hypomnema 1.3.0 → 1.3.1

package/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "hypomnema",
       "source": "./",
       "description": "LLM-native personal wiki — session-aware knowledge base for Claude Code",
-      "version": "1.3.0",
+      "version": "1.3.1",
       "homepage": "https://github.com/sk-lim19f/Hypomnema"
     }
   ]

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "hypomnema",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "LLM-native personal wiki system — session-aware knowledge base for Claude Code",
   "author": {
     "name": "sk-lim19f",

package/README.ko.md

@@ -23,13 +23,15 @@ _Claude에게 기록을 맡기세요 — 그리고 그 기록이 실제로 쌓
 
 > **아래에서 자주 쓰이는 용어 간단 정리.** *프런트매터(frontmatter)* = 마크다운 파일 맨 위의 YAML 블록. *위키링크(wikilink)* = `[[페이지-슬러그]]` 형태의 교차 참조. *ADR* = "Architecture Decision Record" — 어떤 설계 결정을 *왜* 했는지 짧게 적은 마크다운 페이지. *projection*(투영) = 한 방향 자동 파생(`pages/feedback/*.md` → `MEMORY.md` / `<learned_behaviors>`). *훅(hook)* = Claude Code가 라이프사이클 이벤트에서 자동으로 실행하는 스크립트. *hot.md* / *session-state.md* = "방금 무엇을 했는지"와 "다음에 무엇을 할지"를 담는 프로젝트별 캐시 파일 — 멈춘 프로젝트를 한 번에 이어 받을 수 있게 합니다. 전체 용어 풀이는 [용어 사전](#용어-사전) 참조.
 
-> **현재 자동화 범위와 다음 목표.** v1.2.0(현재)은 트리거 모델을 솔직하게 정리합니다. 위키 작업(자료 정리·검색·세션 마무리)은 여전히 사용자가 `/hypo:*` 명령어를 직접 입력해 시작합니다. 다만 **v1.1.0**부터 위키가 한 세션에서 얼마나 활용됐는지를 측정하는 *관측성 지표(observability score)* 가 들어갔고, **v1.2.0**은 그 위에 사용자가 시키지 않아도 자동으로 동작하는 영역 4개를 추가했습니다:
+> **현재 자동화 범위와 다음 목표.** v1.3.0(현재)은 트리거 모델을 솔직하게 정리합니다. 위키 작업(자료 정리·검색·세션 마무리)은 여전히 사용자가 `/hypo:*` 명령어를 직접 입력해 시작합니다. 다만 **v1.1.0**부터 위키가 한 세션에서 얼마나 활용됐는지를 측정하는 *관측성 지표(observability score)* 가 들어갔고, **v1.2.0**은 그 위에 사용자가 시키지 않아도 자동으로 동작하는 영역 4개를 추가했습니다:
 > - **`feedback` 페이지를 단일 원천(source of truth)으로**(ADR 0031) — `pages/feedback/`에 한 번만 적으면, 위키가 `MEMORY.md`와 `~/.claude/CLAUDE.md`의 `<learned_behaviors>` 블록을 자동으로 갱신합니다.
 > - **확장 파일 동봉 동기화**(ADR 0024) — 위키 안의 `~/hypomnema/extensions/{agents,commands,hooks,skills}/`에 둔 파일을 자동으로 `~/.claude/`에 반영합니다. `--codex` 옵션을 추가하면 `hooks`·`commands`는 `~/.codex/`에도 반영되지만, `agents`와 `skills`는 Claude 전용이라 의도적으로 건너뜁니다.
 > - **프로젝트 자동 생성**(ADR 0023) — 작업 디렉터리를 git 저장소(`package.json`·`Cargo.toml` 등의 프로젝트 표식이 있는 곳)로 옮겼을 때 대응하는 위키 프로젝트가 없으면, 새로 만들지 물어봅니다.
 > - **세션 종료 자동 정리와 `/clear` 복구**(ADR 0022) — 의미 있는 세션이 끝날 때 "마무리 메모를 짧게 남길까요?"가 자동으로 뜨고, 마무리하지 않은 채 `/clear`를 입력해도 다음 세션 시작 시 이어서 정리할 수 있습니다.
 >
 > 스키마(`SCHEMA.md`)는 2.0으로 올라갑니다. `feedback` 페이지 타입에 9개의 필수 항목이 추가되며, `hypomnema upgrade --apply`를 실행하면 위키 루트에 `MIGRATION-v2.0.md`가 생성되어 단계별 보강 체크리스트를 제공합니다. 사용자가 직접 편집한 `SCHEMA.md`는 upgrade가 **덮어쓰지 않습니다** — 안내만 표시하고, 실제 반영은 사용자가 수동으로 결정합니다(이 정책을 코드에서는 *Option C*로 부릅니다).
+>
+> **v1.3.0**은 자율성을 넓히기보다 이 레이어를 다듬습니다. 세션 마무리 흐름에 *권고형* 성찰 4가지(자동 실행 없이 제안만 — ADR 0029)가 들어가고, `hypomnema lint --strict`가 선택된 경고를 에러로 승격해 릴리스 게이트로 쓸 수 있으며, 설치가 **stale-sibling 감지**로 단단해집니다 — `$PATH`에 남은 더 오래된 `hypomnema`가 더는 활성 훅을 조용히 다운그레이드하지 못합니다(ADR 0038).
 
 ---
 
@@ -247,7 +249,7 @@ v1.0에서는 `personal / shared / public` 3-mode를 만들었습니다. 현실
 
 이와 별도로 `SessionStart` 훅은 npm 레지스트리와 Claude Code 플러그인 마켓플레이스를 백그라운드에서 확인합니다(세션 시작을 막지 않습니다). 새 버전이 게시되어 있으면 다음 세션 시작 시 "Update available!" 안내가 한 줄 표시됩니다. `HYPO_NO_UPDATE_CHECK=1`, `NO_UPDATE_NOTIFIER=1`을 지정하거나 `CI=true` 환경에서 실행하면 점검을 건너뜁니다.
 
-위 네 가지 레인 외의 v1.2 세부 수정 — 오래된 `design-history.md`를 잡는 `W8` lint, 프로젝트 간 누출을 막는 `project:*` 정확 일치 필터(PR #59), 코드 주석 정리 1단계(PR #58) — 는 [`CHANGELOG.md`](CHANGELOG.md)를 참고하세요.
+위 네 가지 레인 외의 v1.3 세부 수정 — 세션 마무리 lint를 건드린 파일로 스코프해 무관한 debt로 `/compact`가 막히지 않게 한 변경(ADR 0037), `feedback` scope 검증기가 cwd 유래 project id를 수용하게 한 수정(OQ-34), `--strict`가 에러로 승격하는 안정적 lint 경고 ID `W1`/`W2`/`W4`(`--fix`로 자동복구되는 `W3`는 경고로 유지) — 은 [`CHANGELOG.md`](CHANGELOG.md)를 참고하세요.
 
 ### 셋업 & 유지보수
 

package/README.md

@@ -23,13 +23,15 @@ _Make Claude take notes — and measure whether it actually does._
 
 > **Quick decoder for terms used below.** *frontmatter* = the YAML block at the top of a markdown file; *wikilink* = a `[[page-slug]]` cross-reference; *ADR* = "Architecture Decision Record", a short markdown page that records *why* a design choice was made; *projection* = a one-way derive (`pages/feedback/*.md` → `MEMORY.md` / `<learned_behaviors>`); *hook* = a script that Claude Code runs automatically on lifecycle events; *hot.md* / *session-state.md* = the per-project cache files that hold "what just happened" and "what's next" so a paused project resumes in one read. Full glossary lives under [Term decoder](#term-decoder).
 
-> **Current state vs. v2 vision.** v1.2.0 (today) is honest about its trigger model: most wiki behavior — ingest, query, session-close — still fires on **explicit `/hypo:*` commands**, but the auto-behavior surface is growing. The v2 thesis is *fully autonomous* — Claude reading, writing, and synthesizing the wiki without being asked. **v1.1.0** shipped the **observability score** that measures how often the wiki is actually used per session (ingest / query / session-close / citation rates). **v1.2.0** adds four load-bearing autonomous lanes on top:
+> **Current state vs. v2 vision.** v1.3.0 (today) is honest about its trigger model: most wiki behavior — ingest, query, session-close — still fires on **explicit `/hypo:*` commands**, but the auto-behavior surface is growing. The v2 thesis is *fully autonomous* — Claude reading, writing, and synthesizing the wiki without being asked. **v1.1.0** shipped the **observability score** that measures how often the wiki is actually used per session (ingest / query / session-close / citation rates). **v1.2.0** adds four load-bearing autonomous lanes on top:
 > - **feedback-as-SoT with one-way projections** — `pages/feedback/` becomes the single source-of-truth (SoT) for behavior corrections; the wiki one-way derives `MEMORY.md` and the `<learned_behaviors>` block inside `~/.claude/CLAUDE.md`, so you edit one place and the projections refresh on their own (ADR 0031 — full design rationale lives in `projects/hypomnema/decisions/0031-*.md` inside your wiki).
 > - **extensions companion sync** — anything you drop under `~/hypomnema/extensions/{agents,commands,hooks,skills}/` is mirrored into `~/.claude/` automatically; the optional `--codex` flag additionally mirrors `hooks` and `commands` into `~/.codex/` (agents/skills are Claude-only and skipped on the Codex target by design) (ADR 0024).
 > - **auto-project creation on cwd match** — when you `cd` into a git repo with a project marker (`package.json`, `Cargo.toml`, etc.) and no matching wiki project exists, Hypomnema offers to scaffold one for you (ADR 0023).
 > - **Stop-chain auto-minimal-crystallize + `/clear` recovery** — non-trivial sessions get an automatic "save a minimal session-close note?" prompt; `/clear` after a forgotten close is detected and recovered cleanly (ADR 0022).
 >
 > The schema (`SCHEMA.md`) bumps to 2.0 — the `feedback` page type now requires 9 mandatory frontmatter fields. `hypomnema upgrade --apply` writes `MIGRATION-v2.0.md` into the wiki root with a step-by-step backfill checklist. Your own `SCHEMA.md` is **never overwritten** by upgrade — we call this policy *Option C*: the upgrade only tells you what changed, and you apply the diff yourself.
+>
+> **v1.3.0** refines this layer rather than expanding autonomy: the session-close flow gains four *advisory* reflections (they suggest, never auto-act — ADR 0029), `hypomnema lint --strict` promotes selected warnings to errors for release gates, and install hardens with **stale-sibling detection** — an older `hypomnema` on `$PATH` can no longer silently downgrade your active hooks (ADR 0038).
 
 ---
 
@@ -247,7 +249,7 @@ All hooks resolve the wiki root via `HYPO_DIR` env → `hypo-config.md` scan →
 
 Additionally, the `SessionStart` hook performs a non-blocking background check against npm and the Claude Code plugin marketplace and prints an "Update available!" banner the next time a newer Hypomnema version has been published. Opt out with `HYPO_NO_UPDATE_CHECK=1`, `NO_UPDATE_NOTIFIER=1`, or by running under `CI=true`.
 
-For fix-level v1.2 detail beyond the lanes above — `W8` stale `design-history.md` lint, exact-match `project:*` filter for cross-project feedback projection (PR #59), and the comment-hygiene Phase 1 cleanup (PR #58) — see [`CHANGELOG.md`](CHANGELOG.md).
+For fix-level v1.3 detail beyond the lanes above — session-close lint scoped to touched files so `/compact` is no longer blocked by unrelated debt (ADR 0037), the `feedback` scope validator accepting cwd-derived project ids (OQ-34), and the stable lint warning IDs `W1`/`W2`/`W4` that `--strict` promotes to errors (while `W3`, auto-repaired by `--fix`, stays a warning) — see [`CHANGELOG.md`](CHANGELOG.md).
 
 ### Setup & maintenance
 

package/commands/upgrade.md

@@ -28,6 +28,8 @@ node <package-root>/scripts/upgrade.mjs [--hypo-dir="<path>"]
 
 Show the output verbatim.
 
+> **Plugin installs**: if the output begins with `ℹ Plugin install detected`, the core hooks, slash commands, and `settings.json` wiring are managed by the Claude Code plugin loader — **not** by `/hypo:upgrade`. Do **not** run `--apply` expecting it to update them (it intentionally skips those to avoid double-registering every hook). To upgrade the plugin itself: `/plugin marketplace update hypomnema` then `/reload-plugins`. `--apply` in plugin mode applies vault-side migrations (SCHEMA, `.hypoignore`), refreshes package metadata, and still syncs any vault extensions — but does **not** install the core hooks/commands/settings (the plugin provides those).
+
 > **Note**: A major SCHEMA bump is only **detected** in this step. The informational `MIGRATION-vX.Y.md` file is written later by `--apply` (Step 4) and only on a major bump. `SCHEMA.md` is never auto-overwritten.
 
 ---

package/hooks/hypo-session-start.mjs

@@ -323,6 +323,10 @@ let raw = '';
 process.stdin.setEncoding('utf-8');
 process.stdin.on('data', (chunk) => (raw += chunk));
 process.stdin.on('end', () => {
+  // ISSUE-5: declared before the try so every emit branch — including the outer
+  // catch — carries the same `systemMessage` (the user-visible update/sibling
+  // banner). Reassigned once below after the notices are computed.
+  let outExtra = { continue: true, suppressOutput: true };
   try {
     let data = {};
     try {
@@ -339,10 +343,16 @@ process.stdin.on('end', () => {
     const clearRecoveryLine = buildClearRecoveryLine(data.source);
     const updateLine = buildUpdateNotice();
     const siblingLine = buildSiblingNotice();
-    // Intentional dual emit: stderr (yellow/cyan) is the human-visible nudge in
-    // the terminal; noticePrefix injects the same plain-text lines into the
-    // LLM's additionalContext so model and user start the session looking at
-    // the same state. ANSI escapes are kept out of additionalContext on purpose.
+    // ISSUE-5: the update + stale-sibling banners must reach the USER. On a
+    // SessionStart hook that exits 0, stderr is invisible in the normal TUI
+    // (only shown on exit 2 / --verbose) and additionalContext is model-only —
+    // `systemMessage` is the documented user-visible channel. Route those two
+    // banners there. They ALSO stay in noticePrefix → additionalContext below,
+    // so the model and the user start the session looking at the same state.
+    // (The other stderr notices — sync/growth/clear/suggest — are intentionally
+    // transcript/--verbose only and out of ISSUE-5's scope.)
+    const userMessage = [updateLine, siblingLine].filter(Boolean).join('\n\n');
+    if (userMessage) outExtra = { ...outExtra, systemMessage: userMessage };
     const notices = [syncLine, growthLine, clearRecoveryLine, updateLine, siblingLine].filter(
       Boolean,
     );
@@ -383,7 +393,7 @@ process.stdin.on('end', () => {
           JSON.stringify(
             buildOutput(
               `${noticePrefix}[WIKI HOT CACHE: project=${sanitizeProjForPrompt(hit.proj)}]\n\n${parts.join('\n\n')}`,
-              { continue: true, suppressOutput: true },
+              outExtra,
             ),
           ),
         );
@@ -399,10 +409,7 @@ process.stdin.on('end', () => {
           JSON.stringify(
             buildOutput(
               `${noticePrefix}[WIKI HOT CACHE: project=${sanitizeProjForPrompt(hit.proj)}, no snapshot yet]`,
-              {
-                continue: true,
-                suppressOutput: true,
-              },
+              outExtra,
             ),
           ),
         );
@@ -425,9 +432,9 @@ process.stdin.on('end', () => {
     if (!existsSync(GLOBAL_HOT)) {
       const notice = notices.join('\n\n');
       if (notice) {
-        console.log(JSON.stringify(buildOutput(notice, { continue: true, suppressOutput: true })));
+        console.log(JSON.stringify(buildOutput(notice, outExtra)));
       } else {
-        console.log(JSON.stringify({ continue: true, suppressOutput: true }));
+        console.log(JSON.stringify(outExtra));
       }
       return;
     }
@@ -439,9 +446,9 @@ process.stdin.on('end', () => {
       // would otherwise be silently dropped here.
       const notice = notices.join('\n\n');
       if (notice) {
-        console.log(JSON.stringify(buildOutput(notice, { continue: true, suppressOutput: true })));
+        console.log(JSON.stringify(buildOutput(notice, outExtra)));
       } else {
-        console.log(JSON.stringify({ continue: true, suppressOutput: true }));
+        console.log(JSON.stringify(outExtra));
       }
       return;
     }
@@ -449,12 +456,12 @@ process.stdin.on('end', () => {
       JSON.stringify(
         buildOutput(
           `${noticePrefix}[WIKI HOT CACHE: global — no project matched cwd=${cwd}]\n\n${globalContent}`,
-          { continue: true, suppressOutput: true },
+          outExtra,
         ),
       ),
     );
   } catch (err) {
     process.stderr.write(`[hypo-session-start] error: ${err?.message ?? String(err)}\n`);
-    console.log(JSON.stringify({ continue: true, suppressOutput: true }));
+    console.log(JSON.stringify(outExtra));
   }
 });

package/hooks/hypo-shared.mjs

@@ -232,13 +232,56 @@ export function freshDates() {
   return local === utc ? [local] : [local, utc];
 }
 
+// Parse a single frontmatter scalar (mirrors hypo-session-start.mjs /
+// hypo-cwd-change.mjs; local copy per the hook self-contained convention).
+function parseFrontmatterField(content, key) {
+  const m = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+  if (!m) return null;
+  const line = m[1].split('\n').find((l) => l.startsWith(`${key}:`));
+  if (!line) return null;
+  return line
+    .slice(key.length + 1)
+    .trim()
+    .replace(/^['"]|['"]$/g, '');
+}
+
+// Among `slugs`, return the one whose projects/<slug>/index.md `working_dir`
+// is the LONGEST prefix of cwd (so /repo/sub wins over /repo). Returns null
+// when cwd is falsy or matches none. Used only as a same-date tie-breaker.
+function pickByCwd(hypoDir, slugs, cwd) {
+  if (!cwd) return null;
+  let best = null;
+  let bestLen = -1;
+  for (const slug of slugs) {
+    const indexPath = join(hypoDir, 'projects', slug, 'index.md');
+    if (!existsSync(indexPath)) continue;
+    const wd = parseFrontmatterField(readFileSync(indexPath, 'utf-8'), 'working_dir');
+    if (!wd) continue;
+    let resolved = wd.startsWith('~/') ? join(homedir(), wd.slice(2)) : wd;
+    resolved = resolved.replace(/\/+$/, ''); // trailing-slash normalize
+    if ((cwd === resolved || cwd.startsWith(resolved + '/')) && resolved.length > bestLen) {
+      bestLen = resolved.length;
+      best = slug;
+    }
+  }
+  return best;
+}
+
 /**
  * Resolve the most-recently-active project slug from root hot.md.
- * Mirrors scripts/resume.mjs resolveActiveProject — kept in sync by hand.
+ * The cwd helpers (parseFrontmatterField / pickByCwd) and the same-date
+ * tie-break are kept in sync with scripts/resume.mjs by hand; the surrounding
+ * wrapper intentionally differs (resume.mjs adds an mtime fallback, this does not).
+ * `cwd` is an optional same-date tie-breaker (ISSUE-1): resume passes
+ * process.cwd(); session-close callers (sessionCloseFileStatus /
+ * closeFileTargets) intentionally pass null — close has a different
+ * authority (payload.project / freshness), tracked separately as ISSUE-7.
+ * When cwd is omitted, behavior is identical to the legacy version.
  * @param {string} hypoDir
+ * @param {string|null} [cwd]
  * @returns {string|null}
  */
-export function resolveActiveProject(hypoDir) {
+export function resolveActiveProject(hypoDir, cwd = null) {
   const hotPath = join(hypoDir, 'hot.md');
   if (!existsSync(hotPath)) return null;
   let content;
@@ -257,6 +300,19 @@ export function resolveActiveProject(hypoDir) {
   ].map((m) => ({ name: m[1].trim(), date: m[2] || '', slug: m[3] }));
   if (wikiRows.length > 0) {
     wikiRows.sort((a, b) => b.date.localeCompare(a.date));
+    // Same-date tie-break (ISSUE-1): when the top date is shared by >1 row,
+    // prefer the project whose working_dir contains cwd. No cwd / no match →
+    // keep the stable-sort winner (the legacy "first table row" behavior).
+    const topDate = wikiRows[0].date;
+    const tied = wikiRows.filter((r) => r.date === topDate);
+    if (cwd && tied.length > 1) {
+      const picked = pickByCwd(
+        hypoDir,
+        tied.map((r) => r.slug),
+        cwd,
+      );
+      if (picked) return picked;
+    }
     return wikiRows[0].slug;
   }
   // Legacy markdown-link rows: | [name](projects/name/...) | ...
@@ -277,12 +333,21 @@ export function resolveActiveProject(hypoDir) {
  * project A can't be masked by a fresh close of project B (and vice versa).
  * open-questions.md (file #5) is conditional and not gated.
  *
+ * `projectOverride` (ISSUE-7 Part A): when the caller already holds the
+ * authoritative project being closed (e.g. crystallize apply derives it from
+ * `payload.project`), it passes that slug so verification checks the SAME
+ * project it just wrote — instead of re-deriving via resolveActiveProject(),
+ * which on a same-date root-hot.md tie can resolve a DIFFERENT project and
+ * false-fail a completed close. When omitted, behavior is byte-identical to the
+ * legacy single-arg version (resolve from root hot.md).
+ *
  * @param {string} hypoDir
+ * @param {{projectOverride?: string|null}} [opts]
  * @returns {{ok: boolean, project: string|null, dates: string[], stale: string[], missing: string[]}}
  */
-export function sessionCloseFileStatus(hypoDir) {
+export function sessionCloseFileStatus(hypoDir, { projectOverride = null } = {}) {
   const dates = freshDates();
-  const project = resolveActiveProject(hypoDir);
+  const project = projectOverride || resolveActiveProject(hypoDir);
   if (!project) {
     return {
       ok: false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hypomnema",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "LLM-native personal wiki system for Claude Code",
   "type": "module",
   "license": "MIT",

package/scripts/crystallize.mjs

@@ -613,7 +613,12 @@ function applySessionClose(args) {
     (wrote ? applied : skipped).push('log (log.md)');
   }
 
-  const verification = sessionCloseFileStatus(args.hypoDir);
+  // ISSUE-7 Part A: verify against the SAME project this apply just wrote
+  // (`project` = payload.project || probe.project, resolved at the top). Without
+  // the override, sessionCloseFileStatus re-derives via resolveActiveProject and,
+  // on a same-date root-hot.md tie, can pick a different project — false-failing
+  // a completed close (the 2026-06-09 security-ops-kb incident).
+  const verification = sessionCloseFileStatus(args.hypoDir, { projectOverride: project });
 
   // Fix #40 post-apply lint: payload may have introduced a malformed body or
   // bad frontmatter. Surface as a distinct `stage` so caller can tell "lint

package/scripts/lib/plugin-detect.mjs

@@ -0,0 +1,51 @@
+// Detect whether the Hypomnema Claude Code plugin is enabled in a settings.json.
+//
+// ISSUE-8 (dual-install guard): the manual/npm `upgrade.mjs` must know when the
+// plugin is ALSO enabled, because the plugin loader already provides the core
+// hooks/commands/settings — copying+registering them from a manual/npm `--apply`
+// would double-register every hook.
+//
+// This parser is INTENTIONALLY conservative. The asymmetric cost is: a false
+// positive blocks/alters a legitimate npm-only user's upgrade, which is worse
+// than the rare dual-install double-register it guards against. So it fails open
+// (returns false) on every uncertainty and only fires on an exact, well-formed
+// `enabledPlugins` entry whose plugin name is precisely `hypomnema`.
+
+import { readFileSync } from 'node:fs';
+
+/**
+ * @param {string} settingsPath  path to a Claude Code settings.json (e.g. ~/.claude/settings.json)
+ * @returns {boolean} true iff `enabledPlugins` contains a key shaped
+ *   `hypomnema@<marketplace>` whose value is strictly `true`.
+ */
+export function isHypomnemaPluginEnabled(settingsPath) {
+  let raw;
+  try {
+    raw = readFileSync(settingsPath, 'utf-8');
+  } catch {
+    return false; // missing / unreadable → cannot prove enabled → fail open
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return false; // corrupt JSON → fail open
+  }
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return false;
+
+  const enabled = parsed.enabledPlugins;
+  // enabledPlugins is an object map `{ "<name>@<marketplace>": true|false }`.
+  // Anything else (absent, array, scalar) → not enabled.
+  if (!enabled || typeof enabled !== 'object' || Array.isArray(enabled)) return false;
+
+  for (const [key, value] of Object.entries(enabled)) {
+    if (value !== true) continue; // strictly true only — no truthy coercion
+    // Require a real `name@marketplace` shape: an `@` that is neither the first
+    // nor the last char. A bare `"hypomnema": true` (no marketplace) must NOT
+    // trigger — that is not a valid enabledPlugins identifier.
+    const at = key.indexOf('@');
+    if (at <= 0 || at === key.length - 1) continue;
+    if (key.slice(0, at) === 'hypomnema') return true; // exact, case-sensitive
+  }
+  return false;
+}

package/scripts/resume.mjs

@@ -9,13 +9,22 @@
  *   node scripts/resume.mjs [options]
  *
  * Options:
- *   --hypo-dir=<path>     Hypomnema root (default: resolved via HYPO_DIR / hypo-config.md / ~/hypomnema)
+ *   --hypo-dir=<path>     Hypomnema root. When omitted, resolveHypoRoot()
+ *                         (see lib/hypo-root.mjs) resolves it in priority order:
+ *                           1. $HYPO_DIR if set — returned immediately; the
+ *                              hypo-config.md scan below is then skipped.
+ *                           2. else the first of 7 fixed candidates
+ *                              (~/{hypomnema,wiki,notes,knowledge},
+ *                              ~/Documents/{hypomnema,wiki,notes}) that contains
+ *                              a hypo-config.md marker.
+ *                           3. else the default ~/hypomnema.
  *   --project=<name>      Project name (default: most recently active from hot.md)
  *   --json                Output as JSON
  */
 
 import { existsSync, readFileSync, readdirSync, statSync } from 'fs';
 import { join } from 'path';
+import { homedir } from 'os';
 import { resolveHypoRoot, expandHome } from './lib/hypo-root.mjs';
 
 // ── arg parsing ──────────────────────────────────────────────────────────────
@@ -33,7 +42,43 @@ function parseArgs(argv) {
 
 // ── active project from hot.md ───────────────────────────────────────────────
 
-function resolveActiveProject(hypoDir) {
+// Parse a single frontmatter scalar (mirrors the hook helpers in
+// hypo-session-start.mjs / hypo-cwd-change.mjs — kept local per the hook
+// self-contained convention rather than shared, to avoid script↔hook coupling).
+function parseFrontmatterField(content, key) {
+  const m = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+  if (!m) return null;
+  const line = m[1].split('\n').find((l) => l.startsWith(`${key}:`));
+  if (!line) return null;
+  return line
+    .slice(key.length + 1)
+    .trim()
+    .replace(/^['"]|['"]$/g, '');
+}
+
+// Among `slugs`, return the one whose projects/<slug>/index.md `working_dir`
+// is the LONGEST prefix of cwd (so /repo/sub wins over /repo). Returns null
+// when cwd is falsy or matches none. Used only as a same-date tie-breaker.
+function pickByCwd(hypoDir, slugs, cwd) {
+  if (!cwd) return null;
+  let best = null;
+  let bestLen = -1;
+  for (const slug of slugs) {
+    const indexPath = join(hypoDir, 'projects', slug, 'index.md');
+    if (!existsSync(indexPath)) continue;
+    const wd = parseFrontmatterField(readFileSync(indexPath, 'utf-8'), 'working_dir');
+    if (!wd) continue;
+    let resolved = wd.startsWith('~/') ? join(homedir(), wd.slice(2)) : wd;
+    resolved = resolved.replace(/\/+$/, ''); // trailing-slash normalize
+    if ((cwd === resolved || cwd.startsWith(resolved + '/')) && resolved.length > bestLen) {
+      bestLen = resolved.length;
+      best = slug;
+    }
+  }
+  return best;
+}
+
+function resolveActiveProject(hypoDir, cwd = null) {
   const hotPath = join(hypoDir, 'hot.md');
   if (!existsSync(hotPath)) return null;
 
@@ -49,6 +94,19 @@ function resolveActiveProject(hypoDir) {
   ].map((m) => ({ name: m[1].trim(), date: m[2] || '', slug: m[3] }));
   if (wikiRows.length > 0) {
     wikiRows.sort((a, b) => b.date.localeCompare(a.date));
+    // Same-date tie-break (ISSUE-1): when the top date is shared by >1 row,
+    // prefer the project whose working_dir contains cwd. No cwd / no match →
+    // keep the stable-sort winner (the legacy "first table row" behavior).
+    const topDate = wikiRows[0].date;
+    const tied = wikiRows.filter((r) => r.date === topDate);
+    if (cwd && tied.length > 1) {
+      const picked = pickByCwd(
+        hypoDir,
+        tied.map((r) => r.slug),
+        cwd,
+      );
+      if (picked) return picked;
+    }
     return wikiRows[0].slug;
   }
   // Legacy markdown-link rows: | [name](projects/name/...) | ...
@@ -93,7 +151,7 @@ function readHot(hypoDir, project) {
 
 const args = parseArgs(process.argv);
 
-const project = args.project || resolveActiveProject(args.hypoDir);
+const project = args.project || resolveActiveProject(args.hypoDir, process.cwd());
 
 if (!project) {
   console.error('Error: no active project found. Use --project=<name> or create a hot.md entry.');

package/scripts/smoke-pack.mjs

@@ -32,6 +32,24 @@ import { fileURLToPath } from 'node:url';
 const REPO = join(fileURLToPath(new URL('.', import.meta.url)), '..');
 const KEEP = process.argv.includes('--keep');
 
+// When this script runs inside `npm publish --dry-run` (the release workflow's
+// publish-credential pre-check), npm exports `npm_config_dry_run=true` into the
+// lifecycle environment. spawnSync inherits process.env, so the nested
+// `npm pack` below would ALSO run in dry-run mode — reporting a tarball
+// filename/size it never actually writes to disk — and the subsequent
+// `npm install <tarball>` then fails with ENOENT (npm maps errno -2 → exit 254).
+// Strip the flag so the nested npm commands always perform real writes,
+// matching the real tag-push publish job (which has no outer `--dry-run`). The
+// outer workflow stays dry-run and still skips the registry PUT.
+// (This was the precheck-254 root cause; the earlier "missing NODE_AUTH_TOKEN"
+// theory was wrong — it is file absence, not auth.)
+const npmEnv = { ...process.env };
+for (const key of Object.keys(npmEnv)) {
+  if (key.toLowerCase().replaceAll('-', '_') === 'npm_config_dry_run') {
+    delete npmEnv[key];
+  }
+}
+
 const PKG = JSON.parse(readFileSync(join(REPO, 'package.json'), 'utf-8'));
 const PKG_NAME = PKG.name;
 
@@ -64,7 +82,7 @@ try {
   const preCommitBefore = existsSync(preCommitPath) ? readFileSync(preCommitPath, 'utf-8') : null;
 
   step('npm pack');
-  const pack = run('npm', ['pack', '--json'], { cwd: REPO });
+  const pack = run('npm', ['pack', '--json'], { cwd: REPO, env: npmEnv });
   const meta = JSON.parse(pack.stdout)[0];
   const tarball = join(REPO, meta.filename);
   console.log(`  → ${meta.filename} (${meta.size} bytes, ${meta.entryCount} entries)`);
@@ -79,7 +97,10 @@ try {
       private: true,
     }) + '\n',
   );
-  run('npm', ['install', '--no-audit', '--no-fund', '--silent', tarball], { cwd: installRoot });
+  // No `--silent`: run() only prints npm's stdout/stderr on a non-zero exit, so
+  // a real nested-install failure must not be muted (the precheck-254 error was
+  // masked by `--silent` for two release cycles).
+  run('npm', ['install', '--no-audit', '--no-fund', tarball], { cwd: installRoot, env: npmEnv });
 
   // Move tarball into the work dir so it's not left in the repo.
   renameSync(tarball, join(work, meta.filename));

package/scripts/upgrade.mjs

@@ -21,6 +21,9 @@
  *   --json              Output results as JSON
  *   --allow-downgrade   Override the guard that refuses to overwrite a NEWER
  *                       active install with an older package (ADR 0038)
+ *   --allow-dual-install  Override the ISSUE-8 guard: register the Claude core
+ *                       surface even though the Hypomnema plugin is also enabled
+ *                       (knowingly accept the double-registration risk)
  */
 
 import {
@@ -47,6 +50,7 @@ import {
   readFileIfRegular,
 } from './lib/pkg-json.mjs';
 import { syncExtensions } from './lib/extensions.mjs';
+import { isHypomnemaPluginEnabled } from './lib/plugin-detect.mjs';
 import { classifyInstall, downgradeGuardMessage } from '../hooks/version-check.mjs';
 
 const HOME = homedir();
@@ -80,6 +84,7 @@ function parseArgs(argv) {
     forceExtensions: false,
     codex: false,
     allowDowngrade: false,
+    allowDualInstall: false,
   };
   for (const arg of argv.slice(2)) {
     if (arg.startsWith('--hypo-dir=')) args.hypoDir = expandHome(arg.slice(11));
@@ -89,6 +94,7 @@ function parseArgs(argv) {
     else if (arg === '--codex') args.codex = true;
     else if (arg === '--json') args.json = true;
     else if (arg === '--allow-downgrade') args.allowDowngrade = true;
+    else if (arg === '--allow-dual-install') args.allowDualInstall = true;
   }
   if (!args.hypoDir) args.hypoDir = resolveHypoRoot();
   return args;
@@ -458,7 +464,7 @@ function applyHypoignoreMigration(result) {
   return appended;
 }
 
-function writeMigrationReport(hypoDir, fromVersion, toVersion) {
+function writeMigrationReport(hypoDir, fromVersion, toVersion, { pluginMode = false } = {}) {
   const today = new Date().toISOString().slice(0, 10);
   const filename = `MIGRATION-v${toVersion}.md`;
   const dest = join(hypoDir, filename);
@@ -544,9 +550,15 @@ Review the SCHEMA diff and update your wiki pages accordingly.
 
 ## Action items
 
-This report was generated during \`/hypo:upgrade --apply\`. Hook files and settings.json
-entries were applied by that run (or skipped with a warning if the target was malformed —
-see the upgrade output). \`SCHEMA.md\` is intentionally **not** overwritten by upgrade — the
+This report was generated during \`/hypo:upgrade --apply\`. ${
+        pluginMode
+          ? 'You are on a **plugin install**, so the core hook files and settings.json hook ' +
+            'registrations were NOT touched — the Claude Code plugin loader owns them (upgrade the ' +
+            'plugin via `/plugin marketplace update hypomnema` then `/reload-plugins`). Vault ' +
+            'extensions, if any, were still synced.'
+          : 'Hook files and settings.json entries were applied by that run (or skipped with a ' +
+            'warning if the target was malformed — see the upgrade output).'
+      } \`SCHEMA.md\` is intentionally **not** overwritten by upgrade — the
 remaining steps are manual:
 
 - [ ] Compare your \`SCHEMA.md\` (v${fromVersion}) with the package template (v${toVersion}) and merge changes manually
@@ -749,6 +761,31 @@ function applyCommands(commandResults, force) {
   return applied;
 }
 
+// ISSUE-6: in plugin mode `applyCommands` is skipped (no command copy), but the
+// runtime still needs hypo-pkg.json to resolve PKG_ROOT for lint/feedback scripts
+// (hooks/hypo-shared.mjs → hypo-personal-check). Write minimal metadata pointing
+// at the plugin's package root, preserving any existing fields (e.g. `extensions`)
+// but DROPPING any prior `commands` map (no commands were copied, so a stale map
+// would falsely assert ownership of ~/.claude/commands/hypo).
+function writePluginModeMetadata() {
+  const path = pkgJsonPath();
+  // Drop any prior top-level `commands` SHA map: no commands were copied in plugin
+  // mode, so keeping a manual install's map would falsely assert ownership of
+  // ~/.claude/commands/hypo. Preserve every other field (e.g. `extensions`).
+  const { commands: _droppedCommands, ...existing } = readPkgJsonSafe(path) || {};
+  let pkgVersion = null;
+  try {
+    pkgVersion = JSON.parse(readFileSync(join(PKG_ROOT, 'package.json'), 'utf-8')).version;
+  } catch {}
+  writePkgJsonAtomic(path, {
+    ...existing,
+    pkgRoot: PKG_ROOT,
+    pkgVersion,
+    schemaVersion: '2.0',
+  });
+  return true;
+}
+
 // ── main ─────────────────────────────────────────────────────────────────────
 
 const args = parseArgs(process.argv);
@@ -760,6 +797,43 @@ const claudeSettingsPath = join(HOME, '.claude', 'settings.json');
 const codexHooksDir = join(HOME, '.codex', 'hooks');
 const codexSettingsPath = join(HOME, '.codex', 'settings.json');
 
+// ISSUE-6: when `/hypo:upgrade` runs as the Claude Code PLUGIN, the 15 core hooks
+// and 14 slash commands are provided by the plugin's hooks.json + commands/
+// (auto-wired by Claude Code), NOT copied into ~/.claude/. The manual/npm health
+// check below would then report all of them "missing" and recommend `--apply`,
+// which copies the hooks into ~/.claude/hooks/ and registers 14 settings.json
+// events → Claude Code runs BOTH the plugin hooks.json AND user settings.json, so
+// every hook fires TWICE. The decisive signal: the plugin command runs the
+// PLUGIN's upgrade.mjs, so PKG_ROOT lives under ~/.claude/plugins/. (A manual/npm
+// upgrade.mjs run while the plugin is ALSO enabled is a different failure mode —
+// dual install — tracked as ISSUE-8.)
+// Match the Claude plugin cache shape specifically (`~/.claude/plugins/…`), NOT a
+// generic `/plugins/` substring — this flag now GATES install behavior, so a
+// legitimate npm/dev checkout under some unrelated `…/plugins/…` path must not be
+// misclassified and silently stop managing its hooks. (detectChannel's broad
+// `/plugins/` test is fine for the notifier's display-only use, but too loose here.)
+const pluginMode = PKG_ROOT.replace(/\\/g, '/').includes('/.claude/plugins/');
+// ISSUE-8 (dual install): the OTHER way the same double-registration can happen.
+// Here the MANUAL/npm upgrade.mjs is running (pluginMode=false), but the Hypomnema
+// plugin is ALSO enabled in ~/.claude/settings.json — so the plugin loader already
+// provides the core hooks/commands/settings. A manual/npm `--apply` would copy and
+// register them on top, and every core hook fires twice. The detector is fail-open
+// (see lib/plugin-detect.mjs): a false positive would wrongly alter a legitimate
+// npm-only user's upgrade, so it only fires on an exact `hypomnema@<mp>: true`.
+const hypomnemaPluginEnabled = !pluginMode && isHypomnemaPluginEnabled(claudeSettingsPath);
+const dualInstallCoreConflict = hypomnemaPluginEnabled;
+// Surface policy: the Claude core surface (hooks/settings/commands/hook-name
+// migration) is skipped when EITHER the plugin runs this script (pluginMode) OR a
+// manual/npm run detects the plugin is enabled (dualInstallCoreConflict) — unless
+// the user knowingly overrides with --allow-dual-install. The codex core surface
+// (--codex) and vault-defined extensions are NOT plugin-provided, so they stay
+// managed in every case.
+const managesClaudeCore = !pluginMode && (!dualInstallCoreConflict || args.allowDualInstall);
+// dualSkip = core was skipped specifically because of the dual install (not a true
+// plugin-mode run, and not overridden). Drives the warning banner and the metadata
+// preservation below.
+const dualSkip = dualInstallCoreConflict && !args.allowDualInstall;
+
 const schema = checkSchemaVersion(args.hypoDir);
 const hooks = checkHookFiles(claudeHooksDir);
 const settings = checkSettingsJson(claudeSettingsPath, claudeHooksDir);
@@ -823,7 +897,14 @@ const invalidSettingsCodex = settingsCodex
   ? settingsCodex.some((s) => s.status === 'invalid-json')
   : false;
 const schemaDrift = schema.bump !== 'none' && schema.bump !== 'unknown' && schema.bump !== 'ahead';
-const pkgJsonDrift = pkgJson.status !== 'up-to-date';
+// ISSUE-8 dual-install: when core is skipped, hypo-pkg.json is deliberately left
+// pointing at the PLUGIN's package root (preserved identity), so checkPkgJson()
+// reports it 'stale' relative to this npm/manual PKG_ROOT. That mismatch is
+// INTENTIONAL — `--apply` will not (and must not) rewrite it — so it must not
+// count as actionable drift, or the user would be nagged to run --apply forever.
+// A genuinely missing/corrupt file (status 'missing') is still surfaced (warning
+// below), because the runtime then cannot resolve its package root at all.
+const pkgJsonDrift = pkgJson.status !== 'up-to-date' && !(dualSkip && pkgJson.status === 'stale');
 const staleCommands = commands.filter((c) => c.status === 'stale' || c.status === 'missing');
 const userModifiedCommands = commands.filter((c) => c.status === 'user-modified');
 const orphanedCommands = commands.filter((c) => c.status === 'orphaned');
@@ -871,21 +952,59 @@ if (args.apply) {
       process.exit(2);
     }
   }
-  if (oldHookRefs.length > 0) {
-    appliedHookNameRenames = applyHookNameMigration(
-      oldHookRefs,
-      claudeSettingsPath,
-      claudeHooksDir,
-    );
-  }
+  // Migration report is vault-side (writes into the Hypomnema root) and applies
+  // in both install models.
   if (schema.bump === 'major' && schema.installed && schema.current && existsSync(args.hypoDir)) {
-    migrationPath = writeMigrationReport(args.hypoDir, schema.installed, schema.current);
+    migrationPath = writeMigrationReport(args.hypoDir, schema.installed, schema.current, {
+      // Use the core-skipped predicate, not raw pluginMode: in a dual-install skip
+      // the core surface is plugin-owned too, so the report must not claim the
+      // core hooks/settings were applied (ISSUE-8, W2 review note).
+      pluginMode: !managesClaudeCore,
+    });
+  }
+  if (managesClaudeCore) {
+    if (oldHookRefs.length > 0) {
+      appliedHookNameRenames = applyHookNameMigration(
+        oldHookRefs,
+        claudeSettingsPath,
+        claudeHooksDir,
+      );
+    }
+    appliedHooks = applyHookFiles(hooks, claudeHooksDir);
+    appliedSettings = applySettingsJson(settings, claudeSettingsPath);
+    // applyCommands handles the single atomic hypo-pkg.json write (pkgRoot, version, schema, commands map)
+    appliedCommands = applyCommands(commands, args.forceCommands);
+    appliedPkgJson = true;
+  } else if (pluginMode) {
+    // ISSUE-6 plugin mode: the plugin loader owns the core hooks/commands and
+    // settings.json wiring — copying them here would double-register. Skip those,
+    // but STILL write minimal package metadata so the runtime can resolve PKG_ROOT
+    // for lint/feedback scripts (hooks/hypo-shared.mjs → hypo-personal-check). The
+    // commands SHA map is intentionally omitted (no command copy happened). PKG_ROOT
+    // is the plugin's own path here, so this metadata is authoritative.
+    appliedPkgJson = writePluginModeMetadata();
+  } else {
+    // ISSUE-8 dual-install skip: a manual/npm run while the plugin is enabled. We
+    // skip the core surface (the plugin owns it), but — unlike true plugin mode —
+    // PKG_ROOT here is the npm/manual path while the ACTIVE runtime hooks are the
+    // PLUGIN's. Rewriting a VALID hypo-pkg.json.pkgRoot to this npm path would
+    // mis-point the plugin runtime's lint/feedback resolution, so we PRESERVE an
+    // existing plugin-written identity (pkgJson.status 'stale'/'up-to-date' both
+    // mean a usable pkgRoot is already on disk) and do not touch it.
+    //
+    // If the metadata is MISSING or corrupt (status 'missing'; corrupt files are
+    // renamed to *.corrupt-*.json by readPkgJson and then read as absent), there is
+    // no plugin identity to preserve. Write minimal fallback metadata pointing at
+    // this (same-version) npm copy so the plugin runtime can resolve a package root
+    // at all — strictly better than the pkgRoot-less file extension sync would
+    // otherwise create, or no file at all. The dual-install banner still tells the
+    // user to resolve the dual install.
+    if (pkgJson.status === 'missing') {
+      appliedPkgJson = writePluginModeMetadata();
+    } else {
+      appliedPkgJson = false;
+    }
   }
-  appliedHooks = applyHookFiles(hooks, claudeHooksDir);
-  appliedSettings = applySettingsJson(settings, claudeSettingsPath);
-  // applyCommands handles the single atomic hypo-pkg.json write (pkgRoot, version, schema, commands map)
-  appliedCommands = applyCommands(commands, args.forceCommands);
-  appliedPkgJson = true;
   appliedHypoignore = applyHypoignoreMigration(hypoignore);
   // codex core hooks + settings + wiki-*→hypo-* rename mirror. Same order
   // as the claude side (rename first so subsequent hook copy can find renamed targets).
@@ -939,17 +1058,28 @@ const codexCoreDrift =
     invalidSettingsCodex ||
     (oldHookRefsCodex?.length ?? 0) > 0);
 
-const hasDrift =
+// Claude core-surface drift (hooks/settings/commands/rename/metadata). In plugin
+// mode these are plugin-managed, so they must NOT count as drift — otherwise the
+// report nags "N items need updating" and recommends a double-registering --apply.
+// Plugin-provided surface (hooks/settings/commands/rename) — excluded from drift
+// in plugin mode. pkgJsonDrift is intentionally NOT here: hypo-pkg.json is written
+// in BOTH install models (plugin mode writes minimal metadata so the runtime can
+// resolve PKG_ROOT for lint/feedback), so a missing/stale metadata file should
+// still prompt a (safe, metadata-only) --apply.
+const claudeCoreDrift =
   staleHooks.length > 0 ||
   missingSettings.length > 0 ||
-  schemaDrift ||
   invalidSettings ||
-  pkgJsonDrift ||
   oldHookRefs.length > 0 ||
   staleCommands.length > 0 ||
   userModifiedCommands.length > 0 ||
   orphanedCommands.length > 0 ||
-  nonRegularCommands.length > 0 ||
+  nonRegularCommands.length > 0;
+
+const hasDrift =
+  (managesClaudeCore && claudeCoreDrift) ||
+  pkgJsonDrift ||
+  schemaDrift ||
   hypoignore.status === 'needs-migration' ||
   extDrift ||
   codexCoreDrift;
@@ -958,6 +1088,12 @@ if (args.json) {
   console.log(
     JSON.stringify(
       {
+        pluginMode,
+        // ISSUE-8 dual-install signals.
+        hypomnemaPluginEnabled,
+        dualInstallCoreConflict,
+        coreManagedBy: managesClaudeCore ? 'self' : pluginMode ? 'plugin' : 'plugin-enabled',
+        dualInstallOverride: args.allowDualInstall,
         schema,
         hooks,
         settings,
@@ -1002,6 +1138,49 @@ if (args.json) {
 // Human-readable report
 const lines = [];
 
+// ISSUE-6: lead with the plugin-mode banner so the user understands why the core
+// hook/command/settings sections read "managed by plugin" and that `--apply` will
+// NOT touch them (only vault-side migrations + package metadata).
+if (pluginMode) {
+  lines.push(
+    'ℹ Plugin install detected — Hypomnema is loaded via the Claude Code plugin.',
+    '  Core hooks, slash commands, and settings.json wiring are provided by the',
+    '  plugin loader, so `/hypo:upgrade` does NOT manage them (and `--apply` will',
+    '  not copy/register them — that would double-register every hook).',
+    '  → To upgrade the plugin: `/plugin marketplace update hypomnema` then `/reload-plugins`.',
+    '  → `/hypo:upgrade --apply` here applies vault-side migrations (SCHEMA,',
+    '    .hypoignore), refreshes package metadata, and still syncs any vault',
+    '    extensions — but does NOT install the core hooks/commands/settings.',
+    '',
+  );
+}
+
+// ISSUE-8: a manual/npm upgrade.mjs is running while the Hypomnema plugin is ALSO
+// enabled — a dual install. Lead with a loud banner: the core surface is owned by
+// the plugin and is intentionally skipped, so `--apply` will not double-register.
+if (dualSkip) {
+  lines.push(
+    '⚠ Dual install detected — you are running the MANUAL/npm `upgrade.mjs`, but the',
+    '  Hypomnema plugin is ALSO enabled in ~/.claude/settings.json. The plugin loader',
+    '  already provides the core hooks, slash commands, and settings.json wiring, so',
+    '  this run does NOT copy/register them (doing so would double-register every hook).',
+    '  → Recommended: pick ONE install. To keep the plugin, remove the npm/manual copy',
+    '    (`npm uninstall -g hypomnema`) and upgrade via `/plugin marketplace update',
+    '    hypomnema` + `/reload-plugins`. Vault extensions + codex (if any) are still synced.',
+    '  → To register the core surface here anyway (knowingly accept the double-register',
+    '    risk), re-run with `--allow-dual-install`.',
+    '',
+  );
+} else if (dualInstallCoreConflict && args.allowDualInstall) {
+  // Override path: the user forced core registration despite the enabled plugin.
+  lines.push(
+    '⚠ Dual install — `--allow-dual-install` set: registering the Claude core surface',
+    '  even though the Hypomnema plugin is enabled. Every core hook may now fire TWICE',
+    '  (plugin loader + ~/.claude registration) until one install is removed.',
+    '',
+  );
+}
+
 // Schema version
 if (schema.bump === 'none') {
   lines.push(`✓ SCHEMA version    ${schema.installed} (up to date)`);
@@ -1047,7 +1226,13 @@ function pushHookSummary(hookList, label, targetPath) {
     }
   }
 }
-pushHookSummary(hooks, '', '~/.claude/hooks/');
+if (managesClaudeCore) {
+  pushHookSummary(hooks, '', '~/.claude/hooks/');
+} else {
+  lines.push(
+    '✓ Hook files          provided by the plugin loader (not managed in ~/.claude/hooks/)',
+  );
+}
 if (hooksCodex) pushHookSummary(hooksCodex, ' (codex)', '~/.codex/hooks/');
 
 // settings.json registrations (target-aware mirror; fix #48).
@@ -1066,11 +1251,33 @@ function pushSettingsSummary(sList, label, invalidFlag) {
     }
   }
 }
-pushSettingsSummary(settings, '', invalidSettings);
+if (managesClaudeCore) {
+  pushSettingsSummary(settings, '', invalidSettings);
+} else {
+  lines.push(
+    '✓ settings.json       hook wiring provided by the plugin (no ~/.claude registration)',
+  );
+}
 if (settingsCodex) pushSettingsSummary(settingsCodex, ' (codex)', invalidSettingsCodex);
 
 // Package metadata
-if (pkgJson.status === 'up-to-date') {
+if (dualSkip && pkgJson.status === 'stale') {
+  // ISSUE-8: the 'stale' here is the preserved plugin identity (pkgRoot points at
+  // the plugin, not this npm/manual copy). That is intentional — not actionable.
+  lines.push(
+    `✓ Package metadata  hypo-pkg.json plugin-owned (preserved — not rewritten in a dual install)`,
+  );
+} else if (dualSkip && pkgJson.status === 'missing') {
+  // Missing/corrupt in a dual install: there is no plugin identity to preserve, so
+  // `--apply` writes minimal fallback metadata (pointing at this same-version npm
+  // copy) — enough for the plugin runtime to resolve its scripts. The real fix is
+  // still to resolve the dual install.
+  lines.push(
+    `⚠ Package metadata  hypo-pkg.json missing/unreadable — \`--apply\` writes fallback metadata`,
+    `                    for this npm copy so the plugin runtime can resolve its scripts.`,
+    `                    Better: resolve the dual install (remove the npm/manual copy).`,
+  );
+} else if (pkgJson.status === 'up-to-date') {
   lines.push(`✓ Package metadata  hypo-pkg.json up to date`);
 } else if (pkgJson.status === 'stale') {
   lines.push(
@@ -1087,7 +1294,9 @@ const cmdMissCount = commands.filter((c) => c.status === 'missing').length;
 const cmdUserCount = userModifiedCommands.length;
 const cmdOrphanCount = orphanedCommands.length;
 const cmdNonRegCount = nonRegularCommands.length;
-if (commands.length === 0) {
+if (!managesClaudeCore) {
+  lines.push('✓ Slash commands    provided by the plugin loader (not ~/.claude/commands/hypo/)');
+} else if (commands.length === 0) {
   lines.push(`⚠ Slash commands    package commands/ is empty`);
 } else if (
   cmdStaleCount === 0 &&
@@ -1134,7 +1343,10 @@ function pushHookNameSummary(refs, label) {
     lines.push(`✓ ${colN}All hook references use current hypo-*.mjs names`);
   }
 }
-pushHookNameSummary(oldHookRefs, '');
+// In plugin mode the Claude settings.json is plugin-owned and --apply skips the
+// rename migration, so do not print a "run --apply to rename" instruction it will
+// not honor. (codex hook-name migration is unaffected by pluginMode.)
+if (managesClaudeCore) pushHookNameSummary(oldHookRefs, '');
 if (oldHookRefsCodex) pushHookNameSummary(oldHookRefsCodex, ' (codex)');
 
 // .hypoignore migration (ensure required runtime patterns are present)
@@ -1269,17 +1481,23 @@ pushAppliedExt(appliedExtensionsCodex, ' (codex)');
 
 // Summary
 lines.push('');
+// Claude core-surface item count — zeroed in plugin mode (plugin-managed), so the
+// summary never reads "N items need updating" for hooks/settings/commands.
+const claudeCoreCount = managesClaudeCore
+  ? staleHooks.length +
+    missingSettings.length +
+    (invalidSettings ? 1 : 0) +
+    oldHookRefs.length +
+    staleCommands.length +
+    userModifiedCommands.length +
+    orphanedCommands.length +
+    nonRegularCommands.length
+  : 0;
+
 const totalDrift =
-  staleHooks.length +
-  missingSettings.length +
-  (schemaDrift ? 1 : 0) +
-  (invalidSettings ? 1 : 0) +
+  claudeCoreCount +
   (pkgJsonDrift ? 1 : 0) +
-  oldHookRefs.length +
-  staleCommands.length +
-  userModifiedCommands.length +
-  orphanedCommands.length +
-  nonRegularCommands.length +
+  (schemaDrift ? 1 : 0) +
   (hypoignore.status === 'needs-migration' ? hypoignore.missing.length : 0) +
   extCheck.actions.filter(
     (a) => a.action === 'create' || a.action === 'update' || a.action === 'force-update',

package/templates/hypo-config.md

@@ -1,7 +1,7 @@
 ---
 title: Hypomnema Config
 type: config
-version: "1.3.0"
+version: "1.3.1"
 created: YYYY-MM-DD
 ---