skillwiki 0.9.61 → 0.9.63

package/dist/cli.js

@@ -3,15 +3,18 @@ import {
   ExitCode,
   FLEET_REL_PATH,
   MetaSchema,
+  RawSourceSchema,
   SATELLITE_STALE_MS,
-  TypedKnowledgeSchema,
+  acquireLock,
+  acquireOwnedSyncLock,
   appendLastOp,
+  assertTargetInsideVault,
   assessSourceIdentity,
+  atomicWriteText,
   buildDegradedReasons,
   buildRemoteObjectPath,
   clearLastOp,
   configPath,
-  detectSchema,
   err,
   evaluateSatelliteRunHealth,
   extractCitationMarkers,
@@ -19,6 +22,8 @@ import {
   extractTaxonomy,
   findPlugin,
   fixPathTooLong,
+  getCliSessionId,
+  getSessionId,
   isBlockedHost,
   isFailedRunStatus,
   isValidRemoteDeleteCap,
@@ -29,12 +34,19 @@ import {
   parseDotenvFile,
   parseDotenvText,
   planAndMaybePruneRemoteObjects,
+  prepareTypedPage,
   probeRemoteHealth,
   profileKey,
   readCliPackageJson,
   readLastOp,
+  readLock,
   readPage,
   readSatelliteLatestRunFromText,
+  reconcileTaxonomyDocument,
+  redactSensitiveContent,
+  releaseLock,
+  releaseOwnedSyncLock,
+  renderIndexUpsert,
   resolveFleetHostId,
   resolveInitTimePath,
   resolveRuntimePath,
@@ -53,6 +65,7 @@ import {
   runIndexLinkFormat,
   runLinks,
   runLint,
+  runLogAppend,
   runLogRotate,
   runMemoryImport,
   runMemoryIndex,
@@ -76,8 +89,10 @@ import {
   scanVault,
   snapshotterAliasForLocalHost,
   splitFrontmatter,
+  taxonomyCommentForPage,
+  upsertIndexEntry,
   writeDotenv
-} from "./chunk-FU462DVS.js";
+} from "./chunk-TUFQZ5K4.js";
 import {
   normalizeDistTag,
   readCache,
@@ -87,7 +102,7 @@ import {
 } from "./chunk-7I2TPIV5.js";
 
 // src/cli.ts
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 import { Command } from "commander";
 
 // src/utils/output.ts
@@ -853,110 +868,9 @@ async function runClaim(input) {
   };
 }
 
-// src/commands/log-append.ts
-import { readFile as readFile5, rename as rename2, writeFile as writeFile4, stat as stat3 } from "fs/promises";
-import { join as join8 } from "path";
-
-// src/utils/log-lock.ts
-import { existsSync as existsSync2, mkdirSync, statSync as statSync2, unlinkSync, writeFileSync } from "fs";
-import { join as join7 } from "path";
-function logLockPath(vault) {
-  return join7(vault, ".skillwiki", "log-append.lock");
-}
-var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-async function acquireLogLock(vault, opts = {}) {
-  const retryMs = opts.retryMs ?? 2e3;
-  const pollMs = opts.pollMs ?? 50;
-  const staleMs = opts.staleMs ?? 1e4;
-  const path = logLockPath(vault);
-  const dir = join7(vault, ".skillwiki");
-  if (!existsSync2(dir)) mkdirSync(dir, { recursive: true });
-  const deadline = Date.now() + retryMs;
-  const content = JSON.stringify({ pid: process.pid, acquired: (/* @__PURE__ */ new Date()).toISOString() }) + "\n";
-  for (; ; ) {
-    try {
-      writeFileSync(path, content, { flag: "wx" });
-      return { ok: true };
-    } catch (e) {
-      const err2 = e;
-      if (err2.code !== "EEXIST") throw err2;
-    }
-    try {
-      const age = Date.now() - statSync2(path).mtimeMs;
-      if (age > staleMs) {
-        unlinkSync(path);
-        continue;
-      }
-    } catch {
-      continue;
-    }
-    if (Date.now() >= deadline) return { ok: false };
-    await sleep(pollMs);
-  }
-}
-function releaseLogLock(vault) {
-  try {
-    unlinkSync(logLockPath(vault));
-  } catch {
-  }
-}
-
-// src/commands/log-append.ts
-var ENTRY_RE = /^## \[(\d{4})-\d{2}-\d{2}\]/gm;
-async function runLogAppend(input) {
-  try {
-    await stat3(join8(input.vault, "SCHEMA.md"));
-  } catch {
-    return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { vault: input.vault }) };
-  }
-  const content = (input.content ?? "").trim();
-  if (content.length === 0) {
-    return { exitCode: ExitCode.USAGE, result: err("USAGE", { message: "--content must be a non-empty log entry" }) };
-  }
-  const acquired = await acquireLogLock(input.vault);
-  if (!acquired.ok) {
-    return { exitCode: ExitCode.LOG_APPEND_LOCK_HELD, result: err("LOG_APPEND_LOCK_HELD", { vault: input.vault }) };
-  }
-  const logPath = join8(input.vault, "log.md");
-  try {
-    let logText;
-    try {
-      logText = await readFile5(logPath, "utf8");
-    } catch {
-      return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: logPath }) };
-    }
-    const entriesBefore = [...logText.matchAll(ENTRY_RE)].length;
-    const body = logText.replace(/\s+$/, "");
-    const next = `${body}
-
-${content}
-`;
-    try {
-      const tmp = logPath + ".tmp";
-      await writeFile4(tmp, next, "utf8");
-      await rename2(tmp, logPath);
-    } catch (e) {
-      return { exitCode: ExitCode.WRITE_FAILED, result: err("WRITE_FAILED", { message: String(e) }) };
-    }
-    appendLastOp(input.vault, {
-      operation: "log-append",
-      summary: `appended log entry (${entriesBefore}->${entriesBefore + 1})`,
-      files: ["log.md"],
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
-    });
-    const entriesAfter = entriesBefore + 1;
-    return {
-      exitCode: ExitCode.OK,
-      result: ok({ entries_before: entriesBefore, entries_after: entriesAfter, appended: true, humanHint: `appended log entry (${entriesBefore}->${entriesAfter})` })
-    };
-  } finally {
-    releaseLogLock(input.vault);
-  }
-}
-
 // src/commands/health.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname4, join as join9, resolve as resolve2 } from "path";
+import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, renameSync, writeFileSync } from "fs";
+import { dirname as dirname4, join as join7, resolve as resolve2 } from "path";
 import { platform } from "os";
 function statusFromCounts(counts) {
   if ((counts.error ?? 0) > 0) return "error";
@@ -1067,7 +981,7 @@ function summarizeChecks(checks) {
   };
 }
 function classifyLog(path, id, label, okPattern) {
-  if (!existsSync3(path)) return { id, label, status: "warn", detail: `log file missing: ${path}` };
+  if (!existsSync2(path)) return { id, label, status: "warn", detail: `log file missing: ${path}` };
   const lines = readFileSync2(path, "utf8").split(/\r?\n/).filter(Boolean);
   if (lines.length === 0) return { id, label, status: "warn", detail: `log file empty: ${path}` };
   const statusLine = [...lines].reverse().find(
@@ -1089,12 +1003,12 @@ function runVaultSyncHealth(home, syncMode) {
     };
   }
   const isMac = platform() === "darwin";
-  const shareDir = isMac ? join9(home, "Library", "Application Support", "vault-sync", "bin") : join9(home, ".local", "share", "vault-sync", "bin");
-  const logDir = isMac ? join9(home, "Library", "Logs") : join9(home, ".local", "state", "vault-sync", "log");
-  const filterPath = join9(home, ".config", "rclone", "wiki-push-filters.txt");
+  const shareDir = isMac ? join7(home, "Library", "Application Support", "vault-sync", "bin") : join7(home, ".local", "share", "vault-sync", "bin");
+  const logDir = isMac ? join7(home, "Library", "Logs") : join7(home, ".local", "state", "vault-sync", "log");
+  const filterPath = join7(home, ".config", "rclone", "wiki-push-filters.txt");
   const checks = [];
-  const pushScript = join9(shareDir, "wiki-push.sh");
-  if (syncMode === "optional" && !existsSync3(pushScript)) {
+  const pushScript = join7(shareDir, "wiki-push.sh");
+  if (syncMode === "optional" && !existsSync2(pushScript)) {
     return {
       status: "pass",
       blocking: false,
@@ -1107,23 +1021,23 @@ function runVaultSyncHealth(home, syncMode) {
       }]
     };
   }
-  checks.push(existsSync3(pushScript) ? { id: "vault_sync_installed", label: "Vault sync installed", status: "pass", detail: `Found: ${pushScript}` } : { id: "vault_sync_installed", label: "Vault sync installed", status: "error", detail: `Script missing: ${pushScript}` });
+  checks.push(existsSync2(pushScript) ? { id: "vault_sync_installed", label: "Vault sync installed", status: "pass", detail: `Found: ${pushScript}` } : { id: "vault_sync_installed", label: "Vault sync installed", status: "error", detail: `Script missing: ${pushScript}` });
   if (isMac) {
-    const pushPlist = join9(home, "Library", "LaunchAgents", "com.karlchow.wiki-push.plist");
-    const fetchPlist = join9(home, "Library", "LaunchAgents", "com.karlchow.wiki-fetch.plist");
-    checks.push(existsSync3(pushPlist) && existsSync3(fetchPlist) ? { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "pass", detail: "launchd unit files present (read-only mode)" } : { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "warn", detail: "launchd unit files missing (read-only mode)" });
+    const pushPlist = join7(home, "Library", "LaunchAgents", "com.karlchow.wiki-push.plist");
+    const fetchPlist = join7(home, "Library", "LaunchAgents", "com.karlchow.wiki-fetch.plist");
+    checks.push(existsSync2(pushPlist) && existsSync2(fetchPlist) ? { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "pass", detail: "launchd unit files present (read-only mode)" } : { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "warn", detail: "launchd unit files missing (read-only mode)" });
     checks.push({ id: "vault_sync_fuse_refresh_job", label: "Vault sync fuse refresh job", status: "pass", detail: "macOS host \u2014 check skipped" });
   } else {
-    const pushTimer = join9(home, ".config", "systemd", "user", "wiki-push.timer");
-    const fetchTimer = join9(home, ".config", "systemd", "user", "wiki-fetch.timer");
-    const fuseTimer = join9(home, ".config", "systemd", "user", "wiki-fuse-refresh.timer");
-    const fuseService = join9(home, ".config", "systemd", "user", "wiki-fuse-refresh.service");
-    checks.push(existsSync3(pushTimer) && existsSync3(fetchTimer) ? { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "pass", detail: "systemd timer unit files present (read-only mode)" } : { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "warn", detail: "systemd timer unit files missing (read-only mode)" });
-    checks.push(existsSync3(fuseTimer) && existsSync3(fuseService) ? { id: "vault_sync_fuse_refresh_job", label: "Vault sync fuse refresh job", status: "pass", detail: "wiki-fuse-refresh unit files present (read-only mode)" } : { id: "vault_sync_fuse_refresh_job", label: "Vault sync fuse refresh job", status: "warn", detail: "wiki-fuse-refresh unit files missing (read-only mode)" });
-  }
-  checks.push(classifyLog(join9(logDir, "wiki-push.log"), "vault_sync_last_push_age", "Vault sync last push recency", /OK push/));
-  checks.push(classifyLog(join9(logDir, "wiki-fetch.log"), "vault_sync_last_fetch_status", "Vault sync last fetch status", /NOTIFY|OK behind|OK/));
-  if (!existsSync3(filterPath)) {
+    const pushTimer = join7(home, ".config", "systemd", "user", "wiki-push.timer");
+    const fetchTimer = join7(home, ".config", "systemd", "user", "wiki-fetch.timer");
+    const fuseTimer = join7(home, ".config", "systemd", "user", "wiki-fuse-refresh.timer");
+    const fuseService = join7(home, ".config", "systemd", "user", "wiki-fuse-refresh.service");
+    checks.push(existsSync2(pushTimer) && existsSync2(fetchTimer) ? { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "pass", detail: "systemd timer unit files present (read-only mode)" } : { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "warn", detail: "systemd timer unit files missing (read-only mode)" });
+    checks.push(existsSync2(fuseTimer) && existsSync2(fuseService) ? { id: "vault_sync_fuse_refresh_job", label: "Vault sync fuse refresh job", status: "pass", detail: "wiki-fuse-refresh unit files present (read-only mode)" } : { id: "vault_sync_fuse_refresh_job", label: "Vault sync fuse refresh job", status: "warn", detail: "wiki-fuse-refresh unit files missing (read-only mode)" });
+  }
+  checks.push(classifyLog(join7(logDir, "wiki-push.log"), "vault_sync_last_push_age", "Vault sync last push recency", /OK push/));
+  checks.push(classifyLog(join7(logDir, "wiki-fetch.log"), "vault_sync_last_fetch_status", "Vault sync last fetch status", /NOTIFY|OK behind|OK/));
+  if (!existsSync2(filterPath)) {
     checks.push({ id: "vault_sync_filter_present", label: "Vault sync filter file present", status: "error", detail: `Filter missing: ${filterPath}` });
   } else {
     const content = readFileSync2(filterPath, "utf8");
@@ -1219,9 +1133,9 @@ function buildHumanHint(report) {
   return lines.join("\n");
 }
 function writeReport(out, report) {
-  mkdirSync2(dirname4(out), { recursive: true });
+  mkdirSync(dirname4(out), { recursive: true });
   const tmp = `${out}.tmp-${process.pid}-${Date.now()}`;
-  writeFileSync2(tmp, JSON.stringify(ok(report), null, 2) + "\n", "utf8");
+  writeFileSync(tmp, JSON.stringify(ok(report), null, 2) + "\n", "utf8");
   renameSync(tmp, out);
 }
 function buildIncompleteReport(input, syncMode) {
@@ -1445,8 +1359,50 @@ async function runHealth(input) {
 }
 
 // src/commands/archive.ts
-import { rename as rename3, mkdir as mkdir5, readFile as readFile6, writeFile as writeFile5 } from "fs/promises";
-import { join as join10, dirname as dirname5 } from "path";
+import { rename as rename2, mkdir as mkdir6, readFile as readFile6, writeFile as writeFile5 } from "fs/promises";
+import { join as join9, dirname as dirname5 } from "path";
+
+// src/utils/delete-intent.ts
+import { mkdir as mkdir5, writeFile as writeFile4, readdir as readdir3, readFile as readFile5 } from "fs/promises";
+import { join as join8 } from "path";
+var DELETE_INTENT_SCHEMA = "vault-delete-intent/v1";
+var DELETE_INTENT_DIR = "meta/delete-intents";
+function normalizeVaultRelPath(path) {
+  const p = path.replace(/\\/g, "/").replace(/^\/+/, "");
+  if (!p || p.includes("..") || p.startsWith(".git/")) {
+    throw new Error(`invalid vault-relative path: ${path}`);
+  }
+  return p;
+}
+function pathToIntentFilename(path) {
+  const p = normalizeVaultRelPath(path);
+  return `${p.replace(/\//g, "__")}.json`;
+}
+function intentHostId() {
+  return process.env.SKILLWIKI_HOST_ID ?? process.env.AGENT_HOST_ID ?? "unknown";
+}
+function buildDeleteIntent(input) {
+  return {
+    schema: DELETE_INTENT_SCHEMA,
+    path: normalizeVaultRelPath(input.path),
+    action: input.action,
+    created: input.created ?? (/* @__PURE__ */ new Date()).toISOString(),
+    host: input.host ?? intentHostId(),
+    actor: input.actor,
+    reason: input.reason,
+    source: input.source,
+    expires: input.expires ?? null
+  };
+}
+async function writeDeleteIntent(vault, intent) {
+  const dir = join8(vault, DELETE_INTENT_DIR);
+  await mkdir5(dir, { recursive: true });
+  const rel = `${DELETE_INTENT_DIR}/${pathToIntentFilename(intent.path)}`;
+  await writeFile4(join8(vault, rel), JSON.stringify(intent, null, 2) + "\n", "utf8");
+  return rel;
+}
+
+// src/commands/archive.ts
 function countWikilinks(body, slug) {
   const escaped = slug.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const re = new RegExp(`\\[\\[${escaped}(?:[|#][^\\]]*)?\\]\\]`, "g");
@@ -1480,7 +1436,7 @@ async function runArchive(input) {
   if (!relPath) return { exitCode: ExitCode.ARCHIVE_TARGET_NOT_FOUND, result: err("ARCHIVE_TARGET_NOT_FOUND", { page: input.page }) };
   if (relPath.startsWith("_archive/")) return { exitCode: ExitCode.ARCHIVE_ALREADY_ARCHIVED, result: err("ARCHIVE_ALREADY_ARCHIVED", { page: relPath }) };
   const slug = relPath.replace(/\.md$/, "").split("/").pop();
-  const archivePath = join10("_archive", relPath).replace(/\\/g, "/");
+  const archivePath = join9("_archive", relPath).replace(/\\/g, "/");
   const remoteRoot = normalizeRemoteRoot(input.remote);
   const remoteObjectPath = buildRemoteObjectPath(remoteRoot, relPath);
   let cascade;
@@ -1506,7 +1462,7 @@ async function runArchive(input) {
     const indexRefs = [];
     if (!isRaw) {
       try {
-        const idx = await readFile6(join10(input.vault, "index.md"), "utf8");
+        const idx = await readFile6(join9(input.vault, "index.md"), "utf8");
         idx.split("\n").forEach((line, i) => {
           if (line.includes(`[[${slug}]]`)) indexRefs.push({ line: i + 1, text: line });
         });
@@ -1533,7 +1489,7 @@ async function runArchive(input) {
   }
   if (input.cascade && input.apply && cascade) {
     for (const ref of cascade.source_array_refs) {
-      const absPath = join10(input.vault, ref.page);
+      const absPath = join9(input.vault, ref.page);
       const text = await readFile6(absPath, "utf8");
       const split = splitFrontmatter(text);
       if (!split.ok) continue;
@@ -1551,10 +1507,10 @@ ${fmRewritten}
       }
     }
   }
-  await mkdir5(dirname5(join10(input.vault, archivePath)), { recursive: true });
+  await mkdir6(dirname5(join9(input.vault, archivePath)), { recursive: true });
   let indexUpdated = false;
   if (!isRaw) {
-    const indexPath = join10(input.vault, "index.md");
+    const indexPath = join9(input.vault, "index.md");
     try {
       const idx = await readFile6(indexPath, "utf8");
       const originalLines = idx.split("\n");
@@ -1567,11 +1523,18 @@ ${fmRewritten}
       if (e instanceof Error && "code" in e && e.code !== "ENOENT") throw e;
     }
   }
-  await rename3(join10(input.vault, relPath), join10(input.vault, archivePath));
+  await rename2(join9(input.vault, relPath), join9(input.vault, archivePath));
+  const archiveIntent = buildDeleteIntent({
+    path: relPath,
+    action: "archive",
+    actor: "skillwiki-cli",
+    source: "cli"
+  });
+  const tombstonePath = await writeDeleteIntent(input.vault, archiveIntent);
   appendLastOp(input.vault, {
     operation: input.cascade ? "archive-cascade" : "archive",
-    summary: `moved ${relPath} to ${archivePath}${input.cascade ? ` (cascade: ${cascade?.source_array_refs.length ?? 0} source arrays updated)` : ""}`,
-    files: [relPath],
+    summary: `moved ${relPath} to ${archivePath}${input.cascade ? ` (cascade: ${cascade?.source_array_refs.length ?? 0} source arrays updated)` : ""}; tombstone ${tombstonePath}`,
+    files: [relPath, archivePath, tombstonePath],
     timestamp: (/* @__PURE__ */ new Date()).toISOString()
   });
   let remote;
@@ -1600,6 +1563,106 @@ ${fmRewritten}
   };
 }
 
+// src/commands/remove.ts
+import { unlink as unlink2, readFile as readFile7, writeFile as writeFile6, access } from "fs/promises";
+import { join as join10 } from "path";
+async function pathExists(abs) {
+  try {
+    await access(abs);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function runRemove(input) {
+  if (input.remoteDelete && !input.remote) {
+    return { exitCode: ExitCode.USAGE, result: err("USAGE", { message: "--remote-delete requires --remote" }) };
+  }
+  if (input.remoteDelete && !isValidRemoteDeleteCap(input.maxRemoteDeletes)) {
+    return { exitCode: ExitCode.USAGE, result: err("USAGE", { message: "--max-remote-deletes must be a positive integer" }) };
+  }
+  const scan = await scanVault(input.vault);
+  if (!scan.ok) return { exitCode: ExitCode.VAULT_PATH_INVALID, result: scan };
+  const lookup = (pages) => {
+    if (input.page.includes("/")) return pages.find((p) => p.relPath === input.page)?.relPath;
+    return pages.find((p) => p.relPath.replace(/\.md$/, "").split("/").pop() === input.page)?.relPath;
+  };
+  let relPath = lookup(scan.data.typedKnowledge) ?? lookup(scan.data.raw) ?? null;
+  if (!relPath) {
+    try {
+      const candidate = normalizeVaultRelPath(input.page);
+      if (await pathExists(join10(input.vault, candidate))) {
+        relPath = candidate;
+      }
+    } catch {
+    }
+  }
+  if (!relPath) {
+    return {
+      exitCode: ExitCode.FILE_NOT_FOUND,
+      result: err("FILE_NOT_FOUND", { page: input.page })
+    };
+  }
+  if (relPath.startsWith("_archive/")) {
+    return {
+      exitCode: ExitCode.USAGE,
+      result: err("USAGE", { message: "refusing to remove path already under _archive/; use restore or leave archived" })
+    };
+  }
+  const remoteRoot = normalizeRemoteRoot(input.remote);
+  const remoteObjectPath = buildRemoteObjectPath(remoteRoot, relPath);
+  const slug = relPath.replace(/\.md$/, "").split("/").pop() ?? relPath;
+  let indexUpdated = false;
+  if (relPath.endsWith(".md") && !relPath.startsWith("raw/")) {
+    const indexPath = join10(input.vault, "index.md");
+    try {
+      const idx = await readFile7(indexPath, "utf8");
+      const originalLines = idx.split("\n");
+      const filtered = originalLines.filter((l) => !l.includes(`[[${slug}]]`));
+      if (filtered.length !== originalLines.length) {
+        await writeFile6(indexPath, filtered.join("\n"), "utf8");
+        indexUpdated = true;
+      }
+    } catch (e) {
+      if (e instanceof Error && "code" in e && e.code !== "ENOENT") throw e;
+    }
+  }
+  const intent = buildDeleteIntent({
+    path: relPath,
+    action: "remove",
+    actor: "skillwiki-cli",
+    source: "cli",
+    reason: input.reason
+  });
+  const tombstonePath = await writeDeleteIntent(input.vault, intent);
+  await unlink2(join10(input.vault, relPath));
+  appendLastOp(input.vault, {
+    operation: "remove",
+    summary: `removed ${relPath} (tombstone ${tombstonePath})`,
+    files: [relPath, tombstonePath],
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  let remote;
+  if (remoteObjectPath) {
+    const pruned = await planAndMaybePruneRemoteObjects([remoteObjectPath], input);
+    if (!pruned.ok) {
+      return { exitCode: ExitCode.SYNC_PUSH_FAILED, result: pruned };
+    }
+    remote = pruned.data;
+  }
+  const remoteNote = remote ? ` (remote ${input.remoteDelete ? `deleted ${remote.deleted.length}` : `planned ${remote.plannedDeletes.length}`})` : "";
+  return {
+    exitCode: ExitCode.OK,
+    result: ok({
+      removed: relPath,
+      tombstone_path: tombstonePath,
+      index_updated: indexUpdated,
+      ...remote ? { remote } : {},
+      humanHint: `removed ${relPath}; tombstone ${tombstonePath}${indexUpdated ? " (index updated)" : ""}${remoteNote}`
+    })
+  };
+}
+
 // src/commands/drift.ts
 import { createHash as createHash2 } from "crypto";
 
@@ -2023,7 +2086,7 @@ async function runUpdate(input) {
 
 // src/commands/self-update.ts
 import { execSync as execSync2 } from "child_process";
-import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
 import { join as join12 } from "path";
 var DEFAULT_SOURCE_ROOT_SUFFIX = "/Desktop/code/llm-wiki";
 async function runSelfUpdate(input) {
@@ -2031,7 +2094,7 @@ async function runSelfUpdate(input) {
   const sourceRoot = input.sourceRoot ?? `${input.home}${DEFAULT_SOURCE_ROOT_SUFFIX}`;
   const distTag = normalizeDistTag(input.distTag);
   const localPkgPath = join12(sourceRoot, "packages", "cli", "package.json");
-  const hasLocalSource = existsSync4(localPkgPath);
+  const hasLocalSource = existsSync3(localPkgPath);
   if (input.check) {
     let availableVersion = null;
     let source;
@@ -2162,13 +2225,13 @@ async function runSelfUpdate(input) {
 }
 
 // src/commands/transcripts.ts
-import { readdir as readdir3, stat as stat4, readFile as readFile7 } from "fs/promises";
+import { readdir as readdir4, stat as stat3, readFile as readFile8 } from "fs/promises";
 import { join as join13 } from "path";
 async function runTranscripts(input) {
   const dir = join13(input.vault, "raw", "transcripts");
   let entries;
   try {
-    entries = await readdir3(dir, { withFileTypes: true });
+    entries = await readdir4(dir, { withFileTypes: true });
   } catch {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: { ok: false, error: "VAULT_PATH_INVALID", detail: `raw/transcripts/ not found: ${dir}` } };
   }
@@ -2176,12 +2239,12 @@ async function runTranscripts(input) {
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
     const filePath = join13(dir, entry.name);
-    const content = await readFile7(filePath, "utf8");
+    const content = await readFile8(filePath, "utf8");
     const fm = extractFrontmatter(content);
     if (!fm.ok) continue;
     const ingested = typeof fm.data.ingested === "string" ? fm.data.ingested : "";
     if (input.since && ingested && ingested < input.since) continue;
-    const s = await stat4(filePath);
+    const s = await stat3(filePath);
     transcripts.push({
       file: `raw/transcripts/${entry.name}`,
       ingested,
@@ -2193,10 +2256,10 @@ async function runTranscripts(input) {
 }
 
 // src/commands/compound.ts
-import { writeFile as writeFile6, mkdir as mkdir6, readdir as readdir4, unlink as unlink2 } from "fs/promises";
+import { writeFile as writeFile7, mkdir as mkdir7, readdir as readdir5, unlink as unlink3 } from "fs/promises";
 import { join as join14 } from "path";
-import { existsSync as existsSync5 } from "fs";
-import { readFile as readFile8 } from "fs/promises";
+import { existsSync as existsSync4 } from "fs";
+import { readFile as readFile9 } from "fs/promises";
 var RETRO_HEADING_RE = /^## \[(\d{4}-\d{2}-\d{2})(?:\s+[^\]]+)?\] retro \| loop cycle(?: (\d+))?: (.+)$/;
 var FIELD_RE = {
   improve: /^-\s+\*?\*?Improve:?\*?\*?\s*(.+)$/m,
@@ -2297,7 +2360,7 @@ async function runCompound(input) {
   const logPath = join14(input.vault, "log.md");
   let logText;
   try {
-    logText = await readFile8(logPath, "utf8");
+    logText = await readFile9(logPath, "utf8");
   } catch {
     return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: logPath }) };
   }
@@ -2313,7 +2376,7 @@ async function runCompound(input) {
     }
     const slug = slugify(entry.cycleName);
     const compoundPath = join14(compoundDir, `${slug}.md`);
-    if (existsSync5(compoundPath)) {
+    if (existsSync4(compoundPath)) {
       skipped.push(entry.date);
       continue;
     }
@@ -2351,10 +2414,10 @@ async function runCompound(input) {
     ].join("\n");
     const content = frontmatter + "\n" + body;
     if (!input.dryRun) {
-      if (!existsSync5(compoundDir)) {
-        await mkdir6(compoundDir, { recursive: true });
+      if (!existsSync4(compoundDir)) {
+        await mkdir7(compoundDir, { recursive: true });
       }
-      await writeFile6(compoundPath, content, "utf8");
+      await writeFile7(compoundPath, content, "utf8");
     }
     promoted.push(`${slug}.md`);
   }
@@ -2374,7 +2437,7 @@ async function runCompound(input) {
 }
 async function runCompoundDelete(input) {
   const projectDir = join14(input.vault, "projects", input.project);
-  if (!existsSync5(projectDir)) {
+  if (!existsSync4(projectDir)) {
     return {
       exitCode: ExitCode.PROJECT_NOT_FOUND,
       result: err("PROJECT_NOT_FOUND", { slug: input.project, path: projectDir })
@@ -2382,14 +2445,14 @@ async function runCompoundDelete(input) {
   }
   const entryName = input.entry.replace(/\.md$/, "");
   const compoundPath = join14(projectDir, "compound", `${entryName}.md`);
-  if (!existsSync5(compoundPath)) {
+  if (!existsSync4(compoundPath)) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
       result: err("FILE_NOT_FOUND", { path: compoundPath })
     };
   }
   try {
-    await unlink2(compoundPath);
+    await unlink3(compoundPath);
   } catch (e) {
     return {
       exitCode: ExitCode.WRITE_FAILED,
@@ -2416,7 +2479,7 @@ knowledge.md regenerated`
 }
 async function runCompoundList(input) {
   const compoundDir = join14(input.vault, "projects", input.project, "compound");
-  if (!existsSync5(compoundDir)) {
+  if (!existsSync4(compoundDir)) {
     return {
       exitCode: ExitCode.OK,
       result: ok({
@@ -2430,7 +2493,7 @@ no compound directory found`
   }
   let dirents;
   try {
-    dirents = await readdir4(compoundDir, { withFileTypes: true });
+    dirents = await readdir5(compoundDir, { withFileTypes: true });
   } catch {
     return {
       exitCode: ExitCode.OK,
@@ -2449,7 +2512,7 @@ could not read compound directory`
     const filePath = join14(compoundDir, dirent.name);
     let text;
     try {
-      text = await readFile8(filePath, "utf8");
+      text = await readFile9(filePath, "utf8");
     } catch {
       continue;
     }
@@ -2478,7 +2541,7 @@ no compound entries found`;
 }
 
 // src/commands/session-brief.ts
-import { mkdir as mkdir7, readFile as readFile9, writeFile as writeFile7 } from "fs/promises";
+import { mkdir as mkdir8, readFile as readFile10, writeFile as writeFile8 } from "fs/promises";
 import { join as join15, relative, sep } from "path";
 var MAX_WORDS = 900;
 async function runSessionBrief(input) {
@@ -2588,7 +2651,7 @@ async function resolveProject(input) {
 async function readProjectSlug(file) {
   let text;
   try {
-    text = await readFile9(file, "utf8");
+    text = await readFile10(file, "utf8");
   } catch {
     return void 0;
   }
@@ -2815,15 +2878,15 @@ async function writeBriefArtifacts(vault, input) {
   const metaPath = join15(vault, "meta", "latest-session-brief.md");
   const cacheMdPath = join15(vault, ".skillwiki", "session-brief.md");
   const cacheJsonPath = join15(vault, ".skillwiki", "session-brief.json");
-  await mkdir7(join15(vault, "meta"), { recursive: true });
-  await mkdir7(join15(vault, ".skillwiki"), { recursive: true });
+  await mkdir8(join15(vault, "meta"), { recursive: true });
+  await mkdir8(join15(vault, ".skillwiki"), { recursive: true });
   const committed = renderCommittedBrief(input);
   const previousComparable = comparableBrief(await readIfExists(metaPath));
   const nextComparable = comparableBrief(committed);
   const materialChange = previousComparable !== nextComparable;
-  await writeFile7(metaPath, committed, "utf8");
-  await writeFile7(cacheMdPath, input.brief, "utf8");
-  await writeFile7(cacheJsonPath, `${JSON.stringify({
+  await writeFile8(metaPath, committed, "utf8");
+  await writeFile8(cacheMdPath, input.brief, "utf8");
+  await writeFile8(cacheJsonPath, `${JSON.stringify({
     project: input.project,
     brief: input.brief,
     word_count: input.wordCount,
@@ -2892,7 +2955,7 @@ async function ensureIndexEntry(vault) {
     while (insertAt < lines.length && !lines[insertAt].startsWith("## ")) insertAt++;
     lines.splice(insertAt, 0, entry);
   }
-  await writeFile7(indexPath, lines.join("\n"), "utf8");
+  await writeFile8(indexPath, lines.join("\n"), "utf8");
   return true;
 }
 async function appendMaterialLog(vault, today) {
@@ -2901,12 +2964,12 @@ async function appendMaterialLog(vault, today) {
   if (!text) return false;
   const entry = `
 ## [${today}] session-brief | refreshed: meta/latest-session-brief.md`;
-  await writeFile7(logPath, text.trimEnd() + entry + "\n", "utf8");
+  await writeFile8(logPath, text.trimEnd() + entry + "\n", "utf8");
   return true;
 }
 async function readIfExists(path) {
   try {
-    return await readFile9(path, "utf8");
+    return await readFile10(path, "utf8");
   } catch {
     return "";
   }
@@ -2948,9 +3011,419 @@ function dateFromPath(path) {
 }
 
 // src/commands/ingest.ts
-import { readFile as readFile10, writeFile as writeFile8, mkdir as mkdir8 } from "fs/promises";
-import { join as join16 } from "path";
+import { readFile as readFile12, open, unlink as unlink4, mkdir as mkdir9 } from "fs/promises";
+import { join as join17 } from "path";
+import { createHash as createHash4 } from "crypto";
+
+// src/commands/page-publish.ts
 import { createHash as createHash3 } from "crypto";
+import { realpathSync } from "fs";
+import { readFile as readFile11 } from "fs/promises";
+import { join as join16, resolve as resolve3 } from "path";
+var DEFAULT_DEPS = { afterStage: async () => void 0 };
+function errorExitCode(error) {
+  switch (error) {
+    case "FILE_NOT_FOUND":
+      return ExitCode.FILE_NOT_FOUND;
+    case "MISSING_CLOSING_DELIMITER":
+      return ExitCode.MISSING_CLOSING_DELIMITER;
+    case "SCHEME_REJECTED":
+    case "NO_TAXONOMY_BLOCK":
+      return ExitCode.SCHEME_REJECTED;
+    case "VAULT_PATH_INVALID":
+      return ExitCode.VAULT_PATH_INVALID;
+    case "SENSITIVE_CONTENT_DETECTED":
+      return ExitCode.SENSITIVE_CONTENT_DETECTED;
+    case "SYNC_LOCK_HELD":
+      return ExitCode.SYNC_LOCK_HELD;
+    case "WRITE_FAILED":
+      return ExitCode.WRITE_FAILED;
+    default:
+      return ExitCode.INVALID_FRONTMATTER;
+  }
+}
+function publicationId(target, content, logNote = "") {
+  return createHash3("sha256").update("skillwiki-page-publish-v1\0").update(target).update("\0").update(content).update("\0").update(logNote).digest("hex");
+}
+function prepareFrozenPublication(input, source) {
+  const target = assertTargetInsideVault(input.vault, input.target);
+  if (!target.ok) return target;
+  const page = prepareTypedPage(input.content, input.target);
+  if (!page.ok) return page;
+  if (input.logNote !== void 0 && /[\r\n]/.test(input.logNote)) {
+    return err("SCHEME_REJECTED", { message: "log note must be one line" });
+  }
+  const logNote = input.logNote?.trim() || void 0;
+  if (logNote && Buffer.byteLength(logNote, "utf8") > 500) {
+    return err("SCHEME_REJECTED", { message: "log note must be one line and at most 500 UTF-8 bytes" });
+  }
+  if (logNote && scanSensitiveContent(logNote, { file: "page-publish log note" }).length > 0) {
+    return err("SENSITIVE_CONTENT_DETECTED", { message: "log note contains sensitive authentication material" });
+  }
+  const date = (input.now ?? /* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  const taxonomyComment = taxonomyCommentForPage(input.target, date);
+  if (!taxonomyComment.ok) return taxonomyComment;
+  return ok({
+    page: page.data,
+    source,
+    targetPath: target.data.absolutePath,
+    logNote,
+    operationId: publicationId(input.target, input.content, logNote),
+    date,
+    taxonomyComment: taxonomyComment.data
+  });
+}
+function preparePagePublicationFromContent(input) {
+  return prepareFrozenPublication(input, { kind: "content" });
+}
+async function preparePagePublication(input) {
+  let content;
+  try {
+    content = await readFile11(input.draftPath, "utf8");
+  } catch (error) {
+    return err("FILE_NOT_FOUND", { path: input.draftPath, message: String(error) });
+  }
+  let draftRealPath;
+  try {
+    draftRealPath = realpathSync(input.draftPath);
+  } catch (error) {
+    return err("VAULT_PATH_INVALID", {
+      path: input.draftPath,
+      message: `draft realpath failed: ${String(error)}`
+    });
+  }
+  const target = assertTargetInsideVault(input.vault, input.target);
+  if (!target.ok) return target;
+  if (resolve3(input.draftPath) === target.data.absolutePath || target.data.existingRealPath !== void 0 && draftRealPath === target.data.existingRealPath) {
+    return err("VAULT_PATH_INVALID", { message: "draft must not alias the final target" });
+  }
+  return prepareFrozenPublication(
+    {
+      vault: input.vault,
+      content,
+      target: input.target,
+      logNote: input.logNote,
+      now: input.now
+    },
+    { kind: "file", realPath: draftRealPath }
+  );
+}
+function emptyLockedState() {
+  return {
+    taxonomyAdded: [],
+    pageChanged: false,
+    indexUpdated: false,
+    published: false,
+    changed: /* @__PURE__ */ new Set()
+  };
+}
+function lockedFailure(stage, state, cause, exitCode = ExitCode.WRITE_FAILED) {
+  return { ok: false, exitCode, stage, state, cause };
+}
+async function observeStage(deps, stage) {
+  try {
+    await deps.afterStage(stage);
+    return void 0;
+  } catch (error) {
+    return err("WRITE_FAILED", { message: `stage hook failed at ${stage}: ${String(error)}` });
+  }
+}
+async function runLockedPrimaryStages(input, vault, deps) {
+  const state = emptyLockedState();
+  const freshTarget = assertTargetInsideVault(vault, input.page.target);
+  if (!freshTarget.ok) {
+    return lockedFailure("target", state, freshTarget, ExitCode.VAULT_PATH_INVALID);
+  }
+  if (freshTarget.data.absolutePath !== input.targetPath) {
+    return lockedFailure(
+      "target",
+      state,
+      err("VAULT_PATH_INVALID", { message: "target canonical path changed after preparation" }),
+      ExitCode.VAULT_PATH_INVALID
+    );
+  }
+  if (input.source.kind === "file" && freshTarget.data.existingRealPath !== void 0 && freshTarget.data.existingRealPath === input.source.realPath) {
+    return lockedFailure(
+      "target",
+      state,
+      err("VAULT_PATH_INVALID", { message: "draft now aliases the final target" }),
+      ExitCode.VAULT_PATH_INVALID
+    );
+  }
+  const schemaPath = join16(vault, "SCHEMA.md");
+  let schemaText;
+  try {
+    schemaText = await readFile11(schemaPath, "utf8");
+  } catch (error) {
+    return lockedFailure("schema", state, err("WRITE_FAILED", { message: String(error) }));
+  }
+  const reconciled = reconcileTaxonomyDocument(schemaText, {
+    tags: input.page.tags,
+    comment: input.taxonomyComment
+  });
+  if (!reconciled.ok) {
+    return lockedFailure("schema", state, reconciled, errorExitCode(reconciled.error));
+  }
+  state.taxonomyAdded = reconciled.data.added;
+  if (reconciled.data.changed) {
+    const schemaWrite = await atomicWriteText(schemaPath, reconciled.data.text);
+    if (!schemaWrite.ok) return lockedFailure("schema", state, schemaWrite);
+    if (schemaWrite.data.changed) state.changed.add("SCHEMA.md");
+  }
+  const schemaHook = await observeStage(deps, "schema");
+  if (schemaHook) return lockedFailure("schema", state, schemaHook);
+  const pageWrite = await safeWritePage(input.targetPath, input.page.content);
+  if (!pageWrite.ok) return lockedFailure("page", state, pageWrite);
+  state.pageChanged = pageWrite.data.changed;
+  if (state.pageChanged) state.changed.add(input.page.target);
+  state.published = true;
+  const pageHook = await observeStage(deps, "page");
+  if (pageHook) return lockedFailure("page", state, pageHook);
+  let visible;
+  let visibleSchema;
+  try {
+    [visible, visibleSchema] = await Promise.all([
+      readFile11(input.targetPath, "utf8"),
+      readFile11(schemaPath, "utf8")
+    ]);
+  } catch (error) {
+    return lockedFailure("verify", state, err("WRITE_FAILED", { message: String(error) }));
+  }
+  const visiblePage = prepareTypedPage(visible, input.page.target);
+  const visibleTaxonomy = extractTaxonomy(visibleSchema);
+  if (!visiblePage.ok || visible !== input.page.content || !visibleTaxonomy.ok || input.page.tags.some((tag) => !visibleTaxonomy.data.includes(tag))) {
+    return lockedFailure(
+      "verify",
+      state,
+      err("WRITE_FAILED", { message: "published bytes or taxonomy verification failed" })
+    );
+  }
+  const verifyHook = await observeStage(deps, "verify");
+  if (verifyHook) return lockedFailure("verify", state, verifyHook);
+  const index = await upsertIndexEntry({
+    vault,
+    target: input.page.target,
+    title: input.page.title,
+    type: input.page.type
+  });
+  if (!index.ok) return lockedFailure("index", state, index);
+  state.indexUpdated = index.data.changed;
+  if (state.indexUpdated) state.changed.add("index.md");
+  const indexHook = await observeStage(deps, "index");
+  if (indexHook) return lockedFailure("index", state, indexHook);
+  return { ok: true, data: state };
+}
+function redactDetail(detail) {
+  if (detail === void 0) return void 0;
+  try {
+    const encoded = JSON.stringify(detail);
+    return JSON.parse(redactSensitiveContent(encoded).text);
+  } catch {
+    return { message: "unserializable error detail omitted" };
+  }
+}
+function phaseFailure(stage, input, published, cause, context = {}, exitCode = ExitCode.WRITE_FAILED) {
+  return {
+    exitCode,
+    result: err("WRITE_FAILED", {
+      ...context,
+      stage,
+      published,
+      target: input.page.target,
+      operation_id: input.operationId,
+      retry_safe: stage !== "target",
+      cause_error: cause.error,
+      cause_detail: redactDetail(cause.detail)
+    })
+  };
+}
+function successReceipt(input, taxonomyAdded, pageChanged, indexUpdated, logAppended, filesChanged, dryRun = false) {
+  return {
+    exitCode: ExitCode.OK,
+    result: ok({
+      target: input.page.target,
+      page_type: input.page.type,
+      tags: [...input.page.tags],
+      taxonomy_added: [...taxonomyAdded],
+      page_changed: pageChanged,
+      index_updated: indexUpdated,
+      log_appended: logAppended,
+      operation_id: input.operationId,
+      dry_run: dryRun,
+      files_changed: filesChanged,
+      humanHint: dryRun ? `dry run: would publish ${input.page.target} (${input.operationId.slice(0, 12)})` : `published ${input.page.target} (${input.operationId.slice(0, 12)})`
+    })
+  };
+}
+function renderPublicationLog(input, added) {
+  return [
+    `## [${input.date}] page-publish | ${input.page.target}`,
+    "",
+    `- Published: [[${input.page.target.replace(/\.md$/, "")}]]`,
+    `- Taxonomy: ${added.length > 0 ? `added ${added.join(", ")}` : "no additions"}`,
+    ...input.logNote ? [`- Note: ${input.logNote}`] : []
+  ].join("\n");
+}
+async function readPageChanged(targetPath, content) {
+  try {
+    return ok(await readFile11(targetPath, "utf8") !== content);
+  } catch (error) {
+    if (error.code === "ENOENT") return ok(true);
+    return err("WRITE_FAILED", { path: targetPath, message: String(error) });
+  }
+}
+async function previewPreparedPagePublication(input, vault) {
+  const schemaPath = join16(vault, "SCHEMA.md");
+  let schemaText;
+  try {
+    schemaText = await readFile11(schemaPath, "utf8");
+  } catch (error) {
+    const result = err("FILE_NOT_FOUND", { path: schemaPath, message: String(error) });
+    return { exitCode: ExitCode.FILE_NOT_FOUND, result };
+  }
+  const reconciled = reconcileTaxonomyDocument(schemaText, {
+    tags: input.page.tags,
+    comment: input.taxonomyComment
+  });
+  if (!reconciled.ok) return { exitCode: errorExitCode(reconciled.error), result: reconciled };
+  const pageChanged = await readPageChanged(input.targetPath, input.page.content);
+  if (!pageChanged.ok) return { exitCode: errorExitCode(pageChanged.error), result: pageChanged };
+  const indexPath = join16(vault, "index.md");
+  let indexText;
+  try {
+    indexText = await readFile11(indexPath, "utf8");
+  } catch (error) {
+    const result = err("FILE_NOT_FOUND", { path: indexPath, message: String(error) });
+    return { exitCode: ExitCode.FILE_NOT_FOUND, result };
+  }
+  const index = renderIndexUpsert(indexText, {
+    target: input.page.target,
+    title: input.page.title,
+    type: input.page.type
+  });
+  if (!index.ok) return { exitCode: errorExitCode(index.error), result: index };
+  const logPath = join16(vault, "log.md");
+  let logText;
+  try {
+    logText = await readFile11(logPath, "utf8");
+  } catch (error) {
+    const result = err("FILE_NOT_FOUND", { path: logPath, message: String(error) });
+    return { exitCode: ExitCode.FILE_NOT_FOUND, result };
+  }
+  const logAppended = !logText.includes(`<!-- skillwiki-page-publish:${input.operationId} -->`);
+  const filesChanged = [
+    ...reconciled.data.changed ? ["SCHEMA.md"] : [],
+    ...pageChanged.data ? [input.page.target] : [],
+    ...index.data.changed ? ["index.md"] : [],
+    ...logAppended ? ["log.md"] : []
+  ];
+  return successReceipt(
+    input,
+    reconciled.data.added,
+    pageChanged.data,
+    index.data.changed,
+    logAppended,
+    filesChanged,
+    true
+  );
+}
+async function publishPreparedPage(input, vault, deps = DEFAULT_DEPS) {
+  let lock;
+  try {
+    lock = acquireOwnedSyncLock(vault, {
+      summary: `page publish ${input.page.target}`,
+      ttlMinutes: 1
+    });
+  } catch (error) {
+    return {
+      exitCode: ExitCode.WRITE_FAILED,
+      result: err("WRITE_FAILED", { stage: "lock", message: String(error) })
+    };
+  }
+  if (!lock.ok) return { exitCode: errorExitCode(lock.error), result: lock };
+  let primary;
+  let released;
+  try {
+    primary = await runLockedPrimaryStages(input, vault, deps);
+  } catch (error) {
+    primary = lockedFailure(
+      "schema",
+      emptyLockedState(),
+      err("WRITE_FAILED", { message: `unexpected primary-stage failure: ${String(error)}` })
+    );
+  } finally {
+    released = releaseOwnedSyncLock(lock.data);
+  }
+  const primaryState = primary?.ok ? primary.data : primary?.state;
+  if (released === void 0 || !released.ok || !released.data.released) {
+    return phaseFailure(
+      "unlock",
+      input,
+      primaryState?.published ?? false,
+      released && !released.ok ? released : err("WRITE_FAILED", { message: "lock release did not run" }),
+      {
+        primary_stage: primary && !primary.ok ? primary.stage : "complete",
+        primary_error: primary && !primary.ok ? primary.cause.error : void 0
+      }
+    );
+  }
+  const unlockHook = await observeStage(deps, "unlock");
+  if (unlockHook) return phaseFailure("unlock", input, primaryState?.published ?? false, unlockHook);
+  if (primary === void 0) {
+    return phaseFailure(
+      "schema",
+      input,
+      false,
+      err("WRITE_FAILED", { message: "locked publication produced no result" })
+    );
+  }
+  if (!primary.ok) {
+    return phaseFailure(
+      primary.stage,
+      input,
+      primary.state.published,
+      primary.cause,
+      void 0,
+      primary.exitCode
+    );
+  }
+  const state = primary.data;
+  const log = await runLogAppend({
+    vault,
+    content: renderPublicationLog(input, state.taxonomyAdded),
+    operationId: input.operationId,
+    strictLock: true,
+    recordLastOp: false
+  });
+  if (!log.result.ok) return phaseFailure("log", input, true, log.result);
+  if (log.exitCode !== ExitCode.OK) {
+    return phaseFailure(
+      "log",
+      input,
+      true,
+      err("WRITE_FAILED", { message: "log append returned inconsistent success state" })
+    );
+  }
+  if (log.result.data.appended) state.changed.add("log.md");
+  const logHook = await observeStage(deps, "log");
+  if (logHook) return phaseFailure("log", input, true, logHook);
+  return successReceipt(
+    input,
+    state.taxonomyAdded,
+    state.pageChanged,
+    state.indexUpdated,
+    log.result.data.appended,
+    [...state.changed]
+  );
+}
+async function runPagePublish(input, deps = DEFAULT_DEPS) {
+  const prepared = await preparePagePublication(input);
+  if (!prepared.ok) return { exitCode: errorExitCode(prepared.error), result: prepared };
+  if (!input.write) return previewPreparedPagePublication(prepared.data, input.vault);
+  return publishPreparedPage(prepared.data, input.vault, deps);
+}
+
+// src/commands/ingest.ts
 var ALLOWED_TYPES = /* @__PURE__ */ new Set(["entity", "concept", "comparison", "query"]);
 var TYPE_DIR = {
   entity: "entities",
@@ -2991,19 +3464,6 @@ function buildTypedContent(title, ingested, type, tags, rawRelPath, provenance)
   const aliases = [];
   const sourcesYaml = `  - ${rawRelPath}`;
   const tagsYaml = tags.length > 0 ? tags.map((t) => `  - ${t}`).join("\n") : "  []";
-  const fm = {
-    title,
-    aliases,
-    created: ingested,
-    updated: ingested,
-    type,
-    tags,
-    sources: [rawRelPath],
-    confidence: "medium"
-  };
-  if (provenance) {
-    fm.provenance = provenance;
-  }
   const fmLines = ["---"];
   fmLines.push(`title: "${title}"`);
   if (aliases.length > 0) {
@@ -3039,6 +3499,78 @@ function buildTypedContent(title, ingested, type, tags, rawRelPath, provenance)
   ].join("\n");
   return fmLines.join("\n") + body;
 }
+async function resolveRawCapture(input) {
+  try {
+    const existing = await readFile12(input.path, "utf8");
+    const frontmatter = extractFrontmatter(existing);
+    if (!frontmatter.ok) {
+      return err("INGEST_VALIDATION_FAILED", {
+        path: input.path,
+        message: "existing immutable raw source has invalid frontmatter",
+        source_error: frontmatter.error
+      });
+    }
+    const parsed = RawSourceSchema.safeParse(frontmatter.data);
+    if (!parsed.success || parsed.data.sha256 !== input.sha256 || (parsed.data.source_url ?? null) !== input.sourceUrl || existing !== buildRawContent(
+      input.sourceUrl,
+      String(parsed.data.ingested),
+      input.sha256,
+      input.sourceContent
+    )) {
+      return err("INGEST_VALIDATION_FAILED", {
+        path: input.path,
+        message: "existing immutable raw source differs from the fetched source"
+      });
+    }
+    return ok({
+      content: existing,
+      ingested: String(parsed.data.ingested),
+      shouldWrite: false
+    });
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      return err("WRITE_FAILED", { path: input.path, message: String(error) });
+    }
+  }
+  return ok({
+    content: buildRawContent(input.sourceUrl, input.today, input.sha256, input.sourceContent),
+    ingested: input.today,
+    shouldWrite: true
+  });
+}
+async function writeResolvedRaw(input) {
+  if (!input.capture.shouldWrite) return ok({ changed: false, capture: input.capture });
+  const lock = await acquireRawCaptureLock(input.path);
+  if (!lock.ok) return lock;
+  try {
+    const resolved = await resolveRawCapture(input);
+    if (!resolved.ok) return resolved;
+    if (!resolved.data.shouldWrite) return ok({ changed: false, capture: resolved.data });
+    const written = await atomicWriteText(input.path, resolved.data.content);
+    return written.ok ? ok({ changed: written.data.changed, capture: resolved.data }) : written;
+  } finally {
+    try {
+      await unlink4(lock.data);
+    } catch {
+    }
+  }
+}
+async function acquireRawCaptureLock(path) {
+  const lockPath = `${path}.ingest.lock`;
+  for (let attempt = 0; attempt < 200; attempt++) {
+    try {
+      const handle = await open(lockPath, "wx");
+      await handle.close();
+      return ok(lockPath);
+    } catch (error) {
+      if (error.code !== "EEXIST") {
+        return err("WRITE_FAILED", { path: lockPath, phase: "raw-lock", message: String(error) });
+      }
+      await new Promise((resolve4) => setTimeout(resolve4, 10));
+    }
+  }
+  return err("WRITE_FAILED", { path: lockPath, phase: "raw-lock", message: "raw capture lock held" });
+}
 async function runIngest(input) {
   if (!input.source || input.source.trim().length === 0) {
     return {
@@ -3108,7 +3640,7 @@ async function runIngest(input) {
     sourceContent = fetchResult.data.body;
   } else {
     try {
-      sourceContent = await readFile10(input.source, "utf8");
+      sourceContent = await readFile12(input.source, "utf8");
     } catch {
       return {
         exitCode: ExitCode.FILE_NOT_FOUND,
@@ -3126,15 +3658,14 @@ async function runIngest(input) {
       })
     };
   }
-  const sha256 = createHash3("sha256").update(Buffer.from(sourceContent, "utf8")).digest("hex");
+  const sha256 = createHash4("sha256").update(Buffer.from(sourceContent, "utf8")).digest("hex");
   const today = todayIso();
   const slug = slugify2(input.title);
   const tags = input.tags && input.tags.length > 0 ? input.tags : [];
   const rawRelPath = `raw/articles/${slug}.md`;
   const typedDir = TYPE_DIR[input.type] ?? `${input.type}s`;
   const typedRelPath = `${typedDir}/${slug}.md`;
-  const rawAbsPath = join16(input.vault, rawRelPath);
-  const typedAbsPath = join16(input.vault, typedRelPath);
+  const rawAbsPath = join17(input.vault, rawRelPath);
   const identity = assessSourceIdentity({
     rawPath: rawRelPath,
     sourceUrl: sourceUrl ?? void 0,
@@ -3154,16 +3685,62 @@ async function runIngest(input) {
       })
     };
   }
-  const rawContent = buildRawContent(sourceUrl, today, sha256, sourceContent);
-  const typedContent = buildTypedContent(
+  const resolvedRaw = await resolveRawCapture({
+    path: rawAbsPath,
+    sourceUrl,
+    sourceContent,
+    sha256,
+    today
+  });
+  if (!resolvedRaw.ok) {
+    return {
+      exitCode: resolvedRaw.error === "INGEST_VALIDATION_FAILED" ? ExitCode.INGEST_VALIDATION_FAILED : ExitCode.WRITE_FAILED,
+      result: resolvedRaw
+    };
+  }
+  let publicationDate = resolvedRaw.data.ingested;
+  let typedContent = buildTypedContent(
     input.title,
-    today,
+    publicationDate,
     input.type,
     tags,
     rawRelPath,
     input.provenance
   );
+  if (!input.dryRun) {
+    try {
+      await mkdir9(join17(input.vault, typedDir), { recursive: true });
+    } catch (error) {
+      return {
+        exitCode: ExitCode.WRITE_FAILED,
+        result: err("WRITE_FAILED", { path: join17(input.vault, typedDir), message: String(error) })
+      };
+    }
+  }
+  let publication = preparePagePublicationFromContent({
+    vault: input.vault,
+    content: typedContent,
+    target: typedRelPath,
+    logNote: `ingested from ${rawRelPath}`,
+    now: /* @__PURE__ */ new Date(`${publicationDate}T00:00:00Z`)
+  });
+  if (!publication.ok) {
+    return {
+      exitCode: ExitCode.INGEST_VALIDATION_FAILED,
+      result: publication
+    };
+  }
   if (input.dryRun) {
+    const preview = await previewPreparedPagePublication(publication.data, input.vault);
+    if (!preview.result.ok) {
+      return { exitCode: preview.exitCode, result: preview.result };
+    }
+    if (preview.exitCode !== ExitCode.OK) {
+      return {
+        exitCode: preview.exitCode,
+        result: err("WRITE_FAILED", { message: "publication preview returned inconsistent success state" })
+      };
+    }
     return {
       exitCode: ExitCode.OK,
       result: ok({
@@ -3172,78 +3749,84 @@ async function runIngest(input) {
         sha256,
         dry_run: true,
         humanHint: [
-          `DRY RUN \u2014 would create:`,
+          "DRY RUN \u2014 would create:",
           `  ${rawRelPath} (sha256: ${sha256.slice(0, 12)}...)`,
           `  ${typedRelPath}`,
           `  type: ${input.type}, tags: [${tags.join(", ")}]`,
           input.provenance ? `  provenance: ${input.provenance}` : ""
-        ].filter(Boolean).join("\n")
+        ].filter(Boolean).join("\n"),
+        publication: preview.result.data
       })
     };
   }
-  const typedFm = {
-    title: input.title,
-    aliases: [],
-    created: today,
-    updated: today,
-    type: input.type,
-    tags,
-    sources: [rawRelPath],
-    confidence: "medium",
-    ...input.provenance ? { provenance: input.provenance } : {}
-  };
-  const det = detectSchema(typedFm);
-  if (!det.schema) {
+  try {
+    await mkdir9(join17(input.vault, "raw", "articles"), { recursive: true });
+  } catch (error) {
     return {
-      exitCode: ExitCode.INGEST_VALIDATION_FAILED,
-      result: err("INGEST_VALIDATION_FAILED", {
-        message: "generated typed-knowledge page could not be detected as a valid schema"
-      })
+      exitCode: ExitCode.WRITE_FAILED,
+      result: err("WRITE_FAILED", { path: join17(input.vault, "raw", "articles"), message: String(error) })
     };
   }
-  const parsed = TypedKnowledgeSchema.safeParse(typedFm);
-  if (!parsed.success) {
-    const errors = parsed.error.issues.map((i) => ({
-      path: i.path.join("."),
-      message: i.message
-    }));
+  const rawWrite = await writeResolvedRaw({
+    path: rawAbsPath,
+    sourceUrl,
+    sourceContent,
+    sha256,
+    today,
+    capture: resolvedRaw.data
+  });
+  if (!rawWrite.ok) {
     return {
-      exitCode: ExitCode.INGEST_VALIDATION_FAILED,
-      result: err("INGEST_VALIDATION_FAILED", {
-        message: "generated typed-knowledge page failed schema validation",
-        errors
-      })
+      exitCode: rawWrite.error === "INGEST_VALIDATION_FAILED" ? ExitCode.INGEST_VALIDATION_FAILED : ExitCode.WRITE_FAILED,
+      result: rawWrite
     };
   }
-  try {
-    await mkdir8(join16(input.vault, "raw", "articles"), { recursive: true });
-    await writeFile8(rawAbsPath, rawContent, "utf8");
-  } catch (e) {
-    return {
-      exitCode: ExitCode.WRITE_FAILED,
-      result: err("WRITE_FAILED", { path: rawAbsPath, message: String(e) })
-    };
+  if (rawWrite.data.capture.ingested !== publicationDate) {
+    publicationDate = rawWrite.data.capture.ingested;
+    typedContent = buildTypedContent(
+      input.title,
+      publicationDate,
+      input.type,
+      tags,
+      rawRelPath,
+      input.provenance
+    );
+    publication = preparePagePublicationFromContent({
+      vault: input.vault,
+      content: typedContent,
+      target: typedRelPath,
+      logNote: `ingested from ${rawRelPath}`,
+      now: /* @__PURE__ */ new Date(`${publicationDate}T00:00:00Z`)
+    });
+    if (!publication.ok) {
+      return {
+        exitCode: ExitCode.INGEST_VALIDATION_FAILED,
+        result: publication
+      };
+    }
   }
-  try {
-    await mkdir8(join16(input.vault, typedDir), { recursive: true });
-    await writeFile8(typedAbsPath, typedContent, "utf8");
-  } catch (e) {
+  const published = await publishPreparedPage(publication.data, input.vault);
+  if (!published.result.ok) {
+    return { exitCode: published.exitCode, result: published.result };
+  }
+  if (published.exitCode !== ExitCode.OK) {
     return {
-      exitCode: ExitCode.WRITE_FAILED,
-      result: err("WRITE_FAILED", { path: typedAbsPath, message: String(e) })
+      exitCode: published.exitCode,
+      result: err("WRITE_FAILED", { message: "publisher returned inconsistent success state" })
     };
   }
-  const humanHint = [
-    `created:`,
-    `  ${rawRelPath} (sha256: ${sha256.slice(0, 12)}...)`,
-    `  ${typedRelPath}`
-  ].join("\n");
-  appendLastOp(input.vault, {
-    operation: "ingest",
-    summary: `added ${slug}`,
-    files: [rawRelPath, typedRelPath],
-    timestamp: (/* @__PURE__ */ new Date()).toISOString()
-  });
+  const changedFiles = [
+    ...rawWrite.data.changed ? [rawRelPath] : [],
+    ...published.result.data.files_changed
+  ];
+  if (changedFiles.length > 0) {
+    appendLastOp(input.vault, {
+      operation: "ingest",
+      summary: `added ${slug}`,
+      files: [...new Set(changedFiles)],
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  }
   return {
     exitCode: ExitCode.OK,
     result: ok({
@@ -3251,7 +3834,12 @@ async function runIngest(input) {
       typed_path: typedRelPath,
       sha256,
       dry_run: false,
-      humanHint
+      humanHint: [
+        "created:",
+        `  ${rawRelPath} (sha256: ${sha256.slice(0, 12)}...)`,
+        `  ${typedRelPath}`
+      ].join("\n"),
+      publication: published.result.data
     })
   };
 }
@@ -3403,138 +3991,216 @@ ${body}`;
   };
 }
 
-// src/commands/sync.ts
-import { existsSync as existsSync7 } from "fs";
-import { join as join18 } from "path";
-import { execFileSync as execFileSync2 } from "child_process";
-
-// src/utils/git.ts
-import { execFileSync } from "child_process";
-function git(cwd, args) {
-  try {
-    return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim();
-  } catch {
-    return "";
+// src/commands/tag-reconcile.ts
+import { readFile as readFile13 } from "fs/promises";
+import { join as join18, posix } from "path";
+var TYPED_TARGET_RE = /^(entities|concepts|comparisons|queries|meta)\/[a-z0-9][a-z0-9./_-]*\.md$/;
+function errorExitCode2(error) {
+  switch (error) {
+    case "FILE_NOT_FOUND":
+      return ExitCode.FILE_NOT_FOUND;
+    case "MISSING_CLOSING_DELIMITER":
+      return ExitCode.MISSING_CLOSING_DELIMITER;
+    case "SCHEME_REJECTED":
+      return ExitCode.SCHEME_REJECTED;
+    case "VAULT_PATH_INVALID":
+      return ExitCode.VAULT_PATH_INVALID;
+    case "WRITE_FAILED":
+      return ExitCode.WRITE_FAILED;
+    case "SYNC_LOCK_HELD":
+      return ExitCode.SYNC_LOCK_HELD;
+    default:
+      return ExitCode.INVALID_FRONTMATTER;
+  }
+}
+function validatePageIdentity(page) {
+  const segments = page.split("/");
+  if (page.length === 0 || posix.isAbsolute(page) || page.includes("\\") || posix.normalize(page) !== page || segments.some((segment) => segment === "" || segment === "." || segment === "..") || !TYPED_TARGET_RE.test(page)) {
+    return err("VAULT_PATH_INVALID", {
+      page,
+      message: "page must be a normalized vault-relative typed Markdown path"
+    });
   }
+  return ok(page);
 }
-function gitStrict(cwd, args) {
-  return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim();
-}
-
-// src/utils/sync-lock.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync4, renameSync as renameSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync3 } from "fs";
-import { join as join17 } from "path";
-import { createHash as createHash4 } from "crypto";
-function getEnvSessionId() {
-  if (process.env.CLAUDE_SESSION_ID) return process.env.CLAUDE_SESSION_ID;
-  if (process.env.SKILLWIKI_SESSION_ID) return process.env.SKILLWIKI_SESSION_ID;
-  return void 0;
-}
-function getSessionId() {
-  const envSessionId = getEnvSessionId();
-  if (envSessionId) return envSessionId;
-  return process.pid.toString();
-}
-function getCwdHash(cwd) {
-  const path = cwd || process.cwd();
-  const hash = createHash4("sha256").update(path).digest("hex");
-  return hash.slice(0, 8);
+function asTagArray(frontmatter, path) {
+  const tags = frontmatter.tags;
+  if (!Array.isArray(tags) || !tags.every((tag) => typeof tag === "string")) {
+    return err("INVALID_FRONTMATTER", {
+      path,
+      message: "frontmatter tags must be an array of strings"
+    });
+  }
+  return ok(tags);
 }
-function getCliSessionId(cwd) {
-  const envSessionId = getEnvSessionId();
-  if (envSessionId) return envSessionId;
-  return `cli-${getCwdHash(cwd)}`;
+async function readTagsFromFile(path) {
+  let text;
+  try {
+    text = await readFile13(path, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path }) };
+    }
+    return { exitCode: ExitCode.WRITE_FAILED, result: err("WRITE_FAILED", { path, message: String(error) }) };
+  }
+  const frontmatter = extractFrontmatter(text);
+  if (!frontmatter.ok) return { exitCode: errorExitCode2(frontmatter.error), result: frontmatter };
+  const tags = asTagArray(frontmatter.data, path);
+  if (!tags.ok) return { exitCode: ExitCode.INVALID_FRONTMATTER, result: tags };
+  return { exitCode: ExitCode.OK, result: tags };
 }
-function lockPath(vault) {
-  return join17(vault, ".skillwiki", "sync.lock");
+async function resolveRequestedTags(input, page) {
+  const explicit = input.tags ?? [];
+  if (!Array.isArray(explicit) || !explicit.every((tag) => typeof tag === "string")) {
+    return {
+      exitCode: ExitCode.INVALID_FRONTMATTER,
+      result: err("INVALID_FRONTMATTER", { message: "explicit tags must be an array of strings" })
+    };
+  }
+  const source = input.from ?? (explicit.length === 0 ? join18(input.vault, page) : void 0);
+  if (!source) return { exitCode: ExitCode.OK, result: ok({ tags: [...new Set(explicit)].sort() }) };
+  const sourced = await readTagsFromFile(source);
+  if (!sourced.result.ok) return { exitCode: sourced.exitCode, result: sourced.result };
+  return {
+    exitCode: ExitCode.OK,
+    result: ok({ tags: [.../* @__PURE__ */ new Set([...explicit, ...sourced.result.data])].sort() })
+  };
 }
-function readLock(vault) {
-  const path = lockPath(vault);
-  if (!existsSync6(path)) return null;
+async function readSchema(schemaPath) {
   try {
-    const raw = readFileSync4(path, "utf8");
-    return JSON.parse(raw);
-  } catch {
-    return null;
+    return { exitCode: ExitCode.OK, result: ok(await readFile13(schemaPath, "utf8")) };
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: schemaPath }) };
+    }
+    return { exitCode: ExitCode.WRITE_FAILED, result: err("WRITE_FAILED", { path: schemaPath, message: String(error) }) };
   }
 }
-function isStale(lock, now) {
-  const nowTime = (now ?? /* @__PURE__ */ new Date()).getTime();
-  const expiresTime = new Date(lock.expires).getTime();
-  return expiresTime < nowTime;
+function previewResult(page, tags, reconciled, dryRun, filesChanged) {
+  if (!reconciled.ok) return { exitCode: errorExitCode2(reconciled.error), result: reconciled };
+  const missingTags = reconciled.data.missing;
+  const addedTags = dryRun ? [] : reconciled.data.added;
+  const humanHint = dryRun ? missingTags.length > 0 ? `dry run: would add ${missingTags.join(", ")} to taxonomy for ${page}` : `dry run: taxonomy already includes requested tags for ${page}` : addedTags.length > 0 ? `added ${addedTags.join(", ")} to taxonomy for ${page}` : `taxonomy already includes requested tags for ${page}`;
+  return {
+    exitCode: ExitCode.OK,
+    result: ok({
+      page,
+      requested_tags: tags,
+      missing_tags: missingTags,
+      added_tags: addedTags,
+      changed: reconciled.data.changed,
+      dry_run: dryRun,
+      files_changed: filesChanged,
+      humanHint
+    })
+  };
 }
-function acquireLock(vault, opts = {}) {
-  const path = lockPath(vault);
-  const dir = join17(vault, ".skillwiki");
-  if (!existsSync6(dir)) {
-    mkdirSync3(dir, { recursive: true });
+async function reconcileTagsWhileLocked(input, page, tags, comment) {
+  const schemaPath = join18(input.vault, "SCHEMA.md");
+  const current = await readSchema(schemaPath);
+  if (!current.result.ok) return { exitCode: current.exitCode, result: current.result };
+  const next = reconcileTaxonomyDocument(current.result.data, { tags, comment });
+  if (!next.ok) return { exitCode: errorExitCode2(next.error), result: next };
+  if (next.data.changed) {
+    const written = await atomicWriteText(schemaPath, next.data.text);
+    if (!written.ok) return { exitCode: ExitCode.WRITE_FAILED, result: written };
+  }
+  let verifiedText;
+  try {
+    verifiedText = await readFile13(schemaPath, "utf8");
+  } catch (error) {
+    return {
+      exitCode: ExitCode.WRITE_FAILED,
+      result: err("WRITE_FAILED", { stage: "verify-taxonomy", page, message: String(error) })
+    };
   }
-  const sessionId = opts.sessionId ?? getSessionId();
-  const summary = opts.summary ?? "skillwiki sync";
-  const ttlMinutes = opts.ttlMinutes ?? 30;
-  const force = opts.force ?? false;
-  const now = /* @__PURE__ */ new Date();
-  const acquired = now.toISOString();
-  const expires = new Date(now.getTime() + ttlMinutes * 60 * 1e3).toISOString();
-  const lock = {
-    session_id: sessionId,
-    pid: process.pid,
-    cwd: process.cwd(),
-    summary,
-    acquired,
-    expires
-  };
+  const verified = extractTaxonomy(verifiedText);
+  if (!verified.ok || tags.some((tag) => !verified.data.includes(tag))) {
+    return {
+      exitCode: ExitCode.WRITE_FAILED,
+      result: err("WRITE_FAILED", { stage: "verify-taxonomy", page })
+    };
+  }
+  return previewResult(page, tags, next, false, next.data.changed ? ["SCHEMA.md"] : []);
+}
+async function runTagReconcile(input) {
+  const page = validatePageIdentity(input.page);
+  if (!page.ok) return { exitCode: ExitCode.VAULT_PATH_INVALID, result: page };
+  const resolvedTags = await resolveRequestedTags(input, page.data);
+  if (!resolvedTags.result.ok) return { exitCode: resolvedTags.exitCode, result: resolvedTags.result };
+  const tags = resolvedTags.result.data.tags;
+  const date = (input.now ?? /* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  const comment = taxonomyCommentForPage(page.data, date, input.reason);
+  if (!comment.ok) return { exitCode: ExitCode.SCHEME_REJECTED, result: comment };
+  if (!input.write) {
+    const schema = await readSchema(join18(input.vault, "SCHEMA.md"));
+    if (!schema.result.ok) return { exitCode: schema.exitCode, result: schema.result };
+    const preview = reconcileTaxonomyDocument(schema.result.data, { tags, comment: comment.data });
+    return previewResult(page.data, tags, preview, true, []);
+  }
+  let lock;
   try {
-    const content = JSON.stringify(lock, null, 2) + "\n";
-    writeFileSync3(path, content, { flag: "wx" });
-    return { ok: true, lock };
-  } catch (e) {
-    const err2 = e;
-    if (err2.code !== "EEXIST") throw err2;
-  }
-  const existing = readLock(vault);
-  if (!existing) {
-    writeLockedFile(path, lock);
-    return { ok: true, lock };
-  }
-  if (force || isStale(existing)) {
-    writeLockedFile(path, lock);
-    return { ok: true, lock };
-  }
-  return { ok: false, held: existing };
-}
-function writeLockedFile(path, lock) {
-  const tmp = path + ".tmp";
-  const content = JSON.stringify(lock, null, 2) + "\n";
-  writeFileSync3(tmp, content);
-  renameSync2(tmp, path);
-}
-function releaseLock(vault, opts = {}) {
-  const path = lockPath(vault);
-  if (!existsSync6(path)) {
-    return { released: false };
-  }
-  const sessionId = opts.sessionId ?? getSessionId();
-  const existing = readLock(vault);
-  if (opts.force) {
-    try {
-      unlinkSync2(path);
-      const prior = existing && existing.session_id !== sessionId ? existing : void 0;
-      return { released: true, prior };
-    } catch {
-      return { released: false };
-    }
+    lock = acquireOwnedSyncLock(input.vault, {
+      summary: `tag reconcile ${page.data}`,
+      ttlMinutes: 1
+    });
+  } catch (error) {
+    return {
+      exitCode: ExitCode.WRITE_FAILED,
+      result: err("WRITE_FAILED", { stage: "lock", page: page.data, message: String(error) })
+    };
+  }
+  if (!lock.ok) return { exitCode: errorExitCode2(lock.error), result: lock };
+  let outcome;
+  let released;
+  try {
+    outcome = await reconcileTagsWhileLocked(input, page.data, tags, comment.data);
+  } catch (error) {
+    outcome = {
+      exitCode: ExitCode.WRITE_FAILED,
+      result: err("WRITE_FAILED", { stage: "reconcile", page: page.data, message: String(error) })
+    };
+  } finally {
+    released = releaseOwnedSyncLock(lock.data);
   }
-  if (!existing || existing.session_id !== sessionId) {
-    return { released: false };
+  if (released === void 0 || !released.ok) {
+    return {
+      exitCode: ExitCode.WRITE_FAILED,
+      result: err("WRITE_FAILED", {
+        stage: "unlock",
+        page: page.data,
+        primary_error: outcome && !outcome.result.ok ? outcome.result.error : void 0,
+        release_error: released && !released.ok ? released.detail : "release did not run"
+      })
+    };
   }
+  return outcome ?? {
+    exitCode: ExitCode.WRITE_FAILED,
+    result: err("WRITE_FAILED", {
+      stage: "reconcile",
+      page: page.data,
+      message: "locked reconciliation produced no result"
+    })
+  };
+}
+
+// src/commands/sync.ts
+import { existsSync as existsSync5 } from "fs";
+import { join as join19 } from "path";
+import { execFileSync as execFileSync2 } from "child_process";
+
+// src/utils/git.ts
+import { execFileSync } from "child_process";
+function git(cwd, args) {
   try {
-    unlinkSync2(path);
-    return { released: true };
+    return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim();
   } catch {
-    return { released: false };
+    return "";
   }
 }
+function gitStrict(cwd, args) {
+  return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+}
 
 // src/utils/vault-git-pathspec.ts
 var VAULT_GENERATED_COMMIT_PATHS = [
@@ -3587,7 +4253,7 @@ function refHasPath(vault, ref, path) {
 function runSyncStatus(input) {
   const vault = input.vault;
   const includeStashes = input.includeStashes ?? false;
-  if (!existsSync7(join18(vault, ".git"))) {
+  if (!existsSync5(join19(vault, ".git"))) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: ok({
@@ -3694,7 +4360,7 @@ function runSyncStatus(input) {
 }
 async function runSyncPush(input) {
   const vault = input.vault;
-  if (!existsSync7(join18(vault, ".git"))) {
+  if (!existsSync5(join19(vault, ".git"))) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: err("NOT_A_GIT_REPO", { path: vault })
@@ -3854,7 +4520,7 @@ function enableGitLongPathsOnWindows(vault) {
 }
 async function runSyncPull(input) {
   const vault = input.vault;
-  if (!existsSync7(join18(vault, ".git"))) {
+  if (!existsSync5(join19(vault, ".git"))) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: err("NOT_A_GIT_REPO", { path: vault })
@@ -4026,7 +4692,7 @@ function runSyncPeers(input) {
 }
 function runSyncLock(input) {
   const vault = input.vault;
-  if (!existsSync7(vault)) {
+  if (!existsSync5(vault)) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: err("VAULT_PATH_INVALID", { path: vault })
@@ -4061,7 +4727,7 @@ function runSyncLock(input) {
 }
 function runSyncUnlock(input) {
   const vault = input.vault;
-  if (!existsSync7(vault)) {
+  if (!existsSync5(vault)) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: err("VAULT_PATH_INVALID", { path: vault })
@@ -4094,8 +4760,8 @@ function runSyncUnlock(input) {
 }
 
 // src/commands/backup.ts
-import { statSync as statSync3, readdirSync, readFileSync as readFileSync5, mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "fs";
-import { join as join19, relative as relative2, dirname as dirname6 } from "path";
+import { statSync as statSync2, readdirSync, readFileSync as readFileSync4, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join as join20, relative as relative2, dirname as dirname6 } from "path";
 import { PutObjectCommand, HeadObjectCommand, ListObjectsV2Command, GetObjectCommand, DeleteObjectsCommand } from "@aws-sdk/client-s3";
 
 // src/utils/s3-client.ts
@@ -4119,7 +4785,7 @@ var SKIP_DIRS = /* @__PURE__ */ new Set([".git", ".obsidian", "_archive", "node_
 function* walkMarkdown(dir, base) {
   for (const entry of readdirSync(dir, { withFileTypes: true })) {
     if (SKIP_DIRS.has(entry.name)) continue;
-    const full = join19(dir, entry.name);
+    const full = join20(dir, entry.name);
     if (entry.isDirectory()) {
       yield* walkMarkdown(full, base);
     } else if (entry.name.endsWith(".md")) {
@@ -4142,8 +4808,8 @@ async function runBackupSync(input) {
   let failed = 0;
   const files = [...walkMarkdown(input.vault, input.vault)];
   for (const relPath of files) {
-    const absPath = join19(input.vault, relPath);
-    const localStat = statSync3(absPath);
+    const absPath = join20(input.vault, relPath);
+    const localStat = statSync2(absPath);
     let needsUpload = true;
     try {
       const head = await client.send(new HeadObjectCommand({ Bucket: input.bucket, Key: relPath }));
@@ -4161,7 +4827,7 @@ async function runBackupSync(input) {
       continue;
     }
     try {
-      const body = readFileSync5(absPath);
+      const body = readFileSync4(absPath);
       await client.send(new PutObjectCommand({ Bucket: input.bucket, Key: relPath, Body: body }));
       uploaded++;
     } catch {
@@ -4218,9 +4884,9 @@ async function runBackupRestore(input) {
     const objects = list.Contents ?? [];
     for (const obj of objects) {
       if (!obj.Key) continue;
-      const localPath = join19(target, obj.Key);
+      const localPath = join20(target, obj.Key);
       try {
-        const localStat = statSync3(localPath);
+        const localStat = statSync2(localPath);
         if (obj.LastModified && localStat.mtime > obj.LastModified) {
           conflicts++;
           continue;
@@ -4231,8 +4897,8 @@ async function runBackupRestore(input) {
         const resp = await client.send(new GetObjectCommand({ Bucket: input.bucket, Key: obj.Key }));
         const body = await resp.Body?.transformToByteArray();
         if (body) {
-          mkdirSync4(dirname6(localPath), { recursive: true });
-          writeFileSync4(localPath, Buffer.from(body));
+          mkdirSync2(dirname6(localPath), { recursive: true });
+          writeFileSync2(localPath, Buffer.from(body));
           downloaded++;
         }
       } catch {
@@ -4264,11 +4930,11 @@ async function runBackupRestore(input) {
 }
 
 // src/commands/status.ts
-import { existsSync as existsSync8, statSync as statSync4 } from "fs";
-import { readFile as readFile11 } from "fs/promises";
-import { join as join20 } from "path";
+import { existsSync as existsSync6, statSync as statSync3 } from "fs";
+import { readFile as readFile14 } from "fs/promises";
+import { join as join21 } from "path";
 async function runStatus(input) {
-  if (!existsSync8(input.vault)) {
+  if (!existsSync6(input.vault)) {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { vault: input.vault }) };
   }
   const scan = await scanVault(input.vault);
@@ -4293,7 +4959,7 @@ async function runStatus(input) {
   const compound = scan.data.compound.length;
   let schemaVersion = "v1";
   try {
-    const schemaContent = await readFile11(join20(input.vault, "SCHEMA.md"), "utf8");
+    const schemaContent = await readFile14(join21(input.vault, "SCHEMA.md"), "utf8");
     const versionMatch = schemaContent.match(/version:\s*["']?([^"'\s\n]+)/i);
     if (versionMatch) schemaVersion = versionMatch[1];
   } catch {
@@ -4309,7 +4975,7 @@ async function runStatus(input) {
   let maxTime = 0;
   for (const page of allPages) {
     try {
-      const st = statSync4(page.absPath);
+      const st = statSync3(page.absPath);
       if (st.mtimeMs > maxTime) {
         maxTime = st.mtimeMs;
         lastModified = st.mtime.toISOString();
@@ -4353,8 +5019,8 @@ async function runStatus(input) {
 }
 
 // src/commands/seed.ts
-import { mkdir as mkdir9, writeFile as writeFile9, stat as stat5 } from "fs/promises";
-import { join as join21 } from "path";
+import { mkdir as mkdir10, writeFile as writeFile9, stat as stat4 } from "fs/promises";
+import { join as join22 } from "path";
 var TODAY = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
 var EXAMPLE_PAGES = {
   "entities/example-project.md": `---
@@ -4423,29 +5089,29 @@ Real sources are immutable after ingestion \u2014 never edit them.
 `;
 async function runSeed(input) {
   try {
-    await stat5(join21(input.vault, "SCHEMA.md"));
+    await stat4(join22(input.vault, "SCHEMA.md"));
   } catch {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { root: input.vault, reason: "SCHEMA.md missing \u2014 run `skillwiki init` first" }) };
   }
   const created = [];
   const skipped = [];
   for (const [relPath, content] of Object.entries(EXAMPLE_PAGES)) {
-    const absPath = join21(input.vault, relPath);
+    const absPath = join22(input.vault, relPath);
     try {
-      await stat5(absPath);
+      await stat4(absPath);
       skipped.push(relPath);
     } catch {
-      await mkdir9(join21(absPath, ".."), { recursive: true });
+      await mkdir10(join22(absPath, ".."), { recursive: true });
       await writeFile9(absPath, content, "utf8");
       created.push(relPath);
     }
   }
-  const rawPath = join21(input.vault, "raw", "articles", "example-source.md");
+  const rawPath = join22(input.vault, "raw", "articles", "example-source.md");
   try {
-    await stat5(rawPath);
+    await stat4(rawPath);
     skipped.push("raw/articles/example-source.md");
   } catch {
-    await mkdir9(join21(rawPath, ".."), { recursive: true });
+    await mkdir10(join22(rawPath, ".."), { recursive: true });
     await writeFile9(rawPath, EXAMPLE_RAW, "utf8");
     created.push("raw/articles/example-source.md");
   }
@@ -4468,9 +5134,9 @@ async function runSeed(input) {
 }
 
 // src/commands/canvas.ts
-import { readFile as readFile12, writeFile as writeFile10 } from "fs/promises";
-import { existsSync as existsSync9 } from "fs";
-import { join as join22 } from "path";
+import { readFile as readFile15, writeFile as writeFile10 } from "fs/promises";
+import { existsSync as existsSync7 } from "fs";
+import { join as join23 } from "path";
 var NODE_WIDTH = 240;
 var NODE_HEIGHT = 60;
 var COLUMN_SPACING = 400;
@@ -4548,8 +5214,8 @@ function buildCanvasEdges(adjacency) {
   return edges;
 }
 async function runCanvasGenerate(input) {
-  const graphPath = input.graphPath ?? join22(input.vault, ".skillwiki", "graph.json");
-  if (!existsSync9(graphPath)) {
+  const graphPath = input.graphPath ?? join23(input.vault, ".skillwiki", "graph.json");
+  if (!existsSync7(graphPath)) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
       result: err("FILE_NOT_FOUND", {
@@ -4560,7 +5226,7 @@ async function runCanvasGenerate(input) {
   }
   let raw;
   try {
-    raw = await readFile12(graphPath, "utf8");
+    raw = await readFile15(graphPath, "utf8");
   } catch (e) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
@@ -4586,7 +5252,7 @@ async function runCanvasGenerate(input) {
   const nodes = buildCanvasNodes(paths);
   const edges = buildCanvasEdges(graph.adjacency);
   const canvas = { nodes, edges };
-  const outPath = join22(input.vault, "vault-graph.canvas");
+  const outPath = join23(input.vault, "vault-graph.canvas");
   try {
     await writeFile10(outPath, JSON.stringify(canvas, null, 2));
   } catch (e) {
@@ -4608,10 +5274,10 @@ written: ${outPath}`
 }
 
 // src/commands/fleet-health.ts
-import { existsSync as existsSync10, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync5 } from "fs";
 import { execSync as nodeExecSync } from "child_process";
 import { hostname as nodeHostname, platform as nodePlatform } from "os";
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 var SSH_TIMEOUT_MS = 15e3;
 var TIMER_UNIT = "agent-memory-trends.timer";
 var SERVICE_UNIT = "agent-memory-trends.service";
@@ -4708,9 +5374,9 @@ function applyServiceFailedOverlay(run, serviceFailed) {
 function probeLocal(vaultPath, deps) {
   const latestPath = satelliteLatestRunPath(vaultPath);
   let parsed = null;
-  if (existsSync10(latestPath)) {
+  if (existsSync8(latestPath)) {
     try {
-      const wire = readSatelliteLatestRunFromText(readFileSync6(latestPath, "utf8"));
+      const wire = readSatelliteLatestRunFromText(readFileSync5(latestPath, "utf8"));
       if (wire) {
         parsed = {
           status: wire.status,
@@ -4841,7 +5507,7 @@ async function runFleetHealth(input) {
   const home = input.home ?? env.HOME ?? "";
   const osHostname = input.osHostname ?? env.HOSTNAME ?? nodeHostname();
   const vault = input.vault ?? env.WIKI_PATH;
-  const file = input.file ?? (vault ? join23(vault, FLEET_REL_PATH) : void 0);
+  const file = input.file ?? (vault ? join24(vault, FLEET_REL_PATH) : void 0);
   if (!file) {
     return {
       exitCode: ExitCode.NO_VAULT_CONFIGURED,
@@ -4925,15 +5591,15 @@ async function runFleetHealth(input) {
 }
 
 // src/utils/auto-commit.ts
-import { existsSync as existsSync11 } from "fs";
-import { join as join24 } from "path";
+import { existsSync as existsSync9 } from "fs";
+import { join as join25 } from "path";
 async function postCommit(vault, exitCode) {
   if (exitCode !== 0) return;
   const home = process.env.HOME ?? "";
   const dotenv = await parseDotenvFile(configPath(home));
   const autoCommit = process.env.AUTO_COMMIT ?? dotenv["AUTO_COMMIT"];
   if (autoCommit === "false") return;
-  if (!existsSync11(join24(vault, ".git"))) return;
+  if (!existsSync9(join25(vault, ".git"))) return;
   const lastOps = readLastOp(vault);
   if (lastOps.length === 0) return;
   const porcelain = git(vault, ["status", "--porcelain", "--", ...VAULT_COMMIT_PATHSPEC]);
@@ -4957,8 +5623,8 @@ async function postCommit(vault, exitCode) {
 }
 
 // src/utils/protected-vault-write-guard.ts
-import { readFileSync as readFileSync7 } from "fs";
-import { join as join25, resolve as resolvePath } from "path";
+import { readFileSync as readFileSync6 } from "fs";
+import { join as join26, resolve as resolvePath } from "path";
 async function guardProtectedVaultWrite(input) {
   const env = input.env ?? process.env;
   const home = input.home ?? process.env.HOME ?? "";
@@ -5024,7 +5690,7 @@ async function resolveLiveVaultPath(input) {
   return resolved.ok ? resolved.data.path : void 0;
 }
 function resolveSnapshotWorktree(home) {
-  const skillwikiEnv = join25(home, ".skillwiki", ".env");
+  const skillwikiEnv = join26(home, ".skillwiki", ".env");
   const explicitWorktree = readEnvKey(skillwikiEnv, ["vault_sync.snapshot_worktree"]);
   if (explicitWorktree) return explicitWorktree;
   const snapshotProfile = readEnvKey(skillwikiEnv, ["vault_sync.snapshot_profile"]);
@@ -5036,7 +5702,7 @@ function resolveSnapshotWorktree(home) {
 }
 function readEnvKey(path, keys) {
   try {
-    const content = readFileSync7(path, "utf8");
+    const content = readFileSync6(path, "utf8");
     for (const line of content.split(/\r?\n/)) {
       const trimmed = line.trim();
       if (trimmed.length === 0 || trimmed.startsWith("#")) continue;
@@ -5094,7 +5760,7 @@ program.command("validate <file>").description("validate vault page frontmatter
   emit(await runValidate({ file, apply: !!opts.apply, vault }), vault);
 });
 program.command("graph").description("graph subcommands").command("build <vault>").option("--out <path>", "graph output path (default: <vault>/.skillwiki/graph.json)").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
-  const out = opts.out ?? join26(vault, ".skillwiki", "graph.json");
+  const out = opts.out ?? join27(vault, ".skillwiki", "graph.json");
   return emitGuardedVaultWrite(vault, "graph build", () => runGraphBuild({ vault, out }));
 });
 var canvasCmd = program.command("canvas").description("manage Obsidian canvas files");
@@ -5188,6 +5854,45 @@ program.command("tag-audit [vault]").description("audit tag taxonomy consistency
   if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
   else emit(await runTagAudit({ vault: v.vault }), v.vault);
 });
+var tagCmd = program.command("tag").description("manage the vault tag taxonomy");
+tagCmd.command("reconcile [vault]").description("preview or add prospective page tags to SCHEMA taxonomy").requiredOption("--page <path>", "vault-relative typed page target").option("--from <path>", "unpublished draft or existing page to read tags from").option("--tags <csv>", "comma-separated prospective tags").option("--reason <text>", "reconciliation comment reason").option("--write", "write SCHEMA.md after successful preview", false).option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
+  const resolved = await resolveVaultArg(vault, opts.wiki);
+  if (!resolved.ok) return emit({ exitCode: resolved.exitCode, result: resolved.payload });
+  const input = {
+    vault: resolved.vault,
+    page: opts.page,
+    from: opts.from,
+    tags: opts.tags?.split(",").map((tag) => tag.trim()).filter(Boolean),
+    reason: opts.reason,
+    write: !!opts.write
+  };
+  if (!opts.write) return emit(await runTagReconcile(input), resolved.vault, { postCommit: false });
+  return emitGuardedVaultWrite(
+    resolved.vault,
+    "tag reconcile",
+    () => runTagReconcile(input),
+    { postCommit: false }
+  );
+});
+var pageCmd = program.command("page").description("validate and publish typed vault pages");
+pageCmd.command("publish <draft> [vault]").description("preview or publish an unpublished typed-page draft").requiredOption("--target <path>", "vault-relative typed page target").option("--log-note <text>", "single-line publication log note").option("--write", "publish SCHEMA, page, index, and log", false).option("--wiki <name>", "wiki profile name").action(async (draft, vault, opts) => {
+  const resolved = await resolveVaultArg(vault, opts.wiki);
+  if (!resolved.ok) return emit({ exitCode: resolved.exitCode, result: resolved.payload });
+  const input = {
+    vault: resolved.vault,
+    draftPath: draft,
+    target: opts.target,
+    logNote: opts.logNote,
+    write: !!opts.write
+  };
+  if (!opts.write) return emit(await runPagePublish(input), resolved.vault, { postCommit: false });
+  return emitGuardedVaultWrite(
+    resolved.vault,
+    "page publish",
+    () => runPagePublish(input),
+    { postCommit: false }
+  );
+});
 program.command("index-check [vault]").description("verify index.md entries match actual vault pages").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
   const v = await resolveVaultArg(vault, opts.wiki);
   if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
@@ -5354,6 +6059,22 @@ program.command("archive <page> [vault]").description("archive a typed-knowledge
     })
   );
 });
+program.command("remove <page> [vault]").description("remove a vault path and write a delete-intent tombstone").option("--wiki <name>", "wiki profile name").option("--remote <remote>", "rclone remote root to prune the live path, for example seaweed-wiki:cloud/wiki").option("--remote-delete", "delete the live path from the remote after local remove", false).option("--max-remote-deletes <n>", "maximum remote object deletes allowed", "1").option("--reason <text>", "stored on the delete-intent tombstone").action(async (page, vault, opts) => {
+  const v = await resolveVaultArg(vault, opts.wiki);
+  if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
+  else return emitGuardedVaultWrite(
+    v.vault,
+    "remove",
+    () => runRemove({
+      vault: v.vault,
+      page,
+      remote: opts.remote,
+      remoteDelete: !!opts.remoteDelete,
+      maxRemoteDeletes: Number.parseInt(opts.maxRemoteDeletes, 10),
+      reason: opts.reason
+    })
+  );
+});
 program.command("drift [vault]").description("detect content drift in raw sources").option("--apply", "update sha256 in drifted sources").option("--new <date>", "list raw files ingested on/after this date (YYYY-MM-DD)").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
   const v = await resolveVaultArg(vault, opts.wiki);
   if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });