skillwiki 0.9.63 → 0.10.0

package/dist/cli.js

@@ -1,53 +1,36 @@
 #!/usr/bin/env node
 import {
-  ExitCode,
-  FLEET_REL_PATH,
-  MetaSchema,
-  RawSourceSchema,
   SATELLITE_STALE_MS,
   acquireLock,
   acquireOwnedSyncLock,
   appendLastOp,
-  assertTargetInsideVault,
   assessSourceIdentity,
-  atomicWriteText,
   buildDegradedReasons,
   buildRemoteObjectPath,
   clearLastOp,
   configPath,
-  err,
   evaluateSatelliteRunHealth,
   extractCitationMarkers,
-  extractFrontmatter,
   extractTaxonomy,
   findPlugin,
   fixPathTooLong,
   getCliSessionId,
   getSessionId,
-  isBlockedHost,
   isFailedRunStatus,
   isValidRemoteDeleteCap,
-  loadFleetManifest,
-  loadFleetManifestAndHost,
+  mergeTaxonomyConflict,
   normalizeRemoteRoot,
-  ok,
-  parseDotenvFile,
-  parseDotenvText,
   planAndMaybePruneRemoteObjects,
-  prepareTypedPage,
   probeRemoteHealth,
-  profileKey,
   readCliPackageJson,
   readLastOp,
   readLock,
-  readPage,
   readSatelliteLatestRunFromText,
   reconcileTaxonomyDocument,
-  redactSensitiveContent,
   releaseLock,
   releaseOwnedSyncLock,
   renderIndexUpsert,
-  resolveFleetHostId,
+  renderProjectIndex,
   resolveInitTimePath,
   resolveRuntimePath,
   runAudit,
@@ -57,8 +40,6 @@ import {
   runConfigSet,
   runDedup,
   runDoctor,
-  runFleetContext,
-  runFleetValidate,
   runFrontmatterFix,
   runGraphBuild,
   runIndexCheck,
@@ -85,14 +66,9 @@ import {
   runValidate,
   safeWritePage,
   satelliteLatestRunPath,
-  scanSensitiveContent,
-  scanVault,
-  snapshotterAliasForLocalHost,
-  splitFrontmatter,
   taxonomyCommentForPage,
-  upsertIndexEntry,
-  writeDotenv
-} from "./chunk-TUFQZ5K4.js";
+  upsertIndexEntry
+} from "./chunk-DR7KFHNH.js";
 import {
   normalizeDistTag,
   readCache,
@@ -100,9 +76,52 @@ import {
   triggerAutoUpdate,
   writeCache
 } from "./chunk-7I2TPIV5.js";
+import {
+  assertTargetInsideVault,
+  atomicWriteText,
+  extractFrontmatter,
+  prepareTypedPage,
+  readPage,
+  redactSensitiveContent,
+  renderRootIndex,
+  scanSensitiveContent,
+  scanVault,
+  splitFrontmatter,
+  writeRootIndexProjection
+} from "./chunk-IZABIE44.js";
+import {
+  acquireManagedWriteLock,
+  git,
+  gitStrict,
+  releaseManagedWriteLock,
+  runManagedWritePreflight,
+  runManagedWriteTransaction,
+  runVaultSyncPullHelper
+} from "./chunk-5TBIMLTZ.js";
+import {
+  FLEET_REL_PATH,
+  loadFleetManifest,
+  loadFleetManifestAndHost,
+  parseDotenvFile,
+  parseDotenvText,
+  profileKey,
+  resolveFleetHostId,
+  runFleetContext,
+  runFleetValidate,
+  snapshotterAliasForLocalHost,
+  writeDotenv
+} from "./chunk-S5ABQCXQ.js";
+import {
+  ExitCode,
+  MetaSchema,
+  RawSourceSchema,
+  err,
+  isBlockedHost,
+  ok
+} from "./chunk-C5OLZRRM.js";
 
 // src/cli.ts
-import { join as join27 } from "path";
+import { join as join34 } from "path";
 import { Command } from "commander";
 
 // src/utils/output.ts
@@ -710,11 +729,11 @@ async function runInit(input) {
     ].join("\n");
   });
   if (errTemplate) return errTemplate;
-  const err2 = await writeOrPreserve("log.md", async () => {
+  const err22 = await writeOrPreserve("log.md", async () => {
     const tpl = await readFile3(join5(input.templates, "log.md"), "utf8");
     return tpl.replace(/\{\{INIT_DATE\}\}/g, today).replace("{{DOMAIN}}", domain).replace("{{WIKI_LANG}}", canonicalLang);
   });
-  if (err2) return err2;
+  if (err22) return err22;
   const skipEnv = !!input.noEnv || explicitTarget && !input.profile && swDotenvHadPath && !input.force;
   let envWritten = "";
   if (!skipEnv) {
@@ -770,10 +789,1009 @@ async function runInit(input) {
   };
 }
 
+// src/commands/index-rebuild.ts
+import { readFileSync as readFileSync3 } from "fs";
+import { join as join7 } from "path";
+
+// src/utils/protected-vault-write-guard.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { join as join6, resolve as resolvePath } from "path";
+async function guardProtectedVaultWrite(input) {
+  const env = input.env ?? process.env;
+  const home = input.home ?? process.env.HOME ?? "";
+  const cwd = input.cwd ?? process.cwd();
+  const liveVaultPath = await resolveLiveVaultPath({ env, home, cwd });
+  const load = await loadFleetManifestAndHost({
+    vault: liveVaultPath ?? input.vault,
+    hostId: input.hostId,
+    env,
+    home,
+    cwd,
+    osHostname: input.osHostname ?? process.env.HOSTNAME,
+    user: input.user ?? process.env.USER
+  });
+  if (!load?.hostId || load.identityStatus !== "known") {
+    return { blocked: false };
+  }
+  const host = load.manifest.hosts[load.hostId];
+  if (!host || host.role !== "snapshotter" || host.protected !== true) {
+    return { blocked: false };
+  }
+  const snapshotWorktree = resolveSnapshotWorktree(home);
+  const targetVault = resolvePath(input.vault);
+  const canonicalLiveVault = liveVaultPath ? resolvePath(liveVaultPath) : void 0;
+  const canonicalSnapshotWorktree = snapshotWorktree ? resolvePath(snapshotWorktree) : void 0;
+  if (canonicalLiveVault && targetVault === canonicalLiveVault) {
+    return { blocked: false };
+  }
+  if (canonicalSnapshotWorktree && targetVault === canonicalSnapshotWorktree) {
+    return {
+      blocked: true,
+      exitCode: ExitCode.PROTECTED_SNAPSHOTTER_WRITE_BLOCKED,
+      result: err("PROTECTED_SNAPSHOTTER_WRITE_BLOCKED", {
+        host_id: load.hostId,
+        command: input.command,
+        reason: `refusing mutation of snapshot worktree '${canonicalSnapshotWorktree}' on protected snapshotter host '${load.hostId}'`,
+        guidance: canonicalLiveVault ? `Use the live vault path '${canonicalLiveVault}' for authoring. Keep snapshot worktrees read-only except explicit snapshot maintenance.` : "Use the live skillwiki vault path for authoring. Keep snapshot worktrees read-only except explicit snapshot maintenance."
+      })
+    };
+  }
+  if (canonicalLiveVault && targetVault !== canonicalLiveVault) {
+    return {
+      blocked: true,
+      exitCode: ExitCode.PROTECTED_SNAPSHOTTER_WRITE_BLOCKED,
+      result: err("PROTECTED_SNAPSHOTTER_WRITE_BLOCKED", {
+        host_id: load.hostId,
+        command: input.command,
+        reason: `refusing vault mutation outside the live vault path '${canonicalLiveVault}' on protected snapshotter host '${load.hostId}'`,
+        guidance: "Use the resolved live skillwiki vault path for authoring. Keep alternate vault roots and snapshot worktrees read-only unless explicitly approved."
+      })
+    };
+  }
+  return { blocked: false };
+}
+async function resolveLiveVaultPath(input) {
+  const resolved = await resolveRuntimePath({
+    flag: void 0,
+    envValue: input.env.WIKI_PATH,
+    wikiEnv: input.env.WIKI,
+    home: input.home,
+    cwd: input.cwd
+  });
+  return resolved.ok ? resolved.data.path : void 0;
+}
+function resolveSnapshotWorktree(home) {
+  const skillwikiEnv = join6(home, ".skillwiki", ".env");
+  const explicitWorktree = readEnvKey(skillwikiEnv, ["vault_sync.snapshot_worktree"]);
+  if (explicitWorktree) return explicitWorktree;
+  const snapshotProfile = readEnvKey(skillwikiEnv, ["vault_sync.snapshot_profile"]);
+  if (snapshotProfile) {
+    const fromProfile = readEnvKey(snapshotProfile, ["WIKI_GIT_WORKTREE", "SNAPSHOT_WORKTREE", "GIT_DIR"]);
+    if (fromProfile) return fromProfile;
+  }
+  return "/root/wiki-git";
+}
+function readEnvKey(path, keys) {
+  try {
+    const content = readFileSync2(path, "utf8");
+    for (const line of content.split(/\r?\n/)) {
+      const trimmed = line.trim();
+      if (trimmed.length === 0 || trimmed.startsWith("#")) continue;
+      const eq = trimmed.indexOf("=");
+      if (eq <= 0) continue;
+      const key = trimmed.slice(0, eq).trim();
+      if (!keys.includes(key)) continue;
+      const value = trimmed.slice(eq + 1).trim();
+      if (value.length > 0) return value;
+    }
+  } catch {
+    return void 0;
+  }
+  return void 0;
+}
+
+// src/commands/index-rebuild.ts
+async function runIndexRebuild(input) {
+  const projection = await renderRootIndex({ vault: input.vault });
+  if (!projection.ok) {
+    const code = projection.error === "SCHEME_REJECTED" ? ExitCode.SCHEME_REJECTED : ExitCode.VAULT_PATH_INVALID;
+    return { exitCode: code, result: projection };
+  }
+  let current = "";
+  try {
+    current = readFileSync3(join7(input.vault, "index.md"), "utf8");
+  } catch {
+    current = "";
+  }
+  const changed = current !== projection.data.text;
+  if (!input.write) {
+    return {
+      exitCode: ExitCode.OK,
+      result: ok({
+        changed,
+        dry_run: true,
+        entry_count: projection.data.entries.length,
+        duplicates_removed: projection.data.duplicates_removed,
+        ghosts_removed: projection.data.ghosts_removed,
+        humanHint: changed ? `dry run: would rewrite index.md (${projection.data.entries.length} entries)` : `dry run: index.md already canonical (${projection.data.entries.length} entries)`
+      })
+    };
+  }
+  const guard = await guardProtectedVaultWrite({
+    vault: input.vault,
+    command: "index rebuild"
+  });
+  if (guard.blocked) {
+    return { exitCode: guard.exitCode, result: guard.result };
+  }
+  return runManagedWriteTransaction({
+    vault: input.vault,
+    command: "index rebuild",
+    allowImmutableRecord: false,
+    mutate: async () => {
+      if (!changed) {
+        return {
+          exitCode: ExitCode.OK,
+          result: ok({
+            changed: false,
+            dry_run: false,
+            entry_count: projection.data.entries.length,
+            duplicates_removed: projection.data.duplicates_removed,
+            ghosts_removed: projection.data.ghosts_removed,
+            humanHint: `index.md already canonical (${projection.data.entries.length} entries)`
+          })
+        };
+      }
+      const written = await writeRootIndexProjection(input.vault, projection.data);
+      if (!written.ok) {
+        return { exitCode: ExitCode.WRITE_FAILED, result: written };
+      }
+      let installed = "";
+      try {
+        installed = readFileSync3(join7(input.vault, "index.md"), "utf8");
+      } catch (error) {
+        return {
+          exitCode: ExitCode.WRITE_FAILED,
+          result: err("WRITE_FAILED", { message: String(error) })
+        };
+      }
+      if (installed !== projection.data.text) {
+        return {
+          exitCode: ExitCode.WRITE_FAILED,
+          result: err("WRITE_FAILED", { message: "installed index.md differs from projection" })
+        };
+      }
+      return {
+        exitCode: ExitCode.OK,
+        result: ok({
+          changed: true,
+          dry_run: false,
+          entry_count: projection.data.entries.length,
+          duplicates_removed: projection.data.duplicates_removed,
+          ghosts_removed: projection.data.ghosts_removed,
+          humanHint: `rewrote index.md (${projection.data.entries.length} entries)`
+        })
+      };
+    }
+  });
+}
+
+// src/commands/derived-conflicts.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { existsSync, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
+import { join as join9 } from "path";
+
+// src/utils/log-merge.ts
+import { execFileSync } from "child_process";
+import { mkdtempSync, writeFileSync, rmSync } from "fs";
+import { tmpdir } from "os";
+import { join as join8 } from "path";
+var ENTRY_RE = /^## \[/m;
+var PUBLISH_MARKER_RE = /<!--\s*skillwiki-page-publish:([a-f0-9]{64})\s*-->/i;
+function splitLog(text) {
+  const normalized = text.replace(/\r\n/g, "\n");
+  const match = ENTRY_RE.exec(normalized);
+  if (!match || match.index === void 0) {
+    return { preamble: normalized.replace(/\n+$/, ""), entries: [] };
+  }
+  const preamble = normalized.slice(0, match.index).replace(/\n+$/, "");
+  const body = normalized.slice(match.index);
+  const parts = body.split(/(?=^## \[)/m).filter((p) => p.length > 0);
+  const entries = parts.map((p) => p.replace(/\n+$/, ""));
+  return { preamble, entries };
+}
+function publishId(entry) {
+  return PUBLISH_MARKER_RE.exec(entry)?.[1]?.toLowerCase();
+}
+function unionUnstructured(base, ours, theirs) {
+  const dir = mkdtempSync(join8(tmpdir(), "log-union-"));
+  try {
+    const basePath = join8(dir, "base");
+    const oursPath = join8(dir, "ours");
+    const theirsPath = join8(dir, "theirs");
+    writeFileSync(basePath, base.endsWith("\n") || base.length === 0 ? base : `${base}
+`);
+    writeFileSync(oursPath, ours.endsWith("\n") || ours.length === 0 ? ours : `${ours}
+`);
+    writeFileSync(theirsPath, theirs.endsWith("\n") || theirs.length === 0 ? theirs : `${theirs}
+`);
+    const text = execFileSync("git", ["merge-file", "--union", "-p", oursPath, basePath, theirsPath], {
+      encoding: "utf8"
+    });
+    return ok(text.endsWith("\n") ? text : `${text}
+`);
+  } catch (error) {
+    return err("WRITE_FAILED", { message: `unstructured log union failed: ${String(error)}` });
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+function mergeLogConflictStages(input) {
+  const ours = splitLog(input.ours);
+  const theirs = splitLog(input.theirs);
+  const baseSplit = splitLog(input.base);
+  if (ours.entries.length === 0 && theirs.entries.length === 0) {
+    const unioned = unionUnstructured(input.base, input.ours, input.theirs);
+    if (!unioned.ok) return unioned;
+    return ok({ text: unioned.data, deduplicated_operation_ids: [] });
+  }
+  const preamble = ours.preamble || theirs.preamble || baseSplit.preamble || "# Log";
+  const seenMarkers = /* @__PURE__ */ new Set();
+  const seenExact = /* @__PURE__ */ new Set();
+  const out = [];
+  const deduped = [];
+  const push = (entry) => {
+    const marker2 = publishId(entry);
+    if (marker2) {
+      if (seenMarkers.has(marker2)) {
+        deduped.push(marker2);
+        return;
+      }
+      seenMarkers.add(marker2);
+    } else if (seenExact.has(entry)) {
+      return;
+    } else {
+      seenExact.add(entry);
+    }
+    out.push(entry);
+  };
+  for (const e of ours.entries) push(e);
+  for (const e of theirs.entries) push(e);
+  let text = preamble;
+  if (out.length > 0) {
+    text = `${preamble.replace(/\n+$/, "")}
+
+${out.join("\n\n")}`;
+  }
+  if (!text.endsWith("\n")) text += "\n";
+  return ok({ text, deduplicated_operation_ids: deduped });
+}
+
+// src/commands/derived-conflicts.ts
+function classifyDerivedPath(path) {
+  if (path === "index.md") return "root-index";
+  if (path === "SCHEMA.md") return "taxonomy";
+  if (path === "log.md" || path.endsWith("/log.md")) return "log";
+  if (/^projects\/[^/]+\/knowledge\.md$/.test(path)) return "project-index";
+  return "unknown";
+}
+function journalPath(vault, operationId2) {
+  const gitPath = git(vault, ["rev-parse", "--git-path", `vault-sync/operations/${operationId2}.env`]);
+  if (!gitPath) return null;
+  return gitPath.startsWith("/") ? gitPath : join9(vault, gitPath);
+}
+function readJournalFields(path) {
+  const text = readFileSync5(path, "utf8");
+  const out = {};
+  for (const line of text.split("\n")) {
+    const i = line.indexOf("=");
+    if (i <= 0) continue;
+    out[line.slice(0, i)] = line.slice(i + 1);
+  }
+  return out;
+}
+function showStage(vault, stage, path) {
+  try {
+    return execFileSync2("git", ["show", `:${stage}:${path}`], {
+      cwd: vault,
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+  } catch {
+    return null;
+  }
+}
+function stageOid(vault, stage, path) {
+  return git(vault, ["rev-parse", `:${stage}:${path}`]);
+}
+function unmergedPaths(vault) {
+  const raw = git(vault, ["diff", "--name-only", "--diff-filter=U"]);
+  return raw ? raw.split("\n").map((s) => s.trim()).filter(Boolean) : [];
+}
+function verifyOperation(vault, operationId2) {
+  const path = journalPath(vault, operationId2);
+  if (!path || !existsSync(path)) {
+    return err("PREFLIGHT_FAILED", { reason: "missing-operation-journal", operation_id: operationId2 });
+  }
+  const fields = readJournalFields(path);
+  if (fields.operation_id !== operationId2) {
+    return err("PREFLIGHT_FAILED", { reason: "operation-id-mismatch", operation_id: operationId2 });
+  }
+  if (fields.handoff === "1") {
+    return err("PREFLIGHT_FAILED", { reason: "operation-handoff", operation_id: operationId2 });
+  }
+  const phase = fields.phase ?? "";
+  if (phase !== "rebasing" && phase !== "restoring") {
+    return err("PREFLIGHT_FAILED", { reason: "operation-phase", phase, operation_id: operationId2 });
+  }
+  const currentGitDir = git(vault, ["rev-parse", "--absolute-git-dir"]);
+  const journalGitDir = fields.worktree_git_dir ?? "";
+  if (journalGitDir && currentGitDir && journalGitDir !== currentGitDir) {
+    return err("PREFLIGHT_FAILED", { reason: "worktree-mismatch", operation_id: operationId2 });
+  }
+  if (!journalGitDir && unmergedPaths(vault).length === 0) {
+    return err("PREFLIGHT_FAILED", { reason: "legacy-journal-without-unmerged", operation_id: operationId2 });
+  }
+  return ok({ phase });
+}
+async function resolveOne(vault, path, klass) {
+  if (klass === "root-index") {
+    const rendered = await renderRootIndex({ vault });
+    if (!rendered.ok) return rendered;
+    return ok(rendered.data.text);
+  }
+  if (klass === "taxonomy") {
+    const base = showStage(vault, 1, path) ?? "";
+    const ours = showStage(vault, 2, path);
+    const theirs = showStage(vault, 3, path);
+    if (ours === null || theirs === null) {
+      return err("WRITE_FAILED", { path, message: "missing taxonomy stages" });
+    }
+    const merged = mergeTaxonomyConflict(base, ours, theirs);
+    if (!merged.ok) return merged;
+    return ok(merged.data.text);
+  }
+  if (klass === "log") {
+    const base = showStage(vault, 1, path) ?? "";
+    const ours = showStage(vault, 2, path) ?? "";
+    const theirs = showStage(vault, 3, path) ?? "";
+    const merged = mergeLogConflictStages({ base, ours, theirs });
+    if (!merged.ok) return merged;
+    return ok(merged.data.text);
+  }
+  if (klass === "project-index") {
+    const slug = path.replace(/^projects\//, "").replace(/\/knowledge\.md$/, "");
+    const rendered = await renderProjectIndex(vault, slug);
+    if (!rendered.ok) return rendered;
+    return ok(rendered.data.text);
+  }
+  return err("SCHEME_REJECTED", { path, reason: "unknown-derived-class" });
+}
+function rollbackPath(vault, path, stage2, stage3) {
+  try {
+    execFileSync2("git", ["checkout", "--conflict=merge", "--", path], {
+      cwd: vault,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+  } catch {
+    return false;
+  }
+  const s2 = stageOid(vault, 2, path);
+  const s3 = stageOid(vault, 3, path);
+  return s2 === stage2 && s3 === stage3;
+}
+function hasMarkers(path, text) {
+  const lines = text.split(/\r?\n/);
+  let open3 = false;
+  let sep2 = false;
+  for (const line of lines) {
+    if (line.startsWith("<<<<<<< ")) {
+      open3 = true;
+      sep2 = false;
+      continue;
+    }
+    if (line === "=======" && open3) {
+      sep2 = true;
+      continue;
+    }
+    if (line.startsWith(">>>>>>> ") && open3 && sep2) return true;
+    if (line.startsWith(">>>>>>> ")) {
+      open3 = false;
+      sep2 = false;
+    }
+  }
+  return false;
+}
+async function runDerivedConflictResolution(input) {
+  const vault = input.vault;
+  const verified = verifyOperation(vault, input.operationId);
+  if (!verified.ok) {
+    return {
+      exitCode: ExitCode.PREFLIGHT_FAILED,
+      result: err("PREFLIGHT_FAILED", verified.detail)
+    };
+  }
+  const paths = unmergedPaths(vault);
+  if (paths.length === 0) {
+    return {
+      exitCode: ExitCode.OK,
+      result: ok({
+        resolved: true,
+        resolved_paths: [],
+        unknown_paths: [],
+        rolled_back: false,
+        humanHint: "no unmerged paths"
+      })
+    };
+  }
+  const classes = paths.map((p) => ({ path: p, klass: classifyDerivedPath(p) }));
+  const unknown = classes.filter((c) => c.klass === "unknown").map((c) => c.path);
+  if (unknown.length > 0) {
+    return {
+      exitCode: ExitCode.SYNC_PULL_FAILED,
+      result: ok({
+        resolved: false,
+        resolved_paths: [],
+        unknown_paths: unknown,
+        rolled_back: false,
+        humanHint: `review-required: unknown conflict paths ${unknown.join(", ")}`
+      })
+    };
+  }
+  const snapshots = /* @__PURE__ */ new Map();
+  for (const { path } of classes) {
+    snapshots.set(path, {
+      stage2: stageOid(vault, 2, path),
+      stage3: stageOid(vault, 3, path)
+    });
+  }
+  const staged = [];
+  try {
+    for (const { path, klass } of classes) {
+      const resolved = await resolveOne(vault, path, klass);
+      if (!resolved.ok) throw new Error(`${path}: ${resolved.error}`);
+      if (hasMarkers(path, resolved.data)) {
+        throw new Error(`${path}: conflict markers remain after resolve`);
+      }
+      writeFileSync2(join9(vault, path), resolved.data, "utf8");
+      execFileSync2("git", ["add", "--", path], { cwd: vault, stdio: ["pipe", "pipe", "pipe"] });
+      staged.push(path);
+    }
+    const remaining = unmergedPaths(vault);
+    if (remaining.length > 0) {
+      throw new Error(`still unmerged: ${remaining.join(",")}`);
+    }
+    return {
+      exitCode: ExitCode.OK,
+      result: ok({
+        resolved: true,
+        resolved_paths: staged,
+        unknown_paths: [],
+        rolled_back: false,
+        humanHint: `resolved ${staged.length} derived path(s)`
+      })
+    };
+  } catch (error) {
+    let rolled = true;
+    for (const path of staged) {
+      const snap = snapshots.get(path);
+      if (!snap || !rollbackPath(vault, path, snap.stage2, snap.stage3)) {
+        rolled = false;
+      }
+    }
+    for (const { path } of classes) {
+      if (staged.includes(path)) continue;
+      const snap = snapshots.get(path);
+      if (snap) rollbackPath(vault, path, snap.stage2, snap.stage3);
+    }
+    return {
+      exitCode: ExitCode.SYNC_PULL_FAILED,
+      result: ok({
+        resolved: false,
+        resolved_paths: [],
+        unknown_paths: [],
+        rolled_back: rolled,
+        humanHint: `derived resolve failed: ${String(error)}`
+      })
+    };
+  }
+}
+
+// src/commands/log-materialize.ts
+import { readFileSync as readFileSync6 } from "fs";
+import { join as join11 } from "path";
+
+// src/utils/log-events.ts
+import { mkdir as mkdir4, open, readFile as readFile4, readdir as readdir3 } from "fs/promises";
+import { join as join10 } from "path";
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function canonicalize(value) {
+  if (Array.isArray(value)) return value.map(canonicalize);
+  if (!isPlainObject(value)) return value;
+  const out = {};
+  for (const key of Object.keys(value).sort()) {
+    out[key] = canonicalize(value[key]);
+  }
+  return out;
+}
+function eventPathFor(event) {
+  const day2 = event.occurred_at.slice(0, 10);
+  return `meta/log-events/${day2}/${event.operation_id}.json`;
+}
+function validateLogEvent(event) {
+  if (event.schema !== "skillwiki-log-event/v1") {
+    return err("SCHEME_REJECTED", { message: "invalid event schema" });
+  }
+  if (!/^[0-9a-f]{64}$/.test(event.operation_id)) {
+    return err("SCHEME_REJECTED", { message: "operation_id must be 64 hex chars" });
+  }
+  if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(event.occurred_at)) {
+    return err("SCHEME_REJECTED", { message: "occurred_at must be UTC ISO with milliseconds" });
+  }
+  for (const field of ["host_id", "actor", "kind", "target", "note"]) {
+    const v = event[field];
+    if (typeof v !== "string" || v.trim().length === 0 || v.length > 500) {
+      return err("SCHEME_REJECTED", { message: `invalid ${field}` });
+    }
+  }
+  if (!isPlainObject(event.metadata)) {
+    return err("SCHEME_REJECTED", { message: "metadata must be a plain object" });
+  }
+  const sensitive = scanSensitiveContent(JSON.stringify(event));
+  if (sensitive.length > 0) {
+    return err("SENSITIVE_CONTENT_DETECTED", { findings: sensitive });
+  }
+  return ok({
+    schema: "skillwiki-log-event/v1",
+    operation_id: event.operation_id,
+    occurred_at: event.occurred_at,
+    host_id: event.host_id,
+    actor: event.actor,
+    kind: event.kind,
+    target: event.target,
+    note: event.note,
+    metadata: canonicalize(event.metadata)
+  });
+}
+function canonicalEventJson(event) {
+  const ordered = {
+    schema: event.schema,
+    operation_id: event.operation_id,
+    occurred_at: event.occurred_at,
+    host_id: event.host_id,
+    actor: event.actor,
+    kind: event.kind,
+    target: event.target,
+    note: event.note,
+    metadata: event.metadata
+  };
+  return `${JSON.stringify(ordered, null, 2)}
+`;
+}
+async function writeLogEvent(vault, event) {
+  const validated = validateLogEvent(event);
+  if (!validated.ok) return validated;
+  const rel = eventPathFor(validated.data);
+  const abs = join10(vault, rel);
+  await mkdir4(join10(vault, "meta", "log-events", validated.data.occurred_at.slice(0, 10)), {
+    recursive: true
+  });
+  const body = canonicalEventJson(validated.data);
+  try {
+    const handle = await open(abs, "wx");
+    try {
+      await handle.writeFile(body, "utf8");
+    } finally {
+      await handle.close();
+    }
+    return ok({ path: rel, created: true });
+  } catch (error) {
+    if (error.code === "EEXIST") {
+      let existing;
+      try {
+        existing = await readFile4(abs, "utf8");
+      } catch (readErr) {
+        return err("WRITE_FAILED", { path: rel, message: String(readErr) });
+      }
+      if (existing === body) return ok({ path: rel, created: false });
+      return err("EVENT_IDENTITY_COLLISION", { path: rel });
+    }
+    return err("WRITE_FAILED", { path: rel, message: String(error) });
+  }
+}
+async function readLogEvents(vault) {
+  const root = join10(vault, "meta", "log-events");
+  let days;
+  try {
+    days = (await readdir3(root, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => d.name).sort();
+  } catch {
+    return ok([]);
+  }
+  const events = [];
+  for (const day2 of days) {
+    const files = (await readdir3(join10(root, day2))).filter((f) => f.endsWith(".json")).sort();
+    for (const file of files) {
+      const text = await readFile4(join10(root, day2, file), "utf8");
+      let parsed;
+      try {
+        parsed = JSON.parse(text);
+      } catch {
+        return err("SCHEME_REJECTED", { path: `meta/log-events/${day2}/${file}`, message: "invalid JSON" });
+      }
+      const validated = validateLogEvent(parsed);
+      if (!validated.ok) return validated;
+      if (eventPathFor(validated.data) !== `meta/log-events/${day2}/${file}`) {
+        return err("SCHEME_REJECTED", {
+          path: `meta/log-events/${day2}/${file}`,
+          message: "path/identity mismatch"
+        });
+      }
+      events.push(validated.data);
+    }
+  }
+  events.sort((a, b) => {
+    if (a.occurred_at !== b.occurred_at) return a.occurred_at < b.occurred_at ? -1 : 1;
+    return a.operation_id < b.operation_id ? -1 : a.operation_id > b.operation_id ? 1 : 0;
+  });
+  return ok(events);
+}
+
+// src/utils/log-projection.ts
+function day(event) {
+  return event.occurred_at.slice(0, 10);
+}
+function marker(event) {
+  return `<!-- skillwiki-log-event:${event.operation_id} -->`;
+}
+function bodyFor(event) {
+  if (event.kind === "page-publish") {
+    const tax = Array.isArray(event.metadata.taxonomy_added) ? event.metadata.taxonomy_added : [];
+    return [
+      `- Published: [[${event.target.replace(/\.md$/, "")}]]`,
+      `- Taxonomy: ${tax.length > 0 ? `added ${tax.join(", ")}` : "no additions"}`,
+      event.note ? `- Note: ${event.note}` : ""
+    ].filter(Boolean).join("\n");
+  }
+  if (event.kind === "legacy-log-entry" && typeof event.metadata.legacy_markdown === "string") {
+    const legacy = event.metadata.legacy_markdown.trimEnd();
+    if (legacy.includes(marker(event))) return legacy;
+    return `${legacy}
+${marker(event)}`;
+  }
+  if (event.kind === "session-brief" || event.kind === "archive" || event.kind === "remove" || event.kind === "log-entry") {
+    return [
+      `- Target: ${event.target}`,
+      `- Note: ${event.note}`,
+      `- Actor: ${event.actor}`,
+      `- Host: ${event.host_id}`
+    ].join("\n");
+  }
+  return [
+    `- Event kind: ${event.kind}`,
+    `- Actor: ${event.actor}`,
+    `- Host: ${event.host_id}`,
+    `- Target: ${event.target}`,
+    `- Note: ${event.note}`,
+    `- Metadata: ${JSON.stringify(event.metadata)}`
+  ].join("\n");
+}
+function renderLogProjection(events) {
+  const ordered = [...events].sort((a, b) => {
+    if (a.occurred_at !== b.occurred_at) return a.occurred_at < b.occurred_at ? -1 : 1;
+    return a.operation_id < b.operation_id ? -1 : a.operation_id > b.operation_id ? 1 : 0;
+  });
+  const lines = [
+    "# Vault Log",
+    "",
+    "Generated by `skillwiki log materialize` from immutable events.",
+    ""
+  ];
+  for (const event of ordered) {
+    if (event.kind === "legacy-log-entry" && typeof event.metadata.legacy_markdown === "string") {
+      const block = bodyFor(event);
+      lines.push(block.endsWith("\n") ? block.trimEnd() : block, "");
+      continue;
+    }
+    lines.push(`## [${day(event)}] ${event.kind} | ${event.target}`, "", bodyFor(event), marker(event), "");
+  }
+  return `${lines.join("\n").replace(/\n+$/, "")}
+`;
+}
+
+// src/utils/projection-authority.ts
+function resolveProjectionAuthority(load) {
+  if (!load) {
+    return ok({ authority_host_id: "standalone", current_host_id: "standalone", can_write: true });
+  }
+  const snapshotters = Object.entries(load.manifest.hosts).filter(([, h]) => h.role === "snapshotter").map(([id]) => id);
+  const configured = load.manifest.projection_authority;
+  let authority = configured;
+  if (!authority) {
+    if (snapshotters.length === 1) authority = snapshotters[0];
+    else {
+      return err("PREFLIGHT_FAILED", {
+        reason: "projection-authority-unresolved",
+        snapshotters
+      });
+    }
+  }
+  if (!load.manifest.hosts[authority]) {
+    return err("PREFLIGHT_FAILED", { reason: "projection-authority-unknown-host", authority });
+  }
+  if (load.identityStatus !== "known" || !load.hostId) {
+    return err("PREFLIGHT_FAILED", {
+      reason: "fleet-identity-unresolved",
+      identity_status: load.identityStatus
+    });
+  }
+  return ok({
+    authority_host_id: authority,
+    current_host_id: load.hostId,
+    can_write: load.hostId === authority
+  });
+}
+
+// src/commands/log-materialize.ts
+async function runLogMaterialize(input) {
+  const events = await readLogEvents(input.vault);
+  if (!events.ok) {
+    return { exitCode: ExitCode.SCHEME_REJECTED, result: events };
+  }
+  const text = renderLogProjection(events.data);
+  let current = "";
+  try {
+    current = readFileSync6(join11(input.vault, "log.md"), "utf8");
+  } catch {
+    current = "";
+  }
+  const changed = current !== text;
+  if (!input.write) {
+    return {
+      exitCode: ExitCode.OK,
+      result: ok({
+        changed,
+        dry_run: true,
+        event_count: events.data.length,
+        humanHint: changed ? `dry run: would rewrite log.md (${events.data.length} events)` : `dry run: log.md already canonical (${events.data.length} events)`
+      })
+    };
+  }
+  if (!input.skipAuthority) {
+    const fleet = await loadFleetManifestAndHost({ vault: input.vault, hostId: input.hostId });
+    const auth = resolveProjectionAuthority(fleet);
+    if (!auth.ok) return { exitCode: ExitCode.PREFLIGHT_FAILED, result: auth };
+    if (!auth.data.can_write) {
+      return {
+        exitCode: ExitCode.PREFLIGHT_FAILED,
+        result: err("PREFLIGHT_FAILED", {
+          reason: "projection-authority",
+          authority_host_id: auth.data.authority_host_id,
+          current_host_id: auth.data.current_host_id
+        })
+      };
+    }
+    const guard = await guardProtectedVaultWrite({ vault: input.vault, command: "log materialize" });
+    if (guard.blocked) return { exitCode: guard.exitCode, result: guard.result };
+  }
+  if (!changed) {
+    return {
+      exitCode: ExitCode.OK,
+      result: ok({
+        changed: false,
+        dry_run: false,
+        event_count: events.data.length,
+        humanHint: `log.md already canonical (${events.data.length} events)`
+      })
+    };
+  }
+  const written = await atomicWriteText(join11(input.vault, "log.md"), text);
+  if (!written.ok) return { exitCode: ExitCode.WRITE_FAILED, result: written };
+  const installed = readFileSync6(join11(input.vault, "log.md"), "utf8");
+  if (installed !== text) {
+    return {
+      exitCode: ExitCode.WRITE_FAILED,
+      result: err("WRITE_FAILED", { message: "installed log.md differs from projection" })
+    };
+  }
+  return {
+    exitCode: ExitCode.OK,
+    result: ok({
+      changed: true,
+      dry_run: false,
+      event_count: events.data.length,
+      humanHint: `rewrote log.md (${events.data.length} events)`
+    })
+  };
+}
+
+// src/commands/log-migrate-legacy.ts
+import { readFileSync as readFileSync7 } from "fs";
+import { join as join12 } from "path";
+
+// src/utils/operation-id.ts
+import { createHash as createHash2 } from "crypto";
+function operationId(namespace, parts) {
+  const hash = createHash2("sha256").update(namespace).update("\0");
+  for (const part of parts) hash.update(part).update("\0");
+  return hash.digest("hex");
+}
+
+// src/commands/log-migrate-legacy.ts
+var BLOCK_RE = /^## \[(\d{4}-\d{2}-\d{2})\][^\n]*$/gm;
+var PUBLISH_RE = /<!--\s*skillwiki-page-publish:([a-f0-9]{64})\s*-->/i;
+function splitLegacyBlocks(text) {
+  const matches = [...text.matchAll(BLOCK_RE)];
+  if (matches.length === 0) return [];
+  const out = [];
+  for (let i = 0; i < matches.length; i++) {
+    const m = matches[i];
+    const start = m.index ?? 0;
+    const end = i + 1 < matches.length ? matches[i + 1].index ?? text.length : text.length;
+    const block = text.slice(start, end).replace(/\s+$/, "") + "\n";
+    out.push({ date: m[1], block, ordinal: i });
+  }
+  return out;
+}
+async function runLogMigrateLegacy(input) {
+  let text = "";
+  try {
+    text = readFileSync7(join12(input.vault, "log.md"), "utf8");
+  } catch {
+    return {
+      exitCode: ExitCode.OK,
+      result: ok({
+        planned: 0,
+        created: 0,
+        already_covered: 0,
+        dry_run: !input.write,
+        humanHint: "no root log.md to migrate"
+      })
+    };
+  }
+  const blocks = splitLegacyBlocks(text);
+  let created = 0;
+  let already = 0;
+  for (const b of blocks) {
+    const publish = PUBLISH_RE.exec(b.block)?.[1]?.toLowerCase();
+    const op = publish && /^[0-9a-f]{64}$/.test(publish) ? publish : operationId("skillwiki-legacy-log-v1", [b.date, String(b.ordinal), b.block]);
+    const heading = b.block.split("\n")[0] ?? `## [${b.date}] legacy`;
+    const event = {
+      schema: "skillwiki-log-event/v1",
+      operation_id: op,
+      occurred_at: `${b.date}T00:00:00.000Z`,
+      host_id: input.hostId ?? "standalone",
+      actor: "skillwiki-cli",
+      kind: "legacy-log-entry",
+      target: "log.md",
+      note: heading,
+      metadata: { legacy_markdown: b.block }
+    };
+    if (!input.write) continue;
+    const wrote = await writeLogEvent(input.vault, event);
+    if (!wrote.ok) {
+      if (wrote.error === "EVENT_IDENTITY_COLLISION") {
+        already += 1;
+        continue;
+      }
+      return { exitCode: ExitCode.WRITE_FAILED, result: wrote };
+    }
+    if (wrote.data.created) created += 1;
+    else already += 1;
+  }
+  return {
+    exitCode: ExitCode.OK,
+    result: ok({
+      planned: blocks.length,
+      created: input.write ? created : 0,
+      already_covered: input.write ? already : 0,
+      dry_run: !input.write,
+      humanHint: input.write ? `migrated legacy log: created=${created} already=${already} planned=${blocks.length}` : `dry run: would migrate ${blocks.length} legacy log block(s)`
+    })
+  };
+}
+
+// src/commands/projections-materialize.ts
+import { readFileSync as readFileSync8 } from "fs";
+import { join as join13 } from "path";
+var defaultDeps = {
+  writeText: (path, text) => atomicWriteText(path, text)
+};
+async function runProjectionsMaterialize(input, deps = defaultDeps) {
+  const fleet = await loadFleetManifestAndHost({ vault: input.vault, hostId: input.hostId });
+  const auth = resolveProjectionAuthority(fleet);
+  if (!auth.ok) return { exitCode: ExitCode.PREFLIGHT_FAILED, result: auth };
+  const indexProj = await renderRootIndex({ vault: input.vault });
+  if (!indexProj.ok) return { exitCode: ExitCode.SCHEME_REJECTED, result: indexProj };
+  const events = await readLogEvents(input.vault);
+  if (!events.ok) return { exitCode: ExitCode.SCHEME_REJECTED, result: events };
+  const logText = renderLogProjection(events.data);
+  let curIndex = "";
+  let curLog = "";
+  try {
+    curIndex = readFileSync8(join13(input.vault, "index.md"), "utf8");
+  } catch {
+  }
+  try {
+    curLog = readFileSync8(join13(input.vault, "log.md"), "utf8");
+  } catch {
+  }
+  const indexDrift = curIndex !== indexProj.data.text;
+  const logDrift = curLog !== logText;
+  if (!input.write) {
+    return {
+      exitCode: ExitCode.OK,
+      result: ok({
+        authority_host_id: auth.data.authority_host_id,
+        current_host_id: auth.data.current_host_id,
+        can_write: auth.data.can_write,
+        index_changed: false,
+        log_changed: false,
+        index_drift: indexDrift,
+        log_drift: logDrift,
+        rolled_back: false,
+        dry_run: true,
+        humanHint: `dry run: index_drift=${indexDrift} log_drift=${logDrift} can_write=${auth.data.can_write}`
+      })
+    };
+  }
+  if (!auth.data.can_write) {
+    return {
+      exitCode: ExitCode.PREFLIGHT_FAILED,
+      result: err("PREFLIGHT_FAILED", {
+        reason: "projection-authority",
+        authority_host_id: auth.data.authority_host_id,
+        current_host_id: auth.data.current_host_id,
+        index_drift: indexDrift,
+        log_drift: logDrift
+      })
+    };
+  }
+  const indexPath = join13(input.vault, "index.md");
+  const logPath = join13(input.vault, "log.md");
+  const indexWrite = await deps.writeText(indexPath, indexProj.data.text);
+  if (!indexWrite.ok) return { exitCode: ExitCode.WRITE_FAILED, result: indexWrite };
+  const logWrite = await deps.writeText(logPath, logText);
+  if (!logWrite.ok) {
+    await deps.writeText(indexPath, curIndex);
+    return {
+      exitCode: ExitCode.WRITE_FAILED,
+      result: ok({
+        authority_host_id: auth.data.authority_host_id,
+        current_host_id: auth.data.current_host_id,
+        can_write: true,
+        index_changed: false,
+        log_changed: false,
+        index_drift: indexDrift,
+        log_drift: logDrift,
+        rolled_back: true,
+        dry_run: false,
+        humanHint: "projection materialize rolled back after log write failure"
+      })
+    };
+  }
+  return {
+    exitCode: ExitCode.OK,
+    result: ok({
+      authority_host_id: auth.data.authority_host_id,
+      current_host_id: auth.data.current_host_id,
+      can_write: true,
+      index_changed: indexWrite.data.changed,
+      log_changed: logWrite.data.changed,
+      index_drift: indexDrift,
+      log_drift: logDrift,
+      rolled_back: false,
+      dry_run: false,
+      humanHint: `materialized projections index_changed=${indexWrite.data.changed} log_changed=${logWrite.data.changed}`
+    })
+  };
+}
+
 // src/commands/claim.ts
-import { mkdir as mkdir4, writeFile as writeFile3, readFile as readFile4 } from "fs/promises";
-import { existsSync, statSync } from "fs";
-import { join as join6 } from "path";
+import { mkdir as mkdir5, writeFile as writeFile3, readFile as readFile5 } from "fs/promises";
+import { existsSync as existsSync2, statSync } from "fs";
+import { join as join14 } from "path";
 function extractDate(filename) {
   const m = filename.match(/^(\d{4}-\d{2}-\d{2})/);
   return m?.[1] ?? "";
@@ -785,14 +1803,14 @@ function extractProjectSlug(projectField) {
   return projectField.replace(/^\[\[/, "").replace(/\]\]$/, "").replace(/^"|"$/g, "");
 }
 async function runClaim(input) {
-  if (!existsSync(input.vault) || !statSync(input.vault).isDirectory()) {
+  if (!existsSync2(input.vault) || !statSync(input.vault).isDirectory()) {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { path: input.vault }) };
   }
-  const absTranscript = join6(input.vault, input.transcript);
-  if (!existsSync(absTranscript)) {
+  const absTranscript = join14(input.vault, input.transcript);
+  if (!existsSync2(absTranscript)) {
     return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: input.transcript }) };
   }
-  const content = await readFile4(absTranscript, "utf8");
+  const content = await readFile5(absTranscript, "utf8");
   const fm = extractFrontmatter(content);
   let projectSlug = input.project;
   if (!projectSlug && fm.ok && typeof fm.data.project === "string") {
@@ -804,8 +1822,8 @@ async function runClaim(input) {
       result: err("SCHEME_REJECTED", { message: "No project specified. Use --project or set project in transcript frontmatter." })
     };
   }
-  const projectDir = join6(input.vault, "projects", projectSlug);
-  if (!existsSync(projectDir) || !statSync(projectDir).isDirectory()) {
+  const projectDir = join14(input.vault, "projects", projectSlug);
+  if (!existsSync2(projectDir) || !statSync(projectDir).isDirectory()) {
     return {
       exitCode: ExitCode.PROJECT_NOT_FOUND,
       result: err("PROJECT_NOT_FOUND", { project: projectSlug })
@@ -821,10 +1839,10 @@ async function runClaim(input) {
   }
   const workSlug = input.slug || extractSlugFromFilename(filename);
   const dirName = `${date}-${workSlug}`;
-  const workDir = join6(projectDir, "work", dirName);
+  const workDir = join14(projectDir, "work", dirName);
   const relWorkDir = `projects/${projectSlug}/work/${dirName}`;
   const relSpecPath = `${relWorkDir}/spec.md`;
-  if (existsSync(workDir)) {
+  if (existsSync2(workDir)) {
     return {
       exitCode: ExitCode.OK,
       result: ok({
@@ -835,7 +1853,7 @@ async function runClaim(input) {
       })
     };
   }
-  await mkdir4(workDir, { recursive: true });
+  await mkdir5(workDir, { recursive: true });
   const kind = fm.ok && typeof fm.data.kind === "string" ? fm.data.kind : "task";
   const specLines = [
     "---",
@@ -850,7 +1868,7 @@ async function runClaim(input) {
     `Claimed from ${input.transcript}`,
     ""
   ];
-  await writeFile3(join6(workDir, "spec.md"), specLines.join("\n"), "utf8");
+  await writeFile3(join14(workDir, "spec.md"), specLines.join("\n"), "utf8");
   appendLastOp(input.vault, {
     operation: "claim",
     summary: `claimed ${input.transcript} \u2192 ${relWorkDir}`,
@@ -869,8 +1887,8 @@ async function runClaim(input) {
 }
 
 // src/commands/health.ts
-import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, renameSync, writeFileSync } from "fs";
-import { dirname as dirname4, join as join7, resolve as resolve2 } from "path";
+import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync9, renameSync, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname4, join as join15, resolve as resolve2 } from "path";
 import { platform } from "os";
 function statusFromCounts(counts) {
   if ((counts.error ?? 0) > 0) return "error";
@@ -981,8 +1999,8 @@ function summarizeChecks(checks) {
   };
 }
 function classifyLog(path, id, label, okPattern) {
-  if (!existsSync2(path)) return { id, label, status: "warn", detail: `log file missing: ${path}` };
-  const lines = readFileSync2(path, "utf8").split(/\r?\n/).filter(Boolean);
+  if (!existsSync3(path)) return { id, label, status: "warn", detail: `log file missing: ${path}` };
+  const lines = readFileSync9(path, "utf8").split(/\r?\n/).filter(Boolean);
   if (lines.length === 0) return { id, label, status: "warn", detail: `log file empty: ${path}` };
   const statusLine = [...lines].reverse().find(
     (line) => /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z /.test(line) && (okPattern.test(line) || /\bFAIL\b|\bERROR\b/i.test(line))
@@ -1003,12 +2021,12 @@ function runVaultSyncHealth(home, syncMode) {
     };
   }
   const isMac = platform() === "darwin";
-  const shareDir = isMac ? join7(home, "Library", "Application Support", "vault-sync", "bin") : join7(home, ".local", "share", "vault-sync", "bin");
-  const logDir = isMac ? join7(home, "Library", "Logs") : join7(home, ".local", "state", "vault-sync", "log");
-  const filterPath = join7(home, ".config", "rclone", "wiki-push-filters.txt");
+  const shareDir = isMac ? join15(home, "Library", "Application Support", "vault-sync", "bin") : join15(home, ".local", "share", "vault-sync", "bin");
+  const logDir = isMac ? join15(home, "Library", "Logs") : join15(home, ".local", "state", "vault-sync", "log");
+  const filterPath = join15(home, ".config", "rclone", "wiki-push-filters.txt");
   const checks = [];
-  const pushScript = join7(shareDir, "wiki-push.sh");
-  if (syncMode === "optional" && !existsSync2(pushScript)) {
+  const pushScript = join15(shareDir, "wiki-push.sh");
+  if (syncMode === "optional" && !existsSync3(pushScript)) {
     return {
       status: "pass",
       blocking: false,
@@ -1021,26 +2039,26 @@ function runVaultSyncHealth(home, syncMode) {
       }]
     };
   }
-  checks.push(existsSync2(pushScript) ? { id: "vault_sync_installed", label: "Vault sync installed", status: "pass", detail: `Found: ${pushScript}` } : { id: "vault_sync_installed", label: "Vault sync installed", status: "error", detail: `Script missing: ${pushScript}` });
+  checks.push(existsSync3(pushScript) ? { id: "vault_sync_installed", label: "Vault sync installed", status: "pass", detail: `Found: ${pushScript}` } : { id: "vault_sync_installed", label: "Vault sync installed", status: "error", detail: `Script missing: ${pushScript}` });
   if (isMac) {
-    const pushPlist = join7(home, "Library", "LaunchAgents", "com.karlchow.wiki-push.plist");
-    const fetchPlist = join7(home, "Library", "LaunchAgents", "com.karlchow.wiki-fetch.plist");
-    checks.push(existsSync2(pushPlist) && existsSync2(fetchPlist) ? { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "pass", detail: "launchd unit files present (read-only mode)" } : { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "warn", detail: "launchd unit files missing (read-only mode)" });
+    const pushPlist = join15(home, "Library", "LaunchAgents", "com.karlchow.wiki-push.plist");
+    const fetchPlist = join15(home, "Library", "LaunchAgents", "com.karlchow.wiki-fetch.plist");
+    checks.push(existsSync3(pushPlist) && existsSync3(fetchPlist) ? { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "pass", detail: "launchd unit files present (read-only mode)" } : { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "warn", detail: "launchd unit files missing (read-only mode)" });
     checks.push({ id: "vault_sync_fuse_refresh_job", label: "Vault sync fuse refresh job", status: "pass", detail: "macOS host \u2014 check skipped" });
   } else {
-    const pushTimer = join7(home, ".config", "systemd", "user", "wiki-push.timer");
-    const fetchTimer = join7(home, ".config", "systemd", "user", "wiki-fetch.timer");
-    const fuseTimer = join7(home, ".config", "systemd", "user", "wiki-fuse-refresh.timer");
-    const fuseService = join7(home, ".config", "systemd", "user", "wiki-fuse-refresh.service");
-    checks.push(existsSync2(pushTimer) && existsSync2(fetchTimer) ? { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "pass", detail: "systemd timer unit files present (read-only mode)" } : { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "warn", detail: "systemd timer unit files missing (read-only mode)" });
-    checks.push(existsSync2(fuseTimer) && existsSync2(fuseService) ? { id: "vault_sync_fuse_refresh_job", label: "Vault sync fuse refresh job", status: "pass", detail: "wiki-fuse-refresh unit files present (read-only mode)" } : { id: "vault_sync_fuse_refresh_job", label: "Vault sync fuse refresh job", status: "warn", detail: "wiki-fuse-refresh unit files missing (read-only mode)" });
-  }
-  checks.push(classifyLog(join7(logDir, "wiki-push.log"), "vault_sync_last_push_age", "Vault sync last push recency", /OK push/));
-  checks.push(classifyLog(join7(logDir, "wiki-fetch.log"), "vault_sync_last_fetch_status", "Vault sync last fetch status", /NOTIFY|OK behind|OK/));
-  if (!existsSync2(filterPath)) {
+    const pushTimer = join15(home, ".config", "systemd", "user", "wiki-push.timer");
+    const fetchTimer = join15(home, ".config", "systemd", "user", "wiki-fetch.timer");
+    const fuseTimer = join15(home, ".config", "systemd", "user", "wiki-fuse-refresh.timer");
+    const fuseService = join15(home, ".config", "systemd", "user", "wiki-fuse-refresh.service");
+    checks.push(existsSync3(pushTimer) && existsSync3(fetchTimer) ? { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "pass", detail: "systemd timer unit files present (read-only mode)" } : { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "warn", detail: "systemd timer unit files missing (read-only mode)" });
+    checks.push(existsSync3(fuseTimer) && existsSync3(fuseService) ? { id: "vault_sync_fuse_refresh_job", label: "Vault sync fuse refresh job", status: "pass", detail: "wiki-fuse-refresh unit files present (read-only mode)" } : { id: "vault_sync_fuse_refresh_job", label: "Vault sync fuse refresh job", status: "warn", detail: "wiki-fuse-refresh unit files missing (read-only mode)" });
+  }
+  checks.push(classifyLog(join15(logDir, "wiki-push.log"), "vault_sync_last_push_age", "Vault sync last push recency", /OK push/));
+  checks.push(classifyLog(join15(logDir, "wiki-fetch.log"), "vault_sync_last_fetch_status", "Vault sync last fetch status", /NOTIFY|OK behind|OK/));
+  if (!existsSync3(filterPath)) {
     checks.push({ id: "vault_sync_filter_present", label: "Vault sync filter file present", status: "error", detail: `Filter missing: ${filterPath}` });
   } else {
-    const content = readFileSync2(filterPath, "utf8");
+    const content = readFileSync9(filterPath, "utf8");
     const missing = [
       "remotely-save/data.json",
       ".skillwiki/sync.lock",
@@ -1135,7 +2153,7 @@ function buildHumanHint(report) {
 function writeReport(out, report) {
   mkdirSync(dirname4(out), { recursive: true });
   const tmp = `${out}.tmp-${process.pid}-${Date.now()}`;
-  writeFileSync(tmp, JSON.stringify(ok(report), null, 2) + "\n", "utf8");
+  writeFileSync3(tmp, JSON.stringify(ok(report), null, 2) + "\n", "utf8");
   renameSync(tmp, out);
 }
 function buildIncompleteReport(input, syncMode) {
@@ -1359,12 +2377,12 @@ async function runHealth(input) {
 }
 
 // src/commands/archive.ts
-import { rename as rename2, mkdir as mkdir6, readFile as readFile6, writeFile as writeFile5 } from "fs/promises";
-import { join as join9, dirname as dirname5 } from "path";
+import { rename as rename2, mkdir as mkdir7, readFile as readFile7, writeFile as writeFile5 } from "fs/promises";
+import { join as join17, dirname as dirname5 } from "path";
 
 // src/utils/delete-intent.ts
-import { mkdir as mkdir5, writeFile as writeFile4, readdir as readdir3, readFile as readFile5 } from "fs/promises";
-import { join as join8 } from "path";
+import { mkdir as mkdir6, writeFile as writeFile4, readdir as readdir4, readFile as readFile6 } from "fs/promises";
+import { join as join16 } from "path";
 var DELETE_INTENT_SCHEMA = "vault-delete-intent/v1";
 var DELETE_INTENT_DIR = "meta/delete-intents";
 function normalizeVaultRelPath(path) {
@@ -1395,10 +2413,10 @@ function buildDeleteIntent(input) {
   };
 }
 async function writeDeleteIntent(vault, intent) {
-  const dir = join8(vault, DELETE_INTENT_DIR);
-  await mkdir5(dir, { recursive: true });
+  const dir = join16(vault, DELETE_INTENT_DIR);
+  await mkdir6(dir, { recursive: true });
   const rel = `${DELETE_INTENT_DIR}/${pathToIntentFilename(intent.path)}`;
-  await writeFile4(join8(vault, rel), JSON.stringify(intent, null, 2) + "\n", "utf8");
+  await writeFile4(join16(vault, rel), JSON.stringify(intent, null, 2) + "\n", "utf8");
   return rel;
 }
 
@@ -1436,7 +2454,7 @@ async function runArchive(input) {
   if (!relPath) return { exitCode: ExitCode.ARCHIVE_TARGET_NOT_FOUND, result: err("ARCHIVE_TARGET_NOT_FOUND", { page: input.page }) };
   if (relPath.startsWith("_archive/")) return { exitCode: ExitCode.ARCHIVE_ALREADY_ARCHIVED, result: err("ARCHIVE_ALREADY_ARCHIVED", { page: relPath }) };
   const slug = relPath.replace(/\.md$/, "").split("/").pop();
-  const archivePath = join9("_archive", relPath).replace(/\\/g, "/");
+  const archivePath = join17("_archive", relPath).replace(/\\/g, "/");
   const remoteRoot = normalizeRemoteRoot(input.remote);
   const remoteObjectPath = buildRemoteObjectPath(remoteRoot, relPath);
   let cascade;
@@ -1462,7 +2480,7 @@ async function runArchive(input) {
     const indexRefs = [];
     if (!isRaw) {
       try {
-        const idx = await readFile6(join9(input.vault, "index.md"), "utf8");
+        const idx = await readFile7(join17(input.vault, "index.md"), "utf8");
         idx.split("\n").forEach((line, i) => {
           if (line.includes(`[[${slug}]]`)) indexRefs.push({ line: i + 1, text: line });
         });
@@ -1489,8 +2507,8 @@ async function runArchive(input) {
   }
   if (input.cascade && input.apply && cascade) {
     for (const ref of cascade.source_array_refs) {
-      const absPath = join9(input.vault, ref.page);
-      const text = await readFile6(absPath, "utf8");
+      const absPath = join17(input.vault, ref.page);
+      const text = await readFile7(absPath, "utf8");
       const split = splitFrontmatter(text);
       if (!split.ok) continue;
       const before = split.data.rawFrontmatter;
@@ -1507,23 +2525,21 @@ ${fmRewritten}
       }
     }
   }
-  await mkdir6(dirname5(join9(input.vault, archivePath)), { recursive: true });
+  await mkdir7(dirname5(join17(input.vault, archivePath)), { recursive: true });
+  await rename2(join17(input.vault, relPath), join17(input.vault, archivePath));
   let indexUpdated = false;
   if (!isRaw) {
-    const indexPath = join9(input.vault, "index.md");
-    try {
-      const idx = await readFile6(indexPath, "utf8");
-      const originalLines = idx.split("\n");
-      const filtered = originalLines.filter((l) => !l.includes(`[[${slug}]]`));
-      if (filtered.length !== originalLines.length) {
-        await writeFile5(indexPath, filtered.join("\n"), "utf8");
-        indexUpdated = true;
-      }
-    } catch (e) {
-      if (e instanceof Error && "code" in e && e.code !== "ENOENT") throw e;
+    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-ERFX76U5.js");
+    const before = await readFile7(join17(input.vault, "index.md"), "utf8").catch(() => "");
+    const fullTarget = relPath.replace(/\.md$/, "");
+    const bare = fullTarget.split("/").pop() ?? fullTarget;
+    const hadIndexEntry = before.includes(`[[${fullTarget}]]`) || before.includes(`[[${bare}]]`);
+    const projection = await renderRootIndex2({ vault: input.vault, currentText: before });
+    if (projection.ok && projection.data.text !== before) {
+      const written = await writeRootIndexProjection2(input.vault, projection.data);
+      if (written.ok && written.data.changed && hadIndexEntry) indexUpdated = true;
     }
   }
-  await rename2(join9(input.vault, relPath), join9(input.vault, archivePath));
   const archiveIntent = buildDeleteIntent({
     path: relPath,
     action: "archive",
@@ -1564,8 +2580,8 @@ ${fmRewritten}
 }
 
 // src/commands/remove.ts
-import { unlink as unlink2, readFile as readFile7, writeFile as writeFile6, access } from "fs/promises";
-import { join as join10 } from "path";
+import { unlink as unlink2, access } from "fs/promises";
+import { join as join18 } from "path";
 async function pathExists(abs) {
   try {
     await access(abs);
@@ -1591,7 +2607,7 @@ async function runRemove(input) {
   if (!relPath) {
     try {
       const candidate = normalizeVaultRelPath(input.page);
-      if (await pathExists(join10(input.vault, candidate))) {
+      if (await pathExists(join18(input.vault, candidate))) {
         relPath = candidate;
       }
     } catch {
@@ -1611,22 +2627,7 @@ async function runRemove(input) {
   }
   const remoteRoot = normalizeRemoteRoot(input.remote);
   const remoteObjectPath = buildRemoteObjectPath(remoteRoot, relPath);
-  const slug = relPath.replace(/\.md$/, "").split("/").pop() ?? relPath;
   let indexUpdated = false;
-  if (relPath.endsWith(".md") && !relPath.startsWith("raw/")) {
-    const indexPath = join10(input.vault, "index.md");
-    try {
-      const idx = await readFile7(indexPath, "utf8");
-      const originalLines = idx.split("\n");
-      const filtered = originalLines.filter((l) => !l.includes(`[[${slug}]]`));
-      if (filtered.length !== originalLines.length) {
-        await writeFile6(indexPath, filtered.join("\n"), "utf8");
-        indexUpdated = true;
-      }
-    } catch (e) {
-      if (e instanceof Error && "code" in e && e.code !== "ENOENT") throw e;
-    }
-  }
   const intent = buildDeleteIntent({
     path: relPath,
     action: "remove",
@@ -1635,7 +2636,21 @@ async function runRemove(input) {
     reason: input.reason
   });
   const tombstonePath = await writeDeleteIntent(input.vault, intent);
-  await unlink2(join10(input.vault, relPath));
+  await unlink2(join18(input.vault, relPath));
+  if (relPath.endsWith(".md") && !relPath.startsWith("raw/")) {
+    const { readFile: readFile17 } = await import("fs/promises");
+    const { join: pathJoin } = await import("path");
+    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-ERFX76U5.js");
+    const before = await readFile17(pathJoin(input.vault, "index.md"), "utf8").catch(() => "");
+    const fullTarget = relPath.replace(/\.md$/, "");
+    const bare = fullTarget.split("/").pop() ?? fullTarget;
+    const hadIndexEntry = before.includes(`[[${fullTarget}]]`) || before.includes(`[[${bare}]]`);
+    const projection = await renderRootIndex2({ vault: input.vault, currentText: before });
+    if (projection.ok && projection.data.text !== before) {
+      const written = await writeRootIndexProjection2(input.vault, projection.data);
+      if (written.ok && written.data.changed && hadIndexEntry) indexUpdated = true;
+    }
+  }
   appendLastOp(input.vault, {
     operation: "remove",
     summary: `removed ${relPath} (tombstone ${tombstonePath})`,
@@ -1664,7 +2679,7 @@ async function runRemove(input) {
 }
 
 // src/commands/drift.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 
 // src/utils/fetch.ts
 async function controlledFetch(url, opts) {
@@ -1743,7 +2758,7 @@ async function runDrift(input) {
       });
       continue;
     }
-    const currentHash = createHash2("sha256").update(Buffer.from(resp.data.body, "utf8")).digest("hex");
+    const currentHash = createHash3("sha256").update(Buffer.from(resp.data.body, "utf8")).digest("hex");
     const identity = assessSourceIdentity({
       rawPath: raw.relPath,
       sourceUrl,
@@ -1974,14 +2989,14 @@ ${migratedBody}${newFooter}`;
 
 // src/commands/update.ts
 import { execSync } from "child_process";
-import { join as join11 } from "path";
+import { join as join19 } from "path";
 function resolveGlobalSkillsRoot() {
   try {
     const globalRoot = execSync("npm root -g", {
       encoding: "utf8",
       timeout: 5e3
     }).trim();
-    return join11(globalRoot, "skillwiki", "skills");
+    return join19(globalRoot, "skillwiki", "skills");
   } catch {
     return null;
   }
@@ -2009,7 +3024,7 @@ async function runUpdate(input) {
   const pkg2 = readCliPackageJson();
   const currentVersion = pkg2.version;
   const tag = normalizeDistTag(input.distTag);
-  const target = join11(input.home, ".claude", "skills");
+  const target = join19(input.home, ".claude", "skills");
   let latest;
   try {
     latest = execSync(`npm view skillwiki@${tag} version`, {
@@ -2086,22 +3101,22 @@ async function runUpdate(input) {
 
 // src/commands/self-update.ts
 import { execSync as execSync2 } from "child_process";
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync10 } from "fs";
+import { join as join20 } from "path";
 var DEFAULT_SOURCE_ROOT_SUFFIX = "/Desktop/code/llm-wiki";
 async function runSelfUpdate(input) {
   const currentVersion = readCliPackageJson().version;
   const sourceRoot = input.sourceRoot ?? `${input.home}${DEFAULT_SOURCE_ROOT_SUFFIX}`;
   const distTag = normalizeDistTag(input.distTag);
-  const localPkgPath = join12(sourceRoot, "packages", "cli", "package.json");
-  const hasLocalSource = existsSync3(localPkgPath);
+  const localPkgPath = join20(sourceRoot, "packages", "cli", "package.json");
+  const hasLocalSource = existsSync4(localPkgPath);
   if (input.check) {
     let availableVersion = null;
     let source;
     if (hasLocalSource) {
       source = "local";
       try {
-        availableVersion = JSON.parse(readFileSync3(localPkgPath, "utf8")).version ?? null;
+        availableVersion = JSON.parse(readFileSync10(localPkgPath, "utf8")).version ?? null;
       } catch {
         availableVersion = null;
       }
@@ -2159,7 +3174,7 @@ async function runSelfUpdate(input) {
     }
     const newVersion = (() => {
       try {
-        return JSON.parse(readFileSync3(localPkgPath, "utf8")).version ?? "unknown";
+        return JSON.parse(readFileSync10(localPkgPath, "utf8")).version ?? "unknown";
       } catch {
         return "unknown";
       }
@@ -2225,21 +3240,21 @@ async function runSelfUpdate(input) {
 }
 
 // src/commands/transcripts.ts
-import { readdir as readdir4, stat as stat3, readFile as readFile8 } from "fs/promises";
-import { join as join13 } from "path";
+import { readdir as readdir5, stat as stat3, readFile as readFile9 } from "fs/promises";
+import { join as join21 } from "path";
 async function runTranscripts(input) {
-  const dir = join13(input.vault, "raw", "transcripts");
+  const dir = join21(input.vault, "raw", "transcripts");
   let entries;
   try {
-    entries = await readdir4(dir, { withFileTypes: true });
+    entries = await readdir5(dir, { withFileTypes: true });
   } catch {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: { ok: false, error: "VAULT_PATH_INVALID", detail: `raw/transcripts/ not found: ${dir}` } };
   }
   const transcripts = [];
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-    const filePath = join13(dir, entry.name);
-    const content = await readFile8(filePath, "utf8");
+    const filePath = join21(dir, entry.name);
+    const content = await readFile9(filePath, "utf8");
     const fm = extractFrontmatter(content);
     if (!fm.ok) continue;
     const ingested = typeof fm.data.ingested === "string" ? fm.data.ingested : "";
@@ -2256,10 +3271,10 @@ async function runTranscripts(input) {
 }
 
 // src/commands/compound.ts
-import { writeFile as writeFile7, mkdir as mkdir7, readdir as readdir5, unlink as unlink3 } from "fs/promises";
-import { join as join14 } from "path";
-import { existsSync as existsSync4 } from "fs";
-import { readFile as readFile9 } from "fs/promises";
+import { writeFile as writeFile7, mkdir as mkdir8, readdir as readdir6, unlink as unlink3 } from "fs/promises";
+import { join as join22 } from "path";
+import { existsSync as existsSync5 } from "fs";
+import { readFile as readFile10 } from "fs/promises";
 var RETRO_HEADING_RE = /^## \[(\d{4}-\d{2}-\d{2})(?:\s+[^\]]+)?\] retro \| loop cycle(?: (\d+))?: (.+)$/;
 var FIELD_RE = {
   improve: /^-\s+\*?\*?Improve:?\*?\*?\s*(.+)$/m,
@@ -2357,17 +3372,17 @@ function extractRetroFields(date, cycleName, block) {
   };
 }
 async function runCompound(input) {
-  const logPath = join14(input.vault, "log.md");
+  const logPath = join22(input.vault, "log.md");
   let logText;
   try {
-    logText = await readFile9(logPath, "utf8");
+    logText = await readFile10(logPath, "utf8");
   } catch {
     return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: logPath }) };
   }
   const entries = parseRetroEntries(logText);
   const promoted = [];
   const skipped = [];
-  const compoundDir = join14(input.vault, "projects", input.project, "compound");
+  const compoundDir = join22(input.vault, "projects", input.project, "compound");
   for (const entry of entries) {
     const generalizeValue = entry.generalize.trim();
     if (!/^yes/i.test(generalizeValue)) {
@@ -2375,8 +3390,8 @@ async function runCompound(input) {
       continue;
     }
     const slug = slugify(entry.cycleName);
-    const compoundPath = join14(compoundDir, `${slug}.md`);
-    if (existsSync4(compoundPath)) {
+    const compoundPath = join22(compoundDir, `${slug}.md`);
+    if (existsSync5(compoundPath)) {
       skipped.push(entry.date);
       continue;
     }
@@ -2414,8 +3429,8 @@ async function runCompound(input) {
     ].join("\n");
     const content = frontmatter + "\n" + body;
     if (!input.dryRun) {
-      if (!existsSync4(compoundDir)) {
-        await mkdir7(compoundDir, { recursive: true });
+      if (!existsSync5(compoundDir)) {
+        await mkdir8(compoundDir, { recursive: true });
       }
       await writeFile7(compoundPath, content, "utf8");
     }
@@ -2436,16 +3451,16 @@ async function runCompound(input) {
   };
 }
 async function runCompoundDelete(input) {
-  const projectDir = join14(input.vault, "projects", input.project);
-  if (!existsSync4(projectDir)) {
+  const projectDir = join22(input.vault, "projects", input.project);
+  if (!existsSync5(projectDir)) {
     return {
       exitCode: ExitCode.PROJECT_NOT_FOUND,
       result: err("PROJECT_NOT_FOUND", { slug: input.project, path: projectDir })
     };
   }
   const entryName = input.entry.replace(/\.md$/, "");
-  const compoundPath = join14(projectDir, "compound", `${entryName}.md`);
-  if (!existsSync4(compoundPath)) {
+  const compoundPath = join22(projectDir, "compound", `${entryName}.md`);
+  if (!existsSync5(compoundPath)) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
       result: err("FILE_NOT_FOUND", { path: compoundPath })
@@ -2478,8 +3493,8 @@ knowledge.md regenerated`
   };
 }
 async function runCompoundList(input) {
-  const compoundDir = join14(input.vault, "projects", input.project, "compound");
-  if (!existsSync4(compoundDir)) {
+  const compoundDir = join22(input.vault, "projects", input.project, "compound");
+  if (!existsSync5(compoundDir)) {
     return {
       exitCode: ExitCode.OK,
       result: ok({
@@ -2493,7 +3508,7 @@ no compound directory found`
   }
   let dirents;
   try {
-    dirents = await readdir5(compoundDir, { withFileTypes: true });
+    dirents = await readdir6(compoundDir, { withFileTypes: true });
   } catch {
     return {
       exitCode: ExitCode.OK,
@@ -2509,10 +3524,10 @@ could not read compound directory`
   const entries = [];
   for (const dirent of dirents) {
     if (!dirent.isFile() || !dirent.name.endsWith(".md")) continue;
-    const filePath = join14(compoundDir, dirent.name);
+    const filePath = join22(compoundDir, dirent.name);
     let text;
     try {
-      text = await readFile9(filePath, "utf8");
+      text = await readFile10(filePath, "utf8");
     } catch {
       continue;
     }
@@ -2541,8 +3556,8 @@ no compound entries found`;
 }
 
 // src/commands/session-brief.ts
-import { mkdir as mkdir8, readFile as readFile10, writeFile as writeFile8 } from "fs/promises";
-import { join as join15, relative, sep } from "path";
+import { mkdir as mkdir9, readFile as readFile11, writeFile as writeFile8 } from "fs/promises";
+import { join as join23, relative, sep } from "path";
 var MAX_WORDS = 900;
 async function runSessionBrief(input) {
   const scan = await scanVault(input.vault);
@@ -2642,7 +3657,7 @@ async function resolveProject(input) {
   const envProject = input.env?.SKILLWIKI_PROJECT;
   if (envProject) return envProject;
   const cwd = input.cwd ?? process.cwd();
-  const projectDotenv = await readProjectSlug(join15(cwd, ".skillwiki", ".env"));
+  const projectDotenv = await readProjectSlug(join23(cwd, ".skillwiki", ".env"));
   if (projectDotenv) return projectDotenv;
   const inferred = inferProjectFromPath(input.vault, cwd);
   if (inferred) return inferred;
@@ -2651,7 +3666,7 @@ async function resolveProject(input) {
 async function readProjectSlug(file) {
   let text;
   try {
-    text = await readFile10(file, "utf8");
+    text = await readFile11(file, "utf8");
   } catch {
     return void 0;
   }
@@ -2728,7 +3743,7 @@ async function loadTrendDigests(typedPages) {
   return out;
 }
 async function loadSessionPins(vault, project) {
-  const text = await readIfExists(join15(vault, "meta", "session-pins.md"));
+  const text = await readIfExists(join23(vault, "meta", "session-pins.md"));
   if (!text) return [];
   const fm = extractFrontmatter(text);
   if (!fm.ok) return [];
@@ -2845,7 +3860,7 @@ function satelliteHealthWarnings(warning) {
   return warning ? [warning] : [];
 }
 async function loadHealthWarnings(vault) {
-  const text = await readIfExists(join15(vault, ".skillwiki", "health.json"));
+  const text = await readIfExists(join23(vault, ".skillwiki", "health.json"));
   if (!text) return [];
   try {
     const parsed = JSON.parse(text);
@@ -2858,7 +3873,7 @@ async function loadHealthWarnings(vault) {
   }
 }
 async function loadMemoryTopics(vault, project) {
-  const text = await readIfExists(join15(vault, ".skillwiki", "memory", project, "topics.json"));
+  const text = await readIfExists(join23(vault, ".skillwiki", "memory", project, "topics.json"));
   if (!text) return [];
   try {
     const parsed = JSON.parse(text);
@@ -2875,11 +3890,11 @@ async function loadMemoryTopics(vault, project) {
   }
 }
 async function writeBriefArtifacts(vault, input) {
-  const metaPath = join15(vault, "meta", "latest-session-brief.md");
-  const cacheMdPath = join15(vault, ".skillwiki", "session-brief.md");
-  const cacheJsonPath = join15(vault, ".skillwiki", "session-brief.json");
-  await mkdir8(join15(vault, "meta"), { recursive: true });
-  await mkdir8(join15(vault, ".skillwiki"), { recursive: true });
+  const metaPath = join23(vault, "meta", "latest-session-brief.md");
+  const cacheMdPath = join23(vault, ".skillwiki", "session-brief.md");
+  const cacheJsonPath = join23(vault, ".skillwiki", "session-brief.json");
+  await mkdir9(join23(vault, "meta"), { recursive: true });
+  await mkdir9(join23(vault, ".skillwiki"), { recursive: true });
   const committed = renderCommittedBrief(input);
   const previousComparable = comparableBrief(await readIfExists(metaPath));
   const nextComparable = comparableBrief(committed);
@@ -2894,8 +3909,17 @@ async function writeBriefArtifacts(vault, input) {
     memory_topics: input.memoryTopics
   }, null, 2)}
 `, "utf8");
-  const indexUpdated = await ensureIndexEntry(vault);
-  const logUpdated = materialChange ? await appendMaterialLog(vault, input.today) : false;
+  const indexUpdated = await rebuildRootIndexProjection(vault);
+  let logUpdated = false;
+  if (materialChange) {
+    const log = await runLogAppend({
+      vault,
+      content: `## [${input.today}] session-brief | refreshed: meta/latest-session-brief.md`,
+      strictLock: true,
+      recordLastOp: false
+    });
+    logUpdated = log.result.ok && log.result.data.appended;
+  }
   if (materialChange) {
     appendLastOp(vault, {
       operation: "session-brief",
@@ -2939,37 +3963,18 @@ function renderCommittedBrief(input) {
     ""
   ].filter((line) => line !== "").join("\n");
 }
-async function ensureIndexEntry(vault) {
-  const indexPath = join15(vault, "index.md");
-  let text = await readIfExists(indexPath);
-  if (!text) return false;
-  if (text.includes("[[meta/latest-session-brief]]")) return false;
-  const entry = "- [[meta/latest-session-brief]] \u2014 Latest Session Brief";
-  const lines = text.split(/\r?\n/);
-  const sectionIdx = lines.findIndex((line) => line.trim() === "## Meta");
-  if (sectionIdx === -1) {
-    while (lines.length > 0 && lines[lines.length - 1].trim() === "") lines.pop();
-    lines.push("", "## Meta", entry);
-  } else {
-    let insertAt = sectionIdx + 1;
-    while (insertAt < lines.length && !lines[insertAt].startsWith("## ")) insertAt++;
-    lines.splice(insertAt, 0, entry);
-  }
-  await writeFile8(indexPath, lines.join("\n"), "utf8");
-  return true;
-}
-async function appendMaterialLog(vault, today) {
-  const logPath = join15(vault, "log.md");
-  const text = await readIfExists(logPath);
-  if (!text) return false;
-  const entry = `
-## [${today}] session-brief | refreshed: meta/latest-session-brief.md`;
-  await writeFile8(logPath, text.trimEnd() + entry + "\n", "utf8");
-  return true;
+async function rebuildRootIndexProjection(vault) {
+  const before = await readIfExists(join23(vault, "index.md"));
+  if (!before) return false;
+  const projection = await renderRootIndex({ vault, currentText: before });
+  if (!projection.ok) return false;
+  if (projection.data.text === before) return false;
+  const written = await writeRootIndexProjection(vault, projection.data);
+  return written.ok && written.data.changed;
 }
 async function readIfExists(path) {
   try {
-    return await readFile10(path, "utf8");
+    return await readFile11(path, "utf8");
   } catch {
     return "";
   }
@@ -3011,16 +4016,18 @@ function dateFromPath(path) {
 }
 
 // src/commands/ingest.ts
-import { readFile as readFile12, open, unlink as unlink4, mkdir as mkdir9 } from "fs/promises";
-import { join as join17 } from "path";
+import { readFile as readFile13, open as open2, unlink as unlink4, mkdir as mkdir10 } from "fs/promises";
+import { join as join25 } from "path";
 import { createHash as createHash4 } from "crypto";
 
 // src/commands/page-publish.ts
-import { createHash as createHash3 } from "crypto";
 import { realpathSync } from "fs";
-import { readFile as readFile11 } from "fs/promises";
-import { join as join16, resolve as resolve3 } from "path";
-var DEFAULT_DEPS = { afterStage: async () => void 0 };
+import { readFile as readFile12 } from "fs/promises";
+import { join as join24, resolve as resolve3 } from "path";
+var DEFAULT_DEPS = {
+  afterStage: async () => void 0,
+  preflight: (input) => runManagedWritePreflight(input)
+};
 function errorExitCode(error) {
   switch (error) {
     case "FILE_NOT_FOUND":
@@ -3036,6 +4043,9 @@ function errorExitCode(error) {
       return ExitCode.SENSITIVE_CONTENT_DETECTED;
     case "SYNC_LOCK_HELD":
       return ExitCode.SYNC_LOCK_HELD;
+    case "PREFLIGHT_FAILED":
+      return ExitCode.PREFLIGHT_FAILED;
+    case "EVENT_IDENTITY_COLLISION":
     case "WRITE_FAILED":
       return ExitCode.WRITE_FAILED;
     default:
@@ -3043,7 +4053,11 @@ function errorExitCode(error) {
   }
 }
 function publicationId(target, content, logNote = "") {
-  return createHash3("sha256").update("skillwiki-page-publish-v1\0").update(target).update("\0").update(content).update("\0").update(logNote).digest("hex");
+  return operationId("skillwiki-page-publish-v1", [target, content, logNote]);
+}
+function resolveRootAggregateMode(env = process.env) {
+  if (env.SKILLWIKI_ROOT_AGGREGATE_MODE === "source-only") return "source-only";
+  return "dual";
 }
 function prepareFrozenPublication(input, source) {
   const target = assertTargetInsideVault(input.vault, input.target);
@@ -3079,7 +4093,7 @@ function preparePagePublicationFromContent(input) {
 async function preparePagePublication(input) {
   let content;
   try {
-    content = await readFile11(input.draftPath, "utf8");
+    content = await readFile12(input.draftPath, "utf8");
   } catch (error) {
     return err("FILE_NOT_FOUND", { path: input.draftPath, message: String(error) });
   }
@@ -3150,10 +4164,10 @@ async function runLockedPrimaryStages(input, vault, deps) {
       ExitCode.VAULT_PATH_INVALID
     );
   }
-  const schemaPath = join16(vault, "SCHEMA.md");
+  const schemaPath = join24(vault, "SCHEMA.md");
   let schemaText;
   try {
-    schemaText = await readFile11(schemaPath, "utf8");
+    schemaText = await readFile12(schemaPath, "utf8");
   } catch (error) {
     return lockedFailure("schema", state, err("WRITE_FAILED", { message: String(error) }));
   }
@@ -3183,8 +4197,8 @@ async function runLockedPrimaryStages(input, vault, deps) {
   let visibleSchema;
   try {
     [visible, visibleSchema] = await Promise.all([
-      readFile11(input.targetPath, "utf8"),
-      readFile11(schemaPath, "utf8")
+      readFile12(input.targetPath, "utf8"),
+      readFile12(schemaPath, "utf8")
     ]);
   } catch (error) {
     return lockedFailure("verify", state, err("WRITE_FAILED", { message: String(error) }));
@@ -3237,7 +4251,7 @@ function phaseFailure(stage, input, published, cause, context = {}, exitCode = E
     })
   };
 }
-function successReceipt(input, taxonomyAdded, pageChanged, indexUpdated, logAppended, filesChanged, dryRun = false) {
+function successReceipt(input, taxonomyAdded, pageChanged, indexUpdated, logAppended, filesChanged, dryRun = false, receipt = null) {
   return {
     exitCode: ExitCode.OK,
     result: ok({
@@ -3251,6 +4265,9 @@ function successReceipt(input, taxonomyAdded, pageChanged, indexUpdated, logAppe
       operation_id: input.operationId,
       dry_run: dryRun,
       files_changed: filesChanged,
+      base_oid: receipt?.base_oid ?? null,
+      write_mode: receipt?.mode ?? null,
+      ...receipt?.host_id ? { host_id: receipt.host_id } : {},
       humanHint: dryRun ? `dry run: would publish ${input.page.target} (${input.operationId.slice(0, 12)})` : `published ${input.page.target} (${input.operationId.slice(0, 12)})`
     })
   };
@@ -3266,17 +4283,17 @@ function renderPublicationLog(input, added) {
 }
 async function readPageChanged(targetPath, content) {
   try {
-    return ok(await readFile11(targetPath, "utf8") !== content);
+    return ok(await readFile12(targetPath, "utf8") !== content);
   } catch (error) {
     if (error.code === "ENOENT") return ok(true);
     return err("WRITE_FAILED", { path: targetPath, message: String(error) });
   }
 }
 async function previewPreparedPagePublication(input, vault) {
-  const schemaPath = join16(vault, "SCHEMA.md");
+  const schemaPath = join24(vault, "SCHEMA.md");
   let schemaText;
   try {
-    schemaText = await readFile11(schemaPath, "utf8");
+    schemaText = await readFile12(schemaPath, "utf8");
   } catch (error) {
     const result = err("FILE_NOT_FOUND", { path: schemaPath, message: String(error) });
     return { exitCode: ExitCode.FILE_NOT_FOUND, result };
@@ -3288,10 +4305,10 @@ async function previewPreparedPagePublication(input, vault) {
   if (!reconciled.ok) return { exitCode: errorExitCode(reconciled.error), result: reconciled };
   const pageChanged = await readPageChanged(input.targetPath, input.page.content);
   if (!pageChanged.ok) return { exitCode: errorExitCode(pageChanged.error), result: pageChanged };
-  const indexPath = join16(vault, "index.md");
+  const indexPath = join24(vault, "index.md");
   let indexText;
   try {
-    indexText = await readFile11(indexPath, "utf8");
+    indexText = await readFile12(indexPath, "utf8");
   } catch (error) {
     const result = err("FILE_NOT_FOUND", { path: indexPath, message: String(error) });
     return { exitCode: ExitCode.FILE_NOT_FOUND, result };
@@ -3302,10 +4319,10 @@ async function previewPreparedPagePublication(input, vault) {
     type: input.page.type
   });
   if (!index.ok) return { exitCode: errorExitCode(index.error), result: index };
-  const logPath = join16(vault, "log.md");
+  const logPath = join24(vault, "log.md");
   let logText;
   try {
-    logText = await readFile11(logPath, "utf8");
+    logText = await readFile12(logPath, "utf8");
   } catch (error) {
     const result = err("FILE_NOT_FOUND", { path: logPath, message: String(error) });
     return { exitCode: ExitCode.FILE_NOT_FOUND, result };
@@ -3328,93 +4345,159 @@ async function previewPreparedPagePublication(input, vault) {
   );
 }
 async function publishPreparedPage(input, vault, deps = DEFAULT_DEPS) {
-  let lock;
+  const managed = acquireManagedWriteLock(vault, `page publish ${input.page.target}`);
+  if (!managed.ok) return { exitCode: errorExitCode(managed.error), result: managed };
   try {
-    lock = acquireOwnedSyncLock(vault, {
-      summary: `page publish ${input.page.target}`,
-      ttlMinutes: 1
+    const preflight = await deps.preflight({
+      vault,
+      command: `page publish ${input.page.target}`,
+      lockToken: managed.data.ownerToken
     });
-  } catch (error) {
-    return {
-      exitCode: ExitCode.WRITE_FAILED,
-      result: err("WRITE_FAILED", { stage: "lock", message: String(error) })
-    };
-  }
-  if (!lock.ok) return { exitCode: errorExitCode(lock.error), result: lock };
-  let primary;
-  let released;
-  try {
-    primary = await runLockedPrimaryStages(input, vault, deps);
-  } catch (error) {
-    primary = lockedFailure(
-      "schema",
-      emptyLockedState(),
-      err("WRITE_FAILED", { message: `unexpected primary-stage failure: ${String(error)}` })
-    );
-  } finally {
-    released = releaseOwnedSyncLock(lock.data);
-  }
-  const primaryState = primary?.ok ? primary.data : primary?.state;
-  if (released === void 0 || !released.ok || !released.data.released) {
-    return phaseFailure(
-      "unlock",
-      input,
-      primaryState?.published ?? false,
-      released && !released.ok ? released : err("WRITE_FAILED", { message: "lock release did not run" }),
-      {
-        primary_stage: primary && !primary.ok ? primary.stage : "complete",
-        primary_error: primary && !primary.ok ? primary.cause.error : void 0
+    if (!preflight.result.ok) {
+      return { exitCode: preflight.exitCode, result: preflight.result };
+    }
+    const writeReceipt = preflight.result.data;
+    const aggregateMode = resolveRootAggregateMode();
+    if (writeReceipt.base_oid) {
+      const head = git(vault, ["rev-parse", "HEAD"]);
+      if (head !== writeReceipt.base_oid) {
+        return {
+          exitCode: ExitCode.PREFLIGHT_FAILED,
+          result: err("PREFLIGHT_FAILED", {
+            reason: "base-oid-drift",
+            expected: writeReceipt.base_oid,
+            actual: head
+          })
+        };
       }
-    );
-  }
-  const unlockHook = await observeStage(deps, "unlock");
-  if (unlockHook) return phaseFailure("unlock", input, primaryState?.published ?? false, unlockHook);
-  if (primary === void 0) {
-    return phaseFailure(
-      "schema",
+    }
+    let lock;
+    try {
+      lock = acquireOwnedSyncLock(vault, {
+        summary: `page publish ${input.page.target}`,
+        ttlMinutes: 1
+      });
+    } catch (error) {
+      return {
+        exitCode: ExitCode.WRITE_FAILED,
+        result: err("WRITE_FAILED", { stage: "lock", message: String(error) })
+      };
+    }
+    if (!lock.ok) return { exitCode: errorExitCode(lock.error), result: lock };
+    let primary;
+    let released;
+    try {
+      primary = await runLockedPrimaryStages(input, vault, deps);
+    } catch (error) {
+      primary = lockedFailure(
+        "schema",
+        emptyLockedState(),
+        err("WRITE_FAILED", { message: `unexpected primary-stage failure: ${String(error)}` })
+      );
+    } finally {
+      released = releaseOwnedSyncLock(lock.data);
+    }
+    const primaryState = primary?.ok ? primary.data : primary?.state;
+    if (released === void 0 || !released.ok || !released.data.released) {
+      return phaseFailure(
+        "unlock",
+        input,
+        primaryState?.published ?? false,
+        released && !released.ok ? released : err("WRITE_FAILED", { message: "lock release did not run" }),
+        {
+          primary_stage: primary && !primary.ok ? primary.stage : "complete",
+          primary_error: primary && !primary.ok ? primary.cause.error : void 0
+        }
+      );
+    }
+    const unlockHook = await observeStage(deps, "unlock");
+    if (unlockHook) return phaseFailure("unlock", input, primaryState?.published ?? false, unlockHook);
+    if (primary === void 0) {
+      return phaseFailure(
+        "schema",
+        input,
+        false,
+        err("WRITE_FAILED", { message: "locked publication produced no result" })
+      );
+    }
+    if (!primary.ok) {
+      return phaseFailure(
+        primary.stage,
+        input,
+        primary.state.published,
+        primary.cause,
+        void 0,
+        primary.exitCode
+      );
+    }
+    const state = primary.data;
+    const event = await writeLogEvent(vault, {
+      schema: "skillwiki-log-event/v1",
+      operation_id: input.operationId,
+      occurred_at: `${input.date}T00:00:00.000Z`,
+      host_id: writeReceipt.host_id ?? "standalone",
+      actor: "skillwiki-cli",
+      kind: "page-publish",
+      target: input.page.target,
+      note: input.logNote ?? `Published ${input.page.title}`,
+      metadata: {
+        page_type: input.page.type,
+        // Stable for replay: do not embed schema-delta taxonomy_added (varies after first write).
+        tags: [...input.page.tags].sort(),
+        base_oid: writeReceipt.base_oid
+      }
+    });
+    if (!event.ok) {
+      return phaseFailure(
+        "event",
+        input,
+        true,
+        event,
+        void 0,
+        event.error === "EVENT_IDENTITY_COLLISION" ? ExitCode.WRITE_FAILED : errorExitCode(event.error)
+      );
+    }
+    if (event.data.created) state.changed.add(event.data.path);
+    const eventHook = await observeStage(deps, "event");
+    if (eventHook) return phaseFailure("event", input, true, eventHook);
+    let logAppended = false;
+    if (aggregateMode === "dual" || writeReceipt.mode !== "immutable-record") {
+      if (aggregateMode === "dual") {
+        const log = await runLogAppend({
+          vault,
+          content: renderPublicationLog(input, state.taxonomyAdded),
+          operationId: input.operationId,
+          strictLock: true,
+          recordLastOp: false
+        });
+        if (!log.result.ok) return phaseFailure("log", input, true, log.result);
+        if (log.exitCode !== ExitCode.OK) {
+          return phaseFailure(
+            "log",
+            input,
+            true,
+            err("WRITE_FAILED", { message: "log append returned inconsistent success state" })
+          );
+        }
+        logAppended = log.result.data.appended;
+        if (logAppended) state.changed.add("log.md");
+        const logHook = await observeStage(deps, "log");
+        if (logHook) return phaseFailure("log", input, true, logHook);
+      }
+    }
+    return successReceipt(
       input,
+      state.taxonomyAdded,
+      state.pageChanged,
+      state.indexUpdated,
+      logAppended,
+      [...state.changed],
       false,
-      err("WRITE_FAILED", { message: "locked publication produced no result" })
-    );
-  }
-  if (!primary.ok) {
-    return phaseFailure(
-      primary.stage,
-      input,
-      primary.state.published,
-      primary.cause,
-      void 0,
-      primary.exitCode
-    );
-  }
-  const state = primary.data;
-  const log = await runLogAppend({
-    vault,
-    content: renderPublicationLog(input, state.taxonomyAdded),
-    operationId: input.operationId,
-    strictLock: true,
-    recordLastOp: false
-  });
-  if (!log.result.ok) return phaseFailure("log", input, true, log.result);
-  if (log.exitCode !== ExitCode.OK) {
-    return phaseFailure(
-      "log",
-      input,
-      true,
-      err("WRITE_FAILED", { message: "log append returned inconsistent success state" })
+      writeReceipt
     );
+  } finally {
+    releaseManagedWriteLock(managed.data);
   }
-  if (log.result.data.appended) state.changed.add("log.md");
-  const logHook = await observeStage(deps, "log");
-  if (logHook) return phaseFailure("log", input, true, logHook);
-  return successReceipt(
-    input,
-    state.taxonomyAdded,
-    state.pageChanged,
-    state.indexUpdated,
-    log.result.data.appended,
-    [...state.changed]
-  );
 }
 async function runPagePublish(input, deps = DEFAULT_DEPS) {
   const prepared = await preparePagePublication(input);
@@ -3501,7 +4584,7 @@ function buildTypedContent(title, ingested, type, tags, rawRelPath, provenance)
 }
 async function resolveRawCapture(input) {
   try {
-    const existing = await readFile12(input.path, "utf8");
+    const existing = await readFile13(input.path, "utf8");
     const frontmatter = extractFrontmatter(existing);
     if (!frontmatter.ok) {
       return err("INGEST_VALIDATION_FAILED", {
@@ -3559,7 +4642,7 @@ async function acquireRawCaptureLock(path) {
   const lockPath = `${path}.ingest.lock`;
   for (let attempt = 0; attempt < 200; attempt++) {
     try {
-      const handle = await open(lockPath, "wx");
+      const handle = await open2(lockPath, "wx");
       await handle.close();
       return ok(lockPath);
     } catch (error) {
@@ -3640,7 +4723,7 @@ async function runIngest(input) {
     sourceContent = fetchResult.data.body;
   } else {
     try {
-      sourceContent = await readFile12(input.source, "utf8");
+      sourceContent = await readFile13(input.source, "utf8");
     } catch {
       return {
         exitCode: ExitCode.FILE_NOT_FOUND,
@@ -3665,7 +4748,7 @@ async function runIngest(input) {
   const rawRelPath = `raw/articles/${slug}.md`;
   const typedDir = TYPE_DIR[input.type] ?? `${input.type}s`;
   const typedRelPath = `${typedDir}/${slug}.md`;
-  const rawAbsPath = join17(input.vault, rawRelPath);
+  const rawAbsPath = join25(input.vault, rawRelPath);
   const identity = assessSourceIdentity({
     rawPath: rawRelPath,
     sourceUrl: sourceUrl ?? void 0,
@@ -3709,11 +4792,11 @@ async function runIngest(input) {
   );
   if (!input.dryRun) {
     try {
-      await mkdir9(join17(input.vault, typedDir), { recursive: true });
+      await mkdir10(join25(input.vault, typedDir), { recursive: true });
     } catch (error) {
       return {
         exitCode: ExitCode.WRITE_FAILED,
-        result: err("WRITE_FAILED", { path: join17(input.vault, typedDir), message: String(error) })
+        result: err("WRITE_FAILED", { path: join25(input.vault, typedDir), message: String(error) })
       };
     }
   }
@@ -3760,11 +4843,11 @@ async function runIngest(input) {
     };
   }
   try {
-    await mkdir9(join17(input.vault, "raw", "articles"), { recursive: true });
+    await mkdir10(join25(input.vault, "raw", "articles"), { recursive: true });
   } catch (error) {
     return {
       exitCode: ExitCode.WRITE_FAILED,
-      result: err("WRITE_FAILED", { path: join17(input.vault, "raw", "articles"), message: String(error) })
+      result: err("WRITE_FAILED", { path: join25(input.vault, "raw", "articles"), message: String(error) })
     };
   }
   const rawWrite = await writeResolvedRaw({
@@ -3992,8 +5075,8 @@ ${body}`;
 }
 
 // src/commands/tag-reconcile.ts
-import { readFile as readFile13 } from "fs/promises";
-import { join as join18, posix } from "path";
+import { readFile as readFile14 } from "fs/promises";
+import { join as join26, posix } from "path";
 var TYPED_TARGET_RE = /^(entities|concepts|comparisons|queries|meta)\/[a-z0-9][a-z0-9./_-]*\.md$/;
 function errorExitCode2(error) {
   switch (error) {
@@ -4036,7 +5119,7 @@ function asTagArray(frontmatter, path) {
 async function readTagsFromFile(path) {
   let text;
   try {
-    text = await readFile13(path, "utf8");
+    text = await readFile14(path, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") {
       return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path }) };
@@ -4057,7 +5140,7 @@ async function resolveRequestedTags(input, page) {
       result: err("INVALID_FRONTMATTER", { message: "explicit tags must be an array of strings" })
     };
   }
-  const source = input.from ?? (explicit.length === 0 ? join18(input.vault, page) : void 0);
+  const source = input.from ?? (explicit.length === 0 ? join26(input.vault, page) : void 0);
   if (!source) return { exitCode: ExitCode.OK, result: ok({ tags: [...new Set(explicit)].sort() }) };
   const sourced = await readTagsFromFile(source);
   if (!sourced.result.ok) return { exitCode: sourced.exitCode, result: sourced.result };
@@ -4068,7 +5151,7 @@ async function resolveRequestedTags(input, page) {
 }
 async function readSchema(schemaPath) {
   try {
-    return { exitCode: ExitCode.OK, result: ok(await readFile13(schemaPath, "utf8")) };
+    return { exitCode: ExitCode.OK, result: ok(await readFile14(schemaPath, "utf8")) };
   } catch (error) {
     if (error.code === "ENOENT") {
       return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: schemaPath }) };
@@ -4096,7 +5179,7 @@ function previewResult(page, tags, reconciled, dryRun, filesChanged) {
   };
 }
 async function reconcileTagsWhileLocked(input, page, tags, comment) {
-  const schemaPath = join18(input.vault, "SCHEMA.md");
+  const schemaPath = join26(input.vault, "SCHEMA.md");
   const current = await readSchema(schemaPath);
   if (!current.result.ok) return { exitCode: current.exitCode, result: current.result };
   const next = reconcileTaxonomyDocument(current.result.data, { tags, comment });
@@ -4107,7 +5190,7 @@ async function reconcileTagsWhileLocked(input, page, tags, comment) {
   }
   let verifiedText;
   try {
-    verifiedText = await readFile13(schemaPath, "utf8");
+    verifiedText = await readFile14(schemaPath, "utf8");
   } catch (error) {
     return {
       exitCode: ExitCode.WRITE_FAILED,
@@ -4133,7 +5216,7 @@ async function runTagReconcile(input) {
   const comment = taxonomyCommentForPage(page.data, date, input.reason);
   if (!comment.ok) return { exitCode: ExitCode.SCHEME_REJECTED, result: comment };
   if (!input.write) {
-    const schema = await readSchema(join18(input.vault, "SCHEMA.md"));
+    const schema = await readSchema(join26(input.vault, "SCHEMA.md"));
     if (!schema.result.ok) return { exitCode: schema.exitCode, result: schema.result };
     const preview = reconcileTaxonomyDocument(schema.result.data, { tags, comment: comment.data });
     return previewResult(page.data, tags, preview, true, []);
@@ -4185,22 +5268,9 @@ async function runTagReconcile(input) {
 }
 
 // src/commands/sync.ts
-import { existsSync as existsSync5 } from "fs";
-import { join as join19 } from "path";
-import { execFileSync as execFileSync2 } from "child_process";
-
-// src/utils/git.ts
-import { execFileSync } from "child_process";
-function git(cwd, args) {
-  try {
-    return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim();
-  } catch {
-    return "";
-  }
-}
-function gitStrict(cwd, args) {
-  return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim();
-}
+import { existsSync as existsSync6 } from "fs";
+import { join as join27 } from "path";
+import { execFileSync as execFileSync3 } from "child_process";
 
 // src/utils/vault-git-pathspec.ts
 var VAULT_GENERATED_COMMIT_PATHS = [
@@ -4241,7 +5311,7 @@ function isTrackedNotePath(path) {
 }
 function refHasPath(vault, ref, path) {
   try {
-    execFileSync2("git", ["cat-file", "-e", `${ref}:${path}`], {
+    execFileSync3("git", ["cat-file", "-e", `${ref}:${path}`], {
       cwd: vault,
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -4253,7 +5323,7 @@ function refHasPath(vault, ref, path) {
 function runSyncStatus(input) {
   const vault = input.vault;
   const includeStashes = input.includeStashes ?? false;
-  if (!existsSync5(join19(vault, ".git"))) {
+  if (!existsSync6(join27(vault, ".git"))) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: ok({
@@ -4360,7 +5430,7 @@ function runSyncStatus(input) {
 }
 async function runSyncPush(input) {
   const vault = input.vault;
-  if (!existsSync5(join19(vault, ".git"))) {
+  if (!existsSync6(join27(vault, ".git"))) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: err("NOT_A_GIT_REPO", { path: vault })
@@ -4520,100 +5590,44 @@ function enableGitLongPathsOnWindows(vault) {
 }
 async function runSyncPull(input) {
   const vault = input.vault;
-  if (!existsSync5(join19(vault, ".git"))) {
+  if (!existsSync6(join27(vault, ".git"))) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: err("NOT_A_GIT_REPO", { path: vault })
     };
   }
   enableGitLongPathsOnWindows(vault);
-  let fetched = false;
-  try {
-    gitStrict(vault, ["fetch", "origin"]);
-    fetched = true;
-  } catch (e) {
+  const remoteUrl = git(vault, ["remote", "get-url", "origin"]);
+  if (!remoteUrl) {
     return {
       exitCode: ExitCode.SYNC_PULL_FAILED,
-      result: err("GIT_FETCH_FAILED", { message: String(e) })
+      result: err("GIT_PULL_FAILED", { message: "no remote configured (origin)" })
     };
   }
-  let pulled = false;
-  let conflicts = 0;
-  let filesUpdated = 0;
-  let autoResolved = 0;
-  try {
-    const pullOutput = gitStrict(vault, ["pull", "--rebase", "origin", "HEAD"]);
-    pulled = true;
-    const fileMatch = pullOutput.match(/(\d+) file[s]? changed/);
-    if (fileMatch) filesUpdated = parseInt(fileMatch[1], 10);
-  } catch (e) {
-    const errString = String(e);
-    if (errString.includes("conflict")) {
-      let inConflict = true;
-      while (inConflict) {
-        const stoppedSha = git(vault, ["rev-parse", "--verify", "REBASE_HEAD"]);
-        let commitMsg = "";
-        if (stoppedSha) {
-          commitMsg = git(vault, ["log", "--format=%s", "-1", stoppedSha]);
-        }
-        const isArchiveOrSnapshot = commitMsg.startsWith("archive: moved") || commitMsg.startsWith("Snapshot ");
-        const conflictedFiles = git(vault, ["diff", "--name-only", "--diff-filter=U"]);
-        const conflictedList = conflictedFiles ? conflictedFiles.split("\n").filter((l) => l.trim().length > 0) : [];
-        if (conflictedList.length === 0) {
-          try {
-            gitStrict(vault, ["rebase", "--continue"]);
-            inConflict = true;
-          } catch {
-            inConflict = false;
-          }
-          continue;
-        }
-        if (isArchiveOrSnapshot) {
-          for (const f of conflictedList) {
-            try {
-              gitStrict(vault, ["checkout", "--ours", f]);
-              gitStrict(vault, ["add", f]);
-            } catch {
-            }
-          }
-          autoResolved += conflictedList.length;
-          try {
-            gitStrict(vault, ["rebase", "--continue"]);
-          } catch (continueErr) {
-            continue;
-          }
-        } else {
-          conflicts = conflictedList.length;
-          return {
-            exitCode: ExitCode.SYNC_PULL_FAILED,
-            result: ok({
-              fetched,
-              pulled: false,
-              files_updated: 0,
-              conflicts,
-              auto_resolved: 0,
-              lint_errors: 0,
-              lint_warnings: 0,
-              humanHint: `pull failed with ${conflicts} conflict(s) on non-archive commit "${commitMsg}" \u2014 resolve manually`
-            })
-          };
-        }
-      }
-      if (autoResolved > 0) {
-        const diffOutput = git(vault, ["diff", "--stat", "HEAD@{1}..HEAD"]);
-        if (diffOutput) {
-          const fileMatch = diffOutput.match(/(\d+) file[s]? changed/);
-          if (fileMatch) filesUpdated = parseInt(fileMatch[1], 10);
-        }
-        pulled = true;
-        conflicts = 0;
-      }
-    } else {
+  const helper = await runVaultSyncPullHelper({ vault, remote: "origin", branch: "main" });
+  if (!helper.ok) {
+    if (helper.error === "PREFLIGHT_FAILED") {
       return {
-        exitCode: ExitCode.SYNC_PULL_FAILED,
-        result: err("GIT_PULL_FAILED", { message: errString })
+        exitCode: ExitCode.PREFLIGHT_FAILED,
+        result: err("PREFLIGHT_FAILED", helper.detail)
       };
     }
+    return {
+      exitCode: ExitCode.SYNC_PULL_FAILED,
+      result: err("GIT_PULL_FAILED", helper.detail)
+    };
+  }
+  const fetched = true;
+  const pulled = helper.data.changed;
+  const conflicts = 0;
+  const autoResolved = 0;
+  let filesUpdated = 0;
+  if (helper.data.changed) {
+    const diffOutput = git(vault, ["diff", "--stat", `${helper.data.before_oid}..${helper.data.after_oid}`]);
+    if (diffOutput) {
+      const fileMatch = diffOutput.match(/(\d+) file[s]? changed/);
+      if (fileMatch) filesUpdated = parseInt(fileMatch[1], 10);
+    }
   }
   const pathFix = await fixPathTooLong({ vault });
   const pathFixCount = pathFix.result.ok ? pathFix.result.data.fixed.length : 0;
@@ -4626,8 +5640,7 @@ async function runSyncPull(input) {
   }
   const hintParts = [];
   if (filesUpdated > 0) hintParts.push(`updated ${filesUpdated} file(s)`);
-  else hintParts.push("already up to date");
-  if (autoResolved > 0) hintParts.push(`${autoResolved} conflict(s) auto-resolved`);
+  else hintParts.push(pulled ? "pulled via vault-sync helper" : "already up to date");
   if (pathFixCount > 0) hintParts.push(`${pathFixCount} long path(s) fixed`);
   if (lintErrors > 0) hintParts.push(`${lintErrors} lint error(s)`);
   if (lintWarnings > 0) hintParts.push(`${lintWarnings} lint warning(s)`);
@@ -4692,7 +5705,7 @@ function runSyncPeers(input) {
 }
 function runSyncLock(input) {
   const vault = input.vault;
-  if (!existsSync5(vault)) {
+  if (!existsSync6(vault)) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: err("VAULT_PATH_INVALID", { path: vault })
@@ -4727,7 +5740,7 @@ function runSyncLock(input) {
 }
 function runSyncUnlock(input) {
   const vault = input.vault;
-  if (!existsSync5(vault)) {
+  if (!existsSync6(vault)) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: err("VAULT_PATH_INVALID", { path: vault })
@@ -4760,8 +5773,8 @@ function runSyncUnlock(input) {
 }
 
 // src/commands/backup.ts
-import { statSync as statSync2, readdirSync, readFileSync as readFileSync4, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
-import { join as join20, relative as relative2, dirname as dirname6 } from "path";
+import { statSync as statSync2, readdirSync, readFileSync as readFileSync11, mkdirSync as mkdirSync2, writeFileSync as writeFileSync4 } from "fs";
+import { join as join28, relative as relative2, dirname as dirname6 } from "path";
 import { PutObjectCommand, HeadObjectCommand, ListObjectsV2Command, GetObjectCommand, DeleteObjectsCommand } from "@aws-sdk/client-s3";
 
 // src/utils/s3-client.ts
@@ -4785,7 +5798,7 @@ var SKIP_DIRS = /* @__PURE__ */ new Set([".git", ".obsidian", "_archive", "node_
 function* walkMarkdown(dir, base) {
   for (const entry of readdirSync(dir, { withFileTypes: true })) {
     if (SKIP_DIRS.has(entry.name)) continue;
-    const full = join20(dir, entry.name);
+    const full = join28(dir, entry.name);
     if (entry.isDirectory()) {
       yield* walkMarkdown(full, base);
     } else if (entry.name.endsWith(".md")) {
@@ -4808,7 +5821,7 @@ async function runBackupSync(input) {
   let failed = 0;
   const files = [...walkMarkdown(input.vault, input.vault)];
   for (const relPath of files) {
-    const absPath = join20(input.vault, relPath);
+    const absPath = join28(input.vault, relPath);
     const localStat = statSync2(absPath);
     let needsUpload = true;
     try {
@@ -4827,7 +5840,7 @@ async function runBackupSync(input) {
       continue;
     }
     try {
-      const body = readFileSync4(absPath);
+      const body = readFileSync11(absPath);
       await client.send(new PutObjectCommand({ Bucket: input.bucket, Key: relPath, Body: body }));
       uploaded++;
     } catch {
@@ -4884,7 +5897,7 @@ async function runBackupRestore(input) {
     const objects = list.Contents ?? [];
     for (const obj of objects) {
       if (!obj.Key) continue;
-      const localPath = join20(target, obj.Key);
+      const localPath = join28(target, obj.Key);
       try {
         const localStat = statSync2(localPath);
         if (obj.LastModified && localStat.mtime > obj.LastModified) {
@@ -4898,7 +5911,7 @@ async function runBackupRestore(input) {
         const body = await resp.Body?.transformToByteArray();
         if (body) {
           mkdirSync2(dirname6(localPath), { recursive: true });
-          writeFileSync2(localPath, Buffer.from(body));
+          writeFileSync4(localPath, Buffer.from(body));
           downloaded++;
         }
       } catch {
@@ -4930,11 +5943,11 @@ async function runBackupRestore(input) {
 }
 
 // src/commands/status.ts
-import { existsSync as existsSync6, statSync as statSync3 } from "fs";
-import { readFile as readFile14 } from "fs/promises";
-import { join as join21 } from "path";
+import { existsSync as existsSync7, statSync as statSync3 } from "fs";
+import { readFile as readFile15 } from "fs/promises";
+import { join as join29 } from "path";
 async function runStatus(input) {
-  if (!existsSync6(input.vault)) {
+  if (!existsSync7(input.vault)) {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { vault: input.vault }) };
   }
   const scan = await scanVault(input.vault);
@@ -4959,7 +5972,7 @@ async function runStatus(input) {
   const compound = scan.data.compound.length;
   let schemaVersion = "v1";
   try {
-    const schemaContent = await readFile14(join21(input.vault, "SCHEMA.md"), "utf8");
+    const schemaContent = await readFile15(join29(input.vault, "SCHEMA.md"), "utf8");
     const versionMatch = schemaContent.match(/version:\s*["']?([^"'\s\n]+)/i);
     if (versionMatch) schemaVersion = versionMatch[1];
   } catch {
@@ -5019,8 +6032,8 @@ async function runStatus(input) {
 }
 
 // src/commands/seed.ts
-import { mkdir as mkdir10, writeFile as writeFile9, stat as stat4 } from "fs/promises";
-import { join as join22 } from "path";
+import { mkdir as mkdir11, writeFile as writeFile9, stat as stat4 } from "fs/promises";
+import { join as join30 } from "path";
 var TODAY = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
 var EXAMPLE_PAGES = {
   "entities/example-project.md": `---
@@ -5089,29 +6102,29 @@ Real sources are immutable after ingestion \u2014 never edit them.
 `;
 async function runSeed(input) {
   try {
-    await stat4(join22(input.vault, "SCHEMA.md"));
+    await stat4(join30(input.vault, "SCHEMA.md"));
   } catch {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { root: input.vault, reason: "SCHEMA.md missing \u2014 run `skillwiki init` first" }) };
   }
   const created = [];
   const skipped = [];
   for (const [relPath, content] of Object.entries(EXAMPLE_PAGES)) {
-    const absPath = join22(input.vault, relPath);
+    const absPath = join30(input.vault, relPath);
     try {
       await stat4(absPath);
       skipped.push(relPath);
     } catch {
-      await mkdir10(join22(absPath, ".."), { recursive: true });
+      await mkdir11(join30(absPath, ".."), { recursive: true });
       await writeFile9(absPath, content, "utf8");
       created.push(relPath);
     }
   }
-  const rawPath = join22(input.vault, "raw", "articles", "example-source.md");
+  const rawPath = join30(input.vault, "raw", "articles", "example-source.md");
   try {
     await stat4(rawPath);
     skipped.push("raw/articles/example-source.md");
   } catch {
-    await mkdir10(join22(rawPath, ".."), { recursive: true });
+    await mkdir11(join30(rawPath, ".."), { recursive: true });
     await writeFile9(rawPath, EXAMPLE_RAW, "utf8");
     created.push("raw/articles/example-source.md");
   }
@@ -5134,9 +6147,9 @@ async function runSeed(input) {
 }
 
 // src/commands/canvas.ts
-import { readFile as readFile15, writeFile as writeFile10 } from "fs/promises";
-import { existsSync as existsSync7 } from "fs";
-import { join as join23 } from "path";
+import { readFile as readFile16, writeFile as writeFile10 } from "fs/promises";
+import { existsSync as existsSync8 } from "fs";
+import { join as join31 } from "path";
 var NODE_WIDTH = 240;
 var NODE_HEIGHT = 60;
 var COLUMN_SPACING = 400;
@@ -5214,8 +6227,8 @@ function buildCanvasEdges(adjacency) {
   return edges;
 }
 async function runCanvasGenerate(input) {
-  const graphPath = input.graphPath ?? join23(input.vault, ".skillwiki", "graph.json");
-  if (!existsSync7(graphPath)) {
+  const graphPath = input.graphPath ?? join31(input.vault, ".skillwiki", "graph.json");
+  if (!existsSync8(graphPath)) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
       result: err("FILE_NOT_FOUND", {
@@ -5226,7 +6239,7 @@ async function runCanvasGenerate(input) {
   }
   let raw;
   try {
-    raw = await readFile15(graphPath, "utf8");
+    raw = await readFile16(graphPath, "utf8");
   } catch (e) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
@@ -5252,7 +6265,7 @@ async function runCanvasGenerate(input) {
   const nodes = buildCanvasNodes(paths);
   const edges = buildCanvasEdges(graph.adjacency);
   const canvas = { nodes, edges };
-  const outPath = join23(input.vault, "vault-graph.canvas");
+  const outPath = join31(input.vault, "vault-graph.canvas");
   try {
     await writeFile10(outPath, JSON.stringify(canvas, null, 2));
   } catch (e) {
@@ -5274,15 +6287,15 @@ written: ${outPath}`
 }
 
 // src/commands/fleet-health.ts
-import { existsSync as existsSync8, readFileSync as readFileSync5 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync12 } from "fs";
 import { execSync as nodeExecSync } from "child_process";
 import { hostname as nodeHostname, platform as nodePlatform } from "os";
-import { join as join24 } from "path";
+import { join as join32 } from "path";
 var SSH_TIMEOUT_MS = 15e3;
 var TIMER_UNIT = "agent-memory-trends.timer";
 var SERVICE_UNIT = "agent-memory-trends.service";
 var SYSTEMD_SERVICE_FAILED_CLASS = "SYSTEMD_SERVICE_FAILED";
-function defaultDeps() {
+function defaultDeps2() {
   return {
     platform: () => nodePlatform(),
     execSync: nodeExecSync
@@ -5374,9 +6387,9 @@ function applyServiceFailedOverlay(run, serviceFailed) {
 function probeLocal(vaultPath, deps) {
   const latestPath = satelliteLatestRunPath(vaultPath);
   let parsed = null;
-  if (existsSync8(latestPath)) {
+  if (existsSync9(latestPath)) {
     try {
-      const wire = readSatelliteLatestRunFromText(readFileSync5(latestPath, "utf8"));
+      const wire = readSatelliteLatestRunFromText(readFileSync12(latestPath, "utf8"));
       if (wire) {
         parsed = {
           status: wire.status,
@@ -5502,12 +6515,12 @@ function rowHealthy(reachable, timer, runUnhealthy, timerBad, platform2) {
   return true;
 }
 async function runFleetHealth(input) {
-  const deps = input.deps ?? defaultDeps();
+  const deps = input.deps ?? defaultDeps2();
   const env = input.env ?? process.env;
   const home = input.home ?? env.HOME ?? "";
   const osHostname = input.osHostname ?? env.HOSTNAME ?? nodeHostname();
   const vault = input.vault ?? env.WIKI_PATH;
-  const file = input.file ?? (vault ? join24(vault, FLEET_REL_PATH) : void 0);
+  const file = input.file ?? (vault ? join32(vault, FLEET_REL_PATH) : void 0);
   if (!file) {
     return {
       exitCode: ExitCode.NO_VAULT_CONFIGURED,
@@ -5591,15 +6604,15 @@ async function runFleetHealth(input) {
 }
 
 // src/utils/auto-commit.ts
-import { existsSync as existsSync9 } from "fs";
-import { join as join25 } from "path";
+import { existsSync as existsSync10 } from "fs";
+import { join as join33 } from "path";
 async function postCommit(vault, exitCode) {
   if (exitCode !== 0) return;
   const home = process.env.HOME ?? "";
   const dotenv = await parseDotenvFile(configPath(home));
   const autoCommit = process.env.AUTO_COMMIT ?? dotenv["AUTO_COMMIT"];
   if (autoCommit === "false") return;
-  if (!existsSync9(join25(vault, ".git"))) return;
+  if (!existsSync10(join33(vault, ".git"))) return;
   const lastOps = readLastOp(vault);
   if (lastOps.length === 0) return;
   const porcelain = git(vault, ["status", "--porcelain", "--", ...VAULT_COMMIT_PATHSPEC]);
@@ -5622,103 +6635,6 @@ async function postCommit(vault, exitCode) {
   clearLastOp(vault);
 }
 
-// src/utils/protected-vault-write-guard.ts
-import { readFileSync as readFileSync6 } from "fs";
-import { join as join26, resolve as resolvePath } from "path";
-async function guardProtectedVaultWrite(input) {
-  const env = input.env ?? process.env;
-  const home = input.home ?? process.env.HOME ?? "";
-  const cwd = input.cwd ?? process.cwd();
-  const liveVaultPath = await resolveLiveVaultPath({ env, home, cwd });
-  const load = await loadFleetManifestAndHost({
-    vault: liveVaultPath ?? input.vault,
-    hostId: input.hostId,
-    env,
-    home,
-    cwd,
-    osHostname: input.osHostname ?? process.env.HOSTNAME,
-    user: input.user ?? process.env.USER
-  });
-  if (!load?.hostId || load.identityStatus !== "known") {
-    return { blocked: false };
-  }
-  const host = load.manifest.hosts[load.hostId];
-  if (!host || host.role !== "snapshotter" || host.protected !== true) {
-    return { blocked: false };
-  }
-  const snapshotWorktree = resolveSnapshotWorktree(home);
-  const targetVault = resolvePath(input.vault);
-  const canonicalLiveVault = liveVaultPath ? resolvePath(liveVaultPath) : void 0;
-  const canonicalSnapshotWorktree = snapshotWorktree ? resolvePath(snapshotWorktree) : void 0;
-  if (canonicalLiveVault && targetVault === canonicalLiveVault) {
-    return { blocked: false };
-  }
-  if (canonicalSnapshotWorktree && targetVault === canonicalSnapshotWorktree) {
-    return {
-      blocked: true,
-      exitCode: ExitCode.PROTECTED_SNAPSHOTTER_WRITE_BLOCKED,
-      result: err("PROTECTED_SNAPSHOTTER_WRITE_BLOCKED", {
-        host_id: load.hostId,
-        command: input.command,
-        reason: `refusing mutation of snapshot worktree '${canonicalSnapshotWorktree}' on protected snapshotter host '${load.hostId}'`,
-        guidance: canonicalLiveVault ? `Use the live vault path '${canonicalLiveVault}' for authoring. Keep snapshot worktrees read-only except explicit snapshot maintenance.` : "Use the live skillwiki vault path for authoring. Keep snapshot worktrees read-only except explicit snapshot maintenance."
-      })
-    };
-  }
-  if (canonicalLiveVault && targetVault !== canonicalLiveVault) {
-    return {
-      blocked: true,
-      exitCode: ExitCode.PROTECTED_SNAPSHOTTER_WRITE_BLOCKED,
-      result: err("PROTECTED_SNAPSHOTTER_WRITE_BLOCKED", {
-        host_id: load.hostId,
-        command: input.command,
-        reason: `refusing vault mutation outside the live vault path '${canonicalLiveVault}' on protected snapshotter host '${load.hostId}'`,
-        guidance: "Use the resolved live skillwiki vault path for authoring. Keep alternate vault roots and snapshot worktrees read-only unless explicitly approved."
-      })
-    };
-  }
-  return { blocked: false };
-}
-async function resolveLiveVaultPath(input) {
-  const resolved = await resolveRuntimePath({
-    flag: void 0,
-    envValue: input.env.WIKI_PATH,
-    wikiEnv: input.env.WIKI,
-    home: input.home,
-    cwd: input.cwd
-  });
-  return resolved.ok ? resolved.data.path : void 0;
-}
-function resolveSnapshotWorktree(home) {
-  const skillwikiEnv = join26(home, ".skillwiki", ".env");
-  const explicitWorktree = readEnvKey(skillwikiEnv, ["vault_sync.snapshot_worktree"]);
-  if (explicitWorktree) return explicitWorktree;
-  const snapshotProfile = readEnvKey(skillwikiEnv, ["vault_sync.snapshot_profile"]);
-  if (snapshotProfile) {
-    const fromProfile = readEnvKey(snapshotProfile, ["WIKI_GIT_WORKTREE", "SNAPSHOT_WORKTREE", "GIT_DIR"]);
-    if (fromProfile) return fromProfile;
-  }
-  return "/root/wiki-git";
-}
-function readEnvKey(path, keys) {
-  try {
-    const content = readFileSync6(path, "utf8");
-    for (const line of content.split(/\r?\n/)) {
-      const trimmed = line.trim();
-      if (trimmed.length === 0 || trimmed.startsWith("#")) continue;
-      const eq = trimmed.indexOf("=");
-      if (eq <= 0) continue;
-      const key = trimmed.slice(0, eq).trim();
-      if (!keys.includes(key)) continue;
-      const value = trimmed.slice(eq + 1).trim();
-      if (value.length > 0) return value;
-    }
-  } catch {
-    return void 0;
-  }
-  return void 0;
-}
-
 // src/cli.ts
 var pkg = readCliPackageJson();
 var program = new Command();
@@ -5745,6 +6661,28 @@ async function emitGuardedVaultWrite(vault, command, run, opts) {
   }
   return emit(await run(), vault, opts);
 }
+async function emitManagedVaultWrite(vault, command, mutate, opts) {
+  const guard = await guardProtectedVaultWrite({
+    vault,
+    command,
+    env: process.env,
+    home: process.env.HOME ?? "",
+    cwd: process.cwd(),
+    osHostname: process.env.HOSTNAME,
+    user: process.env.USER
+  });
+  if (guard.blocked) {
+    return emit({ exitCode: guard.exitCode, result: guard.result }, void 0, { postCommit: false });
+  }
+  const { runManagedWriteTransaction: runManagedWriteTransaction2 } = await import("./managed-write-preflight-SILEUQEV.js");
+  const run = await runManagedWriteTransaction2({
+    vault,
+    command,
+    allowImmutableRecord: opts?.allowImmutableRecord === true,
+    mutate: async (receipt) => await mutate(receipt)
+  });
+  return emit(run, vault, opts);
+}
 program.command("hash <file>").description("compute SHA-256 hash of a vault page body").action(async (file) => emit(await runHash({ file })));
 program.command("fetch-guard <url>").description("check if a URL passes fetch guard rules and sanitize secrets").action(async (url) => emit(await runFetchGuard({ url })));
 program.command("validate <file>").description("validate vault page frontmatter against its detected schema").option("--apply", "auto-update vault index.md and log.md after successful validation", false).option("--vault <dir>", "vault root directory (required with --apply)").option("--wiki <name>", "wiki profile name").action(async (file, opts) => {
@@ -5755,12 +6693,12 @@ program.command("validate <file>").description("validate vault page frontmatter
     else vault = v.vault;
   }
   if (opts.apply && vault) {
-    return emitGuardedVaultWrite(vault, "validate --apply", () => runValidate({ file, apply: true, vault }), void 0);
+    return emitManagedVaultWrite(vault, "validate --apply", () => runValidate({ file, apply: true, vault }), void 0);
   }
   emit(await runValidate({ file, apply: !!opts.apply, vault }), vault);
 });
 program.command("graph").description("graph subcommands").command("build <vault>").option("--out <path>", "graph output path (default: <vault>/.skillwiki/graph.json)").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
-  const out = opts.out ?? join27(vault, ".skillwiki", "graph.json");
+  const out = opts.out ?? join34(vault, ".skillwiki", "graph.json");
   return emitGuardedVaultWrite(vault, "graph build", () => runGraphBuild({ vault, out }));
 });
 var canvasCmd = program.command("canvas").description("manage Obsidian canvas files");
@@ -5893,6 +6831,12 @@ pageCmd.command("publish <draft> [vault]").description("preview or publish an un
     { postCommit: false }
   );
 });
+var indexCmd = program.command("index").description("root index projection and checks");
+indexCmd.command("rebuild [vault]").description("preview or write deterministic root index.md projection").option("--write", "write projected index.md", false).option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
+  const v = await resolveVaultArg(vault, opts.wiki);
+  if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
+  else emit(await runIndexRebuild({ vault: v.vault, write: Boolean(opts.write) }), v.vault);
+});
 program.command("index-check [vault]").description("verify index.md entries match actual vault pages").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
   const v = await resolveVaultArg(vault, opts.wiki);
   if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
@@ -5945,12 +6889,47 @@ program.command("log-rotate [vault]").description("rotate or trim the vault log
 program.command("log-append [vault]").description("append a single entry to the vault log under a short advisory lock").requiredOption("--content <text>", "log entry text to append").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
   const v = await resolveVaultArg(vault, opts.wiki);
   if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
-  else return emitGuardedVaultWrite(
+  else return emitManagedVaultWrite(
     v.vault,
     "log-append",
     () => runLogAppend({ vault: v.vault, content: opts.content })
   );
 });
+var logCmd = program.command("log").description("immutable log events and projections");
+logCmd.command("materialize [vault]").description("preview or write root log.md from immutable events").option("--write", "write projected log.md", false).option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
+  const v = await resolveVaultArg(vault, opts.wiki);
+  if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
+  else if (opts.write) {
+    return emitManagedVaultWrite(
+      v.vault,
+      "log materialize",
+      () => runLogMaterialize({ vault: v.vault, write: true })
+    );
+  } else emit(await runLogMaterialize({ vault: v.vault, write: false }), v.vault);
+});
+logCmd.command("migrate-legacy [vault]").description("backfill immutable events from historical root log.md blocks").option("--write", "write events", false).option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
+  const v = await resolveVaultArg(vault, opts.wiki);
+  if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
+  else if (opts.write) {
+    return emitManagedVaultWrite(
+      v.vault,
+      "log migrate-legacy",
+      () => runLogMigrateLegacy({ vault: v.vault, write: true })
+    );
+  } else emit(await runLogMigrateLegacy({ vault: v.vault, write: false }), v.vault);
+});
+var projectionsCmd = program.command("projections").description("root index/log projection materialization");
+projectionsCmd.command("materialize [vault]").description("preview or write root index.md and log.md as a pair").option("--write", "write projections", false).option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
+  const v = await resolveVaultArg(vault, opts.wiki);
+  if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
+  else if (opts.write) {
+    return emitManagedVaultWrite(
+      v.vault,
+      "projections materialize",
+      () => runProjectionsMaterialize({ vault: v.vault, write: true })
+    );
+  } else emit(await runProjectionsMaterialize({ vault: v.vault, write: false }), v.vault);
+});
 program.command("lint [vault]").description("run all vault health checks").option("--days <n>", "stale threshold", (s) => parseInt(s, 10), 90).option("--lines <n>", "pagesize threshold", (s) => parseInt(s, 10), 200).option("--log-threshold <n>", "log rotation threshold", (s) => parseInt(s, 10), 500).option("--fix", "auto-fix supported lint violations").option("--only <bucket>", "run only the specified lint bucket").option("--summary", "emit bounded bucket counts instead of full item arrays", false).option("--examples <n>", "example count per bucket in summary mode", (s) => parseInt(s, 10), 3).option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
   const v = await resolveVaultArg(vault, opts.wiki);
   if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
@@ -6045,7 +7024,7 @@ program.command("archive <page> [vault]").description("archive a typed-knowledge
     remoteDelete: !!opts.remoteDelete,
     maxRemoteDeletes: Number.parseInt(opts.maxRemoteDeletes, 10)
   }), v.vault);
-  else return emitGuardedVaultWrite(
+  else return emitManagedVaultWrite(
     v.vault,
     "archive",
     () => runArchive({
@@ -6062,7 +7041,7 @@ program.command("archive <page> [vault]").description("archive a typed-knowledge
 program.command("remove <page> [vault]").description("remove a vault path and write a delete-intent tombstone").option("--wiki <name>", "wiki profile name").option("--remote <remote>", "rclone remote root to prune the live path, for example seaweed-wiki:cloud/wiki").option("--remote-delete", "delete the live path from the remote after local remove", false).option("--max-remote-deletes <n>", "maximum remote object deletes allowed", "1").option("--reason <text>", "stored on the delete-intent tombstone").action(async (page, vault, opts) => {
   const v = await resolveVaultArg(vault, opts.wiki);
   if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
-  else return emitGuardedVaultWrite(
+  else return emitManagedVaultWrite(
     v.vault,
     "remove",
     () => runRemove({
@@ -6235,6 +7214,17 @@ syncCmd.command("pull [vault]").description("pull remote vault changes and lint"
     () => runSyncPull({ vault: v.vault })
   );
 });
+syncCmd.command("resolve-derived [vault]").description("resolve mixed derived conflicts for an owned vault-sync operation (internal)").requiredOption("--operation-id <id>", "vault-sync operation journal id").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
+  const v = await resolveVaultArg(vault, opts.wiki);
+  if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
+  else {
+    return emitGuardedVaultWrite(
+      v.vault,
+      "sync resolve-derived",
+      () => runDerivedConflictResolution({ vault: v.vault, operationId: opts.operationId })
+    );
+  }
+});
 syncCmd.command("lock [vault]").description("acquire advisory lock on vault").option("--summary <text>", "lock description", "skillwiki sync").option("--ttl-minutes <n>", "lock time-to-live in minutes", "30").option("--force", "overwrite existing lock", false).option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
   const v = await resolveVaultArg(vault, opts.wiki);
   if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
@@ -6334,7 +7324,7 @@ program.command("observe [vault]").description("create a raw transcript observat
 program.command("session-brief [vault]").description("render or refresh the bounded startup session brief").option("--project <slug>", "project slug, or auto for deterministic detection", "auto").option("--write", "write meta/latest-session-brief.md and local cache files", false).option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
   const v = await resolveVaultArg(vault, opts.wiki);
   if (!v.ok) emit({ exitCode: v.exitCode, result: v.payload });
-  else if (opts.write) return emitGuardedVaultWrite(
+  else if (opts.write) return emitManagedVaultWrite(
     v.vault,
     "session-brief --write",
     () => runSessionBrief({