hypomnema 1.3.1 → 1.3.3

package/scripts/doctor.mjs

@@ -222,7 +222,7 @@ function checkDirectories(hypoDir) {
     'projects',
     'sources',
     // Extensions baseline (ADR 0024). Existence only — SHA / settings /
-    // manifest integrity is E5 (fix #33).
+    // manifest integrity is E5.
     'extensions/hooks',
     'extensions/commands',
     'extensions/skills',
@@ -310,7 +310,7 @@ function checkSettingsJson() {
   // stale hypo-* entries (uninstall remnants).
   // hypo-ext-* commands are user-extension entries (ADR 0024) — not core hooks,
   // so they are intentionally absent from HOOK_MAP. Excluded here; their
-  // integrity (SHA + manifest + entry match) is checked separately in E5 (fix #33).
+  // integrity (SHA + manifest + entry match) is checked separately in E5.
   const isExtCommand = (cmd) => /(?:^|[/\s])hypo-ext-[^/\s]+\.mjs(?=$|["'\s])/.test(cmd);
   const expectedCmds = new Set(
     Object.entries(HOOK_MAP).flatMap(([, files]) =>
@@ -352,7 +352,7 @@ function checkSettingsJson() {
       if (!g || typeof g !== 'object') continue;
       for (const h of g.hooks || []) {
         if (typeof h.command !== 'string' || !/hypo-[^/]+\.mjs/.test(h.command)) continue;
-        if (isExtCommand(h.command)) continue; // ext duplicates are E5's concern (fix #33)
+        if (isExtCommand(h.command)) continue; // ext duplicates are E5's concern
         if (seen.has(h.command)) dupes.push(`${event}:${h.command}`);
         else seen.add(h.command);
       }
@@ -399,10 +399,7 @@ function checkGit(hypoDir) {
       );
     }
   } else {
-    warn(
-      '.git/hooks/pre-commit',
-      'Not installed — run /hypo:init to install .hypoignore guard (fix #24)',
-    );
+    warn('.git/hooks/pre-commit', 'Not installed — run /hypo:init to install .hypoignore guard');
   }
 }
 
@@ -679,7 +676,7 @@ function checkCodexPaths() {
 //
 // E5 is doctor SURFACE for extensions integrity. The mixed-group surgical
 // *write* (preserve sibling-plugin hooks, swap only ours) used to be deferred
-// here; fix #47 (ADR 0024 amendment 2026-05-23) lifted that deferral —
+// here; ADR 0024 amendment 2026-05-23 lifted that deferral —
 // registerSettings (extensions.mjs:478 docstring) now does occurrence-first +
 // 8-rank canonical write, and the (b) loop below mirrors that read-path via
 // collectOurOccurrences so a valid mixed-group occurrence is no longer warned
@@ -773,7 +770,7 @@ function checkExtensions(hypoDir, claudeHome, target = 'claude') {
     const expected = buildExpectedSettingsEntries(discovered.hooks, hooksDir);
 
     // (b) for each registrable hook: locate every occurrence of our command
-    // (single-hook OR mixed group, fix #47) and pick the canonical via the
+    // (single-hook OR mixed group) and pick the canonical via the
     // SAME 8-rank logic registerSettings uses.
     // Without this mirror, doctor picked the first traversal-order occurrence
     // under the target event and warned "differs" even when a later

package/scripts/feedback-sync.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * feedback-sync.mjs — project wiki feedback as SoT, external memory as projection (ADR 0031, fix #37)
+ * feedback-sync.mjs — project wiki feedback as SoT, external memory as projection (ADR 0031)
  *
  * Wiki `pages/feedback/<slug>.md` is the single source of truth for
  * learning/correction knowledge. Two Claude Code memory surfaces are derived

package/scripts/init.mjs

@@ -928,7 +928,7 @@ if (args.hooks) {
   }
   for (const r of extResult.registered) log('merged', `extension ${r}`);
   for (const w of extResult.warnings) log('skipped', `extension: ${w}`);
-  // E3 (fix #31): a hard conflict (unowned/symlinked target) blocks install — surface
+  // E3: a hard conflict (unowned/symlinked target) blocks install — surface
   // the recovery and force a non-zero exit. Drift is advisory (resolvable, no block).
   if (extResult.conflicts.length > 0) {
     log('errors', '[WIKI: existing file conflicts. Backup and retry, or use --force-extensions]');

package/scripts/install-git-hooks.mjs

@@ -79,10 +79,39 @@ function shellSingleQuote(s) {
   return `'` + s.replace(/'/g, `'\\''`) + `'`;
 }
 
-function shimBody(root, gitDir) {
+// Hook-specific gate body. Runs AFTER the shared identity guards, so everything
+// here is already proven to be our trusted checkout. `set +e` is active, so the
+// gate must explicitly `|| exit 1` to BLOCK a commit; a missing script is a
+// fail-open skip (old checkout that predates the script).
+function gateLines(kind) {
+  // CHECK_TRACKER_ROOT is a test-only seam in check-tracker-ids.mjs. Clear any
+  // inherited value so the real hook always gates THIS checkout's index, never a
+  // redirected one.
+  const unsetSeam = 'unset CHECK_TRACKER_ROOT';
+  if (kind === 'pre-commit') {
+    // 1) Auto-format staged files (its own exit 1 = a true git-add failure block).
+    //    The sentinel tells pre-commit-format.mjs it runs under the trusted shim,
+    //    so it preserves an inherited GIT_INDEX_FILE (index-whitelist defence).
+    // 2) Tracker-id gate on the staged blobs — blocks the commit on a leak.
+    return `${unsetSeam}
+FMT="$HYPOMNEMA_ROOT/scripts/pre-commit-format.mjs"
+[ -f "$FMT" ] && { HYPOMNEMA_HOOK_INVOCATION=1 node "$FMT" || exit 1; }
+TRK="$HYPOMNEMA_ROOT/scripts/check-tracker-ids.mjs"
+[ -f "$TRK" ] && { node "$TRK" --staged || exit 1; }
+exit 0`;
+  }
+  // commit-msg: scan the message file (passed as $1) for wiki tracker ids.
+  return `${unsetSeam}
+TRK="$HYPOMNEMA_ROOT/scripts/check-tracker-ids.mjs"
+[ -f "$TRK" ] || exit 0
+node "$TRK" --commit-msg "$1" || exit 1
+exit 0`;
+}
+
+function shimBody(kind, root, gitDir) {
   return `#!/bin/sh
-# hypomnema-pre-commit-marker v1
-# Fail-open at every guard. Only the .mjs (after identity checks) can exit nonzero.
+# hypomnema-${kind}-marker v2
+# Fail-open at every identity/setup guard. Only the gate below can exit nonzero.
 set +e
 HYPOMNEMA_ROOT=${shellSingleQuote(root)}
 HYPOMNEMA_GIT_DIR=${shellSingleQuote(gitDir)}
@@ -91,28 +120,51 @@ TOPLEVEL="$(git rev-parse --show-toplevel 2>/dev/null)" || exit 0
 [ "$TOPLEVEL" = "$HYPOMNEMA_ROOT" ] || exit 0
 ABSGITDIR="$(git rev-parse --absolute-git-dir 2>/dev/null)" || exit 0
 [ "$ABSGITDIR" = "$HYPOMNEMA_GIT_DIR" ] || exit 0
-SCRIPT="$HYPOMNEMA_ROOT/scripts/pre-commit-format.mjs"
-[ -f "$SCRIPT" ] || exit 0
 command -v node >/dev/null 2>&1 || exit 0
-# Sentinel: tells the .mjs it is running under our trusted shim (not direct
-# attacker invocation). The .mjs preserves inherited GIT_INDEX_FILE only when
-# this sentinel is present — direct invocation drops it and falls back to the
-# default \`.git/index\`. This closes prefix-matching attacks on the index
-# whitelist (e.g. attacker-crafted .git/next-index-attack.lock).
-HYPOMNEMA_HOOK_INVOCATION=1 exec node "$SCRIPT"
+${gateLines(kind)}
 `;
 }
 
-function writeShim(target, root, gitDir) {
+// Write a single hook shim. Returns true on success, false on write failure.
+// Does NOT exit — the caller installs multiple hooks and reports once.
+function writeShim(target, kind, root, gitDir) {
   try {
-    fs.writeFileSync(target, shimBody(root, gitDir), { mode: 0o755 });
+    fs.writeFileSync(target, shimBody(kind, root, gitDir), { mode: 0o755 });
     try {
       fs.chmodSync(target, 0o755);
     } catch {}
-    return exitSilent(`installed pre-commit hook for ${root}`);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// Install/refresh one hook of the given kind under absHooksDir. Returns a short
+// status string (never throws, never exits). Refreshes our own marker (any
+// version) so a checkout move or a shim-body change re-propagates; never
+// clobbers a user's own non-marker hook or a symlink.
+function installHook(kind, absHooksDir, root, gitDir) {
+  const target = path.join(absHooksDir, kind);
+  let existing;
+  try {
+    existing = fs.lstatSync(target);
   } catch (e) {
-    return exitSilent(`write hook failed: ${e.code || e.message}; skipping`);
+    if (e.code === 'ENOENT') {
+      return writeShim(target, kind, root, gitDir) ? `installed ${kind}` : `write ${kind} failed`;
+    }
+    return `stat ${kind} failed: ${e.code}`;
+  }
+  if (existing.isSymbolicLink()) return `${kind} is symlink; not overwriting`;
+  let head;
+  try {
+    head = fs.readFileSync(target, 'utf-8').split('\n').slice(0, 3).join('\n');
+  } catch {
+    return `read ${kind} failed; skipping`;
   }
+  if (head.includes(`hypomnema-${kind}-marker`)) {
+    return writeShim(target, kind, root, gitDir) ? `refreshed ${kind}` : `refresh ${kind} failed`;
+  }
+  return `existing non-marker ${kind}; not overwriting`;
 }
 
 async function main() {
@@ -225,31 +277,14 @@ async function main() {
       return exitSilent('hooks dir outside .git/; skipping');
     }
 
-    // (7) Existing pre-commit logic.
-    const target = path.join(absHooksDir, 'pre-commit');
-    let existing;
-    try {
-      existing = fs.lstatSync(target);
-    } catch (e) {
-      if (e.code === 'ENOENT') {
-        return writeShim(target, expectedRoot, absGitDir);
-      }
-      return exitSilent(`stat target failed: ${e.code}; skipping`);
-    }
-    if (existing.isSymbolicLink()) {
-      return exitSilent('pre-commit is symlink; not overwriting');
-    }
-    let head;
-    try {
-      head = fs.readFileSync(target, 'utf-8').split('\n').slice(0, 3).join('\n');
-    } catch {
-      return exitSilent('read existing pre-commit failed; skipping');
-    }
-    if (head.includes('hypomnema-pre-commit-marker v1')) {
-      // Same marker — regenerate (refreshes embedded root if checkout moved).
-      return writeShim(target, expectedRoot, absGitDir);
-    }
-    return exitSilent('existing non-marker pre-commit; not overwriting');
+    // (7) Install both hooks: pre-commit (format + tracker-id gate on staged
+    //     blobs) and commit-msg (tracker-id gate on the message). Each is
+    //     independently marker-detected so a user's own hook is never clobbered.
+    const results = [
+      installHook('pre-commit', absHooksDir, expectedRoot, absGitDir),
+      installHook('commit-msg', absHooksDir, expectedRoot, absGitDir),
+    ];
+    return exitSilent(results.join('; '));
   } catch (e) {
     return exitSilent(`unexpected: ${e.code || e.message}; skipping`);
   }

package/scripts/lib/check-tracker-ids.mjs

@@ -0,0 +1,140 @@
+/**
+ * lib/check-tracker-ids.mjs — pure scanner for wiki-internal tracker IDs.
+ *
+ * The OSS repo must not ship references to the maintainer's PRIVATE wiki issue
+ * tracker (`ISSUE-N`) or fix tracker (`fix #N`) in public artifacts: an OSS user
+ * who opens a shipped file or reads the README/CHANGELOG just sees a dangling
+ * pointer into a tracker they cannot access. GitHub references (`PR #N`, `(#N)`,
+ * bare `#N`, issue URLs) are legitimate and must NOT be flagged.
+ *
+ * This module is PURE (no fs, no git, no process) so it is unit-testable; the
+ * CLI wrapper (scripts/check-tracker-ids.mjs) does the file/git/commit-msg I/O.
+ *
+ * Blocked (examples use an `N` placeholder, NOT a real digit, so this file
+ * itself scans clean and is NOT exempted from --all):
+ *   - /\bISSUE-\d+\b/i      → the wiki issue tracker, any case (e.g. ISSUE-N)
+ *   - /\bfix[ \t ]+#\d+\b/i → the wiki fix tracker, any case (e.g. fix #N)
+ *
+ * User-facing docs ONLY (README.md, README.ko.md, docs/) additionally block
+ * `ADR NNNN` / `decisions/NNNN` (USER_FACING_PATTERNS) — dangling pointers into the
+ * maintainer's private wiki ADR set. The CLI scope-gates these so shipped code
+ * comments and CHANGELOG history keep their ADR anchors.
+ *
+ * Accepted edge cases (documented, not bugs):
+ *   - FALSE POSITIVE: `FOO-ISSUE-N` matches (the `-` gives a word boundary
+ *     before ISSUE). Such a string in this repo would still be a tracker ref.
+ *   - The `fix #N` matcher requires the literal word `fix` immediately before the
+ *     `#`, so `prefix #N`, `suffix #N`, `PR #N`, `(#N)`, and bare `#N` are all
+ *     safe — none start the word `fix` right before the `#`.
+ */
+
+// Applied by the CLI to user-facing docs ONLY (README.md / README.ko.md / docs/),
+// never to shipped code or CHANGELOG. A `ADR NNNN` / `decisions/NNNN` reference in
+// prose a user reads points into the maintainer's private wiki ADR set, which the
+// user does not have — a dangling pointer. The same anchor inside a code comment
+// is maintainer rationale (kept), so this set is scope-gated rather than global.
+// Examples below use `NNNN`, not real digits, so this file scans clean.
+export const USER_FACING_PATTERNS = [
+  {
+    name: 'ADR NNNN',
+    label: 'wiki ADR pointer (user-facing docs)',
+    re: /\bADR[ \t]+\d{3,4}\b/gi,
+  },
+  {
+    name: 'decisions/NNNN',
+    label: 'wiki decisions path (user-facing docs)',
+    re: /\bdecisions\/\d{3,4}\b/gi,
+  },
+];
+
+// Each entry: a named, /g/i regex over a single line of text.
+export const BLOCKED_PATTERNS = [
+  {
+    name: 'ISSUE-N',
+    label: 'wiki issue-tracker id',
+    re: /\bISSUE-\d+\b/gi,
+  },
+  {
+    name: 'fix #N',
+    label: 'wiki fix-tracker id',
+    re: /\bfix[ \t ]+#\d+\b/gi,
+  },
+];
+
+/**
+ * Scan a blob of text against `patterns` (default BLOCKED_PATTERNS). Returns hits:
+ *   { pattern, label, match, line, col, lineText }
+ * `line`/`col` are 1-based. Empty array => clean. The CLI passes the broader
+ * [...BLOCKED_PATTERNS, ...USER_FACING_PATTERNS] set only for user-facing docs.
+ */
+export function scanText(text, patterns = BLOCKED_PATTERNS) {
+  if (typeof text !== 'string' || text.length === 0) return [];
+  const hits = [];
+  const lines = text.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const lineText = lines[i];
+    for (const { name, label, re } of patterns) {
+      re.lastIndex = 0; // reset shared /g regex between lines
+      let m;
+      while ((m = re.exec(lineText)) !== null) {
+        hits.push({
+          pattern: name,
+          label,
+          match: m[0],
+          line: i + 1,
+          col: m.index + 1,
+          lineText,
+        });
+        if (m.index === re.lastIndex) re.lastIndex++; // never-zero-width guard
+      }
+    }
+  }
+  return hits;
+}
+
+/**
+ * Strip a `--verbose` commit diff: everything from the scissors line onward is
+ * dropped by git before the commit is recorded, so it must not be scanned. The
+ * scissors art is comment-char-prefixed but the `>8` token is constant across
+ * comment chars, so match on that. Returns the text up to (excluding) the
+ * scissors line. If no scissors line is present, returns the input unchanged.
+ */
+// git's real scissors line is COMMENT-prefixed (`# ----- >8 -----`); a bare
+// `--- >8 ---` line is NOT a scissors marker (git keeps it as body), so it must
+// not trigger truncation. Require the leading comment char (default `#`, or `;`).
+const SCISSORS_RE = /^[ \t]*[#;][ \t]*-{2,}[ \t]*>8[ \t]*-{2,}/;
+
+export function stripScissors(text) {
+  if (typeof text !== 'string') return '';
+  const lines = text.split(/\r?\n/);
+  const idx = lines.findIndex((l) => SCISSORS_RE.test(l));
+  if (idx === -1) return text;
+  return lines.slice(0, idx).join('\n');
+}
+
+/**
+ * Does a commit-message file carry git's auto-generated template? git ONLY adds
+ * the instructional / status comment block (and the --verbose scissors) when the
+ * effective cleanup mode will STRIP comment lines (the editor default). In the
+ * comment-PRESERVING modes (`git commit -m` → whitespace, `--cleanup=verbatim`)
+ * git adds NO template, so a `#` line there is real committed content.
+ *
+ * The commit-msg hook therefore decides comment handling by template presence,
+ * not by config alone: template present ⇒ scan the strip-comments view (matches
+ * git, no false-positive on the template's branch/file names); template absent ⇒
+ * scan the raw view so a `#`-prefixed tracker id git WILL keep is still caught.
+ *
+ * Markers cover the default English git template + the scissors line. Other
+ * locales may miss the template and fall through to the raw (comment-keeping)
+ * scan — which is the SAFE direction for a gate (catches more, never less).
+ */
+export function messageHasGitTemplate(text) {
+  if (typeof text !== 'string') return false;
+  if (SCISSORS_RE_M.test(text)) return true; // --verbose scissors (comment-prefixed)
+  return /^[#;] *(Please enter the commit message|On branch |Changes to be committed:|Changes not staged for commit:|Untracked files:|Your branch (is|and))/m.test(
+    text,
+  );
+}
+
+// Multiline form of SCISSORS_RE for whole-message detection.
+const SCISSORS_RE_M = /^[ \t]*[#;][ \t]*-{2,}[ \t]*>8[ \t]*-{2,}/m;

package/scripts/lib/design-history-stale.mjs

@@ -1,21 +1,65 @@
 import { readFileSync, existsSync, readdirSync, statSync } from 'fs';
 import { join } from 'path';
 
-const SESSION_LOG_DATE_RE = /^## \[(\d{4}-\d{2}-\d{2})\]/gm;
+// session-log headings appear in two shapes in the wild: bracketed
+// `## [YYYY-MM-DD]` (spec convention) and bare `## YYYY-MM-DD` (some entries,
+// e.g. the 2026-06-08 SHIP entry). Two explicit branches instead of an
+// `\[?...\]?` optional — the optional form silently accepts malformed partial
+// brackets like `## [2026-06-08` and `## 2026-06-08]`, which we don't want to
+// treat as valid dated headings. The bare branch carries a `(?!\])` guard so a
+// trailing-only bracket (`## 2026-06-08]`) is rejected too — without it the
+// bare branch would match the date and ignore the stray `]` (codex review).
+const SESSION_LOG_HEADING_RE = /^## (?:\[(\d{4}-\d{2}-\d{2})\]|(\d{4}-\d{2}-\d{2})(?!\]))/gm;
 const DESIGN_HISTORY_DATE_RE = /^## (\d{4}-\d{2}-\d{2})/gm;
 
+// W8 false-positive fix (issue①): a session-log entry that explicitly declares
+// "no design change" (the crystallize #41 `ADR 없음` marker) must not count
+// toward design-history staleness — otherwise a no-design session pushes the
+// session-log date past design-history forever (treadmill), or a real design
+// session that forgot to append blocks correctly. We exclude an entry ONLY when
+// it carries the `ADR 없음` marker AND no ADR reference in the same block. If
+// both coexist (an ambiguous/contradictory entry), we include it — excluding it
+// would re-introduce the exact false-negative W8 exists to catch (codex review).
+const NO_ADR_MARKER_RE = /ADR\s*없음/;
+const ADR_REF_RE = /ADR\s+\d{4}|decisions\/\d{4}/;
+
+function isValidDate(literal) {
+  // The regex matches digit-shaped YYYY-MM-DD literals but cannot reject
+  // semantically invalid ones like 2026-13-01 or 2026-02-30. JavaScript's Date
+  // constructor returns an Invalid Date for those, which would later crash
+  // `toISOString()` with RangeError and poison `>` comparisons inside maxDate.
+  // Filter at the parse boundary so callers never see one.
+  return !Number.isNaN(new Date(literal).getTime());
+}
+
 function parseDates(text, pattern) {
   const dates = [];
   pattern.lastIndex = 0;
   let m;
   while ((m = pattern.exec(text)) !== null) {
-    // The regex matches digit-shaped YYYY-MM-DD literals but cannot reject
-    // semantically invalid ones like 2026-13-01 or 2026-02-30. JavaScript's
-    // Date constructor returns an Invalid Date for those, which would later
-    // crash `toISOString()` with RangeError and poison `>` comparisons inside
-    // maxDate. Filter at the parse boundary so callers never see one.
-    const d = new Date(m[1]);
-    if (!Number.isNaN(d.getTime())) dates.push(d);
+    if (isValidDate(m[1])) dates.push(new Date(m[1]));
+  }
+  return dates;
+}
+
+// Parse session-log dates entry-by-entry, skipping no-design-change entries.
+// Entries are sliced by heading start-index (not a single `$`-anchored block
+// regex — multiline `$` terminates at line ends, not true EOF, so the last
+// entry would be truncated). The last entry runs to EOF.
+function parseSessionDates(text) {
+  const headings = [];
+  SESSION_LOG_HEADING_RE.lastIndex = 0;
+  let m;
+  while ((m = SESSION_LOG_HEADING_RE.exec(text)) !== null) {
+    headings.push({ literal: m[1] ?? m[2], start: m.index });
+  }
+  const dates = [];
+  for (let i = 0; i < headings.length; i++) {
+    const body = text.slice(headings[i].start, headings[i + 1]?.start ?? text.length);
+    // Exclude only an explicit no-design-change entry. An entry carrying both
+    // the marker and an ADR reference is treated as a design entry (included).
+    if (NO_ADR_MARKER_RE.test(body) && !ADR_REF_RE.test(body)) continue;
+    if (isValidDate(headings[i].literal)) dates.push(new Date(headings[i].literal));
   }
   return dates;
 }
@@ -43,21 +87,22 @@ export function findDesignHistoryStale(hypoDir) {
     const dhPath = join(projectDir, 'design-history.md');
     if (!existsSync(dhPath)) continue;
 
-    // session-log can live as a flat `session-log.md` (legacy) or a directory
-    // `session-log/YYYY-MM.md` (spec §5.2.7 canonical). Aggregate dates from
-    // whichever shape is present — both forms appear in the wild and the
-    // staleness check needs to see all of them.
+    // session-log can live as a flat `session-log.md` (legacy) or a directory of
+    // daily shards `session-log/YYYY-MM-DD.md` (ADR 0050 canonical; legacy
+    // monthly `YYYY-MM.md` files still appear pre-cutover). This globs every
+    // `.md` in the directory, so daily and monthly shapes are both aggregated —
+    // the staleness check needs to see all of them.
     const sessionDates = [];
     const flatSlPath = join(projectDir, 'session-log.md');
     if (existsSync(flatSlPath)) {
-      sessionDates.push(...parseDates(readFileSync(flatSlPath, 'utf-8'), SESSION_LOG_DATE_RE));
+      sessionDates.push(...parseSessionDates(readFileSync(flatSlPath, 'utf-8')));
     }
     const dirSlPath = join(projectDir, 'session-log');
     if (existsSync(dirSlPath) && statSync(dirSlPath).isDirectory()) {
       for (const entry of readdirSync(dirSlPath)) {
         if (!entry.endsWith('.md')) continue;
         const text = readFileSync(join(dirSlPath, entry), 'utf-8');
-        sessionDates.push(...parseDates(text, SESSION_LOG_DATE_RE));
+        sessionDates.push(...parseSessionDates(text));
       }
     }
     if (sessionDates.length === 0) continue;

package/scripts/lib/extensions.mjs

@@ -1,5 +1,5 @@
 /**
- * scripts/lib/extensions.mjs — User extensions companion sync (ADR 0024, fix #29 + #30).
+ * scripts/lib/extensions.mjs — User extensions companion sync (ADR 0024).
  *
  * `~/hypomnema/extensions/{hooks,commands,skills,agents}/` holds user-authored
  * extensions, git-tracked alongside the wiki. init/upgrade hard-copy them into
@@ -80,7 +80,7 @@ function pkgRootDir(target) {
 
 /**
  * Discover sync-eligible extensions under `extDir`. Returns a per-type map plus a
- * `warnings` array. Applies the `.hypoignore` filter (fix #30), the basename
+ * `warnings` array. Applies the `.hypoignore` filter, the basename
  * whitelist (plan §5 #9), and pairs each file with its optional `<name>.manifest.json`.
  * No-ops gracefully when extDir is absent (e.g. --from-remote clones, plan §5 #8).
  */
@@ -364,7 +364,7 @@ export function syncExtensions({
   const discovered = discoverExtensions(extDir, patterns, hypoDir);
   result.warnings.push(...discovered.warnings);
 
-  // E4 (fix #32): Codex supports hooks + commands only. If the user authored
+  // E4: Codex supports hooks + commands only. If the user authored
   // skills/agents extensions, surface a one-time notice that they are skipped
   // for this target rather than silently dropping them (plan §2 E4).
   if (target === 'codex') {
@@ -505,7 +505,7 @@ export function syncExtensions({
  *   7. non-target event · mixed                                        (extract + append new)
  *   8. no occurrence                                                   (append new)
  *
- * Mixed-group invariant (fix #47, ADR 0024 amendment 2026-05-23): foreign hooks
+ * Mixed-group invariant (ADR 0024 amendment 2026-05-23): foreign hooks
  * sharing the matcher group are NEVER read, modified, or reordered. The hosting
  * group's matcher is also left exactly as-is once we extract — even when our
  * extraction is the reason the group becomes single-foreign. Foreign handler-

package/scripts/lib/fix-manifest.mjs

@@ -76,10 +76,10 @@ export const FIX_MANIFEST = [
     // deliberate removal-marker comment + the negative-control test.
     fixId: 26,
     testNames: [
-      'replay-personal-check-bypass-order: wiki-context-critical.json does NOT bypass (fix #26 negative control)',
+      'replay-personal-check-bypass-order: wiki-context-critical.json does NOT bypass (negative control)',
     ],
     adrPath: 'decisions/0022-session-close-ux-automation.md',
-    adrKeyLine: 'Capacity bypass (≥90%) REMOVED — fix #26',
+    adrKeyLine: 'Capacity bypass (≥90%) REMOVED',
   },
   {
     fixId: 27,

package/scripts/lib/fix-status-verify.mjs

@@ -27,8 +27,8 @@ const NEGATIVE_STATUS_TOKENS = ['STALE_MERGED', 'partial', 'retired'];
 /**
  * Parse anchor comments out of runner.mjs source text.
  *
- *   // @fix #15: all type-conditional fields present → green
- *   // @fix #15: another test name
+ *   // @fix #N: all type-conditional fields present → green
+ *   // @fix #N: another test name
  *
  * The `@fix` prefix is mandatory — distinguishes anchors from prose comments
  * that mention "fix #N" in passing. Each anchor line maps ONE fix # to ONE
@@ -79,8 +79,9 @@ export function parseStatus(specText) {
   // For each line, find every fix # mention and check whether a positive
   // status token sits within a small proximity window AFTER the mention. This
   // avoids false positives when a line mentions multiple fix #s with status
-  // tokens that only apply to some of them (e.g. "fix #38 (resolved); fix #41
-  // (v1.3.0 advisory)" — only #38 should be picked up).
+  // tokens that only apply to some of them (e.g. a line where the first
+  // mention is "(resolved)" and a later one is "(advisory)" — only the first
+  // should be picked up).
   const lines = specText.split('\n');
   const PROXIMITY = 120; // chars after fix # to scan for status
   for (const line of lines) {

package/scripts/lib/plugin-detect.mjs

@@ -1,6 +1,6 @@
 // Detect whether the Hypomnema Claude Code plugin is enabled in a settings.json.
 //
-// ISSUE-8 (dual-install guard): the manual/npm `upgrade.mjs` must know when the
+// Dual-install guard: the manual/npm `upgrade.mjs` must know when the
 // plugin is ALSO enabled, because the plugin loader already provides the core
 // hooks/commands/settings — copying+registering them from a manual/npm `--apply`
 // would double-register every hook.
@@ -9,14 +9,19 @@
 // positive blocks/alters a legitimate npm-only user's upgrade, which is worse
 // than the rare dual-install double-register it guards against. So it fails open
 // (returns false) on every uncertainty and only fires on an exact, well-formed
-// `enabledPlugins` entry whose plugin name is precisely `hypomnema`.
+// `enabledPlugins` entry whose plugin name is precisely `hypo` (the current
+// plugin name) or `hypomnema` (the legacy name, pre-rename). Both are matched so
+// the guard survives the rename's migration window: an existing user keeps the
+// legacy `hypomnema@<marketplace>` key in `enabledPlugins` until they reinstall
+// as `hypo@<marketplace>`, and the guard must hold across that gap.
 
 import { readFileSync } from 'node:fs';
 
 /**
  * @param {string} settingsPath  path to a Claude Code settings.json (e.g. ~/.claude/settings.json)
  * @returns {boolean} true iff `enabledPlugins` contains a key shaped
- *   `hypomnema@<marketplace>` whose value is strictly `true`.
+ *   `hypo@<marketplace>` (or the legacy `hypomnema@<marketplace>`) whose value
+ *   is strictly `true`.
  */
 export function isHypomnemaPluginEnabled(settingsPath) {
   let raw;
@@ -41,11 +46,15 @@ export function isHypomnemaPluginEnabled(settingsPath) {
   for (const [key, value] of Object.entries(enabled)) {
     if (value !== true) continue; // strictly true only — no truthy coercion
     // Require a real `name@marketplace` shape: an `@` that is neither the first
-    // nor the last char. A bare `"hypomnema": true` (no marketplace) must NOT
-    // trigger — that is not a valid enabledPlugins identifier.
+    // nor the last char. A bare `"hypo": true` / `"hypomnema": true` (no
+    // marketplace) must NOT trigger — that is not a valid enabledPlugins
+    // identifier.
     const at = key.indexOf('@');
     if (at <= 0 || at === key.length - 1) continue;
-    if (key.slice(0, at) === 'hypomnema') return true; // exact, case-sensitive
+    const name = key.slice(0, at);
+    // Match the current plugin name and the legacy one (pre-rename) so the
+    // guard holds across the migration window. Exact, case-sensitive.
+    if (name === 'hypo' || name === 'hypomnema') return true;
   }
   return false;
 }

package/scripts/lib/project-create.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * project-create.mjs — atomic auto-project scaffold (fix #23, ADR 0023)
+ * project-create.mjs — atomic auto-project scaffold (ADR 0023)
  *
  * Invoked by the LLM (NOT a user-facing subcommand — ADR 0023 deprecated
  * `hypomnema project new`) after the user answers "Y" to a SessionStart /