hypomnema 1.4.0 → 1.4.2

package/scripts/crystallize.mjs

@@ -13,6 +13,11 @@
  *   --hypo-dir=<path>        Hypomnema root (default: resolved via HYPO_DIR / hypo-config.md / ~/hypomnema)
  *   --min-group=<n>          Min pages per tag group to report (default: 2)
  *   --check-session-close    Verify the strict session-close memory files — 5 mandatory + open-questions conditional
+ *   --project=<slug>         Override the recency-inferred project on --check / --mark (single segment
+ *                            [A-Za-z0-9._-]+, projects/<slug>/ must exist). On --check it NARROWS the
+ *                            gate to that one project — a project-scoped diagnostic, NOT a global
+ *                            compact-ready verdict. On --mark it is ATTRIBUTION only; the gate stays
+ *                            global (the marker == compact-ready invariant). Ignored on --apply.
  *   --apply-session-close    Apply a JSON payload that updates the 5 mandatory memory files
  *                            (+ optional open-questions). Idempotent — re-running with the same
  *                            payload is a no-op. Always finishes with the strict gate check.
@@ -31,13 +36,13 @@
  *
  * Payload schema:
  *   {
- *     "project":      "<slug>",                       // optional — defaults to resolveActiveProject()
+ *     "project":      "<slug>",                       // REQUIRED — single segment [A-Za-z0-9._-]+ (≥1 alnum, not dot-only), projects/<slug>/ dir must exist (B-3: no recency fallback for apply)
  *     "date":         "YYYY-MM-DD",                   // optional — defaults to today (local)
  *     "sessionState": { "content": "<full file>" },   // overwrite (idempotent: identical bytes → skip)
  *     "projectHot":   { "content": "<full file>" },   // overwrite
  *     "rootHot":      { "content": "<full file>" },   // overwrite
  *     "sessionLog":   { "entry":   "## [date] ..." }, // append, skip if heading already present
- *     "log":          { "entry":   "## [date] session | <project> ..." }, // append, skip if entry present
+ *     "log":          { "entry":   "## [date] session | <project> ..." }, // OPTIONAL (B-1): omit it and apply derives the root log.md entry from this close's sessionLog heading; supply it only for a deliberately custom log line
  *     "openQuestions":{ "content": "<full file>" }    // optional overwrite
  *   }
  *
@@ -60,7 +65,7 @@
  *     hard-fails regardless of scope.
  */
 
-import { existsSync, readFileSync, writeFileSync, mkdirSync, renameSync } from 'fs';
+import { existsSync, statSync, readFileSync, writeFileSync, mkdirSync, renameSync } from 'fs';
 import { join, dirname } from 'path';
 import { hostname } from 'os';
 import { spawnSync } from 'child_process';
@@ -68,6 +73,8 @@ import { fileURLToPath } from 'url';
 import { resolveHypoRoot, expandHome } from './lib/hypo-root.mjs';
 import { loadHypoIgnore } from './lib/hypo-ignore.mjs';
 import { collectPagesCrystallize, extractWikilinks } from './lib/wikilink.mjs';
+import { isValidProjectName } from './lib/project-create.mjs';
+import { appendPendingTags, checkForbidden } from './lib/schema-vocab.mjs';
 import {
   sessionCloseFileStatus,
   sessionCloseGlobalStatus,
@@ -79,12 +86,17 @@ import {
   sessionLogShardPath,
   sessionLogReadCandidates,
   sessionLogScopePath,
+  rootLogEntry,
   resolveTranscriptBySessionId,
   hasUserCloseSignal,
   commitWikiChanges,
 } from '../hooks/hypo-shared.mjs';
 
-const LINT_SCRIPT = join(dirname(fileURLToPath(import.meta.url)), 'lint.mjs');
+// This script's own absolute path. Used to print copy-pasteable recovery
+// commands as `node <SELF_SCRIPT> ...` rather than a bare `crystallize` bin,
+// which is not on PATH in a Claude Code plugin install (only in an npm global).
+const SELF_SCRIPT = fileURLToPath(import.meta.url);
+const LINT_SCRIPT = join(dirname(SELF_SCRIPT), 'lint.mjs');
 
 // Spawn lint.mjs --json against `hypoDir` and return parsed result.
 // We shell out instead of refactoring lint.mjs into a library because lint.mjs
@@ -133,6 +145,7 @@ function parseArgs(argv) {
     payload: null,
     force: false,
     transcriptPath: null,
+    project: null,
   };
   for (const arg of argv.slice(2)) {
     if (arg.startsWith('--hypo-dir=')) args.hypoDir = expandHome(arg.slice(11));
@@ -144,10 +157,23 @@ function parseArgs(argv) {
     else if (arg.startsWith('--session-id=')) args.sessionId = arg.slice(13);
     else if (arg.startsWith('--payload=')) args.payload = arg.slice(10);
     else if (arg.startsWith('--transcript-path=')) args.transcriptPath = expandHome(arg.slice(18));
+    else if (arg.startsWith('--project=')) args.project = arg.slice(10);
     else if (arg === '--force') args.force = true;
     else if (arg === '--json') args.json = true;
   }
   if (!args.hypoDir) args.hypoDir = resolveHypoRoot();
+  // --project=<slug> override (check/mark only). Validate the SYNTAX here so a
+  // traversal/charset attack (`--project=../x`) is rejected before any path is
+  // built from it — sessionCloseFileStatus(projectOverride) joins it directly.
+  // isValidProjectName is the SHARED validator (project-create.mjs), so the
+  // override accepts exactly the namespace createProject can scaffold. Existence
+  // (a real projects/<slug>/ directory) is checked in the run functions, where
+  // hypoDir is resolved and only the check/mark paths consume --project.
+  if (args.project != null && !isValidProjectName(args.project)) {
+    const msg = `--project "${args.project}" is not a valid project name (need a single segment with ≥1 alnum, charset A-Za-z0-9._-, not "."/"..")`;
+    console.log(args.json ? JSON.stringify({ ok: false, error: msg }, null, 2) : `✗ ${msg}`);
+    process.exit(1);
+  }
   return args;
 }
 
@@ -163,6 +189,20 @@ function parseArgs(argv) {
 // closed.) `--transcript-path` survives ONLY for `--check-session-close`'s lint
 // scope, which writes no marker and so cannot cause an over-close.
 
+// Validate that an explicit --project=<slug> override names a real project
+// DIRECTORY. Syntax was already checked in parseArgs; this is the existence half,
+// mirroring apply's payload.project check — a regular file or an absent dir at
+// projects/<slug> is a hard error so the override never silently resolves to an
+// all-missing status (which a reader would misread as "exists but incomplete").
+function requireProjectDir(args, slug) {
+  const projectDir = join(args.hypoDir, 'projects', slug);
+  if (!existsSync(projectDir) || !statSync(projectDir).isDirectory()) {
+    const msg = `--project "${slug}" does not exist as a directory (no projects/${slug}/ directory)`;
+    console.log(args.json ? JSON.stringify({ ok: false, error: msg }, null, 2) : `✗ ${msg}`);
+    process.exit(1);
+  }
+}
+
 // ── session-close check (spec §5.2.7 / §8.3) ────────────────────────
 // Mirrors the hard gate in hypo-personal-check.mjs so the /hypo:crystallize
 // flow can self-verify before /compact triggers PreCompact.
@@ -179,8 +219,21 @@ function runSessionCloseCheck(args) {
   // (marker_present:true) while `ok` still reflected the stale active project —
   // the completion-signal trio (PreCompact / --check / marker) would diverge
   // (codex design Finding 2).
+  //
+  // --project=<slug> narrows BOTH the close status and the lint scope to that one
+  // project: a project-scoped DIAGNOSTIC, NOT the global compact-ready verdict
+  // (ADR 0046 caveat below). It is check-only — the marker writers stay global so
+  // the marker == compact-ready invariant holds (ADR 0047). When narrowed, the
+  // transcript widening is suppressed: a transcript touch in some OTHER project
+  // would re-add that project's files to the lint scope and re-block the scoped
+  // check, defeating the point. The global (no --project) check keeps widening.
+  if (args.project) requireProjectDir(args, args.project);
   const status = precompactGateStatus(args.hypoDir, {
-    ...(args.transcriptPath ? { transcriptPath: args.transcriptPath } : {}),
+    ...(args.project
+      ? { projectOverride: args.project }
+      : args.transcriptPath
+        ? { transcriptPath: args.transcriptPath }
+        : {}),
     ...(args.sessionId ? { sessionId: args.sessionId } : {}),
   });
   const close = status.close;
@@ -198,9 +251,18 @@ function runSessionCloseCheck(args) {
   // while /compact's Stop still blocks — the exact incoherence this ADR closes
   // (codex pre-commit CONCERN). readSessionClosedMarker unlinks an invalid
   // marker as it reads, matching the hook's behavior on the next Stop.
-  const markerPresent = args.sessionId
-    ? readSessionClosedMarker(args.hypoDir, args.sessionId) !== null
-    : null;
+  const markerObj = args.sessionId ? readSessionClosedMarker(args.hypoDir, args.sessionId) : null;
+  const markerPresent = args.sessionId ? markerObj !== null : null;
+
+  // Scope of this check (codex design review finding 2 — the scope must be
+  // explicit in JSON + prose, not implied). `global` = the full PreCompact mirror
+  // (green ⇒ compact-ready). `project` = narrowed to --project=<slug> (green ⇒
+  // only THAT project is close-complete, NOT global compact-readiness). When a
+  // log-only marker governs the session, the gate runs in log-only mode and the
+  // --project override is IGNORED — surface that rather than implying X was
+  // checked (it was not).
+  const logOnlyWon = args.project != null && markerObj?.scope === 'log-only';
+  const scope = args.project ? (logOnlyWon ? 'log-only' : 'project') : 'global';
 
   if (args.json) {
     console.log(
@@ -215,6 +277,14 @@ function runSessionCloseCheck(args) {
           blockers: status.blockers,
           notices: status.notices,
           skipped: status.skipped,
+          // scope is additive; `global` keeps prior semantics for existing readers
+          scope,
+          ...(args.project
+            ? {
+                scoped_project: args.project,
+                ...(logOnlyWon ? { project_override_ignored: true } : {}),
+              }
+            : {}),
           ...(args.sessionId ? { session_id: args.sessionId, marker_present: markerPresent } : {}),
         },
         null,
@@ -224,8 +294,20 @@ function runSessionCloseCheck(args) {
     process.exit(status.ok ? 0 : 1);
   }
 
+  if (logOnlyWon) {
+    console.log(
+      `Note: a log-only session-closed marker governs session ${args.sessionId}, so the gate ran in log-only mode and --project=${args.project} was IGNORED (no project was checked).\n`,
+    );
+  } else if (scope === 'project') {
+    console.log(
+      `Note: --project=${args.project} — this is a PROJECT-SCOPED diagnostic, not the global /compact gate. A green result means only ${args.project} is close-complete; another project can still block /compact.\n`,
+    );
+  }
+
   const proj = close.project || '(unresolved)';
-  console.log(`Compact-ready check (project: ${proj}, date: ${close.dates.join(' / ')}):\n`);
+  console.log(
+    `Compact-ready check (${scope === 'global' ? `project: ${proj}` : `scope: ${scope}, project: ${proj}`}, date: ${close.dates.join(' / ')}):\n`,
+  );
 
   const required = close.project
     ? [
@@ -261,15 +343,25 @@ function runSessionCloseCheck(args) {
     console.log(
       markerPresent
         ? `  ✓ session-closed marker present (session_id: ${args.sessionId}).`
-        : `  · session-closed marker absent (session_id: ${args.sessionId}) — the Stop hook will block until it is written. Run \`crystallize --mark-session-closed --session-id=${args.sessionId}${args.transcriptPath ? ` --transcript-path=${args.transcriptPath}` : ''}\`.`,
+        : `  · session-closed marker absent (session_id: ${args.sessionId}) — the Stop hook will block until it is written. Run \`node "${SELF_SCRIPT}" --mark-session-closed --session-id=${args.sessionId}${args.transcriptPath ? ` --transcript-path="${args.transcriptPath}"` : ''}\`.`,
     );
   }
   console.log('');
-  console.log(
-    status.ok
-      ? '✓ Compact-ready — no PreCompact gate blocker needs a human fix. (open-questions.md: conditional, not checked. The live /compact can still differ on a context-≥70% prompt, HYPO_SKIP_GATE, or a transcript-scoped lint error this check did not see — pass --transcript-path to include the latter.)'
-      : '✗ Not compact-ready — resolve the ✗ items above, then retry. /compact would block on these.',
-  );
+  if (scope === 'project') {
+    // Project-scoped diagnostic: green means ONLY this project is close-complete.
+    // Do NOT claim global compact-readiness (the whole point of the narrow).
+    console.log(
+      status.ok
+        ? `✓ ${args.project} is close-complete (project-scoped). This is NOT a global /compact guarantee — run \`--check-session-close\` without --project for that.`
+        : `✗ ${args.project} is not close-complete — resolve the ✗ items above.`,
+    );
+  } else {
+    console.log(
+      status.ok
+        ? '✓ Compact-ready — no PreCompact gate blocker needs a human fix. (open-questions.md: conditional, not checked. The live /compact can still differ on a context-≥70% prompt, HYPO_SKIP_GATE, or a transcript-scoped lint error this check did not see — pass --transcript-path to include the latter.)'
+        : '✗ Not compact-ready — resolve the ✗ items above, then retry. /compact would block on these.',
+    );
+  }
   process.exit(status.ok ? 0 : 1);
 }
 
@@ -358,18 +450,19 @@ function todayLocal() {
   return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;
 }
 
-// Spec §5.2.7 / §8.3 + ADR 0029: 5 mandatory + 1 conditional. The payload
-// shape MUST mirror that contract — missing a mandatory field is a payload
-// bug, not a no-op. Caller is the LLM session-close flow, which composes the
-// payload deliberately; partial payloads must fail loudly so caller fixes them
-// rather than silently relying on yesterday's freshness state. (Codex review
-// of the apply path — Worker 1 finding 1.)
+// Spec §5.2.7 / §8.3 + ADR 0029: 4 mandatory + 2 optional (`log`, `openQuestions`).
+// The payload shape MUST mirror that contract — missing a mandatory field is a
+// payload bug, not a no-op. Caller is the LLM session-close flow, which composes
+// the payload deliberately; partial payloads must fail loudly so caller fixes
+// them rather than silently relying on yesterday's freshness state. (Codex review
+// of the apply path — Worker 1 finding 1.) `log` left the mandatory set in B-1:
+// the root log.md entry is a DERIVABLE artifact (rootLogEntry over this close's
+// sessionLog heading), so apply auto-fills it when the field is absent.
 const REQUIRED_PAYLOAD_FIELDS = [
   ['sessionState', 'content'],
   ['projectHot', 'content'],
   ['rootHot', 'content'],
   ['sessionLog', 'entry'],
-  ['log', 'entry'],
 ];
 
 function validatePayloadShape(payload) {
@@ -397,6 +490,11 @@ function validatePayloadShape(payload) {
       errs.push('payload.openQuestions, when present, must be { content: string }');
     }
   }
+  if (payload.log !== undefined) {
+    if (!payload.log || typeof payload.log !== 'object' || typeof payload.log.entry !== 'string') {
+      errs.push('payload.log, when present, must be { entry: string }');
+    }
+  }
   if (payload.date !== undefined && !/^\d{4}-\d{2}-\d{2}$/.test(String(payload.date))) {
     errs.push('payload.date, when present, must be YYYY-MM-DD');
   }
@@ -419,6 +517,14 @@ function runMarkSessionClosed(args) {
     console.log(args.json ? JSON.stringify({ ok: false, error: msg }, null, 2) : `✗ ${msg}`);
     process.exit(1);
   }
+  // --project=<slug> on --mark is ATTRIBUTION ONLY (the marker's `project` field).
+  // The gate stays GLOBAL — never narrowed — because a marker that narrowed its
+  // gate could attest compact-ready while PreCompact re-checks all of today's
+  // projects and stays red (the marker == compact-ready invariant, ADR 0047 /
+  // codex design finding 1/2). Validate the attribution slug exists as a
+  // directory, exactly as --check does, but only when it is actually used (a
+  // --log-only mark attributes to no project, so --project is moot there).
+  if (args.project && !args.logOnly) requireProjectDir(args, args.project);
   // ADR 0047: the per-session marker is the THIRD session-close completion
   // signal (after the PreCompact gate and `--check-session-close`). It must use
   // the SAME gate that governs /compact — precompactGateStatus — so the marker
@@ -484,8 +590,12 @@ function runMarkSessionClosed(args) {
     console.log(args.json ? JSON.stringify(result, null, 2) : `✗ ${reason}`);
     process.exit(1);
   }
+  // --project attributes the marker to that slug (gate stayed global); falls back
+  // to the gate's resolved primary. log-only marks attribute to no project. Used
+  // for the marker, the JSON result, and the success message so all three agree.
+  const markerProject = !args.logOnly && args.project ? args.project : status.project;
   writeSessionClosedMarker(args.hypoDir, args.sessionId, {
-    project: status.project,
+    project: markerProject,
     ...(args.logOnly ? { scope: 'log-only' } : {}),
   });
   // Marker writer swallows IO errors (best-effort, see hypo-shared.mjs). Verify
@@ -504,7 +614,7 @@ function runMarkSessionClosed(args) {
   const result = {
     ok: true,
     session_id: args.sessionId,
-    project: status.project,
+    project: markerProject,
     scope: args.logOnly ? 'log-only' : 'project',
     date: status.dates[0],
     notices: gate.notices,
@@ -520,7 +630,7 @@ function runMarkSessionClosed(args) {
     console.log(
       args.logOnly
         ? `✓ session-closed marker written (session_id: ${args.sessionId}, scope: log-only — no project attribution).`
-        : `✓ session-closed marker written (session_id: ${args.sessionId}, project: ${status.project}).`,
+        : `✓ session-closed marker written (session_id: ${args.sessionId}, project: ${markerProject}).`,
     );
     if (gate.driftTargets.length > 0) {
       console.log(
@@ -585,20 +695,48 @@ function applySessionClose(args) {
     process.exit(1);
   }
 
-  // Resolve project: explicit payload.project wins; else fall back to active project.
-  // Done via sessionCloseFileStatus to keep one source of truth (and so a
-  // missing pointer table surfaces the same error shape as --check-session-close).
+  // Resolve project: payload.project is REQUIRED (B-3, close-gate-hardening). The
+  // old recency fallback (payload.project || probe.project) could, on a same-date
+  // root-hot.md tie, resolve a DIFFERENT project than the one the payload's files
+  // belong to — apply would then write the close into the wrong project (silent
+  // data loss). Validate fail-fast, BEFORE the probe is consulted:
+  //   - missing      → no target to write; abort rather than infer.
+  //   - invalid name → reject (non-string, wrong charset, or dot-only) BEFORE the
+  //                    existsSync(join(...)) path build, so a `../`-style value
+  //                    never reaches a path builder (traversal guard — order is
+  //                    the guard). isValidProjectName is SHARED with createProject
+  //                    so apply accepts exactly the namespace the repo can
+  //                    scaffold (A-Za-z0-9._-, single segment) — no narrower.
+  //   - non-existent → projects/<slug>/ absent; abort rather than create.
+  // A payload.project that merely DIFFERS from the inferred active project is NOT an
+  // error — it is surfaced as a stderr note below and the close proceeds.
+  if (payload.project === undefined || payload.project === null) {
+    const msg = 'payload.project is required (apply must not infer the close target project)';
+    console.log(args.json ? JSON.stringify({ ok: false, error: msg }, null, 2) : `✗ ${msg}`);
+    process.exit(1);
+  }
+  if (!isValidProjectName(payload.project)) {
+    const msg = `payload.project ${JSON.stringify(payload.project)} is not a valid project name (single segment, charset A-Za-z0-9._-, ≥1 alnum, not "."/"..")`;
+    console.log(args.json ? JSON.stringify({ ok: false, error: msg }, null, 2) : `✗ ${msg}`);
+    process.exit(1);
+  }
+  // existsSync alone is not enough: a regular FILE at projects/<slug> would pass,
+  // then apply would build child paths under it and fail with an unstructured
+  // filesystem error (codex re-review). Require it to be a directory.
+  const projectDir = join(args.hypoDir, 'projects', payload.project);
+  if (!existsSync(projectDir) || !statSync(projectDir).isDirectory()) {
+    const msg = `payload.project "${payload.project}" does not exist as a directory (no projects/${payload.project}/ directory)`;
+    console.log(args.json ? JSON.stringify({ ok: false, error: msg }, null, 2) : `✗ ${msg}`);
+    process.exit(1);
+  }
+  const project = payload.project;
+  // probe (the recency-inferred active project) is now consulted ONLY to surface a
+  // divergence note — never to resolve the target. Computed AFTER validation so a
+  // malformed/missing payload.project fails fast without a pointer-table read.
   // Resolved BEFORE preflight because preflight needs overwrite-target paths
   // (which require the project slug) to filter out errors in files this apply
   // is about to replace — see the filter rationale below.
   const probe = sessionCloseFileStatus(args.hypoDir);
-  const project = payload.project || probe.project;
-  if (!project) {
-    const msg =
-      'no project resolved (payload.project missing and root hot.md has no active-project row)';
-    console.log(args.json ? JSON.stringify({ ok: false, error: msg }, null, 2) : `✗ ${msg}`);
-    process.exit(1);
-  }
   // The freshness verification below (and at the post-apply check) already honors
   // payload.project — `project` wins over the inferred active project, and the
   // post-apply sessionCloseFileStatus call passes it as projectOverride. But when the
@@ -606,7 +744,7 @@ function applySessionClose(args) {
   // (probe.project), that divergence used to be silent, so an operator couldn't tell
   // which project the close actually verified. Surface it on stderr (the stdout JSON
   // contract is untouched) so the verified/closed project is always explicit.
-  if (payload.project && probe.project && probe.project !== payload.project) {
+  if (probe.project && probe.project !== payload.project) {
     process.stderr.write(
       `note: payload.project="${payload.project}" differs from the inferred active ` +
         `project "${probe.project}"; verifying and closing "${payload.project}".\n`,
@@ -614,6 +752,23 @@ function applySessionClose(args) {
   }
   const date = payload.date || todayLocal();
 
+  // B-1 derive precondition: when `log` is omitted, apply reconstructs the root
+  // log.md entry from THIS close's sessionLog heading. If sessionLog.entry has no
+  // `## [<date>] …` heading there is nothing to derive — and on a same-day SECOND
+  // close the date-level freshness verifier would still pass on the earlier
+  // close's entry, so the no-write would slip through as ok:true. Fail loud here,
+  // before any writes (codex pre-commit review).
+  if (
+    !payload.log &&
+    !new RegExp(`^#{1,6} \\[${date}\\]`, 'm').test(payload.sessionLog.entry || '')
+  ) {
+    const msg =
+      `payload.sessionLog.entry has no "## [${date}] …" heading to derive the log.md ` +
+      `entry from. Give it a dated heading, or supply payload.log explicitly.`;
+    console.log(args.json ? JSON.stringify({ ok: false, error: msg }, null, 2) : `✗ ${msg}`);
+    process.exit(1);
+  }
+
   // Preflight: lint the wiki BEFORE writing any payload bytes. If lint
   // has blockers (errors) in files this apply WON'T overwrite, the wiki is in
   // a degraded state and apply would mask the root cause — abort fail-fast.
@@ -776,13 +931,43 @@ function applySessionClose(args) {
     }
   }
 
-  {
+  // log.md: `payload.log` is OPTIONAL (B-1). When the caller supplies it, keep
+  // the explicit appendIfAbsent path (backward-compat: a custom log line, with
+  // the same idempotent dedup). When it is ABSENT, the root log.md entry is a
+  // DERIVABLE artifact: reconstruct the canonical `## [date] session | <project>`
+  // line directly from THIS close's session-log heading (`payload.sessionLog`),
+  // not by re-reading the session-log files. Deriving from the payload is what
+  // makes the per-close entry exact: a same-day second close lands its distinct
+  // heading, and a hybrid daily/monthly session-log split can't hide it (apply
+  // never reads those files for this). The global scan-based deriveRootLogEntries
+  // (the Stop hook) still backfills OTHER projects; calling it here would either
+  // miss the current entry (single-candidate read) or, with a loosened guard,
+  // append onto a deliberately custom payload.log (codex pre-commit review). The
+  // two payload paths are mutually exclusive: deriving on top of a present-but-
+  // malformed payload.log would mask it and weaken the verifier's fail-loud.
+  if (payload.log) {
     const wrote = appendIfAbsent(
       join(args.hypoDir, 'log.md'),
       payload.log.entry,
       entryAlreadyPresent(payload.log.entry),
     );
     (wrote ? applied : skipped).push('log (log.md)');
+  } else {
+    // matchAll (not exec) mirrors deriveRootLogEntries: a payload that carried
+    // more than one dated heading derives one canonical line each, symmetric with
+    // the global path. Exact-line dedup on the heading keeps a second apply (or a
+    // titleless vs titled same-day pair) from duplicating.
+    const logFull = join(args.hypoDir, 'log.md');
+    const headingRe = new RegExp(`^#{1,6} \\[${date}\\]\\s*(.*)$`, 'gm');
+    let wroteAny = false;
+    for (const m of (payload.sessionLog.entry || '').matchAll(headingRe)) {
+      const { heading, block } = rootLogEntry(project, date, m[1]);
+      const wrote = appendIfAbsent(logFull, block, (c) =>
+        (c || '').split(/\r?\n/).includes(heading),
+      );
+      wroteAny = wroteAny || wrote;
+    }
+    (wroteAny ? applied : skipped).push('log (log.md, derived)');
   }
 
   // Same-date-tie fix: verify against the SAME project this apply just wrote
@@ -792,6 +977,29 @@ function applySessionClose(args) {
   // a completed close (the 2026-06-09 security-ops-kb incident).
   const verification = sessionCloseFileStatus(args.hypoDir, { projectOverride: project });
 
+  // B-4 auto-register: lift unknown (non-forbidden) tags surfaced by the PREFLIGHT
+  // lint into SCHEMA.md's `### Pending` section so the post-apply lint sees them as
+  // known and the close never stalls on a vocabulary gap. The W10 id is hidden in
+  // non-strict --json output (lint.mjs toOut), so the unknown-tag warns are matched
+  // and the tag extracted from the message string itself — kept in lockstep with
+  // lint.mjs's W10 emit (a copy-edit there breaks this; the close-path round-trip
+  // test guards it). Forbidden patterns stay hard errors and are filtered out.
+  // SCOPE (eventual consistency, intended): this registers PRE-EXISTING wiki debt
+  // visible at preflight, NOT a novel tag this very close's payload introduces —
+  // that one would surface only at post-apply and lands on the NEXT close. The
+  // contract is "must not stall", which warns (not errors) already satisfy; the
+  // registration just keeps the vocabulary catching up.
+  // The capture is anchored on the FULL message suffix (not `[^"]+`) so a tag that
+  // itself contains a `"` — non-forbidden, so reachable — is captured whole rather
+  // than truncated at its first quote (codex stage-2 CONCERN).
+  const unknownTagRe = /^Unknown tag: "(.+)" \(not in SCHEMA\.md Tag Vocabulary\)/;
+  const pendingTags = [];
+  for (const w of preflightLint.warns || []) {
+    const m = unknownTagRe.exec(w.message || '');
+    if (m && !checkForbidden(m[1])) pendingTags.push(m[1]);
+  }
+  if (pendingTags.length > 0) appendPendingTags(args.hypoDir, pendingTags);
+
   // Post-apply lint: payload may have introduced a malformed body or
   // bad frontmatter. Surface as a distinct `stage` so caller can tell "lint
   // broke" apart from "frontmatter stale". This runs even if the freshness gate
@@ -919,8 +1127,36 @@ function applySessionClose(args) {
     for (const a of applied) console.log(`  ✓ wrote ${a}`);
     for (const s of skipped) console.log(`  · skipped ${s} (already current)`);
     if (ok) {
-      console.log('\n✓ session-close verified — all 5 mandatory files fresh, lint clean.');
-    } else {
+      // When the marker was withheld, qualify the success line so a reader scanning
+      // stdout alone cannot mistake "verified" for "fully closed". markerSkipReason
+      // is non-null exactly when args.sessionId is set and the marker did not land.
+      if (markerSkipReason) {
+        console.log(
+          '\n✓ session-close files verified (all 5 mandatory files fresh, lint clean).' +
+            '\n  session NOT fully closed: the Stop-chain marker was not written (see warning below).',
+        );
+      } else {
+        console.log('\n✓ session-close verified — all 5 mandatory files fresh, lint clean.');
+      }
+    }
+    // When ok:true but the session-close marker was NOT written, the Stop-chain
+    // still sees an open session and will re-prompt at the next Stop. Surface this
+    // loudly so neither the human nor a skill-following model reads "ok:true" as
+    // "session fully closed". Gate on markerSkipReason (non-null exactly when
+    // args.sessionId is present and the marker was withheld).
+    if (markerSkipReason) {
+      process.stderr.write(
+        `\n⚠️  session-close marker NOT written (reason: ${markerSkipReason})\n` +
+          `    The 5 mandatory files were applied and verified (ok:true), but the\n` +
+          `    per-session Stop-chain marker was withheld. The session is NOT fully\n` +
+          `    closed: the Stop hook will re-prompt until the marker is present.\n` +
+          `    To fix: re-run with the correct main-conversation --session-id (NOT\n` +
+          `    a background task or Agent UUID from a /tmp/... path).\n` +
+          `    Example: crystallize.mjs --apply-session-close --payload=<path>\n` +
+          `             --session-id=<main-conversation-id> --hypo-dir=<path>\n`,
+      );
+    }
+    if (!ok) {
       if (!verification.ok) {
         const bad = [
           ...verification.missing.map((f) => `${f} (missing)`),