hypomnema 1.0.1 → 1.2.0

package/scripts/feedback.mjs

@@ -2,35 +2,100 @@
 /**
  * Hypomnema feedback script
  *
- * Creates or appends to pages/feedback/<topic>.md with a feedback entry.
- * Also appends a log entry to log.md.
+ * Creates or appends to pages/feedback/<topic>.md with a behaviour-correction
+ * entry. The wiki feedback page is the single source of truth (ADR 0031 / fix
+ * #37); MEMORY.md and CLAUDE.md <learned_behaviors> are one-way *projections*
+ * derived from it. Never hand-edit those targets — this script writes the page
+ * and then runs `feedback-sync --write` to refresh the projection automatically.
+ *
  * Used by /hypo:feedback after Claude drafts the feedback content.
  *
  * Usage:
- *   node scripts/feedback.mjs --topic=<slug> --entry=<text> [options]
+ *   node scripts/feedback.mjs --topic=<slug> --entry=<text> [classification flags]
+ *
+ * Page write:
+ *   --topic=<slug>          Feedback topic slug (e.g. "response-length")
+ *   --entry=<text>          Rule body (one-line rule or short paragraph)
+ *   --title=<text>          Frontmatter title (default: topic)
+ *
+ * Classification (lint #8 schema — required on create):
+ *   --scope=<v>             global | project:<slug>           (required)
+ *   --tier=<v>              L1 | L2                            (required)
+ *   --targets=<list>        comma list of project-memory,claude-learned (default: project-memory)
+ *   --sensitivity=<v>       public | sanitized                (default: public)
+ *   --priority=<1-5>        projection sort weight             (default: 3)
+ *   --memory-summary=<t>    one-line MEMORY.md index summary   (required)
+ *   --reason=<t>            why this rule exists               (required)
+ *   --source=<t>            provenance (default: session:<today>)
+ *   --behavior=<t>          optional: the behaviour being corrected
+ *
+ * Required only when --targets includes claude-learned:
+ *   --global-summary=<t>    one-line CLAUDE.md learned-behaviour summary
+ *   --promote-to-global     mark the page for global CLAUDE.md projection
  *
- * Options:
- *   --hypo-dir=<path>   Hypomnema root (default: resolved via HYPO_DIR / hypo-config.md / ~/hypomnema)
- *   --topic=<slug>      Feedback topic slug (e.g. "response-length", "code-style")
- *   --entry=<text>      Feedback entry text (one-line rule or short paragraph)
- *   --dry-run           Preview without writing
- *   --list              List existing feedback topics
+ * Modes:
+ *   --hypo-dir=<path>       Hypomnema root (default: HYPO_DIR / hypo-config.md / ~/hypomnema)
+ *   --claude-home=<path>    Projection target home for the post-step (default: ~/.claude)
+ *   --project-id=<id>       Projection MEMORY project-id for the post-step (default: derived from cwd)
+ *   --no-sync               Skip the automatic `feedback-sync --write` post-step
+ *   --dry-run               Preview without writing (also skips projection)
+ *   --list                  List existing feedback topics
  */
 
 import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync } from 'fs';
-import { join, resolve, sep } from 'path';
+import { join } from 'path';
+import { spawnSync } from 'child_process';
+import { fileURLToPath } from 'url';
 import { resolveHypoRoot, expandHome } from './lib/hypo-root.mjs';
 
+const SCRIPT_DIR = fileURLToPath(new URL('.', import.meta.url));
+
 // ── arg parsing ──────────────────────────────────────────────────────────────
 
 function parseArgs(argv) {
-  const args = { hypoDir: null, topic: null, entry: null, dryRun: false, list: false };
+  const args = {
+    hypoDir: null,
+    topic: null,
+    entry: null,
+    title: null,
+    scope: null,
+    tier: null,
+    targets: null,
+    sensitivity: 'public',
+    priority: '3',
+    memorySummary: null,
+    globalSummary: null,
+    promoteToGlobal: false,
+    reason: null,
+    source: null,
+    behavior: null,
+    claudeHome: null,
+    projectId: null,
+    noSync: false,
+    dryRun: false,
+    list: false,
+  };
   for (const arg of argv.slice(2)) {
     if (arg.startsWith('--hypo-dir=')) args.hypoDir = expandHome(arg.slice(11));
-    else if (arg.startsWith('--topic='))   args.topic  = arg.slice(8);
-    else if (arg.startsWith('--entry='))   args.entry  = arg.slice(8);
-    else if (arg === '--dry-run')          args.dryRun = true;
-    else if (arg === '--list')             args.list   = true;
+    else if (arg.startsWith('--topic=')) args.topic = arg.slice(8);
+    else if (arg.startsWith('--entry=')) args.entry = arg.slice(8);
+    else if (arg.startsWith('--title=')) args.title = arg.slice(8);
+    else if (arg.startsWith('--scope=')) args.scope = arg.slice(8);
+    else if (arg.startsWith('--tier=')) args.tier = arg.slice(7);
+    else if (arg.startsWith('--targets=')) args.targets = arg.slice(10);
+    else if (arg.startsWith('--sensitivity=')) args.sensitivity = arg.slice(14);
+    else if (arg.startsWith('--priority=')) args.priority = arg.slice(11);
+    else if (arg.startsWith('--memory-summary=')) args.memorySummary = arg.slice(17);
+    else if (arg.startsWith('--global-summary=')) args.globalSummary = arg.slice(17);
+    else if (arg === '--promote-to-global') args.promoteToGlobal = true;
+    else if (arg.startsWith('--reason=')) args.reason = arg.slice(9);
+    else if (arg.startsWith('--source=')) args.source = arg.slice(9);
+    else if (arg.startsWith('--behavior=')) args.behavior = arg.slice(11);
+    else if (arg.startsWith('--claude-home=')) args.claudeHome = expandHome(arg.slice(14));
+    else if (arg.startsWith('--project-id=')) args.projectId = arg.slice(13);
+    else if (arg === '--no-sync') args.noSync = true;
+    else if (arg === '--dry-run') args.dryRun = true;
+    else if (arg === '--list') args.list = true;
   }
   if (!args.hypoDir) args.hypoDir = resolveHypoRoot();
   return args;
@@ -44,7 +109,7 @@ function listTopics(hypoDir) {
     console.log('No feedback pages found.');
     return;
   }
-  const files = readdirSync(feedbackDir).filter(f => f.endsWith('.md'));
+  const files = readdirSync(feedbackDir).filter((f) => f.endsWith('.md'));
   if (files.length === 0) {
     console.log('No feedback pages found.');
     return;
@@ -53,54 +118,195 @@ function listTopics(hypoDir) {
   for (const f of files) console.log(`  ${f.replace(/\.md$/, '')}`);
 }
 
-// ── write feedback entry ──────────────────────────────────────────────────────
+// ── classification validation (mirrors lint #8 / ADR 0031 §6) ──────────────────
 
-function writeFeedback(hypoDir, topic, entry, dryRun) {
-  const feedbackDir = join(hypoDir, 'pages', 'feedback');
-  const filePath    = join(feedbackDir, `${topic}.md`);
-  const today       = new Date().toISOString().slice(0, 10);
+const SCOPE_RE = /^(global|project:[a-z0-9][a-z0-9-]*)$/;
+const TIER_ENUM = ['L1', 'L2'];
+const SENSITIVITY_ENUM = ['public', 'sanitized']; // private is forbidden (wiki is git-public)
+const TARGET_ENUM = ['project-memory', 'claude-learned'];
 
-  let content;
+function parseTargets(raw) {
+  return String(raw || '')
+    .split(',')
+    .map((t) => t.trim())
+    .filter(Boolean);
+}
 
-  if (existsSync(filePath)) {
-    content = readFileSync(filePath, 'utf-8');
-    const newEntry = `\n## ${today}\n\n${entry}\n`;
-    content = content.trimEnd() + '\n' + newEntry;
-  } else {
-    content = `---
-title: "Feedback: ${topic}"
-type: feedback
-updated: ${today}
-tags: [feedback]
----
+// Validate the create-mode classification. Returns an array of error strings.
+function validateClassification(args, targets) {
+  const errs = [];
+  if (!args.scope) errs.push('--scope is required (global | project:<slug>)');
+  else if (!SCOPE_RE.test(args.scope)) errs.push(`--scope invalid: "${args.scope}"`);
+  if (!args.tier) errs.push('--tier is required (L1 | L2)');
+  else if (!TIER_ENUM.includes(args.tier)) errs.push(`--tier invalid: "${args.tier}"`);
+  if (!SENSITIVITY_ENUM.includes(args.sensitivity))
+    errs.push(
+      `--sensitivity invalid: "${args.sensitivity}" (public | sanitized; private is forbidden)`,
+    );
+  if (!targets.length) errs.push('--targets is required (project-memory[,claude-learned])');
+  for (const t of targets)
+    if (!TARGET_ENUM.includes(t)) errs.push(`--targets invalid member: "${t}"`);
+  const pri = Number(args.priority);
+  if (!Number.isInteger(pri) || pri < 1 || pri > 5)
+    errs.push(`--priority must be an integer 1-5 (got "${args.priority}")`);
+  if (!args.memorySummary) errs.push('--memory-summary is required');
+  if (!args.reason) errs.push('--reason is required');
+
+  // CLAUDE.md projection candidates must be global + L1 (ADR 0031 §6 filter), and
+  // carry the two conditional fields (lint #8). Enforce here so we never write a
+  // claude-learned page that lint rejects or that silently never projects.
+  if (targets.includes('claude-learned')) {
+    if (!args.globalSummary)
+      errs.push('--global-summary is required when --targets includes claude-learned');
+    if (!args.promoteToGlobal)
+      errs.push('--promote-to-global is required when --targets includes claude-learned');
+    if (args.scope !== 'global')
+      errs.push('claude-learned projection requires --scope=global (ADR 0031 §6)');
+    if (args.tier !== 'L1') errs.push('claude-learned projection requires --tier=L1 (ADR 0031 §6)');
+  }
+  return errs;
+}
 
-# Feedback: ${topic}
+// ── frontmatter rendering ──────────────────────────────────────────────────────
 
-## ${today}
+// Frontmatter scalars are written one-per-line as `key: value`. A raw newline in
+// a value would inject a forged frontmatter key (e.g. a `reason` containing
+// "\nstatus: archived"), silently overriding classification AFTER validation.
+// These fields are one-liners by contract, so collapse any whitespace run
+// (including newlines / control chars) to a single space and trim.
+function oneLine(v) {
+  return String(v ?? '')
+    .replace(/\s+/g, ' ')
+    .trim();
+}
 
-${entry}
-`;
+function renderPage(args, targets, today) {
+  const title = oneLine(args.title || args.topic);
+  const lines = [
+    '---',
+    `title: ${title}`,
+    'tags: [feedback]',
+    'type: feedback',
+    'status: active',
+    `scope: ${args.scope}`,
+    `tier: ${args.tier}`,
+    `targets: [${targets.join(', ')}]`,
+    `sensitivity: ${args.sensitivity}`,
+    `priority: ${Number(args.priority)}`,
+    `memory_summary: ${oneLine(args.memorySummary)}`,
+  ];
+  if (targets.includes('claude-learned')) {
+    lines.push(`global_summary: ${oneLine(args.globalSummary)}`);
+    lines.push(`promote_to_global: ${args.promoteToGlobal}`);
   }
+  lines.push(`reason: ${oneLine(args.reason)}`);
+  lines.push(`source: ${oneLine(args.source || `session:${today}`)}`);
+  lines.push(`corrected_at: ${today}`);
+  lines.push(`updated: ${today}`);
+  lines.push(`created: ${today}`);
+  if (args.behavior) lines.push(`behavior: ${oneLine(args.behavior)}`);
+  lines.push('---');
+  lines.push('');
+  lines.push(`# ${title}`);
+  lines.push('');
+  lines.push('## 규칙');
+  lines.push('');
+  lines.push(args.entry);
+  lines.push('');
+  return lines.join('\n');
+}
+
+// ── write feedback page ─────────────────────────────────────────────────────────
 
-  if (dryRun) {
+// Append-mode `updated:` bump: appending a dated entry to an existing page makes
+// it the freshest correction, so it should sort first. Rewrite the `updated:`
+// line ONLY inside the leading frontmatter block (between the first pair of
+// `---` fences). A naive multiline replace would also rewrite any body line that
+// happens to start with "updated:" (codex review) — so we scope to the fence.
+function bumpUpdated(content, today) {
+  const m = content.match(/^---\n([\s\S]*?)\n---/);
+  if (!m) return content; // no frontmatter → nothing to bump
+  const fm = m[1];
+  const bumped = /^updated:\s*/m.test(fm)
+    ? fm.replace(/^(updated:\s*).*$/m, `$1${today}`)
+    : `${fm}\nupdated: ${today}`;
+  return content.replace(m[0], `---\n${bumped}\n---`);
+}
+
+function writeFeedback(args, today) {
+  const feedbackDir = join(args.hypoDir, 'pages', 'feedback');
+  const filePath = join(feedbackDir, `${args.topic}.md`);
+  const targets = parseTargets(args.targets || 'project-memory');
+
+  let content;
+  let mode;
+  if (existsSync(filePath)) {
+    // Append a dated entry; preserve existing frontmatter classification.
+    mode = 'append';
+    const existing = readFileSync(filePath, 'utf-8');
+    const appended = existing.trimEnd() + `\n\n## ${today}\n\n${args.entry}\n`;
+    content = bumpUpdated(appended, today);
+  } else {
+    mode = 'create';
+    const errs = validateClassification(args, targets);
+    if (errs.length) {
+      console.error('Error: feedback classification incomplete:');
+      for (const e of errs) console.error(`  - ${e}`);
+      process.exit(1);
+    }
+    content = renderPage(args, targets, today);
+  }
+
+  if (args.dryRun) {
     console.log('[DRY RUN — no changes made]\n');
-    console.log(`Would write to: ${filePath}\n`);
+    console.log(`Would ${mode}: ${filePath}\n`);
     console.log(content);
-    return;
+    return { wrote: false };
   }
 
   if (!existsSync(feedbackDir)) mkdirSync(feedbackDir, { recursive: true });
   writeFileSync(filePath, content);
-  console.log(`✓ Written: ${filePath}`);
+  console.log(`✓ ${mode === 'create' ? 'Created' : 'Updated'}: ${filePath}`);
 
   // append to log.md
-  const logPath = join(hypoDir, 'log.md');
-  const logEntry = `\n- ${today} feedback: [[pages/feedback/${topic}]] — ${entry.split('\n')[0].slice(0, 80)}\n`;
+  const logPath = join(args.hypoDir, 'log.md');
+  const logEntry = `\n- ${today} feedback: [[pages/feedback/${args.topic}]] — ${args.entry
+    .split('\n')[0]
+    .slice(0, 80)}\n`;
   if (existsSync(logPath)) {
     const log = readFileSync(logPath, 'utf-8');
     writeFileSync(logPath, log.trimEnd() + logEntry);
     console.log(`↪ Appended to log.md`);
   }
+  return { wrote: true };
+}
+
+// ── projection post-step (ADR 0031) ────────────────────────────────────────────
+
+// Refresh the MEMORY.md / CLAUDE.md projection from the just-written page. This
+// is best-effort and NON-blocking: a projection failure (over-cap, conflict,
+// unresolved project-id) must not fail the page write — the SoT is already
+// saved. We surface a one-line stderr warning and let the user reconcile.
+function runProjection(args) {
+  const cli = join(SCRIPT_DIR, 'feedback-sync.mjs');
+  if (!existsSync(cli)) return;
+  // Forward --claude-home / --project-id when given so the projection targets a
+  // caller-controlled location (tests, CI) instead of always defaulting to the
+  // real ~/.claude. Omitted → feedback-sync's own defaults (the production path:
+  // ~/.claude + project-id derived from cwd).
+  const cliArgs = [cli, '--write', '--no-input', `--hypo-dir=${args.hypoDir}`];
+  if (args.claudeHome) cliArgs.push(`--claude-home=${args.claudeHome}`);
+  if (args.projectId) cliArgs.push(`--project-id=${args.projectId}`);
+  const r = spawnSync(process.execPath, cliArgs, { encoding: 'utf-8' });
+  if (r.status === 0) {
+    console.log('↪ Projection refreshed (MEMORY.md / CLAUDE.md learned-behaviors)');
+    return;
+  }
+  const detail = (r.stderr || '').trim().split('\n').slice(-1)[0] || `exit ${r.status}`;
+  console.error(
+    `⚠ feedback-sync --write did not complete cleanly (${detail}). ` +
+      `The page is saved; run \`hypomnema feedback-sync --check\` to reconcile the projection.`,
+  );
 }
 
 // ── main ─────────────────────────────────────────────────────────────────────
@@ -127,4 +333,7 @@ if (!args.entry) {
   process.exit(1);
 }
 
-writeFeedback(args.hypoDir, args.topic, args.entry, args.dryRun);
+const today = new Date().toISOString().slice(0, 10);
+const { wrote } = writeFeedback(args, today);
+
+if (wrote && !args.noSync) runProjection(args);

package/scripts/graph.mjs

@@ -24,8 +24,8 @@ import { loadHypoIgnore, isIgnored } from './lib/hypo-ignore.mjs';
 function parseArgs(argv) {
   const args = { hypoDir: null, format: 'json', minEdges: 0 };
   for (const arg of argv.slice(2)) {
-    if (arg.startsWith('--hypo-dir='))  args.hypoDir  = expandHome(arg.slice(11));
-    else if (arg.startsWith('--format='))   args.format   = arg.slice(9);
+    if (arg.startsWith('--hypo-dir=')) args.hypoDir = expandHome(arg.slice(11));
+    else if (arg.startsWith('--format=')) args.format = arg.slice(9);
     else if (arg.startsWith('--min-edges=')) args.minEdges = parseInt(arg.slice(12), 10) || 0;
   }
   if (!args.hypoDir) args.hypoDir = resolveHypoRoot();
@@ -75,7 +75,7 @@ function extractWikilinks(content) {
 
 function buildGraph(pages, slugIndex) {
   const edges = [];
-  const inDegree  = new Map();
+  const inDegree = new Map();
   const outDegree = new Map();
 
   for (const p of pages) {
@@ -85,7 +85,11 @@ function buildGraph(pages, slugIndex) {
 
   for (const p of pages) {
     let content;
-    try { content = readFileSync(p.path, 'utf-8'); } catch { continue; }
+    try {
+      content = readFileSync(p.path, 'utf-8');
+    } catch {
+      continue;
+    }
     for (const link of extractWikilinks(content)) {
       const target = slugIndex.get(link);
       if (target && target !== p.slug) {
@@ -101,24 +105,28 @@ function buildGraph(pages, slugIndex) {
 
 // ── label escapers ────────────────────────────────────────────────────────────
 
-function escapeMermaid(s) { return s.replace(/"/g, '#quot;'); }
-function escapeDot(s)     { return s.replace(/\\/g, '\\\\').replace(/"/g, '\\"'); }
+function escapeMermaid(s) {
+  return s.replace(/"/g, '#quot;');
+}
+function escapeDot(s) {
+  return s.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+}
 
 // ── formatters ────────────────────────────────────────────────────────────────
 
 function formatJson(pages, graph, minEdges) {
   const nodes = pages
-    .map(p => ({
+    .map((p) => ({
       slug: p.slug,
       in: graph.inDegree.get(p.slug) || 0,
       out: graph.outDegree.get(p.slug) || 0,
     }))
-    .filter(n => minEdges === 0 || n.in + n.out >= minEdges)
-    .sort((a, b) => (b.in + b.out) - (a.in + a.out));
+    .filter((n) => minEdges === 0 || n.in + n.out >= minEdges)
+    .sort((a, b) => b.in + b.out - (a.in + a.out));
 
-  const edges = graph.edges.filter(e => {
-    const fn = nodes.find(n => n.slug === e.from);
-    const tn = nodes.find(n => n.slug === e.to);
+  const edges = graph.edges.filter((e) => {
+    const fn = nodes.find((n) => n.slug === e.from);
+    const tn = nodes.find((n) => n.slug === e.to);
     return fn && tn;
   });
 
@@ -128,11 +136,11 @@ function formatJson(pages, graph, minEdges) {
 function formatMermaid(pages, graph, minEdges) {
   const activeNodes = new Set(
     pages
-      .filter(p => {
+      .filter((p) => {
         const total = (graph.inDegree.get(p.slug) || 0) + (graph.outDegree.get(p.slug) || 0);
         return total >= minEdges;
       })
-      .map(p => p.slug)
+      .map((p) => p.slug),
   );
 
   const lines = ['graph TD'];
@@ -149,11 +157,11 @@ function formatMermaid(pages, graph, minEdges) {
 function formatDot(pages, graph, minEdges) {
   const activeNodes = new Set(
     pages
-      .filter(p => {
+      .filter((p) => {
         const total = (graph.inDegree.get(p.slug) || 0) + (graph.outDegree.get(p.slug) || 0);
         return total >= minEdges;
       })
-      .map(p => p.slug)
+      .map((p) => p.slug),
   );
 
   const lines = ['digraph wiki {', '  rankdir=LR;'];
@@ -171,13 +179,18 @@ function formatDot(pages, graph, minEdges) {
 const args = parseArgs(process.argv);
 
 const ignorePatterns = loadHypoIgnore(args.hypoDir);
-const scanDirs = ['pages', 'projects'].map(d => join(args.hypoDir, d));
-const pages    = scanDirs.flatMap(d => collectPages(d, args.hypoDir, [], ignorePatterns));
+const scanDirs = ['pages', 'projects'].map((d) => join(args.hypoDir, d));
+const pages = scanDirs.flatMap((d) => collectPages(d, args.hypoDir, [], ignorePatterns));
 const slugIndex = buildSlugIndex(pages);
-const graph    = buildGraph(pages, slugIndex);
+const graph = buildGraph(pages, slugIndex);
 
 switch (args.format) {
-  case 'mermaid': console.log(formatMermaid(pages, graph, args.minEdges)); break;
-  case 'dot':     console.log(formatDot(pages, graph, args.minEdges)); break;
-  default:        console.log(formatJson(pages, graph, args.minEdges));
+  case 'mermaid':
+    console.log(formatMermaid(pages, graph, args.minEdges));
+    break;
+  case 'dot':
+    console.log(formatDot(pages, graph, args.minEdges));
+    break;
+  default:
+    console.log(formatJson(pages, graph, args.minEdges));
 }

package/scripts/ingest.mjs

@@ -16,25 +16,56 @@
  * Options:
  *   --hypo-dir=<path>   Hypomnema root (default: resolved via HYPO_DIR / hypo-config.md / ~/hypomnema)
  *   --json              Output as JSON
+ *   --check=<path>      Privacy guard: exit 1 if <path> matches a `.hypoignore`
+ *                       pattern, exit 0 silently otherwise. Used by `/hypo:ingest`
+ *                       to refuse ingesting secrets before they reach `sources/`.
  */
 
-import { existsSync, readFileSync, readdirSync, statSync } from 'fs';
-import { join, extname, basename } from 'path';
+import { existsSync, readFileSync, readdirSync, statSync, realpathSync } from 'fs';
+import { join, extname, basename, isAbsolute } from 'path';
 import { resolveHypoRoot, expandHome } from './lib/hypo-root.mjs';
 import { loadHypoIgnore, isIgnored } from './lib/hypo-ignore.mjs';
 
 // ── arg parsing ──────────────────────────────────────────────────────────────
 
 function parseArgs(argv) {
-  const args = { hypoDir: null, json: false };
+  const args = { hypoDir: null, json: false, check: null };
   for (const arg of argv.slice(2)) {
     if (arg.startsWith('--hypo-dir=')) args.hypoDir = expandHome(arg.slice(11));
-    else if (arg === '--json')         args.json = true;
+    else if (arg === '--json') args.json = true;
+    else if (arg.startsWith('--check=')) args.check = expandHome(arg.slice(8));
   }
   if (!args.hypoDir) args.hypoDir = resolveHypoRoot();
   return args;
 }
 
+// Find the first `.hypoignore` pattern that matches `target`, or null.
+// `target` is resolved relative to `hypoDir` when not already absolute, so
+// both wiki-relative destinations (`sources/<slug>.md`) and user-supplied
+// input paths land inside the wiki tree for anchored-pattern matching.
+//
+// A symlink with an innocuous name (`note.md` → `.env`) must still be
+// refused, so an existing target is also checked by its realpath. realpath
+// throws ENOENT for a not-yet-created destination — fall back to the lexical
+// path in that case. Both the lexical and resolved paths are tested, for
+// defense-in-depth when only one of them matches a pattern.
+function matchingIgnorePattern(target, hypoDir, patterns) {
+  const lexical = isAbsolute(target) ? target : join(hypoDir, target);
+  let resolved = lexical;
+  try {
+    resolved = realpathSync(lexical);
+  } catch {
+    /* not on disk — lexical only */
+  }
+  const candidates = resolved === lexical ? [lexical] : [lexical, resolved];
+  for (const pattern of patterns) {
+    for (const candidate of candidates) {
+      if (isIgnored(candidate, hypoDir, [pattern])) return pattern;
+    }
+  }
+  return null;
+}
+
 // ── helpers ──────────────────────────────────────────────────────────────────
 
 function collectMdFiles(dir, acc = [], hypoDir = '', ignorePatterns = []) {
@@ -57,7 +88,10 @@ function parseFrontmatter(content) {
   for (const line of m[1].split('\n')) {
     const idx = line.indexOf(':');
     if (idx < 0) continue;
-    fm[line.slice(0, idx).trim()] = line.slice(idx + 1).trim().replace(/^["']|["']$/g, '');
+    fm[line.slice(0, idx).trim()] = line
+      .slice(idx + 1)
+      .trim()
+      .replace(/^["']|["']$/g, '');
   }
   return fm;
 }
@@ -67,9 +101,30 @@ function parseFrontmatter(content) {
 const args = parseArgs(process.argv);
 
 const ignorePatterns = loadHypoIgnore(args.hypoDir);
+
+// ── --check guard ────────────────────────────────────────────────────────────
+// Privacy boundary (spec §6.8 / §8.10): refuse to ingest a path that matches
+// `.hypoignore` before it ever reaches `sources/`. Separate from the
+// listing-mode filter below — this is the explicit-reject path.
+if (args.check) {
+  const matched = matchingIgnorePattern(args.check, args.hypoDir, ignorePatterns);
+  if (matched) {
+    console.error(
+      `Refused: '${args.check}' matches .hypoignore pattern '${matched}' — not ingesting.`,
+    );
+    process.exit(1);
+  }
+  process.exit(0);
+}
+
 const sourcesDir = join(args.hypoDir, 'sources');
 const allSources = existsSync(sourcesDir)
-  ? readdirSync(sourcesDir).filter(e => !e.startsWith('.') && !statSync(join(sourcesDir, e)).isDirectory() && !isIgnored(join(sourcesDir, e), args.hypoDir, ignorePatterns))
+  ? readdirSync(sourcesDir).filter(
+      (e) =>
+        !e.startsWith('.') &&
+        !statSync(join(sourcesDir, e)).isDirectory() &&
+        !isIgnored(join(sourcesDir, e), args.hypoDir, ignorePatterns),
+    )
   : [];
 
 // collect all source: references in wiki pages
@@ -78,7 +133,11 @@ const referencedSources = new Set();
 
 for (const f of pageFiles) {
   let content;
-  try { content = readFileSync(f, 'utf-8'); } catch { continue; }
+  try {
+    content = readFileSync(f, 'utf-8');
+  } catch {
+    continue;
+  }
   const fm = parseFrontmatter(content);
   if (fm.source && !fm.source.startsWith('session:')) {
     referencedSources.add(fm.source);
@@ -86,7 +145,7 @@ for (const f of pageFiles) {
 }
 
 // sources with no summary page
-const orphaned = allSources.filter(s => {
+const orphaned = allSources.filter((s) => {
   const slug = basename(s, extname(s));
   return !referencedSources.has(s) && !referencedSources.has(slug);
 });
@@ -95,24 +154,38 @@ const orphaned = allSources.filter(s => {
 const missingSource = [];
 for (const f of pageFiles) {
   let content;
-  try { content = readFileSync(f, 'utf-8'); } catch { continue; }
+  try {
+    content = readFileSync(f, 'utf-8');
+  } catch {
+    continue;
+  }
   const fm = parseFrontmatter(content);
   if (!fm.source || fm.source.startsWith('session:')) continue;
   const sourceFile = join(sourcesDir, fm.source);
-  const sourceFileWithExt = allSources.find(s => s === fm.source || basename(s, extname(s)) === fm.source);
+  const sourceFileWithExt = allSources.find(
+    (s) => s === fm.source || basename(s, extname(s)) === fm.source,
+  );
   if (!sourceFileWithExt && !existsSync(sourceFile)) {
     missingSource.push({ page: f, source: fm.source });
   }
 }
 
 if (args.json) {
-  console.log(JSON.stringify({
-    totalSources: allSources.length,
-    orphaned,
-    missingSource,
-  }, null, 2));
+  console.log(
+    JSON.stringify(
+      {
+        totalSources: allSources.length,
+        orphaned,
+        missingSource,
+      },
+      null,
+      2,
+    ),
+  );
 } else {
-  console.log('[hypomnema] Listing pending ingest targets — synthesis is performed by /hypo:ingest inside Claude Code.');
+  console.log(
+    '[hypomnema] Listing pending ingest targets — synthesis is performed by /hypo:ingest inside Claude Code.',
+  );
   console.log(`Sources: ${allSources.length} total`);
 
   if (orphaned.length === 0) {