feat(wiki): port upstream knowledge quality improvements

Selectively port source coverage and redirect lint, ignore-aware provenance, staging and trust checks from upstream 055d720. Preserve local archive metadata and adapt source-date and defuddle skill guidance.

Keep the existing skills directory, file index and MCP interfaces. Record per-module upstream baselines and exclusions without migrating vault data or changing services.

Validation: 625 tests passed; git diff --check passed.

tests/test_lint.py

@@ -1065,3 +1065,127 @@ def test_lint_vault_warns_on_undated_counts_and_skips_dated_ones(tmp_path: Path)
     lines = page.read_text(encoding="utf-8").splitlines()
     assert all(lines[claim["line"] - 1].strip() == claim["text"] for claim in claims)
     assert report["status"] == "warn"
+
+
+def _write_ignored_archive(vault: Path) -> None:
+    """`_write_archive_and_manifest`, plus a second archive `.okignore` covers."""
+    _write_archive_and_manifest(vault)
+    hidden = vault / "_raw" / "_archived" / "private" / "hidden.md"
+    hidden.parent.mkdir(parents=True, exist_ok=True)
+    hidden.write_text("# clip\n", encoding="utf-8")
+    manifest = json.loads((vault / ".manifest.json").read_text(encoding="utf-8"))
+    manifest["sources"]["_raw/_archived/private/hidden.md"] = {"pages_produced": ["concepts/alpha.md"]}
+    (vault / ".manifest.json").write_text(json.dumps(manifest), encoding="utf-8")
+    (vault / ".okignore").write_text("_raw/_archived/private\n", encoding="utf-8")
+
+
+def test_snapshot_mismatch_does_not_name_an_ignored_archive(tmp_path: Path) -> None:
+    vault = tmp_path / "vault"
+    _clean_pair(vault)
+    _write_ignored_archive(vault)
+
+    rows = lint_vault(vault)["findings"]["snapshot_mismatch"]
+
+    assert [row["expected"] for row in rows] == [["_raw/_archived/a.md"]]
+
+
+def test_a_page_citing_an_ignored_archive_is_not_a_mismatch(tmp_path: Path) -> None:
+    vault = tmp_path / "vault"
+    _clean_pair(vault, alpha_snapshots="[_raw/_archived/a.md, _raw/_archived/private/hidden.md]")
+    _write_ignored_archive(vault)
+
+    assert lint_vault(vault)["findings"]["snapshot_mismatch"] == []
+
+
+def test_uncovered_sources_reports_sources_with_no_surviving_page(tmp_path: Path) -> None:
+    vault = tmp_path / "vault"
+    _clean_pair(vault)
+    (vault / ".manifest.json").write_text(
+        json.dumps(
+            {
+                "sources": [
+                    {"path": "docs/kept.md", "pages_produced": ["concepts/alpha.md"]},
+                    {"path": "docs/partly.md", "pages_produced": ["concepts/beta", "concepts/gone.md"]},
+                    {"path": "docs/empty.md", "pages_produced": []},
+                    {"path": "docs/lost.md", "pages_created": ["concepts/gone.md"]},
+                    {"path": "docs/counts-only.md", "pages_created": 3},
+                ]
+            }
+        ),
+        encoding="utf-8",
+    )
+
+    report = lint_vault(vault)
+
+    assert report["findings"]["uncovered_sources"] == [
+        {"source": "docs/empty.md", "issue": "no_pages", "missing": []},
+        {"source": "docs/lost.md", "issue": "pages_missing", "missing": ["concepts/gone.md"]},
+    ]
+    assert report["status"] == "warn"
+
+
+def _redirect_stub(vault: Path, relpath: str, target: str, *, title: str | None = None) -> Path:
+    """A wiki-dedup merge leftover: same title/stem as the canonical page,
+    with a `redirects_to:` pointer in its frontmatter."""
+    path = _page(vault, relpath, title=title)
+    text = path.read_text(encoding="utf-8")
+    path.write_text(
+        text.replace("\n---\n", f'\nredirects_to: "[[{target}]]"\n---\n', 1),
+        encoding="utf-8",
+    )
+    return path
+
+
+def test_lint_redirect_stub_is_not_a_duplicate(tmp_path: Path) -> None:
+    vault = tmp_path / "vault"
+    _page(vault, "concepts/example.md", title="Example")
+    _redirect_stub(vault, "entities/example.md", "concepts/example", title="Example")
+
+    report = lint_vault(vault, require_trust_ledger=False)
+
+    assert report["findings"]["duplicate_titles"] == []
+    assert report["findings"]["duplicate_stems"] == []
+    assert report["findings"]["redirect_issues"] == []
+
+
+def test_lint_redirect_stub_with_missing_target_is_reported(tmp_path: Path) -> None:
+    vault = tmp_path / "vault"
+    _page(vault, "concepts/example.md", title="Example")
+    _redirect_stub(vault, "entities/example.md", "concepts/gone", title="Example")
+
+    report = lint_vault(vault, require_trust_ledger=False)
+
+    assert report["findings"]["redirect_issues"] == [
+        {"page": "entities/example.md", "target": "concepts/gone", "issue": "missing_target"}
+    ]
+    # A broken stub still stays out of the duplicate checks.
+    assert report["findings"]["duplicate_titles"] == []
+    assert report["findings"]["duplicate_stems"] == []
+
+
+def test_lint_redirect_chain_is_reported(tmp_path: Path) -> None:
+    vault = tmp_path / "vault"
+    _page(vault, "concepts/example.md", title="Example")
+    _redirect_stub(vault, "entities/example.md", "concepts/example", title="Example")
+    _redirect_stub(vault, "references/example.md", "entities/example", title="Example")
+
+    report = lint_vault(vault, require_trust_ledger=False)
+
+    assert report["findings"]["redirect_issues"] == [
+        {"page": "references/example.md", "target": "entities/example", "issue": "redirect_chain"}
+    ]
+
+
+def test_lint_two_real_pages_with_same_title_still_duplicate(tmp_path: Path) -> None:
+    vault = tmp_path / "vault"
+    _page(vault, "concepts/example.md", title="Example")
+    _page(vault, "entities/example.md", title="Example")
+
+    report = lint_vault(vault, require_trust_ledger=False)
+
+    assert report["findings"]["duplicate_titles"] == [
+        {"title": "example", "pages": ["concepts/example.md", "entities/example.md"]}
+    ]
+    assert report["findings"]["duplicate_stems"] == [
+        {"stem": "example", "pages": ["concepts/example.md", "entities/example.md"]}
+    ]