    raw = readFileSync5(join20(home, CODEX_CONFIG_PATH), "utf8");
   } catch {
     return null;
   }
@@ -4746,7 +4950,7 @@ function parseTomlScalar(rawValue) {
 
 // src/utils/conflict-markers.ts
 import { existsSync as existsSync9, readdirSync as readdirSync2, readFileSync as readFileSync6 } from "fs";
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 function scanConflictMarkerBlocksInText(relPath, text) {
   const findings = [];
   const lines = text.split(/\r?\n/);
@@ -4797,7 +5001,7 @@ function walkMarkdownFiles2(root, dir, rel, out) {
   for (const entry of entries) {
     if (entry.isDirectory()) {
       if (PRUNE_DIRS.has(entry.name)) continue;
-      walkMarkdownFiles2(root, join20(dir, entry.name), rel ? `${rel}/${entry.name}` : entry.name, out);
+      walkMarkdownFiles2(root, join21(dir, entry.name), rel ? `${rel}/${entry.name}` : entry.name, out);
     } else if (entry.isFile() && entry.name.endsWith(".md")) {
       out.push(rel ? `${rel}/${entry.name}` : entry.name);
     }
@@ -4811,7 +5015,7 @@ function scanVaultConflictMarkers(vaultRoot) {
   for (const rel of relPaths) {
     let text;
     try {
-      text = readFileSync6(join20(vaultRoot, rel), "utf8");
+      text = readFileSync6(join21(vaultRoot, rel), "utf8");
     } catch {
       continue;
     }
@@ -4822,7 +5026,7 @@ function scanVaultConflictMarkers(vaultRoot) {
 
 // src/utils/remote-health.ts
 import { existsSync as existsSync10, readFileSync as readFileSync7 } from "fs";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 import { execFileSync } from "child_process";
 var REMOTE_PROBE_TIMEOUT_MS = 3e3;
 var defaultExec = (file, args, cwd) => execFileSync(file, args, {
@@ -4833,7 +5037,7 @@ var defaultExec = (file, args, cwd) => execFileSync(file, args, {
 }).trim();
 function readWikiS3RemoteConfigured(home) {
   try {
-    const content = readFileSync7(join21(home, ".skillwiki", ".env"), "utf8");
+    const content = readFileSync7(join22(home, ".skillwiki", ".env"), "utf8");
     for (const line of content.split(/\r?\n/)) {
       const trimmed = line.trim();
       if (!trimmed || trimmed.startsWith("#")) continue;
@@ -4858,7 +5062,7 @@ function resolveWikiS3Remote(input) {
   return readWikiS3RemoteConfigured(input.home);
 }
 function probeGithubReachability(vaultPath, exec = defaultExec) {
-  if (!existsSync10(join21(vaultPath, ".git"))) return "unknown";
+  if (!existsSync10(join22(vaultPath, ".git"))) return "unknown";
   try {
     exec("git", ["remote", "get-url", "origin"], vaultPath);
   } catch {
@@ -4924,10 +5128,10 @@ function probeRemoteHealth(input) {
 
 // src/utils/satellite-run-health.ts
 import { existsSync as existsSync11, readFileSync as readFileSync8 } from "fs";
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 var SATELLITE_STALE_MS = 26 * 60 * 60 * 1e3;
 function satelliteLatestRunPath(vault) {
-  return join22(vault, ".skillwiki", "agent-memory-trends", "latest-run.json");
+  return join23(vault, ".skillwiki", "agent-memory-trends", "latest-run.json");
 }
 function isFailedRunStatus(status) {
   return status === "fail" || status === "failure";
@@ -4980,8 +5184,8 @@ function evaluateSatelliteRunHealth(vault, now) {
 // src/utils/s3-mount-health.ts
 import { execSync } from "child_process";
 import { platform } from "os";
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync5, unlinkSync as unlinkSync5, readFileSync as readFile15 } from "fs";
-import { join as join23 } from "path";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync5, unlinkSync as unlinkSync5, readFileSync as readFile16 } from "fs";
+import { join as join24 } from "path";
 var OS = platform();
 function findRcloneMountPid() {
   try {
@@ -5139,7 +5343,7 @@ function detectFuseMount(vaultPath) {
   return null;
 }
 function writeTest(dir) {
-  const testFile = join23(dir, `.doctor-write-test-${process.pid}.tmp`);
+  const testFile = join24(dir, `.doctor-write-test-${process.pid}.tmp`);
   const payload = `skillwiki doctor write test \u2014 ${Date.now()} \u2014 ${Math.random().toString(36).slice(2)}`;
   const start = Date.now();
   try {
@@ -5150,7 +5354,7 @@ function writeTest(dir) {
   const writeMs = Date.now() - start;
   const readStart = Date.now();
   try {
-    const back = readFile15(testFile, "utf8");
+    const back = readFile16(testFile, "utf8");
     const readMs = Date.now() - readStart;
     if (back !== payload) {
       try {
@@ -5239,12 +5443,12 @@ function detectCliChannels(argv, home) {
   }
   const plugin = findPlugin(home);
   if (plugin) {
-    const pluginBin = join24(plugin.installPath, "bin", "skillwiki");
+    const pluginBin = join25(plugin.installPath, "bin", "skillwiki");
     if (existsSync13(pluginBin)) {
       channels.push({ name: "plugin", path: pluginBin, isDevLink: false });
     }
   }
-  const installBin = join24(home, ".claude", "skills", "bin", "skillwiki");
+  const installBin = join25(home, ".claude", "skills", "bin", "skillwiki");
   if (existsSync13(installBin)) {
     channels.push({ name: "install", path: installBin, isDevLink: false });
   }
@@ -5334,9 +5538,9 @@ function checkVaultStructure(resolvedPath) {
     return check("error", "vault_structure", "Vault structure valid", "Cannot check \u2014 vault directory does not exist");
   }
   const missing = [];
-  if (!existsSync13(join24(resolvedPath, "SCHEMA.md"))) missing.push("SCHEMA.md");
+  if (!existsSync13(join25(resolvedPath, "SCHEMA.md"))) missing.push("SCHEMA.md");
   for (const dir of ["raw", "entities", "concepts", "meta"]) {
-    if (!existsSync13(join24(resolvedPath, dir))) missing.push(dir + "/");
+    if (!existsSync13(join25(resolvedPath, dir))) missing.push(dir + "/");
   }
   if (missing.length === 0) {
     return check("pass", "vault_structure", "Vault structure valid", "All required files and directories present");
@@ -5344,7 +5548,7 @@ function checkVaultStructure(resolvedPath) {
   return check("warn", "vault_structure", "Vault structure valid", `Missing: ${missing.join(", ")} \u2014 run \`skillwiki init\` to add CodeWiki structure`);
 }
 function checkSkillsInstalled(home, cwd) {
-  const srcDir = cwd ? join24(cwd, "packages", "skills") : void 0;
+  const srcDir = cwd ? join25(cwd, "packages", "skills") : void 0;
   if (srcDir && existsSync13(srcDir)) {
     const found = findInstalledSkillMd(srcDir);
     if (found.length > 0) {
@@ -5358,7 +5562,7 @@ function checkSkillsInstalled(home, cwd) {
       return check("pass", "skills_installed", "Skills installed", `${found.length} SKILL.md file(s) found (plugin v${plugin.version})`);
     }
   }
-  const skillsDir = join24(home, ".claude", "skills");
+  const skillsDir = join25(home, ".claude", "skills");
   if (existsSync13(skillsDir)) {
     const found = findInstalledSkillMd(skillsDir);
     if (found.length > 0) {
@@ -5369,10 +5573,10 @@ function checkSkillsInstalled(home, cwd) {
 }
 function checkDuplicateSkills(home) {
   const plugin = findPlugin(home);
-  const skillsDir = join24(home, ".claude", "skills");
+  const skillsDir = join25(home, ".claude", "skills");
   const agentSkillDirs = [
-    { label: "~/.codex/skills/", path: join24(home, ".codex", "skills") },
-    { label: "~/.agents/skills/", path: join24(home, ".agents", "skills") }
+    { label: "~/.codex/skills/", path: join25(home, ".codex", "skills") },
+    { label: "~/.agents/skills/", path: join25(home, ".agents", "skills") }
   ];
   if (!plugin) {
     return check("pass", "skills_duplicate", "Skills not duplicated", "Single install channel");
@@ -5475,7 +5679,7 @@ async function checkProfiles(home) {
 }
 async function checkProjectLocalOverride(cwd) {
   const dir = cwd ?? process.cwd();
-  const envPath = join24(dir, ".skillwiki", ".env");
+  const envPath = join25(dir, ".skillwiki", ".env");
   if (existsSync13(envPath)) {
     return check("pass", "project_local", "Project-local config", `Found: ${envPath}`);
   }
@@ -5485,7 +5689,7 @@ function checkVaultGitRemote(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("error", "vault_git_remote", "Vault git remote", "Cannot check \u2014 WIKI_PATH not resolved");
   }
-  if (!existsSync13(join24(resolvedPath, ".git"))) {
+  if (!existsSync13(join25(resolvedPath, ".git"))) {
     return check("warn", "vault_git_remote", "Vault git remote", "Vault is not a git repository \u2014 sync features unavailable");
   }
   try {
@@ -5508,9 +5712,9 @@ function checkObsidianTemplates(resolvedPath) {
     return check("error", "obsidian_templates", "Obsidian templates", "Cannot check \u2014 WIKI_PATH not resolved");
   }
   const missing = [];
-  if (!existsSync13(join24(resolvedPath, "_Templates"))) missing.push("_Templates/");
-  if (!existsSync13(join24(resolvedPath, ".obsidian", "templates.json"))) missing.push(".obsidian/templates.json");
-  if (!existsSync13(join24(resolvedPath, ".obsidian", "app.json"))) missing.push(".obsidian/app.json");
+  if (!existsSync13(join25(resolvedPath, "_Templates"))) missing.push("_Templates/");
+  if (!existsSync13(join25(resolvedPath, ".obsidian", "templates.json"))) missing.push(".obsidian/templates.json");
+  if (!existsSync13(join25(resolvedPath, ".obsidian", "app.json"))) missing.push(".obsidian/app.json");
   if (missing.length === 0) {
     return check("pass", "obsidian_templates", "Obsidian templates", "Template folder and config present");
   }
@@ -5520,7 +5724,7 @@ function checkDotStoreClean(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("error", "dsstore_clean", "No .DS_Store in raw/", "Cannot check \u2014 WIKI_PATH not resolved");
   }
-  const rawDir = join24(resolvedPath, "raw");
+  const rawDir = join25(resolvedPath, "raw");
   if (!existsSync13(rawDir)) {
     return check("pass", "dsstore_clean", "No .DS_Store in raw/", "raw/ directory not found \u2014 check skipped");
   }
@@ -5536,7 +5740,7 @@ function checkDotStoreClean(resolvedPath) {
       if (entry.name === ".DS_Store") {
         found.push(rel ? `${rel}/.DS_Store` : ".DS_Store");
       } else if (entry.isDirectory()) {
-        walk(join24(dir, entry.name), rel ? `${rel}/${entry.name}` : entry.name);
+        walk(join25(dir, entry.name), rel ? `${rel}/${entry.name}` : entry.name);
       }
     }
   })(rawDir, "");
@@ -5567,7 +5771,7 @@ function checkSyncLastPush(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("error", "sync_last_push", "Vault sync recency", "Cannot check \u2014 WIKI_PATH not resolved");
   }
-  if (!existsSync13(join24(resolvedPath, ".git"))) {
+  if (!existsSync13(join25(resolvedPath, ".git"))) {
     return check("pass", "sync_last_push", "Vault sync recency", "No git repo \u2014 sync check skipped");
   }
   let timestamp;
@@ -5604,7 +5808,8 @@ function hasOriginMain(resolvedPath) {
     execSync2("git rev-parse --verify --quiet origin/main", {
       cwd: resolvedPath,
       encoding: "utf8",
-      stdio: ["pipe", "pipe", "pipe"]
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 2e3
     });
     return true;
   } catch {
@@ -5615,14 +5820,15 @@ function checkVaultGitDirty(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("pass", "vault_git_dirty", "Vault git dirty state", "No vault path \u2014 check skipped");
   }
-  if (!existsSync13(join24(resolvedPath, ".git"))) {
+  if (!existsSync13(join25(resolvedPath, ".git"))) {
     return check("pass", "vault_git_dirty", "Vault git dirty state", "No git repo \u2014 check skipped");
   }
   try {
     const lines = execSync2("git status --porcelain", {
       cwd: resolvedPath,
       encoding: "utf8",
-      stdio: ["pipe", "pipe", "pipe"]
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 5e3
     }).trim().split("\n").filter(Boolean);
     if (lines.length > 0) {
       return check("warn", "vault_git_dirty", "Vault git dirty state", `${lines.length} dirty file(s) in vault worktree`);
@@ -5683,7 +5889,7 @@ function remoteMainHash(resolvedPath) {
 }
 function checkStaleRemoteMain(resolvedPath) {
   if (resolvedPath === void 0) return void 0;
-  if (!existsSync13(join24(resolvedPath, ".git"))) return void 0;
+  if (!existsSync13(join25(resolvedPath, ".git"))) return void 0;
   const localOrigin = gitRefHash(resolvedPath, "origin/main");
   if (!localOrigin) return void 0;
   const remoteMain = remoteMainHash(resolvedPath);
@@ -5699,7 +5905,7 @@ function checkVaultLocalGit(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("warn", "vault_local_git", "Vault local git", "Cannot check \u2014 WIKI_PATH not resolved");
   }
-  if (!existsSync13(join24(resolvedPath, ".git"))) {
+  if (!existsSync13(join25(resolvedPath, ".git"))) {
     return check("warn", "vault_local_git", "Vault local git", "Not a git repository - sync features unavailable");
   }
   try {
@@ -5718,7 +5924,7 @@ function checkVaultGithubRemote(resolvedPath, exec) {
   if (resolvedPath === void 0) {
     return check("pass", "vault_github_remote", "Vault GitHub remote", "No vault path \u2014 check skipped");
   }
-  if (!existsSync13(join24(resolvedPath, ".git"))) {
+  if (!existsSync13(join25(resolvedPath, ".git"))) {
     return check("pass", "vault_github_remote", "Vault GitHub remote", "No git repo \u2014 check skipped");
   }
   const state = probeGithubReachability(resolvedPath, exec);
@@ -5762,7 +5968,7 @@ function checkVaultPromotionLag(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("pass", "vault_promotion_lag", "Vault promotion lag", "No vault path \u2014 check skipped");
   }
-  if (!existsSync13(join24(resolvedPath, ".git"))) {
+  if (!existsSync13(join25(resolvedPath, ".git"))) {
     return check("pass", "vault_promotion_lag", "Vault promotion lag", "No git repo \u2014 check skipped");
   }
   try {
@@ -5789,7 +5995,7 @@ function checkVaultGitComparison(resolvedPath, id, label, range, nonZeroSuffix,
   if (resolvedPath === void 0) {
     return check("pass", id, label, "No vault path \u2014 check skipped");
   }
-  if (!existsSync13(join24(resolvedPath, ".git"))) {
+  if (!existsSync13(join25(resolvedPath, ".git"))) {
     return check("pass", id, label, "No git repo \u2014 check skipped");
   }
   if (!hasOriginMain(resolvedPath)) {
@@ -5799,7 +6005,8 @@ function checkVaultGitComparison(resolvedPath, id, label, range, nonZeroSuffix,
     const count = parseInt(execSync2(`git rev-list --count ${range}`, {
       cwd: resolvedPath,
       encoding: "utf8",
-      stdio: ["pipe", "pipe", "pipe"]
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 5e3
     }).trim(), 10);
     if (count > 0) {
       return check("warn", id, label, `${count} commit(s) ${nonZeroSuffix}`);
@@ -5905,11 +6112,11 @@ async function checkFleetIdentity(input) {
 }
 function pullLogPaths(home) {
   const paths = platform2() === "darwin" ? [
-    join24(home, "Library", "Logs", "wiki-pull.log"),
-    join24(home, ".local", "state", "vault-sync", "log", "wiki-pull.log")
+    join25(home, "Library", "Logs", "wiki-pull.log"),
+    join25(home, ".local", "state", "vault-sync", "log", "wiki-pull.log")
   ] : [
-    join24(home, ".local", "state", "vault-sync", "log", "wiki-pull.log"),
-    join24(home, "Library", "Logs", "wiki-pull.log")
+    join25(home, ".local", "state", "vault-sync", "log", "wiki-pull.log"),
+    join25(home, "Library", "Logs", "wiki-pull.log")
   ];
   return [...new Set(paths)];
 }
@@ -5949,7 +6156,7 @@ function checkS3MountPerf(resolvedPath) {
     return check("pass", "s3_mount_perf", "S3 mount performance", "local disk");
   }
   const mountPoint = fuse.mountPoint;
-  const conceptsDir = join24(resolvedPath, "concepts");
+  const conceptsDir = join25(resolvedPath, "concepts");
   if (!existsSync13(conceptsDir)) {
     return check("pass", "s3_mount_perf", "S3 mount performance", `S3 FUSE mount (${mountPoint}), no concepts/ to benchmark`);
   }
@@ -6132,7 +6339,7 @@ function checkWriteTest(resolvedPath) {
   if (!fuse) {
     return check("pass", "s3_write_test", "S3 write test", "local disk \u2014 check skipped");
   }
-  const conceptsDir = join24(resolvedPath, "concepts");
+  const conceptsDir = join25(resolvedPath, "concepts");
   if (!existsSync13(conceptsDir)) {
     return check("pass", "s3_write_test", "S3 write test", "no concepts/ dir to test \u2014 check skipped");
   }
@@ -6234,7 +6441,7 @@ function checkVaultSyncPullHelper(home, env) {
   );
 }
 function checkVaultSyncReviewRequiredJournals(vaultPath) {
-  if (!vaultPath || !existsSync13(join24(vaultPath, ".git"))) {
+  if (!vaultPath || !existsSync13(join25(vaultPath, ".git"))) {
     return check("pass", "vault_sync_review_required_journals", "Review-required journals", "No git vault \u2014 check skipped");
   }
   try {
@@ -6255,7 +6462,7 @@ function checkVaultSyncReviewRequiredJournals(vaultPath) {
 }
 function readVaultSyncConfig(home) {
   try {
-    const content = readFileSync10(join24(home, ".skillwiki", ".env"), "utf8");
+    const content = readFileSync10(join25(home, ".skillwiki", ".env"), "utf8");
     let installed = false;
     let role;
     let serviceScope;
@@ -6323,14 +6530,14 @@ function vaultSyncChecks(input) {
     ];
   }
   const isMac = os === "darwin";
-  const logDir = input.logDir ?? (isMac ? join24(home, "Library", "Logs") : join24(home, ".local", "state", "vault-sync", "log"));
-  const shareDir = input.shareDir ?? (isMac ? join24(home, "Library", "Application Support", "vault-sync", "bin") : join24(home, ".local", "share", "vault-sync", "bin"));
-  const filterPath = input.filterPath ?? join24(home, ".config", "rclone", "wiki-push-filters.txt");
-  const packagedSnapshotPath = join24(shareDir, "wiki-snapshot.sh");
+  const logDir = input.logDir ?? (isMac ? join25(home, "Library", "Logs") : join25(home, ".local", "state", "vault-sync", "log"));
+  const shareDir = input.shareDir ?? (isMac ? join25(home, "Library", "Application Support", "vault-sync", "bin") : join25(home, ".local", "share", "vault-sync", "bin"));
+  const filterPath = input.filterPath ?? join25(home, ".config", "rclone", "wiki-push-filters.txt");
+  const packagedSnapshotPath = join25(shareDir, "wiki-snapshot.sh");
   const legacySnapshotPath = "/root/.hermes/scripts/wiki-snapshot-v3.sh";
   const snapshotPath = input.snapshotScriptPath ?? (existsSync13(packagedSnapshotPath) ? packagedSnapshotPath : legacySnapshotPath);
   function snapshotLastStatusCheck() {
-    const snapshotLog = join24(logDir, "wiki-snapshot.log");
+    const snapshotLog = join25(logDir, "wiki-snapshot.log");
     try {
       const logContent = readFileSync10(snapshotLog, "utf8");
       const lines = logContent.trim().split("\n").filter(Boolean);
@@ -6379,7 +6586,7 @@ function vaultSyncChecks(input) {
   if (input.vaultSyncRole === "snapshotter") {
     const c12 = existsSync13(snapshotPath) ? check("pass", "vault_sync_installed", "Vault sync installed", `Found snapshot script: ${snapshotPath}`) : check("error", "vault_sync_installed", "Vault sync installed", `Snapshot script not found at ${snapshotPath}`);
     const serviceScope = input.vaultSyncServiceScope ?? "user";
-    const userTimerPath = join24(home, ".config", "systemd", "user", "wiki-snapshot.timer");
+    const userTimerPath = join25(home, ".config", "systemd", "user", "wiki-snapshot.timer");
     const systemTimerPath = "/etc/systemd/system/wiki-snapshot.timer";
     let c22;
     if (serviceScope === "user" && existsSync13(userTimerPath)) {
@@ -6451,7 +6658,7 @@ function vaultSyncChecks(input) {
     }
     return [c12, c22, c32, cFetch2, c42, c52];
   }
-  const pushScriptPath = join24(shareDir, "wiki-push.sh");
+  const pushScriptPath = join25(shareDir, "wiki-push.sh");
   const c1 = existsSync13(pushScriptPath) ? check("pass", "vault_sync_installed", "Vault sync installed", `Found: ${pushScriptPath}`) : check("error", "vault_sync_installed", "Vault sync installed", `Script not found at ${pushScriptPath} \u2014 run vault-sync-install`);
   let c2;
   try {
@@ -6503,7 +6710,7 @@ function vaultSyncChecks(input) {
       "Scheduler check failed \u2014 run vault-sync-install"
     );
   }
-  const logFile = join24(logDir, "wiki-push.log");
+  const logFile = join25(logDir, "wiki-push.log");
   let c3;
   try {
     const logContent = readFileSync10(logFile, "utf8");
@@ -6574,7 +6781,7 @@ function vaultSyncChecks(input) {
       `Log directory not found at ${logDir}`
     );
   }
-  const fetchLogFile = join24(logDir, "wiki-fetch.log");
+  const fetchLogFile = join25(logDir, "wiki-fetch.log");
   let cFetch;
   try {
     const logContent = readFileSync10(fetchLogFile, "utf8");
@@ -6718,15 +6925,15 @@ function findSkillMd(dir) {
   }
   for (const entry of entries) {
     if (entry.isFile() && entry.name === "SKILL.md") {
-      results.push(join24(dir, entry.name));
+      results.push(join25(dir, entry.name));
     } else if (entry.isDirectory()) {
-      results.push(...findSkillMd(join24(dir, entry.name)));
+      results.push(...findSkillMd(join25(dir, entry.name)));
     }
   }
   return results;
 }
 function findInstalledSkillMd(dir) {
-  const directSkills = findSkillNames(dir).map((name) => join24(dir, name, "SKILL.md"));
+  const directSkills = findSkillNames(dir).map((name) => join25(dir, name, "SKILL.md"));
   return directSkills.length > 0 ? directSkills : findSkillMd(dir);
 }
 function findSkillNames(dir) {
@@ -6738,13 +6945,16 @@ function findSkillNames(dir) {
     return results;
   }
   for (const entry of entries) {
-    if (entry.isDirectory() && existsSync13(join24(dir, entry.name, "SKILL.md"))) {
+    if (entry.isDirectory() && existsSync13(join25(dir, entry.name, "SKILL.md"))) {
       results.push(entry.name);
     }
   }
   return results;
 }
 var METRIC_TYPES = ["entities", "concepts", "comparisons", "queries", "meta"];
+function doctorReadOnlyScanRoot(resolvedPath) {
+  return resolveReadOnlyVaultRoot(resolvedPath).root;
+}
 async function vaultMetrics(resolvedPath) {
   const ids = [
     ["vault_metric_pages", "Vault pages by type"],
@@ -6755,7 +6965,8 @@ async function vaultMetrics(resolvedPath) {
   ];
   const noVault = () => ids.map(([id, label]) => check("info", id, label, "no vault configured"));
   if (!resolvedPath) return noVault();
-  const scan = await scanVault(resolvedPath);
+  const scanRoot = doctorReadOnlyScanRoot(resolvedPath);
+  const scan = await scanVault(scanRoot);
   if (!scan.ok) return noVault();
   const tk = scan.data.typedKnowledge;
   const perType = METRIC_TYPES.map((d) => `${d} ${tk.filter((p) => p.relPath.startsWith(d + "/")).length}`).join(", ");
@@ -6782,7 +6993,7 @@ async function vaultMetrics(resolvedPath) {
   }
   let logLines = 0;
   try {
-    logLines = readFileSync10(join24(resolvedPath, "log.md"), "utf8").split("\n").length;
+    logLines = readFileSync10(join25(scanRoot, "log.md"), "utf8").split("\n").length;
   } catch {
   }
   return [
@@ -6844,8 +7055,9 @@ async function runDoctor(input) {
   checks.push(checkVaultS3Remote(input.home, input.execProbe, input.env ?? process.env));
   checks.push(checkVaultSnapshotterReachable(fleetLoad, input.checkSnapshotter, input.execProbe));
   checks.push(checkVaultPromotionLag(gitCheckPath));
-  checks.push(checkDotStoreClean(resolvedPath));
-  checks.push(checkVaultConflictMarkers(resolvedPath));
+  const readOnlyScanRoot = resolvedPath ? doctorReadOnlyScanRoot(resolvedPath) : void 0;
+  checks.push(checkDotStoreClean(readOnlyScanRoot));
+  checks.push(checkVaultConflictMarkers(readOnlyScanRoot));
   checks.push(checkS3MountPerf(resolvedPath));
   checks.push(checkS3MountFreshness(resolvedPath));
   checks.push(checkRcloneFlagAudit(resolvedPath));
@@ -6913,9 +7125,9 @@ function readCliPackageJson(baseUrl = import.meta.url) {
 }
 
 // src/commands/observe.ts
-import { mkdir as mkdir5, writeFile as writeFile4 } from "fs/promises";
+import { mkdir as mkdir6, writeFile as writeFile4 } from "fs/promises";
 import { existsSync as existsSync14, statSync as statSync3 } from "fs";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 import { createHash as createHash6 } from "crypto";
 var ALLOWED_KINDS = /* @__PURE__ */ new Set(["note", "bug", "task", "idea", "session-log"]);
 function slugify(text) {
@@ -6944,9 +7156,9 @@ async function runObserve(input) {
       result: err("VAULT_PATH_INVALID", { path: input.vault })
     };
   }
-  const transcriptsDir = join25(input.vault, "raw", "transcripts");
+  const transcriptsDir = join26(input.vault, "raw", "transcripts");
   try {
-    await mkdir5(transcriptsDir, { recursive: true });
+    await mkdir6(transcriptsDir, { recursive: true });
   } catch {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
@@ -6956,7 +7168,7 @@ async function runObserve(input) {
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const slug = slugify(input.text);
   const fileName = `${today}-observation-${slug}.md`;
-  const filePath = join25(transcriptsDir, fileName);
+  const filePath = join26(transcriptsDir, fileName);
   const body = `
 ${input.text.trim()}
 `;
@@ -6997,8 +7209,8 @@ ${input.text.trim()}
 
 // src/commands/memory.ts
 import { createHash as createHash7 } from "crypto";
-import { mkdir as mkdir6, readFile as readFile16, readdir as readdir4, stat as stat5, writeFile as writeFile5 } from "fs/promises";
-import { basename as basename2, extname, join as join26, relative as relative3, sep as sep3 } from "path";
+import { mkdir as mkdir7, readFile as readFile17, readdir as readdir5, stat as stat5, writeFile as writeFile5 } from "fs/promises";
+import { basename as basename2, extname, join as join27, relative as relative3, sep as sep3 } from "path";
 
 // src/utils/memory-authority.ts
 var TIER_RANK = {
@@ -7117,8 +7329,8 @@ async function runMemoryIndex(input) {
   }
   const generatedAt = (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "Z");
   const relCachePath = memoryCacheRelPath(input.project);
-  const absCachePath = join26(input.vault, relCachePath);
-  await mkdir6(join26(input.vault, ".skillwiki", "memory", input.project), { recursive: true });
+  const absCachePath = join27(input.vault, relCachePath);
+  await mkdir7(join27(input.vault, ".skillwiki", "memory", input.project), { recursive: true });
   await writeFile5(absCachePath, `${JSON.stringify({
     generated_at: generatedAt,
     project: input.project,
@@ -7310,7 +7522,7 @@ async function buildMemoryIndexState(pages, project) {
 }
 async function checkMemoryIndex(vault, project, current) {
   const relCachePath = memoryCacheRelPath(project);
-  const cacheText = await readIfExists2(join26(vault, relCachePath));
+  const cacheText = await readIfExists2(join27(vault, relCachePath));
   if (!cacheText) {
     return {
       ok: true,
@@ -7703,7 +7915,7 @@ function renderMemoryIndexStatusHint(status) {
 }
 async function readIfExists2(path) {
   try {
-    return await readFile16(path, "utf8");
+    return await readFile17(path, "utf8");
   } catch {
     return "";
   }
@@ -7716,10 +7928,10 @@ async function collectImportFiles(source) {
   return files.sort((a, b) => a.localeCompare(b));
 }
 async function walkImportFiles(dir, out) {
-  const entries = await readdir4(dir, { withFileTypes: true });
+  const entries = await readdir5(dir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.name === ".git" || entry.name === "node_modules") continue;
-    const path = join26(dir, entry.name);
+    const path = join27(dir, entry.name);
     if (entry.isDirectory()) {
       await walkImportFiles(path, out);
     } else if (entry.isFile() && isImportCandidate(path)) {
@@ -7734,7 +7946,7 @@ function isImportCandidate(path) {
 async function buildImportEntry(file, sourceRoot, project, today, maxBytes) {
   const st = await stat5(file);
   const sourceKind = classifyImportSource(file);
-  const hash = createHash7("sha256").update(await readFile16(file)).digest("hex");
+  const hash = createHash7("sha256").update(await readFile17(file)).digest("hex");
   const baseEntry = {
     source_path: file,
     source_kind: sourceKind,
@@ -7757,7 +7969,7 @@ async function buildImportEntry(file, sourceRoot, project, today, maxBytes) {
       reason: "policy_source_not_imported"
     };
   }
-  const text = await readFile16(file, "utf8");
+  const text = await readFile17(file, "utf8");
   const extracted = extractImportText(text, sourceKind);
   if (!extracted) {
     return {
@@ -7786,8 +7998,8 @@ async function writeImportCapture(vault, entry, today) {
   const content = hiddenString(entry, "__content");
   const project = hiddenString(entry, "__project");
   const relPath = await availableImportPath(vault, entry.proposed_path);
-  const absPath = join26(vault, relPath);
-  await mkdir6(join26(vault, "raw", "transcripts"), { recursive: true });
+  const absPath = join27(vault, relPath);
+  await mkdir7(join27(vault, "raw", "transcripts"), { recursive: true });
   await writeFile5(absPath, renderImportCapture(entry, content, project, today), "utf8");
   const validation = await runValidate({ file: absPath });
   return {
@@ -7803,7 +8015,7 @@ async function availableImportPath(vault, proposed) {
   const stem = proposed.slice(0, -ext.length);
   let candidate = proposed;
   let i = 2;
-  while (await readIfExists2(join26(vault, candidate))) {
+  while (await readIfExists2(join27(vault, candidate))) {
     candidate = `${stem}-${i}${ext}`;
     i++;
   }
@@ -7988,10 +8200,10 @@ function memoryCacheRelPath(project) {
 }
 async function readMemoryCache(vault, project) {
   if (project) {
-    const projectCache = await readIfExists2(join26(vault, memoryCacheRelPath(project)));
+    const projectCache = await readIfExists2(join27(vault, memoryCacheRelPath(project)));
     if (projectCache) return projectCache;
   }
-  return readIfExists2(join26(vault, ".skillwiki", "memory-topics.json"));
+  return readIfExists2(join27(vault, ".skillwiki", "memory-topics.json"));
 }
 function dedupePages(pages) {
   const seen = /* @__PURE__ */ new Set();
@@ -8082,8 +8294,8 @@ function slugify2(value) {
 }
 
 // src/commands/query.ts
-import { readFile as readFile17, stat as stat6 } from "fs/promises";
-import { join as join27 } from "path";
+import { readFile as readFile18, stat as stat6 } from "fs/promises";
+import { join as join28 } from "path";
 var W_KEYWORD = 2;
 var W_SOURCE_OVERLAP = 4;
 var W_WIKILINK = 3;
@@ -8204,7 +8416,7 @@ function computeKeywordScore(terms, title, tags, body) {
   return score;
 }
 async function loadOrBuildGraph(vault) {
-  const graphPath = join27(vault, ".skillwiki", "graph.json");
+  const graphPath = join28(vault, ".skillwiki", "graph.json");
   let needsBuild = false;
   try {
     const fileStat = await stat6(graphPath);
@@ -8218,7 +8430,7 @@ async function loadOrBuildGraph(vault) {
     if (buildResult.exitCode !== 0) return null;
   }
   try {
-    const raw = await readFile17(graphPath, "utf8");
+    const raw = await readFile18(graphPath, "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -8233,7 +8445,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z } from "zod";
 
 // src/mcp/vault-resolve.ts
-import { join as join28, resolve as resolve7 } from "path";
+import { join as join29, resolve as resolve7 } from "path";
 
 // src/mcp/allowlist.ts
 import { resolve as resolve6, sep as sep4 } from "path";
@@ -8295,7 +8507,7 @@ async function resolveMcpVault(input) {
   return ok({ vault: vaultPath, source });
 }
 function defaultGraphOut(vault) {
-  return join28(vault, ".skillwiki", "graph.json");
+  return join29(vault, ".skillwiki", "graph.json");
 }
 
 // src/mcp/result-format.ts
@@ -8312,7 +8524,7 @@ function formatToolResult(payload) {
 // src/mcp/audit-log.ts
 import { appendFileSync, mkdirSync as mkdirSync5 } from "fs";
 import { homedir } from "os";
-import { join as join29 } from "path";
+import { join as join30 } from "path";
 function auditEnabled() {
   const v = process.env.SKILLWIKI_MCP_AUDIT;
   if (v === "0" || v === "false") return false;
@@ -8324,7 +8536,7 @@ function auditSink() {
 function auditFilePath() {
   const custom = process.env.SKILLWIKI_MCP_AUDIT_FILE;
   if (custom && custom.length > 0) return custom;
-  return join29(homedir(), ".skillwiki", "mcp-audit.jsonl");
+  return join30(homedir(), ".skillwiki", "mcp-audit.jsonl");
 }
 function auditMcpToolCall(entry) {
   if (!auditEnabled()) return;
@@ -8334,7 +8546,7 @@ function auditMcpToolCall(entry) {
     return;
   }
   const path = auditFilePath();
-  mkdirSync5(join29(path, ".."), { recursive: true });
+  mkdirSync5(join30(path, ".."), { recursive: true });
   appendFileSync(path, line, "utf8");
 }
 async function runMcpToolHandler(tool, input, fn) {
@@ -8554,8 +8766,8 @@ function registerMcpMutatingTools(server) {
 }
 
 // src/mcp/resources.ts
-import { readFile as readFile19 } from "fs/promises";
-import { join as join31 } from "path";
+import { readFile as readFile20 } from "fs/promises";
+import { join as join32 } from "path";
 import { ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 
 // src/mcp/lint-bucket.ts
@@ -8683,8 +8895,8 @@ async function fetchQueryPreview(input) {
 }
 
 // src/mcp/graph-html.ts
-import { readFile as readFile18 } from "fs/promises";
-import { join as join30 } from "path";
+import { readFile as readFile19 } from "fs/promises";
+import { join as join31 } from "path";
 import { existsSync as existsSync15 } from "fs";
 var TYPE_COLORS = {
   entities: "#e74c3c",
@@ -8753,7 +8965,7 @@ ${nodeSvg}
   return { html, node_count: nodes.length, edge_count: edges.length, truncated };
 }
 async function fetchGraphHtmlReport(input) {
-  const graphPath = input.graphPath ?? join30(input.vault, ".skillwiki", "graph.json");
+  const graphPath = input.graphPath ?? join31(input.vault, ".skillwiki", "graph.json");
   const maxNodes = Math.min(Math.max(10, input.maxNodes ?? 120), 500);
   if (!existsSync15(graphPath)) {
     return {
@@ -8763,7 +8975,7 @@ async function fetchGraphHtmlReport(input) {
   }
   let raw;
   try {
-    raw = await readFile18(graphPath, "utf8");
+    raw = await readFile19(graphPath, "utf8");
   } catch (e) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
@@ -8827,7 +9039,7 @@ async function fetchStaleSummary(input) {
 
 // src/mcp/resources.ts
 async function readVaultFile(vault, rel) {
-  return readFile19(join31(vault, rel), "utf8");
+  return readFile20(join32(vault, rel), "utf8");
 }
 async function tailLines(text, lines) {
   const parts = text.split(/\r?\n/);
@@ -8913,9 +9125,9 @@ function registerMcpResources(server) {
       if (!v.ok) {
         return { contents: [{ uri: uri.href, mimeType: "text/plain", text: JSON.stringify(v) }] };
       }
-      const path = join31(v.data.vault, ".skillwiki", "graph.json");
+      const path = join32(v.data.vault, ".skillwiki", "graph.json");
       try {
-        const raw = await readFile19(path, "utf8");
+        const raw = await readFile20(path, "utf8");
         const graph = JSON.parse(raw);
         const adjacency = graph.adjacency ?? {};
         const nodes = Object.keys(adjacency);
@@ -9228,6 +9440,8 @@ export {
   readLastOp,
   appendLastOp,
   clearLastOp,
+  writeLogEvent,
+  readLogEvents,
   runLogAppend,
   renderIndexUpsert,
   upsertIndexEntry,
@@ -9258,6 +9472,7 @@ export {
   runStale,
   runPagesize,
   runLogRotate,
+  scanConflictMarkerBlocksInText,
   runTopicMapCheck,
   runIndexLinkFormat,
   normalizeRemoteRoot,