wiki: update PST (deletion-report location) + add fast wiki-compile 'update' mode

- peaceful-spirit: record the standing 'Mara audit log' (daily PST Deletion Report task,
  SACL 4660/4663 on G:\Shares\Scanned) and its new output location under the legal/
  partner-review folder (moved 2026-07-02). Surgical update, no full recompile.
- wiki-compile: add an incremental UPDATE mode (now the no-flag default) that folds only
  session logs newer than last_compiled via targeted section edits — no Sonnet subagent,
  no full-article regeneration. --full is now the explicit REBUILD; --syncro is the
  instant Syncro-only refresh. Addresses the slow-rebuild complaint.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.claude/commands/wiki-compile.md

@@ -7,17 +7,29 @@ Seed new wiki articles or refresh existing ones from session logs, client docume
 ## Usage
 
 ```
-/wiki-compile client:<slug>          Seed or refresh a client wiki article
-/wiki-compile client:<slug> --full   Force full recompile of existing article (Sonnet synthesis)
+/wiki-compile client:<slug>          UPDATE an existing article (fast, incremental) or seed a new one
+/wiki-compile client:<slug> --full   REBUILD: full re-synthesis from ALL sources (Sonnet, slow)
+/wiki-compile client:<slug> --syncro Syncro dynamic fields only (hours/tickets) — instant, no LLM
 /wiki-compile project:<slug>         Compile a project wiki article (no Syncro)
 /wiki-compile system:<slug>          Compile a system wiki article (no Syncro)
 /wiki-compile all                    Process all missing + stale articles
 ```
 
 **Mode auto-detection:**
-- If `wiki/clients/<slug>.md` **does not exist** → **Seed mode** (full synthesis, Sonnet subagent)
-- If `wiki/clients/<slug>.md` **exists** and no `--full` flag → **Refresh mode** (surgical update of dynamic fields only, no subagent)
-- `--full` flag → **Full recompile** (Sonnet synthesis, preserves existing Patterns/History)
+- If `wiki/clients/<slug>.md` **does not exist** → **Seed mode** (full synthesis, Sonnet subagent).
+- If it **exists** and no flag → **Update mode** (fast, incremental — the default; see below).
+- `--full` → **Rebuild** (full Sonnet re-synthesis from ALL sources; preserves Patterns/History).
+- `--syncro` → **Syncro-only refresh** (dynamic fields only; instant, no LLM).
+
+**Update vs Rebuild — why update is fast (this is the point).** A **Rebuild** (`--full`) reads
+*every* session log for the client and regenerates the *entire* article with a Sonnet subagent —
+correct, but slow and expensive, and wasteful when only one thing changed. **Update** reads ONLY
+the session logs dated after the article's `last_compiled` (usually 1–3 files, often zero) plus the
+current article, and applies a few **surgical section edits** — new History rows, and targeted
+edits to any section a new log actually changes — leaving the rest of the article byte-for-byte
+untouched. Small input + small output + no full-article Sonnet pass = typically many times faster.
+Reach for `--full` only when the article structure has drifted, sections are stale/wrong, or you
+want a periodic clean rebuild. For "I just did some work, capture it," use plain update.
 
 ---
 
@@ -65,12 +77,21 @@ esac
 if [ ! -f "$CLAUDETOOLS_ROOT/$ARTICLE_PATH" ]; then
   MODE="seed"
 elif [ "$FULL_FLAG" = "--full" ]; then
-  MODE="full"
+  MODE="full"          # rebuild — full Sonnet re-synthesis
+elif [ "$FULL_FLAG" = "--syncro" ]; then
+  MODE="syncro"        # Syncro dynamic fields only
 else
-  MODE="refresh"
+  MODE="update"        # default: fast incremental knowledge merge
 fi
 
 echo "[INFO] Mode: $MODE | Target: $TARGET_TYPE:$SLUG"
+
+# For update mode, read the article's last_compiled so Phase 3 can select only newer logs.
+LAST_COMPILED=""
+if [ "$MODE" = "update" ]; then
+  LAST_COMPILED=$(sed -n 's/^last_compiled:[[:space:]]*//p' "$CLAUDETOOLS_ROOT/$ARTICLE_PATH" | head -1)
+  echo "[INFO] Update since last_compiled=${LAST_COMPILED:-unknown}"
+fi
 ```
 
 ---
@@ -244,6 +265,28 @@ SOURCE_COUNT=$(echo "$ALL_SOURCES" | grep -c '^' || echo 0)
 echo "[INFO] Found $SOURCE_COUNT source files"
 ```
 
+**Update mode — narrow to NEW sources only (this is the speedup).** In update mode, do NOT read
+the full source set. Select only the logs the article has not yet incorporated: a source is "new"
+if its filename date is **after** `LAST_COMPILED`, **or** it is not already listed in the article's
+frontmatter `sources:`. Read only those.
+
+```bash
+if [ "$MODE" = "update" ]; then
+  # existing sources already folded into the article
+  EXISTING_SRC=$(awk '/^sources:/{f=1;next} /^[^ -]/{f=0} f&&/^[[:space:]]*-/{sub(/^[[:space:]]*-[[:space:]]*/,"");print}' "$CLAUDETOOLS_ROOT/$ARTICLE_PATH")
+  NEW_SOURCES=$(echo "$ALL_SOURCES" | while read -r f; do
+    [ -z "$f" ] && continue
+    # (a) not yet in the article's sources list?
+    if ! grep -qxF "$f" <<<"$EXISTING_SRC"; then echo "$f"; continue; fi
+    # (b) filename carries a YYYY-MM-DD newer than last_compiled?
+    d=$(echo "$f" | grep -oE '[0-9]{4}-[0-9]{2}-[0-9]{2}' | head -1)
+    if [ -n "$d" ] && [ -n "$LAST_COMPILED" ] && [ "$d" \> "$LAST_COMPILED" ]; then echo "$f"; fi
+  done | sort -u | grep -v '^$')
+  NEW_COUNT=$(echo "$NEW_SOURCES" | grep -c '^' || echo 0)
+  echo "[INFO] Update: $NEW_COUNT new source(s) since ${LAST_COMPILED:-unknown}"
+fi
+```
+
 If `SOURCE_COUNT == 0` and no Syncro data: warn and stop.
 ```
 [ERROR] No session logs and no Syncro data found for '${SLUG}'. Cannot compile.
@@ -254,7 +297,40 @@ If `SOURCE_COUNT == 0` and no Syncro data: warn and stop.
 
 ## Phase 4 — Article Generation
 
-### Refresh Mode (existing article, no --full)
+### Update Mode (existing article, default) — fast incremental
+
+Fold only what changed since the last compile. **Do NOT re-synthesize the whole article and do
+NOT spawn a Sonnet subagent.** Two parts:
+
+**Part A — Syncro dynamic fields** (the three surgical edits documented under *Syncro-only Refresh*
+below): hours remaining, Active Work ticket list, and frontmatter (`last_compiled`, `compiled_by`).
+
+**Part B — Incremental knowledge merge** — run ONLY if `NEW_COUNT > 0` (new logs from Phase 3):
+1. Read the full text of the `NEW_SOURCES` logs **and the current article**. Do NOT read the full
+   historical log set — that is what makes this fast.
+2. Apply **targeted edits** for what those new logs actually establish:
+   - **Always:** add one dated row per material change to **History Highlights** (chronological).
+   - **Infrastructure** — add/adjust a row for any new or removed host, IP, service, or key path.
+   - **Access** — add any new vault path or access route (vault path only, never the secret).
+   - **Patterns & Known Issues** — add a genuinely new recurring issue, or mark an existing one
+     resolved if a new log shows it fixed.
+   - Touch **only** the sections a new log changes; leave every other byte of the article intact.
+3. The delta is small, so **the main agent applies these edits directly** (Edit tool), or delegates
+   only the prose wording to Ollama Tier-0 / `haiku` and reviews it. Follow the same Hard Rules
+   (Syncro authoritative for billing; never inline secrets; never invent vault paths).
+4. Append the `NEW_SOURCES` paths to frontmatter `sources:` (dedup).
+
+If `NEW_COUNT == 0`: there is nothing new to fold — Part A (Syncro refresh) is the whole update.
+
+Emit:
+```
+[OK] Update complete for wiki/clients/<slug>.md
+     - New logs folded: <NEW_COUNT> (since <LAST_COMPILED>)
+     - Sections touched: History[, Infrastructure, Access, Patterns] | none (Syncro-only)
+     - Syncro: hours <PREPAY_HOURS>, tickets <TICKET_COUNT>
+```
+
+### Syncro-only Refresh (`--syncro`) — instant, no LLM
 
 Perform surgical updates only. No Ollama call. Three edits:
 
@@ -298,7 +374,7 @@ After edits, emit:
      - Sources: ${SOURCE_COUNT} files tracked
 ```
 
-### Seed Mode / Full Recompile — Claude Synthesis (Sonnet subagent)
+### Seed Mode / Rebuild (`--full`) — Claude Synthesis (Sonnet subagent)
 
 Prepare the synthesis context by reading the most relevant source files. For session logs, read the full content of client-specific logs and the first 200 lines of root session logs (to avoid overwhelming the prompt). For full recompile, also read the existing article.
 
@@ -447,4 +523,7 @@ When invoked as `/wiki-compile all`:
 - **Never invent vault paths.** If a credential is not mentioned in session logs, write "(verify)" in the Access section.
 - **Never populate Infrastructure tables with placeholder rows.** Only include servers/services that appear in session logs or Syncro assets.
 - **Syncro contacts are ground truth for the Profile section.** Do not override with session log guesses if the contact name differs.
-- **Refresh mode never touches Patterns or History.** Those sections require human review or `--full`.
+- **Syncro-only refresh (`--syncro`) never touches Patterns or History.** It edits dynamic fields only.
+- **Update mode may ADD to History (always) and may add/adjust Infrastructure, Access, and Patterns**
+  strictly from the NEW logs — it never rewrites or removes existing prose. Wholesale re-synthesis
+  (rewriting existing sections, reconciling contradictions across the full history) is `--full` only.