fix(wiki): plug slug/title leaks producing .md.md, timestamp-slugs, path-titles

[cdeust]

Context

Audit of the methodology wiki (7,883 pages) on 2026-05-12 surfaced systematic pollution:

Bug	Count	Example
.md.md double extension	58	adr/_general/2234-decision-001-zero-dependencies.md.md
Timestamp-as-slug ADRs	10	adr/_general/1828-decision-created-2026-04-15t09-29-10z.md
Embedded path in slug	11+	specs/2026/2026-04-17-also-on-users-cdeust-documents-developments-ai-architect-prd.md

All polluted pages were written 2026-04-21 — six days after v3.10.1 (commit 554f1ac, 2026-04-15) shipped the audit-artefact filter. These are live bugs, not historical pollution.

Root causes and fixes

1. .md.md (slugify preserves . ; six callers append .md)

Reproducer (before fix):

>>> from mcp_server.core.wiki_layout import slugify, adr_filename
>>> adr_filename(2234, slugify("001-zero-dependencies.md"))
'2234-001-zero-dependencies.md.md'

Six callsites all do f"{...}{slug}.md": adr_filename, domain_page_path, wiki_sync:91, draft_compiler:127, ingest_prd:205, ingest_codebase_pages:28. Single-point fix in slugify to strip a trailing chain of .md benefits all of them. Non-.md extensions (.py, .yaml, etc.) are preserved — file_path_slug callers still get login.py as before.

2. Timestamp-as-title (YAML metadata leaked through derive_title)

derive_title accepted any line len > 10 that didn't start with {/[. A YAML line like created: 2026-04-15T09:29:10Z passed that gate. New _YAML_KV_TITLE_PATTERNS reject (created|updated|date|timestamp|time|id|uuid|version): lines and bare ISO-8601 timestamps anywhere in the candidate line.

3. Path-embedded-mid-sentence titles

Existing _PATH_OR_URL_TITLE_PATTERNS only matched paths at line start (^\s*#*\s*[/~]). When content like "also on /Users/cdeust/Documents/..." became first_line, the path was mid-line so the regex didn't trigger; slugify then folded the entire path into the slug. Added two patterns matching /Users/, /home/, /root/, /opt/, /var/, /etc/, /tmp/ and Windows drive paths anywhere in the line.

4. derive_title fallback defeated the deterministic hash fallback

The function fell back to content[:80] when no clean line existed, leaking raw fragments. wiki_sync already had a memory-<hash> fallback but it was unreachable. Now derive_title returns "" when every candidate line is rejected; the caller routes to the hash. Extracted _line_is_title_candidate for a single source-of-truth predicate.

Files changed

• mcp_server/core/wiki_layout.py — strip trailing .md chain from slug; document the postcondition.
• mcp_server/core/wiki_classifier.py — extend path/URL filter, add YAML KV filter, extract _line_is_title_candidate, return "" on no-candidate.
• tests_py/core/test_wiki_layout.py — 4 new tests covering .md strip, multi-.md collapse, non-.md preservation, end-to-end adr_filename.
• tests_py/core/test_wiki_classifier.py — 6 new tests covering YAML-timestamp rejection, embedded-POSIX-path rejection, Windows path rejection, empty-on-no-candidate, bare ISO timestamp, positive control.

Test plan

• pytest tests_py/core/ — 1720 passed
• pytest tests_py/handlers/test_wiki_sync_errors.py tests_py/infrastructure/test_wiki_store.py — 20 passed
• After merge + plugin re-publish: re-audit wiki page count; verify zero .md.md, zero decision-created-* ADRs, zero users-cdeust slugs in newly-written pages

Scope of fix vs scope of cleanup

This PR prevents future pollution. The existing ~88 polluted pages must be purged separately (see follow-up: cleanup pass using wiki_purge once this lands).

🤖 Generated with Claude Code