Flat retirement: make the silo the only place a page lives

[yuanhao]

Completes the cluster tracked by #892 — #890 (Part B), #889 (Part A), #874 (revisions), #891 (Part C) — plus #905/#908, which turned out to be a prerequisite rather than a sibling.

Why 13+ agent attempts produced nothing

#892's B→A ordering has no green state. Part B stops the flat dual-write while Part A still reads flat, so in between, every page written is invisible to the read that follows it — 8 lifecycle tests fail at exactly that seam. An agent that lands B, runs the suite and sees failures correctly concludes it broke something and backs out. B and A are one change.

#905/#908 was a missing dependency, and had been closed twice without landing. syncPageIndexForPage still had if (idx === null) return. Silo-only reads derive a page's tenant from its index entry, so a page written before the first rebuild resolves to DEFAULT_TENANT and reads as missing.

What landed

piece	change
#905/#908	syncPageIndexForPage seeds the map instead of no-opping
#890 (+ #902/#903)	drops the 3 flat dual-write/delete blocks in lifecycle.ts and the flat scan in getOnDiskSlugs
#889	readWikiPage / wikiPageExists / writeWikiPage all route through one resolver, siloPathForSlug
#874	revision reads resolve the tenant internally — no caller changes
#891	reconcile's dead forward pass repurposed to repair misplaced pages

#874 without the caller churn. The issue plan threads tenant? through 5 functions and ~15 call sites across mcp.ts, the revisions route, trail.ts, contributors.ts and lifecycle.ts. Resolving the tenant inside revisions.ts — the same way reads resolve a page — gets the same result with zero caller changes.

#891 does more than delete dead code. The forward pass copied flat → silo and is now meaningless. Rather than drop it, it repairs the failure silo-only reads actually introduce: a page under a different tenant than its index entry names is unreachable, so reconcile finds it and moves it back. The reverse pass also now clears stale cross-tenant duplicates, which the ghost check kept forever.

One flat fallback kept, deliberately

Revision reads still fall back to the flat archive. The tenant migration only ever copied pages and raw sources — it never moved .revisions/, so every page edited before revisions became tenant-aware has its history there. Making those reads silo-only would have quietly erased the visible history of most of the wiki.

That is a data fallback, not the write-path fallback this epic removes, and it can go once a migration moves .revisions/ into the silos.

Four regressions the issues don't mention

Found by the suite, all pre-existing but masked by the dual-write:

1. Ownership changes lost revision history. An owner change moves a page between silos; the snapshot read the destination, found nothing, and silently dropped the history. Writes now snapshot from wherever the page actually is, and moveRevisions carries the archive across.
2. writeWikiPage without a tenant would relocate an owned page. Flat retirement Part A: Make wiki.ts silo-only (read/write/exists) #889's plan defaults to DEFAULT_TENANT, which turns an ordinary content edit into a move. An explicit tenant now asserts ownership and moves; an omitted one updates in place.
3. Delete derived its tenant from frontmatter while reads derive it from the index. When those disagree the delete misses and the page stays live.
4. migrateToTenants could no longer read the tree it migrates — it enumerated through readWikiPage. It now reads flat directly and seeds the page index from the tenants it just computed (owner lives inside the page, so a scan can't bootstrap itself after a move).

Verification

• 3531 tests pass (135 files); tsc --noEmit and eslint clean.
• Production data checked before merging — the one thing tests can't catch, since a misplaced page becomes unreachable rather than merely slow. Dumped _idx:pages from KV (123 pages: 46 yuanhao, 72 yuanhao--yoyo, 5 yopedia) and confirmed every one exists at the silo key its entry resolves to. 123/123 present, 0 misplaced.
• PR yoyo: Remove flat-directory fallback from getOnDiskSlugs in lint-checks.ts #903 cherry-picked rather than reimplemented — the agent's version was more complete than Flat retirement Part B: Remove dual-write/delete from lifecycle.ts and flat fallback from lint-checks.ts #890's plan, which claimed "only 2 tests need changes" but missed the page-index seeding lint.test.ts, maintenance.test.ts and mcp.test.ts needed.

Two test suites set WIKI_DIR but never DATA_DIR or _resetStorage(). Silo paths resolve against DATA_DIR, so their fixtures were escaping tmpDir and leaking across tests — that's why a re-ingest test was deduping onto a page a previous test created. Isolated both; page fixtures now go through __tests__/helpers/wiki-fixtures.ts.

Not done on purpose

The ~124 flat copies in R2 become orphans after this. They are the rollback net, so they should stay until the deploy is proven — then a separate cleanup can remove them. Deleting production files isn't part of this change.

Closes #889, #890, #891, #874, #892, #902, #906
Refs #905, #908

🤖 Generated with Claude Code