skillwiki 0.9.63 → 0.10.1

package/dist/{chunk-TUFQZ5K4.js → chunk-XSTXPA34.js}

@@ -3,334 +3,51 @@ import {
   latestFromCache,
   semverGt
 } from "./chunk-7I2TPIV5.js";
-
-// ../shared/src/exit-codes.ts
-var ExitCode = {
-  OK: 0,
-  INTERNAL_ERROR: 1,
-  FILE_NOT_FOUND: 2,
-  MISSING_CLOSING_DELIMITER: 3,
-  SCHEME_REJECTED: 4,
-  HOST_BLOCKED: 5,
-  MALFORMED_URL: 6,
-  INVALID_FRONTMATTER: 7,
-  SCHEMA_NOT_DETECTED: 8,
-  VAULT_PATH_INVALID: 9,
-  WRITE_FAILED: 10,
-  UNRESOLVED_MARKERS: 11,
-  SOURCES_INCONSISTENT: 12,
-  PREFLIGHT_FAILED: 13,
-  ATOMIC_COPY_FAILED: 14,
-  INIT_TARGET_NOT_EMPTY: 15,
-  BROKEN_WIKILINKS: 16,
-  TAG_NOT_IN_TAXONOMY: 17,
-  INDEX_INCOMPLETE: 18,
-  STALE_PAGE: 19,
-  PAGE_TOO_LARGE: 20,
-  LOG_ROTATE_NEEDED: 21,
-  LINT_HAS_WARNINGS: 22,
-  LINT_HAS_ERRORS: 23,
-  ENV_WRITE_CONFLICT: 24,
-  NO_VAULT_CONFIGURED: 25,
-  INVALID_CONFIG_KEY: 26,
-  CONFIG_WRITE_FAILED: 27,
-  DOCTOR_HAS_WARNINGS: 28,
-  DOCTOR_HAS_ERRORS: 29,
-  ARCHIVE_TARGET_NOT_FOUND: 30,
-  ARCHIVE_ALREADY_ARCHIVED: 31,
-  DRIFT_DETECTED: 32,
-  RAW_DEDUP_DETECTED: 33,
-  MIGRATION_APPLIED: 34,
-  UNKNOWN_WIKI_PROFILE: 35,
-  DEDUP_APPLIED: 36,
-  PROJECT_NOT_FOUND: 37,
-  SYMLINK_FAILED: 38,
-  COMPOUND_PROMOTED: 39,
-  SKILL_VERSION_MISMATCH: 40,
-  INGEST_VALIDATION_FAILED: 41,
-  SYNC_PUSH_FAILED: 42,
-  SYNC_PULL_FAILED: 43,
-  BACKUP_SYNC_FAILED: 44,
-  BACKUP_RESTORE_CONFLICTS: 45,
-  USAGE: 46,
-  BODY_TRUNCATION_GUARD: 47,
-  SYNC_LOCK_HELD: 48,
-  LOG_APPEND_LOCK_HELD: 49,
-  FLEET_MANIFEST_INVALID: 50,
-  SENSITIVE_CONTENT_DETECTED: 51,
-  FLEET_SATELLITE_HEALTH_FAILED: 52,
-  PROTECTED_SNAPSHOTTER_WRITE_BLOCKED: 53
-};
-
-// ../shared/src/json-output.ts
-function ok(data) {
-  return { ok: true, data };
-}
-function err(error, detail) {
-  return detail === void 0 ? { ok: false, error } : { ok: false, error, detail };
-}
-
-// ../shared/src/schemas.ts
-import { z } from "zod";
-var isoDate = z.string().refine((s) => {
-  if (!/^\d{4}-\d{2}-\d{2}$/.test(s)) return false;
-  const d = /* @__PURE__ */ new Date(s + "T00:00:00Z");
-  return !Number.isNaN(d.getTime()) && s === d.toISOString().slice(0, 10);
-}, { message: "must be YYYY-MM-DD" });
-var wikilink = z.string().regex(/^\[\[[^\[\]]+\]\]$/, 'must be "[[name]]"');
-var TypedKnowledgeSchema = z.object({
-  title: z.string().min(1),
-  aliases: z.array(z.string()).optional(),
-  created: isoDate,
-  updated: isoDate,
-  type: z.enum(["entity", "concept", "comparison", "query"]),
-  tags: z.array(z.string()),
-  sources: z.array(z.string()).min(1),
-  confidence: z.enum(["high", "medium", "low"]).optional(),
-  contested: z.boolean().optional(),
-  contradictions: z.array(z.string()).optional(),
-  provenance: z.enum(["research", "project", "mixed"]).optional(),
-  provenance_projects: z.array(wikilink).optional(),
-  work_items: z.array(wikilink).optional(),
-  stale_ttl: z.number().int().positive().optional()
-}).superRefine((v, ctx) => {
-  if (v.provenance && v.provenance !== "research" && (!v.provenance_projects || v.provenance_projects.length === 0)) {
-    ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["provenance_projects"], message: "required when provenance != research" });
-  }
-});
-var sha256Hex = z.string().regex(/^[0-9a-f]{64}$/);
-var RawSourceSchema = z.object({
-  title: z.string().min(1).optional(),
-  source_url: z.string().nullable(),
-  created: isoDate.optional(),
-  ingested: isoDate,
-  ingested_by: z.enum(["wiki-ingest", "proj-work", "manual"]).optional(),
-  sha256: sha256Hex.optional(),
-  project: wikilink.optional(),
-  work_item: wikilink.optional(),
-  kind: z.enum(["postmortem", "session-log", "meeting-notes", "other", "idea", "bug", "task", "note"]).optional()
-}).superRefine((v, ctx) => {
-  if (v.work_item !== void 0 && (v.project === void 0 || v.kind === void 0)) {
-    ctx.addIssue({ code: z.ZodIssueCode.custom, message: "project and kind are required when work_item is set" });
-  }
-});
-var WorkItemSchema = z.object({
-  title: z.string().min(1),
-  aliases: z.array(z.string()).optional(),
-  created: isoDate,
-  updated: isoDate,
-  started: isoDate,
-  completed: isoDate.optional(),
-  kind: z.enum(["feature", "issue", "refactor", "decision"]),
-  status: z.enum(["planned", "in-progress", "completed", "abandoned"]),
-  priority: z.enum(["high", "medium", "low"]),
-  project: wikilink,
-  owner: wikilink.optional(),
-  parent: wikilink.optional(),
-  related: z.array(wikilink).optional(),
-  sources: z.array(z.string()).optional()
-}).superRefine((v, ctx) => {
-  if (v.status === "completed" && !v.completed) {
-    ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["completed"], message: "required when status is completed" });
-  }
-});
-var CompoundSchema = z.object({
-  title: z.string().min(1),
-  aliases: z.array(z.string()).optional(),
-  created: isoDate,
-  updated: isoDate,
-  type: z.enum(["lesson", "pattern", "antipattern", "gotcha"]),
-  tags: z.array(z.string()),
-  confidence: z.enum(["high", "medium", "low"]),
-  contradicts: z.array(z.string()).optional(),
-  project: wikilink,
-  work_items: z.array(wikilink).min(1),
-  promoted_to: wikilink.optional(),
-  cssclasses: z.array(z.string()).optional()
-});
-var sessionPinPath = z.string().regex(
-  /^(entities|concepts|comparisons|queries|meta)\/.+\.md$/,
-  "must reference a typed-knowledge markdown page"
-);
-var SessionPinSchema = z.object({
-  title: z.string().min(1),
-  path: sessionPinPath,
-  scope: z.enum(["global", "project"]),
-  project: wikilink.optional(),
-  summary: z.string().min(1).optional(),
-  updated: isoDate.optional()
-}).superRefine((v, ctx) => {
-  if (v.scope === "project" && v.project === void 0) {
-    ctx.addIssue({
-      code: z.ZodIssueCode.custom,
-      path: ["project"],
-      message: "project is required when scope is project"
-    });
-  }
-});
-var MetaSchema = z.object({
-  title: z.string().min(1),
-  aliases: z.array(z.string()).optional(),
-  created: isoDate,
-  updated: isoDate,
-  type: z.literal("meta"),
-  tags: z.array(z.string()),
-  confidence: z.enum(["high", "medium", "low"]).optional(),
-  provenance: z.enum(["research", "project", "mixed"]).optional(),
-  provenance_projects: z.array(wikilink).optional(),
-  generated_by: z.string().min(1).optional(),
-  generated_at: z.string().datetime().optional(),
-  generated_kind: z.enum(["session-brief"]).optional(),
-  meta_kind: z.enum(["session-pins"]).optional(),
-  stale_ttl: z.number().int().positive().optional(),
-  pins: z.array(SessionPinSchema).optional()
-}).superRefine((v, ctx) => {
-  const isGeneratedSessionBrief = v.generated_kind === "session-brief";
-  const isSessionPins = v.meta_kind === "session-pins";
-  if (isSessionPins && (!v.pins || v.pins.length === 0)) {
-    ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["pins"], message: "required when meta_kind is session-pins" });
-  }
-  if (!isGeneratedSessionBrief && !isSessionPins && (!v.provenance_projects || v.provenance_projects.length < 2)) {
-    ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["provenance_projects"], message: "meta pages must reference \u22652 projects" });
-  }
-  if (v.provenance && v.provenance !== "research" && (!v.provenance_projects || v.provenance_projects.length === 0)) {
-    ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["provenance_projects"], message: "required when provenance != research" });
-  }
-});
-var hostId = z.string().regex(/^[a-z0-9][a-z0-9_-]*$/, "must be a lowercase host id");
-var endpointName = z.string().min(1).regex(/^[A-Za-z0-9_.-]+$/, "must be a hostname-like token");
-var ipAddress = z.string().min(1).regex(/^[0-9a-fA-F:.]+$/, "must be an IP address token");
-var sshAlias = z.string().min(1).regex(/^[A-Za-z0-9_.@-]+$/, "must be an SSH alias token");
-var sshUser = z.string().min(1).regex(/^[A-Za-z0-9_.-]+$/, "must be an SSH user token");
-var absolutePath = z.string().min(1).regex(/^\//, "must be an absolute path");
-var FleetAccessProfileSchema = z.object({
-  status: z.enum(["local", "configured", "planned", "absent", "unknown"]),
-  ssh_aliases: z.array(sshAlias).optional(),
-  users: z.array(sshUser).optional(),
-  transports: z.array(z.enum(["local", "public-ip", "tailscale", "private-lan"])).min(1)
-}).strict();
-var FleetHostIdentitySchema = z.object({
-  hostnames: z.array(endpointName).min(1),
-  public_addresses: z.array(ipAddress).optional(),
-  private_addresses: z.array(ipAddress).optional(),
-  tailscale: z.object({
-    node_names: z.array(endpointName).optional(),
-    magicdns_names: z.array(endpointName).optional(),
-    addresses: z.array(ipAddress).optional()
-  }).strict().optional()
-}).strict();
-var FleetSkillwikiSatelliteSchema = z.object({
-  enabled: z.boolean(),
-  user: sshUser,
-  vault_path: absolutePath,
-  repo_path: absolutePath,
-  ssh_alias: sshAlias,
-  scheduler: z.enum(["systemd"]),
-  timezone: z.string().min(1).optional(),
-  jobs: z.array(z.enum([
-    "self-update-check",
-    "vault-sync-preflight",
-    "agent-memory-trends-daily",
-    "session-brief-refresh",
-    "health-summary"
-  ])).min(1),
-  cadence: z.object({
-    self_update_check: z.literal("every-4-hours").optional(),
-    daily_window: z.string().min(1).optional()
-  }).strict().optional()
-}).strict();
-var FleetHostSchema = z.object({
-  class: z.enum(["dev-macos", "dev-linux", "prod-linux", "unknown"]),
-  role: z.enum(["leaf", "snapshotter"]),
-  writes_to: z.array(z.enum(["s3", "github"])).min(1),
-  protected: z.boolean().optional(),
-  identity: FleetHostIdentitySchema,
-  access: z.object({
-    from: z.record(hostId, FleetAccessProfileSchema).optional()
-  }).strict().optional(),
-  maintenance: z.object({
-    skillwiki_satellite: FleetSkillwikiSatelliteSchema.optional()
-  }).strict().optional()
-}).strict();
-var FleetManifestSchema = z.object({
-  "$schema": z.string().url().optional(),
-  schema_version: z.literal(1),
-  vault_remote: z.string().min(1),
-  s3_remote: z.string().min(1).optional(),
-  hosts: z.record(hostId, FleetHostSchema)
-}).strict().superRefine((v, ctx) => {
-  const entries = Object.entries(v.hosts);
-  if (entries.length === 0) {
-    ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["hosts"], message: "must contain at least one host" });
-  }
-  const snapshotters = entries.filter(([, host]) => host.role === "snapshotter").map(([id]) => id);
-  if (snapshotters.length !== 1) {
-    ctx.addIssue({
-      code: z.ZodIssueCode.custom,
-      path: ["hosts"],
-      message: `must contain exactly one snapshotter host, found ${snapshotters.length}`
-    });
-  }
-});
-function detectSchema(fm) {
-  const COMPOUND_TYPES = /* @__PURE__ */ new Set(["lesson", "pattern", "antipattern", "gotcha"]);
-  if (typeof fm.type === "string" && COMPOUND_TYPES.has(fm.type) && "project" in fm) return { schema: "compound" };
-  if (fm.type === "meta") return { schema: "meta" };
-  if ("type" in fm && "sources" in fm) return { schema: "typed-knowledge" };
-  if ("ingested" in fm && ("source_url" in fm || "sha256" in fm)) return { schema: "raw" };
-  const RAW_KINDS = /* @__PURE__ */ new Set(["postmortem", "session-log", "meeting-notes", "other", "idea", "bug", "task", "note"]);
-  if ("ingested" in fm && typeof fm.kind === "string" && RAW_KINDS.has(fm.kind)) return { schema: "raw" };
-  if ("kind" in fm && "status" in fm) return { schema: "work-item" };
-  return { schema: null };
-}
-
-// ../shared/src/blocked-hosts.ts
-var METADATA_HOSTS = /* @__PURE__ */ new Set([
-  "metadata.google.internal",
-  "metadata"
-]);
-var METADATA_IPS = /* @__PURE__ */ new Set(["169.254.169.254"]);
-function ipv4ToInt(ip) {
-  const parts = ip.split(".");
-  if (parts.length !== 4) return null;
-  let n = 0;
-  for (const p of parts) {
-    const v = Number(p);
-    if (!Number.isInteger(v) || v < 0 || v > 255) return null;
-    n = (n << 8) + v;
-  }
-  return n >>> 0;
-}
-function inRange(ip, baseStr, prefix) {
-  const ipN = ipv4ToInt(ip);
-  const baseN = ipv4ToInt(baseStr);
-  if (ipN === null || baseN === null) return false;
-  const mask = prefix === 0 ? 0 : ~0 << 32 - prefix >>> 0;
-  return (ipN & mask) === (baseN & mask);
-}
-function isBlockedHost(host) {
-  const lower = host.toLowerCase();
-  if (METADATA_HOSTS.has(lower)) return true;
-  if (METADATA_IPS.has(host)) return true;
-  if (lower === "::1") return true;
-  if (lower.startsWith("fe80:")) return true;
-  if (ipv4ToInt(host) === null) return false;
-  if (inRange(host, "10.0.0.0", 8)) return true;
-  if (inRange(host, "172.16.0.0", 12)) return true;
-  if (inRange(host, "192.168.0.0", 16)) return true;
-  if (inRange(host, "169.254.0.0", 16)) return true;
-  if (inRange(host, "127.0.0.0", 8)) return true;
-  return false;
-}
-
-// ../shared/src/error-message.ts
-function getErrorMessage(e) {
-  return e instanceof Error ? e.message : String(e);
-}
+import {
+  atomicWriteText,
+  extractFrontmatter,
+  mapWithConcurrency,
+  prepareTypedPage,
+  readPage,
+  readPageCached,
+  redactSensitiveContent,
+  renderRootIndex,
+  resolveReadOnlyVaultRoot,
+  scanSensitiveContent,
+  scanVault,
+  splitFrontmatter,
+  vaultIoConcurrency,
+  writeRootIndexProjection
+} from "./chunk-IZABIE44.js";
+import {
+  CONFIG_KEYS,
+  isValidWikiProfileKey,
+  listReviewRequiredOps,
+  loadFleetManifestAndHost,
+  parseDotenvFile,
+  parseDotenvText,
+  profileKey,
+  resolveVaultSyncPullHelper,
+  satelliteGateFromFleetLoad,
+  snapshotterAliasForLocalHost,
+  writeDotenv
+} from "./chunk-R6BKJWVC.js";
+import {
+  CompoundSchema,
+  ExitCode,
+  MetaSchema,
+  RawSourceSchema,
+  TypedKnowledgeSchema,
+  WorkItemSchema,
+  detectSchema,
+  err,
+  getErrorMessage,
+  ok
+} from "./chunk-C5OLZRRM.js";
 
 // src/commands/log-append.ts
-import { readFile as readFile2, stat } from "fs/promises";
-import { join as join4 } from "path";
+import { readFile, stat } from "fs/promises";
+import { join as join3 } from "path";
 
 // src/utils/last-op.ts
 import { readFileSync, writeFileSync, mkdirSync, unlinkSync, existsSync } from "fs";
@@ -374,58 +91,12 @@ function clearLastOp(vault) {
   }
 }
 
-// src/utils/atomic-write.ts
-import { randomBytes } from "crypto";
-import { open, readFile, rename, unlink } from "fs/promises";
-import { basename, dirname, join as join2 } from "path";
-async function readExisting(path) {
-  try {
-    return await readFile(path, "utf8");
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-}
-async function atomicWriteText(path, text) {
-  let existing;
-  try {
-    existing = await readExisting(path);
-  } catch (error) {
-    return err("WRITE_FAILED", { path, phase: "read-existing", message: String(error) });
-  }
-  if (existing === text) return ok({ changed: false, existed: true });
-  const tmp = join2(
-    dirname(path),
-    `.${basename(path)}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`
-  );
-  try {
-    const handle = await open(tmp, "wx");
-    try {
-      await handle.writeFile(text, "utf8");
-      try {
-        await handle.sync();
-      } catch {
-      }
-    } finally {
-      await handle.close();
-    }
-    await rename(tmp, path);
-    return ok({ changed: true, existed: existing !== null });
-  } catch (error) {
-    try {
-      await unlink(tmp);
-    } catch {
-    }
-    return err("WRITE_FAILED", { path, phase: "atomic-write", message: String(error) });
-  }
-}
-
 // src/utils/log-lock.ts
-import { randomBytes as randomBytes2 } from "crypto";
+import { randomBytes } from "crypto";
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, statSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "fs";
-import { join as join3 } from "path";
+import { join as join2 } from "path";
 function logLockPath(vault) {
-  return join3(vault, ".skillwiki", "log-append.lock");
+  return join2(vault, ".skillwiki", "log-append.lock");
 }
 var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 function readLogLock(path) {
@@ -441,10 +112,10 @@ async function acquireLogLock(vault, opts = {}) {
   const staleMs = opts.staleMs ?? 1e4;
   const reclaimStale = opts.reclaimStale ?? true;
   const path = logLockPath(vault);
-  const dir = join3(vault, ".skillwiki");
+  const dir = join2(vault, ".skillwiki");
   if (!existsSync2(dir)) mkdirSync2(dir, { recursive: true });
   const deadline = Date.now() + retryMs;
-  const ownerToken = randomBytes2(16).toString("hex");
+  const ownerToken = randomBytes(16).toString("hex");
   const acquired = (/* @__PURE__ */ new Date()).toISOString();
   const content = JSON.stringify({ pid: process.pid, owner_token: ownerToken, acquired }) + "\n";
   for (; ; ) {
@@ -487,146 +158,6 @@ function releaseLogLock(handle) {
   }
 }
 
-// src/utils/sensitive-content.ts
-import { createHash } from "crypto";
-var REDACTED_RE = /\[REDACTED:[^\]]+\]/i;
-var SYNTHETIC_RE = /^(?:<[^>]+>|\$\{[^}]+\}|REPLACE_WITH_[A-Z0-9_]+|YOUR_[A-Z0-9_]+|EXAMPLE_[A-Z0-9_]+)$/i;
-var MATCHERS = [
-  {
-    kind: "private_key",
-    re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g
-  },
-  {
-    kind: "authorization_header",
-    re: /\bAuthorization["']?\s*:\s*["']?(Bearer\s+[A-Za-z0-9._~+/-]{20,})["']?/gi,
-    valueGroup: 1
-  },
-  {
-    kind: "cookie",
-    re: /\b(?:Cookie|Set-Cookie)\s*:\s*([^\n]{20,})/gi,
-    valueGroup: 1
-  },
-  {
-    kind: "jwt",
-    re: /\b([A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{12,}\.[A-Za-z0-9_-]{12,})\b/g,
-    valueGroup: 1
-  },
-  {
-    kind: "provider_key",
-    re: /\b(sk-[A-Za-z0-9_-]{20,}|xox[baprs]-[A-Za-z0-9-]{20,}|gh[pousr]_[A-Za-z0-9_=-]{20,})\b/g,
-    valueGroup: 1
-  },
-  {
-    kind: "access_key",
-    re: /\b((?:AKIA|ASIA)[A-Z0-9]{16})\b/g,
-    valueGroup: 1
-  },
-  {
-    kind: "access_key",
-    re: /\b(?:access[-_ ]?key|credential)["']?\s*[:=]\s*["']?([A-Za-z0-9._~+/-]{20,})["']?/gi,
-    valueGroup: 1
-  },
-  {
-    kind: "api_key",
-    re: /\b(?:api[-_ ]?key)["']?\s*[:=]\s*["']?([A-Za-z0-9._~+/-]{20,})["']?/gi,
-    valueGroup: 1
-  },
-  {
-    kind: "password",
-    re: /\b(?:pass(?:word|wd)?)["']?\s*[:=]\s*["']?([^\s`"']{8,})["']?/gi,
-    valueGroup: 1
-  },
-  {
-    kind: "secret",
-    re: /\b(?:secret|client[-_ ]?secret)["']?\s*[:=]\s*["']?([A-Za-z0-9._~+/-]{16,})["']?/gi,
-    valueGroup: 1
-  },
-  {
-    kind: "token",
-    re: /\b(?:token|session)["']?\s*[:=]\s*["']?([A-Za-z0-9._~+/-]{16,})["']?/gi,
-    valueGroup: 1
-  }
-];
-function fingerprint(value) {
-  return createHash("sha256").update(value).digest("hex").slice(0, 12);
-}
-function lineFor(text, offset) {
-  return text.slice(0, offset).split(/\r?\n/).length;
-}
-function redactMarker(kind, value) {
-  return `[REDACTED:${kind}:${fingerprint(value)}]`;
-}
-function isSyntheticPlaceholder(value) {
-  return REDACTED_RE.test(value) || SYNTHETIC_RE.test(value.trim());
-}
-function collectMatches(text) {
-  const matches = [];
-  for (const matcher of MATCHERS) {
-    matcher.re.lastIndex = 0;
-    for (const m of text.matchAll(matcher.re)) {
-      const whole = m[0];
-      const start = m.index ?? 0;
-      if (REDACTED_RE.test(whole)) continue;
-      const value = matcher.valueGroup ? m[matcher.valueGroup] : whole;
-      if (isSyntheticPlaceholder(value)) continue;
-      const valueOffset = whole.lastIndexOf(value);
-      const valueStart = start + Math.max(0, valueOffset);
-      matches.push({
-        start,
-        end: start + whole.length,
-        valueStart,
-        valueEnd: valueStart + value.length,
-        kind: matcher.kind
-      });
-    }
-  }
-  return matches.sort((a, b) => {
-    if (a.valueStart !== b.valueStart) return a.valueStart - b.valueStart;
-    return b.valueEnd - b.valueStart - (a.valueEnd - a.valueStart);
-  });
-}
-function collapseOverlaps(matches) {
-  const kept = [];
-  for (const match of matches) {
-    const overlaps = kept.some((k) => match.valueStart < k.valueEnd && match.valueEnd > k.valueStart);
-    if (!overlaps) kept.push(match);
-  }
-  return kept;
-}
-function scanSensitiveContent(text, opts = {}) {
-  return collapseOverlaps(collectMatches(text)).map((match) => {
-    const value = text.slice(match.valueStart, match.valueEnd);
-    const marker = redactMarker(match.kind, value);
-    const rawPreview = text.slice(Math.max(0, match.start - 24), Math.min(text.length, match.end + 24));
-    const preview = rawPreview.replace(value, marker);
-    return {
-      file: opts.file,
-      line: lineFor(text, match.valueStart),
-      kind: match.kind,
-      preview,
-      fingerprint: fingerprint(value)
-    };
-  });
-}
-function redactSensitiveContent(text, opts = {}) {
-  const matches = collapseOverlaps(collectMatches(text));
-  if (matches.length === 0) return { text, changed: false, findings: [] };
-  let out = "";
-  let cursor = 0;
-  for (const match of matches) {
-    const value = text.slice(match.valueStart, match.valueEnd);
-    out += text.slice(cursor, match.valueStart);
-    out += redactMarker(match.kind, value);
-    cursor = match.valueEnd;
-  }
-  out += text.slice(cursor);
-  return {
-    text: out,
-    changed: out !== text,
-    findings: scanSensitiveContent(text, opts)
-  };
-}
-
 // src/commands/log-append.ts
 var ENTRY_RE = /^## \[(\d{4})-\d{2}-\d{2}\]/gm;
 function operationMarker(operationId) {
@@ -638,7 +169,7 @@ function operationMarker(operationId) {
 async function appendWhileLocked(logPath, content, marker) {
   let logText;
   try {
-    logText = await readFile2(logPath, "utf8");
+    logText = await readFile(logPath, "utf8");
   } catch {
     return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: logPath }) };
   }
@@ -677,7 +208,7 @@ ${appendedContent}
 }
 async function runLogAppend(input) {
   try {
-    await stat(join4(input.vault, "SCHEMA.md"));
+    await stat(join3(input.vault, "SCHEMA.md"));
   } catch {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { vault: input.vault }) };
   }
@@ -706,7 +237,7 @@ async function runLogAppend(input) {
     return { exitCode: ExitCode.LOG_APPEND_LOCK_HELD, result: err("LOG_APPEND_LOCK_HELD", { vault: input.vault }) };
   }
   const lockHandle = acquired.data;
-  const logPath = join4(input.vault, "log.md");
+  const logPath = join3(input.vault, "log.md");
   let outcome;
   let released;
   try {
@@ -751,8 +282,8 @@ async function runLogAppend(input) {
 
 // src/utils/sync-lock.ts
 import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, renameSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync3 } from "fs";
-import { join as join5 } from "path";
-import { createHash as createHash2, randomBytes as randomBytes3 } from "crypto";
+import { join as join4 } from "path";
+import { createHash, randomBytes as randomBytes2 } from "crypto";
 function getEnvSessionId() {
   if (process.env.CLAUDE_SESSION_ID) return process.env.CLAUDE_SESSION_ID;
   if (process.env.SKILLWIKI_SESSION_ID) return process.env.SKILLWIKI_SESSION_ID;
@@ -765,7 +296,7 @@ function getSessionId() {
 }
 function getCwdHash(cwd) {
   const path = cwd || process.cwd();
-  const hash = createHash2("sha256").update(path).digest("hex");
+  const hash = createHash("sha256").update(path).digest("hex");
   return hash.slice(0, 8);
 }
 function getCliSessionId(cwd) {
@@ -774,7 +305,7 @@ function getCliSessionId(cwd) {
   return `cli-${getCwdHash(cwd)}`;
 }
 function lockPath(vault) {
-  return join5(vault, ".skillwiki", "sync.lock");
+  return join4(vault, ".skillwiki", "sync.lock");
 }
 function readLock(vault) {
   const path = lockPath(vault);
@@ -793,7 +324,7 @@ function isStale(lock, now) {
 }
 function acquireLock(vault, opts = {}) {
   const path = lockPath(vault);
-  const dir = join5(vault, ".skillwiki");
+  const dir = join4(vault, ".skillwiki");
   if (!existsSync3(dir)) {
     mkdirSync3(dir, { recursive: true });
   }
@@ -864,7 +395,7 @@ function releaseLock(vault, opts = {}) {
   }
 }
 function acquireOwnedSyncLock(vault, opts) {
-  const ownerToken = randomBytes3(16).toString("hex");
+  const ownerToken = randomBytes2(16).toString("hex");
   const sessionId = `publish-${process.pid}-${ownerToken.slice(0, 12)}`;
   const now = /* @__PURE__ */ new Date();
   const lock = {
@@ -878,7 +409,7 @@ function acquireOwnedSyncLock(vault, opts) {
   };
   const path = lockPath(vault);
   try {
-    mkdirSync3(join5(vault, ".skillwiki"), { recursive: true });
+    mkdirSync3(join4(vault, ".skillwiki"), { recursive: true });
   } catch (error) {
     return err("WRITE_FAILED", { path, message: String(error) });
   }
@@ -909,40 +440,13 @@ function releaseOwnedSyncLock(handle) {
 }
 
 // src/commands/validate.ts
-import { createHash as createHash3 } from "crypto";
-import { readFile as readFile4 } from "fs/promises";
-import { resolve as resolve2, relative as relative2, sep as sep2 } from "path";
-
-// src/parsers/frontmatter.ts
-import yaml from "js-yaml";
-var FM_OPEN = /^---\r?\n/;
-function splitFrontmatter(text) {
-  if (!FM_OPEN.test(text)) return ok({ rawFrontmatter: "", body: text, bodyStart: 0 });
-  const afterOpen = text.replace(FM_OPEN, "");
-  const closeIdx = afterOpen.search(/\r?\n---\r?\n/);
-  if (closeIdx === -1) return err("MISSING_CLOSING_DELIMITER");
-  const rawFrontmatter = afterOpen.slice(0, closeIdx);
-  const closeMatch = afterOpen.slice(closeIdx).match(/\r?\n---\r?\n/);
-  const bodyStart = text.length - (afterOpen.length - closeIdx - closeMatch[0].length);
-  const body = text.slice(bodyStart);
-  return ok({ rawFrontmatter, body, bodyStart });
-}
-function extractFrontmatter(text) {
-  const split = splitFrontmatter(text);
-  if (!split.ok) return split;
-  if (!split.data.rawFrontmatter) return ok({});
-  try {
-    const parsed = yaml.load(split.data.rawFrontmatter, { schema: yaml.JSON_SCHEMA });
-    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return ok({});
-    return ok(parsed);
-  } catch (e) {
-    return err("INVALID_FRONTMATTER", { message: getErrorMessage(e) });
-  }
-}
+import { createHash as createHash2 } from "crypto";
+import { readFile as readFile3 } from "fs/promises";
+import { resolve, relative, sep } from "path";
 
 // src/utils/index-entry.ts
-import { readFile as readFile3 } from "fs/promises";
-import { join as join6 } from "path";
+import { readFile as readFile2 } from "fs/promises";
+import { join as join5 } from "path";
 var TYPE_SECTION = {
   entity: "Entities",
   concept: "Concepts",
@@ -986,128 +490,31 @@ function renderIndexUpsert(text, input) {
   });
 }
 async function upsertIndexEntry(input) {
-  const path = join6(input.vault, "index.md");
-  let current;
+  const path = join5(input.vault, "index.md");
+  let before = "";
   try {
-    current = await readFile3(path, "utf8");
-  } catch (error) {
-    return err("FILE_NOT_FOUND", { path, message: String(error) });
-  }
-  const rendered = renderIndexUpsert(current, input);
-  if (!rendered.ok) return rendered;
-  if (!rendered.data.changed) return ok({ changed: false });
-  const written = await atomicWriteText(path, rendered.data.text);
-  return written.ok ? ok({ changed: written.data.changed }) : written;
-}
-
-// src/utils/typed-page.ts
-import { lstatSync, realpathSync } from "fs";
-import { dirname as dirname2, posix, relative, resolve, sep } from "path";
-var TYPE_DIRECTORY = {
-  entity: "entities",
-  concept: "concepts",
-  comparison: "comparisons",
-  query: "queries",
-  meta: "meta"
-};
-function validateTypedTarget(target) {
-  const segments = target.split("/");
-  if (target.length === 0 || posix.isAbsolute(target) || target.includes("\\") || posix.normalize(target) !== target || segments.some((segment) => segment === "" || segment === "." || segment === "..") || !/^(entities|concepts|comparisons|queries|meta)\/[a-z0-9][a-z0-9._/-]*\.md$/.test(target)) {
-    return err("VAULT_PATH_INVALID", { target, message: "unsafe typed-page target" });
-  }
-  return ok(target);
-}
-function assertTargetInsideVault(vault, target) {
-  const validated = validateTypedTarget(target);
-  if (!validated.ok) return validated;
-  let vaultReal;
-  try {
-    vaultReal = realpathSync(vault);
+    before = await readFile2(path, "utf8");
   } catch {
-    return err("VAULT_PATH_INVALID", { target, message: "vault realpath failed" });
-  }
-  const absolutePath2 = resolve(vaultReal, target);
-  const parent = dirname2(absolutePath2);
-  let parentReal;
-  try {
-    parentReal = realpathSync(parent);
-  } catch {
-    return err("VAULT_PATH_INVALID", { target, message: "target parent realpath failed" });
-  }
-  const parentRelative = relative(vaultReal, parentReal).split(sep).join("/");
-  if (parentRelative === ".." || parentRelative.startsWith("../")) {
-    return err("VAULT_PATH_INVALID", { target, message: "target parent escapes vault" });
+    before = "";
   }
-  if (parentReal !== parent) {
-    return err("VAULT_PATH_INVALID", { target, message: "target parent may not be a symlink alias" });
+  const projection = await renderRootIndex({ vault: input.vault, currentText: before });
+  if (projection.ok) {
+    if (projection.data.text === before) return ok({ changed: false });
+    const written2 = await writeRootIndexProjection(input.vault, projection.data);
+    if (!written2.ok) return written2;
+    return ok({ changed: written2.data.changed });
   }
-  let existingRealPath;
-  try {
-    const targetStat = lstatSync(absolutePath2);
-    if (targetStat.isSymbolicLink()) {
-      return err("VAULT_PATH_INVALID", { target, message: "target may not be a symlink" });
-    }
-    if (!targetStat.isFile()) {
-      return err("VAULT_PATH_INVALID", { target, message: "existing target must be a regular file" });
-    }
-    try {
-      existingRealPath = realpathSync(absolutePath2);
-    } catch {
-      return err("VAULT_PATH_INVALID", { target, message: "target realpath failed" });
-    }
-  } catch (error) {
-    if (error.code !== "ENOENT") {
-      return err("VAULT_PATH_INVALID", { target, message: "target lstat failed" });
-    }
-  }
-  return ok({ absolutePath: absolutePath2, existingRealPath });
-}
-function invalidFrontmatter(target, issues) {
-  return err("INVALID_FRONTMATTER", {
-    target,
-    errors: issues.map((issue) => ({ path: issue.path.join("."), message: issue.message }))
+  const rendered = renderIndexUpsert(before, input);
+  if (!rendered.ok) return rendered;
+  if (!rendered.data.changed) return ok({ changed: false });
+  const written = await writeRootIndexProjection(input.vault, {
+    text: rendered.data.text,
+    entries: [],
+    duplicates_removed: 0,
+    ghosts_removed: []
   });
-}
-function prepareTypedPage(content, target) {
-  const safeTarget = validateTypedTarget(target);
-  if (!safeTarget.ok) return safeTarget;
-  const sensitive = scanSensitiveContent(content, { file: target });
-  if (sensitive.length > 0) {
-    return err("SENSITIVE_CONTENT_DETECTED", { file: target, findings: sensitive });
-  }
-  const frontmatter = extractFrontmatter(content);
-  if (!frontmatter.ok) return frontmatter;
-  const detected = detectSchema(frontmatter.data);
-  if (detected.schema === "typed-knowledge") {
-    const parsed = TypedKnowledgeSchema.safeParse(frontmatter.data);
-    if (!parsed.success) return invalidFrontmatter(target, parsed.error.issues);
-    const expectedDirectory = TYPE_DIRECTORY[parsed.data.type];
-    if (!expectedDirectory || !target.startsWith(`${expectedDirectory}/`)) {
-      return err("SCHEME_REJECTED", { target, type: parsed.data.type, message: "frontmatter type does not match target directory" });
-    }
-    return ok({
-      target,
-      title: parsed.data.title,
-      type: parsed.data.type,
-      tags: [...parsed.data.tags],
-      content
-    });
-  }
-  if (detected.schema === "meta") {
-    const parsed = MetaSchema.safeParse(frontmatter.data);
-    if (!parsed.success) return invalidFrontmatter(target, parsed.error.issues);
-    if (!target.startsWith("meta/")) {
-      return err("SCHEME_REJECTED", { target, type: "meta", message: "frontmatter type does not match target directory" });
-    }
-    return ok({
-      target,
-      title: parsed.data.title,
-      type: "meta",
-      tags: [...parsed.data.tags],
-      content
-    });
-  }
-  return invalidFrontmatter(target, []);
+  if (!written.ok) return written;
+  return ok({ changed: written.data.changed });
 }
 
 // src/commands/validate.ts
@@ -1121,7 +528,7 @@ var SCHEMAS = {
 async function runValidate(input) {
   let text;
   try {
-    text = await readFile4(input.file, "utf8");
+    text = await readFile3(input.file, "utf8");
   } catch {
     return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: input.file }) };
   }
@@ -1172,13 +579,13 @@ ${errors.map((e) => `  ${e.path}: ${e.message}`).join("\n")}` })
   let logUpdated = false;
   let applyHint = "";
   if (input.apply && input.vault) {
-    const absFile = resolve2(input.file);
-    const absVault = resolve2(input.vault);
-    const relPath = relative2(absVault, absFile).split(sep2).join("/");
+    const absFile = resolve(input.file);
+    const absVault = resolve(input.vault);
+    const relPath = relative(absVault, absFile).split(sep).join("/");
     if (relPath.startsWith("..")) {
       return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { reason: `file ${input.file} is not inside vault ${input.vault}` }) };
     }
-    const operationId = createHash3("sha256").update("skillwiki-validate-apply-v1\0").update(relPath).update("\0").update(text).digest("hex");
+    const operationId = createHash2("sha256").update("skillwiki-validate-apply-v1\0").update(relPath).update("\0").update(text).digest("hex");
     if (det.schema === "typed-knowledge" || det.schema === "meta") {
       const prepared = prepareTypedPage(text, relPath);
       if (!prepared.ok) {
@@ -1262,109 +669,7 @@ ${errors.map((e) => `  ${e.path}: ${e.message}`).join("\n")}` })
 
 // src/commands/graph.ts
 import { writeFile, mkdir } from "fs/promises";
-import { dirname as dirname3 } from "path";
-
-// src/utils/vault.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
-import { readFile as readFile5, readdir, stat as stat2 } from "fs/promises";
-import { join as join7, relative as relative3, sep as sep3 } from "path";
-var TYPED_DIRS = ["entities", "concepts", "comparisons", "queries", "meta"];
-var SKIP_DIRS = /* @__PURE__ */ new Set([".git", "node_modules"]);
-var DEFAULT_IO_CONCURRENCY = 1;
-function vaultIoConcurrency() {
-  const raw = Number.parseInt(process.env.SKILLWIKI_VAULT_IO_CONCURRENCY ?? "", 10);
-  return Number.isFinite(raw) && raw > 0 ? Math.min(raw, 64) : DEFAULT_IO_CONCURRENCY;
-}
-function decodeProcMountPath(value) {
-  return value.replace(/\\040/g, " ");
-}
-function isRcloneFuseVaultFromMounts(root, mounts) {
-  return mounts.split(/\r?\n/).some((line) => {
-    const parts = line.split(" ");
-    if (parts.length < 3) return false;
-    const mountPoint = decodeProcMountPath(parts[1]);
-    const fsType = parts[2];
-    return fsType === "fuse.rclone" && (root === mountPoint || root.startsWith(`${mountPoint}/`));
-  });
-}
-function resolveReadOnlyVaultRootWithMounts(root, mounts) {
-  if (/^(1|true|yes)$/i.test(process.env.SKILLWIKI_DISABLE_VAULT_READ_MIRROR ?? "")) {
-    return { root, mirrored: false };
-  }
-  const explicitMirror = process.env.SKILLWIKI_VAULT_READ_MIRROR;
-  if (explicitMirror && existsSync4(join7(explicitMirror, "SCHEMA.md"))) {
-    return { root: explicitMirror, mirrored: explicitMirror !== root };
-  }
-  const siblingMirror = `${root}-git`;
-  if (isRcloneFuseVaultFromMounts(root, mounts) && existsSync4(join7(siblingMirror, "SCHEMA.md"))) {
-    return { root: siblingMirror, mirrored: true };
-  }
-  return { root, mirrored: false };
-}
-function resolveReadOnlyVaultRoot(root) {
-  let mounts = "";
-  try {
-    mounts = readFileSync4("/proc/mounts", "utf8");
-  } catch {
-  }
-  return resolveReadOnlyVaultRootWithMounts(root, mounts);
-}
-async function mapWithConcurrency(items, limit, mapper) {
-  const out = new Array(items.length);
-  let next = 0;
-  const workers = Array.from({ length: Math.min(Math.max(1, limit), items.length) }, async () => {
-    for (; ; ) {
-      const index = next++;
-      if (index >= items.length) return;
-      out[index] = await mapper(items[index], index);
-    }
-  });
-  await Promise.all(workers);
-  return out;
-}
-async function scanVault(root) {
-  try {
-    await stat2(join7(root, "SCHEMA.md"));
-  } catch {
-    return err("VAULT_PATH_INVALID", { root, reason: "SCHEMA.md missing" });
-  }
-  const all = await walk(root);
-  const rels = all.map((p) => ({ absPath: p, relPath: relative3(root, p).split(sep3).join("/") }));
-  return ok({
-    root,
-    allMarkdown: rels,
-    typedKnowledge: rels.filter((p) => TYPED_DIRS.some((d) => p.relPath.startsWith(d + "/"))),
-    raw: rels.filter((p) => p.relPath.startsWith("raw/")),
-    workItems: rels.filter((p) => /^projects\/[^/]+\/work\/[^/]+\/(spec|plan|log)\.md$/.test(p.relPath)),
-    compound: rels.filter((p) => /^projects\/[^/]+\/compound\//.test(p.relPath))
-  });
-}
-async function walk(dir) {
-  const entries = await readdir(dir, { withFileTypes: true });
-  const out = [];
-  const subdirs = [];
-  for (const e of entries) {
-    const p = join7(dir, e.name);
-    if (e.isDirectory()) {
-      if (SKIP_DIRS.has(e.name)) continue;
-      subdirs.push(p);
-    } else if (e.isFile() && e.name.endsWith(".md")) out.push(p);
-  }
-  const nested = await mapWithConcurrency(subdirs, Math.min(8, vaultIoConcurrency()), walk);
-  for (const files of nested) out.push(...files);
-  return out;
-}
-async function readPage(p) {
-  return readFile5(p.absPath, "utf8");
-}
-async function readPageCached(p, cache) {
-  if (!cache) return readPage(p);
-  const existing = cache.get(p.absPath);
-  if (existing) return existing;
-  const pending = readPage(p);
-  cache.set(p.absPath, pending);
-  return pending;
-}
+import { dirname } from "path";
 
 // src/parsers/wikilinks.ts
 var FENCE = /```[\s\S]*?```|`[^`\n]*`/g;
@@ -1518,7 +823,7 @@ async function runGraphBuild(input) {
   const adamicAdar = computeAdamicAdar(adjacency);
   const edge_count = Object.values(adjacency).reduce((acc, arr) => acc + arr.length, 0);
   try {
-    await mkdir(dirname3(input.out), { recursive: true });
+    await mkdir(dirname(input.out), { recursive: true });
     await writeFile(input.out, JSON.stringify({ adjacency, adamicAdar }, null, 2));
   } catch (e) {
     return { exitCode: ExitCode.WRITE_FAILED, result: err("WRITE_FAILED", { message: String(e) }) };
@@ -1561,102 +866,8 @@ function computeAdamicAdar(adj) {
   return out;
 }
 
-// src/utils/dotenv.ts
-import { readFile as readFile6, writeFile as writeFile2, mkdir as mkdir2 } from "fs/promises";
-import { dirname as dirname4 } from "path";
-var CONFIG_KEYS = [
-  "WIKI_PATH",
-  "WIKI_LANG",
-  "SKILLWIKI_HOST_ID",
-  "AUTO_COMMIT",
-  "BACKUP_ENDPOINT",
-  "BACKUP_BUCKET",
-  "BACKUP_REGION",
-  "BACKUP_ACCESS_KEY_ID",
-  "BACKUP_SECRET_ACCESS_KEY"
-];
-var _whitelist = new Set(CONFIG_KEYS);
-var PROFILE_PATH_RE = /^WIKI_([A-Z][A-Z0-9_]{0,31})_PATH$/;
-var PROFILE_LANG_RE = /^WIKI_([A-Z][A-Z0-9_]{0,31})_LANG$/;
-var PROFILE_DEFAULT_RE = /^WIKI_DEFAULT$/;
-function isValidWikiProfileKey(key) {
-  if (key === "WIKI_PATH" || key === "WIKI_LANG") return false;
-  return PROFILE_PATH_RE.test(key) || PROFILE_LANG_RE.test(key) || PROFILE_DEFAULT_RE.test(key);
-}
-function profileKey(name, suffix) {
-  return `WIKI_${name.toUpperCase().replace(/-/g, "_").replace(/[^A-Z0-9_]/g, "")}_${suffix}`;
-}
-function parseDotenvText(text) {
-  const out = {};
-  for (const rawLine of text.split(/\r?\n/)) {
-    const line = rawLine.trim();
-    if (line.length === 0 || line.startsWith("#")) continue;
-    const eq = line.indexOf("=");
-    if (eq <= 0) continue;
-    const key = line.slice(0, eq).trim();
-    const value = line.slice(eq + 1).trim();
-    if (!_whitelist.has(key) && !isValidWikiProfileKey(key)) continue;
-    if (value.length === 0) continue;
-    out[key] = value;
-  }
-  return out;
-}
-async function parseDotenvFile(path) {
-  let text;
-  try {
-    text = await readFile6(path, "utf8");
-  } catch {
-    return {};
-  }
-  return parseDotenvText(text);
-}
-async function writeDotenv(filePath, entries, originalContent) {
-  const lines = originalContent !== void 0 ? updateLines(originalContent, entries) : freshLines(entries);
-  await mkdir2(dirname4(filePath), { recursive: true });
-  await writeFile2(filePath, lines.join("\n") + "\n", "utf8");
-}
-function freshLines(entries) {
-  const out = [];
-  for (const [key, value] of Object.entries(entries)) {
-    if (value !== void 0) out.push(`${key}=${value}`);
-  }
-  return out;
-}
-function updateLines(originalContent, entries) {
-  let rawLines = originalContent.split(/\r?\n/);
-  if (rawLines.length > 0 && rawLines[rawLines.length - 1] === "") {
-    rawLines = rawLines.slice(0, -1);
-  }
-  const keysToWrite = new Set(Object.keys(entries));
-  const out = [];
-  for (const line of rawLines) {
-    const trimmed = line.trim();
-    if (trimmed.length === 0 || trimmed.startsWith("#")) {
-      out.push(line);
-      continue;
-    }
-    const eq = trimmed.indexOf("=");
-    if (eq <= 0) {
-      out.push(line);
-      continue;
-    }
-    const key = trimmed.slice(0, eq).trim();
-    if (keysToWrite.has(key)) {
-      out.push(`${key}=${entries[key]}`);
-      keysToWrite.delete(key);
-    } else {
-      out.push(line);
-    }
-  }
-  for (const key of keysToWrite) {
-    const value = entries[key];
-    if (value !== void 0) out.push(`${key}=${value}`);
-  }
-  return out;
-}
-
 // src/utils/wiki-path.ts
-import { join as join8 } from "path";
+import { join as join6 } from "path";
 async function resolveInitTimePath(input) {
   const chain = [];
   if (input.flag !== void 0 && input.flag.length > 0) {
@@ -1669,27 +880,27 @@ async function resolveInitTimePath(input) {
     return { path: input.envValue, source: "env", ...input.explain ? { chain } : {} };
   }
   if (input.explain) chain.push({ source: "env", matched: false });
-  const sw = await parseDotenvFile(join8(input.home, ".skillwiki", ".env"));
+  const sw = await parseDotenvFile(join6(input.home, ".skillwiki", ".env"));
   if (sw.WIKI_PATH !== void 0) {
     if (input.explain) chain.push({ source: "skillwiki-dotenv", matched: true, value: sw.WIKI_PATH });
     return { path: sw.WIKI_PATH, source: "skillwiki-dotenv", ...input.explain ? { chain } : {} };
   }
   if (input.explain) chain.push({ source: "skillwiki-dotenv", matched: false });
-  const hermes = await parseDotenvFile(join8(input.home, ".hermes", ".env"));
+  const hermes = await parseDotenvFile(join6(input.home, ".hermes", ".env"));
   if (hermes.WIKI_PATH !== void 0) {
     if (input.explain) chain.push({ source: "hermes-dotenv", matched: true, value: hermes.WIKI_PATH });
     return { path: hermes.WIKI_PATH, source: "hermes-dotenv", ...input.explain ? { chain } : {} };
   }
   if (input.explain) chain.push({ source: "hermes-dotenv", matched: false });
   if (input.cwd) {
-    const projCfg = await parseDotenvFile(join8(input.cwd, ".skillwiki", ".env"));
+    const projCfg = await parseDotenvFile(join6(input.cwd, ".skillwiki", ".env"));
     if (projCfg.WIKI_PATH !== void 0) {
       if (input.explain) chain.push({ source: "project-dotenv", matched: true, value: projCfg.WIKI_PATH });
       return { path: projCfg.WIKI_PATH, source: "project-dotenv", ...input.explain ? { chain } : {} };
     }
   }
   if (input.explain) chain.push({ source: "project-dotenv", matched: false });
-  const fallback = join8(input.home, "wiki");
+  const fallback = join6(input.home, "wiki");
   if (input.explain) chain.push({ source: "default", matched: true, value: fallback });
   return { path: fallback, source: "default", ...input.explain ? { chain } : {} };
 }
@@ -1700,7 +911,7 @@ async function resolveRuntimePath(input) {
     return ok({ path: input.flag, source: "flag", ...input.explain ? { chain } : {} });
   }
   if (input.explain) chain.push({ source: "flag", matched: false });
-  const swGlobal = await parseDotenvFile(join8(input.home, ".skillwiki", ".env"));
+  const swGlobal = await parseDotenvFile(join6(input.home, ".skillwiki", ".env"));
   const wikiName = input.wiki;
   if (wikiName !== void 0 && wikiName.length > 0) {
     if (wikiName.toLowerCase() === "default") {
@@ -1744,7 +955,7 @@ async function resolveRuntimePath(input) {
   }
   if (input.explain) chain.push({ source: "env", matched: false });
   if (input.cwd) {
-    const projCfg = await parseDotenvFile(join8(input.cwd, ".skillwiki", ".env"));
+    const projCfg = await parseDotenvFile(join6(input.cwd, ".skillwiki", ".env"));
     if (projCfg.WIKI_PATH !== void 0) {
       if (input.explain) chain.push({ source: "project-dotenv", matched: true, value: projCfg.WIKI_PATH });
       return ok({ path: projCfg.WIKI_PATH, source: "project-dotenv", ...input.explain ? { chain } : {} });
@@ -1864,8 +1075,8 @@ function simulateRemoval(adj, removed) {
 }
 
 // src/commands/audit.ts
-import { readFile as readFile7, stat as stat4 } from "fs/promises";
-import { dirname as dirname5, resolve as resolve3, join as join10 } from "path";
+import { readFile as readFile4, stat as stat3 } from "fs/promises";
+import { dirname as dirname2, resolve as resolve2, join as join8 } from "path";
 
 // src/parsers/citations.ts
 var FENCE2 = /```[\s\S]*?```/g;
@@ -1975,9 +1186,9 @@ function hasWikilinkCitations(body) {
 }
 
 // src/utils/raw-source.ts
-import { existsSync as existsSync5 } from "fs";
-import { stat as stat3 } from "fs/promises";
-import { join as join9 } from "path";
+import { existsSync as existsSync4 } from "fs";
+import { stat as stat2 } from "fs/promises";
+import { join as join7 } from "path";
 function normalizeRawSourceTarget(entry) {
   let target = entry.trim().replace(/^"/, "").replace(/"$/, "").replace(/^'/, "").replace(/'$/, "");
   target = target.replace(/^\^\[/, "").replace(/\]$/, "");
@@ -1987,21 +1198,21 @@ function normalizeRawSourceTarget(entry) {
 function rawSourceTargetCandidates(vault, target) {
   const normalized = normalizeRawSourceTarget(target);
   if (!normalized) return [];
-  const candidates = [join9(vault, normalized)];
-  if (!normalized.endsWith(".md")) candidates.push(join9(vault, `${normalized}.md`));
+  const candidates = [join7(vault, normalized)];
+  if (!normalized.endsWith(".md")) candidates.push(join7(vault, `${normalized}.md`));
   if (normalized.startsWith("raw/")) {
-    candidates.push(join9(vault, "_archive", normalized));
-    if (!normalized.endsWith(".md")) candidates.push(join9(vault, "_archive", `${normalized}.md`));
+    candidates.push(join7(vault, "_archive", normalized));
+    if (!normalized.endsWith(".md")) candidates.push(join7(vault, "_archive", `${normalized}.md`));
   }
   return [...new Set(candidates)];
 }
 function rawSourceTargetExistsSync(vault, target) {
-  return rawSourceTargetCandidates(vault, target).some((candidate) => existsSync5(candidate));
+  return rawSourceTargetCandidates(vault, target).some((candidate) => existsSync4(candidate));
 }
 async function rawSourceTargetExists(vault, target) {
   for (const candidate of rawSourceTargetCandidates(vault, target)) {
     try {
-      await stat3(candidate);
+      await stat2(candidate);
       return true;
     } catch {
     }
@@ -2013,7 +1224,7 @@ async function rawSourceTargetExists(vault, target) {
 async function runAudit(input) {
   let text;
   try {
-    text = await readFile7(input.file, "utf8");
+    text = await readFile4(input.file, "utf8");
   } catch {
     return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: input.file }) };
   }
@@ -2021,7 +1232,7 @@ async function runAudit(input) {
   if (!fm.ok) return { exitCode: ExitCode.INVALID_FRONTMATTER, result: fm };
   const split = splitFrontmatter(text);
   const body = split.ok ? split.data.body : text;
-  const vault = await findVaultRoot(dirname5(resolve3(input.file)));
+  const vault = await findVaultRoot(dirname2(resolve2(input.file)));
   if (!vault) return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID") };
   const markers = extractCitationMarkers(body);
   const resolved = await Promise.all(markers.map(async (m) => {
@@ -2066,11 +1277,11 @@ async function findVaultRoot(start) {
   let cur = start;
   for (let i = 0; i < 20; i++) {
     try {
-      await stat4(join10(cur, "SCHEMA.md"));
+      await stat3(join8(cur, "SCHEMA.md"));
       return cur;
     } catch {
     }
-    const parent = dirname5(cur);
+    const parent = dirname2(cur);
     if (parent === cur) return null;
     cur = parent;
   }
@@ -2158,11 +1369,11 @@ ${broken.map((b) => `  ${b.page}:[[${b.slug}]] (line ${b.line})`).join("\n")}` }
 }
 
 // src/commands/tag-audit.ts
-import { readFile as readFile8 } from "fs/promises";
-import { join as join11 } from "path";
+import { readFile as readFile5 } from "fs/promises";
+import { join as join9 } from "path";
 
 // src/parsers/taxonomy.ts
-import yaml2 from "js-yaml";
+import yaml from "js-yaml";
 var TAG_SLUG_RE = /^[a-z0-9][a-z0-9_./-]*$/;
 function taxonomyItemIndent(yamlText) {
   const lines = yamlText.split(/\r?\n/);
@@ -2184,12 +1395,12 @@ function parseTaxonomyDocument(schemaText) {
   const nextHeading = /^#{1,2}[ \t]+/m.exec(unboundedTail);
   const sectionEnd = nextHeading?.index === void 0 ? schemaText.length : afterHeading + nextHeading.index;
   const sectionText = schemaText.slice(afterHeading, sectionEnd);
-  const open2 = /^```yaml[ \t]*\r?$/m.exec(sectionText);
-  if (!open2 || open2.index === void 0) {
+  const open = /^```yaml[ \t]*\r?$/m.exec(sectionText);
+  if (!open || open.index === void 0) {
     return err("NO_TAXONOMY_BLOCK", { message: "Fenced YAML taxonomy block not found" });
   }
-  const openStart = afterHeading + open2.index;
-  const yamlStart = openStart + open2[0].length + 1;
+  const openStart = afterHeading + open.index;
+  const yamlStart = openStart + open[0].length + 1;
   const afterOpen = schemaText.slice(yamlStart, sectionEnd);
   const close = /^```[ \t]*\r?$/m.exec(afterOpen);
   if (!close || close.index === void 0) {
@@ -2201,7 +1412,7 @@ function parseTaxonomyDocument(schemaText) {
   const yamlText = schemaText.slice(yamlStart, yamlEnd);
   let parsed;
   try {
-    parsed = yaml2.load(yamlText, { schema: yaml2.JSON_SCHEMA });
+    parsed = yaml.load(yamlText, { schema: yaml.JSON_SCHEMA });
   } catch (error) {
     return err("INVALID_FRONTMATTER", { message: getErrorMessage(error) });
   }
@@ -2221,8 +1432,8 @@ function extractTaxonomy(schemaText) {
   return ok(parsed.data.tags);
 }
 function renderTag(tag) {
-  const roundTrip = yaml2.load(`value: ${tag}
-`, { schema: yaml2.JSON_SCHEMA });
+  const roundTrip = yaml.load(`value: ${tag}
+`, { schema: yaml.JSON_SCHEMA });
   return typeof roundTrip.value === "string" && roundTrip.value === tag ? tag : JSON.stringify(tag);
 }
 function taxonomyCommentForPage(page, date, reason) {
@@ -2276,13 +1487,43 @@ function reconcileTaxonomyDocument(schemaText, input) {
     changed: true
   });
 }
+function taxonomyEnvelope(text, doc) {
+  return text.slice(0, doc.yamlStart) + "<taxonomy-yaml>" + text.slice(doc.closingFenceStart);
+}
+function mergeTaxonomyConflict(baseText, oursText, theirsText) {
+  const base = parseTaxonomyDocument(baseText);
+  const ours = parseTaxonomyDocument(oursText);
+  const theirs = parseTaxonomyDocument(theirsText);
+  if (!base.ok) return base;
+  if (!ours.ok) return ours;
+  if (!theirs.ok) return theirs;
+  const envelope = taxonomyEnvelope(baseText, base.data);
+  if (taxonomyEnvelope(oursText, ours.data) !== envelope || taxonomyEnvelope(theirsText, theirs.data) !== envelope) {
+    return err("SCHEME_REJECTED", { reason: "non-taxonomy-change" });
+  }
+  const baseTags = new Set(base.data.tags);
+  const addedFromOurs = ours.data.tags.filter((tag) => !baseTags.has(tag)).sort();
+  const addedFromTheirs = theirs.data.tags.filter((tag) => !baseTags.has(tag)).sort();
+  const tags = [...base.data.tags, .../* @__PURE__ */ new Set([...addedFromOurs, ...addedFromTheirs])];
+  const rendered = reconcileTaxonomyDocument(baseText, {
+    tags,
+    comment: "# -- reconciled: taxonomy-only three-stage merge --"
+  });
+  if (!rendered.ok) return rendered;
+  return ok({
+    text: rendered.data.text,
+    tags,
+    added_from_ours: addedFromOurs,
+    added_from_theirs: addedFromTheirs
+  });
+}
 
 // src/commands/tag-audit.ts
 async function runTagAudit(input) {
   const scanResult = input.scan ? ok(input.scan) : await scanVault(input.vault);
   if (!scanResult.ok) return { exitCode: ExitCode.VAULT_PATH_INVALID, result: scanResult };
   const scan = scanResult.data;
-  const schemaText = await readFile8(join11(input.vault, "SCHEMA.md"), "utf8");
+  const schemaText = await readFile5(join9(input.vault, "SCHEMA.md"), "utf8");
   const tax = extractTaxonomy(schemaText);
   if (!tax.ok) return { exitCode: ExitCode.INVALID_FRONTMATTER, result: tax };
   const allowed = new Set(tax.data);
@@ -2299,69 +1540,328 @@ async function runTagAudit(input) {
         pageViolations.push({ page: p.relPath, tag: t });
       }
     }
-    return pageViolations;
+    return pageViolations;
+  });
+  for (const result of perPage) {
+    if (!Array.isArray(result)) {
+      return { exitCode: ExitCode.INVALID_FRONTMATTER, result };
+    }
+    violations.push(...result);
+  }
+  if (violations.length > 0) {
+    return { exitCode: ExitCode.TAG_NOT_IN_TAXONOMY, result: ok({ violations, taxonomy: tax.data, humanHint: violations.map((v) => `${v.page}: "${v.tag}" not in taxonomy`).join("\n") }) };
+  }
+  return { exitCode: ExitCode.OK, result: ok({ violations, taxonomy: tax.data, humanHint: "all tags valid" }) };
+}
+
+// src/commands/index-check.ts
+import { readFile as readFile6 } from "fs/promises";
+import { join as join10 } from "path";
+function normalizeIndexTarget(raw) {
+  return raw.replace(/\.md$/, "").replace(/^\.?\//, "");
+}
+async function runIndexCheck(input) {
+  const scan = input.scan ? ok(input.scan) : await scanVault(input.vault);
+  if (!scan.ok) return { exitCode: ExitCode.VAULT_PATH_INVALID, result: scan };
+  let indexText = "";
+  try {
+    indexText = await readFile6(join10(input.vault, "index.md"), "utf8");
+  } catch {
+  }
+  const indexTargets = /* @__PURE__ */ new Set();
+  const indexBare = /* @__PURE__ */ new Map();
+  for (const s of extractBodyWikilinks(indexText)) {
+    const target = normalizeIndexTarget(s);
+    indexTargets.add(target);
+    const bare = target.split("/").pop().toLowerCase();
+    const list = indexBare.get(bare) ?? [];
+    list.push(target);
+    indexBare.set(bare, list);
+  }
+  const required = /* @__PURE__ */ new Map();
+  const known = /* @__PURE__ */ new Set();
+  for (const p of scan.data.typedKnowledge) {
+    const target = p.relPath.replace(/\.md$/, "");
+    required.set(target, p.relPath);
+    known.add(target);
+  }
+  for (const p of scan.data.compound) {
+    known.add(p.relPath.replace(/\.md$/, ""));
+  }
+  const missing_from_index = [];
+  for (const [target, relPath] of required.entries()) {
+    if (indexTargets.has(target)) continue;
+    const bare = target.split("/").pop().toLowerCase();
+    const bareHits = indexBare.get(bare) ?? [];
+    const basenameOnly = bareHits.filter((t) => !t.includes("/"));
+    const sameNameRequired = [...required.keys()].filter(
+      (t) => t.split("/").pop().toLowerCase() === bare
+    );
+    if (basenameOnly.length === 1 && sameNameRequired.length === 1) continue;
+    missing_from_index.push(relPath);
+  }
+  const ghost_entries = [];
+  for (const target of indexTargets) {
+    if (known.has(target)) continue;
+    if (!target.includes("/")) {
+      const bare = target.toLowerCase();
+      const matches = [...known].filter((k) => k.split("/").pop().toLowerCase() === bare);
+      if (matches.length === 0) ghost_entries.push(target);
+      continue;
+    }
+    ghost_entries.push(target);
+  }
+  const hintLines = [];
+  if (missing_from_index.length > 0) hintLines.push(`missing from index: ${missing_from_index.length}`, ...missing_from_index.map((p) => `  ${p}`));
+  if (ghost_entries.length > 0) hintLines.push(`ghost entries: ${ghost_entries.length}`, ...ghost_entries.map((g) => `  ${g}`));
+  if (hintLines.length === 0) hintLines.push("index OK");
+  if (missing_from_index.length > 0 || ghost_entries.length > 0) {
+    return { exitCode: ExitCode.INDEX_INCOMPLETE, result: ok({ missing_from_index, ghost_entries, humanHint: hintLines.join("\n") }) };
+  }
+  return { exitCode: ExitCode.OK, result: ok({ missing_from_index, ghost_entries, humanHint: hintLines.join("\n") }) };
+}
+
+// src/commands/project-index.ts
+import { readdir, readFile as readFile7, mkdir as mkdir2 } from "fs/promises";
+import { join as join11, dirname as dirname3, basename } from "path";
+var LAYER2_DIRS = ["entities", "concepts", "comparisons", "queries", "meta"];
+var PROJECT_LOCAL_DIRS = ["requirements", "work", "architecture", "history"];
+async function scanMarkdownTree(rootAbs, rootRel) {
+  const found = [];
+  let entries;
+  try {
+    entries = await readdir(rootAbs, { withFileTypes: true });
+  } catch {
+    return found;
+  }
+  for (const entry of entries) {
+    const abs = join11(rootAbs, entry.name);
+    const rel = `${rootRel}/${entry.name}`;
+    if (entry.isDirectory()) {
+      found.push(...await scanMarkdownTree(abs, rel));
+    } else if (entry.isFile() && entry.name.endsWith(".md")) {
+      found.push(rel);
+    }
+  }
+  return found;
+}
+function projectLocalType(slug, page, data) {
+  if (page.startsWith(`projects/${slug}/requirements/`)) return "requirement";
+  if (page.startsWith(`projects/${slug}/work/`)) {
+    if (typeof data.kind === "string") return data.kind;
+    const name = basename(page, ".md");
+    if (name === "spec" || name === "plan" || name === "retro") return name;
+    return "work";
+  }
+  if (page.startsWith(`projects/${slug}/architecture/`)) {
+    return typeof data.type === "string" ? data.type : "architecture";
+  }
+  if (page.startsWith(`projects/${slug}/history/`)) {
+    if (typeof data.kind === "string") return data.kind;
+    if (typeof data.type === "string") return data.type;
+    return "history";
+  }
+  return typeof data.type === "string" ? data.type : "project";
+}
+async function renderProjectIndex(vault, slug, opts = {}) {
+  const projectDir = join11(vault, "projects", slug);
+  try {
+    await readdir(projectDir);
+  } catch {
+    return err("PROJECT_NOT_FOUND", { slug, path: projectDir });
+  }
+  const wikilinkPattern = `[[${slug}]]`;
+  const entries = [];
+  const compoundDir = join11(vault, "projects", slug, "compound");
+  try {
+    const compoundFiles = await readdir(compoundDir, { withFileTypes: true });
+    for (const entry of compoundFiles) {
+      if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
+      const filePath = join11(compoundDir, entry.name);
+      let text;
+      try {
+        text = await readFile7(filePath, "utf8");
+      } catch {
+        continue;
+      }
+      const fm = extractFrontmatter(text);
+      if (!fm.ok) continue;
+      entries.push({
+        page: `projects/${slug}/compound/${entry.name}`,
+        type: typeof fm.data.type === "string" ? fm.data.type : "compound",
+        title: typeof fm.data.title === "string" ? fm.data.title : entry.name.replace(/\.md$/, "")
+      });
+    }
+  } catch {
+  }
+  for (const dir of LAYER2_DIRS) {
+    let files;
+    try {
+      files = await readdir(join11(vault, dir), { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of files) {
+      if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
+      const filePath = join11(vault, dir, entry.name);
+      let text;
+      try {
+        text = await readFile7(filePath, "utf8");
+      } catch {
+        continue;
+      }
+      const fm = extractFrontmatter(text);
+      if (!fm.ok) continue;
+      const pp = fm.data.provenance_projects;
+      if (!Array.isArray(pp) || !pp.some((p) => String(p) === wikilinkPattern)) continue;
+      entries.push({
+        page: `${dir}/${entry.name}`,
+        type: typeof fm.data.type === "string" ? fm.data.type : dir.slice(0, -1),
+        title: typeof fm.data.title === "string" ? fm.data.title : entry.name.replace(/\.md$/, "")
+      });
+    }
+  }
+  for (const dir of PROJECT_LOCAL_DIRS) {
+    const rootAbs = join11(projectDir, dir);
+    const rootRel = `projects/${slug}/${dir}`;
+    const pages = await scanMarkdownTree(rootAbs, rootRel);
+    for (const page of pages) {
+      const filePath = join11(vault, page);
+      let text;
+      try {
+        text = await readFile7(filePath, "utf8");
+      } catch {
+        continue;
+      }
+      const fm = extractFrontmatter(text);
+      if (!fm.ok) continue;
+      entries.push({
+        page,
+        type: projectLocalType(slug, page, fm.data),
+        title: typeof fm.data.title === "string" ? fm.data.title : basename(page, ".md")
+      });
+    }
+  }
+  const typeOrder = {
+    entity: 0,
+    concept: 1,
+    comparison: 2,
+    query: 3,
+    summary: 4,
+    meta: 5,
+    requirement: 6,
+    spec: 7,
+    plan: 8,
+    retro: 9,
+    architecture: 10,
+    pattern: 11,
+    gotcha: 12,
+    lesson: 13,
+    antipattern: 14,
+    compound: 15,
+    work: 16,
+    history: 17
+  };
+  entries.sort((a, b) => {
+    const ta = typeOrder[a.type] ?? 99;
+    const tb = typeOrder[b.type] ?? 99;
+    return ta !== tb ? ta - tb : a.title.localeCompare(b.title);
   });
-  for (const result of perPage) {
-    if (!Array.isArray(result)) {
-      return { exitCode: ExitCode.INVALID_FRONTMATTER, result };
+  const today = opts.today ?? (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  const grouped = /* @__PURE__ */ new Map();
+  for (const e of entries) {
+    const group = e.type;
+    if (!grouped.has(group)) grouped.set(group, []);
+    grouped.get(group).push(e);
+  }
+  let body = `# Knowledge Index: ${slug}
+
+Autogenerated by \`skillwiki project-index\` on ${today}.
+
+`;
+  for (const [type, items] of grouped) {
+    body += `## ${type}
+
+`;
+    for (const item of items) {
+      const pageRef = item.page.replace(/\.md$/, "");
+      body += `- [[${pageRef}]] \u2014 ${item.title}
+`;
     }
-    violations.push(...result);
+    body += "\n";
   }
-  if (violations.length > 0) {
-    return { exitCode: ExitCode.TAG_NOT_IN_TAXONOMY, result: ok({ violations, taxonomy: tax.data, humanHint: violations.map((v) => `${v.page}: "${v.tag}" not in taxonomy`).join("\n") }) };
+  if (entries.length === 0) {
+    body += `No Layer 2 pages reference \`[[${slug}]]\` in provenance_projects.
+`;
   }
-  return { exitCode: ExitCode.OK, result: ok({ violations, taxonomy: tax.data, humanHint: "all tags valid" }) };
+  return ok({
+    text: body,
+    entries,
+    index_path: `projects/${slug}/knowledge.md`
+  });
 }
-
-// src/commands/index-check.ts
-import { readFile as readFile9 } from "fs/promises";
-import { join as join12 } from "path";
-async function runIndexCheck(input) {
-  const scan = input.scan ? ok(input.scan) : await scanVault(input.vault);
-  if (!scan.ok) return { exitCode: ExitCode.VAULT_PATH_INVALID, result: scan };
-  let indexText = "";
+async function runProjectIndex(input) {
+  const slug = input.slug;
+  const projectDir = join11(input.vault, "projects", slug);
+  const rendered = await renderProjectIndex(input.vault, slug);
+  if (!rendered.ok) {
+    return {
+      exitCode: rendered.error === "PROJECT_NOT_FOUND" ? ExitCode.PROJECT_NOT_FOUND : ExitCode.WRITE_FAILED,
+      result: rendered
+    };
+  }
+  const indexPath = join11(projectDir, "knowledge.md");
+  const entries = rendered.data.entries;
+  let existing = false;
+  let stale = false;
   try {
-    indexText = await readFile9(join12(input.vault, "index.md"), "utf8");
+    const existingText = await readFile7(indexPath, "utf8");
+    existing = true;
+    const existingEntries = existingText.split("\n").filter((l) => l.startsWith("- [["));
+    const existingPages = new Set(existingEntries.map((l) => {
+      const m = l.match(/\[\[([^\]]+)\]\]/);
+      return m ? m[1] : "";
+    }));
+    const currentPages = new Set(entries.map((e) => e.page.replace(/\.md$/, "")));
+    stale = existingPages.size !== currentPages.size || [...currentPages].some((p) => !existingPages.has(p));
   } catch {
   }
-  const indexSlugsLower = /* @__PURE__ */ new Map();
-  for (const s of extractBodyWikilinks(indexText)) {
-    const tail = s.split("/").pop();
-    indexSlugsLower.set(tail.toLowerCase(), tail);
-  }
-  const fileSlugs = /* @__PURE__ */ new Map();
-  const requiredSlugs = /* @__PURE__ */ new Map();
-  for (const p of scan.data.typedKnowledge) {
-    const slug = p.relPath.replace(/\.md$/, "").split("/").pop();
-    fileSlugs.set(slug, p.relPath);
-    requiredSlugs.set(slug, p.relPath);
-  }
-  for (const p of scan.data.compound) {
-    const slug = p.relPath.replace(/\.md$/, "").split("/").pop();
-    fileSlugs.set(slug, p.relPath);
-  }
-  const missing_from_index = [];
-  for (const [slug, relPath] of requiredSlugs.entries()) {
-    if (!indexSlugsLower.has(slug.toLowerCase())) missing_from_index.push(relPath);
-  }
-  const fileSlugsLower = new Set([...fileSlugs.keys()].map((s) => s.toLowerCase()));
-  const ghost_entries = [];
-  for (const [lower, orig] of indexSlugsLower) {
-    if (!fileSlugsLower.has(lower)) ghost_entries.push(orig);
-  }
-  const hintLines = [];
-  if (missing_from_index.length > 0) hintLines.push(`missing from index: ${missing_from_index.length}`, ...missing_from_index.map((p) => `  ${p}`));
-  if (ghost_entries.length > 0) hintLines.push(`ghost entries: ${ghost_entries.length}`, ...ghost_entries.map((g) => `  ${g}`));
-  if (hintLines.length === 0) hintLines.push("index OK");
-  if (missing_from_index.length > 0 || ghost_entries.length > 0) {
-    return { exitCode: ExitCode.INDEX_INCOMPLETE, result: ok({ missing_from_index, ghost_entries, humanHint: hintLines.join("\n") }) };
+  if (input.apply) {
+    try {
+      await mkdir2(dirname3(indexPath), { recursive: true });
+    } catch (e) {
+      return {
+        exitCode: ExitCode.WRITE_FAILED,
+        result: err("WRITE_FAILED", { file: indexPath, message: String(e) })
+      };
+    }
+    const written = await atomicWriteText(indexPath, rendered.data.text);
+    if (!written.ok) {
+      return { exitCode: ExitCode.WRITE_FAILED, result: written };
+    }
   }
-  return { exitCode: ExitCode.OK, result: ok({ missing_from_index, ghost_entries, humanHint: hintLines.join("\n") }) };
+  const action = input.apply ? `written ${entries.length} entries to ${indexPath}` : `${entries.length} entries found (use --apply to write)`;
+  const staleHint = stale ? " (STALE \u2014 existing index outdated)" : existing ? " (up to date)" : "";
+  return {
+    exitCode: ExitCode.OK,
+    result: ok({
+      slug,
+      entries,
+      existing,
+      stale,
+      index_path: rendered.data.index_path,
+      humanHint: `project: ${slug}
+entries: ${entries.length}${staleHint}
+${action}
+
+${entries.map((e) => `  ${e.type}: [[${e.page.replace(/\.md$/, "")}]] \u2014 ${e.title}`).join("\n")}`
+    })
+  };
 }
 
 // src/commands/stale.ts
-import { readdir as readdir2, rename as rename2, mkdir as mkdir3, readFile as readFile10 } from "fs/promises";
-import { join as join13 } from "path";
+import { readdir as readdir2, rename, mkdir as mkdir3, readFile as readFile8 } from "fs/promises";
+import { join as join12 } from "path";
 
 // src/parsers/expiry-annotations.ts
 var HEADING_RE = /^#{1,6}\s+(.+)$/;
@@ -2398,8 +1898,8 @@ function parseExpiryAnnotations(content, pagePath) {
 }
 
 // src/commands/stale.ts
-function daysSince(isoDate2) {
-  return Math.floor((Date.now() - Date.parse(isoDate2)) / 864e5);
+function daysSince(isoDate) {
+  return Math.floor((Date.now() - Date.parse(isoDate)) / 864e5);
 }
 async function runStale(input) {
   const scanResult = input.scan ? ok(input.scan) : await scanVault(input.vault);
@@ -2410,7 +1910,7 @@ async function runStale(input) {
   const archived = [];
   const workDirs = /* @__PURE__ */ new Map();
   const workDirsBySlug = /* @__PURE__ */ new Map();
-  const projectsDir = join13(input.vault, "projects");
+  const projectsDir = join12(input.vault, "projects");
   let projectSlugs = [];
   try {
     projectSlugs = (await readdir2(projectsDir, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => d.name);
@@ -2423,7 +1923,7 @@ async function runStale(input) {
     projectSlugs = [input.project];
   }
   for (const slug of projectSlugs) {
-    const workPath = join13(projectsDir, slug, "work");
+    const workPath = join12(projectsDir, slug, "work");
     let entries;
     try {
       entries = await readdir2(workPath, { withFileTypes: true });
@@ -2434,7 +1934,7 @@ async function runStale(input) {
     for (const e of entries) {
       if (!e.isDirectory()) continue;
       const relDir = `projects/${slug}/work/${e.name}`;
-      const absDir = join13(workPath, e.name);
+      const absDir = join12(workPath, e.name);
       let status = "";
       let files;
       try {
@@ -2447,7 +1947,7 @@ async function runStale(input) {
       for (const f of files) {
         if (!f.endsWith(".md")) continue;
         try {
-          const fm = extractFrontmatter(await readFile10(join13(absDir, f), "utf8"));
+          const fm = extractFrontmatter(await readFile8(join12(absDir, f), "utf8"));
           if (fm.ok && typeof fm.data.status === "string") {
             status = fm.data.status;
             break;
@@ -2478,9 +1978,9 @@ async function runStale(input) {
       if (input.project && !project.includes(input.project)) return null;
       let inferred = false;
       if (input.forceScan && !kind) {
-        const basename4 = t.relPath.split("/").pop();
-        if (!LOOP_CYCLE_PATTERN.test(basename4)) {
-          const m = basename4.match(KIND_FROM_FILENAME);
+        const basename3 = t.relPath.split("/").pop();
+        if (!LOOP_CYCLE_PATTERN.test(basename3)) {
+          const m = basename3.match(KIND_FROM_FILENAME);
           if (m) {
             kind = m[1];
             inferred = true;
@@ -2491,9 +1991,9 @@ async function runStale(input) {
         const bodyStart = content.indexOf("---", 4);
         if (bodyStart > 0) {
           const body = content.slice(bodyStart);
-          const wikilink2 = body.match(/\[\[([a-z0-9-]+)\]\]/);
-          if (wikilink2) {
-            const candidate = wikilink2[1];
+          const wikilink = body.match(/\[\[([a-z0-9-]+)\]\]/);
+          if (wikilink) {
+            const candidate = wikilink[1];
             if (workDirsBySlug.has(candidate)) {
               project = `[[${candidate}]]`;
               inferred = true;
@@ -2543,9 +2043,9 @@ async function runStale(input) {
     }
   }
   await mapWithConcurrency([...workDirs.keys()], vaultIoConcurrency(), async (relDir) => {
-    const specPath = join13(input.vault, relDir, "spec.md");
+    const specPath = join12(input.vault, relDir, "spec.md");
     try {
-      const specContent = await readFile10(specPath, "utf8");
+      const specContent = await readFile8(specPath, "utf8");
       const specFm = extractFrontmatter(specContent);
       if (specFm.ok && typeof specFm.data.source === "string") {
         const sourcePath = specFm.data.source;
@@ -2574,7 +2074,7 @@ async function runStale(input) {
     if (daysSince(dateStr) < input.days) continue;
     let files;
     try {
-      files = await readdir2(join13(input.vault, relDir));
+      files = await readdir2(join12(input.vault, relDir));
     } catch {
       continue;
     }
@@ -2644,7 +2144,7 @@ async function runStale(input) {
   staleSections.push(...staleSectionResults.flat());
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   if (input.archive) {
-    const archiveDir = join13(input.vault, "_archive", today);
+    const archiveDir = join12(input.vault, "_archive", today);
     await mkdir3(archiveDir, { recursive: true });
     const citedRawPaths = /* @__PURE__ */ new Set();
     for (const page of scan.typedKnowledge) {
@@ -2660,9 +2160,9 @@ async function runStale(input) {
     }
     for (const t of staleTranscripts) {
       if (citedRawPaths.has(t.path) || citedRawPaths.has(t.path.replace(/\.md$/, ""))) continue;
-      const dest = join13(archiveDir, t.path.split("/").pop());
+      const dest = join12(archiveDir, t.path.split("/").pop());
       try {
-        await rename2(join13(input.vault, t.path), dest);
+        await rename(join12(input.vault, t.path), dest);
         archived.push(t.path);
       } catch {
       }
@@ -2672,18 +2172,18 @@ async function runStale(input) {
       if (parts.length >= 4 && parts[0] === "projects") {
         const slug = parts[1];
         const itemName = parts[3];
-        const histDir = join13(input.vault, "projects", slug, "history", "archived-work");
+        const histDir = join12(input.vault, "projects", slug, "history", "archived-work");
         await mkdir3(histDir, { recursive: true });
-        const dest = join13(histDir, itemName);
+        const dest = join12(histDir, itemName);
         try {
-          await rename2(join13(input.vault, w.path), dest);
+          await rename(join12(input.vault, w.path), dest);
           archived.push(w.path);
         } catch {
         }
       } else {
-        const dest = join13(archiveDir, w.path.replace(/\//g, "_"));
+        const dest = join12(archiveDir, w.path.replace(/\//g, "_"));
         try {
-          await rename2(join13(input.vault, w.path), dest);
+          await rename(join12(input.vault, w.path), dest);
           archived.push(w.path);
         } catch {
         }
@@ -2738,19 +2238,19 @@ async function runPagesize(input) {
 }
 
 // src/commands/log-rotate.ts
-import { readFile as readFile11, rename as rename3, writeFile as writeFile3, stat as stat5 } from "fs/promises";
-import { join as join14 } from "path";
+import { readFile as readFile9, rename as rename2, writeFile as writeFile2, stat as stat4 } from "fs/promises";
+import { join as join13 } from "path";
 var ENTRY_RE2 = /^## \[(\d{4})-\d{2}-\d{2}\]/gm;
 async function runLogRotate(input) {
   try {
-    await stat5(join14(input.vault, "SCHEMA.md"));
+    await stat4(join13(input.vault, "SCHEMA.md"));
   } catch {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { vault: input.vault }) };
   }
-  const logPath = join14(input.vault, "log.md");
+  const logPath = join13(input.vault, "log.md");
   let logText;
   try {
-    logText = await readFile11(logPath, "utf8");
+    logText = await readFile9(logPath, "utf8");
   } catch {
     return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: logPath }) };
   }
@@ -2767,9 +2267,9 @@ async function runLogRotate(input) {
   }
   const newestYear = matches[matches.length - 1][1];
   const rotatedName = `log-${newestYear}.md`;
-  const rotatedPath = join14(input.vault, rotatedName);
+  const rotatedPath = join13(input.vault, rotatedName);
   try {
-    await rename3(logPath, rotatedPath);
+    await rename2(logPath, rotatedPath);
     const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
     const fresh = `# Vault Log
 
@@ -2779,7 +2279,7 @@ Chronological action log. Newest entries last. Skill writes append entries; lint
 
 - Previous log moved to ${rotatedName}
 `;
-    await writeFile3(logPath, fresh, "utf8");
+    await writeFile2(logPath, fresh, "utf8");
   } catch (e) {
     return { exitCode: ExitCode.WRITE_FAILED, result: err("WRITE_FAILED", { message: String(e) }) };
   }
@@ -2812,13 +2312,13 @@ async function runTopicMapCheck(input) {
 }
 
 // src/commands/index-link-format.ts
-import { readFile as readFile12 } from "fs/promises";
-import { join as join15 } from "path";
+import { readFile as readFile10 } from "fs/promises";
+import { join as join14 } from "path";
 var MD_LINK_RE = /\[[^\[\]]+\]\([^)]+\.md\)/;
 async function runIndexLinkFormat(input) {
   let text = "";
   try {
-    text = await readFile12(join15(input.vault, "index.md"), "utf8");
+    text = await readFile10(join14(input.vault, "index.md"), "utf8");
   } catch {
   }
   const markdown_links = [];
@@ -2831,9 +2331,9 @@ ${markdown_links.map((l) => `  line ${l.line}: ${l.text}`).join("\n")}`;
 }
 
 // src/commands/dedup.ts
-import { createHash as createHash4 } from "crypto";
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4, unlinkSync as unlinkSync4 } from "fs";
-import { dirname as dirname6, join as join16, resolve as resolve4 } from "path";
+import { createHash as createHash3 } from "crypto";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4, unlinkSync as unlinkSync4 } from "fs";
+import { dirname as dirname4, join as join15, resolve as resolve3 } from "path";
 
 // src/utils/rclone.ts
 import { execFile } from "child_process";
@@ -2925,7 +2425,7 @@ async function runDedup(input) {
   const manifest = safeEntries.length > 0 ? {
     version: 1,
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
-    vault: resolve4(input.vault),
+    vault: resolve3(input.vault),
     entries: safeEntries
   } : void 0;
   const remote = await planAndMaybePruneRemote(input, safeEntries);
@@ -2937,7 +2437,7 @@ async function runDedup(input) {
   }
   if (input.manifestOut && manifest) {
     try {
-      mkdirSync4(dirname6(input.manifestOut), { recursive: true });
+      mkdirSync4(dirname4(input.manifestOut), { recursive: true });
       writeFileSync4(input.manifestOut, `${JSON.stringify(manifest, null, 2)}
 `, "utf-8");
     } catch (e) {
@@ -2952,7 +2452,7 @@ async function runDedup(input) {
       }
     }
     for (const page of scan.allMarkdown.filter((p) => !p.relPath.startsWith("raw/"))) {
-      const text = readFileSync5(join16(input.vault, page.relPath), "utf-8");
+      const text = readFileSync4(join15(input.vault, page.relPath), "utf-8");
       let updated = text;
       let changed = false;
       for (const [oldPath, newPath] of replacements) {
@@ -2970,12 +2470,12 @@ async function runDedup(input) {
         }
       }
       if (changed) {
-        writeFileSync4(join16(input.vault, page.relPath), updated);
+        writeFileSync4(join15(input.vault, page.relPath), updated);
         rewired.push(page.relPath);
       }
     }
     for (const oldPath of replacements.keys()) {
-      const fullPath = join16(input.vault, oldPath);
+      const fullPath = join15(input.vault, oldPath);
       try {
         unlinkSync4(fullPath);
         removed.push(oldPath);
@@ -3069,14 +2569,14 @@ function buildSafeEntries(vault, duplicates, unsafe) {
   return entries;
 }
 function hashRawBody(vault, relPath) {
-  const text = readFileSync5(join16(vault, relPath), "utf-8");
+  const text = readFileSync4(join15(vault, relPath), "utf-8");
   const split = splitFrontmatter(text);
   const body = split.ok ? split.data.body : text;
-  return createHash4("sha256").update(body).digest("hex");
+  return createHash3("sha256").update(body).digest("hex");
 }
 function readManifest(path) {
   try {
-    const parsed = JSON.parse(readFileSync5(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync4(path, "utf-8"));
     if (parsed.version !== 1 || !Array.isArray(parsed.entries)) {
       return err("INVALID_FRONTMATTER", { message: "dedup manifest must have version 1 and entries[]" });
     }
@@ -3092,7 +2592,7 @@ async function planAndMaybePruneRemote(input, entries) {
 }
 
 // src/utils/safe-write.ts
-import { readFile as readFile13, writeFile as writeFile4 } from "fs/promises";
+import { readFile as readFile11, writeFile as writeFile3 } from "fs/promises";
 var DEFAULT_MIN_BODY_RATIO = 0.5;
 var DEFAULT_MIN_OLD_BODY_BYTES = 200;
 function bodyBytes(text) {
@@ -3102,7 +2602,7 @@ function bodyBytes(text) {
 }
 async function readIfExists(absPath) {
   try {
-    return await readFile13(absPath, "utf8");
+    return await readFile11(absPath, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return null;
     throw e;
@@ -3225,10 +2725,10 @@ ${newBody}`;
 }
 
 // src/commands/lint.ts
-import { existsSync as existsSync7 } from "fs";
-import { readFile as readFile15, readdir as readdir3 } from "fs/promises";
-import { createHash as createHash6 } from "crypto";
-import { join as join18, relative as relative4, sep as sep4 } from "path";
+import { existsSync as existsSync6 } from "fs";
+import { readFile as readFile13, readdir as readdir3 } from "fs/promises";
+import { createHash as createHash5 } from "crypto";
+import { join as join17, relative as relative2, sep as sep2 } from "path";
 
 // src/commands/sparse-community.ts
 async function runSparseCommunity(input) {
@@ -3244,7 +2744,7 @@ async function runSparseCommunity(input) {
 }
 
 // src/commands/raw-body-dedup.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 async function runRawBodyDedup(vault, scan, pageTextCache) {
   const scanResult = scan ? ok(scan) : await scanVault(vault);
   if (!scanResult.ok) return { exitCode: ExitCode.VAULT_PATH_INVALID, result: scanResult };
@@ -3253,7 +2753,7 @@ async function runRawBodyDedup(vault, scan, pageTextCache) {
     const text = await readPageCached(raw, pageTextCache);
     const split = splitFrontmatter(text);
     if (!split.ok) return null;
-    const bodyHash = createHash5("sha256").update(split.data.body).digest("hex");
+    const bodyHash = createHash4("sha256").update(split.data.body).digest("hex");
     const fm = extractFrontmatter(text);
     let fmSha256 = null;
     if (fm.ok && typeof fm.data.sha256 === "string" && fm.data.sha256.length === 64) {
@@ -3285,9 +2785,9 @@ async function runRawBodyDedup(vault, scan, pageTextCache) {
 }
 
 // src/commands/path-too-long.ts
-import { existsSync as existsSync6 } from "fs";
-import { mkdir as mkdir4, readFile as readFile14, rename as rename4, unlink as unlink2 } from "fs/promises";
-import { dirname as dirname7, join as join17, posix as posix2, resolve as resolve5 } from "path";
+import { existsSync as existsSync5 } from "fs";
+import { mkdir as mkdir4, readFile as readFile12, rename as rename3, unlink } from "fs/promises";
+import { dirname as dirname5, join as join16, posix, resolve as resolve4 } from "path";
 var MAX_PATH_LENGTH = 240;
 var WINDOWS_ABSOLUTE_PATH_LIMIT = 259;
 async function runPathTooLong(input) {
@@ -3320,10 +2820,10 @@ async function fixPathTooLong(input) {
     }
     try {
       if (target.mode === "dedupe") {
-        await unlink2(join17(input.vault, violation.relPath));
+        await unlink(join16(input.vault, violation.relPath));
       } else {
-        await mkdir4(dirname7(join17(input.vault, target.relPath)), { recursive: true });
-        await rename4(join17(input.vault, violation.relPath), join17(input.vault, target.relPath));
+        await mkdir4(dirname5(join16(input.vault, target.relPath)), { recursive: true });
+        await rename3(join16(input.vault, violation.relPath), join16(input.vault, target.relPath));
       }
       fixed.push({ from: violation.relPath, to: target.relPath });
     } catch {
@@ -3337,7 +2837,7 @@ async function fixPathTooLong(input) {
       for (const page of afterScan.data.allMarkdown) {
         if (!shouldRewriteReferences(page.relPath)) continue;
         try {
-          const original = await readFile14(page.absPath, "utf8");
+          const original = await readFile12(page.absPath, "utf8");
           let updated = original;
           for (const fix of fixed) {
             updated = replacePathReferences(updated, fix.from, fix.to);
@@ -3374,7 +2874,7 @@ function findPathTooLongViolations(pages, maxLength) {
 }
 function maxFixPathLength(vault) {
   if (process.platform !== "win32") return MAX_PATH_LENGTH;
-  const root = resolve5(vault);
+  const root = resolve4(vault);
   const separatorBudget = root.endsWith("\\") || root.endsWith("/") ? 0 : 1;
   const absoluteSafeRelLength = WINDOWS_ABSOLUTE_PATH_LIMIT - root.length - separatorBudget;
   return Math.max(1, Math.min(MAX_PATH_LENGTH, absoluteSafeRelLength));
@@ -3400,9 +2900,9 @@ function truncateFilename(relPath, maxLength = MAX_PATH_LENGTH) {
 async function resolveFixTarget(vault, original, preferred, maxLength) {
   for (const candidate of candidateRelPaths(preferred, maxLength)) {
     if (candidate === original || candidate.length > maxLength) continue;
-    const candidatePath = join17(vault, candidate);
-    if (!existsSync6(candidatePath)) return { relPath: candidate, mode: "rename" };
-    if (await hasSameContent(join17(vault, original), candidatePath)) {
+    const candidatePath = join16(vault, candidate);
+    if (!existsSync5(candidatePath)) return { relPath: candidate, mode: "rename" };
+    if (await hasSameContent(join16(vault, original), candidatePath)) {
       return { relPath: candidate, mode: "dedupe" };
     }
   }
@@ -3411,8 +2911,8 @@ async function resolveFixTarget(vault, original, preferred, maxLength) {
 function candidateRelPaths(preferred, maxLength) {
   const candidates = [preferred];
   if (preferred.length > maxLength) return candidates;
-  const dir = posix2.dirname(preferred) === "." ? "" : posix2.dirname(preferred);
-  const filename = posix2.basename(preferred);
+  const dir = posix.dirname(preferred) === "." ? "" : posix.dirname(preferred);
+  const filename = posix.basename(preferred);
   const ext = filename.endsWith(".md") ? ".md" : "";
   const base = ext ? filename.slice(0, -3) : filename;
   const dirPrefix = dir ? `${dir}/` : "";
@@ -3426,7 +2926,7 @@ function candidateRelPaths(preferred, maxLength) {
 }
 async function hasSameContent(a, b) {
   try {
-    const [left, right] = await Promise.all([readFile14(a), readFile14(b)]);
+    const [left, right] = await Promise.all([readFile12(a), readFile12(b)]);
     return left.equals(right);
   } catch {
     return false;
@@ -3439,8 +2939,8 @@ function shouldRewriteReferences(relPath) {
 }
 function replacePathReferences(content, oldRelPath, newRelPath) {
   let updated = content.replaceAll(oldRelPath, newRelPath);
-  const oldStem = posix2.basename(oldRelPath).replace(/\.md$/, "");
-  const newStem = posix2.basename(newRelPath).replace(/\.md$/, "");
+  const oldStem = posix.basename(oldRelPath).replace(/\.md$/, "");
+  const newStem = posix.basename(newRelPath).replace(/\.md$/, "");
   if (oldStem !== newStem) {
     const oldStemEscaped = oldStem.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     const stemWikilinkRe = new RegExp(`\\[\\[${oldStemEscaped}(\\|[^\\]]*)?\\]\\]`, "g");
@@ -3534,6 +3034,10 @@ function buildCliSurface() {
   syncCmd.command("status").option("--wiki <name>").option("--include-stashes").option("--include-remote-health").option("--check-snapshotter");
   syncCmd.command("push").option("--wiki <name>");
   syncCmd.command("pull").option("--wiki <name>");
+  syncCmd.command("resolve-derived").option("--operation-id <id>").option("--wiki <name>");
+  const syncJournalCmd = syncCmd.command("journal");
+  syncJournalCmd.command("list").option("--wiki <name>");
+  syncJournalCmd.command("clear-stale").option("--dry-run").option("--wiki <name>");
   syncCmd.command("lock").option("--summary <text>").option("--ttl-minutes <n>").option("--force").option("--wiki <name>");
   syncCmd.command("unlock").option("--force").option("--wiki <name>");
   syncCmd.command("peers").option("--wiki <name>");
@@ -3553,16 +3057,16 @@ function buildCliSurface() {
   fleetCmd.command("health").option("--file <path>").option("--host-id <id>").option("--json");
   const surface = /* @__PURE__ */ new Map();
   const rootFlags = new Set(program.options.map((o) => o.long ?? o.short).filter((f) => f != null));
-  function walk2(cmd, prefix, parentFlags) {
+  function walk(cmd, prefix, parentFlags) {
     const key = prefix ? `${prefix}.${cmd.name()}` : cmd.name();
     const flags = /* @__PURE__ */ new Set([...parentFlags, ...cmd.options.map((o) => o.long ?? o.short).filter((f) => f != null)]);
     surface.set(key, flags);
     for (const sub of cmd.commands) {
-      walk2(sub, key, flags);
+      walk(sub, key, flags);
     }
   }
   for (const cmd of program.commands) {
-    walk2(cmd, "", rootFlags);
+    walk(cmd, "", rootFlags);
   }
   return surface;
 }
@@ -3838,7 +3342,7 @@ function recomputeRawSha256IfPresent(content) {
   const split = splitFrontmatter(content);
   if (!split.ok) return content;
   if (!/^sha256:\s*[0-9a-f]{64}$/m.test(split.data.rawFrontmatter)) return content;
-  const sha256 = createHash6("sha256").update(Buffer.from(split.data.body, "utf8")).digest("hex");
+  const sha256 = createHash5("sha256").update(Buffer.from(split.data.body, "utf8")).digest("hex");
   const rawFrontmatter = split.data.rawFrontmatter.replace(/^sha256:\s*[0-9a-f]{64}$/m, `sha256: ${sha256}`);
   return `---
 ${rawFrontmatter}
@@ -3886,24 +3390,24 @@ async function walkMarkdownFiles(absDir, vaultRoot) {
   const entries = await readdir3(absDir, { withFileTypes: true });
   const pages = [];
   for (const entry of entries) {
-    const absPath = join18(absDir, entry.name);
+    const absPath = join17(absDir, entry.name);
     if (entry.isDirectory()) {
       if (entry.name === ".git" || entry.name === "node_modules") continue;
       pages.push(...await walkMarkdownFiles(absPath, vaultRoot));
     } else if (entry.isFile() && entry.name.endsWith(".md")) {
-      pages.push({ absPath, relPath: relative4(vaultRoot, absPath).split(sep4).join("/") });
+      pages.push({ absPath, relPath: relative2(vaultRoot, absPath).split(sep2).join("/") });
     }
   }
   return pages;
 }
 async function collectCliRefsPages(vault) {
-  if (!existsSync7(join18(vault, "SCHEMA.md"))) {
+  if (!existsSync6(join17(vault, "SCHEMA.md"))) {
     return err("VAULT_PATH_INVALID", { root: vault, reason: "SCHEMA.md missing" });
   }
   const pages = [];
   for (const dir of CLI_REFS_TYPED_DIRS) {
-    const absDir = join18(vault, dir);
-    if (!existsSync7(absDir)) continue;
+    const absDir = join17(vault, dir);
+    if (!existsSync6(absDir)) continue;
     pages.push(...await walkMarkdownFiles(absDir, vault));
   }
   return ok(pages);
@@ -4024,7 +3528,7 @@ async function applyFileSourceUrlFix(input, scan, fileSourceUrlFlags, fileSource
   for (const relPath of fileSourceUrlFrontmatterFlags) {
     try {
       const absPath = `${input.vault}/${relPath}`;
-      const raw = await readFile15(absPath, "utf8");
+      const raw = await readFile13(absPath, "utf8");
       const parts = raw.split("---", 3);
       if (parts.length < 3) {
         unresolved.push(relPath);
@@ -4417,8 +3921,8 @@ async function runLint(input) {
     const readKnowledgeContent = (slug) => {
       const existing = knowledgeContentCache.get(slug);
       if (existing) return existing;
-      const knowledgePath = join18(lintVault, "projects", slug, "knowledge.md");
-      const pending = existsSync7(knowledgePath) ? readFile15(knowledgePath, "utf8").catch(() => null) : Promise.resolve(null);
+      const knowledgePath = join17(lintVault, "projects", slug, "knowledge.md");
+      const pending = existsSync6(knowledgePath) ? readFile13(knowledgePath, "utf8").catch(() => null) : Promise.resolve(null);
       knowledgeContentCache.set(slug, pending);
       return pending;
     };
@@ -4524,7 +4028,7 @@ async function runLint(input) {
       for (const relPath of legacyPages) {
         try {
           const absPath = `${input.vault}/${relPath}`;
-          const raw = await readFile15(absPath, "utf8");
+          const raw = await readFile13(absPath, "utf8");
           const split = splitFrontmatter(raw);
           if (!split.ok) {
             unresolved.push(relPath);
@@ -4623,7 +4127,7 @@ ${newBody}`;
       for (const relPath of noOverview) {
         try {
           const absPath = `${input.vault}/${relPath}`;
-          const raw = await readFile15(absPath, "utf8");
+          const raw = await readFile13(absPath, "utf8");
           const split = splitFrontmatter(raw);
           if (!split.ok) {
             unresolved.push(relPath);
@@ -4664,7 +4168,7 @@ ${trimmedBody}`;
       for (const relPath of missingTldrFlags) {
         try {
           const absPath = `${input.vault}/${relPath}`;
-          const raw = await readFile15(absPath, "utf8");
+          const raw = await readFile13(absPath, "utf8");
           const split = splitFrontmatter(raw);
           if (!split.ok) {
             unresolved.push(relPath);
@@ -4714,7 +4218,7 @@ ${lines.join("\n")}`;
       for (const relPath of wikilinkCitationFlags) {
         try {
           const absPath = `${input.vault}/${relPath}`;
-          const raw = await readFile15(absPath, "utf8");
+          const raw = await readFile13(absPath, "utf8");
           const split = splitFrontmatter(raw);
           if (!split.ok) {
             unresolved.push(relPath);
@@ -5055,14 +4559,14 @@ async function runSyncLintDelta(input) {
 }
 
 // src/commands/config.ts
-import { readFile as readFile16 } from "fs/promises";
-import { existsSync as existsSync8 } from "fs";
-import { join as join19 } from "path";
+import { readFile as readFile14 } from "fs/promises";
+import { existsSync as existsSync7 } from "fs";
+import { join as join18 } from "path";
 function validateKey(key) {
   return CONFIG_KEYS.includes(key) || isValidWikiProfileKey(key);
 }
 function configPath(home) {
-  return join19(home, ".skillwiki", ".env");
+  return join18(home, ".skillwiki", ".env");
 }
 async function runConfigGet(input) {
   if (!validateKey(input.key)) {
@@ -5080,7 +4584,7 @@ async function runConfigSet(input) {
   try {
     let originalContent;
     try {
-      originalContent = await readFile16(filePath, "utf8");
+      originalContent = await readFile14(filePath, "utf8");
     } catch {
     }
     const existing = originalContent !== void 0 ? parseDotenvText(originalContent) : {};
@@ -5097,501 +4601,39 @@ async function runConfigList(input) {
   let profiles;
   if (input.profiles) {
     const defaultProfile = map["WIKI_DEFAULT"];
-    profiles = [];
-    for (const key of Object.keys(map)) {
-      const m = key.match(/^WIKI_([A-Z][A-Z0-9_]{0,31})_PATH$/);
-      if (m && key !== "WIKI_PATH") {
-        const name = m[1].toLowerCase().replace(/_/g, "-");
-        profiles.push({ name, path: map[key] ?? "", isDefault: name === defaultProfile });
-      }
-    }
-    profiles.sort((a, b) => a.name.localeCompare(b.name));
-  }
-  const hint = profiles ? profiles.map((p) => `${p.isDefault ? "* " : "  "}${p.name} \u2192 ${p.path}`).join("\n") || "(no profiles)" : entries.map((e) => `${e.key}=${e.value}`).join("\n");
-  return { exitCode: ExitCode.OK, result: ok({ entries, profiles, humanHint: hint }) };
-}
-async function runConfigPath(input) {
-  const filePath = configPath(input.home);
-  return { exitCode: ExitCode.OK, result: ok({ path: filePath, exists: existsSync8(filePath), humanHint: filePath }) };
-}
-
-// src/commands/fleet.ts
-import { readFile as readFile17 } from "fs/promises";
-import { hostname as nodeHostname, userInfo } from "os";
-import { join as join20 } from "path";
-import yaml3 from "js-yaml";
-var FLEET_REL_PATH = join20("projects", "llm-wiki", "architecture", "fleet.yaml");
-async function runFleetValidate(input) {
-  const loaded = await loadFleetManifest(input.file);
-  if (!loaded.ok) {
-    if (loaded.error === "FILE_NOT_FOUND") {
-      return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: input.file }) };
-    }
-    const errors = fleetLoadErrors(loaded);
-    return invalidFleet(errors);
-  }
-  const warnings = fleetWarnings(loaded.manifest);
-  const snapshotter = findSnapshotter(loaded.manifest);
-  return {
-    exitCode: ExitCode.OK,
-    result: ok({
-      valid: true,
-      errors: [],
-      warnings,
-      host_count: Object.keys(loaded.manifest.hosts).length,
-      snapshotter,
-      humanHint: `VALID fleet manifest (${Object.keys(loaded.manifest.hosts).length} hosts; snapshotter: ${snapshotter ?? "none"})`
-    })
-  };
-}
-async function runFleetContext(input) {
-  const env = input.env ?? process.env;
-  const home = input.home ?? env.HOME ?? "";
-  const cwd = input.cwd ?? process.cwd();
-  const osHostname = input.osHostname ?? safeEnvValue(env.HOSTNAME) ?? nodeHostname();
-  const user = input.user ?? safeEnvValue(env.USER) ?? safeUserName();
-  const vault = input.vault ?? safeEnvValue(env.WIKI_PATH);
-  const file = input.file ?? (vault ? join20(vault, FLEET_REL_PATH) : void 0);
-  const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const loaded = file ? await loadFleetManifest(file) : { ok: false, error: "FILE_NOT_FOUND" };
-  if (!loaded.ok) {
-    const warnings = ["fleet manifest unavailable or invalid"];
-    const markdown2 = formatUnknownContext({
-      generatedAt,
-      osHostname,
-      user,
-      cwd,
-      vault,
-      reason: warnings[0],
-      trace: [],
-      warnings
-    });
-    return {
-      exitCode: ExitCode.OK,
-      result: ok({
-        manifest_loaded: false,
-        generated_at: generatedAt,
-        identity_status: "unknown",
-        resolver_trace: [],
-        warnings,
-        markdown: markdown2,
-        humanHint: markdown2
-      })
-    };
-  }
-  const resolved = await resolveFleetHostId({
-    manifest: loaded.manifest,
-    hostId: input.hostId,
-    env,
-    home,
-    osHostname
-  });
-  if (resolved.hostId && !loaded.manifest.hosts[resolved.hostId]) {
-    const source = resolved.source ?? "unknown";
-    const warnings = [`resolved host id \`${resolved.hostId}\` from ${source} is not in fleet.yaml`];
-    const markdown2 = formatInvalidContext({
-      generatedAt,
-      hostId: resolved.hostId,
-      source,
-      osHostname,
-      user,
-      cwd,
-      vault,
-      trace: resolved.trace,
-      warnings
-    });
-    return {
-      exitCode: ExitCode.OK,
-      result: ok({
-        manifest_loaded: true,
-        host_id: resolved.hostId,
-        source: resolved.source,
-        generated_at: generatedAt,
-        identity_status: "invalid",
-        resolver_trace: resolved.trace,
-        warnings,
-        markdown: markdown2,
-        humanHint: markdown2
-      })
-    };
-  }
-  if (!resolved.hostId) {
-    const warnings = ["host identity is unresolved"];
-    const markdown2 = formatUnknownContext({
-      generatedAt,
-      osHostname,
-      user,
-      cwd,
-      vault,
-      reason: warnings[0],
-      trace: resolved.trace,
-      warnings
-    });
-    return {
-      exitCode: ExitCode.OK,
-      result: ok({
-        manifest_loaded: true,
-        generated_at: generatedAt,
-        identity_status: "unknown",
-        resolver_trace: resolved.trace,
-        warnings,
-        markdown: markdown2,
-        humanHint: markdown2
-      })
-    };
-  }
-  const markdown = formatKnownContext({
-    manifest: loaded.manifest,
-    hostId: resolved.hostId,
-    source: resolved.source,
-    generatedAt,
-    osHostname,
-    user,
-    cwd,
-    vault,
-    trace: resolved.trace
-  });
-  return {
-    exitCode: ExitCode.OK,
-    result: ok({
-      manifest_loaded: true,
-      host_id: resolved.hostId,
-      source: resolved.source,
-      generated_at: generatedAt,
-      identity_status: "known",
-      resolver_trace: resolved.trace,
-      warnings: [],
-      markdown,
-      humanHint: markdown
-    })
-  };
-}
-function fleetContextEnv(input) {
-  const env = input.env ?? process.env;
-  const home = input.home ?? env.HOME ?? "";
-  const osHostname = input.osHostname ?? safeEnvValue(env.HOSTNAME) ?? nodeHostname();
-  const vault = input.vault ?? safeEnvValue(env.WIKI_PATH);
-  const file = input.file ?? (vault ? join20(vault, FLEET_REL_PATH) : void 0);
-  return { env, home, osHostname, vault, file };
-}
-async function loadFleetManifestAndHost(input) {
-  const { env, home, osHostname, file } = fleetContextEnv(input);
-  if (!file) return null;
-  const loaded = await loadFleetManifest(file);
-  if (!loaded.ok) return null;
-  const resolved = await resolveFleetHostId({
-    manifest: loaded.manifest,
-    hostId: input.hostId,
-    env,
-    home,
-    osHostname
-  });
-  if (!resolved.hostId) {
-    return {
-      manifest: loaded.manifest,
-      hostId: void 0,
-      source: resolved.source,
-      warnings: ["host identity is unresolved"],
-      identityStatus: "unknown"
-    };
-  }
-  if (!loaded.manifest.hosts[resolved.hostId]) {
-    const source = resolved.source ?? "unknown";
-    return {
-      manifest: loaded.manifest,
-      hostId: resolved.hostId,
-      source: resolved.source,
-      warnings: [`resolved host id \`${resolved.hostId}\` from ${source} is not in fleet.yaml`],
-      identityStatus: "invalid"
-    };
-  }
-  return {
-    manifest: loaded.manifest,
-    hostId: resolved.hostId,
-    source: resolved.source,
-    warnings: [],
-    identityStatus: "known"
-  };
-}
-function snapshotterAliasForLocalHost(fleetLoad) {
-  if (!fleetLoad?.manifest || !fleetLoad.hostId) return void 0;
-  const snapshotterId = Object.entries(fleetLoad.manifest.hosts).find(([, h]) => h.role === "snapshotter")?.[0];
-  if (!snapshotterId) return void 0;
-  const profile = fleetLoad.manifest.hosts[snapshotterId]?.access?.from?.[fleetLoad.hostId];
-  if (!profile || profile.status !== "configured" && profile.status !== "local") return void 0;
-  const aliases = profile.ssh_aliases ?? [];
-  return aliases.length > 0 ? aliases[0] : void 0;
-}
-function satelliteGateFromFleetLoad(load) {
-  if (!load?.hostId) return { satelliteExpected: false };
-  const host = load.manifest.hosts[load.hostId];
-  if (!host) return { satelliteExpected: false };
-  return { satelliteExpected: host.maintenance?.skillwiki_satellite?.enabled === true };
-}
-async function loadFleetManifest(file) {
-  let text;
-  try {
-    text = await readFile17(file, "utf8");
-  } catch {
-    return { ok: false, error: "FILE_NOT_FOUND" };
-  }
-  let parsed;
-  try {
-    parsed = yaml3.load(text, { schema: yaml3.JSON_SCHEMA });
-  } catch (error) {
-    return { ok: false, error: "INVALID_YAML", detail: error instanceof Error ? error.message : String(error) };
-  }
-  const result = FleetManifestSchema.safeParse(parsed);
-  if (!result.success) {
-    return { ok: false, error: "INVALID_FLEET_MANIFEST", detail: result.error.issues };
-  }
-  return { ok: true, manifest: result.data };
-}
-function invalidFleet(errors) {
-  return {
-    exitCode: ExitCode.FLEET_MANIFEST_INVALID,
-    result: ok({
-      valid: false,
-      errors,
-      warnings: [],
-      host_count: 0,
-      humanHint: `INVALID fleet manifest
-${errors.map((e) => `  ${e.path || "(root)"}: ${e.message}`).join("\n")}`
-    })
-  };
-}
-function fleetLoadErrors(loaded) {
-  if (loaded.error === "INVALID_YAML") {
-    return [{ path: "", message: `invalid YAML: ${String(loaded.detail ?? "parse failed")}` }];
-  }
-  if (loaded.error === "INVALID_FLEET_MANIFEST" && Array.isArray(loaded.detail)) {
-    return loaded.detail.map((issue) => {
-      const zodIssue = issue;
-      return {
-        path: (zodIssue.path ?? []).join("."),
-        message: zodIssue.message ?? "invalid value"
-      };
-    });
-  }
-  return [{ path: "", message: loaded.error }];
-}
-function fleetWarnings(manifest) {
-  const warnings = [];
-  for (const [id, host] of Object.entries(manifest.hosts)) {
-    if (host.role === "snapshotter" && host.protected !== true) {
-      warnings.push(`snapshotter host '${id}' is not protected=true`);
-    }
-  }
-  return warnings;
-}
-function findSnapshotter(manifest) {
-  return Object.entries(manifest.hosts).find(([, host]) => host.role === "snapshotter")?.[0];
-}
-async function resolveFleetHostId(input) {
-  const trace = [];
-  if (input.hostId) {
-    trace.push({ source: "--host-id", status: "matched", value: input.hostId });
-    return { hostId: input.hostId, source: "host-id", trace };
-  }
-  trace.push({ source: "--host-id", status: "unset" });
-  if (input.env.SKILLWIKI_HOST_ID) {
-    trace.push({ source: "SKILLWIKI_HOST_ID", status: "matched", value: input.env.SKILLWIKI_HOST_ID });
-    return { hostId: input.env.SKILLWIKI_HOST_ID, source: "SKILLWIKI_HOST_ID", trace };
-  }
-  trace.push({ source: "SKILLWIKI_HOST_ID", status: "unset" });
-  if (input.env.AGENT_HOST_ID) {
-    trace.push({ source: "AGENT_HOST_ID", status: "matched", value: input.env.AGENT_HOST_ID });
-    return { hostId: input.env.AGENT_HOST_ID, source: "AGENT_HOST_ID", trace };
-  }
-  trace.push({ source: "AGENT_HOST_ID", status: "unset" });
-  if (input.home) {
-    const dotenv = await parseDotenvFile(join20(input.home, ".skillwiki", ".env"));
-    if (dotenv.SKILLWIKI_HOST_ID) {
-      trace.push({ source: "~/.skillwiki/.env:SKILLWIKI_HOST_ID", status: "matched", value: dotenv.SKILLWIKI_HOST_ID });
-      return { hostId: dotenv.SKILLWIKI_HOST_ID, source: "~/.skillwiki/.env:SKILLWIKI_HOST_ID", trace };
-    }
-    trace.push({ source: "~/.skillwiki/.env:SKILLWIKI_HOST_ID", status: "unset" });
-  } else {
-    trace.push({ source: "~/.skillwiki/.env:SKILLWIKI_HOST_ID", status: "skipped" });
-  }
-  if (input.env.VS_HOSTNAME) {
-    trace.push({ source: "VS_HOSTNAME", status: "matched", value: input.env.VS_HOSTNAME });
-    return { hostId: input.env.VS_HOSTNAME, source: "VS_HOSTNAME", trace };
-  }
-  trace.push({ source: "VS_HOSTNAME", status: "unset" });
-  const hostname = input.osHostname.trim();
-  if (hostname) {
-    if (input.manifest.hosts[hostname]) {
-      trace.push({ source: "hostname", status: "matched", value: hostname });
-      return { hostId: hostname, source: "hostname", trace };
-    }
-    const byHostname = Object.entries(input.manifest.hosts).find(([, host]) => host.identity.hostnames.includes(hostname));
-    if (byHostname) {
-      trace.push({ source: "hostname", status: "matched", value: hostname });
-      return { hostId: byHostname[0], source: "hostname", trace };
-    }
-    trace.push({ source: "hostname", status: "unmatched", value: hostname });
-  } else {
-    trace.push({ source: "hostname", status: "unset" });
-  }
-  return { trace };
-}
-function formatKnownContext(input) {
-  const host = input.manifest.hosts[input.hostId];
-  const protectedValue = host.protected === true ? "true" : "false";
-  const writesTo = host.writes_to.join(", ");
-  const selfAliases = collectSelfAliases(input.manifest, input.hostId);
-  const outbound = collectOutboundAccess(input.manifest, input.hostId);
-  const maintenanceLines = formatMaintenanceLines(host);
-  const guidance = host.role === "snapshotter" && host.protected === true ? `this session is already on \`${input.hostId}\`; this is a protected snapshotter host. Live-vault authoring at the resolved \`skillwiki path\` is allowed here. Do not mutate snapshot worktrees or repo-local project workspaces from this session except explicitly approved snapshot maintenance. Keep release-validation workflows read-only when they are documented as such.` : input.hostId === "macos-dev" ? "use declared SSH aliases for remote work when needed; do not assume undeclared hosts have reciprocal SSH access." : `this session is already on \`${input.hostId}\`; do not SSH to self aliases unless the user explicitly asks. Do not assume outbound SSH to other fleet hosts is configured.`;
-  return [
-    "## Runtime Host Context",
-    "",
-    `- Context generated: \`${input.generatedAt}\``,
-    `- Current machine: \`${input.hostId}\`${input.source ? ` (source: \`${input.source}\`)` : ""}`,
-    "- Identity status: `known`",
-    `- Identity resolution: ${formatResolution(input.source, input.hostId)}`,
-    `- Resolver trace: ${formatTrace(input.trace)}`,
-    `- OS hostname: ${formatMaybe(input.osHostname)}`,
-    `- User: ${formatMaybe(input.user)}`,
-    `- Workspace: ${formatMaybe(input.cwd)}`,
-    `- Vault: ${formatMaybe(input.vault)}`,
-    "- Remote freshness: not checked by `fleet context`; run `sync status` or presync before host-sensitive work.",
-    `- Fleet role: \`${host.role}\`; protected: \`${protectedValue}\`; writes_to: \`${writesTo}\``,
-    ...maintenanceLines,
-    `- Self SSH aliases known in fleet: ${formatList(selfAliases)}`,
-    `- Declared outbound SSH from this source: ${formatOutboundAccess(outbound)}`,
-    `- Guidance: ${guidance}`
-  ].join("\n");
-}
-function formatUnknownContext(input) {
-  return [
-    "## Runtime Host Context",
-    "",
-    `- Context generated: \`${input.generatedAt}\``,
-    "- Current machine: unknown",
-    "- Identity status: `unknown`",
-    `- Resolver trace: ${formatTrace(input.trace)}`,
-    `- Warnings: ${formatWarnings(input.warnings)}`,
-    `- OS hostname: ${formatMaybe(input.osHostname)}`,
-    `- User: ${formatMaybe(input.user)}`,
-    `- Workspace: ${formatMaybe(input.cwd)}`,
-    `- Vault: ${formatMaybe(input.vault)}`,
-    "- Remote freshness: not checked by `fleet context`; run `sync status` or presync before host-sensitive work.",
-    "- Fleet role: unknown",
-    "- Self SSH aliases known in fleet: unknown",
-    "- Declared outbound SSH from this source: unknown",
-    `- Guidance: ${input.reason}; do not assume local vs remote role. Inspect runtime or ask before SSH/deploy/sync work.`
-  ].join("\n");
-}
-function formatInvalidContext(input) {
-  return [
-    "## Runtime Host Context",
-    "",
-    `- Context generated: \`${input.generatedAt}\``,
-    "- Current machine: unknown",
-    "- Identity status: `invalid`",
-    `- Identity resolution: ${formatResolution(input.source, input.hostId)}`,
-    `- Resolver trace: ${formatTrace(input.trace)}`,
-    `- Warnings: ${formatWarnings(input.warnings)}`,
-    `- OS hostname: ${formatMaybe(input.osHostname)}`,
-    `- User: ${formatMaybe(input.user)}`,
-    `- Workspace: ${formatMaybe(input.cwd)}`,
-    `- Vault: ${formatMaybe(input.vault)}`,
-    "- Remote freshness: not checked by `fleet context`; run `sync status` or presync before host-sensitive work.",
-    "- Fleet role: unknown",
-    "- Self SSH aliases known in fleet: unknown",
-    "- Declared outbound SSH from this source: unknown",
-    `- Guidance: do not trust this identity; rerun with \`--host-id\` only if the user confirms \`${input.hostId}\` is the current fleet host id.`
-  ].join("\n");
-}
-function collectSelfAliases(manifest, hostId2) {
-  const aliases = [];
-  const host = manifest.hosts[hostId2];
-  const access = host?.access?.from ?? {};
-  for (const profile of Object.values(access)) {
-    for (const alias of profile.ssh_aliases ?? []) aliases.push(alias);
-  }
-  return [...new Set(aliases)];
-}
-function collectOutboundAccess(manifest, sourceHostId) {
-  const hosts = [];
-  for (const [targetId, target] of Object.entries(manifest.hosts)) {
-    if (targetId === sourceHostId) continue;
-    const profile = target.access?.from?.[sourceHostId];
-    if (profile && (profile.status === "configured" || profile.status === "local")) {
-      hosts.push({
-        hostId: targetId,
-        sshAliases: [...new Set(profile.ssh_aliases ?? [])],
-        users: [...new Set(profile.users ?? [])]
-      });
-    }
-  }
-  return hosts.sort((left, right) => left.hostId.localeCompare(right.hostId));
-}
-function formatMaintenanceLines(host) {
-  const satellite = host.maintenance?.skillwiki_satellite;
-  if (!satellite?.enabled) return [];
-  return [
-    `- Maintenance role: \`skillwiki satellite\`; user: \`${satellite.user}\`; ssh: \`${satellite.ssh_alias}\``,
-    `- Maintenance paths: maintenance vault: \`${satellite.vault_path}\`; repo: \`${satellite.repo_path}\`; scheduler: \`${satellite.scheduler}\`; jobs: ${formatList(satellite.jobs)}`
-  ];
-}
-function formatOutboundAccess(values) {
-  if (values.length === 0) return "none";
-  return values.map((value) => {
-    const aliasPart = value.sshAliases.length > 0 ? ` via ${formatList(value.sshAliases)}` : " (no SSH aliases)";
-    const usersPart = value.users.length > 0 ? ` (users: ${formatList(value.users)})` : "";
-    return `\`${value.hostId}\`${aliasPart}${usersPart}`;
-  }).join("; ");
-}
-function formatResolution(source, hostId2) {
-  return source ? `\`${source === "host-id" ? "--host-id" : source}\` -> \`${hostId2}\`` : `unknown -> \`${hostId2}\``;
-}
-function formatTrace(values) {
-  if (values.length === 0) return "not available";
-  return values.map((value) => {
-    const source = `\`${value.source}\``;
-    if (value.status === "matched") return `${source} matched \`${value.value ?? ""}\``;
-    if (value.status === "unmatched") return `${source} unmatched \`${value.value ?? ""}\``;
-    return `${source} ${value.status}`;
-  }).join("; ");
-}
-function formatWarnings(values) {
-  return values.length > 0 ? values.join("; ") : "none";
-}
-function formatList(values) {
-  return values.length > 0 ? values.map((v) => `\`${v}\``).join(", ") : "none";
-}
-function formatMaybe(value) {
-  return value && value.trim().length > 0 ? `\`${value}\`` : "unknown";
-}
-function safeEnvValue(value) {
-  return value && value.trim().length > 0 ? value : void 0;
-}
-function safeUserName() {
-  try {
-    return userInfo().username;
-  } catch {
-    return "";
+    profiles = [];
+    for (const key of Object.keys(map)) {
+      const m = key.match(/^WIKI_([A-Z][A-Z0-9_]{0,31})_PATH$/);
+      if (m && key !== "WIKI_PATH") {
+        const name = m[1].toLowerCase().replace(/_/g, "-");
+        profiles.push({ name, path: map[key] ?? "", isDefault: name === defaultProfile });
+      }
+    }
+    profiles.sort((a, b) => a.name.localeCompare(b.name));
   }
+  const hint = profiles ? profiles.map((p) => `${p.isDefault ? "* " : "  "}${p.name} \u2192 ${p.path}`).join("\n") || "(no profiles)" : entries.map((e) => `${e.key}=${e.value}`).join("\n");
+  return { exitCode: ExitCode.OK, result: ok({ entries, profiles, humanHint: hint }) };
+}
+async function runConfigPath(input) {
+  const filePath = configPath(input.home);
+  return { exitCode: ExitCode.OK, result: ok({ path: filePath, exists: existsSync7(filePath), humanHint: filePath }) };
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync14, lstatSync as lstatSync2, readlinkSync, readdirSync as readdirSync3, statSync as statSync2, readFileSync as readFileSync11 } from "fs";
-import { join as join26, resolve as resolve6 } from "path";
+import { existsSync as existsSync13, lstatSync, readlinkSync, readdirSync as readdirSync3, statSync as statSync2, readFileSync as readFileSync10 } from "fs";
+import { join as join24, resolve as resolve5 } from "path";
 import { execSync as execSync2 } from "child_process";
 import { platform as platform2 } from "os";
 
 // src/utils/plugin-registry.ts
-import { existsSync as existsSync9, readdirSync, readFileSync as readFileSync6 } from "fs";
-import { join as join21 } from "path";
-var REGISTRY_PATH = join21(".claude", "plugins", "installed_plugins.json");
-var CODEX_CONFIG_PATH = join21(".codex", "config.toml");
+import { existsSync as existsSync8, readdirSync, readFileSync as readFileSync5 } from "fs";
+import { join as join19 } from "path";
+var REGISTRY_PATH = join19(".claude", "plugins", "installed_plugins.json");
+var CODEX_CONFIG_PATH = join19(".codex", "config.toml");
 var PLUGIN_KEY = "skillwiki@llm-wiki";
 function readInstalledPlugins(home) {
   try {
-    const raw = readFileSync6(join21(home, REGISTRY_PATH), "utf8");
+    const raw = readFileSync5(join19(home, REGISTRY_PATH), "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -5627,8 +4669,8 @@ function findPluginInstallations(home, key = PLUGIN_KEY) {
 function findCodexPlugin(home, key, pluginName, marketplace) {
   const config = readCodexPluginConfig(home, key, marketplace);
   if (!config?.enabled) return null;
-  const cacheRoot = join21(home, ".codex", "plugins", "cache", marketplace, pluginName);
-  if (!existsSync9(cacheRoot)) return null;
+  const cacheRoot = join19(home, ".codex", "plugins", "cache", marketplace, pluginName);
+  if (!existsSync8(cacheRoot)) return null;
   let versions;
   try {
     versions = readdirSync(cacheRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
@@ -5643,7 +4685,7 @@ function findCodexPlugin(home, key, pluginName, marketplace) {
     key,
     pluginName,
     marketplace,
-    installPath: join21(cacheRoot, version),
+    installPath: join19(cacheRoot, version),
     version,
     sourceType: config.sourceType,
     source: config.source
@@ -5660,7 +4702,7 @@ function parsePluginKey(key) {
 function readCodexPluginConfig(home, key, marketplace) {
   let raw;
   try {
-    raw = readFileSync6(join21(home, CODEX_CONFIG_PATH), "utf8");
+    raw = readFileSync5(join19(home, CODEX_CONFIG_PATH), "utf8");
   } catch {
     return null;
   }
@@ -5702,8 +4744,8 @@ function parseTomlScalar(rawValue) {
 }
 
 // src/utils/conflict-markers.ts
-import { existsSync as existsSync10, readdirSync as readdirSync2, readFileSync as readFileSync7 } from "fs";
-import { join as join22 } from "path";
+import { existsSync as existsSync9, readdirSync as readdirSync2, readFileSync as readFileSync6 } from "fs";
+import { join as join20 } from "path";
 function scanConflictMarkerBlocksInText(relPath, text) {
   const findings = [];
   const lines = text.split(/\r?\n/);
@@ -5754,21 +4796,21 @@ function walkMarkdownFiles2(root, dir, rel, out) {
   for (const entry of entries) {
     if (entry.isDirectory()) {
       if (PRUNE_DIRS.has(entry.name)) continue;
-      walkMarkdownFiles2(root, join22(dir, entry.name), rel ? `${rel}/${entry.name}` : entry.name, out);
+      walkMarkdownFiles2(root, join20(dir, entry.name), rel ? `${rel}/${entry.name}` : entry.name, out);
     } else if (entry.isFile() && entry.name.endsWith(".md")) {
       out.push(rel ? `${rel}/${entry.name}` : entry.name);
     }
   }
 }
 function scanVaultConflictMarkers(vaultRoot) {
-  if (!existsSync10(vaultRoot)) return [];
+  if (!existsSync9(vaultRoot)) return [];
   const relPaths = [];
   walkMarkdownFiles2(vaultRoot, vaultRoot, "", relPaths);
   const all = [];
   for (const rel of relPaths) {
     let text;
     try {
-      text = readFileSync7(join22(vaultRoot, rel), "utf8");
+      text = readFileSync6(join20(vaultRoot, rel), "utf8");
     } catch {
       continue;
     }
@@ -5778,8 +4820,8 @@ function scanVaultConflictMarkers(vaultRoot) {
 }
 
 // src/utils/remote-health.ts
-import { existsSync as existsSync11, readFileSync as readFileSync8 } from "fs";
-import { join as join23 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync7 } from "fs";
+import { join as join21 } from "path";
 import { execFileSync } from "child_process";
 var REMOTE_PROBE_TIMEOUT_MS = 3e3;
 var defaultExec = (file, args, cwd) => execFileSync(file, args, {
@@ -5790,7 +4832,7 @@ var defaultExec = (file, args, cwd) => execFileSync(file, args, {
 }).trim();
 function readWikiS3RemoteConfigured(home) {
   try {
-    const content = readFileSync8(join23(home, ".skillwiki", ".env"), "utf8");
+    const content = readFileSync7(join21(home, ".skillwiki", ".env"), "utf8");
     for (const line of content.split(/\r?\n/)) {
       const trimmed = line.trim();
       if (!trimmed || trimmed.startsWith("#")) continue;
@@ -5815,7 +4857,7 @@ function resolveWikiS3Remote(input) {
   return readWikiS3RemoteConfigured(input.home);
 }
 function probeGithubReachability(vaultPath, exec = defaultExec) {
-  if (!existsSync11(join23(vaultPath, ".git"))) return "unknown";
+  if (!existsSync10(join21(vaultPath, ".git"))) return "unknown";
   try {
     exec("git", ["remote", "get-url", "origin"], vaultPath);
   } catch {
@@ -5838,8 +4880,8 @@ function probeS3Reachability(remote, exec = defaultExec) {
     return "unreachable";
   }
 }
-function probeSnapshotterSsh(sshAlias2, exec = defaultExec) {
-  if (!sshAlias2) return "unknown";
+function probeSnapshotterSsh(sshAlias, exec = defaultExec) {
+  if (!sshAlias) return "unknown";
   try {
     exec("ssh", [
       "-o",
@@ -5848,7 +4890,7 @@ function probeSnapshotterSsh(sshAlias2, exec = defaultExec) {
       "ConnectTimeout=3",
       "-o",
       "StrictHostKeyChecking=accept-new",
-      sshAlias2,
+      sshAlias,
       "true"
     ]);
     return "ok";
@@ -5880,11 +4922,11 @@ function probeRemoteHealth(input) {
 }
 
 // src/utils/satellite-run-health.ts
-import { existsSync as existsSync12, readFileSync as readFileSync9 } from "fs";
-import { join as join24 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync8 } from "fs";
+import { join as join22 } from "path";
 var SATELLITE_STALE_MS = 26 * 60 * 60 * 1e3;
 function satelliteLatestRunPath(vault) {
-  return join24(vault, ".skillwiki", "agent-memory-trends", "latest-run.json");
+  return join22(vault, ".skillwiki", "agent-memory-trends", "latest-run.json");
 }
 function isFailedRunStatus(status) {
   return status === "fail" || status === "failure";
@@ -5906,9 +4948,9 @@ function readSatelliteLatestRunFromText(text) {
 }
 function readSatelliteLatestRun(vault) {
   const latestPath = satelliteLatestRunPath(vault);
-  if (!existsSync12(latestPath)) return null;
+  if (!existsSync11(latestPath)) return null;
   try {
-    return parseLatestRunFile(readFileSync9(latestPath, "utf8"));
+    return parseLatestRunFile(readFileSync8(latestPath, "utf8"));
   } catch {
     return null;
   }
@@ -5937,8 +4979,8 @@ function evaluateSatelliteRunHealth(vault, now) {
 // src/utils/s3-mount-health.ts
 import { execSync } from "child_process";
 import { platform } from "os";
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync5, unlinkSync as unlinkSync5, readFileSync as readFile18 } from "fs";
-import { join as join25 } from "path";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync5, unlinkSync as unlinkSync5, readFileSync as readFile15 } from "fs";
+import { join as join23 } from "path";
 var OS = platform();
 function findRcloneMountPid() {
   try {
@@ -6022,7 +5064,7 @@ function extractRcloneFs(args) {
 function getRcloneArgs(pid) {
   try {
     if (OS === "linux") {
-      const raw = readFileSync10(`/proc/${pid}/cmdline`);
+      const raw = readFileSync9(`/proc/${pid}/cmdline`);
       return new TextDecoder().decode(raw).split("\0").filter(Boolean);
     } else {
       const out = execSync(`ps -o args= -p ${pid}`, {
@@ -6065,7 +5107,7 @@ function queryRcloneRC(rcAddr, fs) {
 function detectFuseMount(vaultPath) {
   try {
     if (OS === "linux") {
-      const mounts = readFileSync10("/proc/mounts", "utf8");
+      const mounts = readFileSync9("/proc/mounts", "utf8");
       let best = null;
       for (const line of mounts.split("\n")) {
         const parts = line.split(" ");
@@ -6096,7 +5138,7 @@ function detectFuseMount(vaultPath) {
   return null;
 }
 function writeTest(dir) {
-  const testFile = join25(dir, `.doctor-write-test-${process.pid}.tmp`);
+  const testFile = join23(dir, `.doctor-write-test-${process.pid}.tmp`);
   const payload = `skillwiki doctor write test \u2014 ${Date.now()} \u2014 ${Math.random().toString(36).slice(2)}`;
   const start = Date.now();
   try {
@@ -6107,7 +5149,7 @@ function writeTest(dir) {
   const writeMs = Date.now() - start;
   const readStart = Date.now();
   try {
-    const back = readFile18(testFile, "utf8");
+    const back = readFile15(testFile, "utf8");
     const readMs = Date.now() - readStart;
     if (back !== payload) {
       try {
@@ -6181,14 +5223,14 @@ function checkNodeVersion() {
 function detectCliChannels(argv, home) {
   const channels = [];
   if (argv.length >= 2 && argv[1].endsWith("cli.js")) {
-    const devPath = resolve6(argv[1]);
+    const devPath = resolve5(argv[1]);
     channels.push({ name: "dev", path: devPath, isDevLink: true });
   }
   try {
     const whichOut = execSync2("which skillwiki 2>/dev/null", { encoding: "utf8" }).trim();
     if (whichOut) {
       const isDev = isDevSymlink(whichOut);
-      if (!channels.some((c) => c.path === resolve6(whichOut))) {
+      if (!channels.some((c) => c.path === resolve5(whichOut))) {
         channels.push({ name: "npm", path: whichOut, isDevLink: isDev });
       }
     }
@@ -6196,22 +5238,22 @@ function detectCliChannels(argv, home) {
   }
   const plugin = findPlugin(home);
   if (plugin) {
-    const pluginBin = join26(plugin.installPath, "bin", "skillwiki");
-    if (existsSync14(pluginBin)) {
+    const pluginBin = join24(plugin.installPath, "bin", "skillwiki");
+    if (existsSync13(pluginBin)) {
       channels.push({ name: "plugin", path: pluginBin, isDevLink: false });
     }
   }
-  const installBin = join26(home, ".claude", "skills", "bin", "skillwiki");
-  if (existsSync14(installBin)) {
+  const installBin = join24(home, ".claude", "skills", "bin", "skillwiki");
+  if (existsSync13(installBin)) {
     channels.push({ name: "install", path: installBin, isDevLink: false });
   }
   return channels;
 }
 function isDevSymlink(binPath) {
   try {
-    const st = lstatSync2(binPath);
+    const st = lstatSync(binPath);
     if (st.isSymbolicLink()) {
-      const target = resolve6(binPath, "..", readlinkSync(binPath));
+      const target = resolve5(binPath, "..", readlinkSync(binPath));
       return target.includes("packages/cli") || target.includes("packages\\cli");
     }
   } catch {
@@ -6263,7 +5305,7 @@ function isDevSourceRun(argv) {
 }
 async function checkConfigFile(home) {
   const cfgPath = configPath(home);
-  if (!existsSync14(cfgPath)) {
+  if (!existsSync13(cfgPath)) {
     return check("warn", "config_file", "Config file exists", `${cfgPath} not found`);
   }
   try {
@@ -6278,7 +5320,7 @@ function checkWikiPathExists(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("error", "wiki_path_exists", "Vault directory exists", "Cannot check \u2014 WIKI_PATH not resolved");
   }
-  if (existsSync14(resolvedPath) && statSync2(resolvedPath).isDirectory()) {
+  if (existsSync13(resolvedPath) && statSync2(resolvedPath).isDirectory()) {
     return check("pass", "wiki_path_exists", "Vault directory exists", resolvedPath);
   }
   return check("error", "wiki_path_exists", "Vault directory exists", `${resolvedPath} does not exist or is not a directory`);
@@ -6287,13 +5329,13 @@ function checkVaultStructure(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("error", "vault_structure", "Vault structure valid", "Cannot check \u2014 WIKI_PATH not resolved");
   }
-  if (!existsSync14(resolvedPath)) {
+  if (!existsSync13(resolvedPath)) {
     return check("error", "vault_structure", "Vault structure valid", "Cannot check \u2014 vault directory does not exist");
   }
   const missing = [];
-  if (!existsSync14(join26(resolvedPath, "SCHEMA.md"))) missing.push("SCHEMA.md");
+  if (!existsSync13(join24(resolvedPath, "SCHEMA.md"))) missing.push("SCHEMA.md");
   for (const dir of ["raw", "entities", "concepts", "meta"]) {
-    if (!existsSync14(join26(resolvedPath, dir))) missing.push(dir + "/");
+    if (!existsSync13(join24(resolvedPath, dir))) missing.push(dir + "/");
   }
   if (missing.length === 0) {
     return check("pass", "vault_structure", "Vault structure valid", "All required files and directories present");
@@ -6301,8 +5343,8 @@ function checkVaultStructure(resolvedPath) {
   return check("warn", "vault_structure", "Vault structure valid", `Missing: ${missing.join(", ")} \u2014 run \`skillwiki init\` to add CodeWiki structure`);
 }
 function checkSkillsInstalled(home, cwd) {
-  const srcDir = cwd ? join26(cwd, "packages", "skills") : void 0;
-  if (srcDir && existsSync14(srcDir)) {
+  const srcDir = cwd ? join24(cwd, "packages", "skills") : void 0;
+  if (srcDir && existsSync13(srcDir)) {
     const found = findInstalledSkillMd(srcDir);
     if (found.length > 0) {
       return check("pass", "skills_installed", "Skills installed", `${found.length} SKILL.md file(s) found (source)`);
@@ -6315,8 +5357,8 @@ function checkSkillsInstalled(home, cwd) {
       return check("pass", "skills_installed", "Skills installed", `${found.length} SKILL.md file(s) found (plugin v${plugin.version})`);
     }
   }
-  const skillsDir = join26(home, ".claude", "skills");
-  if (existsSync14(skillsDir)) {
+  const skillsDir = join24(home, ".claude", "skills");
+  if (existsSync13(skillsDir)) {
     const found = findInstalledSkillMd(skillsDir);
     if (found.length > 0) {
       return check("pass", "skills_installed", "Skills installed", `${found.length} SKILL.md file(s) found (CLI install)`);
@@ -6326,10 +5368,10 @@ function checkSkillsInstalled(home, cwd) {
 }
 function checkDuplicateSkills(home) {
   const plugin = findPlugin(home);
-  const skillsDir = join26(home, ".claude", "skills");
+  const skillsDir = join24(home, ".claude", "skills");
   const agentSkillDirs = [
-    { label: "~/.codex/skills/", path: join26(home, ".codex", "skills") },
-    { label: "~/.agents/skills/", path: join26(home, ".agents", "skills") }
+    { label: "~/.codex/skills/", path: join24(home, ".codex", "skills") },
+    { label: "~/.agents/skills/", path: join24(home, ".agents", "skills") }
   ];
   if (!plugin) {
     return check("pass", "skills_duplicate", "Skills not duplicated", "Single install channel");
@@ -6432,8 +5474,8 @@ async function checkProfiles(home) {
 }
 async function checkProjectLocalOverride(cwd) {
   const dir = cwd ?? process.cwd();
-  const envPath = join26(dir, ".skillwiki", ".env");
-  if (existsSync14(envPath)) {
+  const envPath = join24(dir, ".skillwiki", ".env");
+  if (existsSync13(envPath)) {
     return check("pass", "project_local", "Project-local config", `Found: ${envPath}`);
   }
   return check("pass", "project_local", "Project-local config", "None");
@@ -6442,7 +5484,7 @@ function checkVaultGitRemote(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("error", "vault_git_remote", "Vault git remote", "Cannot check \u2014 WIKI_PATH not resolved");
   }
-  if (!existsSync14(join26(resolvedPath, ".git"))) {
+  if (!existsSync13(join24(resolvedPath, ".git"))) {
     return check("warn", "vault_git_remote", "Vault git remote", "Vault is not a git repository \u2014 sync features unavailable");
   }
   try {
@@ -6465,9 +5507,9 @@ function checkObsidianTemplates(resolvedPath) {
     return check("error", "obsidian_templates", "Obsidian templates", "Cannot check \u2014 WIKI_PATH not resolved");
   }
   const missing = [];
-  if (!existsSync14(join26(resolvedPath, "_Templates"))) missing.push("_Templates/");
-  if (!existsSync14(join26(resolvedPath, ".obsidian", "templates.json"))) missing.push(".obsidian/templates.json");
-  if (!existsSync14(join26(resolvedPath, ".obsidian", "app.json"))) missing.push(".obsidian/app.json");
+  if (!existsSync13(join24(resolvedPath, "_Templates"))) missing.push("_Templates/");
+  if (!existsSync13(join24(resolvedPath, ".obsidian", "templates.json"))) missing.push(".obsidian/templates.json");
+  if (!existsSync13(join24(resolvedPath, ".obsidian", "app.json"))) missing.push(".obsidian/app.json");
   if (missing.length === 0) {
     return check("pass", "obsidian_templates", "Obsidian templates", "Template folder and config present");
   }
@@ -6477,12 +5519,12 @@ function checkDotStoreClean(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("error", "dsstore_clean", "No .DS_Store in raw/", "Cannot check \u2014 WIKI_PATH not resolved");
   }
-  const rawDir = join26(resolvedPath, "raw");
-  if (!existsSync14(rawDir)) {
+  const rawDir = join24(resolvedPath, "raw");
+  if (!existsSync13(rawDir)) {
     return check("pass", "dsstore_clean", "No .DS_Store in raw/", "raw/ directory not found \u2014 check skipped");
   }
   const found = [];
-  (function walk2(dir, rel) {
+  (function walk(dir, rel) {
     let entries;
     try {
       entries = readdirSync3(dir, { withFileTypes: true });
@@ -6493,7 +5535,7 @@ function checkDotStoreClean(resolvedPath) {
       if (entry.name === ".DS_Store") {
         found.push(rel ? `${rel}/.DS_Store` : ".DS_Store");
       } else if (entry.isDirectory()) {
-        walk2(join26(dir, entry.name), rel ? `${rel}/${entry.name}` : entry.name);
+        walk(join24(dir, entry.name), rel ? `${rel}/${entry.name}` : entry.name);
       }
     }
   })(rawDir, "");
@@ -6524,7 +5566,7 @@ function checkSyncLastPush(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("error", "sync_last_push", "Vault sync recency", "Cannot check \u2014 WIKI_PATH not resolved");
   }
-  if (!existsSync14(join26(resolvedPath, ".git"))) {
+  if (!existsSync13(join24(resolvedPath, ".git"))) {
     return check("pass", "sync_last_push", "Vault sync recency", "No git repo \u2014 sync check skipped");
   }
   let timestamp;
@@ -6572,7 +5614,7 @@ function checkVaultGitDirty(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("pass", "vault_git_dirty", "Vault git dirty state", "No vault path \u2014 check skipped");
   }
-  if (!existsSync14(join26(resolvedPath, ".git"))) {
+  if (!existsSync13(join24(resolvedPath, ".git"))) {
     return check("pass", "vault_git_dirty", "Vault git dirty state", "No git repo \u2014 check skipped");
   }
   try {
@@ -6640,7 +5682,7 @@ function remoteMainHash(resolvedPath) {
 }
 function checkStaleRemoteMain(resolvedPath) {
   if (resolvedPath === void 0) return void 0;
-  if (!existsSync14(join26(resolvedPath, ".git"))) return void 0;
+  if (!existsSync13(join24(resolvedPath, ".git"))) return void 0;
   const localOrigin = gitRefHash(resolvedPath, "origin/main");
   if (!localOrigin) return void 0;
   const remoteMain = remoteMainHash(resolvedPath);
@@ -6656,7 +5698,7 @@ function checkVaultLocalGit(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("warn", "vault_local_git", "Vault local git", "Cannot check \u2014 WIKI_PATH not resolved");
   }
-  if (!existsSync14(join26(resolvedPath, ".git"))) {
+  if (!existsSync13(join24(resolvedPath, ".git"))) {
     return check("warn", "vault_local_git", "Vault local git", "Not a git repository - sync features unavailable");
   }
   try {
@@ -6675,7 +5717,7 @@ function checkVaultGithubRemote(resolvedPath, exec) {
   if (resolvedPath === void 0) {
     return check("pass", "vault_github_remote", "Vault GitHub remote", "No vault path \u2014 check skipped");
   }
-  if (!existsSync14(join26(resolvedPath, ".git"))) {
+  if (!existsSync13(join24(resolvedPath, ".git"))) {
     return check("pass", "vault_github_remote", "Vault GitHub remote", "No git repo \u2014 check skipped");
   }
   const state = probeGithubReachability(resolvedPath, exec);
@@ -6719,7 +5761,7 @@ function checkVaultPromotionLag(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("pass", "vault_promotion_lag", "Vault promotion lag", "No vault path \u2014 check skipped");
   }
-  if (!existsSync14(join26(resolvedPath, ".git"))) {
+  if (!existsSync13(join24(resolvedPath, ".git"))) {
     return check("pass", "vault_promotion_lag", "Vault promotion lag", "No git repo \u2014 check skipped");
   }
   try {
@@ -6746,7 +5788,7 @@ function checkVaultGitComparison(resolvedPath, id, label, range, nonZeroSuffix,
   if (resolvedPath === void 0) {
     return check("pass", id, label, "No vault path \u2014 check skipped");
   }
-  if (!existsSync14(join26(resolvedPath, ".git"))) {
+  if (!existsSync13(join24(resolvedPath, ".git"))) {
     return check("pass", id, label, "No git repo \u2014 check skipped");
   }
   if (!hasOriginMain(resolvedPath)) {
@@ -6774,7 +5816,7 @@ function checkSatelliteLastRun(vaultPath, satelliteExpected) {
     return check("pass", "satellite_job_last_run", "Satellite job last run", "No vault path \u2014 check skipped");
   }
   const latestPath = satelliteLatestRunPath(vaultPath);
-  if (!existsSync14(latestPath)) {
+  if (!existsSync13(latestPath)) {
     return check("pass", "satellite_job_last_run", "Satellite job last run", "No latest-run.json \u2014 satellite has not run yet");
   }
   try {
@@ -6862,11 +5904,11 @@ async function checkFleetIdentity(input) {
 }
 function pullLogPaths(home) {
   const paths = platform2() === "darwin" ? [
-    join26(home, "Library", "Logs", "wiki-pull.log"),
-    join26(home, ".local", "state", "vault-sync", "log", "wiki-pull.log")
+    join24(home, "Library", "Logs", "wiki-pull.log"),
+    join24(home, ".local", "state", "vault-sync", "log", "wiki-pull.log")
   ] : [
-    join26(home, ".local", "state", "vault-sync", "log", "wiki-pull.log"),
-    join26(home, "Library", "Logs", "wiki-pull.log")
+    join24(home, ".local", "state", "vault-sync", "log", "wiki-pull.log"),
+    join24(home, "Library", "Logs", "wiki-pull.log")
   ];
   return [...new Set(paths)];
 }
@@ -6878,12 +5920,12 @@ function isRecentLogLine(line, nowMs) {
   return nowMs - ts <= 24 * 60 * 60 * 1e3;
 }
 function checkVaultGitPullFailures(home) {
-  const path = pullLogPaths(home).find((p) => existsSync14(p));
+  const path = pullLogPaths(home).find((p) => existsSync13(p));
   if (!path) {
     return check("pass", "vault_git_pull_failures", "Vault pull failures", "No wiki-pull.log found \u2014 check skipped");
   }
   try {
-    const lines = readFileSync11(path, "utf8").split(/\r?\n/).filter(Boolean);
+    const lines = readFileSync10(path, "utf8").split(/\r?\n/).filter(Boolean);
     const now = Date.now();
     const failures = lines.filter(
       (line) => isRecentLogLine(line, now) && /(pre-push pull failed|FAIL .*pull|FAIL .*rebase|cannot pull with rebase|unstaged changes)/i.test(line)
@@ -6906,8 +5948,8 @@ function checkS3MountPerf(resolvedPath) {
     return check("pass", "s3_mount_perf", "S3 mount performance", "local disk");
   }
   const mountPoint = fuse.mountPoint;
-  const conceptsDir = join26(resolvedPath, "concepts");
-  if (!existsSync14(conceptsDir)) {
+  const conceptsDir = join24(resolvedPath, "concepts");
+  if (!existsSync13(conceptsDir)) {
     return check("pass", "s3_mount_perf", "S3 mount performance", `S3 FUSE mount (${mountPoint}), no concepts/ to benchmark`);
   }
   const start = Date.now();
@@ -7089,8 +6131,8 @@ function checkWriteTest(resolvedPath) {
   if (!fuse) {
     return check("pass", "s3_write_test", "S3 write test", "local disk \u2014 check skipped");
   }
-  const conceptsDir = join26(resolvedPath, "concepts");
-  if (!existsSync14(conceptsDir)) {
+  const conceptsDir = join24(resolvedPath, "concepts");
+  if (!existsSync13(conceptsDir)) {
     return check("pass", "s3_write_test", "S3 write test", "no concepts/ dir to test \u2014 check skipped");
   }
   const result = writeTest(conceptsDir);
@@ -7174,9 +6216,45 @@ function checkVfsCacheHealth(resolvedPath) {
     `${stats.files} files, ${(stats.bytesUsed / 1024 / 1024).toFixed(1)}MB \u2014 clean (0 errored, 0 pending)`
   );
 }
+function checkVaultSyncPullHelper(home, env) {
+  const path = resolveVaultSyncPullHelper({
+    vault: "",
+    home,
+    env
+  });
+  if (path) {
+    return check("pass", "vault_sync_pull_helper", "Vault-sync pull helper", `Resolved: ${path}`);
+  }
+  return check(
+    "error",
+    "vault_sync_pull_helper",
+    "Vault-sync pull helper",
+    "Not found \u2014 install skillwiki@0.10.1+, redeploy vault-sync, or set SKILLWIKI_VAULT_SYNC_PULL_HELPER"
+  );
+}
+function checkVaultSyncReviewRequiredJournals(vaultPath) {
+  if (!vaultPath || !existsSync13(join24(vaultPath, ".git"))) {
+    return check("pass", "vault_sync_review_required_journals", "Review-required journals", "No git vault \u2014 check skipped");
+  }
+  try {
+    const ops = listReviewRequiredOps(vaultPath);
+    if (ops.length === 0) {
+      return check("pass", "vault_sync_review_required_journals", "Review-required journals", "None");
+    }
+    const sample = ops[0]?.opId ?? "?";
+    return check(
+      "warn",
+      "vault_sync_review_required_journals",
+      "Review-required journals",
+      `${ops.length} handoff(s); oldest/sample: ${sample} \u2014 if worktree clean: skillwiki sync journal clear-stale --dry-run`
+    );
+  } catch {
+    return check("pass", "vault_sync_review_required_journals", "Review-required journals", "Could not read journals \u2014 check skipped");
+  }
+}
 function readVaultSyncConfig(home) {
   try {
-    const content = readFileSync11(join26(home, ".skillwiki", ".env"), "utf8");
+    const content = readFileSync10(join24(home, ".skillwiki", ".env"), "utf8");
     let installed = false;
     let role;
     let serviceScope;
@@ -7205,7 +6283,7 @@ function readVaultSyncConfig(home) {
 }
 function readKeyFromEnvFile(path, keys) {
   try {
-    const content = readFileSync11(path, "utf8");
+    const content = readFileSync10(path, "utf8");
     for (const line of content.split(/\r?\n/)) {
       const trimmed = line.trim();
       if (trimmed.length === 0 || trimmed.startsWith("#")) continue;
@@ -7227,7 +6305,7 @@ function resolveSnapshotGitWorktree(config) {
     if (fromProfile) return fromProfile;
   }
   const defaultPath = "/root/wiki-git";
-  return existsSync14(defaultPath) ? defaultPath : void 0;
+  return existsSync13(defaultPath) ? defaultPath : void 0;
 }
 function vaultSyncChecks(input) {
   const os = input.os ?? platform2();
@@ -7244,16 +6322,16 @@ function vaultSyncChecks(input) {
     ];
   }
   const isMac = os === "darwin";
-  const logDir = input.logDir ?? (isMac ? join26(home, "Library", "Logs") : join26(home, ".local", "state", "vault-sync", "log"));
-  const shareDir = input.shareDir ?? (isMac ? join26(home, "Library", "Application Support", "vault-sync", "bin") : join26(home, ".local", "share", "vault-sync", "bin"));
-  const filterPath = input.filterPath ?? join26(home, ".config", "rclone", "wiki-push-filters.txt");
-  const packagedSnapshotPath = join26(shareDir, "wiki-snapshot.sh");
+  const logDir = input.logDir ?? (isMac ? join24(home, "Library", "Logs") : join24(home, ".local", "state", "vault-sync", "log"));
+  const shareDir = input.shareDir ?? (isMac ? join24(home, "Library", "Application Support", "vault-sync", "bin") : join24(home, ".local", "share", "vault-sync", "bin"));
+  const filterPath = input.filterPath ?? join24(home, ".config", "rclone", "wiki-push-filters.txt");
+  const packagedSnapshotPath = join24(shareDir, "wiki-snapshot.sh");
   const legacySnapshotPath = "/root/.hermes/scripts/wiki-snapshot-v3.sh";
-  const snapshotPath = input.snapshotScriptPath ?? (existsSync14(packagedSnapshotPath) ? packagedSnapshotPath : legacySnapshotPath);
+  const snapshotPath = input.snapshotScriptPath ?? (existsSync13(packagedSnapshotPath) ? packagedSnapshotPath : legacySnapshotPath);
   function snapshotLastStatusCheck() {
-    const snapshotLog = join26(logDir, "wiki-snapshot.log");
+    const snapshotLog = join24(logDir, "wiki-snapshot.log");
     try {
-      const logContent = readFileSync11(snapshotLog, "utf8");
+      const logContent = readFileSync10(snapshotLog, "utf8");
       const lines = logContent.trim().split("\n").filter(Boolean);
       if (lines.length === 0) {
         return check(
@@ -7298,14 +6376,14 @@ function vaultSyncChecks(input) {
     }
   }
   if (input.vaultSyncRole === "snapshotter") {
-    const c12 = existsSync14(snapshotPath) ? check("pass", "vault_sync_installed", "Vault sync installed", `Found snapshot script: ${snapshotPath}`) : check("error", "vault_sync_installed", "Vault sync installed", `Snapshot script not found at ${snapshotPath}`);
+    const c12 = existsSync13(snapshotPath) ? check("pass", "vault_sync_installed", "Vault sync installed", `Found snapshot script: ${snapshotPath}`) : check("error", "vault_sync_installed", "Vault sync installed", `Snapshot script not found at ${snapshotPath}`);
     const serviceScope = input.vaultSyncServiceScope ?? "user";
-    const userTimerPath = join26(home, ".config", "systemd", "user", "wiki-snapshot.timer");
+    const userTimerPath = join24(home, ".config", "systemd", "user", "wiki-snapshot.timer");
     const systemTimerPath = "/etc/systemd/system/wiki-snapshot.timer";
     let c22;
-    if (serviceScope === "user" && existsSync14(userTimerPath)) {
+    if (serviceScope === "user" && existsSync13(userTimerPath)) {
       c22 = check("pass", "vault_sync_jobs_enabled", "Vault sync jobs enabled", `Found: ${userTimerPath}`);
-    } else if (serviceScope === "system" && existsSync14(systemTimerPath)) {
+    } else if (serviceScope === "system" && existsSync13(systemTimerPath)) {
       c22 = check("pass", "vault_sync_jobs_enabled", "Vault sync jobs enabled", `Found: ${systemTimerPath}`);
     } else if (os !== "linux") {
       c22 = check("warn", "vault_sync_jobs_enabled", "Vault sync jobs enabled", "Snapshotter scheduler is Linux-only and no wiki-snapshot.timer file was found");
@@ -7337,7 +6415,7 @@ function vaultSyncChecks(input) {
     );
     let c52;
     try {
-      if (!existsSync14(snapshotPath)) {
+      if (!existsSync13(snapshotPath)) {
         c52 = check(
           "error",
           "vault_sync_snapshot_guard",
@@ -7345,7 +6423,7 @@ function vaultSyncChecks(input) {
           `Snapshot script not found at ${snapshotPath}`
         );
       } else {
-        const content = readFileSync11(snapshotPath, "utf8");
+        const content = readFileSync10(snapshotPath, "utf8");
         if (!content.includes("--max-delete")) {
           c52 = check(
             "error",
@@ -7372,8 +6450,8 @@ function vaultSyncChecks(input) {
     }
     return [c12, c22, c32, cFetch2, c42, c52];
   }
-  const pushScriptPath = join26(shareDir, "wiki-push.sh");
-  const c1 = existsSync14(pushScriptPath) ? check("pass", "vault_sync_installed", "Vault sync installed", `Found: ${pushScriptPath}`) : check("error", "vault_sync_installed", "Vault sync installed", `Script not found at ${pushScriptPath} \u2014 run vault-sync-install`);
+  const pushScriptPath = join24(shareDir, "wiki-push.sh");
+  const c1 = existsSync13(pushScriptPath) ? check("pass", "vault_sync_installed", "Vault sync installed", `Found: ${pushScriptPath}`) : check("error", "vault_sync_installed", "Vault sync installed", `Script not found at ${pushScriptPath} \u2014 run vault-sync-install`);
   let c2;
   try {
     if (isMac) {
@@ -7424,10 +6502,10 @@ function vaultSyncChecks(input) {
       "Scheduler check failed \u2014 run vault-sync-install"
     );
   }
-  const logFile = join26(logDir, "wiki-push.log");
+  const logFile = join24(logDir, "wiki-push.log");
   let c3;
   try {
-    const logContent = readFileSync11(logFile, "utf8");
+    const logContent = readFileSync10(logFile, "utf8");
     const lines = logContent.trim().split("\n").filter(Boolean);
     if (lines.length === 0) {
       c3 = check(
@@ -7483,7 +6561,7 @@ function vaultSyncChecks(input) {
       }
     }
   } catch {
-    c3 = existsSync14(logDir) ? check(
+    c3 = existsSync13(logDir) ? check(
       "warn",
       "vault_sync_last_push_age",
       "Vault sync last push recency",
@@ -7495,10 +6573,10 @@ function vaultSyncChecks(input) {
       `Log directory not found at ${logDir}`
     );
   }
-  const fetchLogFile = join26(logDir, "wiki-fetch.log");
+  const fetchLogFile = join24(logDir, "wiki-fetch.log");
   let cFetch;
   try {
-    const logContent = readFileSync11(fetchLogFile, "utf8");
+    const logContent = readFileSync10(fetchLogFile, "utf8");
     const lines = logContent.trim().split("\n").filter(Boolean);
     if (lines.length === 0) {
       cFetch = check(
@@ -7542,7 +6620,7 @@ function vaultSyncChecks(input) {
   }
   let c4;
   try {
-    if (!existsSync14(filterPath)) {
+    if (!existsSync13(filterPath)) {
       c4 = check(
         "error",
         "vault_sync_filter_present",
@@ -7550,7 +6628,7 @@ function vaultSyncChecks(input) {
         `Filter file not found at ${filterPath}`
       );
     } else {
-      const content = readFileSync11(filterPath, "utf8");
+      const content = readFileSync10(filterPath, "utf8");
       const requiredExcludes = [
         "remotely-save/data.json",
         ".skillwiki/sync.lock",
@@ -7593,7 +6671,7 @@ function vaultSyncChecks(input) {
     );
   } else {
     try {
-      if (!existsSync14(snapshotPath)) {
+      if (!existsSync13(snapshotPath)) {
         c5 = check(
           "error",
           "vault_sync_snapshot_guard",
@@ -7601,7 +6679,7 @@ function vaultSyncChecks(input) {
           `Snapshot script not found at ${snapshotPath}`
         );
       } else {
-        const content = readFileSync11(snapshotPath, "utf8");
+        const content = readFileSync10(snapshotPath, "utf8");
         if (!content.includes("--max-delete")) {
           c5 = check(
             "error",
@@ -7639,15 +6717,15 @@ function findSkillMd(dir) {
   }
   for (const entry of entries) {
     if (entry.isFile() && entry.name === "SKILL.md") {
-      results.push(join26(dir, entry.name));
+      results.push(join24(dir, entry.name));
     } else if (entry.isDirectory()) {
-      results.push(...findSkillMd(join26(dir, entry.name)));
+      results.push(...findSkillMd(join24(dir, entry.name)));
     }
   }
   return results;
 }
 function findInstalledSkillMd(dir) {
-  const directSkills = findSkillNames(dir).map((name) => join26(dir, name, "SKILL.md"));
+  const directSkills = findSkillNames(dir).map((name) => join24(dir, name, "SKILL.md"));
   return directSkills.length > 0 ? directSkills : findSkillMd(dir);
 }
 function findSkillNames(dir) {
@@ -7659,7 +6737,7 @@ function findSkillNames(dir) {
     return results;
   }
   for (const entry of entries) {
-    if (entry.isDirectory() && existsSync14(join26(dir, entry.name, "SKILL.md"))) {
+    if (entry.isDirectory() && existsSync13(join24(dir, entry.name, "SKILL.md"))) {
       results.push(entry.name);
     }
   }
@@ -7703,7 +6781,7 @@ async function vaultMetrics(resolvedPath) {
   }
   let logLines = 0;
   try {
-    logLines = readFileSync11(join26(resolvedPath, "log.md"), "utf8").split("\n").length;
+    logLines = readFileSync10(join24(resolvedPath, "log.md"), "utf8").split("\n").length;
   } catch {
   }
   return [
@@ -7784,6 +6862,8 @@ async function runDoctor(input) {
     vaultSyncServiceScope: vsConfig.serviceScope,
     snapshotScriptPath: vsConfig.snapshotScript
   }));
+  checks.push(checkVaultSyncPullHelper(input.home, input.env ?? process.env));
+  checks.push(checkVaultSyncReviewRequiredJournals(resolvedPath));
   const satelliteGate = satelliteGateFromFleetLoad(fleetLoad);
   checks.push(checkSatelliteLastRun(resolvedPath, satelliteGate.satelliteExpected));
   checks.push(checkSatelliteTimer(satelliteGate.satelliteExpected));
@@ -7811,7 +6891,7 @@ async function runDoctor(input) {
 }
 
 // src/utils/package-info.ts
-import { readFileSync as readFileSync12 } from "fs";
+import { readFileSync as readFileSync11 } from "fs";
 function packageJsonCandidateUrls(baseUrl = import.meta.url) {
   return [
     new URL("../package.json", baseUrl),
@@ -7821,7 +6901,7 @@ function packageJsonCandidateUrls(baseUrl = import.meta.url) {
 function readCliPackageJson(baseUrl = import.meta.url) {
   for (const url of packageJsonCandidateUrls(baseUrl)) {
     try {
-      const pkg = JSON.parse(readFileSync12(url, "utf8"));
+      const pkg = JSON.parse(readFileSync11(url, "utf8"));
       if (typeof pkg.version === "string") {
         return { ...pkg, version: pkg.version };
       }
@@ -7831,214 +6911,11 @@ function readCliPackageJson(baseUrl = import.meta.url) {
   throw new Error(`Could not locate skillwiki package.json from ${baseUrl}`);
 }
 
-// src/commands/project-index.ts
-import { readdir as readdir4, readFile as readFile19, writeFile as writeFile5, mkdir as mkdir5 } from "fs/promises";
-import { join as join27, dirname as dirname8, basename as basename2 } from "path";
-var LAYER2_DIRS = ["entities", "concepts", "comparisons", "queries", "meta"];
-var PROJECT_LOCAL_DIRS = ["requirements", "work", "architecture", "history"];
-async function scanMarkdownTree(rootAbs, rootRel) {
-  const found = [];
-  let entries;
-  try {
-    entries = await readdir4(rootAbs, { withFileTypes: true });
-  } catch {
-    return found;
-  }
-  for (const entry of entries) {
-    const abs = join27(rootAbs, entry.name);
-    const rel = `${rootRel}/${entry.name}`;
-    if (entry.isDirectory()) {
-      found.push(...await scanMarkdownTree(abs, rel));
-    } else if (entry.isFile() && entry.name.endsWith(".md")) {
-      found.push(rel);
-    }
-  }
-  return found;
-}
-function projectLocalType(slug, page, data) {
-  if (page.startsWith(`projects/${slug}/requirements/`)) return "requirement";
-  if (page.startsWith(`projects/${slug}/work/`)) {
-    if (typeof data.kind === "string") return data.kind;
-    const name = basename2(page, ".md");
-    if (name === "spec" || name === "plan" || name === "retro") return name;
-    return "work";
-  }
-  if (page.startsWith(`projects/${slug}/architecture/`)) {
-    return typeof data.type === "string" ? data.type : "architecture";
-  }
-  if (page.startsWith(`projects/${slug}/history/`)) {
-    if (typeof data.kind === "string") return data.kind;
-    if (typeof data.type === "string") return data.type;
-    return "history";
-  }
-  return typeof data.type === "string" ? data.type : "project";
-}
-async function runProjectIndex(input) {
-  const slug = input.slug;
-  const projectDir = join27(input.vault, "projects", slug);
-  try {
-    await readdir4(projectDir);
-  } catch {
-    return {
-      exitCode: ExitCode.PROJECT_NOT_FOUND,
-      result: err("PROJECT_NOT_FOUND", { slug, path: projectDir })
-    };
-  }
-  const wikilinkPattern = `[[${slug}]]`;
-  const entries = [];
-  const compoundDir = join27(input.vault, "projects", slug, "compound");
-  try {
-    const compoundFiles = await readdir4(compoundDir, { withFileTypes: true });
-    for (const entry of compoundFiles) {
-      if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-      const filePath = join27(compoundDir, entry.name);
-      let text;
-      try {
-        text = await readFile19(filePath, "utf8");
-      } catch {
-        continue;
-      }
-      const fm = extractFrontmatter(text);
-      if (!fm.ok) continue;
-      entries.push({
-        page: `projects/${slug}/compound/${entry.name}`,
-        type: typeof fm.data.type === "string" ? fm.data.type : "compound",
-        title: typeof fm.data.title === "string" ? fm.data.title : entry.name.replace(/\.md$/, "")
-      });
-    }
-  } catch {
-  }
-  for (const dir of LAYER2_DIRS) {
-    let files;
-    try {
-      files = await readdir4(join27(input.vault, dir), { withFileTypes: true });
-    } catch {
-      continue;
-    }
-    for (const entry of files) {
-      if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-      const filePath = join27(input.vault, dir, entry.name);
-      let text;
-      try {
-        text = await readFile19(filePath, "utf8");
-      } catch {
-        continue;
-      }
-      const fm = extractFrontmatter(text);
-      if (!fm.ok) continue;
-      const pp = fm.data.provenance_projects;
-      if (!Array.isArray(pp) || !pp.some((p) => String(p) === wikilinkPattern)) continue;
-      entries.push({
-        page: `${dir}/${entry.name}`,
-        type: typeof fm.data.type === "string" ? fm.data.type : dir.slice(0, -1),
-        title: typeof fm.data.title === "string" ? fm.data.title : entry.name.replace(/\.md$/, "")
-      });
-    }
-  }
-  for (const dir of PROJECT_LOCAL_DIRS) {
-    const rootAbs = join27(projectDir, dir);
-    const rootRel = `projects/${slug}/${dir}`;
-    const pages = await scanMarkdownTree(rootAbs, rootRel);
-    for (const page of pages) {
-      const filePath = join27(input.vault, page);
-      let text;
-      try {
-        text = await readFile19(filePath, "utf8");
-      } catch {
-        continue;
-      }
-      const fm = extractFrontmatter(text);
-      if (!fm.ok) continue;
-      entries.push({
-        page,
-        type: projectLocalType(slug, page, fm.data),
-        title: typeof fm.data.title === "string" ? fm.data.title : basename2(page, ".md")
-      });
-    }
-  }
-  const typeOrder = { entity: 0, concept: 1, comparison: 2, query: 3, summary: 4, meta: 5, requirement: 6, spec: 7, plan: 8, retro: 9, architecture: 10, pattern: 11, gotcha: 12, lesson: 13, antipattern: 14, compound: 15, work: 16, history: 17 };
-  entries.sort((a, b) => {
-    const ta = typeOrder[a.type] ?? 99;
-    const tb = typeOrder[b.type] ?? 99;
-    return ta !== tb ? ta - tb : a.title.localeCompare(b.title);
-  });
-  const indexPath = join27(projectDir, "knowledge.md");
-  let existing = false;
-  let stale = false;
-  try {
-    const existingText = await readFile19(indexPath, "utf8");
-    existing = true;
-    const existingEntries = existingText.split("\n").filter((l) => l.startsWith("- [["));
-    const existingPages = new Set(existingEntries.map((l) => {
-      const m = l.match(/\[\[([^\]]+)\]\]/);
-      return m ? m[1] : "";
-    }));
-    const currentPages = new Set(entries.map((e) => e.page.replace(/\.md$/, "")));
-    stale = existingPages.size !== currentPages.size || [...currentPages].some((p) => !existingPages.has(p));
-  } catch {
-  }
-  const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  const grouped = /* @__PURE__ */ new Map();
-  for (const e of entries) {
-    const group = e.type;
-    if (!grouped.has(group)) grouped.set(group, []);
-    grouped.get(group).push(e);
-  }
-  let body = `# Knowledge Index: ${slug}
-
-Autogenerated by \`skillwiki project-index\` on ${today}.
-
-`;
-  for (const [type, items] of grouped) {
-    body += `## ${type}
-
-`;
-    for (const item of items) {
-      const pageRef = item.page.replace(/\.md$/, "");
-      body += `- [[${pageRef}]] \u2014 ${item.title}
-`;
-    }
-    body += "\n";
-  }
-  if (entries.length === 0) {
-    body += `No Layer 2 pages reference \`[[${slug}]]\` in provenance_projects.
-`;
-  }
-  if (input.apply) {
-    try {
-      await mkdir5(dirname8(indexPath), { recursive: true });
-      await writeFile5(indexPath, body, "utf8");
-    } catch (e) {
-      return {
-        exitCode: ExitCode.WRITE_FAILED,
-        result: err("WRITE_FAILED", { file: indexPath, message: String(e) })
-      };
-    }
-  }
-  const action = input.apply ? `written ${entries.length} entries to ${indexPath}` : `${entries.length} entries found (use --apply to write)`;
-  const staleHint = stale ? " (STALE \u2014 existing index outdated)" : existing ? " (up to date)" : "";
-  return {
-    exitCode: ExitCode.OK,
-    result: ok({
-      slug,
-      entries,
-      existing,
-      stale,
-      index_path: `projects/${slug}/knowledge.md`,
-      humanHint: `project: ${slug}
-entries: ${entries.length}${staleHint}
-${action}
-
-${entries.map((e) => `  ${e.type}: [[${e.page.replace(/\.md$/, "")}]] \u2014 ${e.title}`).join("\n")}`
-    })
-  };
-}
-
 // src/commands/observe.ts
-import { mkdir as mkdir6, writeFile as writeFile6 } from "fs/promises";
-import { existsSync as existsSync15, statSync as statSync3 } from "fs";
-import { join as join28 } from "path";
-import { createHash as createHash7 } from "crypto";
+import { mkdir as mkdir5, writeFile as writeFile4 } from "fs/promises";
+import { existsSync as existsSync14, statSync as statSync3 } from "fs";
+import { join as join25 } from "path";
+import { createHash as createHash6 } from "crypto";
 var ALLOWED_KINDS = /* @__PURE__ */ new Set(["note", "bug", "task", "idea", "session-log"]);
 function slugify(text) {
   const words = text.trim().split(/\s+/).slice(0, 6).join("-").toLowerCase().replace(/[^a-z0-9-]/g, "").replace(/-+/g, "-").replace(/^-|-$/g, "");
@@ -8060,15 +6937,15 @@ async function runObserve(input) {
       result: err("SCHEME_REJECTED", { message: "Text must not be empty" })
     };
   }
-  if (!existsSync15(input.vault) || !statSync3(input.vault).isDirectory()) {
+  if (!existsSync14(input.vault) || !statSync3(input.vault).isDirectory()) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: err("VAULT_PATH_INVALID", { path: input.vault })
     };
   }
-  const transcriptsDir = join28(input.vault, "raw", "transcripts");
+  const transcriptsDir = join25(input.vault, "raw", "transcripts");
   try {
-    await mkdir6(transcriptsDir, { recursive: true });
+    await mkdir5(transcriptsDir, { recursive: true });
   } catch {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
@@ -8078,11 +6955,11 @@ async function runObserve(input) {
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const slug = slugify(input.text);
   const fileName = `${today}-observation-${slug}.md`;
-  const filePath = join28(transcriptsDir, fileName);
+  const filePath = join25(transcriptsDir, fileName);
   const body = `
 ${input.text.trim()}
 `;
-  const sha256 = createHash7("sha256").update(Buffer.from(body, "utf8")).digest("hex");
+  const sha256 = createHash6("sha256").update(Buffer.from(body, "utf8")).digest("hex");
   const frontmatterLines = [
     "---",
     "source_url:",
@@ -8096,7 +6973,7 @@ ${input.text.trim()}
   frontmatterLines.push("---");
   const content = frontmatterLines.join("\n") + body;
   try {
-    await writeFile6(filePath, content, "utf8");
+    await writeFile4(filePath, content, "utf8");
   } catch (e) {
     return {
       exitCode: ExitCode.WRITE_FAILED,
@@ -8118,9 +6995,9 @@ ${input.text.trim()}
 }
 
 // src/commands/memory.ts
-import { createHash as createHash8 } from "crypto";
-import { mkdir as mkdir7, readFile as readFile20, readdir as readdir5, stat as stat6, writeFile as writeFile7 } from "fs/promises";
-import { basename as basename3, extname, join as join29, relative as relative5, sep as sep5 } from "path";
+import { createHash as createHash7 } from "crypto";
+import { mkdir as mkdir6, readFile as readFile16, readdir as readdir4, stat as stat5, writeFile as writeFile5 } from "fs/promises";
+import { basename as basename2, extname, join as join26, relative as relative3, sep as sep3 } from "path";
 async function runMemoryTopics(input) {
   const scan = await scanVault(input.vault);
   if (!scan.ok) return { exitCode: ExitCode.VAULT_PATH_INVALID, result: scan };
@@ -8184,9 +7061,9 @@ async function runMemoryIndex(input) {
   }
   const generatedAt = (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "Z");
   const relCachePath = memoryCacheRelPath(input.project);
-  const absCachePath = join29(input.vault, relCachePath);
-  await mkdir7(join29(input.vault, ".skillwiki", "memory", input.project), { recursive: true });
-  await writeFile7(absCachePath, `${JSON.stringify({
+  const absCachePath = join26(input.vault, relCachePath);
+  await mkdir6(join26(input.vault, ".skillwiki", "memory", input.project), { recursive: true });
+  await writeFile5(absCachePath, `${JSON.stringify({
     generated_at: generatedAt,
     project: input.project,
     topics: state.topics,
@@ -8377,7 +7254,7 @@ async function buildMemoryIndexState(pages, project) {
 }
 async function checkMemoryIndex(vault, project, current) {
   const relCachePath = memoryCacheRelPath(project);
-  const cacheText = await readIfExists2(join29(vault, relCachePath));
+  const cacheText = await readIfExists2(join26(vault, relCachePath));
   if (!cacheText) {
     return {
       ok: true,
@@ -8494,7 +7371,7 @@ async function readMemoryPage(page, project, warnings) {
       title,
       summary: summarize(body),
       updated,
-      hash: createHash8("sha256").update(Buffer.from(body, "utf8")).digest("hex"),
+      hash: createHash7("sha256").update(Buffer.from(body, "utf8")).digest("hex"),
       topics,
       project,
       ...stringField(fm.data.memory_kind) ? { memory_kind: stringField(fm.data.memory_kind) } : {},
@@ -8770,23 +7647,23 @@ function renderMemoryIndexStatusHint(status) {
 }
 async function readIfExists2(path) {
   try {
-    return await readFile20(path, "utf8");
+    return await readFile16(path, "utf8");
   } catch {
     return "";
   }
 }
 async function collectImportFiles(source) {
-  const st = await stat6(source);
+  const st = await stat5(source);
   if (st.isFile()) return isImportCandidate(source) ? [source] : [];
   const files = [];
   await walkImportFiles(source, files);
   return files.sort((a, b) => a.localeCompare(b));
 }
 async function walkImportFiles(dir, out) {
-  const entries = await readdir5(dir, { withFileTypes: true });
+  const entries = await readdir4(dir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.name === ".git" || entry.name === "node_modules") continue;
-    const path = join29(dir, entry.name);
+    const path = join26(dir, entry.name);
     if (entry.isDirectory()) {
       await walkImportFiles(path, out);
     } else if (entry.isFile() && isImportCandidate(path)) {
@@ -8799,9 +7676,9 @@ function isImportCandidate(path) {
   return ext === ".md" || ext === ".txt";
 }
 async function buildImportEntry(file, sourceRoot, project, today, maxBytes) {
-  const st = await stat6(file);
+  const st = await stat5(file);
   const sourceKind = classifyImportSource(file);
-  const hash = createHash8("sha256").update(await readFile20(file)).digest("hex");
+  const hash = createHash7("sha256").update(await readFile16(file)).digest("hex");
   const baseEntry = {
     source_path: file,
     source_kind: sourceKind,
@@ -8824,7 +7701,7 @@ async function buildImportEntry(file, sourceRoot, project, today, maxBytes) {
       reason: "policy_source_not_imported"
     };
   }
-  const text = await readFile20(file, "utf8");
+  const text = await readFile16(file, "utf8");
   const extracted = extractImportText(text, sourceKind);
   if (!extracted) {
     return {
@@ -8835,8 +7712,8 @@ async function buildImportEntry(file, sourceRoot, project, today, maxBytes) {
   }
   const redacted = redactSensitiveContent(extracted, { file });
   const privacy = redacted.findings.length > 0 ? "sensitive" : "local";
-  const sourceSlug = slugify2(basename3(file, extname(file)));
-  const relSource = relative5(sourceRoot, file).split(sep5).join("/");
+  const sourceSlug = slugify2(basename2(file, extname(file)));
+  const relSource = relative3(sourceRoot, file).split(sep3).join("/");
   const entry = {
     ...baseEntry,
     status: "ready",
@@ -8853,9 +7730,9 @@ async function writeImportCapture(vault, entry, today) {
   const content = hiddenString(entry, "__content");
   const project = hiddenString(entry, "__project");
   const relPath = await availableImportPath(vault, entry.proposed_path);
-  const absPath = join29(vault, relPath);
-  await mkdir7(join29(vault, "raw", "transcripts"), { recursive: true });
-  await writeFile7(absPath, renderImportCapture(entry, content, project, today), "utf8");
+  const absPath = join26(vault, relPath);
+  await mkdir6(join26(vault, "raw", "transcripts"), { recursive: true });
+  await writeFile5(absPath, renderImportCapture(entry, content, project, today), "utf8");
   const validation = await runValidate({ file: absPath });
   return {
     relPath,
@@ -8870,7 +7747,7 @@ async function availableImportPath(vault, proposed) {
   const stem = proposed.slice(0, -ext.length);
   let candidate = proposed;
   let i = 2;
-  while (await readIfExists2(join29(vault, candidate))) {
+  while (await readIfExists2(join26(vault, candidate))) {
     candidate = `${stem}-${i}${ext}`;
     i++;
   }
@@ -8894,7 +7771,7 @@ function renderImportCapture(entry, content, project, today) {
     `source_paths: ["${entry.source_path.replaceAll('"', '\\"')}"]`,
     "---",
     "",
-    `# Imported Memory: ${basename3(entry.source_path, extname(entry.source_path))}`,
+    `# Imported Memory: ${basename2(entry.source_path, extname(entry.source_path))}`,
     "",
     `Source kind: ${entry.source_kind}`,
     "",
@@ -8908,8 +7785,8 @@ function hiddenString(entry, key) {
   return entry[key] ?? "";
 }
 function classifyImportSource(file) {
-  const rel = file.split(sep5).join("/");
-  const name = basename3(file);
+  const rel = file.split(sep3).join("/");
+  const name = basename2(file);
   if (rel.includes("/.codex/memories/")) return "codex-memory";
   if (rel.includes("/.codex/rules/")) return "codex-rule";
   if (rel.includes("/.claude/") && name === "napkin.md") return "napkin";
@@ -9042,10 +7919,10 @@ function memoryCacheRelPath(project) {
 }
 async function readMemoryCache(vault, project) {
   if (project) {
-    const projectCache = await readIfExists2(join29(vault, memoryCacheRelPath(project)));
+    const projectCache = await readIfExists2(join26(vault, memoryCacheRelPath(project)));
     if (projectCache) return projectCache;
   }
-  return readIfExists2(join29(vault, ".skillwiki", "memory-topics.json"));
+  return readIfExists2(join26(vault, ".skillwiki", "memory-topics.json"));
 }
 function dedupePages(pages) {
   const seen = /* @__PURE__ */ new Set();
@@ -9131,8 +8008,8 @@ function slugify2(value) {
 }
 
 // src/commands/query.ts
-import { readFile as readFile21, stat as stat7 } from "fs/promises";
-import { join as join30 } from "path";
+import { readFile as readFile17, stat as stat6 } from "fs/promises";
+import { join as join27 } from "path";
 var W_KEYWORD = 2;
 var W_SOURCE_OVERLAP = 4;
 var W_WIKILINK = 3;
@@ -9185,11 +8062,11 @@ async function runQuery(input) {
   );
   const results = pages.map((page) => {
     const sourceOverlap = scoreSourceOverlap(page, pages, seedPaths);
-    const wikilink2 = scoreWikilink(page.relPath, seedPaths, graph);
+    const wikilink = scoreWikilink(page.relPath, seedPaths, graph);
     const aa = scoreAdamicAdar(page.relPath, seedPaths, graph);
     const typeAffinity = scoreTypeAffinity(page.type, queryTerms);
     const isSeed = page.keywordScore > 0;
-    const structuralBoost = sourceOverlap * W_SOURCE_OVERLAP + wikilink2 * W_WIKILINK + aa * W_ADAMIC_ADAR;
+    const structuralBoost = sourceOverlap * W_SOURCE_OVERLAP + wikilink * W_WIKILINK + aa * W_ADAMIC_ADAR;
     const composite = isSeed ? page.keywordScore * W_KEYWORD + structuralBoost + typeAffinity * W_TYPE_AFFINITY : structuralBoost * NON_SEED_FACTOR + typeAffinity * W_TYPE_AFFINITY;
     return {
       path: page.relPath,
@@ -9253,10 +8130,10 @@ function computeKeywordScore(terms, title, tags, body) {
   return score;
 }
 async function loadOrBuildGraph(vault) {
-  const graphPath = join30(vault, ".skillwiki", "graph.json");
+  const graphPath = join27(vault, ".skillwiki", "graph.json");
   let needsBuild = false;
   try {
-    const fileStat = await stat7(graphPath);
+    const fileStat = await stat6(graphPath);
     const ageHours = (Date.now() - fileStat.mtimeMs) / (1e3 * 60 * 60);
     if (ageHours > 24) needsBuild = true;
   } catch {
@@ -9267,7 +8144,7 @@ async function loadOrBuildGraph(vault) {
     if (buildResult.exitCode !== 0) return null;
   }
   try {
-    const raw = await readFile21(graphPath, "utf8");
+    const raw = await readFile17(graphPath, "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -9279,30 +8156,30 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
 // src/mcp/tools.ts
-import { z as z2 } from "zod";
+import { z } from "zod";
 
 // src/mcp/vault-resolve.ts
-import { join as join31, resolve as resolve8 } from "path";
+import { join as join28, resolve as resolve7 } from "path";
 
 // src/mcp/allowlist.ts
-import { resolve as resolve7, sep as sep6 } from "path";
-import { realpathSync as realpathSync2 } from "fs";
+import { resolve as resolve6, sep as sep4 } from "path";
+import { realpathSync } from "fs";
 function parseVaultAllowlist(envValue) {
   if (envValue === void 0 || envValue.trim() === "") return null;
-  return envValue.split(",").map((s) => s.trim()).filter((s) => s.length > 0).map((p) => resolve7(p));
+  return envValue.split(",").map((s) => s.trim()).filter((s) => s.length > 0).map((p) => resolve6(p));
 }
 function vaultAllowedByList(vaultPath, allowlist) {
   if (!allowlist || allowlist.length === 0) return true;
   let canonical = vaultPath;
   try {
-    canonical = realpathSync2(vaultPath);
+    canonical = realpathSync(vaultPath);
   } catch {
-    canonical = resolve7(vaultPath);
+    canonical = resolve6(vaultPath);
   }
-  const resolved = resolve7(canonical);
+  const resolved = resolve6(canonical);
   return allowlist.some((root) => {
-    const r = resolve7(root);
-    return resolved === r || resolved.startsWith(r + sep6);
+    const r = resolve6(root);
+    return resolved === r || resolved.startsWith(r + sep4);
   });
 }
 function getVaultAllowlistFromEnv() {
@@ -9315,7 +8192,7 @@ async function resolveMcpVault(input) {
   let vaultPath;
   let source = "resolved";
   if (input.vault !== void 0 && input.vault.length > 0) {
-    vaultPath = resolve8(input.vault);
+    vaultPath = resolve7(input.vault);
     source = "flag";
   } else {
     const r = await resolveRuntimePath({
@@ -9327,7 +8204,7 @@ async function resolveMcpVault(input) {
       cwd: input.cwd ?? process.cwd()
     });
     if (!r.ok) return r;
-    vaultPath = resolve8(r.data.path);
+    vaultPath = resolve7(r.data.path);
     source = r.data.source;
   }
   const scan = await scanVault(vaultPath);
@@ -9344,7 +8221,7 @@ async function resolveMcpVault(input) {
   return ok({ vault: vaultPath, source });
 }
 function defaultGraphOut(vault) {
-  return join31(vault, ".skillwiki", "graph.json");
+  return join28(vault, ".skillwiki", "graph.json");
 }
 
 // src/mcp/result-format.ts
@@ -9361,7 +8238,7 @@ function formatToolResult(payload) {
 // src/mcp/audit-log.ts
 import { appendFileSync, mkdirSync as mkdirSync5 } from "fs";
 import { homedir } from "os";
-import { join as join32 } from "path";
+import { join as join29 } from "path";
 function auditEnabled() {
   const v = process.env.SKILLWIKI_MCP_AUDIT;
   if (v === "0" || v === "false") return false;
@@ -9373,7 +8250,7 @@ function auditSink() {
 function auditFilePath() {
   const custom = process.env.SKILLWIKI_MCP_AUDIT_FILE;
   if (custom && custom.length > 0) return custom;
-  return join32(homedir(), ".skillwiki", "mcp-audit.jsonl");
+  return join29(homedir(), ".skillwiki", "mcp-audit.jsonl");
 }
 function auditMcpToolCall(entry) {
   if (!auditEnabled()) return;
@@ -9383,7 +8260,7 @@ function auditMcpToolCall(entry) {
     return;
   }
   const path = auditFilePath();
-  mkdirSync5(join32(path, ".."), { recursive: true });
+  mkdirSync5(join29(path, ".."), { recursive: true });
   appendFileSync(path, line, "utf8");
 }
 async function runMcpToolHandler(tool, input, fn) {
@@ -9412,18 +8289,18 @@ async function runMcpToolHandler(tool, input, fn) {
 
 // src/mcp/tools.ts
 var vaultFields = {
-  vault: z2.string().optional().describe("Vault root directory; omitted = resolve WIKI_PATH / default ~/wiki"),
-  wiki: z2.string().optional().describe("Wiki profile name for vault resolution")
+  vault: z.string().optional().describe("Vault root directory; omitted = resolve WIKI_PATH / default ~/wiki"),
+  wiki: z.string().optional().describe("Wiki profile name for vault resolution")
 };
 function registerMcpTools(server) {
   server.registerTool(
     "skillwiki.query",
     {
       description: "Ranked vault query over typed knowledge (read-only). Returns Result envelope JSON.",
-      inputSchema: z2.object({
+      inputSchema: z.object({
         ...vaultFields,
-        text: z2.string().min(1).describe("Query text"),
-        limit: z2.number().int().positive().optional().describe("Max results (default 10)")
+        text: z.string().min(1).describe("Query text"),
+        limit: z.number().int().positive().optional().describe("Max results (default 10)")
       })
     },
     async ({ vault, wiki, text, limit }) => runMcpToolHandler("skillwiki.query", { vault, wiki }, async () => {
@@ -9437,13 +8314,13 @@ function registerMcpTools(server) {
     "skillwiki.lint_summary",
     {
       description: "Vault lint bucket summary (read-only, no --fix). Returns Result envelope JSON.",
-      inputSchema: z2.object({
+      inputSchema: z.object({
         ...vaultFields,
-        only: z2.string().optional().describe("Run a single lint bucket"),
-        examplesLimit: z2.number().int().nonnegative().optional().describe("Examples per bucket in summary (default 3)"),
-        days: z2.number().int().positive().optional().describe("Stale threshold days (default 90)"),
-        lines: z2.number().int().positive().optional().describe("Pagesize threshold lines (default 200)"),
-        logThreshold: z2.number().int().positive().optional().describe("Log rotation threshold (default 500)")
+        only: z.string().optional().describe("Run a single lint bucket"),
+        examplesLimit: z.number().int().nonnegative().optional().describe("Examples per bucket in summary (default 3)"),
+        days: z.number().int().positive().optional().describe("Stale threshold days (default 90)"),
+        lines: z.number().int().positive().optional().describe("Pagesize threshold lines (default 200)"),
+        logThreshold: z.number().int().positive().optional().describe("Log rotation threshold (default 500)")
       })
     },
     async (args) => runMcpToolHandler("skillwiki.lint_summary", { vault: args.vault, wiki: args.wiki }, async () => {
@@ -9467,7 +8344,7 @@ function registerMcpTools(server) {
     "skillwiki.doctor",
     {
       description: "Diagnose skillwiki setup, vault path, sync, and plugin channels (read-only).",
-      inputSchema: z2.object({
+      inputSchema: z.object({
         ...vaultFields
       })
     },
@@ -9488,9 +8365,9 @@ function registerMcpTools(server) {
     "skillwiki.graph_build",
     {
       description: "Build wikilink graph JSON under .skillwiki/graph.json (writes graph file only).",
-      inputSchema: z2.object({
+      inputSchema: z.object({
         ...vaultFields,
-        out: z2.string().optional().describe("Output path (default <vault>/.skillwiki/graph.json)")
+        out: z.string().optional().describe("Output path (default <vault>/.skillwiki/graph.json)")
       })
     },
     async ({ vault, wiki, out }) => runMcpToolHandler("skillwiki.graph_build", { vault, wiki }, async () => {
@@ -9505,9 +8382,9 @@ function registerMcpTools(server) {
     "skillwiki.project_index",
     {
       description: "List project index entries for a slug (read-only, apply=false).",
-      inputSchema: z2.object({
+      inputSchema: z.object({
         ...vaultFields,
-        slug: z2.string().min(1).describe("Project slug under projects/{slug}/")
+        slug: z.string().min(1).describe("Project slug under projects/{slug}/")
       })
     },
     async ({ vault, wiki, slug }) => runMcpToolHandler("skillwiki.project_index", { vault, wiki }, async () => {
@@ -9521,10 +8398,10 @@ function registerMcpTools(server) {
     "skillwiki.stale",
     {
       description: "List stale pages, transcripts, and incomplete work items (read-only).",
-      inputSchema: z2.object({
+      inputSchema: z.object({
         ...vaultFields,
-        days: z2.number().int().positive().optional().describe("Stale age threshold (default 90)"),
-        project: z2.string().optional().describe("Scope to one project slug")
+        days: z.number().int().positive().optional().describe("Stale age threshold (default 90)"),
+        project: z.string().optional().describe("Scope to one project slug")
       })
     },
     async ({ vault, wiki, days, project }) => runMcpToolHandler("skillwiki.stale", { vault, wiki }, async () => {
@@ -9543,8 +8420,8 @@ function registerMcpTools(server) {
     "skillwiki.config_get",
     {
       description: "Read a single skillwiki config key from ~/.skillwiki/.env (read-only).",
-      inputSchema: z2.object({
-        key: z2.string().min(1).describe("Config key (e.g. WIKI_PATH or profile key)")
+      inputSchema: z.object({
+        key: z.string().min(1).describe("Config key (e.g. WIKI_PATH or profile key)")
       })
     },
     async ({ key }) => runMcpToolHandler("skillwiki.config_get", {}, async () => {
@@ -9555,7 +8432,7 @@ function registerMcpTools(server) {
 }
 
 // src/mcp/mutating-tools.ts
-import { z as z3 } from "zod";
+import { z as z2 } from "zod";
 
 // src/mcp/mutation-gate.ts
 function mcpMutationsEnabled() {
@@ -9566,20 +8443,20 @@ var MCP_MUTATION_DISABLED_MESSAGE = "Mutating MCP tools are disabled. Set SKILLW
 
 // src/mcp/mutating-tools.ts
 var vaultFields2 = {
-  vault: z3.string().optional(),
-  wiki: z3.string().optional()
+  vault: z2.string().optional(),
+  wiki: z2.string().optional()
 };
 function registerMcpMutatingTools(server) {
   server.registerTool(
     "skillwiki.observe",
     {
       description: "Create a new raw/transcripts capture file (mutating). Requires SKILLWIKI_MCP_ALLOW_MUTATIONS=true.",
-      inputSchema: z3.object({
+      inputSchema: z2.object({
         ...vaultFields2,
-        text: z3.string().min(1).describe("Capture body text"),
-        kind: z3.enum(["note", "bug", "task", "idea", "session-log"]).optional(),
-        project: z3.string().optional().describe("Project slug for frontmatter"),
-        confirm_mutation: z3.literal(true).describe("Must be true to acknowledge vault write")
+        text: z2.string().min(1).describe("Capture body text"),
+        kind: z2.enum(["note", "bug", "task", "idea", "session-log"]).optional(),
+        project: z2.string().optional().describe("Project slug for frontmatter"),
+        confirm_mutation: z2.literal(true).describe("Must be true to acknowledge vault write")
       })
     },
     async (args) => runMcpToolHandler("skillwiki.observe", { vault: args.vault, wiki: args.wiki }, async () => {
@@ -9603,8 +8480,8 @@ function registerMcpMutatingTools(server) {
 }
 
 // src/mcp/resources.ts
-import { readFile as readFile23 } from "fs/promises";
-import { join as join34 } from "path";
+import { readFile as readFile19 } from "fs/promises";
+import { join as join31 } from "path";
 import { ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 
 // src/mcp/lint-bucket.ts
@@ -9732,9 +8609,9 @@ async function fetchQueryPreview(input) {
 }
 
 // src/mcp/graph-html.ts
-import { readFile as readFile22 } from "fs/promises";
-import { join as join33 } from "path";
-import { existsSync as existsSync16 } from "fs";
+import { readFile as readFile18 } from "fs/promises";
+import { join as join30 } from "path";
+import { existsSync as existsSync15 } from "fs";
 var TYPE_COLORS = {
   entities: "#e74c3c",
   concepts: "#27ae60",
@@ -9802,9 +8679,9 @@ ${nodeSvg}
   return { html, node_count: nodes.length, edge_count: edges.length, truncated };
 }
 async function fetchGraphHtmlReport(input) {
-  const graphPath = input.graphPath ?? join33(input.vault, ".skillwiki", "graph.json");
+  const graphPath = input.graphPath ?? join30(input.vault, ".skillwiki", "graph.json");
   const maxNodes = Math.min(Math.max(10, input.maxNodes ?? 120), 500);
-  if (!existsSync16(graphPath)) {
+  if (!existsSync15(graphPath)) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
       result: err("GRAPH_MISSING", { path: graphPath, hint: "Run skillwiki.graph_build first." })
@@ -9812,7 +8689,7 @@ async function fetchGraphHtmlReport(input) {
   }
   let raw;
   try {
-    raw = await readFile22(graphPath, "utf8");
+    raw = await readFile18(graphPath, "utf8");
   } catch (e) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
@@ -9876,7 +8753,7 @@ async function fetchStaleSummary(input) {
 
 // src/mcp/resources.ts
 async function readVaultFile(vault, rel) {
-  return readFile23(join34(vault, rel), "utf8");
+  return readFile19(join31(vault, rel), "utf8");
 }
 async function tailLines(text, lines) {
   const parts = text.split(/\r?\n/);
@@ -9962,9 +8839,9 @@ function registerMcpResources(server) {
       if (!v.ok) {
         return { contents: [{ uri: uri.href, mimeType: "text/plain", text: JSON.stringify(v) }] };
       }
-      const path = join34(v.data.vault, ".skillwiki", "graph.json");
+      const path = join31(v.data.vault, ".skillwiki", "graph.json");
       try {
-        const raw = await readFile23(path, "utf8");
+        const raw = await readFile19(path, "utf8");
         const graph = JSON.parse(raw);
         const adjacency = graph.adjacency ?? {};
         const nodes = Object.keys(adjacency);
@@ -10138,14 +9015,14 @@ function registerMcpResources(server) {
 }
 
 // src/mcp/prompts.ts
-import { z as z4 } from "zod";
+import { z as z3 } from "zod";
 function registerMcpPrompts(server) {
   server.registerPrompt(
     "skillwiki-research-query",
     {
       description: "Structured vault research using skillwiki.query and typed pages",
       argsSchema: {
-        topic: z4.string().describe("Research topic or question")
+        topic: z3.string().describe("Research topic or question")
       }
     },
     ({ topic }) => ({
@@ -10176,8 +9053,8 @@ function registerMcpPrompts(server) {
     {
       description: "Plan a project work item using vault project workspace conventions",
       argsSchema: {
-        slug: z4.string().describe("Project slug"),
-        idea: z4.string().describe("Work item idea or bug/feature summary")
+        slug: z3.string().describe("Project slug"),
+        idea: z3.string().describe("Work item idea or bug/feature summary")
       }
     },
     ({ slug, idea }) => ({
@@ -10205,7 +9082,7 @@ function registerMcpPrompts(server) {
     {
       description: "Review vault health via lint summary, doctor, and stale tools",
       argsSchema: {
-        vault: z4.string().optional().describe("Optional vault path")
+        vault: z3.string().optional().describe("Optional vault path")
       }
     },
     ({ vault }) => ({
@@ -10231,7 +9108,7 @@ function registerMcpPrompts(server) {
     {
       description: "Audit citation health using query + lint buckets",
       argsSchema: {
-        focus: z4.string().optional().describe("Page or topic focus")
+        focus: z3.string().optional().describe("Page or topic focus")
       }
     },
     ({ focus }) => ({
@@ -10274,20 +9151,9 @@ async function runSkillwikiMcpStdio() {
 }
 
 export {
-  ExitCode,
-  ok,
-  err,
-  RawSourceSchema,
-  MetaSchema,
-  isBlockedHost,
-  splitFrontmatter,
-  extractFrontmatter,
-  scanSensitiveContent,
-  redactSensitiveContent,
   readLastOp,
   appendLastOp,
   clearLastOp,
-  atomicWriteText,
   runLogAppend,
   renderIndexUpsert,
   upsertIndexEntry,
@@ -10298,16 +9164,8 @@ export {
   releaseLock,
   acquireOwnedSyncLock,
   releaseOwnedSyncLock,
-  assertTargetInsideVault,
-  prepareTypedPage,
   runValidate,
-  scanVault,
-  readPage,
   runGraphBuild,
-  profileKey,
-  parseDotenvText,
-  parseDotenvFile,
-  writeDotenv,
   resolveInitTimePath,
   resolveRuntimePath,
   runOrphans,
@@ -10317,9 +9175,12 @@ export {
   extractTaxonomy,
   taxonomyCommentForPage,
   reconcileTaxonomyDocument,
+  mergeTaxonomyConflict,
   runLinks,
   runTagAudit,
   runIndexCheck,
+  renderProjectIndex,
+  runProjectIndex,
   runStale,
   runPagesize,
   runLogRotate,
@@ -10343,13 +9204,6 @@ export {
   runConfigPath,
   buildDegradedReasons,
   probeRemoteHealth,
-  FLEET_REL_PATH,
-  runFleetValidate,
-  runFleetContext,
-  loadFleetManifestAndHost,
-  snapshotterAliasForLocalHost,
-  loadFleetManifest,
-  resolveFleetHostId,
   SATELLITE_STALE_MS,
   satelliteLatestRunPath,
   isFailedRunStatus,
@@ -10357,7 +9211,6 @@ export {
   evaluateSatelliteRunHealth,
   runDoctor,
   readCliPackageJson,
-  runProjectIndex,
   runObserve,
   runMemoryTopics,
   runMemoryIndex,