skillwiki 0.9.61 → 0.9.63

package/dist/{chunk-FU462DVS.js → chunk-TUFQZ5K4.js}

@@ -328,34 +328,162 @@ function getErrorMessage(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
-// src/commands/validate.ts
-import { readFile, writeFile } from "fs/promises";
-import { join, resolve, relative, sep } from "path";
+// src/commands/log-append.ts
+import { readFile as readFile2, stat } from "fs/promises";
+import { join as join4 } from "path";
 
-// src/parsers/frontmatter.ts
-import yaml from "js-yaml";
-var FM_OPEN = /^---\r?\n/;
-function splitFrontmatter(text) {
-  if (!FM_OPEN.test(text)) return ok({ rawFrontmatter: "", body: text, bodyStart: 0 });
-  const afterOpen = text.replace(FM_OPEN, "");
-  const closeIdx = afterOpen.search(/\r?\n---\r?\n/);
-  if (closeIdx === -1) return err("MISSING_CLOSING_DELIMITER");
-  const rawFrontmatter = afterOpen.slice(0, closeIdx);
-  const closeMatch = afterOpen.slice(closeIdx).match(/\r?\n---\r?\n/);
-  const bodyStart = text.length - (afterOpen.length - closeIdx - closeMatch[0].length);
-  const body = text.slice(bodyStart);
-  return ok({ rawFrontmatter, body, bodyStart });
+// src/utils/last-op.ts
+import { readFileSync, writeFileSync, mkdirSync, unlinkSync, existsSync } from "fs";
+import { join } from "path";
+var LAST_OP_DIR = ".skillwiki";
+var LAST_OP_FILE = "last-op.json";
+function lastOpPath(vault) {
+  return join(vault, LAST_OP_DIR, LAST_OP_FILE);
 }
-function extractFrontmatter(text) {
-  const split = splitFrontmatter(text);
-  if (!split.ok) return split;
-  if (!split.data.rawFrontmatter) return ok({});
+function readLastOp(vault) {
+  const p = lastOpPath(vault);
+  if (!existsSync(p)) return [];
   try {
-    const parsed = yaml.load(split.data.rawFrontmatter, { schema: yaml.JSON_SCHEMA });
-    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return ok({});
-    return ok(parsed);
-  } catch (e) {
-    return err("INVALID_FRONTMATTER", { message: getErrorMessage(e) });
+    const raw = readFileSync(p, "utf8");
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed)) {
+      unlinkSync(p);
+      return [];
+    }
+    return parsed;
+  } catch {
+    try {
+      unlinkSync(p);
+    } catch (_e) {
+    }
+    return [];
+  }
+}
+function appendLastOp(vault, entry) {
+  const existing = readLastOp(vault);
+  existing.push(entry);
+  const dir = join(vault, LAST_OP_DIR);
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  writeFileSync(lastOpPath(vault), JSON.stringify(existing, null, 2), "utf8");
+}
+function clearLastOp(vault) {
+  const p = lastOpPath(vault);
+  try {
+    unlinkSync(p);
+  } catch (_e) {
+  }
+}
+
+// src/utils/atomic-write.ts
+import { randomBytes } from "crypto";
+import { open, readFile, rename, unlink } from "fs/promises";
+import { basename, dirname, join as join2 } from "path";
+async function readExisting(path) {
+  try {
+    return await readFile(path, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+async function atomicWriteText(path, text) {
+  let existing;
+  try {
+    existing = await readExisting(path);
+  } catch (error) {
+    return err("WRITE_FAILED", { path, phase: "read-existing", message: String(error) });
+  }
+  if (existing === text) return ok({ changed: false, existed: true });
+  const tmp = join2(
+    dirname(path),
+    `.${basename(path)}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`
+  );
+  try {
+    const handle = await open(tmp, "wx");
+    try {
+      await handle.writeFile(text, "utf8");
+      try {
+        await handle.sync();
+      } catch {
+      }
+    } finally {
+      await handle.close();
+    }
+    await rename(tmp, path);
+    return ok({ changed: true, existed: existing !== null });
+  } catch (error) {
+    try {
+      await unlink(tmp);
+    } catch {
+    }
+    return err("WRITE_FAILED", { path, phase: "atomic-write", message: String(error) });
+  }
+}
+
+// src/utils/log-lock.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, statSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join as join3 } from "path";
+function logLockPath(vault) {
+  return join3(vault, ".skillwiki", "log-append.lock");
+}
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+function readLogLock(path) {
+  try {
+    return JSON.parse(readFileSync2(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+async function acquireLogLock(vault, opts = {}) {
+  const retryMs = opts.retryMs ?? 2e3;
+  const pollMs = opts.pollMs ?? 50;
+  const staleMs = opts.staleMs ?? 1e4;
+  const reclaimStale = opts.reclaimStale ?? true;
+  const path = logLockPath(vault);
+  const dir = join3(vault, ".skillwiki");
+  if (!existsSync2(dir)) mkdirSync2(dir, { recursive: true });
+  const deadline = Date.now() + retryMs;
+  const ownerToken = randomBytes2(16).toString("hex");
+  const acquired = (/* @__PURE__ */ new Date()).toISOString();
+  const content = JSON.stringify({ pid: process.pid, owner_token: ownerToken, acquired }) + "\n";
+  for (; ; ) {
+    try {
+      writeFileSync2(path, content, { flag: "wx" });
+      return ok({ vault, path, ownerToken, acquired });
+    } catch (error) {
+      const fsError = error;
+      if (fsError.code !== "EEXIST") {
+        return err("WRITE_FAILED", { path, message: String(error) });
+      }
+    }
+    if (reclaimStale) {
+      try {
+        const age = Date.now() - statSync(path).mtimeMs;
+        if (age > staleMs) {
+          unlinkSync2(path);
+          continue;
+        }
+      } catch {
+        continue;
+      }
+    }
+    if (Date.now() >= deadline) return err("LOG_APPEND_LOCK_HELD", { vault });
+    await sleep(pollMs);
+  }
+}
+function releaseLogLock(handle) {
+  const existing = readLogLock(handle.path);
+  if (!existing || existing.owner_token !== handle.ownerToken || existing.acquired !== handle.acquired) {
+    return err("LOG_APPEND_LOCK_HELD", {
+      message: "log append lock ownership changed; refusing release"
+    });
+  }
+  try {
+    unlinkSync2(handle.path);
+    return ok({ released: true });
+  } catch (error) {
+    return err("WRITE_FAILED", { path: handle.path, message: String(error) });
   }
 }
 
@@ -499,15 +627,490 @@ function redactSensitiveContent(text, opts = {}) {
   };
 }
 
+// src/commands/log-append.ts
+var ENTRY_RE = /^## \[(\d{4})-\d{2}-\d{2}\]/gm;
+function operationMarker(operationId) {
+  if (!/^[0-9a-f]{64}$/.test(operationId)) {
+    return err("USAGE", { message: "operationId must be a SHA-256 hex string" });
+  }
+  return ok(`<!-- skillwiki-page-publish:${operationId} -->`);
+}
+async function appendWhileLocked(logPath, content, marker) {
+  let logText;
+  try {
+    logText = await readFile2(logPath, "utf8");
+  } catch {
+    return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: logPath }) };
+  }
+  const entriesBefore = [...logText.matchAll(ENTRY_RE)].length;
+  if (marker && logText.includes(marker)) {
+    return {
+      exitCode: ExitCode.OK,
+      result: ok({
+        entries_before: entriesBefore,
+        entries_after: entriesBefore,
+        appended: false,
+        humanHint: `publication operation already appended (${entriesBefore} entries)`
+      })
+    };
+  }
+  const body = logText.replace(/\s+$/, "");
+  const appendedContent = marker ? `${content}
+${marker}` : content;
+  const written = await atomicWriteText(logPath, `${body}
+
+${appendedContent}
+`);
+  if (!written.ok) {
+    return { exitCode: ExitCode.WRITE_FAILED, result: written };
+  }
+  const entriesAfter = entriesBefore + 1;
+  return {
+    exitCode: ExitCode.OK,
+    result: ok({
+      entries_before: entriesBefore,
+      entries_after: entriesAfter,
+      appended: true,
+      humanHint: `appended log entry (${entriesBefore}->${entriesAfter})`
+    })
+  };
+}
+async function runLogAppend(input) {
+  try {
+    await stat(join4(input.vault, "SCHEMA.md"));
+  } catch {
+    return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { vault: input.vault }) };
+  }
+  const content = (input.content ?? "").trim();
+  if (content.length === 0) {
+    return { exitCode: ExitCode.USAGE, result: err("USAGE", { message: "--content must be a non-empty log entry" }) };
+  }
+  const sensitive = scanSensitiveContent(content, { file: "log.md" });
+  if (sensitive.length > 0) {
+    return {
+      exitCode: ExitCode.SENSITIVE_CONTENT_DETECTED,
+      result: err("SENSITIVE_CONTENT_DETECTED", { file: "log.md", findings: sensitive })
+    };
+  }
+  let marker;
+  if (input.operationId !== void 0) {
+    const operation = operationMarker(input.operationId);
+    if (!operation.ok) return { exitCode: ExitCode.USAGE, result: operation };
+    marker = operation.data;
+  }
+  const acquired = await acquireLogLock(input.vault, input.strictLock ? { reclaimStale: false } : {});
+  if (!acquired.ok) {
+    if (acquired.error === "WRITE_FAILED") {
+      return { exitCode: ExitCode.WRITE_FAILED, result: acquired };
+    }
+    return { exitCode: ExitCode.LOG_APPEND_LOCK_HELD, result: err("LOG_APPEND_LOCK_HELD", { vault: input.vault }) };
+  }
+  const lockHandle = acquired.data;
+  const logPath = join4(input.vault, "log.md");
+  let outcome;
+  let released;
+  try {
+    outcome = await appendWhileLocked(logPath, content, marker);
+  } catch (error) {
+    outcome = {
+      exitCode: ExitCode.WRITE_FAILED,
+      result: err("WRITE_FAILED", { stage: "log-append", message: String(error) })
+    };
+  } finally {
+    released = releaseLogLock(lockHandle);
+  }
+  if (released === void 0 || !released.ok) {
+    return {
+      exitCode: ExitCode.WRITE_FAILED,
+      result: err("WRITE_FAILED", { stage: "log-unlock" })
+    };
+  }
+  if (outcome === void 0) {
+    return {
+      exitCode: ExitCode.WRITE_FAILED,
+      result: err("WRITE_FAILED", { stage: "log-append" })
+    };
+  }
+  if (outcome.result.ok && outcome.result.data.appended && input.recordLastOp !== false) {
+    try {
+      appendLastOp(input.vault, {
+        operation: "log-append",
+        summary: `appended log entry (${outcome.result.data.entries_before}->${outcome.result.data.entries_after})`,
+        files: ["log.md"],
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    } catch (error) {
+      return {
+        exitCode: ExitCode.WRITE_FAILED,
+        result: err("WRITE_FAILED", { stage: "last-op", message: String(error) })
+      };
+    }
+  }
+  return outcome;
+}
+
+// src/utils/sync-lock.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, renameSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync3 } from "fs";
+import { join as join5 } from "path";
+import { createHash as createHash2, randomBytes as randomBytes3 } from "crypto";
+function getEnvSessionId() {
+  if (process.env.CLAUDE_SESSION_ID) return process.env.CLAUDE_SESSION_ID;
+  if (process.env.SKILLWIKI_SESSION_ID) return process.env.SKILLWIKI_SESSION_ID;
+  return void 0;
+}
+function getSessionId() {
+  const envSessionId = getEnvSessionId();
+  if (envSessionId) return envSessionId;
+  return process.pid.toString();
+}
+function getCwdHash(cwd) {
+  const path = cwd || process.cwd();
+  const hash = createHash2("sha256").update(path).digest("hex");
+  return hash.slice(0, 8);
+}
+function getCliSessionId(cwd) {
+  const envSessionId = getEnvSessionId();
+  if (envSessionId) return envSessionId;
+  return `cli-${getCwdHash(cwd)}`;
+}
+function lockPath(vault) {
+  return join5(vault, ".skillwiki", "sync.lock");
+}
+function readLock(vault) {
+  const path = lockPath(vault);
+  if (!existsSync3(path)) return null;
+  try {
+    const raw = readFileSync3(path, "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function isStale(lock, now) {
+  const nowTime = (now ?? /* @__PURE__ */ new Date()).getTime();
+  const expiresTime = new Date(lock.expires).getTime();
+  return expiresTime < nowTime;
+}
+function acquireLock(vault, opts = {}) {
+  const path = lockPath(vault);
+  const dir = join5(vault, ".skillwiki");
+  if (!existsSync3(dir)) {
+    mkdirSync3(dir, { recursive: true });
+  }
+  const sessionId = opts.sessionId ?? getSessionId();
+  const summary = opts.summary ?? "skillwiki sync";
+  const ttlMinutes = opts.ttlMinutes ?? 30;
+  const force = opts.force ?? false;
+  const now = /* @__PURE__ */ new Date();
+  const acquired = now.toISOString();
+  const expires = new Date(now.getTime() + ttlMinutes * 60 * 1e3).toISOString();
+  const lock = {
+    session_id: sessionId,
+    pid: process.pid,
+    cwd: process.cwd(),
+    summary,
+    acquired,
+    expires
+  };
+  try {
+    const content = JSON.stringify(lock, null, 2) + "\n";
+    writeFileSync3(path, content, { flag: "wx" });
+    return { ok: true, lock };
+  } catch (e) {
+    const err2 = e;
+    if (err2.code !== "EEXIST") throw err2;
+  }
+  const existing = readLock(vault);
+  if (!existing) {
+    writeLockedFile(path, lock);
+    return { ok: true, lock };
+  }
+  if (force || isStale(existing)) {
+    writeLockedFile(path, lock);
+    return { ok: true, lock };
+  }
+  return { ok: false, held: existing };
+}
+function writeLockedFile(path, lock) {
+  const tmp = path + ".tmp";
+  const content = JSON.stringify(lock, null, 2) + "\n";
+  writeFileSync3(tmp, content);
+  renameSync(tmp, path);
+}
+function releaseLock(vault, opts = {}) {
+  const path = lockPath(vault);
+  if (!existsSync3(path)) {
+    return { released: false };
+  }
+  const sessionId = opts.sessionId ?? getSessionId();
+  const existing = readLock(vault);
+  if (opts.force) {
+    try {
+      unlinkSync3(path);
+      const prior = existing && existing.session_id !== sessionId ? existing : void 0;
+      return { released: true, prior };
+    } catch {
+      return { released: false };
+    }
+  }
+  if (!existing || existing.session_id !== sessionId) {
+    return { released: false };
+  }
+  try {
+    unlinkSync3(path);
+    return { released: true };
+  } catch {
+    return { released: false };
+  }
+}
+function acquireOwnedSyncLock(vault, opts) {
+  const ownerToken = randomBytes3(16).toString("hex");
+  const sessionId = `publish-${process.pid}-${ownerToken.slice(0, 12)}`;
+  const now = /* @__PURE__ */ new Date();
+  const lock = {
+    session_id: sessionId,
+    owner_token: ownerToken,
+    pid: process.pid,
+    cwd: process.cwd(),
+    summary: opts.summary,
+    acquired: now.toISOString(),
+    expires: new Date(now.getTime() + opts.ttlMinutes * 6e4).toISOString()
+  };
+  const path = lockPath(vault);
+  try {
+    mkdirSync3(join5(vault, ".skillwiki"), { recursive: true });
+  } catch (error) {
+    return err("WRITE_FAILED", { path, message: String(error) });
+  }
+  try {
+    writeFileSync3(path, JSON.stringify(lock, null, 2) + "\n", { flag: "wx" });
+    return ok({ vault, path, sessionId, ownerToken, acquired: lock.acquired });
+  } catch (error) {
+    if (error.code === "EEXIST") {
+      const held = readLock(vault);
+      return err("SYNC_LOCK_HELD", { vault, held, malformed: held === null });
+    }
+    return err("WRITE_FAILED", { path, message: String(error) });
+  }
+}
+function releaseOwnedSyncLock(handle) {
+  const existing = readLock(handle.vault);
+  if (!existing || existing.session_id !== handle.sessionId || existing.owner_token !== handle.ownerToken || existing.acquired !== handle.acquired) {
+    return err("SYNC_LOCK_HELD", {
+      message: "publication lock ownership changed; refusing release"
+    });
+  }
+  try {
+    unlinkSync3(handle.path);
+    return ok({ released: true });
+  } catch (error) {
+    return err("WRITE_FAILED", { path: handle.path, message: String(error) });
+  }
+}
+
 // src/commands/validate.ts
-var TYPE_TO_SECTION = {
+import { createHash as createHash3 } from "crypto";
+import { readFile as readFile4 } from "fs/promises";
+import { resolve as resolve2, relative as relative2, sep as sep2 } from "path";
+
+// src/parsers/frontmatter.ts
+import yaml from "js-yaml";
+var FM_OPEN = /^---\r?\n/;
+function splitFrontmatter(text) {
+  if (!FM_OPEN.test(text)) return ok({ rawFrontmatter: "", body: text, bodyStart: 0 });
+  const afterOpen = text.replace(FM_OPEN, "");
+  const closeIdx = afterOpen.search(/\r?\n---\r?\n/);
+  if (closeIdx === -1) return err("MISSING_CLOSING_DELIMITER");
+  const rawFrontmatter = afterOpen.slice(0, closeIdx);
+  const closeMatch = afterOpen.slice(closeIdx).match(/\r?\n---\r?\n/);
+  const bodyStart = text.length - (afterOpen.length - closeIdx - closeMatch[0].length);
+  const body = text.slice(bodyStart);
+  return ok({ rawFrontmatter, body, bodyStart });
+}
+function extractFrontmatter(text) {
+  const split = splitFrontmatter(text);
+  if (!split.ok) return split;
+  if (!split.data.rawFrontmatter) return ok({});
+  try {
+    const parsed = yaml.load(split.data.rawFrontmatter, { schema: yaml.JSON_SCHEMA });
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return ok({});
+    return ok(parsed);
+  } catch (e) {
+    return err("INVALID_FRONTMATTER", { message: getErrorMessage(e) });
+  }
+}
+
+// src/utils/index-entry.ts
+import { readFile as readFile3 } from "fs/promises";
+import { join as join6 } from "path";
+var TYPE_SECTION = {
   entity: "Entities",
   concept: "Concepts",
   comparison: "Comparisons",
   query: "Queries",
-  summary: "Summaries",
   meta: "Meta"
 };
+function renderIndexUpsert(text, input) {
+  const section = TYPE_SECTION[input.type];
+  if (!section) return err("SCHEME_REJECTED", { type: input.type });
+  const ref = input.target.replace(/\.md$/, "");
+  if (text.includes(`[[${ref}]]`)) return ok({ text, changed: false });
+  if (/[\r\n]/.test(input.title)) {
+    return err("SCHEME_REJECTED", { message: "index title must be one line" });
+  }
+  const newline = text.includes("\r\n") ? "\r\n" : "\n";
+  const header = `## ${section}`;
+  const entry = `- [[${ref}]] \u2014 ${input.title}`;
+  const heading = new RegExp(`^${header}[ \\t]*(?=\\r?$)`, "m").exec(text);
+  if (heading?.index !== void 0) {
+    const afterHeading = heading.index + heading[0].length;
+    const nextHeading = /^##[ \t]+/m.exec(text.slice(afterHeading));
+    const sectionEnd = nextHeading?.index === void 0 ? text.length : afterHeading + nextHeading.index;
+    const sectionText = text.slice(afterHeading, sectionEnd);
+    const trailingWhitespace2 = /(?:\r?\n[ \t]*)*$/.exec(sectionText)?.[0] ?? "";
+    const insertAt2 = sectionEnd - trailingWhitespace2.length;
+    const before2 = text.slice(0, insertAt2);
+    const leadingNewline = before2.endsWith("\n") ? "" : newline;
+    return ok({
+      text: before2 + leadingNewline + entry + text.slice(insertAt2),
+      changed: true
+    });
+  }
+  const trailingWhitespace = /(?:\r?\n[ \t]*)*$/.exec(text)?.[0] ?? "";
+  const insertAt = text.length - trailingWhitespace.length;
+  const before = text.slice(0, insertAt);
+  const separator = before.length === 0 ? "" : newline + newline;
+  return ok({
+    text: before + separator + header + newline + entry + text.slice(insertAt),
+    changed: true
+  });
+}
+async function upsertIndexEntry(input) {
+  const path = join6(input.vault, "index.md");
+  let current;
+  try {
+    current = await readFile3(path, "utf8");
+  } catch (error) {
+    return err("FILE_NOT_FOUND", { path, message: String(error) });
+  }
+  const rendered = renderIndexUpsert(current, input);
+  if (!rendered.ok) return rendered;
+  if (!rendered.data.changed) return ok({ changed: false });
+  const written = await atomicWriteText(path, rendered.data.text);
+  return written.ok ? ok({ changed: written.data.changed }) : written;
+}
+
+// src/utils/typed-page.ts
+import { lstatSync, realpathSync } from "fs";
+import { dirname as dirname2, posix, relative, resolve, sep } from "path";
+var TYPE_DIRECTORY = {
+  entity: "entities",
+  concept: "concepts",
+  comparison: "comparisons",
+  query: "queries",
+  meta: "meta"
+};
+function validateTypedTarget(target) {
+  const segments = target.split("/");
+  if (target.length === 0 || posix.isAbsolute(target) || target.includes("\\") || posix.normalize(target) !== target || segments.some((segment) => segment === "" || segment === "." || segment === "..") || !/^(entities|concepts|comparisons|queries|meta)\/[a-z0-9][a-z0-9._/-]*\.md$/.test(target)) {
+    return err("VAULT_PATH_INVALID", { target, message: "unsafe typed-page target" });
+  }
+  return ok(target);
+}
+function assertTargetInsideVault(vault, target) {
+  const validated = validateTypedTarget(target);
+  if (!validated.ok) return validated;
+  let vaultReal;
+  try {
+    vaultReal = realpathSync(vault);
+  } catch {
+    return err("VAULT_PATH_INVALID", { target, message: "vault realpath failed" });
+  }
+  const absolutePath2 = resolve(vaultReal, target);
+  const parent = dirname2(absolutePath2);
+  let parentReal;
+  try {
+    parentReal = realpathSync(parent);
+  } catch {
+    return err("VAULT_PATH_INVALID", { target, message: "target parent realpath failed" });
+  }
+  const parentRelative = relative(vaultReal, parentReal).split(sep).join("/");
+  if (parentRelative === ".." || parentRelative.startsWith("../")) {
+    return err("VAULT_PATH_INVALID", { target, message: "target parent escapes vault" });
+  }
+  if (parentReal !== parent) {
+    return err("VAULT_PATH_INVALID", { target, message: "target parent may not be a symlink alias" });
+  }
+  let existingRealPath;
+  try {
+    const targetStat = lstatSync(absolutePath2);
+    if (targetStat.isSymbolicLink()) {
+      return err("VAULT_PATH_INVALID", { target, message: "target may not be a symlink" });
+    }
+    if (!targetStat.isFile()) {
+      return err("VAULT_PATH_INVALID", { target, message: "existing target must be a regular file" });
+    }
+    try {
+      existingRealPath = realpathSync(absolutePath2);
+    } catch {
+      return err("VAULT_PATH_INVALID", { target, message: "target realpath failed" });
+    }
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      return err("VAULT_PATH_INVALID", { target, message: "target lstat failed" });
+    }
+  }
+  return ok({ absolutePath: absolutePath2, existingRealPath });
+}
+function invalidFrontmatter(target, issues) {
+  return err("INVALID_FRONTMATTER", {
+    target,
+    errors: issues.map((issue) => ({ path: issue.path.join("."), message: issue.message }))
+  });
+}
+function prepareTypedPage(content, target) {
+  const safeTarget = validateTypedTarget(target);
+  if (!safeTarget.ok) return safeTarget;
+  const sensitive = scanSensitiveContent(content, { file: target });
+  if (sensitive.length > 0) {
+    return err("SENSITIVE_CONTENT_DETECTED", { file: target, findings: sensitive });
+  }
+  const frontmatter = extractFrontmatter(content);
+  if (!frontmatter.ok) return frontmatter;
+  const detected = detectSchema(frontmatter.data);
+  if (detected.schema === "typed-knowledge") {
+    const parsed = TypedKnowledgeSchema.safeParse(frontmatter.data);
+    if (!parsed.success) return invalidFrontmatter(target, parsed.error.issues);
+    const expectedDirectory = TYPE_DIRECTORY[parsed.data.type];
+    if (!expectedDirectory || !target.startsWith(`${expectedDirectory}/`)) {
+      return err("SCHEME_REJECTED", { target, type: parsed.data.type, message: "frontmatter type does not match target directory" });
+    }
+    return ok({
+      target,
+      title: parsed.data.title,
+      type: parsed.data.type,
+      tags: [...parsed.data.tags],
+      content
+    });
+  }
+  if (detected.schema === "meta") {
+    const parsed = MetaSchema.safeParse(frontmatter.data);
+    if (!parsed.success) return invalidFrontmatter(target, parsed.error.issues);
+    if (!target.startsWith("meta/")) {
+      return err("SCHEME_REJECTED", { target, type: "meta", message: "frontmatter type does not match target directory" });
+    }
+    return ok({
+      target,
+      title: parsed.data.title,
+      type: "meta",
+      tags: [...parsed.data.tags],
+      content
+    });
+  }
+  return invalidFrontmatter(target, []);
+}
+
+// src/commands/validate.ts
 var SCHEMAS = {
   "typed-knowledge": TypedKnowledgeSchema,
   "raw": RawSourceSchema,
@@ -518,7 +1121,7 @@ var SCHEMAS = {
 async function runValidate(input) {
   let text;
   try {
-    text = await readFile(input.file, "utf8");
+    text = await readFile4(input.file, "utf8");
   } catch {
     return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: input.file }) };
   }
@@ -569,18 +1172,80 @@ ${errors.map((e) => `  ${e.path}: ${e.message}`).join("\n")}` })
   let logUpdated = false;
   let applyHint = "";
   if (input.apply && input.vault) {
-    const absFile = resolve(input.file);
-    const absVault = resolve(input.vault);
-    const relPath = relative(absVault, absFile).split(sep).join("/");
+    const absFile = resolve2(input.file);
+    const absVault = resolve2(input.vault);
+    const relPath = relative2(absVault, absFile).split(sep2).join("/");
     if (relPath.startsWith("..")) {
       return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { reason: `file ${input.file} is not inside vault ${input.vault}` }) };
     }
-    const pageType = "type" in parsed.data && typeof parsed.data.type === "string" ? parsed.data.type : "";
-    const title = typeof parsed.data.title === "string" ? parsed.data.title : relPath.replace(/\.md$/, "");
+    const operationId = createHash3("sha256").update("skillwiki-validate-apply-v1\0").update(relPath).update("\0").update(text).digest("hex");
     if (det.schema === "typed-knowledge" || det.schema === "meta") {
-      indexUpdated = await addToIndex(input.vault, relPath, title, pageType);
+      const prepared = prepareTypedPage(text, relPath);
+      if (!prepared.ok) {
+        return { exitCode: ExitCode.INVALID_FRONTMATTER, result: prepared };
+      }
+      let lock;
+      try {
+        lock = acquireOwnedSyncLock(input.vault, {
+          summary: `validate --apply ${relPath}`,
+          ttlMinutes: 1
+        });
+      } catch (error) {
+        return {
+          exitCode: ExitCode.WRITE_FAILED,
+          result: err("WRITE_FAILED", { stage: "lock", message: String(error) })
+        };
+      }
+      if (!lock.ok) {
+        return {
+          exitCode: lock.error === "SYNC_LOCK_HELD" ? ExitCode.SYNC_LOCK_HELD : ExitCode.WRITE_FAILED,
+          result: lock
+        };
+      }
+      let index;
+      let released;
+      try {
+        index = await upsertIndexEntry({
+          vault: input.vault,
+          target: relPath,
+          title: prepared.data.title,
+          type: prepared.data.type
+        });
+      } catch (error) {
+        index = err("WRITE_FAILED", { stage: "index", message: String(error) });
+      } finally {
+        released = releaseOwnedSyncLock(lock.data);
+      }
+      if (released === void 0 || !released.ok) {
+        return {
+          exitCode: ExitCode.WRITE_FAILED,
+          result: err("WRITE_FAILED", { stage: "unlock", detail: released?.detail })
+        };
+      }
+      if (index === void 0 || !index.ok) {
+        return {
+          exitCode: ExitCode.WRITE_FAILED,
+          result: index ?? err("WRITE_FAILED", { stage: "index" })
+        };
+      }
+      indexUpdated = index.data.changed;
+    }
+    const logged = await runLogAppend({
+      vault: input.vault,
+      content: `## [${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}] validate | added: ${relPath}`,
+      operationId,
+      strictLock: true
+    });
+    if (!logged.result.ok) {
+      return { exitCode: logged.exitCode, result: logged.result };
+    }
+    if (logged.exitCode !== ExitCode.OK) {
+      return {
+        exitCode: logged.exitCode,
+        result: err("WRITE_FAILED", { message: "log append returned inconsistent success state" })
+      };
     }
-    logUpdated = await appendToLog(input.vault, relPath);
+    logUpdated = logged.result.data.appended;
     if (indexUpdated) applyHint += `
   index: added [[${relPath.replace(/\.md$/, "")}]]`;
     if (logUpdated) applyHint += "\n  log: appended entry";
@@ -594,69 +1259,15 @@ ${errors.map((e) => `  ${e.path}: ${e.message}`).join("\n")}` })
     humanHint: `VALID (${det.schema})${applyHint}`
   }) };
 }
-async function addToIndex(vault, relPath, title, pageType) {
-  const section = TYPE_TO_SECTION[pageType];
-  if (!section) return false;
-  const indexPath = join(vault, "index.md");
-  let text;
-  try {
-    text = await readFile(indexPath, "utf8");
-  } catch {
-    return false;
-  }
-  const ref = relPath.replace(/\.md$/, "");
-  if (text.includes(`[[${ref}]]`)) return false;
-  const entry = `- [[${ref}]] \u2014 ${title}`;
-  const lines = text.split("\n");
-  const sectionLine = `## ${section}`;
-  const sectionIdx = lines.findIndex((l) => l.trim() === sectionLine);
-  if (sectionIdx === -1) {
-    while (lines.length > 0 && lines[lines.length - 1].trim() === "") lines.pop();
-    lines.push("", sectionLine, entry);
-  } else {
-    let endIdx = sectionIdx + 1;
-    while (endIdx < lines.length) {
-      if (lines[endIdx].startsWith("## ")) break;
-      endIdx++;
-    }
-    let insertAt = endIdx;
-    while (insertAt > sectionIdx + 1 && lines[insertAt - 1].trim() === "") insertAt--;
-    lines.splice(insertAt, 0, entry);
-  }
-  try {
-    await writeFile(indexPath, lines.join("\n"), "utf8");
-  } catch {
-    return false;
-  }
-  return true;
-}
-async function appendToLog(vault, relPath) {
-  const logPath = join(vault, "log.md");
-  let text;
-  try {
-    text = await readFile(logPath, "utf8");
-  } catch {
-    return false;
-  }
-  const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  const entry = `
-## [${today}] validate | added: ${relPath}`;
-  try {
-    await writeFile(logPath, text.trimEnd() + entry, "utf8");
-  } catch {
-    return false;
-  }
-  return true;
-}
 
 // src/commands/graph.ts
-import { writeFile as writeFile2, mkdir } from "fs/promises";
-import { dirname } from "path";
+import { writeFile, mkdir } from "fs/promises";
+import { dirname as dirname3 } from "path";
 
 // src/utils/vault.ts
-import { existsSync, readFileSync } from "fs";
-import { readFile as readFile2, readdir, stat } from "fs/promises";
-import { join as join2, relative as relative2, sep as sep2 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { readFile as readFile5, readdir, stat as stat2 } from "fs/promises";
+import { join as join7, relative as relative3, sep as sep3 } from "path";
 var TYPED_DIRS = ["entities", "concepts", "comparisons", "queries", "meta"];
 var SKIP_DIRS = /* @__PURE__ */ new Set([".git", "node_modules"]);
 var DEFAULT_IO_CONCURRENCY = 1;
@@ -681,11 +1292,11 @@ function resolveReadOnlyVaultRootWithMounts(root, mounts) {
     return { root, mirrored: false };
   }
   const explicitMirror = process.env.SKILLWIKI_VAULT_READ_MIRROR;
-  if (explicitMirror && existsSync(join2(explicitMirror, "SCHEMA.md"))) {
+  if (explicitMirror && existsSync4(join7(explicitMirror, "SCHEMA.md"))) {
     return { root: explicitMirror, mirrored: explicitMirror !== root };
   }
   const siblingMirror = `${root}-git`;
-  if (isRcloneFuseVaultFromMounts(root, mounts) && existsSync(join2(siblingMirror, "SCHEMA.md"))) {
+  if (isRcloneFuseVaultFromMounts(root, mounts) && existsSync4(join7(siblingMirror, "SCHEMA.md"))) {
     return { root: siblingMirror, mirrored: true };
   }
   return { root, mirrored: false };
@@ -693,7 +1304,7 @@ function resolveReadOnlyVaultRootWithMounts(root, mounts) {
 function resolveReadOnlyVaultRoot(root) {
   let mounts = "";
   try {
-    mounts = readFileSync("/proc/mounts", "utf8");
+    mounts = readFileSync4("/proc/mounts", "utf8");
   } catch {
   }
   return resolveReadOnlyVaultRootWithMounts(root, mounts);
@@ -713,12 +1324,12 @@ async function mapWithConcurrency(items, limit, mapper) {
 }
 async function scanVault(root) {
   try {
-    await stat(join2(root, "SCHEMA.md"));
+    await stat2(join7(root, "SCHEMA.md"));
   } catch {
     return err("VAULT_PATH_INVALID", { root, reason: "SCHEMA.md missing" });
   }
   const all = await walk(root);
-  const rels = all.map((p) => ({ absPath: p, relPath: relative2(root, p).split(sep2).join("/") }));
+  const rels = all.map((p) => ({ absPath: p, relPath: relative3(root, p).split(sep3).join("/") }));
   return ok({
     root,
     allMarkdown: rels,
@@ -733,7 +1344,7 @@ async function walk(dir) {
   const out = [];
   const subdirs = [];
   for (const e of entries) {
-    const p = join2(dir, e.name);
+    const p = join7(dir, e.name);
     if (e.isDirectory()) {
       if (SKIP_DIRS.has(e.name)) continue;
       subdirs.push(p);
@@ -744,7 +1355,7 @@ async function walk(dir) {
   return out;
 }
 async function readPage(p) {
-  return readFile2(p.absPath, "utf8");
+  return readFile5(p.absPath, "utf8");
 }
 async function readPageCached(p, cache) {
   if (!cache) return readPage(p);
@@ -907,8 +1518,8 @@ async function runGraphBuild(input) {
   const adamicAdar = computeAdamicAdar(adjacency);
   const edge_count = Object.values(adjacency).reduce((acc, arr) => acc + arr.length, 0);
   try {
-    await mkdir(dirname(input.out), { recursive: true });
-    await writeFile2(input.out, JSON.stringify({ adjacency, adamicAdar }, null, 2));
+    await mkdir(dirname3(input.out), { recursive: true });
+    await writeFile(input.out, JSON.stringify({ adjacency, adamicAdar }, null, 2));
   } catch (e) {
     return { exitCode: ExitCode.WRITE_FAILED, result: err("WRITE_FAILED", { message: String(e) }) };
   }
@@ -951,8 +1562,8 @@ function computeAdamicAdar(adj) {
 }
 
 // src/utils/dotenv.ts
-import { readFile as readFile3, writeFile as writeFile3, mkdir as mkdir2 } from "fs/promises";
-import { dirname as dirname2 } from "path";
+import { readFile as readFile6, writeFile as writeFile2, mkdir as mkdir2 } from "fs/promises";
+import { dirname as dirname4 } from "path";
 var CONFIG_KEYS = [
   "WIKI_PATH",
   "WIKI_LANG",
@@ -993,7 +1604,7 @@ function parseDotenvText(text) {
 async function parseDotenvFile(path) {
   let text;
   try {
-    text = await readFile3(path, "utf8");
+    text = await readFile6(path, "utf8");
   } catch {
     return {};
   }
@@ -1001,8 +1612,8 @@ async function parseDotenvFile(path) {
 }
 async function writeDotenv(filePath, entries, originalContent) {
   const lines = originalContent !== void 0 ? updateLines(originalContent, entries) : freshLines(entries);
-  await mkdir2(dirname2(filePath), { recursive: true });
-  await writeFile3(filePath, lines.join("\n") + "\n", "utf8");
+  await mkdir2(dirname4(filePath), { recursive: true });
+  await writeFile2(filePath, lines.join("\n") + "\n", "utf8");
 }
 function freshLines(entries) {
   const out = [];
@@ -1045,7 +1656,7 @@ function updateLines(originalContent, entries) {
 }
 
 // src/utils/wiki-path.ts
-import { join as join3 } from "path";
+import { join as join8 } from "path";
 async function resolveInitTimePath(input) {
   const chain = [];
   if (input.flag !== void 0 && input.flag.length > 0) {
@@ -1058,27 +1669,27 @@ async function resolveInitTimePath(input) {
     return { path: input.envValue, source: "env", ...input.explain ? { chain } : {} };
   }
   if (input.explain) chain.push({ source: "env", matched: false });
-  const sw = await parseDotenvFile(join3(input.home, ".skillwiki", ".env"));
+  const sw = await parseDotenvFile(join8(input.home, ".skillwiki", ".env"));
   if (sw.WIKI_PATH !== void 0) {
     if (input.explain) chain.push({ source: "skillwiki-dotenv", matched: true, value: sw.WIKI_PATH });
     return { path: sw.WIKI_PATH, source: "skillwiki-dotenv", ...input.explain ? { chain } : {} };
   }
   if (input.explain) chain.push({ source: "skillwiki-dotenv", matched: false });
-  const hermes = await parseDotenvFile(join3(input.home, ".hermes", ".env"));
+  const hermes = await parseDotenvFile(join8(input.home, ".hermes", ".env"));
   if (hermes.WIKI_PATH !== void 0) {
     if (input.explain) chain.push({ source: "hermes-dotenv", matched: true, value: hermes.WIKI_PATH });
     return { path: hermes.WIKI_PATH, source: "hermes-dotenv", ...input.explain ? { chain } : {} };
   }
   if (input.explain) chain.push({ source: "hermes-dotenv", matched: false });
   if (input.cwd) {
-    const projCfg = await parseDotenvFile(join3(input.cwd, ".skillwiki", ".env"));
+    const projCfg = await parseDotenvFile(join8(input.cwd, ".skillwiki", ".env"));
     if (projCfg.WIKI_PATH !== void 0) {
       if (input.explain) chain.push({ source: "project-dotenv", matched: true, value: projCfg.WIKI_PATH });
       return { path: projCfg.WIKI_PATH, source: "project-dotenv", ...input.explain ? { chain } : {} };
     }
   }
   if (input.explain) chain.push({ source: "project-dotenv", matched: false });
-  const fallback = join3(input.home, "wiki");
+  const fallback = join8(input.home, "wiki");
   if (input.explain) chain.push({ source: "default", matched: true, value: fallback });
   return { path: fallback, source: "default", ...input.explain ? { chain } : {} };
 }
@@ -1089,7 +1700,7 @@ async function resolveRuntimePath(input) {
     return ok({ path: input.flag, source: "flag", ...input.explain ? { chain } : {} });
   }
   if (input.explain) chain.push({ source: "flag", matched: false });
-  const swGlobal = await parseDotenvFile(join3(input.home, ".skillwiki", ".env"));
+  const swGlobal = await parseDotenvFile(join8(input.home, ".skillwiki", ".env"));
   const wikiName = input.wiki;
   if (wikiName !== void 0 && wikiName.length > 0) {
     if (wikiName.toLowerCase() === "default") {
@@ -1133,7 +1744,7 @@ async function resolveRuntimePath(input) {
   }
   if (input.explain) chain.push({ source: "env", matched: false });
   if (input.cwd) {
-    const projCfg = await parseDotenvFile(join3(input.cwd, ".skillwiki", ".env"));
+    const projCfg = await parseDotenvFile(join8(input.cwd, ".skillwiki", ".env"));
     if (projCfg.WIKI_PATH !== void 0) {
       if (input.explain) chain.push({ source: "project-dotenv", matched: true, value: projCfg.WIKI_PATH });
       return ok({ path: projCfg.WIKI_PATH, source: "project-dotenv", ...input.explain ? { chain } : {} });
@@ -1253,8 +1864,8 @@ function simulateRemoval(adj, removed) {
 }
 
 // src/commands/audit.ts
-import { readFile as readFile4, stat as stat3 } from "fs/promises";
-import { dirname as dirname3, resolve as resolve2, join as join5 } from "path";
+import { readFile as readFile7, stat as stat4 } from "fs/promises";
+import { dirname as dirname5, resolve as resolve3, join as join10 } from "path";
 
 // src/parsers/citations.ts
 var FENCE2 = /```[\s\S]*?```/g;
@@ -1364,9 +1975,9 @@ function hasWikilinkCitations(body) {
 }
 
 // src/utils/raw-source.ts
-import { existsSync as existsSync2 } from "fs";
-import { stat as stat2 } from "fs/promises";
-import { join as join4 } from "path";
+import { existsSync as existsSync5 } from "fs";
+import { stat as stat3 } from "fs/promises";
+import { join as join9 } from "path";
 function normalizeRawSourceTarget(entry) {
   let target = entry.trim().replace(/^"/, "").replace(/"$/, "").replace(/^'/, "").replace(/'$/, "");
   target = target.replace(/^\^\[/, "").replace(/\]$/, "");
@@ -1376,21 +1987,21 @@ function normalizeRawSourceTarget(entry) {
 function rawSourceTargetCandidates(vault, target) {
   const normalized = normalizeRawSourceTarget(target);
   if (!normalized) return [];
-  const candidates = [join4(vault, normalized)];
-  if (!normalized.endsWith(".md")) candidates.push(join4(vault, `${normalized}.md`));
+  const candidates = [join9(vault, normalized)];
+  if (!normalized.endsWith(".md")) candidates.push(join9(vault, `${normalized}.md`));
   if (normalized.startsWith("raw/")) {
-    candidates.push(join4(vault, "_archive", normalized));
-    if (!normalized.endsWith(".md")) candidates.push(join4(vault, "_archive", `${normalized}.md`));
+    candidates.push(join9(vault, "_archive", normalized));
+    if (!normalized.endsWith(".md")) candidates.push(join9(vault, "_archive", `${normalized}.md`));
   }
   return [...new Set(candidates)];
 }
 function rawSourceTargetExistsSync(vault, target) {
-  return rawSourceTargetCandidates(vault, target).some((candidate) => existsSync2(candidate));
+  return rawSourceTargetCandidates(vault, target).some((candidate) => existsSync5(candidate));
 }
 async function rawSourceTargetExists(vault, target) {
   for (const candidate of rawSourceTargetCandidates(vault, target)) {
     try {
-      await stat2(candidate);
+      await stat3(candidate);
       return true;
     } catch {
     }
@@ -1402,7 +2013,7 @@ async function rawSourceTargetExists(vault, target) {
 async function runAudit(input) {
   let text;
   try {
-    text = await readFile4(input.file, "utf8");
+    text = await readFile7(input.file, "utf8");
   } catch {
     return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: input.file }) };
   }
@@ -1410,7 +2021,7 @@ async function runAudit(input) {
   if (!fm.ok) return { exitCode: ExitCode.INVALID_FRONTMATTER, result: fm };
   const split = splitFrontmatter(text);
   const body = split.ok ? split.data.body : text;
-  const vault = await findVaultRoot(dirname3(resolve2(input.file)));
+  const vault = await findVaultRoot(dirname5(resolve3(input.file)));
   if (!vault) return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID") };
   const markers = extractCitationMarkers(body);
   const resolved = await Promise.all(markers.map(async (m) => {
@@ -1455,11 +2066,11 @@ async function findVaultRoot(start) {
   let cur = start;
   for (let i = 0; i < 20; i++) {
     try {
-      await stat3(join5(cur, "SCHEMA.md"));
+      await stat4(join10(cur, "SCHEMA.md"));
       return cur;
     } catch {
     }
-    const parent = dirname3(cur);
+    const parent = dirname5(cur);
     if (parent === cur) return null;
     cur = parent;
   }
@@ -1547,32 +2158,123 @@ ${broken.map((b) => `  ${b.page}:[[${b.slug}]] (line ${b.line})`).join("\n")}` }
 }
 
 // src/commands/tag-audit.ts
-import { readFile as readFile5 } from "fs/promises";
-import { join as join6 } from "path";
+import { readFile as readFile8 } from "fs/promises";
+import { join as join11 } from "path";
 
 // src/parsers/taxonomy.ts
 import yaml2 from "js-yaml";
-var FENCE_RE = /^##\s+Tag Taxonomy\s*$[\s\S]*?```yaml\s*\n([\s\S]*?)\n```/m;
-function extractTaxonomy(schemaText) {
-  const m = schemaText.match(FENCE_RE);
-  if (!m) return err("NO_TAXONOMY_BLOCK", { message: "No fenced YAML taxonomy block found in SCHEMA.md" });
+var TAG_SLUG_RE = /^[a-z0-9][a-z0-9_./-]*$/;
+function taxonomyItemIndent(yamlText) {
+  const lines = yamlText.split(/\r?\n/);
+  const taxonomyLine = lines.findIndex((line) => /^taxonomy:[ \t]*(?:#.*)?$/.test(line));
+  if (taxonomyLine === -1) return void 0;
+  for (const line of lines.slice(taxonomyLine + 1)) {
+    if (/^[ \t]*(?:#.*)?$/.test(line)) continue;
+    return /^([ \t]+)-[ \t]+/.exec(line)?.[1];
+  }
+  return void 0;
+}
+function parseTaxonomyDocument(schemaText) {
+  const heading = /^##[ \t]+Tag Taxonomy[ \t]*\r?$/m.exec(schemaText);
+  if (!heading || heading.index === void 0) {
+    return err("NO_TAXONOMY_BLOCK", { message: "Tag Taxonomy heading not found" });
+  }
+  const afterHeading = heading.index + heading[0].length;
+  const unboundedTail = schemaText.slice(afterHeading);
+  const nextHeading = /^#{1,2}[ \t]+/m.exec(unboundedTail);
+  const sectionEnd = nextHeading?.index === void 0 ? schemaText.length : afterHeading + nextHeading.index;
+  const sectionText = schemaText.slice(afterHeading, sectionEnd);
+  const open2 = /^```yaml[ \t]*\r?$/m.exec(sectionText);
+  if (!open2 || open2.index === void 0) {
+    return err("NO_TAXONOMY_BLOCK", { message: "Fenced YAML taxonomy block not found" });
+  }
+  const openStart = afterHeading + open2.index;
+  const yamlStart = openStart + open2[0].length + 1;
+  const afterOpen = schemaText.slice(yamlStart, sectionEnd);
+  const close = /^```[ \t]*\r?$/m.exec(afterOpen);
+  if (!close || close.index === void 0) {
+    return err("NO_TAXONOMY_BLOCK", { message: "Taxonomy closing fence not found" });
+  }
+  const closingFenceStart = yamlStart + close.index;
+  const newline = schemaText.slice(closingFenceStart - 2, closingFenceStart) === "\r\n" ? "\r\n" : "\n";
+  const yamlEnd = closingFenceStart - newline.length;
+  const yamlText = schemaText.slice(yamlStart, yamlEnd);
   let parsed;
   try {
-    parsed = yaml2.load(m[1], { schema: yaml2.JSON_SCHEMA });
-  } catch (e) {
-    return err("INVALID_FRONTMATTER", { message: getErrorMessage(e) });
+    parsed = yaml2.load(yamlText, { schema: yaml2.JSON_SCHEMA });
+  } catch (error) {
+    return err("INVALID_FRONTMATTER", { message: getErrorMessage(error) });
   }
-  if (parsed === null || typeof parsed !== "object") {
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
     return err("INVALID_FRONTMATTER", { message: "taxonomy block is not an object" });
   }
-  const tax = parsed.taxonomy;
-  if (!Array.isArray(tax)) {
-    return err("INVALID_FRONTMATTER", { message: "taxonomy key missing or not an array" });
-  }
-  if (!tax.every((x) => typeof x === "string")) {
+  const tags = parsed.taxonomy;
+  if (!Array.isArray(tags) || !tags.every((tag) => typeof tag === "string")) {
     return err("INVALID_FRONTMATTER", { message: "taxonomy must be a list of strings" });
   }
-  return ok(tax);
+  const itemIndent = taxonomyItemIndent(yamlText) ?? "  ";
+  return ok({ tags, yamlStart, yamlEnd, closingFenceStart, newline, itemIndent });
+}
+function extractTaxonomy(schemaText) {
+  const parsed = parseTaxonomyDocument(schemaText);
+  if ("error" in parsed) return err(parsed.error, parsed.detail);
+  return ok(parsed.data.tags);
+}
+function renderTag(tag) {
+  const roundTrip = yaml2.load(`value: ${tag}
+`, { schema: yaml2.JSON_SCHEMA });
+  return typeof roundTrip.value === "string" && roundTrip.value === tag ? tag : JSON.stringify(tag);
+}
+function taxonomyCommentForPage(page, date, reason) {
+  const cycle = /^queries\/\d{4}-\d{2}-\d{2}-research-cycle-(\d+)-report\.md$/.exec(page);
+  const chosen = reason?.trim() || (cycle ? `research-cycle ${cycle[1]} taxonomy reconciliation` : `taxonomy reconciliation for ${page}`);
+  if (!/^[A-Za-z0-9][A-Za-z0-9 ._/-]{0,159}$/.test(chosen)) {
+    return err("SCHEME_REJECTED", {
+      message: "reconciliation reason contains unsupported characters or is too long"
+    });
+  }
+  return ok(`# -- added ${date}: ${chosen} --`);
+}
+function reconcileTaxonomyDocument(schemaText, input) {
+  const document = parseTaxonomyDocument(schemaText);
+  if ("error" in document) return err(document.error, document.detail);
+  const requested = [...new Set(input.tags)].sort();
+  const existingSet = new Set(document.data.tags);
+  const missing = requested.filter((tag) => !existingSet.has(tag));
+  const invalid = missing.filter((tag) => !TAG_SLUG_RE.test(tag));
+  if (invalid.length > 0) {
+    return err("SCHEME_REJECTED", { message: "invalid taxonomy tag", tags: invalid });
+  }
+  if (missing.length === 0) {
+    return ok({
+      text: schemaText,
+      requested,
+      existing: document.data.tags,
+      missing: [],
+      added: [],
+      changed: false
+    });
+  }
+  const yamlText = schemaText.slice(document.data.yamlStart, document.data.yamlEnd);
+  const itemIndent = taxonomyItemIndent(yamlText);
+  if (!itemIndent) {
+    return err("SCHEME_REJECTED", {
+      message: "taxonomy reconciliation requires a block-style taxonomy list"
+    });
+  }
+  const { newline, closingFenceStart } = document.data;
+  const comment = `${itemIndent}${input.comment}`;
+  const items = missing.map((tag) => `${itemIndent}- ${renderTag(tag)}`);
+  const block = `${comment}${newline}${items.join(newline)}${newline}`;
+  const text = schemaText.slice(0, closingFenceStart) + block + schemaText.slice(closingFenceStart);
+  return ok({
+    text,
+    requested,
+    existing: document.data.tags,
+    missing,
+    added: missing,
+    changed: true
+  });
 }
 
 // src/commands/tag-audit.ts
@@ -1580,7 +2282,7 @@ async function runTagAudit(input) {
   const scanResult = input.scan ? ok(input.scan) : await scanVault(input.vault);
   if (!scanResult.ok) return { exitCode: ExitCode.VAULT_PATH_INVALID, result: scanResult };
   const scan = scanResult.data;
-  const schemaText = await readFile5(join6(input.vault, "SCHEMA.md"), "utf8");
+  const schemaText = await readFile8(join11(input.vault, "SCHEMA.md"), "utf8");
   const tax = extractTaxonomy(schemaText);
   if (!tax.ok) return { exitCode: ExitCode.INVALID_FRONTMATTER, result: tax };
   const allowed = new Set(tax.data);
@@ -1612,14 +2314,14 @@ async function runTagAudit(input) {
 }
 
 // src/commands/index-check.ts
-import { readFile as readFile6 } from "fs/promises";
-import { join as join7 } from "path";
+import { readFile as readFile9 } from "fs/promises";
+import { join as join12 } from "path";
 async function runIndexCheck(input) {
   const scan = input.scan ? ok(input.scan) : await scanVault(input.vault);
   if (!scan.ok) return { exitCode: ExitCode.VAULT_PATH_INVALID, result: scan };
   let indexText = "";
   try {
-    indexText = await readFile6(join7(input.vault, "index.md"), "utf8");
+    indexText = await readFile9(join12(input.vault, "index.md"), "utf8");
   } catch {
   }
   const indexSlugsLower = /* @__PURE__ */ new Map();
@@ -1658,8 +2360,8 @@ async function runIndexCheck(input) {
 }
 
 // src/commands/stale.ts
-import { readdir as readdir2, rename, mkdir as mkdir3, readFile as readFile7 } from "fs/promises";
-import { join as join9 } from "path";
+import { readdir as readdir2, rename as rename2, mkdir as mkdir3, readFile as readFile10 } from "fs/promises";
+import { join as join13 } from "path";
 
 // src/parsers/expiry-annotations.ts
 var HEADING_RE = /^#{1,6}\s+(.+)$/;
@@ -1695,48 +2397,6 @@ function parseExpiryAnnotations(content, pagePath) {
   return annotations;
 }
 
-// src/utils/last-op.ts
-import { readFileSync as readFileSync2, writeFileSync, mkdirSync, unlinkSync, existsSync as existsSync3 } from "fs";
-import { join as join8 } from "path";
-var LAST_OP_DIR = ".skillwiki";
-var LAST_OP_FILE = "last-op.json";
-function lastOpPath(vault) {
-  return join8(vault, LAST_OP_DIR, LAST_OP_FILE);
-}
-function readLastOp(vault) {
-  const p = lastOpPath(vault);
-  if (!existsSync3(p)) return [];
-  try {
-    const raw = readFileSync2(p, "utf8");
-    const parsed = JSON.parse(raw);
-    if (!Array.isArray(parsed)) {
-      unlinkSync(p);
-      return [];
-    }
-    return parsed;
-  } catch {
-    try {
-      unlinkSync(p);
-    } catch (_e) {
-    }
-    return [];
-  }
-}
-function appendLastOp(vault, entry) {
-  const existing = readLastOp(vault);
-  existing.push(entry);
-  const dir = join8(vault, LAST_OP_DIR);
-  if (!existsSync3(dir)) mkdirSync(dir, { recursive: true });
-  writeFileSync(lastOpPath(vault), JSON.stringify(existing, null, 2), "utf8");
-}
-function clearLastOp(vault) {
-  const p = lastOpPath(vault);
-  try {
-    unlinkSync(p);
-  } catch (_e) {
-  }
-}
-
 // src/commands/stale.ts
 function daysSince(isoDate2) {
   return Math.floor((Date.now() - Date.parse(isoDate2)) / 864e5);
@@ -1750,7 +2410,7 @@ async function runStale(input) {
   const archived = [];
   const workDirs = /* @__PURE__ */ new Map();
   const workDirsBySlug = /* @__PURE__ */ new Map();
-  const projectsDir = join9(input.vault, "projects");
+  const projectsDir = join13(input.vault, "projects");
   let projectSlugs = [];
   try {
     projectSlugs = (await readdir2(projectsDir, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => d.name);
@@ -1763,7 +2423,7 @@ async function runStale(input) {
     projectSlugs = [input.project];
   }
   for (const slug of projectSlugs) {
-    const workPath = join9(projectsDir, slug, "work");
+    const workPath = join13(projectsDir, slug, "work");
     let entries;
     try {
       entries = await readdir2(workPath, { withFileTypes: true });
@@ -1774,7 +2434,7 @@ async function runStale(input) {
     for (const e of entries) {
       if (!e.isDirectory()) continue;
       const relDir = `projects/${slug}/work/${e.name}`;
-      const absDir = join9(workPath, e.name);
+      const absDir = join13(workPath, e.name);
       let status = "";
       let files;
       try {
@@ -1787,7 +2447,7 @@ async function runStale(input) {
       for (const f of files) {
         if (!f.endsWith(".md")) continue;
         try {
-          const fm = extractFrontmatter(await readFile7(join9(absDir, f), "utf8"));
+          const fm = extractFrontmatter(await readFile10(join13(absDir, f), "utf8"));
           if (fm.ok && typeof fm.data.status === "string") {
             status = fm.data.status;
             break;
@@ -1883,9 +2543,9 @@ async function runStale(input) {
     }
   }
   await mapWithConcurrency([...workDirs.keys()], vaultIoConcurrency(), async (relDir) => {
-    const specPath = join9(input.vault, relDir, "spec.md");
+    const specPath = join13(input.vault, relDir, "spec.md");
     try {
-      const specContent = await readFile7(specPath, "utf8");
+      const specContent = await readFile10(specPath, "utf8");
       const specFm = extractFrontmatter(specContent);
       if (specFm.ok && typeof specFm.data.source === "string") {
         const sourcePath = specFm.data.source;
@@ -1914,7 +2574,7 @@ async function runStale(input) {
     if (daysSince(dateStr) < input.days) continue;
     let files;
     try {
-      files = await readdir2(join9(input.vault, relDir));
+      files = await readdir2(join13(input.vault, relDir));
     } catch {
       continue;
     }
@@ -1984,7 +2644,7 @@ async function runStale(input) {
   staleSections.push(...staleSectionResults.flat());
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   if (input.archive) {
-    const archiveDir = join9(input.vault, "_archive", today);
+    const archiveDir = join13(input.vault, "_archive", today);
     await mkdir3(archiveDir, { recursive: true });
     const citedRawPaths = /* @__PURE__ */ new Set();
     for (const page of scan.typedKnowledge) {
@@ -2000,9 +2660,9 @@ async function runStale(input) {
     }
     for (const t of staleTranscripts) {
       if (citedRawPaths.has(t.path) || citedRawPaths.has(t.path.replace(/\.md$/, ""))) continue;
-      const dest = join9(archiveDir, t.path.split("/").pop());
+      const dest = join13(archiveDir, t.path.split("/").pop());
       try {
-        await rename(join9(input.vault, t.path), dest);
+        await rename2(join13(input.vault, t.path), dest);
         archived.push(t.path);
       } catch {
       }
@@ -2012,18 +2672,18 @@ async function runStale(input) {
       if (parts.length >= 4 && parts[0] === "projects") {
         const slug = parts[1];
         const itemName = parts[3];
-        const histDir = join9(input.vault, "projects", slug, "history", "archived-work");
+        const histDir = join13(input.vault, "projects", slug, "history", "archived-work");
         await mkdir3(histDir, { recursive: true });
-        const dest = join9(histDir, itemName);
+        const dest = join13(histDir, itemName);
         try {
-          await rename(join9(input.vault, w.path), dest);
+          await rename2(join13(input.vault, w.path), dest);
           archived.push(w.path);
         } catch {
         }
       } else {
-        const dest = join9(archiveDir, w.path.replace(/\//g, "_"));
+        const dest = join13(archiveDir, w.path.replace(/\//g, "_"));
         try {
-          await rename(join9(input.vault, w.path), dest);
+          await rename2(join13(input.vault, w.path), dest);
           archived.push(w.path);
         } catch {
         }
@@ -2078,23 +2738,23 @@ async function runPagesize(input) {
 }
 
 // src/commands/log-rotate.ts
-import { readFile as readFile8, rename as rename2, writeFile as writeFile4, stat as stat4 } from "fs/promises";
-import { join as join10 } from "path";
-var ENTRY_RE = /^## \[(\d{4})-\d{2}-\d{2}\]/gm;
+import { readFile as readFile11, rename as rename3, writeFile as writeFile3, stat as stat5 } from "fs/promises";
+import { join as join14 } from "path";
+var ENTRY_RE2 = /^## \[(\d{4})-\d{2}-\d{2}\]/gm;
 async function runLogRotate(input) {
   try {
-    await stat4(join10(input.vault, "SCHEMA.md"));
+    await stat5(join14(input.vault, "SCHEMA.md"));
   } catch {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { vault: input.vault }) };
   }
-  const logPath = join10(input.vault, "log.md");
+  const logPath = join14(input.vault, "log.md");
   let logText;
   try {
-    logText = await readFile8(logPath, "utf8");
+    logText = await readFile11(logPath, "utf8");
   } catch {
     return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: logPath }) };
   }
-  const matches = [...logText.matchAll(ENTRY_RE)];
+  const matches = [...logText.matchAll(ENTRY_RE2)];
   const entries = matches.length;
   if (entries < input.threshold) {
     return { exitCode: ExitCode.OK, result: ok({ entries, threshold: input.threshold, rotated: false, humanHint: `${entries}/${input.threshold} entries \u2014 no rotation needed` }) };
@@ -2107,9 +2767,9 @@ async function runLogRotate(input) {
   }
   const newestYear = matches[matches.length - 1][1];
   const rotatedName = `log-${newestYear}.md`;
-  const rotatedPath = join10(input.vault, rotatedName);
+  const rotatedPath = join14(input.vault, rotatedName);
   try {
-    await rename2(logPath, rotatedPath);
+    await rename3(logPath, rotatedPath);
     const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
     const fresh = `# Vault Log
 
@@ -2119,7 +2779,7 @@ Chronological action log. Newest entries last. Skill writes append entries; lint
 
 - Previous log moved to ${rotatedName}
 `;
-    await writeFile4(logPath, fresh, "utf8");
+    await writeFile3(logPath, fresh, "utf8");
   } catch (e) {
     return { exitCode: ExitCode.WRITE_FAILED, result: err("WRITE_FAILED", { message: String(e) }) };
   }
@@ -2152,13 +2812,13 @@ async function runTopicMapCheck(input) {
 }
 
 // src/commands/index-link-format.ts
-import { readFile as readFile9 } from "fs/promises";
-import { join as join11 } from "path";
+import { readFile as readFile12 } from "fs/promises";
+import { join as join15 } from "path";
 var MD_LINK_RE = /\[[^\[\]]+\]\([^)]+\.md\)/;
 async function runIndexLinkFormat(input) {
   let text = "";
   try {
-    text = await readFile9(join11(input.vault, "index.md"), "utf8");
+    text = await readFile12(join15(input.vault, "index.md"), "utf8");
   } catch {
   }
   const markdown_links = [];
@@ -2171,9 +2831,9 @@ ${markdown_links.map((l) => `  line ${l.line}: ${l.text}`).join("\n")}`;
 }
 
 // src/commands/dedup.ts
-import { createHash as createHash2 } from "crypto";
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2, unlinkSync as unlinkSync2 } from "fs";
-import { dirname as dirname4, join as join12, resolve as resolve3 } from "path";
+import { createHash as createHash4 } from "crypto";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4, unlinkSync as unlinkSync4 } from "fs";
+import { dirname as dirname6, join as join16, resolve as resolve4 } from "path";
 
 // src/utils/rclone.ts
 import { execFile } from "child_process";
@@ -2265,7 +2925,7 @@ async function runDedup(input) {
   const manifest = safeEntries.length > 0 ? {
     version: 1,
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
-    vault: resolve3(input.vault),
+    vault: resolve4(input.vault),
     entries: safeEntries
   } : void 0;
   const remote = await planAndMaybePruneRemote(input, safeEntries);
@@ -2277,8 +2937,8 @@ async function runDedup(input) {
   }
   if (input.manifestOut && manifest) {
     try {
-      mkdirSync2(dirname4(input.manifestOut), { recursive: true });
-      writeFileSync2(input.manifestOut, `${JSON.stringify(manifest, null, 2)}
+      mkdirSync4(dirname6(input.manifestOut), { recursive: true });
+      writeFileSync4(input.manifestOut, `${JSON.stringify(manifest, null, 2)}
 `, "utf-8");
     } catch (e) {
       return { exitCode: ExitCode.WRITE_FAILED, result: err("WRITE_FAILED", { path: input.manifestOut, message: String(e) }) };
@@ -2292,7 +2952,7 @@ async function runDedup(input) {
       }
     }
     for (const page of scan.allMarkdown.filter((p) => !p.relPath.startsWith("raw/"))) {
-      const text = readFileSync3(join12(input.vault, page.relPath), "utf-8");
+      const text = readFileSync5(join16(input.vault, page.relPath), "utf-8");
       let updated = text;
       let changed = false;
       for (const [oldPath, newPath] of replacements) {
@@ -2310,14 +2970,14 @@ async function runDedup(input) {
         }
       }
       if (changed) {
-        writeFileSync2(join12(input.vault, page.relPath), updated);
+        writeFileSync4(join16(input.vault, page.relPath), updated);
         rewired.push(page.relPath);
       }
     }
     for (const oldPath of replacements.keys()) {
-      const fullPath = join12(input.vault, oldPath);
+      const fullPath = join16(input.vault, oldPath);
       try {
-        unlinkSync2(fullPath);
+        unlinkSync4(fullPath);
         removed.push(oldPath);
       } catch {
       }
@@ -2409,14 +3069,14 @@ function buildSafeEntries(vault, duplicates, unsafe) {
   return entries;
 }
 function hashRawBody(vault, relPath) {
-  const text = readFileSync3(join12(vault, relPath), "utf-8");
+  const text = readFileSync5(join16(vault, relPath), "utf-8");
   const split = splitFrontmatter(text);
   const body = split.ok ? split.data.body : text;
-  return createHash2("sha256").update(body).digest("hex");
+  return createHash4("sha256").update(body).digest("hex");
 }
 function readManifest(path) {
   try {
-    const parsed = JSON.parse(readFileSync3(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync5(path, "utf-8"));
     if (parsed.version !== 1 || !Array.isArray(parsed.entries)) {
       return err("INVALID_FRONTMATTER", { message: "dedup manifest must have version 1 and entries[]" });
     }
@@ -2432,9 +3092,7 @@ async function planAndMaybePruneRemote(input, entries) {
 }
 
 // src/utils/safe-write.ts
-import { open, readFile as readFile10, rename as rename3, unlink, writeFile as writeFile5 } from "fs/promises";
-import { randomBytes } from "crypto";
-import { dirname as dirname5, basename, join as join13 } from "path";
+import { readFile as readFile13, writeFile as writeFile4 } from "fs/promises";
 var DEFAULT_MIN_BODY_RATIO = 0.5;
 var DEFAULT_MIN_OLD_BODY_BYTES = 200;
 function bodyBytes(text) {
@@ -2444,7 +3102,7 @@ function bodyBytes(text) {
 }
 async function readIfExists(absPath) {
   try {
-    return await readFile10(absPath, "utf8");
+    return await readFile13(absPath, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return null;
     throw e;
@@ -2478,32 +3136,16 @@ async function safeWritePage(absPath, newContent, opts = {}) {
       });
     }
   }
-  if (!isNew && oldContent === newContent) {
-    return ok({ isNew: false, oldBodyBytes, newBodyBytes, bodyRatio, guardSkippedSmall });
-  }
-  const dir = dirname5(absPath);
-  const tmpName = `.${basename(absPath)}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
-  const tmpPath = join13(dir, tmpName);
-  try {
-    const handle = await open(tmpPath, "w");
-    try {
-      await handle.writeFile(newContent, "utf8");
-      try {
-        await handle.sync();
-      } catch {
-      }
-    } finally {
-      await handle.close();
-    }
-    await rename3(tmpPath, absPath);
-    return ok({ isNew, oldBodyBytes, newBodyBytes, bodyRatio, guardSkippedSmall });
-  } catch (e) {
-    try {
-      await unlink(tmpPath);
-    } catch {
-    }
-    return err("WRITE_FAILED", { path: absPath, phase: "atomic-write", message: String(e) });
-  }
+  const written = await atomicWriteText(absPath, newContent);
+  if (!written.ok) return written;
+  return ok({
+    changed: written.data.changed,
+    isNew,
+    oldBodyBytes,
+    newBodyBytes,
+    bodyRatio,
+    guardSkippedSmall
+  });
 }
 
 // src/commands/frontmatter-fix.ts
@@ -2583,10 +3225,10 @@ ${newBody}`;
 }
 
 // src/commands/lint.ts
-import { existsSync as existsSync5 } from "fs";
-import { readFile as readFile12, readdir as readdir3 } from "fs/promises";
-import { createHash as createHash4 } from "crypto";
-import { join as join15, relative as relative3, sep as sep3 } from "path";
+import { existsSync as existsSync7 } from "fs";
+import { readFile as readFile15, readdir as readdir3 } from "fs/promises";
+import { createHash as createHash6 } from "crypto";
+import { join as join18, relative as relative4, sep as sep4 } from "path";
 
 // src/commands/sparse-community.ts
 async function runSparseCommunity(input) {
@@ -2602,7 +3244,7 @@ async function runSparseCommunity(input) {
 }
 
 // src/commands/raw-body-dedup.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 async function runRawBodyDedup(vault, scan, pageTextCache) {
   const scanResult = scan ? ok(scan) : await scanVault(vault);
   if (!scanResult.ok) return { exitCode: ExitCode.VAULT_PATH_INVALID, result: scanResult };
@@ -2611,7 +3253,7 @@ async function runRawBodyDedup(vault, scan, pageTextCache) {
     const text = await readPageCached(raw, pageTextCache);
     const split = splitFrontmatter(text);
     if (!split.ok) return null;
-    const bodyHash = createHash3("sha256").update(split.data.body).digest("hex");
+    const bodyHash = createHash5("sha256").update(split.data.body).digest("hex");
     const fm = extractFrontmatter(text);
     let fmSha256 = null;
     if (fm.ok && typeof fm.data.sha256 === "string" && fm.data.sha256.length === 64) {
@@ -2643,9 +3285,9 @@ async function runRawBodyDedup(vault, scan, pageTextCache) {
 }
 
 // src/commands/path-too-long.ts
-import { existsSync as existsSync4 } from "fs";
-import { mkdir as mkdir4, readFile as readFile11, rename as rename4, unlink as unlink2 } from "fs/promises";
-import { dirname as dirname6, join as join14, posix, resolve as resolve4 } from "path";
+import { existsSync as existsSync6 } from "fs";
+import { mkdir as mkdir4, readFile as readFile14, rename as rename4, unlink as unlink2 } from "fs/promises";
+import { dirname as dirname7, join as join17, posix as posix2, resolve as resolve5 } from "path";
 var MAX_PATH_LENGTH = 240;
 var WINDOWS_ABSOLUTE_PATH_LIMIT = 259;
 async function runPathTooLong(input) {
@@ -2678,10 +3320,10 @@ async function fixPathTooLong(input) {
     }
     try {
       if (target.mode === "dedupe") {
-        await unlink2(join14(input.vault, violation.relPath));
+        await unlink2(join17(input.vault, violation.relPath));
       } else {
-        await mkdir4(dirname6(join14(input.vault, target.relPath)), { recursive: true });
-        await rename4(join14(input.vault, violation.relPath), join14(input.vault, target.relPath));
+        await mkdir4(dirname7(join17(input.vault, target.relPath)), { recursive: true });
+        await rename4(join17(input.vault, violation.relPath), join17(input.vault, target.relPath));
       }
       fixed.push({ from: violation.relPath, to: target.relPath });
     } catch {
@@ -2695,7 +3337,7 @@ async function fixPathTooLong(input) {
       for (const page of afterScan.data.allMarkdown) {
         if (!shouldRewriteReferences(page.relPath)) continue;
         try {
-          const original = await readFile11(page.absPath, "utf8");
+          const original = await readFile14(page.absPath, "utf8");
           let updated = original;
           for (const fix of fixed) {
             updated = replacePathReferences(updated, fix.from, fix.to);
@@ -2732,7 +3374,7 @@ function findPathTooLongViolations(pages, maxLength) {
 }
 function maxFixPathLength(vault) {
   if (process.platform !== "win32") return MAX_PATH_LENGTH;
-  const root = resolve4(vault);
+  const root = resolve5(vault);
   const separatorBudget = root.endsWith("\\") || root.endsWith("/") ? 0 : 1;
   const absoluteSafeRelLength = WINDOWS_ABSOLUTE_PATH_LIMIT - root.length - separatorBudget;
   return Math.max(1, Math.min(MAX_PATH_LENGTH, absoluteSafeRelLength));
@@ -2758,9 +3400,9 @@ function truncateFilename(relPath, maxLength = MAX_PATH_LENGTH) {
 async function resolveFixTarget(vault, original, preferred, maxLength) {
   for (const candidate of candidateRelPaths(preferred, maxLength)) {
     if (candidate === original || candidate.length > maxLength) continue;
-    const candidatePath = join14(vault, candidate);
-    if (!existsSync4(candidatePath)) return { relPath: candidate, mode: "rename" };
-    if (await hasSameContent(join14(vault, original), candidatePath)) {
+    const candidatePath = join17(vault, candidate);
+    if (!existsSync6(candidatePath)) return { relPath: candidate, mode: "rename" };
+    if (await hasSameContent(join17(vault, original), candidatePath)) {
       return { relPath: candidate, mode: "dedupe" };
     }
   }
@@ -2769,8 +3411,8 @@ async function resolveFixTarget(vault, original, preferred, maxLength) {
 function candidateRelPaths(preferred, maxLength) {
   const candidates = [preferred];
   if (preferred.length > maxLength) return candidates;
-  const dir = posix.dirname(preferred) === "." ? "" : posix.dirname(preferred);
-  const filename = posix.basename(preferred);
+  const dir = posix2.dirname(preferred) === "." ? "" : posix2.dirname(preferred);
+  const filename = posix2.basename(preferred);
   const ext = filename.endsWith(".md") ? ".md" : "";
   const base = ext ? filename.slice(0, -3) : filename;
   const dirPrefix = dir ? `${dir}/` : "";
@@ -2784,7 +3426,7 @@ function candidateRelPaths(preferred, maxLength) {
 }
 async function hasSameContent(a, b) {
   try {
-    const [left, right] = await Promise.all([readFile11(a), readFile11(b)]);
+    const [left, right] = await Promise.all([readFile14(a), readFile14(b)]);
     return left.equals(right);
   } catch {
     return false;
@@ -2797,8 +3439,8 @@ function shouldRewriteReferences(relPath) {
 }
 function replacePathReferences(content, oldRelPath, newRelPath) {
   let updated = content.replaceAll(oldRelPath, newRelPath);
-  const oldStem = posix.basename(oldRelPath).replace(/\.md$/, "");
-  const newStem = posix.basename(newRelPath).replace(/\.md$/, "");
+  const oldStem = posix2.basename(oldRelPath).replace(/\.md$/, "");
+  const newStem = posix2.basename(newRelPath).replace(/\.md$/, "");
   if (oldStem !== newStem) {
     const oldStemEscaped = oldStem.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     const stemWikilinkRe = new RegExp(`\\[\\[${oldStemEscaped}(\\|[^\\]]*)?\\]\\]`, "g");
@@ -2850,6 +3492,7 @@ function buildCliSurface() {
   program.command("doctor").option("--check-snapshotter");
   program.command("status").option("--wiki <name>");
   program.command("archive").option("--wiki <name>").option("--cascade").option("--apply").option("--remote <remote>").option("--remote-delete").option("--max-remote-deletes <n>");
+  program.command("remove").option("--wiki <name>").option("--remote <remote>").option("--remote-delete").option("--max-remote-deletes <n>").option("--reason <text>");
   program.command("drift").option("--apply").option("--new <date>").option("--wiki <name>");
   program.command("dedup").option("--apply").option("--canonical-policy <policy>").option("--manifest-out <path>").option("--manifest-in <path>").option("--remote <remote>").option("--remote-delete").option("--max-remote-deletes <n>").option("--wiki <name>");
   program.command("migrate-citations").option("--dry-run").option("--wiki <name>");
@@ -2859,6 +3502,7 @@ function buildCliSurface() {
   program.command("transcripts").option("--since <date>").option("--wiki <name>");
   program.command("project-index").option("--apply").option("--wiki <name>");
   program.command("compound");
+  program.command("tag");
   program.command("tag-sync").option("--dry-run").option("--wiki <name>");
   program.command("sync");
   program.command("backup");
@@ -2868,6 +3512,7 @@ function buildCliSurface() {
   program.command("memory");
   program.command("ingest").requiredOption("--vault <path>").requiredOption("--type <type>").requiredOption("--title <title>").option("--tags <csv>").option("--provenance <provenance>").option("--dry-run");
   program.command("fleet");
+  program.command("page");
   const graphCmd = program.commands.find((c) => c.name() === "graph");
   graphCmd.command("build").option("--out <path>").option("--wiki <name>");
   const canvasCmd = program.commands.find((c) => c.name() === "canvas");
@@ -2881,6 +3526,10 @@ function buildCliSurface() {
   compoundCmd.command("promote").requiredOption("--project <slug>").option("--dry-run").option("--wiki <name>");
   compoundCmd.command("list").requiredOption("--project <slug>").option("--wiki <name>");
   compoundCmd.command("delete").requiredOption("--project <slug>").option("--wiki <name>");
+  const tagCmd = program.commands.find((c) => c.name() === "tag");
+  tagCmd.command("reconcile").requiredOption("--page <path>").option("--from <path>").option("--tags <csv>").option("--reason <text>").option("--write").option("--wiki <name>");
+  const pageCmd = program.commands.find((c) => c.name() === "page");
+  pageCmd.command("publish").requiredOption("--target <path>").option("--log-note <text>").option("--write").option("--wiki <name>");
   const syncCmd = program.commands.find((c) => c.name() === "sync");
   syncCmd.command("status").option("--wiki <name>").option("--include-stashes").option("--include-remote-health").option("--check-snapshotter");
   syncCmd.command("push").option("--wiki <name>");
@@ -3189,7 +3838,7 @@ function recomputeRawSha256IfPresent(content) {
   const split = splitFrontmatter(content);
   if (!split.ok) return content;
   if (!/^sha256:\s*[0-9a-f]{64}$/m.test(split.data.rawFrontmatter)) return content;
-  const sha256 = createHash4("sha256").update(Buffer.from(split.data.body, "utf8")).digest("hex");
+  const sha256 = createHash6("sha256").update(Buffer.from(split.data.body, "utf8")).digest("hex");
   const rawFrontmatter = split.data.rawFrontmatter.replace(/^sha256:\s*[0-9a-f]{64}$/m, `sha256: ${sha256}`);
   return `---
 ${rawFrontmatter}
@@ -3237,24 +3886,24 @@ async function walkMarkdownFiles(absDir, vaultRoot) {
   const entries = await readdir3(absDir, { withFileTypes: true });
   const pages = [];
   for (const entry of entries) {
-    const absPath = join15(absDir, entry.name);
+    const absPath = join18(absDir, entry.name);
     if (entry.isDirectory()) {
       if (entry.name === ".git" || entry.name === "node_modules") continue;
       pages.push(...await walkMarkdownFiles(absPath, vaultRoot));
     } else if (entry.isFile() && entry.name.endsWith(".md")) {
-      pages.push({ absPath, relPath: relative3(vaultRoot, absPath).split(sep3).join("/") });
+      pages.push({ absPath, relPath: relative4(vaultRoot, absPath).split(sep4).join("/") });
     }
   }
   return pages;
 }
 async function collectCliRefsPages(vault) {
-  if (!existsSync5(join15(vault, "SCHEMA.md"))) {
+  if (!existsSync7(join18(vault, "SCHEMA.md"))) {
     return err("VAULT_PATH_INVALID", { root: vault, reason: "SCHEMA.md missing" });
   }
   const pages = [];
   for (const dir of CLI_REFS_TYPED_DIRS) {
-    const absDir = join15(vault, dir);
-    if (!existsSync5(absDir)) continue;
+    const absDir = join18(vault, dir);
+    if (!existsSync7(absDir)) continue;
     pages.push(...await walkMarkdownFiles(absDir, vault));
   }
   return ok(pages);
@@ -3375,7 +4024,7 @@ async function applyFileSourceUrlFix(input, scan, fileSourceUrlFlags, fileSource
   for (const relPath of fileSourceUrlFrontmatterFlags) {
     try {
       const absPath = `${input.vault}/${relPath}`;
-      const raw = await readFile12(absPath, "utf8");
+      const raw = await readFile15(absPath, "utf8");
       const parts = raw.split("---", 3);
       if (parts.length < 3) {
         unresolved.push(relPath);
@@ -3768,8 +4417,8 @@ async function runLint(input) {
     const readKnowledgeContent = (slug) => {
       const existing = knowledgeContentCache.get(slug);
       if (existing) return existing;
-      const knowledgePath = join15(lintVault, "projects", slug, "knowledge.md");
-      const pending = existsSync5(knowledgePath) ? readFile12(knowledgePath, "utf8").catch(() => null) : Promise.resolve(null);
+      const knowledgePath = join18(lintVault, "projects", slug, "knowledge.md");
+      const pending = existsSync7(knowledgePath) ? readFile15(knowledgePath, "utf8").catch(() => null) : Promise.resolve(null);
       knowledgeContentCache.set(slug, pending);
       return pending;
     };
@@ -3870,12 +4519,12 @@ async function runLint(input) {
       else delete buckets.sensitive_content;
     }
     if (shouldFix("legacy_citation_style") && legacyPages.length > 0) {
-      const FENCE_RE2 = /```[\s\S]*?```/g;
+      const FENCE_RE = /```[\s\S]*?```/g;
       const INLINE_MARKER = /\^\[raw\/[^\]]+\]/g;
       for (const relPath of legacyPages) {
         try {
           const absPath = `${input.vault}/${relPath}`;
-          const raw = await readFile12(absPath, "utf8");
+          const raw = await readFile15(absPath, "utf8");
           const split = splitFrontmatter(raw);
           if (!split.ok) {
             unresolved.push(relPath);
@@ -3883,7 +4532,7 @@ async function runLint(input) {
           }
           const body = split.data.body;
           const rawFm = split.data.rawFrontmatter;
-          const stripped = body.replace(FENCE_RE2, "");
+          const stripped = body.replace(FENCE_RE, "");
           const lines = stripped.split("\n");
           const inlineMarkers = [];
           let inSources = false;
@@ -3974,7 +4623,7 @@ ${newBody}`;
       for (const relPath of noOverview) {
         try {
           const absPath = `${input.vault}/${relPath}`;
-          const raw = await readFile12(absPath, "utf8");
+          const raw = await readFile15(absPath, "utf8");
           const split = splitFrontmatter(raw);
           if (!split.ok) {
             unresolved.push(relPath);
@@ -4015,7 +4664,7 @@ ${trimmedBody}`;
       for (const relPath of missingTldrFlags) {
         try {
           const absPath = `${input.vault}/${relPath}`;
-          const raw = await readFile12(absPath, "utf8");
+          const raw = await readFile15(absPath, "utf8");
           const split = splitFrontmatter(raw);
           if (!split.ok) {
             unresolved.push(relPath);
@@ -4060,12 +4709,12 @@ ${lines.join("\n")}`;
     }
     if (shouldFix("wikilink_citation") && wikilinkCitationFlags.length > 0) {
       const WIKILINK_RE = /\[\[raw\/([^\]|]+)(?:\|[^\]]*)?\]\]/g;
-      const FENCE_RE2 = /```[\s\S]*?```/g;
+      const FENCE_RE = /```[\s\S]*?```/g;
       const wikilinkFixed = [];
       for (const relPath of wikilinkCitationFlags) {
         try {
           const absPath = `${input.vault}/${relPath}`;
-          const raw = await readFile12(absPath, "utf8");
+          const raw = await readFile15(absPath, "utf8");
           const split = splitFrontmatter(raw);
           if (!split.ok) {
             unresolved.push(relPath);
@@ -4073,7 +4722,7 @@ ${lines.join("\n")}`;
           }
           const body = split.data.body;
           const rawFm = split.data.rawFrontmatter;
-          const stripped = body.replace(FENCE_RE2, "");
+          const stripped = body.replace(FENCE_RE, "");
           const wikilinkMatches = [...stripped.matchAll(WIKILINK_RE)];
           if (wikilinkMatches.length === 0) {
             unresolved.push(relPath);
@@ -4406,14 +5055,14 @@ async function runSyncLintDelta(input) {
 }
 
 // src/commands/config.ts
-import { readFile as readFile13 } from "fs/promises";
-import { existsSync as existsSync6 } from "fs";
-import { join as join16 } from "path";
+import { readFile as readFile16 } from "fs/promises";
+import { existsSync as existsSync8 } from "fs";
+import { join as join19 } from "path";
 function validateKey(key) {
   return CONFIG_KEYS.includes(key) || isValidWikiProfileKey(key);
 }
 function configPath(home) {
-  return join16(home, ".skillwiki", ".env");
+  return join19(home, ".skillwiki", ".env");
 }
 async function runConfigGet(input) {
   if (!validateKey(input.key)) {
@@ -4431,7 +5080,7 @@ async function runConfigSet(input) {
   try {
     let originalContent;
     try {
-      originalContent = await readFile13(filePath, "utf8");
+      originalContent = await readFile16(filePath, "utf8");
     } catch {
     }
     const existing = originalContent !== void 0 ? parseDotenvText(originalContent) : {};
@@ -4463,15 +5112,15 @@ async function runConfigList(input) {
 }
 async function runConfigPath(input) {
   const filePath = configPath(input.home);
-  return { exitCode: ExitCode.OK, result: ok({ path: filePath, exists: existsSync6(filePath), humanHint: filePath }) };
+  return { exitCode: ExitCode.OK, result: ok({ path: filePath, exists: existsSync8(filePath), humanHint: filePath }) };
 }
 
 // src/commands/fleet.ts
-import { readFile as readFile14 } from "fs/promises";
+import { readFile as readFile17 } from "fs/promises";
 import { hostname as nodeHostname, userInfo } from "os";
-import { join as join17 } from "path";
+import { join as join20 } from "path";
 import yaml3 from "js-yaml";
-var FLEET_REL_PATH = join17("projects", "llm-wiki", "architecture", "fleet.yaml");
+var FLEET_REL_PATH = join20("projects", "llm-wiki", "architecture", "fleet.yaml");
 async function runFleetValidate(input) {
   const loaded = await loadFleetManifest(input.file);
   if (!loaded.ok) {
@@ -4502,7 +5151,7 @@ async function runFleetContext(input) {
   const osHostname = input.osHostname ?? safeEnvValue(env.HOSTNAME) ?? nodeHostname();
   const user = input.user ?? safeEnvValue(env.USER) ?? safeUserName();
   const vault = input.vault ?? safeEnvValue(env.WIKI_PATH);
-  const file = input.file ?? (vault ? join17(vault, FLEET_REL_PATH) : void 0);
+  const file = input.file ?? (vault ? join20(vault, FLEET_REL_PATH) : void 0);
   const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
   const loaded = file ? await loadFleetManifest(file) : { ok: false, error: "FILE_NOT_FOUND" };
   if (!loaded.ok) {
@@ -4622,7 +5271,7 @@ function fleetContextEnv(input) {
   const home = input.home ?? env.HOME ?? "";
   const osHostname = input.osHostname ?? safeEnvValue(env.HOSTNAME) ?? nodeHostname();
   const vault = input.vault ?? safeEnvValue(env.WIKI_PATH);
-  const file = input.file ?? (vault ? join17(vault, FLEET_REL_PATH) : void 0);
+  const file = input.file ?? (vault ? join20(vault, FLEET_REL_PATH) : void 0);
   return { env, home, osHostname, vault, file };
 }
 async function loadFleetManifestAndHost(input) {
@@ -4682,7 +5331,7 @@ function satelliteGateFromFleetLoad(load) {
 async function loadFleetManifest(file) {
   let text;
   try {
-    text = await readFile14(file, "utf8");
+    text = await readFile17(file, "utf8");
   } catch {
     return { ok: false, error: "FILE_NOT_FOUND" };
   }
@@ -4756,7 +5405,7 @@ async function resolveFleetHostId(input) {
   }
   trace.push({ source: "AGENT_HOST_ID", status: "unset" });
   if (input.home) {
-    const dotenv = await parseDotenvFile(join17(input.home, ".skillwiki", ".env"));
+    const dotenv = await parseDotenvFile(join20(input.home, ".skillwiki", ".env"));
     if (dotenv.SKILLWIKI_HOST_ID) {
       trace.push({ source: "~/.skillwiki/.env:SKILLWIKI_HOST_ID", status: "matched", value: dotenv.SKILLWIKI_HOST_ID });
       return { hostId: dotenv.SKILLWIKI_HOST_ID, source: "~/.skillwiki/.env:SKILLWIKI_HOST_ID", trace };
@@ -4929,20 +5578,20 @@ function safeUserName() {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync12, lstatSync, readlinkSync, readdirSync as readdirSync3, statSync, readFileSync as readFileSync9 } from "fs";
-import { join as join23, resolve as resolve5 } from "path";
+import { existsSync as existsSync14, lstatSync as lstatSync2, readlinkSync, readdirSync as readdirSync3, statSync as statSync2, readFileSync as readFileSync11 } from "fs";
+import { join as join26, resolve as resolve6 } from "path";
 import { execSync as execSync2 } from "child_process";
 import { platform as platform2 } from "os";
 
 // src/utils/plugin-registry.ts
-import { existsSync as existsSync7, readdirSync, readFileSync as readFileSync4 } from "fs";
-import { join as join18 } from "path";
-var REGISTRY_PATH = join18(".claude", "plugins", "installed_plugins.json");
-var CODEX_CONFIG_PATH = join18(".codex", "config.toml");
+import { existsSync as existsSync9, readdirSync, readFileSync as readFileSync6 } from "fs";
+import { join as join21 } from "path";
+var REGISTRY_PATH = join21(".claude", "plugins", "installed_plugins.json");
+var CODEX_CONFIG_PATH = join21(".codex", "config.toml");
 var PLUGIN_KEY = "skillwiki@llm-wiki";
 function readInstalledPlugins(home) {
   try {
-    const raw = readFileSync4(join18(home, REGISTRY_PATH), "utf8");
+    const raw = readFileSync6(join21(home, REGISTRY_PATH), "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -4978,8 +5627,8 @@ function findPluginInstallations(home, key = PLUGIN_KEY) {
 function findCodexPlugin(home, key, pluginName, marketplace) {
   const config = readCodexPluginConfig(home, key, marketplace);
   if (!config?.enabled) return null;
-  const cacheRoot = join18(home, ".codex", "plugins", "cache", marketplace, pluginName);
-  if (!existsSync7(cacheRoot)) return null;
+  const cacheRoot = join21(home, ".codex", "plugins", "cache", marketplace, pluginName);
+  if (!existsSync9(cacheRoot)) return null;
   let versions;
   try {
     versions = readdirSync(cacheRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
@@ -4994,7 +5643,7 @@ function findCodexPlugin(home, key, pluginName, marketplace) {
     key,
     pluginName,
     marketplace,
-    installPath: join18(cacheRoot, version),
+    installPath: join21(cacheRoot, version),
     version,
     sourceType: config.sourceType,
     source: config.source
@@ -5011,7 +5660,7 @@ function parsePluginKey(key) {
 function readCodexPluginConfig(home, key, marketplace) {
   let raw;
   try {
-    raw = readFileSync4(join18(home, CODEX_CONFIG_PATH), "utf8");
+    raw = readFileSync6(join21(home, CODEX_CONFIG_PATH), "utf8");
   } catch {
     return null;
   }
@@ -5053,8 +5702,8 @@ function parseTomlScalar(rawValue) {
 }
 
 // src/utils/conflict-markers.ts
-import { existsSync as existsSync8, readdirSync as readdirSync2, readFileSync as readFileSync5 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync10, readdirSync as readdirSync2, readFileSync as readFileSync7 } from "fs";
+import { join as join22 } from "path";
 function scanConflictMarkerBlocksInText(relPath, text) {
   const findings = [];
   const lines = text.split(/\r?\n/);
@@ -5105,21 +5754,21 @@ function walkMarkdownFiles2(root, dir, rel, out) {
   for (const entry of entries) {
     if (entry.isDirectory()) {
       if (PRUNE_DIRS.has(entry.name)) continue;
-      walkMarkdownFiles2(root, join19(dir, entry.name), rel ? `${rel}/${entry.name}` : entry.name, out);
+      walkMarkdownFiles2(root, join22(dir, entry.name), rel ? `${rel}/${entry.name}` : entry.name, out);
     } else if (entry.isFile() && entry.name.endsWith(".md")) {
       out.push(rel ? `${rel}/${entry.name}` : entry.name);
     }
   }
 }
 function scanVaultConflictMarkers(vaultRoot) {
-  if (!existsSync8(vaultRoot)) return [];
+  if (!existsSync10(vaultRoot)) return [];
   const relPaths = [];
   walkMarkdownFiles2(vaultRoot, vaultRoot, "", relPaths);
   const all = [];
   for (const rel of relPaths) {
     let text;
     try {
-      text = readFileSync5(join19(vaultRoot, rel), "utf8");
+      text = readFileSync7(join22(vaultRoot, rel), "utf8");
     } catch {
       continue;
     }
@@ -5129,8 +5778,8 @@ function scanVaultConflictMarkers(vaultRoot) {
 }
 
 // src/utils/remote-health.ts
-import { existsSync as existsSync9, readFileSync as readFileSync6 } from "fs";
-import { join as join20 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync8 } from "fs";
+import { join as join23 } from "path";
 import { execFileSync } from "child_process";
 var REMOTE_PROBE_TIMEOUT_MS = 3e3;
 var defaultExec = (file, args, cwd) => execFileSync(file, args, {
@@ -5141,7 +5790,7 @@ var defaultExec = (file, args, cwd) => execFileSync(file, args, {
 }).trim();
 function readWikiS3RemoteConfigured(home) {
   try {
-    const content = readFileSync6(join20(home, ".skillwiki", ".env"), "utf8");
+    const content = readFileSync8(join23(home, ".skillwiki", ".env"), "utf8");
     for (const line of content.split(/\r?\n/)) {
       const trimmed = line.trim();
       if (!trimmed || trimmed.startsWith("#")) continue;
@@ -5166,7 +5815,7 @@ function resolveWikiS3Remote(input) {
   return readWikiS3RemoteConfigured(input.home);
 }
 function probeGithubReachability(vaultPath, exec = defaultExec) {
-  if (!existsSync9(join20(vaultPath, ".git"))) return "unknown";
+  if (!existsSync11(join23(vaultPath, ".git"))) return "unknown";
   try {
     exec("git", ["remote", "get-url", "origin"], vaultPath);
   } catch {
@@ -5231,11 +5880,11 @@ function probeRemoteHealth(input) {
 }
 
 // src/utils/satellite-run-health.ts
-import { existsSync as existsSync10, readFileSync as readFileSync7 } from "fs";
-import { join as join21 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync9 } from "fs";
+import { join as join24 } from "path";
 var SATELLITE_STALE_MS = 26 * 60 * 60 * 1e3;
 function satelliteLatestRunPath(vault) {
-  return join21(vault, ".skillwiki", "agent-memory-trends", "latest-run.json");
+  return join24(vault, ".skillwiki", "agent-memory-trends", "latest-run.json");
 }
 function isFailedRunStatus(status) {
   return status === "fail" || status === "failure";
@@ -5257,9 +5906,9 @@ function readSatelliteLatestRunFromText(text) {
 }
 function readSatelliteLatestRun(vault) {
   const latestPath = satelliteLatestRunPath(vault);
-  if (!existsSync10(latestPath)) return null;
+  if (!existsSync12(latestPath)) return null;
   try {
-    return parseLatestRunFile(readFileSync7(latestPath, "utf8"));
+    return parseLatestRunFile(readFileSync9(latestPath, "utf8"));
   } catch {
     return null;
   }
@@ -5288,8 +5937,8 @@ function evaluateSatelliteRunHealth(vault, now) {
 // src/utils/s3-mount-health.ts
 import { execSync } from "child_process";
 import { platform } from "os";
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync3, unlinkSync as unlinkSync3, readFileSync as readFile15 } from "fs";
-import { join as join22 } from "path";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync5, unlinkSync as unlinkSync5, readFileSync as readFile18 } from "fs";
+import { join as join25 } from "path";
 var OS = platform();
 function findRcloneMountPid() {
   try {
@@ -5373,7 +6022,7 @@ function extractRcloneFs(args) {
 function getRcloneArgs(pid) {
   try {
     if (OS === "linux") {
-      const raw = readFileSync8(`/proc/${pid}/cmdline`);
+      const raw = readFileSync10(`/proc/${pid}/cmdline`);
       return new TextDecoder().decode(raw).split("\0").filter(Boolean);
     } else {
       const out = execSync(`ps -o args= -p ${pid}`, {
@@ -5416,7 +6065,7 @@ function queryRcloneRC(rcAddr, fs) {
 function detectFuseMount(vaultPath) {
   try {
     if (OS === "linux") {
-      const mounts = readFileSync8("/proc/mounts", "utf8");
+      const mounts = readFileSync10("/proc/mounts", "utf8");
       let best = null;
       for (const line of mounts.split("\n")) {
         const parts = line.split(" ");
@@ -5447,35 +6096,35 @@ function detectFuseMount(vaultPath) {
   return null;
 }
 function writeTest(dir) {
-  const testFile = join22(dir, `.doctor-write-test-${process.pid}.tmp`);
+  const testFile = join25(dir, `.doctor-write-test-${process.pid}.tmp`);
   const payload = `skillwiki doctor write test \u2014 ${Date.now()} \u2014 ${Math.random().toString(36).slice(2)}`;
   const start = Date.now();
   try {
-    writeFileSync3(testFile, payload, "utf8");
+    writeFileSync5(testFile, payload, "utf8");
   } catch (e) {
     return { success: false, writeMs: Date.now() - start, readMs: 0, size: 0, error: `write failed: ${e.message}` };
   }
   const writeMs = Date.now() - start;
   const readStart = Date.now();
   try {
-    const back = readFile15(testFile, "utf8");
+    const back = readFile18(testFile, "utf8");
     const readMs = Date.now() - readStart;
     if (back !== payload) {
       try {
-        unlinkSync3(testFile);
+        unlinkSync5(testFile);
       } catch {
       }
       return { success: false, writeMs, readMs, size: Buffer.byteLength(payload, "utf8"), error: "content mismatch \u2014 wrote and read-back differ" };
     }
   } catch (e) {
     try {
-      unlinkSync3(testFile);
+      unlinkSync5(testFile);
     } catch {
     }
     return { success: false, writeMs, readMs: Date.now() - readStart, size: 0, error: `read failed: ${e.message}` };
   }
   try {
-    unlinkSync3(testFile);
+    unlinkSync5(testFile);
   } catch {
   }
   return { success: true, writeMs, readMs: Date.now() - readStart, size: Buffer.byteLength(payload, "utf8") };
@@ -5532,14 +6181,14 @@ function checkNodeVersion() {
 function detectCliChannels(argv, home) {
   const channels = [];
   if (argv.length >= 2 && argv[1].endsWith("cli.js")) {
-    const devPath = resolve5(argv[1]);
+    const devPath = resolve6(argv[1]);
     channels.push({ name: "dev", path: devPath, isDevLink: true });
   }
   try {
     const whichOut = execSync2("which skillwiki 2>/dev/null", { encoding: "utf8" }).trim();
     if (whichOut) {
       const isDev = isDevSymlink(whichOut);
-      if (!channels.some((c) => c.path === resolve5(whichOut))) {
+      if (!channels.some((c) => c.path === resolve6(whichOut))) {
         channels.push({ name: "npm", path: whichOut, isDevLink: isDev });
       }
     }
@@ -5547,22 +6196,22 @@ function detectCliChannels(argv, home) {
   }
   const plugin = findPlugin(home);
   if (plugin) {
-    const pluginBin = join23(plugin.installPath, "bin", "skillwiki");
-    if (existsSync12(pluginBin)) {
+    const pluginBin = join26(plugin.installPath, "bin", "skillwiki");
+    if (existsSync14(pluginBin)) {
       channels.push({ name: "plugin", path: pluginBin, isDevLink: false });
     }
   }
-  const installBin = join23(home, ".claude", "skills", "bin", "skillwiki");
-  if (existsSync12(installBin)) {
+  const installBin = join26(home, ".claude", "skills", "bin", "skillwiki");
+  if (existsSync14(installBin)) {
     channels.push({ name: "install", path: installBin, isDevLink: false });
   }
   return channels;
 }
 function isDevSymlink(binPath) {
   try {
-    const st = lstatSync(binPath);
+    const st = lstatSync2(binPath);
     if (st.isSymbolicLink()) {
-      const target = resolve5(binPath, "..", readlinkSync(binPath));
+      const target = resolve6(binPath, "..", readlinkSync(binPath));
       return target.includes("packages/cli") || target.includes("packages\\cli");
     }
   } catch {
@@ -5614,7 +6263,7 @@ function isDevSourceRun(argv) {
 }
 async function checkConfigFile(home) {
   const cfgPath = configPath(home);
-  if (!existsSync12(cfgPath)) {
+  if (!existsSync14(cfgPath)) {
     return check("warn", "config_file", "Config file exists", `${cfgPath} not found`);
   }
   try {
@@ -5629,7 +6278,7 @@ function checkWikiPathExists(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("error", "wiki_path_exists", "Vault directory exists", "Cannot check \u2014 WIKI_PATH not resolved");
   }
-  if (existsSync12(resolvedPath) && statSync(resolvedPath).isDirectory()) {
+  if (existsSync14(resolvedPath) && statSync2(resolvedPath).isDirectory()) {
     return check("pass", "wiki_path_exists", "Vault directory exists", resolvedPath);
   }
   return check("error", "wiki_path_exists", "Vault directory exists", `${resolvedPath} does not exist or is not a directory`);
@@ -5638,13 +6287,13 @@ function checkVaultStructure(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("error", "vault_structure", "Vault structure valid", "Cannot check \u2014 WIKI_PATH not resolved");
   }
-  if (!existsSync12(resolvedPath)) {
+  if (!existsSync14(resolvedPath)) {
     return check("error", "vault_structure", "Vault structure valid", "Cannot check \u2014 vault directory does not exist");
   }
   const missing = [];
-  if (!existsSync12(join23(resolvedPath, "SCHEMA.md"))) missing.push("SCHEMA.md");
+  if (!existsSync14(join26(resolvedPath, "SCHEMA.md"))) missing.push("SCHEMA.md");
   for (const dir of ["raw", "entities", "concepts", "meta"]) {
-    if (!existsSync12(join23(resolvedPath, dir))) missing.push(dir + "/");
+    if (!existsSync14(join26(resolvedPath, dir))) missing.push(dir + "/");
   }
   if (missing.length === 0) {
     return check("pass", "vault_structure", "Vault structure valid", "All required files and directories present");
@@ -5652,8 +6301,8 @@ function checkVaultStructure(resolvedPath) {
   return check("warn", "vault_structure", "Vault structure valid", `Missing: ${missing.join(", ")} \u2014 run \`skillwiki init\` to add CodeWiki structure`);
 }
 function checkSkillsInstalled(home, cwd) {
-  const srcDir = cwd ? join23(cwd, "packages", "skills") : void 0;
-  if (srcDir && existsSync12(srcDir)) {
+  const srcDir = cwd ? join26(cwd, "packages", "skills") : void 0;
+  if (srcDir && existsSync14(srcDir)) {
     const found = findInstalledSkillMd(srcDir);
     if (found.length > 0) {
       return check("pass", "skills_installed", "Skills installed", `${found.length} SKILL.md file(s) found (source)`);
@@ -5666,8 +6315,8 @@ function checkSkillsInstalled(home, cwd) {
       return check("pass", "skills_installed", "Skills installed", `${found.length} SKILL.md file(s) found (plugin v${plugin.version})`);
     }
   }
-  const skillsDir = join23(home, ".claude", "skills");
-  if (existsSync12(skillsDir)) {
+  const skillsDir = join26(home, ".claude", "skills");
+  if (existsSync14(skillsDir)) {
     const found = findInstalledSkillMd(skillsDir);
     if (found.length > 0) {
       return check("pass", "skills_installed", "Skills installed", `${found.length} SKILL.md file(s) found (CLI install)`);
@@ -5677,10 +6326,10 @@ function checkSkillsInstalled(home, cwd) {
 }
 function checkDuplicateSkills(home) {
   const plugin = findPlugin(home);
-  const skillsDir = join23(home, ".claude", "skills");
+  const skillsDir = join26(home, ".claude", "skills");
   const agentSkillDirs = [
-    { label: "~/.codex/skills/", path: join23(home, ".codex", "skills") },
-    { label: "~/.agents/skills/", path: join23(home, ".agents", "skills") }
+    { label: "~/.codex/skills/", path: join26(home, ".codex", "skills") },
+    { label: "~/.agents/skills/", path: join26(home, ".agents", "skills") }
   ];
   if (!plugin) {
     return check("pass", "skills_duplicate", "Skills not duplicated", "Single install channel");
@@ -5783,8 +6432,8 @@ async function checkProfiles(home) {
 }
 async function checkProjectLocalOverride(cwd) {
   const dir = cwd ?? process.cwd();
-  const envPath = join23(dir, ".skillwiki", ".env");
-  if (existsSync12(envPath)) {
+  const envPath = join26(dir, ".skillwiki", ".env");
+  if (existsSync14(envPath)) {
     return check("pass", "project_local", "Project-local config", `Found: ${envPath}`);
   }
   return check("pass", "project_local", "Project-local config", "None");
@@ -5793,7 +6442,7 @@ function checkVaultGitRemote(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("error", "vault_git_remote", "Vault git remote", "Cannot check \u2014 WIKI_PATH not resolved");
   }
-  if (!existsSync12(join23(resolvedPath, ".git"))) {
+  if (!existsSync14(join26(resolvedPath, ".git"))) {
     return check("warn", "vault_git_remote", "Vault git remote", "Vault is not a git repository \u2014 sync features unavailable");
   }
   try {
@@ -5816,9 +6465,9 @@ function checkObsidianTemplates(resolvedPath) {
     return check("error", "obsidian_templates", "Obsidian templates", "Cannot check \u2014 WIKI_PATH not resolved");
   }
   const missing = [];
-  if (!existsSync12(join23(resolvedPath, "_Templates"))) missing.push("_Templates/");
-  if (!existsSync12(join23(resolvedPath, ".obsidian", "templates.json"))) missing.push(".obsidian/templates.json");
-  if (!existsSync12(join23(resolvedPath, ".obsidian", "app.json"))) missing.push(".obsidian/app.json");
+  if (!existsSync14(join26(resolvedPath, "_Templates"))) missing.push("_Templates/");
+  if (!existsSync14(join26(resolvedPath, ".obsidian", "templates.json"))) missing.push(".obsidian/templates.json");
+  if (!existsSync14(join26(resolvedPath, ".obsidian", "app.json"))) missing.push(".obsidian/app.json");
   if (missing.length === 0) {
     return check("pass", "obsidian_templates", "Obsidian templates", "Template folder and config present");
   }
@@ -5828,8 +6477,8 @@ function checkDotStoreClean(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("error", "dsstore_clean", "No .DS_Store in raw/", "Cannot check \u2014 WIKI_PATH not resolved");
   }
-  const rawDir = join23(resolvedPath, "raw");
-  if (!existsSync12(rawDir)) {
+  const rawDir = join26(resolvedPath, "raw");
+  if (!existsSync14(rawDir)) {
     return check("pass", "dsstore_clean", "No .DS_Store in raw/", "raw/ directory not found \u2014 check skipped");
   }
   const found = [];
@@ -5844,7 +6493,7 @@ function checkDotStoreClean(resolvedPath) {
       if (entry.name === ".DS_Store") {
         found.push(rel ? `${rel}/.DS_Store` : ".DS_Store");
       } else if (entry.isDirectory()) {
-        walk2(join23(dir, entry.name), rel ? `${rel}/${entry.name}` : entry.name);
+        walk2(join26(dir, entry.name), rel ? `${rel}/${entry.name}` : entry.name);
       }
     }
   })(rawDir, "");
@@ -5875,7 +6524,7 @@ function checkSyncLastPush(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("error", "sync_last_push", "Vault sync recency", "Cannot check \u2014 WIKI_PATH not resolved");
   }
-  if (!existsSync12(join23(resolvedPath, ".git"))) {
+  if (!existsSync14(join26(resolvedPath, ".git"))) {
     return check("pass", "sync_last_push", "Vault sync recency", "No git repo \u2014 sync check skipped");
   }
   let timestamp;
@@ -5923,7 +6572,7 @@ function checkVaultGitDirty(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("pass", "vault_git_dirty", "Vault git dirty state", "No vault path \u2014 check skipped");
   }
-  if (!existsSync12(join23(resolvedPath, ".git"))) {
+  if (!existsSync14(join26(resolvedPath, ".git"))) {
     return check("pass", "vault_git_dirty", "Vault git dirty state", "No git repo \u2014 check skipped");
   }
   try {
@@ -5991,7 +6640,7 @@ function remoteMainHash(resolvedPath) {
 }
 function checkStaleRemoteMain(resolvedPath) {
   if (resolvedPath === void 0) return void 0;
-  if (!existsSync12(join23(resolvedPath, ".git"))) return void 0;
+  if (!existsSync14(join26(resolvedPath, ".git"))) return void 0;
   const localOrigin = gitRefHash(resolvedPath, "origin/main");
   if (!localOrigin) return void 0;
   const remoteMain = remoteMainHash(resolvedPath);
@@ -6007,7 +6656,7 @@ function checkVaultLocalGit(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("warn", "vault_local_git", "Vault local git", "Cannot check \u2014 WIKI_PATH not resolved");
   }
-  if (!existsSync12(join23(resolvedPath, ".git"))) {
+  if (!existsSync14(join26(resolvedPath, ".git"))) {
     return check("warn", "vault_local_git", "Vault local git", "Not a git repository - sync features unavailable");
   }
   try {
@@ -6026,7 +6675,7 @@ function checkVaultGithubRemote(resolvedPath, exec) {
   if (resolvedPath === void 0) {
     return check("pass", "vault_github_remote", "Vault GitHub remote", "No vault path \u2014 check skipped");
   }
-  if (!existsSync12(join23(resolvedPath, ".git"))) {
+  if (!existsSync14(join26(resolvedPath, ".git"))) {
     return check("pass", "vault_github_remote", "Vault GitHub remote", "No git repo \u2014 check skipped");
   }
   const state = probeGithubReachability(resolvedPath, exec);
@@ -6070,7 +6719,7 @@ function checkVaultPromotionLag(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("pass", "vault_promotion_lag", "Vault promotion lag", "No vault path \u2014 check skipped");
   }
-  if (!existsSync12(join23(resolvedPath, ".git"))) {
+  if (!existsSync14(join26(resolvedPath, ".git"))) {
     return check("pass", "vault_promotion_lag", "Vault promotion lag", "No git repo \u2014 check skipped");
   }
   try {
@@ -6097,7 +6746,7 @@ function checkVaultGitComparison(resolvedPath, id, label, range, nonZeroSuffix,
   if (resolvedPath === void 0) {
     return check("pass", id, label, "No vault path \u2014 check skipped");
   }
-  if (!existsSync12(join23(resolvedPath, ".git"))) {
+  if (!existsSync14(join26(resolvedPath, ".git"))) {
     return check("pass", id, label, "No git repo \u2014 check skipped");
   }
   if (!hasOriginMain(resolvedPath)) {
@@ -6125,7 +6774,7 @@ function checkSatelliteLastRun(vaultPath, satelliteExpected) {
     return check("pass", "satellite_job_last_run", "Satellite job last run", "No vault path \u2014 check skipped");
   }
   const latestPath = satelliteLatestRunPath(vaultPath);
-  if (!existsSync12(latestPath)) {
+  if (!existsSync14(latestPath)) {
     return check("pass", "satellite_job_last_run", "Satellite job last run", "No latest-run.json \u2014 satellite has not run yet");
   }
   try {
@@ -6213,11 +6862,11 @@ async function checkFleetIdentity(input) {
 }
 function pullLogPaths(home) {
   const paths = platform2() === "darwin" ? [
-    join23(home, "Library", "Logs", "wiki-pull.log"),
-    join23(home, ".local", "state", "vault-sync", "log", "wiki-pull.log")
+    join26(home, "Library", "Logs", "wiki-pull.log"),
+    join26(home, ".local", "state", "vault-sync", "log", "wiki-pull.log")
   ] : [
-    join23(home, ".local", "state", "vault-sync", "log", "wiki-pull.log"),
-    join23(home, "Library", "Logs", "wiki-pull.log")
+    join26(home, ".local", "state", "vault-sync", "log", "wiki-pull.log"),
+    join26(home, "Library", "Logs", "wiki-pull.log")
   ];
   return [...new Set(paths)];
 }
@@ -6229,12 +6878,12 @@ function isRecentLogLine(line, nowMs) {
   return nowMs - ts <= 24 * 60 * 60 * 1e3;
 }
 function checkVaultGitPullFailures(home) {
-  const path = pullLogPaths(home).find((p) => existsSync12(p));
+  const path = pullLogPaths(home).find((p) => existsSync14(p));
   if (!path) {
     return check("pass", "vault_git_pull_failures", "Vault pull failures", "No wiki-pull.log found \u2014 check skipped");
   }
   try {
-    const lines = readFileSync9(path, "utf8").split(/\r?\n/).filter(Boolean);
+    const lines = readFileSync11(path, "utf8").split(/\r?\n/).filter(Boolean);
     const now = Date.now();
     const failures = lines.filter(
       (line) => isRecentLogLine(line, now) && /(pre-push pull failed|FAIL .*pull|FAIL .*rebase|cannot pull with rebase|unstaged changes)/i.test(line)
@@ -6257,8 +6906,8 @@ function checkS3MountPerf(resolvedPath) {
     return check("pass", "s3_mount_perf", "S3 mount performance", "local disk");
   }
   const mountPoint = fuse.mountPoint;
-  const conceptsDir = join23(resolvedPath, "concepts");
-  if (!existsSync12(conceptsDir)) {
+  const conceptsDir = join26(resolvedPath, "concepts");
+  if (!existsSync14(conceptsDir)) {
     return check("pass", "s3_mount_perf", "S3 mount performance", `S3 FUSE mount (${mountPoint}), no concepts/ to benchmark`);
   }
   const start = Date.now();
@@ -6440,8 +7089,8 @@ function checkWriteTest(resolvedPath) {
   if (!fuse) {
     return check("pass", "s3_write_test", "S3 write test", "local disk \u2014 check skipped");
   }
-  const conceptsDir = join23(resolvedPath, "concepts");
-  if (!existsSync12(conceptsDir)) {
+  const conceptsDir = join26(resolvedPath, "concepts");
+  if (!existsSync14(conceptsDir)) {
     return check("pass", "s3_write_test", "S3 write test", "no concepts/ dir to test \u2014 check skipped");
   }
   const result = writeTest(conceptsDir);
@@ -6527,7 +7176,7 @@ function checkVfsCacheHealth(resolvedPath) {
 }
 function readVaultSyncConfig(home) {
   try {
-    const content = readFileSync9(join23(home, ".skillwiki", ".env"), "utf8");
+    const content = readFileSync11(join26(home, ".skillwiki", ".env"), "utf8");
     let installed = false;
     let role;
     let serviceScope;
@@ -6556,7 +7205,7 @@ function readVaultSyncConfig(home) {
 }
 function readKeyFromEnvFile(path, keys) {
   try {
-    const content = readFileSync9(path, "utf8");
+    const content = readFileSync11(path, "utf8");
     for (const line of content.split(/\r?\n/)) {
       const trimmed = line.trim();
       if (trimmed.length === 0 || trimmed.startsWith("#")) continue;
@@ -6578,7 +7227,7 @@ function resolveSnapshotGitWorktree(config) {
     if (fromProfile) return fromProfile;
   }
   const defaultPath = "/root/wiki-git";
-  return existsSync12(defaultPath) ? defaultPath : void 0;
+  return existsSync14(defaultPath) ? defaultPath : void 0;
 }
 function vaultSyncChecks(input) {
   const os = input.os ?? platform2();
@@ -6595,16 +7244,16 @@ function vaultSyncChecks(input) {
     ];
   }
   const isMac = os === "darwin";
-  const logDir = input.logDir ?? (isMac ? join23(home, "Library", "Logs") : join23(home, ".local", "state", "vault-sync", "log"));
-  const shareDir = input.shareDir ?? (isMac ? join23(home, "Library", "Application Support", "vault-sync", "bin") : join23(home, ".local", "share", "vault-sync", "bin"));
-  const filterPath = input.filterPath ?? join23(home, ".config", "rclone", "wiki-push-filters.txt");
-  const packagedSnapshotPath = join23(shareDir, "wiki-snapshot.sh");
+  const logDir = input.logDir ?? (isMac ? join26(home, "Library", "Logs") : join26(home, ".local", "state", "vault-sync", "log"));
+  const shareDir = input.shareDir ?? (isMac ? join26(home, "Library", "Application Support", "vault-sync", "bin") : join26(home, ".local", "share", "vault-sync", "bin"));
+  const filterPath = input.filterPath ?? join26(home, ".config", "rclone", "wiki-push-filters.txt");
+  const packagedSnapshotPath = join26(shareDir, "wiki-snapshot.sh");
   const legacySnapshotPath = "/root/.hermes/scripts/wiki-snapshot-v3.sh";
-  const snapshotPath = input.snapshotScriptPath ?? (existsSync12(packagedSnapshotPath) ? packagedSnapshotPath : legacySnapshotPath);
+  const snapshotPath = input.snapshotScriptPath ?? (existsSync14(packagedSnapshotPath) ? packagedSnapshotPath : legacySnapshotPath);
   function snapshotLastStatusCheck() {
-    const snapshotLog = join23(logDir, "wiki-snapshot.log");
+    const snapshotLog = join26(logDir, "wiki-snapshot.log");
     try {
-      const logContent = readFileSync9(snapshotLog, "utf8");
+      const logContent = readFileSync11(snapshotLog, "utf8");
       const lines = logContent.trim().split("\n").filter(Boolean);
       if (lines.length === 0) {
         return check(
@@ -6649,14 +7298,14 @@ function vaultSyncChecks(input) {
     }
   }
   if (input.vaultSyncRole === "snapshotter") {
-    const c12 = existsSync12(snapshotPath) ? check("pass", "vault_sync_installed", "Vault sync installed", `Found snapshot script: ${snapshotPath}`) : check("error", "vault_sync_installed", "Vault sync installed", `Snapshot script not found at ${snapshotPath}`);
+    const c12 = existsSync14(snapshotPath) ? check("pass", "vault_sync_installed", "Vault sync installed", `Found snapshot script: ${snapshotPath}`) : check("error", "vault_sync_installed", "Vault sync installed", `Snapshot script not found at ${snapshotPath}`);
     const serviceScope = input.vaultSyncServiceScope ?? "user";
-    const userTimerPath = join23(home, ".config", "systemd", "user", "wiki-snapshot.timer");
+    const userTimerPath = join26(home, ".config", "systemd", "user", "wiki-snapshot.timer");
     const systemTimerPath = "/etc/systemd/system/wiki-snapshot.timer";
     let c22;
-    if (serviceScope === "user" && existsSync12(userTimerPath)) {
+    if (serviceScope === "user" && existsSync14(userTimerPath)) {
       c22 = check("pass", "vault_sync_jobs_enabled", "Vault sync jobs enabled", `Found: ${userTimerPath}`);
-    } else if (serviceScope === "system" && existsSync12(systemTimerPath)) {
+    } else if (serviceScope === "system" && existsSync14(systemTimerPath)) {
       c22 = check("pass", "vault_sync_jobs_enabled", "Vault sync jobs enabled", `Found: ${systemTimerPath}`);
     } else if (os !== "linux") {
       c22 = check("warn", "vault_sync_jobs_enabled", "Vault sync jobs enabled", "Snapshotter scheduler is Linux-only and no wiki-snapshot.timer file was found");
@@ -6688,7 +7337,7 @@ function vaultSyncChecks(input) {
     );
     let c52;
     try {
-      if (!existsSync12(snapshotPath)) {
+      if (!existsSync14(snapshotPath)) {
         c52 = check(
           "error",
           "vault_sync_snapshot_guard",
@@ -6696,7 +7345,7 @@ function vaultSyncChecks(input) {
           `Snapshot script not found at ${snapshotPath}`
         );
       } else {
-        const content = readFileSync9(snapshotPath, "utf8");
+        const content = readFileSync11(snapshotPath, "utf8");
         if (!content.includes("--max-delete")) {
           c52 = check(
             "error",
@@ -6723,8 +7372,8 @@ function vaultSyncChecks(input) {
     }
     return [c12, c22, c32, cFetch2, c42, c52];
   }
-  const pushScriptPath = join23(shareDir, "wiki-push.sh");
-  const c1 = existsSync12(pushScriptPath) ? check("pass", "vault_sync_installed", "Vault sync installed", `Found: ${pushScriptPath}`) : check("error", "vault_sync_installed", "Vault sync installed", `Script not found at ${pushScriptPath} \u2014 run vault-sync-install`);
+  const pushScriptPath = join26(shareDir, "wiki-push.sh");
+  const c1 = existsSync14(pushScriptPath) ? check("pass", "vault_sync_installed", "Vault sync installed", `Found: ${pushScriptPath}`) : check("error", "vault_sync_installed", "Vault sync installed", `Script not found at ${pushScriptPath} \u2014 run vault-sync-install`);
   let c2;
   try {
     if (isMac) {
@@ -6775,10 +7424,10 @@ function vaultSyncChecks(input) {
       "Scheduler check failed \u2014 run vault-sync-install"
     );
   }
-  const logFile = join23(logDir, "wiki-push.log");
+  const logFile = join26(logDir, "wiki-push.log");
   let c3;
   try {
-    const logContent = readFileSync9(logFile, "utf8");
+    const logContent = readFileSync11(logFile, "utf8");
     const lines = logContent.trim().split("\n").filter(Boolean);
     if (lines.length === 0) {
       c3 = check(
@@ -6834,7 +7483,7 @@ function vaultSyncChecks(input) {
       }
     }
   } catch {
-    c3 = existsSync12(logDir) ? check(
+    c3 = existsSync14(logDir) ? check(
       "warn",
       "vault_sync_last_push_age",
       "Vault sync last push recency",
@@ -6846,10 +7495,10 @@ function vaultSyncChecks(input) {
       `Log directory not found at ${logDir}`
     );
   }
-  const fetchLogFile = join23(logDir, "wiki-fetch.log");
+  const fetchLogFile = join26(logDir, "wiki-fetch.log");
   let cFetch;
   try {
-    const logContent = readFileSync9(fetchLogFile, "utf8");
+    const logContent = readFileSync11(fetchLogFile, "utf8");
     const lines = logContent.trim().split("\n").filter(Boolean);
     if (lines.length === 0) {
       cFetch = check(
@@ -6893,7 +7542,7 @@ function vaultSyncChecks(input) {
   }
   let c4;
   try {
-    if (!existsSync12(filterPath)) {
+    if (!existsSync14(filterPath)) {
       c4 = check(
         "error",
         "vault_sync_filter_present",
@@ -6901,7 +7550,7 @@ function vaultSyncChecks(input) {
         `Filter file not found at ${filterPath}`
       );
     } else {
-      const content = readFileSync9(filterPath, "utf8");
+      const content = readFileSync11(filterPath, "utf8");
       const requiredExcludes = [
         "remotely-save/data.json",
         ".skillwiki/sync.lock",
@@ -6944,7 +7593,7 @@ function vaultSyncChecks(input) {
     );
   } else {
     try {
-      if (!existsSync12(snapshotPath)) {
+      if (!existsSync14(snapshotPath)) {
         c5 = check(
           "error",
           "vault_sync_snapshot_guard",
@@ -6952,7 +7601,7 @@ function vaultSyncChecks(input) {
           `Snapshot script not found at ${snapshotPath}`
         );
       } else {
-        const content = readFileSync9(snapshotPath, "utf8");
+        const content = readFileSync11(snapshotPath, "utf8");
         if (!content.includes("--max-delete")) {
           c5 = check(
             "error",
@@ -6990,15 +7639,15 @@ function findSkillMd(dir) {
   }
   for (const entry of entries) {
     if (entry.isFile() && entry.name === "SKILL.md") {
-      results.push(join23(dir, entry.name));
+      results.push(join26(dir, entry.name));
     } else if (entry.isDirectory()) {
-      results.push(...findSkillMd(join23(dir, entry.name)));
+      results.push(...findSkillMd(join26(dir, entry.name)));
     }
   }
   return results;
 }
 function findInstalledSkillMd(dir) {
-  const directSkills = findSkillNames(dir).map((name) => join23(dir, name, "SKILL.md"));
+  const directSkills = findSkillNames(dir).map((name) => join26(dir, name, "SKILL.md"));
   return directSkills.length > 0 ? directSkills : findSkillMd(dir);
 }
 function findSkillNames(dir) {
@@ -7010,7 +7659,7 @@ function findSkillNames(dir) {
     return results;
   }
   for (const entry of entries) {
-    if (entry.isDirectory() && existsSync12(join23(dir, entry.name, "SKILL.md"))) {
+    if (entry.isDirectory() && existsSync14(join26(dir, entry.name, "SKILL.md"))) {
       results.push(entry.name);
     }
   }
@@ -7054,7 +7703,7 @@ async function vaultMetrics(resolvedPath) {
   }
   let logLines = 0;
   try {
-    logLines = readFileSync9(join23(resolvedPath, "log.md"), "utf8").split("\n").length;
+    logLines = readFileSync11(join26(resolvedPath, "log.md"), "utf8").split("\n").length;
   } catch {
   }
   return [
@@ -7162,7 +7811,7 @@ async function runDoctor(input) {
 }
 
 // src/utils/package-info.ts
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 function packageJsonCandidateUrls(baseUrl = import.meta.url) {
   return [
     new URL("../package.json", baseUrl),
@@ -7172,7 +7821,7 @@ function packageJsonCandidateUrls(baseUrl = import.meta.url) {
 function readCliPackageJson(baseUrl = import.meta.url) {
   for (const url of packageJsonCandidateUrls(baseUrl)) {
     try {
-      const pkg = JSON.parse(readFileSync10(url, "utf8"));
+      const pkg = JSON.parse(readFileSync12(url, "utf8"));
       if (typeof pkg.version === "string") {
         return { ...pkg, version: pkg.version };
       }
@@ -7183,8 +7832,8 @@ function readCliPackageJson(baseUrl = import.meta.url) {
 }
 
 // src/commands/project-index.ts
-import { readdir as readdir4, readFile as readFile16, writeFile as writeFile6, mkdir as mkdir5 } from "fs/promises";
-import { join as join24, dirname as dirname7, basename as basename2 } from "path";
+import { readdir as readdir4, readFile as readFile19, writeFile as writeFile5, mkdir as mkdir5 } from "fs/promises";
+import { join as join27, dirname as dirname8, basename as basename2 } from "path";
 var LAYER2_DIRS = ["entities", "concepts", "comparisons", "queries", "meta"];
 var PROJECT_LOCAL_DIRS = ["requirements", "work", "architecture", "history"];
 async function scanMarkdownTree(rootAbs, rootRel) {
@@ -7196,7 +7845,7 @@ async function scanMarkdownTree(rootAbs, rootRel) {
     return found;
   }
   for (const entry of entries) {
-    const abs = join24(rootAbs, entry.name);
+    const abs = join27(rootAbs, entry.name);
     const rel = `${rootRel}/${entry.name}`;
     if (entry.isDirectory()) {
       found.push(...await scanMarkdownTree(abs, rel));
@@ -7226,7 +7875,7 @@ function projectLocalType(slug, page, data) {
 }
 async function runProjectIndex(input) {
   const slug = input.slug;
-  const projectDir = join24(input.vault, "projects", slug);
+  const projectDir = join27(input.vault, "projects", slug);
   try {
     await readdir4(projectDir);
   } catch {
@@ -7237,15 +7886,15 @@ async function runProjectIndex(input) {
   }
   const wikilinkPattern = `[[${slug}]]`;
   const entries = [];
-  const compoundDir = join24(input.vault, "projects", slug, "compound");
+  const compoundDir = join27(input.vault, "projects", slug, "compound");
   try {
     const compoundFiles = await readdir4(compoundDir, { withFileTypes: true });
     for (const entry of compoundFiles) {
       if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-      const filePath = join24(compoundDir, entry.name);
+      const filePath = join27(compoundDir, entry.name);
       let text;
       try {
-        text = await readFile16(filePath, "utf8");
+        text = await readFile19(filePath, "utf8");
       } catch {
         continue;
       }
@@ -7262,16 +7911,16 @@ async function runProjectIndex(input) {
   for (const dir of LAYER2_DIRS) {
     let files;
     try {
-      files = await readdir4(join24(input.vault, dir), { withFileTypes: true });
+      files = await readdir4(join27(input.vault, dir), { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of files) {
       if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-      const filePath = join24(input.vault, dir, entry.name);
+      const filePath = join27(input.vault, dir, entry.name);
       let text;
       try {
-        text = await readFile16(filePath, "utf8");
+        text = await readFile19(filePath, "utf8");
       } catch {
         continue;
       }
@@ -7287,14 +7936,14 @@ async function runProjectIndex(input) {
     }
   }
   for (const dir of PROJECT_LOCAL_DIRS) {
-    const rootAbs = join24(projectDir, dir);
+    const rootAbs = join27(projectDir, dir);
     const rootRel = `projects/${slug}/${dir}`;
     const pages = await scanMarkdownTree(rootAbs, rootRel);
     for (const page of pages) {
-      const filePath = join24(input.vault, page);
+      const filePath = join27(input.vault, page);
       let text;
       try {
-        text = await readFile16(filePath, "utf8");
+        text = await readFile19(filePath, "utf8");
       } catch {
         continue;
       }
@@ -7313,11 +7962,11 @@ async function runProjectIndex(input) {
     const tb = typeOrder[b.type] ?? 99;
     return ta !== tb ? ta - tb : a.title.localeCompare(b.title);
   });
-  const indexPath = join24(projectDir, "knowledge.md");
+  const indexPath = join27(projectDir, "knowledge.md");
   let existing = false;
   let stale = false;
   try {
-    const existingText = await readFile16(indexPath, "utf8");
+    const existingText = await readFile19(indexPath, "utf8");
     existing = true;
     const existingEntries = existingText.split("\n").filter((l) => l.startsWith("- [["));
     const existingPages = new Set(existingEntries.map((l) => {
@@ -7357,8 +8006,8 @@ Autogenerated by \`skillwiki project-index\` on ${today}.
   }
   if (input.apply) {
     try {
-      await mkdir5(dirname7(indexPath), { recursive: true });
-      await writeFile6(indexPath, body, "utf8");
+      await mkdir5(dirname8(indexPath), { recursive: true });
+      await writeFile5(indexPath, body, "utf8");
     } catch (e) {
       return {
         exitCode: ExitCode.WRITE_FAILED,
@@ -7386,10 +8035,10 @@ ${entries.map((e) => `  ${e.type}: [[${e.page.replace(/\.md$/, "")}]] \u2014 ${e
 }
 
 // src/commands/observe.ts
-import { mkdir as mkdir6, writeFile as writeFile7 } from "fs/promises";
-import { existsSync as existsSync13, statSync as statSync2 } from "fs";
-import { join as join25 } from "path";
-import { createHash as createHash5 } from "crypto";
+import { mkdir as mkdir6, writeFile as writeFile6 } from "fs/promises";
+import { existsSync as existsSync15, statSync as statSync3 } from "fs";
+import { join as join28 } from "path";
+import { createHash as createHash7 } from "crypto";
 var ALLOWED_KINDS = /* @__PURE__ */ new Set(["note", "bug", "task", "idea", "session-log"]);
 function slugify(text) {
   const words = text.trim().split(/\s+/).slice(0, 6).join("-").toLowerCase().replace(/[^a-z0-9-]/g, "").replace(/-+/g, "-").replace(/^-|-$/g, "");
@@ -7411,13 +8060,13 @@ async function runObserve(input) {
       result: err("SCHEME_REJECTED", { message: "Text must not be empty" })
     };
   }
-  if (!existsSync13(input.vault) || !statSync2(input.vault).isDirectory()) {
+  if (!existsSync15(input.vault) || !statSync3(input.vault).isDirectory()) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: err("VAULT_PATH_INVALID", { path: input.vault })
     };
   }
-  const transcriptsDir = join25(input.vault, "raw", "transcripts");
+  const transcriptsDir = join28(input.vault, "raw", "transcripts");
   try {
     await mkdir6(transcriptsDir, { recursive: true });
   } catch {
@@ -7429,11 +8078,11 @@ async function runObserve(input) {
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const slug = slugify(input.text);
   const fileName = `${today}-observation-${slug}.md`;
-  const filePath = join25(transcriptsDir, fileName);
+  const filePath = join28(transcriptsDir, fileName);
   const body = `
 ${input.text.trim()}
 `;
-  const sha256 = createHash5("sha256").update(Buffer.from(body, "utf8")).digest("hex");
+  const sha256 = createHash7("sha256").update(Buffer.from(body, "utf8")).digest("hex");
   const frontmatterLines = [
     "---",
     "source_url:",
@@ -7447,7 +8096,7 @@ ${input.text.trim()}
   frontmatterLines.push("---");
   const content = frontmatterLines.join("\n") + body;
   try {
-    await writeFile7(filePath, content, "utf8");
+    await writeFile6(filePath, content, "utf8");
   } catch (e) {
     return {
       exitCode: ExitCode.WRITE_FAILED,
@@ -7469,9 +8118,9 @@ ${input.text.trim()}
 }
 
 // src/commands/memory.ts
-import { createHash as createHash6 } from "crypto";
-import { mkdir as mkdir7, readFile as readFile17, readdir as readdir5, stat as stat5, writeFile as writeFile8 } from "fs/promises";
-import { basename as basename3, extname, join as join26, relative as relative4, sep as sep4 } from "path";
+import { createHash as createHash8 } from "crypto";
+import { mkdir as mkdir7, readFile as readFile20, readdir as readdir5, stat as stat6, writeFile as writeFile7 } from "fs/promises";
+import { basename as basename3, extname, join as join29, relative as relative5, sep as sep5 } from "path";
 async function runMemoryTopics(input) {
   const scan = await scanVault(input.vault);
   if (!scan.ok) return { exitCode: ExitCode.VAULT_PATH_INVALID, result: scan };
@@ -7535,9 +8184,9 @@ async function runMemoryIndex(input) {
   }
   const generatedAt = (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "Z");
   const relCachePath = memoryCacheRelPath(input.project);
-  const absCachePath = join26(input.vault, relCachePath);
-  await mkdir7(join26(input.vault, ".skillwiki", "memory", input.project), { recursive: true });
-  await writeFile8(absCachePath, `${JSON.stringify({
+  const absCachePath = join29(input.vault, relCachePath);
+  await mkdir7(join29(input.vault, ".skillwiki", "memory", input.project), { recursive: true });
+  await writeFile7(absCachePath, `${JSON.stringify({
     generated_at: generatedAt,
     project: input.project,
     topics: state.topics,
@@ -7728,7 +8377,7 @@ async function buildMemoryIndexState(pages, project) {
 }
 async function checkMemoryIndex(vault, project, current) {
   const relCachePath = memoryCacheRelPath(project);
-  const cacheText = await readIfExists2(join26(vault, relCachePath));
+  const cacheText = await readIfExists2(join29(vault, relCachePath));
   if (!cacheText) {
     return {
       ok: true,
@@ -7845,7 +8494,7 @@ async function readMemoryPage(page, project, warnings) {
       title,
       summary: summarize(body),
       updated,
-      hash: createHash6("sha256").update(Buffer.from(body, "utf8")).digest("hex"),
+      hash: createHash8("sha256").update(Buffer.from(body, "utf8")).digest("hex"),
       topics,
       project,
       ...stringField(fm.data.memory_kind) ? { memory_kind: stringField(fm.data.memory_kind) } : {},
@@ -8121,13 +8770,13 @@ function renderMemoryIndexStatusHint(status) {
 }
 async function readIfExists2(path) {
   try {
-    return await readFile17(path, "utf8");
+    return await readFile20(path, "utf8");
   } catch {
     return "";
   }
 }
 async function collectImportFiles(source) {
-  const st = await stat5(source);
+  const st = await stat6(source);
   if (st.isFile()) return isImportCandidate(source) ? [source] : [];
   const files = [];
   await walkImportFiles(source, files);
@@ -8137,7 +8786,7 @@ async function walkImportFiles(dir, out) {
   const entries = await readdir5(dir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.name === ".git" || entry.name === "node_modules") continue;
-    const path = join26(dir, entry.name);
+    const path = join29(dir, entry.name);
     if (entry.isDirectory()) {
       await walkImportFiles(path, out);
     } else if (entry.isFile() && isImportCandidate(path)) {
@@ -8150,9 +8799,9 @@ function isImportCandidate(path) {
   return ext === ".md" || ext === ".txt";
 }
 async function buildImportEntry(file, sourceRoot, project, today, maxBytes) {
-  const st = await stat5(file);
+  const st = await stat6(file);
   const sourceKind = classifyImportSource(file);
-  const hash = createHash6("sha256").update(await readFile17(file)).digest("hex");
+  const hash = createHash8("sha256").update(await readFile20(file)).digest("hex");
   const baseEntry = {
     source_path: file,
     source_kind: sourceKind,
@@ -8175,7 +8824,7 @@ async function buildImportEntry(file, sourceRoot, project, today, maxBytes) {
       reason: "policy_source_not_imported"
     };
   }
-  const text = await readFile17(file, "utf8");
+  const text = await readFile20(file, "utf8");
   const extracted = extractImportText(text, sourceKind);
   if (!extracted) {
     return {
@@ -8187,7 +8836,7 @@ async function buildImportEntry(file, sourceRoot, project, today, maxBytes) {
   const redacted = redactSensitiveContent(extracted, { file });
   const privacy = redacted.findings.length > 0 ? "sensitive" : "local";
   const sourceSlug = slugify2(basename3(file, extname(file)));
-  const relSource = relative4(sourceRoot, file).split(sep4).join("/");
+  const relSource = relative5(sourceRoot, file).split(sep5).join("/");
   const entry = {
     ...baseEntry,
     status: "ready",
@@ -8204,9 +8853,9 @@ async function writeImportCapture(vault, entry, today) {
   const content = hiddenString(entry, "__content");
   const project = hiddenString(entry, "__project");
   const relPath = await availableImportPath(vault, entry.proposed_path);
-  const absPath = join26(vault, relPath);
-  await mkdir7(join26(vault, "raw", "transcripts"), { recursive: true });
-  await writeFile8(absPath, renderImportCapture(entry, content, project, today), "utf8");
+  const absPath = join29(vault, relPath);
+  await mkdir7(join29(vault, "raw", "transcripts"), { recursive: true });
+  await writeFile7(absPath, renderImportCapture(entry, content, project, today), "utf8");
   const validation = await runValidate({ file: absPath });
   return {
     relPath,
@@ -8221,7 +8870,7 @@ async function availableImportPath(vault, proposed) {
   const stem = proposed.slice(0, -ext.length);
   let candidate = proposed;
   let i = 2;
-  while (await readIfExists2(join26(vault, candidate))) {
+  while (await readIfExists2(join29(vault, candidate))) {
     candidate = `${stem}-${i}${ext}`;
     i++;
   }
@@ -8259,7 +8908,7 @@ function hiddenString(entry, key) {
   return entry[key] ?? "";
 }
 function classifyImportSource(file) {
-  const rel = file.split(sep4).join("/");
+  const rel = file.split(sep5).join("/");
   const name = basename3(file);
   if (rel.includes("/.codex/memories/")) return "codex-memory";
   if (rel.includes("/.codex/rules/")) return "codex-rule";
@@ -8393,10 +9042,10 @@ function memoryCacheRelPath(project) {
 }
 async function readMemoryCache(vault, project) {
   if (project) {
-    const projectCache = await readIfExists2(join26(vault, memoryCacheRelPath(project)));
+    const projectCache = await readIfExists2(join29(vault, memoryCacheRelPath(project)));
     if (projectCache) return projectCache;
   }
-  return readIfExists2(join26(vault, ".skillwiki", "memory-topics.json"));
+  return readIfExists2(join29(vault, ".skillwiki", "memory-topics.json"));
 }
 function dedupePages(pages) {
   const seen = /* @__PURE__ */ new Set();
@@ -8482,8 +9131,8 @@ function slugify2(value) {
 }
 
 // src/commands/query.ts
-import { readFile as readFile18, stat as stat6 } from "fs/promises";
-import { join as join27 } from "path";
+import { readFile as readFile21, stat as stat7 } from "fs/promises";
+import { join as join30 } from "path";
 var W_KEYWORD = 2;
 var W_SOURCE_OVERLAP = 4;
 var W_WIKILINK = 3;
@@ -8604,10 +9253,10 @@ function computeKeywordScore(terms, title, tags, body) {
   return score;
 }
 async function loadOrBuildGraph(vault) {
-  const graphPath = join27(vault, ".skillwiki", "graph.json");
+  const graphPath = join30(vault, ".skillwiki", "graph.json");
   let needsBuild = false;
   try {
-    const fileStat = await stat6(graphPath);
+    const fileStat = await stat7(graphPath);
     const ageHours = (Date.now() - fileStat.mtimeMs) / (1e3 * 60 * 60);
     if (ageHours > 24) needsBuild = true;
   } catch {
@@ -8618,7 +9267,7 @@ async function loadOrBuildGraph(vault) {
     if (buildResult.exitCode !== 0) return null;
   }
   try {
-    const raw = await readFile18(graphPath, "utf8");
+    const raw = await readFile21(graphPath, "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -8633,27 +9282,27 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z as z2 } from "zod";
 
 // src/mcp/vault-resolve.ts
-import { join as join28, resolve as resolve7 } from "path";
+import { join as join31, resolve as resolve8 } from "path";
 
 // src/mcp/allowlist.ts
-import { resolve as resolve6, sep as sep5 } from "path";
-import { realpathSync } from "fs";
+import { resolve as resolve7, sep as sep6 } from "path";
+import { realpathSync as realpathSync2 } from "fs";
 function parseVaultAllowlist(envValue) {
   if (envValue === void 0 || envValue.trim() === "") return null;
-  return envValue.split(",").map((s) => s.trim()).filter((s) => s.length > 0).map((p) => resolve6(p));
+  return envValue.split(",").map((s) => s.trim()).filter((s) => s.length > 0).map((p) => resolve7(p));
 }
 function vaultAllowedByList(vaultPath, allowlist) {
   if (!allowlist || allowlist.length === 0) return true;
   let canonical = vaultPath;
   try {
-    canonical = realpathSync(vaultPath);
+    canonical = realpathSync2(vaultPath);
   } catch {
-    canonical = resolve6(vaultPath);
+    canonical = resolve7(vaultPath);
   }
-  const resolved = resolve6(canonical);
+  const resolved = resolve7(canonical);
   return allowlist.some((root) => {
-    const r = resolve6(root);
-    return resolved === r || resolved.startsWith(r + sep5);
+    const r = resolve7(root);
+    return resolved === r || resolved.startsWith(r + sep6);
   });
 }
 function getVaultAllowlistFromEnv() {
@@ -8666,7 +9315,7 @@ async function resolveMcpVault(input) {
   let vaultPath;
   let source = "resolved";
   if (input.vault !== void 0 && input.vault.length > 0) {
-    vaultPath = resolve7(input.vault);
+    vaultPath = resolve8(input.vault);
     source = "flag";
   } else {
     const r = await resolveRuntimePath({
@@ -8678,7 +9327,7 @@ async function resolveMcpVault(input) {
       cwd: input.cwd ?? process.cwd()
     });
     if (!r.ok) return r;
-    vaultPath = resolve7(r.data.path);
+    vaultPath = resolve8(r.data.path);
     source = r.data.source;
   }
   const scan = await scanVault(vaultPath);
@@ -8695,7 +9344,7 @@ async function resolveMcpVault(input) {
   return ok({ vault: vaultPath, source });
 }
 function defaultGraphOut(vault) {
-  return join28(vault, ".skillwiki", "graph.json");
+  return join31(vault, ".skillwiki", "graph.json");
 }
 
 // src/mcp/result-format.ts
@@ -8710,9 +9359,9 @@ function formatToolResult(payload) {
 }
 
 // src/mcp/audit-log.ts
-import { appendFileSync, mkdirSync as mkdirSync3 } from "fs";
+import { appendFileSync, mkdirSync as mkdirSync5 } from "fs";
 import { homedir } from "os";
-import { join as join29 } from "path";
+import { join as join32 } from "path";
 function auditEnabled() {
   const v = process.env.SKILLWIKI_MCP_AUDIT;
   if (v === "0" || v === "false") return false;
@@ -8724,7 +9373,7 @@ function auditSink() {
 function auditFilePath() {
   const custom = process.env.SKILLWIKI_MCP_AUDIT_FILE;
   if (custom && custom.length > 0) return custom;
-  return join29(homedir(), ".skillwiki", "mcp-audit.jsonl");
+  return join32(homedir(), ".skillwiki", "mcp-audit.jsonl");
 }
 function auditMcpToolCall(entry) {
   if (!auditEnabled()) return;
@@ -8734,7 +9383,7 @@ function auditMcpToolCall(entry) {
     return;
   }
   const path = auditFilePath();
-  mkdirSync3(join29(path, ".."), { recursive: true });
+  mkdirSync5(join32(path, ".."), { recursive: true });
   appendFileSync(path, line, "utf8");
 }
 async function runMcpToolHandler(tool, input, fn) {
@@ -8954,8 +9603,8 @@ function registerMcpMutatingTools(server) {
 }
 
 // src/mcp/resources.ts
-import { readFile as readFile20 } from "fs/promises";
-import { join as join31 } from "path";
+import { readFile as readFile23 } from "fs/promises";
+import { join as join34 } from "path";
 import { ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 
 // src/mcp/lint-bucket.ts
@@ -9083,9 +9732,9 @@ async function fetchQueryPreview(input) {
 }
 
 // src/mcp/graph-html.ts
-import { readFile as readFile19 } from "fs/promises";
-import { join as join30 } from "path";
-import { existsSync as existsSync14 } from "fs";
+import { readFile as readFile22 } from "fs/promises";
+import { join as join33 } from "path";
+import { existsSync as existsSync16 } from "fs";
 var TYPE_COLORS = {
   entities: "#e74c3c",
   concepts: "#27ae60",
@@ -9153,9 +9802,9 @@ ${nodeSvg}
   return { html, node_count: nodes.length, edge_count: edges.length, truncated };
 }
 async function fetchGraphHtmlReport(input) {
-  const graphPath = input.graphPath ?? join30(input.vault, ".skillwiki", "graph.json");
+  const graphPath = input.graphPath ?? join33(input.vault, ".skillwiki", "graph.json");
   const maxNodes = Math.min(Math.max(10, input.maxNodes ?? 120), 500);
-  if (!existsSync14(graphPath)) {
+  if (!existsSync16(graphPath)) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
       result: err("GRAPH_MISSING", { path: graphPath, hint: "Run skillwiki.graph_build first." })
@@ -9163,7 +9812,7 @@ async function fetchGraphHtmlReport(input) {
   }
   let raw;
   try {
-    raw = await readFile19(graphPath, "utf8");
+    raw = await readFile22(graphPath, "utf8");
   } catch (e) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
@@ -9227,7 +9876,7 @@ async function fetchStaleSummary(input) {
 
 // src/mcp/resources.ts
 async function readVaultFile(vault, rel) {
-  return readFile20(join31(vault, rel), "utf8");
+  return readFile23(join34(vault, rel), "utf8");
 }
 async function tailLines(text, lines) {
   const parts = text.split(/\r?\n/);
@@ -9313,9 +9962,9 @@ function registerMcpResources(server) {
       if (!v.ok) {
         return { contents: [{ uri: uri.href, mimeType: "text/plain", text: JSON.stringify(v) }] };
       }
-      const path = join31(v.data.vault, ".skillwiki", "graph.json");
+      const path = join34(v.data.vault, ".skillwiki", "graph.json");
       try {
-        const raw = await readFile20(path, "utf8");
+        const raw = await readFile23(path, "utf8");
         const graph = JSON.parse(raw);
         const adjacency = graph.adjacency ?? {};
         const nodes = Object.keys(adjacency);
@@ -9628,13 +10277,29 @@ export {
   ExitCode,
   ok,
   err,
-  TypedKnowledgeSchema,
+  RawSourceSchema,
   MetaSchema,
-  detectSchema,
   isBlockedHost,
   splitFrontmatter,
   extractFrontmatter,
   scanSensitiveContent,
+  redactSensitiveContent,
+  readLastOp,
+  appendLastOp,
+  clearLastOp,
+  atomicWriteText,
+  runLogAppend,
+  renderIndexUpsert,
+  upsertIndexEntry,
+  getSessionId,
+  getCliSessionId,
+  readLock,
+  acquireLock,
+  releaseLock,
+  acquireOwnedSyncLock,
+  releaseOwnedSyncLock,
+  assertTargetInsideVault,
+  prepareTypedPage,
   runValidate,
   scanVault,
   readPage,
@@ -9650,9 +10315,8 @@ export {
   runAudit,
   findPlugin,
   extractTaxonomy,
-  readLastOp,
-  appendLastOp,
-  clearLastOp,
+  taxonomyCommentForPage,
+  reconcileTaxonomyDocument,
   runLinks,
   runTagAudit,
   runIndexCheck,