hypomnema 1.3.1 → 1.3.3

package/scripts/crystallize.mjs

@@ -12,16 +12,16 @@
  * Options:
  *   --hypo-dir=<path>        Hypomnema root (default: resolved via HYPO_DIR / hypo-config.md / ~/hypomnema)
  *   --min-group=<n>          Min pages per tag group to report (default: 2)
- *   --check-session-close    Verify the strict session-close memory files — 5 mandatory + open-questions conditional (fix #17)
+ *   --check-session-close    Verify the strict session-close memory files — 5 mandatory + open-questions conditional
  *   --apply-session-close    Apply a JSON payload that updates the 5 mandatory memory files
  *                            (+ optional open-questions). Idempotent — re-running with the same
  *                            payload is a no-op. Always finishes with the strict gate check.
  *
  *                            Without --payload, runs as a cheap "already complete?" probe:
  *                            if the strict gate is ok, exits 0 with alreadyComplete:true;
- *                            otherwise exits 1 with "payload is required". Fix #39 (option D):
+ *                            otherwise exits 1 with "payload is required". Option D:
  *                            payload presence = explicit close intent → always full apply
- *                            (fix #38's per-entry idempotency keeps re-apply cheap).
+ *                            (the per-entry idempotency keeps re-apply cheap).
  *   --payload=<path|->       Path to JSON payload (file or `-` for stdin). Required for any
  *                            apply work; omit only for the probe path above.
  *   --force                  Bypass the no-payload probe early-exit. Payload is still required
@@ -29,7 +29,7 @@
  *                            shortcut. Reserved for explicit diagnostics / scripted recovery.
  *   --json                   Output as JSON
  *
- * Payload schema (fix #38):
+ * Payload schema:
  *   {
  *     "project":      "<slug>",                       // optional — defaults to resolveActiveProject()
  *     "date":         "YYYY-MM-DD",                   // optional — defaults to today (local)
@@ -45,7 +45,7 @@
  * stale date, the final sessionCloseFileStatus check fails with a clear error so the
  * caller fixes the payload and retries. Silent rewrites would mask payload bugs.
  *
- * Lint gates (fix #40):
+ * Lint gates:
  *   • Preflight — runs `lint.mjs --json` BEFORE any payload byte is written.
  *     Errors in files this payload will OVERWRITE (sessionState/projectHot/
  *     rootHot/openQuestions) are filtered out — they're about to be replaced,
@@ -76,12 +76,18 @@ import { resolveHypoRoot, expandHome } from './lib/hypo-root.mjs';
 import { loadHypoIgnore, isIgnored } from './lib/hypo-ignore.mjs';
 import {
   sessionCloseFileStatus,
+  sessionCloseGlobalStatus,
+  precompactGateStatus,
   writeSessionClosedMarker,
   sessionClosedMarkerPath,
-  hypoIsClean,
-  extractTouchedWikiFiles,
-  closeFileTargets,
+  readSessionClosedMarker,
   partitionLintScope,
+  sessionLogShardPath,
+  sessionLogReadCandidates,
+  sessionLogScopePath,
+  resolveTranscriptBySessionId,
+  hasUserCloseSignal,
+  commitWikiChanges,
 } from '../hooks/hypo-shared.mjs';
 
 const LINT_SCRIPT = join(dirname(fileURLToPath(import.meta.url)), 'lint.mjs');
@@ -94,7 +100,7 @@ const LINT_SCRIPT = join(dirname(fileURLToPath(import.meta.url)), 'lint.mjs');
 // with valid JSON is a normal "errors present" signal, not a crash.
 // maxBuffer raised to 64 MiB: warn-only output on a large wiki can otherwise
 // trip Node's 1 MiB default, truncate stdout, and turn a clean wiki into a
-// JSON.parse crash (codex P3 — fix #40 follow-up).
+// JSON.parse crash (codex P3 follow-up).
 function runLint(hypoDir) {
   const r = spawnSync(process.execPath, [LINT_SCRIPT, `--hypo-dir=${hypoDir}`, '--json'], {
     encoding: 'utf-8',
@@ -103,8 +109,17 @@ function runLint(hypoDir) {
   try {
     return JSON.parse(r.stdout);
   } catch {
+    // Report diagnostic metadata (sizes, exit/signal, spawn error code, a stderr
+    // tail) instead of dumping the whole — possibly huge, possibly truncated —
+    // stdout. lint.mjs now sets exitCode and exits naturally so its stdout is no
+    // longer cut at the 64 KiB pipe boundary; if this still fires it signals a
+    // genuine crash, and these fields say which kind.
+    const stderrTail = (r.stderr || '').slice(-2000);
     throw new Error(
-      `lint helper produced unparseable output (exit=${r.status}):\n${r.stdout}\n${r.stderr}`,
+      `lint helper produced unparseable output ` +
+        `(exit=${r.status}, signal=${r.signal || 'none'}, ` +
+        `stdoutBytes=${(r.stdout || '').length}, spawnError=${r.error?.code || 'none'})` +
+        (stderrTail ? `\nstderr tail:\n${stderrTail}` : ''),
     );
   }
 }
@@ -119,6 +134,7 @@ function parseArgs(argv) {
     checkSessionClose: false,
     applySessionClose: false,
     markSessionClosed: false,
+    logOnly: false,
     sessionId: null,
     payload: null,
     force: false,
@@ -130,6 +146,7 @@ function parseArgs(argv) {
     else if (arg === '--check-session-close') args.checkSessionClose = true;
     else if (arg === '--apply-session-close') args.applySessionClose = true;
     else if (arg === '--mark-session-closed') args.markSessionClosed = true;
+    else if (arg === '--log-only') args.logOnly = true;
     else if (arg.startsWith('--session-id=')) args.sessionId = arg.slice(13);
     else if (arg.startsWith('--payload=')) args.payload = arg.slice(10);
     else if (arg.startsWith('--transcript-path=')) args.transcriptPath = expandHome(arg.slice(18));
@@ -140,22 +157,71 @@ function parseArgs(argv) {
   return args;
 }
 
+// ── session-close hard gate (ADR 0055) ───────────────────────────────────────
+// The marker attests "the USER closed this session". Its evidence transcript is
+// resolved STRICTLY from the session id (a globally-unique UUID) by globbing the
+// Claude project dirs — never from a CLI arg. A model owns the whole subprocess
+// invocation, so trusting a `--transcript-path` it supplies would let it point at
+// a forged `<session-id>.jsonl` it just wrote with a fake close phrase. Resolving
+// from the id alone closes that: the only file the glob finds is the live
+// transcript the harness itself maintains, which the model cannot author. (If the
+// model drops a second `<id>.jsonl` elsewhere the glob returns >1 and fails
+// closed.) `--transcript-path` survives ONLY for `--check-session-close`'s lint
+// scope, which writes no marker and so cannot cause an over-close.
+
 // ── session-close check (spec §5.2.7 / §8.3) ────────────────────────
 // Mirrors the hard gate in hypo-personal-check.mjs so the /hypo:crystallize
 // flow can self-verify before /compact triggers PreCompact.
 
 function runSessionCloseCheck(args) {
-  const status = sessionCloseFileStatus(args.hypoDir);
+  // ADR 0046: the check mirrors the FULL PreCompact gate via the shared
+  // precompactGateStatus (close files + lint + design-history + feedback
+  // projection), not just the close files — so a green check means /compact
+  // won't block on a human-fixable issue. Pass --transcript-path to widen the
+  // lint scope to the session's edited files exactly as the interactive hook
+  // does (without it, the scope is the mandatory close files only).
+  // Pass --session-id so a log-only marker activates log-only gate
+  // semantics here too. Without it the check would read the marker as present
+  // (marker_present:true) while `ok` still reflected the stale active project —
+  // the completion-signal trio (PreCompact / --check / marker) would diverge
+  // (codex design Finding 2).
+  const status = precompactGateStatus(args.hypoDir, {
+    ...(args.transcriptPath ? { transcriptPath: args.transcriptPath } : {}),
+    ...(args.sessionId ? { sessionId: args.sessionId } : {}),
+  });
+  const close = status.close;
+
+  // ADR 0047: when a --session-id is supplied, report whether THIS session's
+  // per-session marker (the Stop-chain completion signal) exists. This is a
+  // separate field, NOT folded into `ok` — `ok` stays the ADR 0046 compact-
+  // readiness verdict. A green gate with marker_present=false is exactly the
+  // hand-edit close state: close is compact-ready but the Stop hook will
+  // still block until the marker is written.
+  //
+  // Use the SAME reader the Stop hook gates on (readSessionClosedMarker), not
+  // raw file existence: a stale/corrupt marker file exists on disk but the hook
+  // rejects (and unlinks) it, so raw existsSync would report marker_present=true
+  // while /compact's Stop still blocks — the exact incoherence this ADR closes
+  // (codex pre-commit CONCERN). readSessionClosedMarker unlinks an invalid
+  // marker as it reads, matching the hook's behavior on the next Stop.
+  const markerPresent = args.sessionId
+    ? readSessionClosedMarker(args.hypoDir, args.sessionId) !== null
+    : null;
 
   if (args.json) {
     console.log(
       JSON.stringify(
         {
           ok: status.ok,
-          project: status.project,
-          dates: status.dates,
-          stale: status.stale,
-          missing: status.missing,
+          // flat close fields preserved for back-compat with prior readers
+          project: close.project,
+          dates: close.dates,
+          stale: close.stale,
+          missing: close.missing,
+          blockers: status.blockers,
+          notices: status.notices,
+          skipped: status.skipped,
+          ...(args.sessionId ? { session_id: args.sessionId, marker_present: markerPresent } : {}),
         },
         null,
         2,
@@ -164,31 +230,51 @@ function runSessionCloseCheck(args) {
     process.exit(status.ok ? 0 : 1);
   }
 
-  const proj = status.project || '(unresolved)';
-  console.log(`Session-close check (project: ${proj}, date: ${status.dates.join(' / ')}):\n`);
+  const proj = close.project || '(unresolved)';
+  console.log(`Compact-ready check (project: ${proj}, date: ${close.dates.join(' / ')}):\n`);
 
-  const required = status.project
+  const required = close.project
     ? [
-        `projects/${status.project}/session-state.md`,
-        `projects/${status.project}/hot.md`,
+        `projects/${close.project}/session-state.md`,
+        `projects/${close.project}/hot.md`,
         'hot.md',
-        `projects/${status.project}/session-log/${status.dates[0].slice(0, 7)}.md`,
+        sessionLogShardPath(close.project, close.dates[0]),
         'log.md',
       ]
     : [];
   for (const f of required) {
-    const bad = status.missing.includes(f) ? 'missing' : status.stale.includes(f) ? 'stale' : '';
+    const bad = close.missing.includes(f) ? 'missing' : close.stale.includes(f) ? 'stale' : '';
     console.log(`  ${bad ? '✗' : '✓'} ${f}${bad ? ` — ${bad}` : ''}`);
   }
   // Surface anything not covered by the canonical list (e.g. unresolved project).
-  for (const f of [...status.missing, ...status.stale]) {
+  for (const f of [...close.missing, ...close.stale]) {
     if (!required.includes(f)) console.log(`  ✗ ${f}`);
   }
+  // Beyond the close files: the rest of the PreCompact gate (lint, design-history,
+  // feedback over-cap/conflict). These are what made a "close-complete" check
+  // disagree with the real /compact gate before ADR 0046.
+  for (const b of status.blockers) {
+    if (b.type !== 'close') console.log(`  ✗ ${b.reason}`);
+  }
+  if (status.notices.length > 0) {
+    console.log('');
+    for (const n of status.notices) console.log(`  · ${n.reason}`);
+  }
+  // ADR 0047: surface the per-session marker state (separate from compact-
+  // readiness) so a green-but-unmarked close is visible at verify time.
+  if (args.sessionId) {
+    console.log('');
+    console.log(
+      markerPresent
+        ? `  ✓ session-closed marker present (session_id: ${args.sessionId}).`
+        : `  · session-closed marker absent (session_id: ${args.sessionId}) — the Stop hook will block until it is written. Run \`crystallize --mark-session-closed --session-id=${args.sessionId}${args.transcriptPath ? ` --transcript-path=${args.transcriptPath}` : ''}\`.`,
+    );
+  }
   console.log('');
   console.log(
     status.ok
-      ? '✓ All required memory files updated this session. (open-questions.md: conditional, not checked)'
-      : '✗ Session close incomplete — update the files marked above, then retry.',
+      ? '✓ Compact-ready — no PreCompact gate blocker needs a human fix. (open-questions.md: conditional, not checked. The live /compact can still differ on a context-≥70% prompt, HYPO_SKIP_GATE, or a transcript-scoped lint error this check did not see — pass --transcript-path to include the latter.)'
+      : '✗ Not compact-ready — resolve the ✗ items above, then retry. /compact would block on these.',
   );
   process.exit(status.ok ? 0 : 1);
 }
@@ -252,7 +338,7 @@ function writeIfChanged(path, content) {
 /**
  * Append `entry` to `path` only if `alreadyPresent(content)` is false.
  * Atomic: rebuilds the full file content and writes via atomicWrite — a crash
- * mid-append cannot leave log.md or session-log/YYYY-MM.md half-written, which
+ * mid-append cannot leave log.md or session-log/YYYY-MM-DD.md half-written, which
  * matters for these append-only history files.
  */
 function appendIfAbsent(path, entry, alreadyPresent) {
@@ -283,7 +369,7 @@ function todayLocal() {
 // bug, not a no-op. Caller is the LLM session-close flow, which composes the
 // payload deliberately; partial payloads must fail loudly so caller fixes them
 // rather than silently relying on yesterday's freshness state. (Codex review
-// of fix #38 — Worker 1 finding 1.)
+// of the apply path — Worker 1 finding 1.)
 const REQUIRED_PAYLOAD_FIELDS = [
   ['sessionState', 'content'],
   ['projectHot', 'content'],
@@ -329,8 +415,9 @@ function validatePayloadShape(payload) {
 // crystallize` is the only Reader; writer authority is intentionally split
 // between this CLI and the auto-write at the tail of applySessionClose.
 //
-// Contract: marker is only written when sessionCloseFileStatus(hypoDir).ok.
-// A failed check exits 1 with no marker — the next Stop hook will re-block.
+// Contract: the marker is written only when the FULL /compact gate
+// (precompactGateStatus, ADR 0046) is green. A failed gate exits 1 with no
+// marker — the next Stop hook re-blocks.
 
 function runMarkSessionClosed(args) {
   if (!args.sessionId) {
@@ -338,20 +425,39 @@ function runMarkSessionClosed(args) {
     console.log(args.json ? JSON.stringify({ ok: false, error: msg }, null, 2) : `✗ ${msg}`);
     process.exit(1);
   }
-  // ADR 0022 amendment 2026-05-19 Q2: marker write authority requires BOTH
-  // sessionCloseFileStatus.ok AND hypoIsClean.clean — git dirty would let a
-  // Stop hook pass while wiki changes are still uncommitted (auto-commit may
-  // have failed in this run). Codex Worker-1 BLOCKER (pre-commit review).
-  const status = sessionCloseFileStatus(args.hypoDir);
-  const git = hypoIsClean(args.hypoDir);
-  if (!status.ok || !git.clean) {
+  // ADR 0047: the per-session marker is the THIRD session-close completion
+  // signal (after the PreCompact gate and `--check-session-close`). It must use
+  // the SAME gate that governs /compact — precompactGateStatus — so the marker
+  // can never attest "closed" while /compact would still block. This subsumes
+  // the prior (sessionCloseGlobalStatus + hypoIsClean + scoped-lint) gate and
+  // additionally enforces feedback projection (over-cap/conflict), W8 design-
+  // history staleness, and root hot.md structure — the checks that the narrower
+  // marker gate skipped (the divergence behind this fix). git-clean is now a
+  // `git` blocker inside the gate. Pass --transcript-path to widen the lint
+  // scope to this session's edited files exactly as the interactive hook does;
+  // without it the scope is the mandatory close files only.
+  // --log-only marks a non-project (tooling / wiki-only) session as
+  // closed without attributing it to any project. The gate runs in log-only mode
+  // (project-close invariant → a today log.md entry; lint/W8 scoped to shared +
+  // touched files, never the active/phantom project), but git / hot / feedback
+  // still apply — log-only is NOT a global-gate bypass.
+  // Resolve the close transcript once from the session id (glob, never a CLI
+  // arg): it both widens the lint scope inside the gate AND is the evidence
+  // source for the user-close hard gate below.
+  const closeTranscript = resolveTranscriptBySessionId(args.sessionId);
+  const gate = precompactGateStatus(args.hypoDir, {
+    ...(closeTranscript ? { transcriptPath: closeTranscript } : {}),
+    ...(args.logOnly ? { logOnly: true } : {}),
+  });
+  const status = gate.close;
+  if (!gate.ok) {
     const result = {
       ok: false,
       session_id: args.sessionId,
       project: status.project,
       missing: status.missing,
       stale: status.stale,
-      git_reason: git.clean ? null : git.reason,
+      blockers: gate.blockers,
       error: 'session-close gate not satisfied — marker not written',
     };
     if (args.json) {
@@ -360,56 +466,34 @@ function runMarkSessionClosed(args) {
       console.log(
         `✗ session-close gate not satisfied — marker not written (project: ${status.project || '(unresolved)'}):`,
       );
-      for (const f of status.missing) console.log(`  ✗ ${f} (missing)`);
-      for (const f of status.stale) console.log(`  ✗ ${f} (stale)`);
-      if (!git.clean) console.log(`  ✗ git: ${git.reason}`);
+      for (const b of gate.blockers) console.log(`  ✗ ${b.reason}`);
     }
     process.exit(1);
   }
-  // Bug A coherence: the marker suppresses the Stop hook, but PreCompact blocks
-  // on lint. If a transcript is provided, refuse the marker when THIS session's
-  // own files (edited ∪ mandatory close files) carry lint errors — otherwise
-  // Stop would pass only for /compact to immediately re-block. No transcript →
-  // legacy freshness+git recovery path (lint left to PreCompact).
-  if (args.transcriptPath) {
-    let scopedLint = null;
-    try {
-      scopedLint = runLint(args.hypoDir);
-    } catch (err) {
-      // Lint crash → fail-open (never strand the marker writer on tooling), same
-      // posture as the PreCompact hook.
-      process.stderr.write(
-        `[crystallize] mark-session-closed lint skipped: ${err?.message ?? err}\n`,
-      );
-    }
-    if (scopedLint) {
-      const scope = new Set([
-        ...extractTouchedWikiFiles(args.transcriptPath, args.hypoDir),
-        ...closeFileTargets(args.hypoDir),
-      ]);
-      const { blocking } = partitionLintScope(scopedLint.errors || [], scope);
-      if (blocking.length > 0) {
-        const files = [...new Set(blocking.map((b) => b.file))];
-        const result = {
-          ok: false,
-          session_id: args.sessionId,
-          project: status.project,
-          lint_blockers: files,
-          error: "session-close gate not satisfied — lint errors in this session's files",
-        };
-        if (args.json) {
-          console.log(JSON.stringify(result, null, 2));
-        } else {
-          console.log(
-            `✗ lint errors in files this session touched — marker not written (fix then re-run):`,
-          );
-          for (const b of blocking) console.log(`  ✗ ${b.file}: ${b.message}`);
-        }
-        process.exit(1);
-      }
-    }
+  // User-close hard gate (ADR 0055): the compact gate above only proves the wiki
+  // is compact-ready; it does NOT prove the USER asked to close. Refuse the marker
+  // unless the transcript carries a genuine user close signal (NL close phrase,
+  // /compact, or an AskUserQuestion close answer). This is the hard backstop for
+  // model over-close, where prose guidance lost to a conflicting global rule.
+  // Fail-closed when the transcript can't be resolved.
+  if (!closeTranscript || !hasUserCloseSignal(closeTranscript)) {
+    const reason = !closeTranscript
+      ? `cannot resolve a transcript for session ${args.sessionId} — the session-closed marker requires a verifiable user close signal`
+      : "no user close signal in this session's transcript — marker refused (the user did not signal session close)";
+    const result = {
+      ok: false,
+      session_id: args.sessionId,
+      project: status.project,
+      skipReason: 'no-user-close-signal',
+      error: reason,
+    };
+    console.log(args.json ? JSON.stringify(result, null, 2) : `✗ ${reason}`);
+    process.exit(1);
   }
-  writeSessionClosedMarker(args.hypoDir, args.sessionId, { project: status.project });
+  writeSessionClosedMarker(args.hypoDir, args.sessionId, {
+    project: status.project,
+    ...(args.logOnly ? { scope: 'log-only' } : {}),
+  });
   // Marker writer swallows IO errors (best-effort, see hypo-shared.mjs). Verify
   // the file actually landed before claiming success — otherwise CLI exits 0
   // while next Stop re-blocks, hiding a permission/disk problem.
@@ -427,22 +511,36 @@ function runMarkSessionClosed(args) {
     ok: true,
     session_id: args.sessionId,
     project: status.project,
+    scope: args.logOnly ? 'log-only' : 'project',
     date: status.dates[0],
+    notices: gate.notices,
+    // ADR 0047: pure feedback-projection drift is a non-blocker — the marker
+    // attests "compact-ready (no human-fixable blocker)", and the PreCompact
+    // hook self-heals the projection (feedback-sync --write) at /compact. Surface
+    // the deferral so the caller knows MEMORY/CLAUDE sync is pending, not lost.
+    drift_deferred: gate.driftTargets,
   };
   if (args.json) {
     console.log(JSON.stringify(result, null, 2));
   } else {
     console.log(
-      `✓ session-closed marker written (session_id: ${args.sessionId}, project: ${status.project}).`,
+      args.logOnly
+        ? `✓ session-closed marker written (session_id: ${args.sessionId}, scope: log-only — no project attribution).`
+        : `✓ session-closed marker written (session_id: ${args.sessionId}, project: ${status.project}).`,
     );
+    if (gate.driftTargets.length > 0) {
+      console.log(
+        `  · feedback projection drift (${gate.driftTargets.join(', ')}) — will self-heal at /compact.`,
+      );
+    }
   }
   process.exit(0);
 }
 
 function applySessionClose(args) {
-  // Fix #39 (option D): early-exit fires only when NO payload was supplied.
+  // Option D: early-exit fires only when NO payload was supplied.
   // Rationale: payload presence is explicit close intent and must always run
-  // the full apply path — fix #38's per-entry idempotency (writeIfChanged +
+  // the full apply path — the per-entry idempotency (writeIfChanged +
   // exact-entry append dedup) keeps re-apply cheap without short-circuiting,
   // and avoids silent-success when a same-day second close brings new bytes.
   // Payload-less invocation is treated as a cheap "already complete?" probe.
@@ -450,7 +548,9 @@ function applySessionClose(args) {
   // for any actual apply work (readPayload below surfaces "payload is
   // required" the same way it always has).
   if (!args.force && !args.payload) {
-    const probe = sessionCloseFileStatus(args.hypoDir);
+    // ADR 0043: no-payload "already complete?" probe uses the
+    // global invariant, not a recency pick.
+    const probe = sessionCloseGlobalStatus(args.hypoDir);
     if (probe.ok) {
       const result = {
         ok: true,
@@ -505,10 +605,22 @@ function applySessionClose(args) {
     console.log(args.json ? JSON.stringify({ ok: false, error: msg }, null, 2) : `✗ ${msg}`);
     process.exit(1);
   }
+  // The freshness verification below (and at the post-apply check) already honors
+  // payload.project — `project` wins over the inferred active project, and the
+  // post-apply sessionCloseFileStatus call passes it as projectOverride. But when the
+  // payload targets a DIFFERENT project than the one active-project resolution infers
+  // (probe.project), that divergence used to be silent, so an operator couldn't tell
+  // which project the close actually verified. Surface it on stderr (the stdout JSON
+  // contract is untouched) so the verified/closed project is always explicit.
+  if (payload.project && probe.project && probe.project !== payload.project) {
+    process.stderr.write(
+      `note: payload.project="${payload.project}" differs from the inferred active ` +
+        `project "${probe.project}"; verifying and closing "${payload.project}".\n`,
+    );
+  }
   const date = payload.date || todayLocal();
-  const ym = date.slice(0, 7);
 
-  // Fix #40 preflight: lint the wiki BEFORE writing any payload bytes. If lint
+  // Preflight: lint the wiki BEFORE writing any payload bytes. If lint
   // has blockers (errors) in files this apply WON'T overwrite, the wiki is in
   // a degraded state and apply would mask the root cause — abort fail-fast.
   //
@@ -531,11 +643,27 @@ function applySessionClose(args) {
   // the files it writes (other projects, shared pages this close did not author).
   // payloadScope = every file this apply writes or appends. Both lint passes are
   // judged against it; errors elsewhere are surfaced as notices, never blocking.
+  //
+  // session-log needs TWO entries (ADR 0050): the daily WRITE target (what this
+  // apply creates/appends, judged by post-apply lint) AND the freshness EVIDENCE
+  // file. They coincide except in the hybrid cutover month, where a fallback-
+  // aware no-op (the identical entry already lives in the legacy monthly file)
+  // writes no daily shard, leaving the monthly as the proof of freshness. Scope
+  // must then include that monthly file, or a CORRUPT monthly evidence file would
+  // pass the gate with its lint error demoted to a non-blocking notice.
+  // sessionLogScopePath returns the monthly ONLY when it carries today's heading
+  // (otherwise the daily write target), so unrelated monthly debt stays a notice.
+  // join() (platform-native), not the POSIX helper output: payloadScope membership
+  // is tested against lint's raw `e.file` (path.relative) WITHOUT posix
+  // normalization, so it must use the OS-native separator the sibling entries use.
+  const sessionLogWriteTarget = join('projects', project, 'session-log', `${date}.md`);
+  const sessionLogEvidence = join(...sessionLogScopePath(args.hypoDir, project, date).split('/'));
   const payloadScope = new Set([
     join('projects', project, 'session-state.md'),
     join('projects', project, 'hot.md'),
     'hot.md',
-    join('projects', project, 'session-log', `${ym}.md`),
+    sessionLogWriteTarget,
+    sessionLogEvidence, // == write target, except a hybrid-month monthly fallback
     'log.md',
     ...(payload.openQuestions ? [join('pages', 'open-questions.md')] : []),
   ]);
@@ -590,18 +718,56 @@ function applySessionClose(args) {
   // dated today". The freshness gate (sessionCloseFileStatus) is what answers
   // "was this file touched today?"; that's a different concern and must not
   // be reused for apply-time dedup, or a legitimate same-day second close gets
-  // silently dropped (Codex review of fix #38 — Worker 1 finding 2).
+  // silently dropped (Codex review of the apply path — Worker 1 finding 2).
   const entryAlreadyPresent = (entry) => (content) =>
     content.includes(entry.endsWith('\n') ? entry.replace(/\n+$/, '') : entry);
 
   {
-    const rel = join('projects', project, 'session-log', `${ym}.md`);
-    const wrote = appendIfAbsent(
-      join(args.hypoDir, rel),
-      payload.sessionLog.entry,
-      entryAlreadyPresent(payload.sessionLog.entry),
-    );
-    (wrote ? applied : skipped).push(`sessionLog (${rel})`);
+    const rel = join('projects', project, 'session-log', `${date}.md`);
+    const full = join(args.hypoDir, rel);
+    const isPresent = entryAlreadyPresent(payload.sessionLog.entry);
+    // Fallback-aware idempotency (ADR 0050 hybrid cutover): during the month the
+    // shard takes over, today's entry may already live in the legacy monthly
+    // file from an earlier (pre-cutover) close. Treat presence in EITHER the
+    // daily shard or the legacy monthly file as "already written" so a same-day
+    // second close does not duplicate an identical entry across both files —
+    // and so an idempotent re-apply stays a true no-op (no shard is created).
+    let alreadyThere = false;
+    for (const cand of sessionLogReadCandidates(project, date)) {
+      const cf = join(args.hypoDir, cand);
+      if (!existsSync(cf)) continue;
+      try {
+        if (isPresent(readFileSync(cf, 'utf-8'))) {
+          alreadyThere = true;
+          break;
+        }
+      } catch {
+        /* unreadable candidate — fall through to the write path */
+      }
+    }
+    if (alreadyThere) {
+      skipped.push(`sessionLog (${rel})`);
+    } else if (!existsSync(full)) {
+      // A daily shard is a new file most days. Seed minimal valid frontmatter
+      // (title + type, the two REQUIRED_FIELDS) so the shard is a first-class
+      // wiki page rather than a W1 "no frontmatter" warning, and write the header
+      // AND the first entry in ONE atomic write — never leave a header-only shard
+      // on disk, which freshness would skip (no dated heading) while derive could
+      // otherwise mistake it for the evidence file. The dated `## [date] ...`
+      // heading lives inside the entry, so freshness / derive / design-history
+      // are unchanged.
+      const header =
+        `---\ntitle: Session Log ${date} (${project})\n` +
+        `type: session-log\nupdated: ${date}\n---\n\n` +
+        `# Session Log ${date} (${project})\n`;
+      const entry = payload.sessionLog.entry;
+      const body = entry.endsWith('\n') ? entry : `${entry}\n`;
+      atomicWrite(full, `${header}\n${body}`);
+      applied.push(`sessionLog (${rel})`);
+    } else {
+      const wrote = appendIfAbsent(full, payload.sessionLog.entry, isPresent);
+      (wrote ? applied : skipped).push(`sessionLog (${rel})`);
+    }
   }
 
   {
@@ -613,14 +779,14 @@ function applySessionClose(args) {
     (wrote ? applied : skipped).push('log (log.md)');
   }
 
-  // ISSUE-7 Part A: verify against the SAME project this apply just wrote
+  // Same-date-tie fix: verify against the SAME project this apply just wrote
   // (`project` = payload.project || probe.project, resolved at the top). Without
   // the override, sessionCloseFileStatus re-derives via resolveActiveProject and,
   // on a same-date root-hot.md tie, can pick a different project — false-failing
   // a completed close (the 2026-06-09 security-ops-kb incident).
   const verification = sessionCloseFileStatus(args.hypoDir, { projectOverride: project });
 
-  // Fix #40 post-apply lint: payload may have introduced a malformed body or
+  // Post-apply lint: payload may have introduced a malformed body or
   // bad frontmatter. Surface as a distinct `stage` so caller can tell "lint
   // broke" apart from "frontmatter stale". This runs even if the freshness gate
   // also failed — both failure modes are useful to the caller.
@@ -660,18 +826,61 @@ function applySessionClose(args) {
   // ADR 0022 amendment 2026-05-19: auto-write the per-session
   // closed marker on a verified close. Hook authority is read-only; this is
   // one of the two writer paths (the other is --mark-session-closed standalone).
-  // Marker requires BOTH file/lint gate (already in `ok`) AND clean git tree —
-  // ADR Q2 explicit. Auto-commit may have failed silently in the Stop chain;
-  // a dirty git would otherwise let the marker pass for an unrecorded close.
+  //
+  // ADR 0047: the marker write is governed by the SAME gate as standalone
+  // --mark-session-closed and /compact (precompactGateStatus), NOT just apply's
+  // `ok` + git-clean. Apply's payload preflight/post-apply lint and `ok` still
+  // govern apply SUCCESS (exit code below), but the marker must additionally
+  // clear feedback projection / W8 design-history / hot.md structure, else this
+  // path could issue a marker the standalone path would refuse (the second
+  // divergence codex flagged).
+  //
+  // ADR 0056: apply just wrote the payload, so the tree is dirty by its OWN
+  // writes — the gate's `uncommitted` git blocker would always trip and the
+  // marker would be skipped, deferring the close to a manual --mark-session-closed
+  // (the ADR 0047 "done but still blocked" regression). Commit the payload HERE, via
+  // the SAME .hypoignore-aware helper the auto-commit Stop hook uses, so the gate sees
+  // a committed tree. Push stays deferred to the Stop hook; the resulting
+  // committed-but-unpushed state is a gate notice, not a blocker (ADR 0056), so
+  // this still marks. A commit failure (not a repo / pre-commit reject / git error)
+  // skips the marker WITH a surfaced reason — today's behavior was also "no marker",
+  // but silently.
+  let markerWritten = false;
+  let markerSkipReason = null;
   if (ok && args.sessionId) {
-    const git = hypoIsClean(args.hypoDir);
-    if (git.clean) {
-      writeSessionClosedMarker(args.hypoDir, args.sessionId, { project });
+    const commitOutcome = commitWikiChanges(args.hypoDir);
+    if (!commitOutcome.committed) {
+      markerSkipReason = `commit-failed: ${commitOutcome.reason}`;
+    } else {
+      const closeTranscript = resolveTranscriptBySessionId(args.sessionId);
+      const markerGate = precompactGateStatus(
+        args.hypoDir,
+        closeTranscript ? { transcriptPath: closeTranscript } : {},
+      );
+      if (!markerGate.ok) {
+        // compact gate not ok → skip. Caller's `result.ok` already reflects the
+        // file/lint state; next Stop re-blocks until the remaining blocker
+        // (feedback/W8/hot/lint — git is now committed) is resolved.
+        markerSkipReason = 'compact-gate-not-ok';
+      } else if (!closeTranscript || !hasUserCloseSignal(closeTranscript)) {
+        // User-close hard gate (ADR 0055): apply succeeded (payload files written)
+        // but the user never signalled session close, so the marker — which attests
+        // "user closed" — is withheld. The wiki record stands; the session is simply
+        // not marked closed. Surfaced (not silent) so the caller knows.
+        markerSkipReason = closeTranscript ? 'no-user-close-signal' : 'transcript-unresolved';
+      } else {
+        writeSessionClosedMarker(args.hypoDir, args.sessionId, { project });
+        // Codex CONCERN (ADR 0055/0056): the writer swallows IO errors (best-effort).
+        // Verify the file actually landed — mirroring the standalone path — instead of
+        // asserting markerWritten=true, so a .cache permission/disk problem surfaces
+        // rather than the caller reporting "closed" while the next Stop re-blocks.
+        if (existsSync(sessionClosedMarkerPath(args.hypoDir, args.sessionId))) {
+          markerWritten = true;
+        } else {
+          markerSkipReason = 'marker-did-not-land';
+        }
+      }
     }
-    // git not clean → silent skip: caller's `result.ok` already reflects the
-    // file/lint state; surfacing a "marker skipped" warning here would
-    // confuse the close-applied success path. Next Stop re-blocks until
-    // git is clean (auto-commit retries on subsequent runs).
   }
   const stage = ok
     ? null
@@ -688,6 +897,9 @@ function applySessionClose(args) {
     applied,
     skipped,
     verification,
+    // ADR 0055: surface the marker outcome instead of skipping silently, so the
+    // caller can tell "closed" from "applied but not marked".
+    ...(args.sessionId ? { markerWritten, markerSkipReason } : {}),
     lint: { preflight: preflightLint, postApply: postApplyLint },
     // Pre-existing lint debt in files this close did not author (Bug B): surfaced
     // for visibility, never gated. Empty on a clean vault.