hypomnema 1.4.1 → 1.5.0

package/scripts/crystallize.mjs

@@ -13,6 +13,11 @@
  *   --hypo-dir=<path>        Hypomnema root (default: resolved via HYPO_DIR / hypo-config.md / ~/hypomnema)
  *   --min-group=<n>          Min pages per tag group to report (default: 2)
  *   --check-session-close    Verify the strict session-close memory files — 5 mandatory + open-questions conditional
+ *   --project=<slug>         Override the recency-inferred project on --check / --mark (single segment
+ *                            [A-Za-z0-9._-]+, projects/<slug>/ must exist). On --check it NARROWS the
+ *                            gate to that one project — a project-scoped diagnostic, NOT a global
+ *                            compact-ready verdict. On --mark it is ATTRIBUTION only; the gate stays
+ *                            global (the marker == compact-ready invariant). Ignored on --apply.
  *   --apply-session-close    Apply a JSON payload that updates the 5 mandatory memory files
  *                            (+ optional open-questions). Idempotent — re-running with the same
  *                            payload is a no-op. Always finishes with the strict gate check.
@@ -31,13 +36,13 @@
  *
  * Payload schema:
  *   {
- *     "project":      "<slug>",                       // optional — defaults to resolveActiveProject()
+ *     "project":      "<slug>",                       // REQUIRED — single segment [A-Za-z0-9._-]+ (≥1 alnum, not dot-only), projects/<slug>/ dir must exist (B-3: no recency fallback for apply)
  *     "date":         "YYYY-MM-DD",                   // optional — defaults to today (local)
  *     "sessionState": { "content": "<full file>" },   // overwrite (idempotent: identical bytes → skip)
  *     "projectHot":   { "content": "<full file>" },   // overwrite
  *     "rootHot":      { "content": "<full file>" },   // overwrite
  *     "sessionLog":   { "entry":   "## [date] ..." }, // append, skip if heading already present
- *     "log":          { "entry":   "## [date] session | <project> ..." }, // append, skip if entry present
+ *     "log":          { "entry":   "## [date] session | <project> ..." }, // OPTIONAL (B-1): omit it and apply derives the root log.md entry from this close's sessionLog heading; supply it only for a deliberately custom log line
  *     "openQuestions":{ "content": "<full file>" }    // optional overwrite
  *   }
  *
@@ -60,7 +65,7 @@
  *     hard-fails regardless of scope.
  */
 
-import { existsSync, readFileSync, writeFileSync, mkdirSync, renameSync } from 'fs';
+import { existsSync, statSync, readFileSync, writeFileSync, mkdirSync, renameSync } from 'fs';
 import { join, dirname } from 'path';
 import { hostname } from 'os';
 import { spawnSync } from 'child_process';
@@ -68,6 +73,8 @@ import { fileURLToPath } from 'url';
 import { resolveHypoRoot, expandHome } from './lib/hypo-root.mjs';
 import { loadHypoIgnore } from './lib/hypo-ignore.mjs';
 import { collectPagesCrystallize, extractWikilinks } from './lib/wikilink.mjs';
+import { isValidProjectName } from './lib/project-create.mjs';
+import { appendPendingTags, checkForbidden } from './lib/schema-vocab.mjs';
 import {
   sessionCloseFileStatus,
   sessionCloseGlobalStatus,
@@ -76,15 +83,21 @@ import {
   sessionClosedMarkerPath,
   readSessionClosedMarker,
   partitionLintScope,
+  isUnderProjectDirs,
   sessionLogShardPath,
   sessionLogReadCandidates,
   sessionLogScopePath,
+  rootLogEntry,
   resolveTranscriptBySessionId,
   hasUserCloseSignal,
   commitWikiChanges,
 } from '../hooks/hypo-shared.mjs';
 
-const LINT_SCRIPT = join(dirname(fileURLToPath(import.meta.url)), 'lint.mjs');
+// This script's own absolute path. Used to print copy-pasteable recovery
+// commands as `node <SELF_SCRIPT> ...` rather than a bare `crystallize` bin,
+// which is not on PATH in a Claude Code plugin install (only in an npm global).
+const SELF_SCRIPT = fileURLToPath(import.meta.url);
+const LINT_SCRIPT = join(dirname(SELF_SCRIPT), 'lint.mjs');
 
 // Spawn lint.mjs --json against `hypoDir` and return parsed result.
 // We shell out instead of refactoring lint.mjs into a library because lint.mjs
@@ -133,6 +146,7 @@ function parseArgs(argv) {
     payload: null,
     force: false,
     transcriptPath: null,
+    project: null,
   };
   for (const arg of argv.slice(2)) {
     if (arg.startsWith('--hypo-dir=')) args.hypoDir = expandHome(arg.slice(11));
@@ -144,14 +158,27 @@ function parseArgs(argv) {
     else if (arg.startsWith('--session-id=')) args.sessionId = arg.slice(13);
     else if (arg.startsWith('--payload=')) args.payload = arg.slice(10);
     else if (arg.startsWith('--transcript-path=')) args.transcriptPath = expandHome(arg.slice(18));
+    else if (arg.startsWith('--project=')) args.project = arg.slice(10);
     else if (arg === '--force') args.force = true;
     else if (arg === '--json') args.json = true;
   }
   if (!args.hypoDir) args.hypoDir = resolveHypoRoot();
+  // --project=<slug> override (check/mark only). Validate the SYNTAX here so a
+  // traversal/charset attack (`--project=../x`) is rejected before any path is
+  // built from it — sessionCloseFileStatus(projectOverride) joins it directly.
+  // isValidProjectName is the SHARED validator (project-create.mjs), so the
+  // override accepts exactly the namespace createProject can scaffold. Existence
+  // (a real projects/<slug>/ directory) is checked in the run functions, where
+  // hypoDir is resolved and only the check/mark paths consume --project.
+  if (args.project != null && !isValidProjectName(args.project)) {
+    const msg = `--project "${args.project}" is not a valid project name (need a single segment with ≥1 alnum, charset A-Za-z0-9._-, not "."/"..")`;
+    console.log(args.json ? JSON.stringify({ ok: false, error: msg }, null, 2) : `✗ ${msg}`);
+    process.exit(1);
+  }
   return args;
 }
 
-// ── session-close hard gate (ADR 0055) ───────────────────────────────────────
+// ── session-close hard gate ───────────────────────────────────────────────────
 // The marker attests "the USER closed this session". Its evidence transcript is
 // resolved STRICTLY from the session id (a globally-unique UUID) by globbing the
 // Claude project dirs — never from a CLI arg. A model owns the whole subprocess
@@ -163,12 +190,26 @@ function parseArgs(argv) {
 // closed.) `--transcript-path` survives ONLY for `--check-session-close`'s lint
 // scope, which writes no marker and so cannot cause an over-close.
 
+// Validate that an explicit --project=<slug> override names a real project
+// DIRECTORY. Syntax was already checked in parseArgs; this is the existence half,
+// mirroring apply's payload.project check — a regular file or an absent dir at
+// projects/<slug> is a hard error so the override never silently resolves to an
+// all-missing status (which a reader would misread as "exists but incomplete").
+function requireProjectDir(args, slug) {
+  const projectDir = join(args.hypoDir, 'projects', slug);
+  if (!existsSync(projectDir) || !statSync(projectDir).isDirectory()) {
+    const msg = `--project "${slug}" does not exist as a directory (no projects/${slug}/ directory)`;
+    console.log(args.json ? JSON.stringify({ ok: false, error: msg }, null, 2) : `✗ ${msg}`);
+    process.exit(1);
+  }
+}
+
 // ── session-close check (spec §5.2.7 / §8.3) ────────────────────────
 // Mirrors the hard gate in hypo-personal-check.mjs so the /hypo:crystallize
 // flow can self-verify before /compact triggers PreCompact.
 
 function runSessionCloseCheck(args) {
-  // ADR 0046: the check mirrors the FULL PreCompact gate via the shared
+  // The check mirrors the FULL PreCompact gate via the shared
   // precompactGateStatus (close files + lint + design-history + feedback
   // projection), not just the close files — so a green check means /compact
   // won't block on a human-fixable issue. Pass --transcript-path to widen the
@@ -179,15 +220,28 @@ function runSessionCloseCheck(args) {
   // (marker_present:true) while `ok` still reflected the stale active project —
   // the completion-signal trio (PreCompact / --check / marker) would diverge
   // (codex design Finding 2).
+  //
+  // --project=<slug> narrows BOTH the close status and the lint scope to that one
+  // project: a project-scoped DIAGNOSTIC, NOT the global compact-ready verdict.
+  // It is check-only: the marker writers stay global so
+  // the marker == compact-ready invariant holds. When narrowed, the
+  // transcript widening is suppressed: a transcript touch in some OTHER project
+  // would re-add that project's files to the lint scope and re-block the scoped
+  // check, defeating the point. The global (no --project) check keeps widening.
+  if (args.project) requireProjectDir(args, args.project);
   const status = precompactGateStatus(args.hypoDir, {
-    ...(args.transcriptPath ? { transcriptPath: args.transcriptPath } : {}),
+    ...(args.project
+      ? { projectOverride: args.project }
+      : args.transcriptPath
+        ? { transcriptPath: args.transcriptPath }
+        : {}),
     ...(args.sessionId ? { sessionId: args.sessionId } : {}),
   });
   const close = status.close;
 
-  // ADR 0047: when a --session-id is supplied, report whether THIS session's
+  // When a --session-id is supplied, report whether THIS session's
   // per-session marker (the Stop-chain completion signal) exists. This is a
-  // separate field, NOT folded into `ok` — `ok` stays the ADR 0046 compact-
+  // separate field, NOT folded into `ok`: `ok` stays the compact-
   // readiness verdict. A green gate with marker_present=false is exactly the
   // hand-edit close state: close is compact-ready but the Stop hook will
   // still block until the marker is written.
@@ -198,9 +252,18 @@ function runSessionCloseCheck(args) {
   // while /compact's Stop still blocks — the exact incoherence this ADR closes
   // (codex pre-commit CONCERN). readSessionClosedMarker unlinks an invalid
   // marker as it reads, matching the hook's behavior on the next Stop.
-  const markerPresent = args.sessionId
-    ? readSessionClosedMarker(args.hypoDir, args.sessionId) !== null
-    : null;
+  const markerObj = args.sessionId ? readSessionClosedMarker(args.hypoDir, args.sessionId) : null;
+  const markerPresent = args.sessionId ? markerObj !== null : null;
+
+  // Scope of this check (codex design review finding 2 — the scope must be
+  // explicit in JSON + prose, not implied). `global` = the full PreCompact mirror
+  // (green ⇒ compact-ready). `project` = narrowed to --project=<slug> (green ⇒
+  // only THAT project is close-complete, NOT global compact-readiness). When a
+  // log-only marker governs the session, the gate runs in log-only mode and the
+  // --project override is IGNORED — surface that rather than implying X was
+  // checked (it was not).
+  const logOnlyWon = args.project != null && markerObj?.scope === 'log-only';
+  const scope = args.project ? (logOnlyWon ? 'log-only' : 'project') : 'global';
 
   if (args.json) {
     console.log(
@@ -215,6 +278,14 @@ function runSessionCloseCheck(args) {
           blockers: status.blockers,
           notices: status.notices,
           skipped: status.skipped,
+          // scope is additive; `global` keeps prior semantics for existing readers
+          scope,
+          ...(args.project
+            ? {
+                scoped_project: args.project,
+                ...(logOnlyWon ? { project_override_ignored: true } : {}),
+              }
+            : {}),
           ...(args.sessionId ? { session_id: args.sessionId, marker_present: markerPresent } : {}),
         },
         null,
@@ -224,8 +295,20 @@ function runSessionCloseCheck(args) {
     process.exit(status.ok ? 0 : 1);
   }
 
+  if (logOnlyWon) {
+    console.log(
+      `Note: a log-only session-closed marker governs session ${args.sessionId}, so the gate ran in log-only mode and --project=${args.project} was IGNORED (no project was checked).\n`,
+    );
+  } else if (scope === 'project') {
+    console.log(
+      `Note: --project=${args.project} — this is a PROJECT-SCOPED diagnostic, not the global /compact gate. A green result means only ${args.project} is close-complete; another project can still block /compact.\n`,
+    );
+  }
+
   const proj = close.project || '(unresolved)';
-  console.log(`Compact-ready check (project: ${proj}, date: ${close.dates.join(' / ')}):\n`);
+  console.log(
+    `Compact-ready check (${scope === 'global' ? `project: ${proj}` : `scope: ${scope}, project: ${proj}`}, date: ${close.dates.join(' / ')}):\n`,
+  );
 
   const required = close.project
     ? [
@@ -246,7 +329,7 @@ function runSessionCloseCheck(args) {
   }
   // Beyond the close files: the rest of the PreCompact gate (lint, design-history,
   // feedback over-cap/conflict). These are what made a "close-complete" check
-  // disagree with the real /compact gate before ADR 0046.
+  // disagree with the real /compact gate before this check was added.
   for (const b of status.blockers) {
     if (b.type !== 'close') console.log(`  ✗ ${b.reason}`);
   }
@@ -254,22 +337,32 @@ function runSessionCloseCheck(args) {
     console.log('');
     for (const n of status.notices) console.log(`  · ${n.reason}`);
   }
-  // ADR 0047: surface the per-session marker state (separate from compact-
+  // Surface the per-session marker state (separate from compact-
   // readiness) so a green-but-unmarked close is visible at verify time.
   if (args.sessionId) {
     console.log('');
     console.log(
       markerPresent
         ? `  ✓ session-closed marker present (session_id: ${args.sessionId}).`
-        : `  · session-closed marker absent (session_id: ${args.sessionId}) — the Stop hook will block until it is written. Run \`crystallize --mark-session-closed --session-id=${args.sessionId}${args.transcriptPath ? ` --transcript-path=${args.transcriptPath}` : ''}\`.`,
+        : `  · session-closed marker absent (session_id: ${args.sessionId}) — the Stop hook will block until it is written. Run \`node "${SELF_SCRIPT}" --mark-session-closed --session-id=${args.sessionId}${args.transcriptPath ? ` --transcript-path="${args.transcriptPath}"` : ''}\`.`,
     );
   }
   console.log('');
-  console.log(
-    status.ok
-      ? '✓ Compact-ready — no PreCompact gate blocker needs a human fix. (open-questions.md: conditional, not checked. The live /compact can still differ on a context-≥70% prompt, HYPO_SKIP_GATE, or a transcript-scoped lint error this check did not see — pass --transcript-path to include the latter.)'
-      : '✗ Not compact-ready — resolve the ✗ items above, then retry. /compact would block on these.',
-  );
+  if (scope === 'project') {
+    // Project-scoped diagnostic: green means ONLY this project is close-complete.
+    // Do NOT claim global compact-readiness (the whole point of the narrow).
+    console.log(
+      status.ok
+        ? `✓ ${args.project} is close-complete (project-scoped). This is NOT a global /compact guarantee — run \`--check-session-close\` without --project for that.`
+        : `✗ ${args.project} is not close-complete — resolve the ✗ items above.`,
+    );
+  } else {
+    console.log(
+      status.ok
+        ? '✓ Compact-ready — no PreCompact gate blocker needs a human fix. (open-questions.md: conditional, not checked. The live /compact can still differ on a context-≥70% prompt, HYPO_SKIP_GATE, or a transcript-scoped lint error this check did not see — pass --transcript-path to include the latter.)'
+        : '✗ Not compact-ready — resolve the ✗ items above, then retry. /compact would block on these.',
+    );
+  }
   process.exit(status.ok ? 0 : 1);
 }
 
@@ -358,18 +451,19 @@ function todayLocal() {
   return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;
 }
 
-// Spec §5.2.7 / §8.3 + ADR 0029: 5 mandatory + 1 conditional. The payload
-// shape MUST mirror that contract — missing a mandatory field is a payload
-// bug, not a no-op. Caller is the LLM session-close flow, which composes the
-// payload deliberately; partial payloads must fail loudly so caller fixes them
-// rather than silently relying on yesterday's freshness state. (Codex review
-// of the apply path — Worker 1 finding 1.)
+// Spec §5.2.7 / §8.3: 4 mandatory + 2 optional (`log`, `openQuestions`).
+// The payload shape MUST mirror that contract — missing a mandatory field is a
+// payload bug, not a no-op. Caller is the LLM session-close flow, which composes
+// the payload deliberately; partial payloads must fail loudly so caller fixes
+// them rather than silently relying on yesterday's freshness state. (Codex review
+// of the apply path — Worker 1 finding 1.) `log` left the mandatory set in B-1:
+// the root log.md entry is a DERIVABLE artifact (rootLogEntry over this close's
+// sessionLog heading), so apply auto-fills it when the field is absent.
 const REQUIRED_PAYLOAD_FIELDS = [
   ['sessionState', 'content'],
   ['projectHot', 'content'],
   ['rootHot', 'content'],
   ['sessionLog', 'entry'],
-  ['log', 'entry'],
 ];
 
 function validatePayloadShape(payload) {
@@ -397,20 +491,25 @@ function validatePayloadShape(payload) {
       errs.push('payload.openQuestions, when present, must be { content: string }');
     }
   }
+  if (payload.log !== undefined) {
+    if (!payload.log || typeof payload.log !== 'object' || typeof payload.log.entry !== 'string') {
+      errs.push('payload.log, when present, must be { entry: string }');
+    }
+  }
   if (payload.date !== undefined && !/^\d{4}-\d{2}-\d{2}$/.test(String(payload.date))) {
     errs.push('payload.date, when present, must be YYYY-MM-DD');
   }
   return errs;
 }
 
-// ── session-close marker (ADR 0022 amendment 2026-05-19) ──────
+// ── session-close marker (amendment 2026-05-19) ───────────────
 // Standalone marker writer. Used when the LLM closes the session via direct
 // Write tool calls (not --apply-session-close). Hook `hypo-auto-minimal-
 // crystallize` is the only Reader; writer authority is intentionally split
 // between this CLI and the auto-write at the tail of applySessionClose.
 //
 // Contract: the marker is written only when the FULL /compact gate
-// (precompactGateStatus, ADR 0046) is green. A failed gate exits 1 with no
+// (precompactGateStatus) is green. A failed gate exits 1 with no
 // marker — the next Stop hook re-blocks.
 
 function runMarkSessionClosed(args) {
@@ -419,7 +518,15 @@ function runMarkSessionClosed(args) {
     console.log(args.json ? JSON.stringify({ ok: false, error: msg }, null, 2) : `✗ ${msg}`);
     process.exit(1);
   }
-  // ADR 0047: the per-session marker is the THIRD session-close completion
+  // --project=<slug> on --mark is ATTRIBUTION ONLY (the marker's `project` field).
+  // The gate stays GLOBAL — never narrowed — because a marker that narrowed its
+  // gate could attest compact-ready while PreCompact re-checks all of today's
+  // projects and stays red (the marker == compact-ready invariant,
+  // codex design finding 1/2). Validate the attribution slug exists as a
+  // directory, exactly as --check does, but only when it is actually used (a
+  // --log-only mark attributes to no project, so --project is moot there).
+  if (args.project && !args.logOnly) requireProjectDir(args, args.project);
+  // The per-session marker is the THIRD session-close completion
   // signal (after the PreCompact gate and `--check-session-close`). It must use
   // the SAME gate that governs /compact — precompactGateStatus — so the marker
   // can never attest "closed" while /compact would still block. This subsumes
@@ -464,7 +571,7 @@ function runMarkSessionClosed(args) {
     }
     process.exit(1);
   }
-  // User-close hard gate (ADR 0055): the compact gate above only proves the wiki
+  // User-close hard gate: the compact gate above only proves the wiki
   // is compact-ready; it does NOT prove the USER asked to close. Refuse the marker
   // unless the transcript carries a genuine user close signal (NL close phrase,
   // /compact, or an AskUserQuestion close answer). This is the hard backstop for
@@ -484,8 +591,12 @@ function runMarkSessionClosed(args) {
     console.log(args.json ? JSON.stringify(result, null, 2) : `✗ ${reason}`);
     process.exit(1);
   }
+  // --project attributes the marker to that slug (gate stayed global); falls back
+  // to the gate's resolved primary. log-only marks attribute to no project. Used
+  // for the marker, the JSON result, and the success message so all three agree.
+  const markerProject = !args.logOnly && args.project ? args.project : status.project;
   writeSessionClosedMarker(args.hypoDir, args.sessionId, {
-    project: status.project,
+    project: markerProject,
     ...(args.logOnly ? { scope: 'log-only' } : {}),
   });
   // Marker writer swallows IO errors (best-effort, see hypo-shared.mjs). Verify
@@ -504,11 +615,11 @@ function runMarkSessionClosed(args) {
   const result = {
     ok: true,
     session_id: args.sessionId,
-    project: status.project,
+    project: markerProject,
     scope: args.logOnly ? 'log-only' : 'project',
     date: status.dates[0],
     notices: gate.notices,
-    // ADR 0047: pure feedback-projection drift is a non-blocker — the marker
+    // pure feedback-projection drift is a non-blocker: the marker
     // attests "compact-ready (no human-fixable blocker)", and the PreCompact
     // hook self-heals the projection (feedback-sync --write) at /compact. Surface
     // the deferral so the caller knows MEMORY/CLAUDE sync is pending, not lost.
@@ -520,7 +631,7 @@ function runMarkSessionClosed(args) {
     console.log(
       args.logOnly
         ? `✓ session-closed marker written (session_id: ${args.sessionId}, scope: log-only — no project attribution).`
-        : `✓ session-closed marker written (session_id: ${args.sessionId}, project: ${status.project}).`,
+        : `✓ session-closed marker written (session_id: ${args.sessionId}, project: ${markerProject}).`,
     );
     if (gate.driftTargets.length > 0) {
       console.log(
@@ -542,7 +653,7 @@ function applySessionClose(args) {
   // for any actual apply work (readPayload below surfaces "payload is
   // required" the same way it always has).
   if (!args.force && !args.payload) {
-    // ADR 0043: no-payload "already complete?" probe uses the
+    // No-payload "already complete?" probe uses the
     // global invariant, not a recency pick.
     const probe = sessionCloseGlobalStatus(args.hypoDir);
     if (probe.ok) {
@@ -585,20 +696,48 @@ function applySessionClose(args) {
     process.exit(1);
   }
 
-  // Resolve project: explicit payload.project wins; else fall back to active project.
-  // Done via sessionCloseFileStatus to keep one source of truth (and so a
-  // missing pointer table surfaces the same error shape as --check-session-close).
+  // Resolve project: payload.project is REQUIRED (B-3, close-gate-hardening). The
+  // old recency fallback (payload.project || probe.project) could, on a same-date
+  // root-hot.md tie, resolve a DIFFERENT project than the one the payload's files
+  // belong to — apply would then write the close into the wrong project (silent
+  // data loss). Validate fail-fast, BEFORE the probe is consulted:
+  //   - missing      → no target to write; abort rather than infer.
+  //   - invalid name → reject (non-string, wrong charset, or dot-only) BEFORE the
+  //                    existsSync(join(...)) path build, so a `../`-style value
+  //                    never reaches a path builder (traversal guard — order is
+  //                    the guard). isValidProjectName is SHARED with createProject
+  //                    so apply accepts exactly the namespace the repo can
+  //                    scaffold (A-Za-z0-9._-, single segment) — no narrower.
+  //   - non-existent → projects/<slug>/ absent; abort rather than create.
+  // A payload.project that merely DIFFERS from the inferred active project is NOT an
+  // error — it is surfaced as a stderr note below and the close proceeds.
+  if (payload.project === undefined || payload.project === null) {
+    const msg = 'payload.project is required (apply must not infer the close target project)';
+    console.log(args.json ? JSON.stringify({ ok: false, error: msg }, null, 2) : `✗ ${msg}`);
+    process.exit(1);
+  }
+  if (!isValidProjectName(payload.project)) {
+    const msg = `payload.project ${JSON.stringify(payload.project)} is not a valid project name (single segment, charset A-Za-z0-9._-, ≥1 alnum, not "."/"..")`;
+    console.log(args.json ? JSON.stringify({ ok: false, error: msg }, null, 2) : `✗ ${msg}`);
+    process.exit(1);
+  }
+  // existsSync alone is not enough: a regular FILE at projects/<slug> would pass,
+  // then apply would build child paths under it and fail with an unstructured
+  // filesystem error (codex re-review). Require it to be a directory.
+  const projectDir = join(args.hypoDir, 'projects', payload.project);
+  if (!existsSync(projectDir) || !statSync(projectDir).isDirectory()) {
+    const msg = `payload.project "${payload.project}" does not exist as a directory (no projects/${payload.project}/ directory)`;
+    console.log(args.json ? JSON.stringify({ ok: false, error: msg }, null, 2) : `✗ ${msg}`);
+    process.exit(1);
+  }
+  const project = payload.project;
+  // probe (the recency-inferred active project) is now consulted ONLY to surface a
+  // divergence note — never to resolve the target. Computed AFTER validation so a
+  // malformed/missing payload.project fails fast without a pointer-table read.
   // Resolved BEFORE preflight because preflight needs overwrite-target paths
   // (which require the project slug) to filter out errors in files this apply
   // is about to replace — see the filter rationale below.
   const probe = sessionCloseFileStatus(args.hypoDir);
-  const project = payload.project || probe.project;
-  if (!project) {
-    const msg =
-      'no project resolved (payload.project missing and root hot.md has no active-project row)';
-    console.log(args.json ? JSON.stringify({ ok: false, error: msg }, null, 2) : `✗ ${msg}`);
-    process.exit(1);
-  }
   // The freshness verification below (and at the post-apply check) already honors
   // payload.project — `project` wins over the inferred active project, and the
   // post-apply sessionCloseFileStatus call passes it as projectOverride. But when the
@@ -606,7 +745,7 @@ function applySessionClose(args) {
   // (probe.project), that divergence used to be silent, so an operator couldn't tell
   // which project the close actually verified. Surface it on stderr (the stdout JSON
   // contract is untouched) so the verified/closed project is always explicit.
-  if (payload.project && probe.project && probe.project !== payload.project) {
+  if (probe.project && probe.project !== payload.project) {
     process.stderr.write(
       `note: payload.project="${payload.project}" differs from the inferred active ` +
         `project "${probe.project}"; verifying and closing "${payload.project}".\n`,
@@ -614,6 +753,23 @@ function applySessionClose(args) {
   }
   const date = payload.date || todayLocal();
 
+  // B-1 derive precondition: when `log` is omitted, apply reconstructs the root
+  // log.md entry from THIS close's sessionLog heading. If sessionLog.entry has no
+  // `## [<date>] …` heading there is nothing to derive — and on a same-day SECOND
+  // close the date-level freshness verifier would still pass on the earlier
+  // close's entry, so the no-write would slip through as ok:true. Fail loud here,
+  // before any writes (codex pre-commit review).
+  if (
+    !payload.log &&
+    !new RegExp(`^#{1,6} \\[${date}\\]`, 'm').test(payload.sessionLog.entry || '')
+  ) {
+    const msg =
+      `payload.sessionLog.entry has no "## [${date}] …" heading to derive the log.md ` +
+      `entry from. Give it a dated heading, or supply payload.log explicitly.`;
+    console.log(args.json ? JSON.stringify({ ok: false, error: msg }, null, 2) : `✗ ${msg}`);
+    process.exit(1);
+  }
+
   // Preflight: lint the wiki BEFORE writing any payload bytes. If lint
   // has blockers (errors) in files this apply WON'T overwrite, the wiki is in
   // a degraded state and apply would mask the root cause — abort fail-fast.
@@ -638,7 +794,7 @@ function applySessionClose(args) {
   // payloadScope = every file this apply writes or appends. Both lint passes are
   // judged against it; errors elsewhere are surfaced as notices, never blocking.
   //
-  // session-log needs TWO entries (ADR 0050): the daily WRITE target (what this
+  // session-log needs TWO entries: the daily WRITE target (what this
   // apply creates/appends, judged by post-apply lint) AND the freshness EVIDENCE
   // file. They coincide except in the hybrid cutover month, where a fallback-
   // aware no-op (the identical entry already lives in the legacy monthly file)
@@ -682,7 +838,7 @@ function applySessionClose(args) {
       ok: false,
       stage: 'preflight-lint',
       error: 'lint preflight failed — apply aborted (no payload bytes written)',
-      lint: { ...preflightLint, blockingErrors },
+      lint: { ...summarizeLintForOutput(preflightLint), blockingErrors },
     };
     if (args.json) {
       console.log(JSON.stringify(out, null, 2));
@@ -720,7 +876,7 @@ function applySessionClose(args) {
     const rel = join('projects', project, 'session-log', `${date}.md`);
     const full = join(args.hypoDir, rel);
     const isPresent = entryAlreadyPresent(payload.sessionLog.entry);
-    // Fallback-aware idempotency (ADR 0050 hybrid cutover): during the month the
+    // Fallback-aware idempotency (hybrid cutover): during the month the
     // shard takes over, today's entry may already live in the legacy monthly
     // file from an earlier (pre-cutover) close. Treat presence in EITHER the
     // daily shard or the legacy monthly file as "already written" so a same-day
@@ -750,7 +906,7 @@ function applySessionClose(args) {
       // otherwise mistake it for the evidence file. The dated `## [date] ...`
       // heading lives inside the entry, so freshness / derive / design-history
       // are unchanged.
-      // PRAC-17 audit fields. The shard frontmatter is git-tracked and synced, so
+      // Audit fields (device, session_id). The shard frontmatter is git-tracked and synced, so
       // `device` is an INTENTIONAL synced multi-machine identifier (privacy note:
       // docs/ARCHITECTURE.md). It is a CREATOR-only stamp — only the session/
       // machine that first seeds the daily shard is recorded; later same-day
@@ -776,13 +932,43 @@ function applySessionClose(args) {
     }
   }
 
-  {
+  // log.md: `payload.log` is OPTIONAL (B-1). When the caller supplies it, keep
+  // the explicit appendIfAbsent path (backward-compat: a custom log line, with
+  // the same idempotent dedup). When it is ABSENT, the root log.md entry is a
+  // DERIVABLE artifact: reconstruct the canonical `## [date] session | <project>`
+  // line directly from THIS close's session-log heading (`payload.sessionLog`),
+  // not by re-reading the session-log files. Deriving from the payload is what
+  // makes the per-close entry exact: a same-day second close lands its distinct
+  // heading, and a hybrid daily/monthly session-log split can't hide it (apply
+  // never reads those files for this). The global scan-based deriveRootLogEntries
+  // (the Stop hook) still backfills OTHER projects; calling it here would either
+  // miss the current entry (single-candidate read) or, with a loosened guard,
+  // append onto a deliberately custom payload.log (codex pre-commit review). The
+  // two payload paths are mutually exclusive: deriving on top of a present-but-
+  // malformed payload.log would mask it and weaken the verifier's fail-loud.
+  if (payload.log) {
     const wrote = appendIfAbsent(
       join(args.hypoDir, 'log.md'),
       payload.log.entry,
       entryAlreadyPresent(payload.log.entry),
     );
     (wrote ? applied : skipped).push('log (log.md)');
+  } else {
+    // matchAll (not exec) mirrors deriveRootLogEntries: a payload that carried
+    // more than one dated heading derives one canonical line each, symmetric with
+    // the global path. Exact-line dedup on the heading keeps a second apply (or a
+    // titleless vs titled same-day pair) from duplicating.
+    const logFull = join(args.hypoDir, 'log.md');
+    const headingRe = new RegExp(`^#{1,6} \\[${date}\\]\\s*(.*)$`, 'gm');
+    let wroteAny = false;
+    for (const m of (payload.sessionLog.entry || '').matchAll(headingRe)) {
+      const { heading, block } = rootLogEntry(project, date, m[1]);
+      const wrote = appendIfAbsent(logFull, block, (c) =>
+        (c || '').split(/\r?\n/).includes(heading),
+      );
+      wroteAny = wroteAny || wrote;
+    }
+    (wroteAny ? applied : skipped).push('log (log.md, derived)');
   }
 
   // Same-date-tie fix: verify against the SAME project this apply just wrote
@@ -792,6 +978,29 @@ function applySessionClose(args) {
   // a completed close (the 2026-06-09 security-ops-kb incident).
   const verification = sessionCloseFileStatus(args.hypoDir, { projectOverride: project });
 
+  // B-4 auto-register: lift unknown (non-forbidden) tags surfaced by the PREFLIGHT
+  // lint into SCHEMA.md's `### Pending` section so the post-apply lint sees them as
+  // known and the close never stalls on a vocabulary gap. The W10 id is hidden in
+  // non-strict --json output (lint.mjs toOut), so the unknown-tag warns are matched
+  // and the tag extracted from the message string itself — kept in lockstep with
+  // lint.mjs's W10 emit (a copy-edit there breaks this; the close-path round-trip
+  // test guards it). Forbidden patterns stay hard errors and are filtered out.
+  // SCOPE (eventual consistency, intended): this registers PRE-EXISTING wiki debt
+  // visible at preflight, NOT a novel tag this very close's payload introduces —
+  // that one would surface only at post-apply and lands on the NEXT close. The
+  // contract is "must not stall", which warns (not errors) already satisfy; the
+  // registration just keeps the vocabulary catching up.
+  // The capture is anchored on the FULL message suffix (not `[^"]+`) so a tag that
+  // itself contains a `"` — non-forbidden, so reachable — is captured whole rather
+  // than truncated at its first quote (codex stage-2 CONCERN).
+  const unknownTagRe = /^Unknown tag: "(.+)" \(not in SCHEMA\.md Tag Vocabulary\)/;
+  const pendingTags = [];
+  for (const w of preflightLint.warns || []) {
+    const m = unknownTagRe.exec(w.message || '');
+    if (m && !checkForbidden(m[1])) pendingTags.push(m[1]);
+  }
+  if (pendingTags.length > 0) appendPendingTags(args.hypoDir, pendingTags);
+
   // Post-apply lint: payload may have introduced a malformed body or
   // bad frontmatter. Surface as a distinct `stage` so caller can tell "lint
   // broke" apart from "frontmatter stale". This runs even if the freshness gate
@@ -829,11 +1038,17 @@ function applySessionClose(args) {
   const postLintOk = !postApplyCrashed && postBlocking.length === 0;
   const ok = verification.ok && postLintOk;
 
-  // ADR 0022 amendment 2026-05-19: auto-write the per-session
+  // Scope the non-blocking notice to the close-target project: debt under
+  // projects/<project>/ stays listed; debt elsewhere folds to a count so the
+  // same untouched-file debt does not re-list its filenames on every close.
+  const closeScopeNotice = postNotice.filter((e) => isUnderProjectDirs(e.file, [project]));
+  const otherDebtCount = postNotice.length - closeScopeNotice.length;
+
+  // Amendment 2026-05-19: auto-write the per-session
   // closed marker on a verified close. Hook authority is read-only; this is
   // one of the two writer paths (the other is --mark-session-closed standalone).
   //
-  // ADR 0047: the marker write is governed by the SAME gate as standalone
+  // The marker write is governed by the SAME gate as standalone
   // --mark-session-closed and /compact (precompactGateStatus), NOT just apply's
   // `ok` + git-clean. Apply's payload preflight/post-apply lint and `ok` still
   // govern apply SUCCESS (exit code below), but the marker must additionally
@@ -841,13 +1056,13 @@ function applySessionClose(args) {
   // path could issue a marker the standalone path would refuse (the second
   // divergence codex flagged).
   //
-  // ADR 0056: apply just wrote the payload, so the tree is dirty by its OWN
-  // writes — the gate's `uncommitted` git blocker would always trip and the
+  // Apply just wrote the payload, so the tree is dirty by its OWN
+  // writes: the gate's `uncommitted` git blocker would always trip and the
   // marker would be skipped, deferring the close to a manual --mark-session-closed
-  // (the ADR 0047 "done but still blocked" regression). Commit the payload HERE, via
+  // ("done but still blocked" regression). Commit the payload HERE, via
   // the SAME .hypoignore-aware helper the auto-commit Stop hook uses, so the gate sees
   // a committed tree. Push stays deferred to the Stop hook; the resulting
-  // committed-but-unpushed state is a gate notice, not a blocker (ADR 0056), so
+  // committed-but-unpushed state is a gate notice, not a blocker, so
   // this still marks. A commit failure (not a repo / pre-commit reject / git error)
   // skips the marker WITH a surfaced reason — today's behavior was also "no marker",
   // but silently.
@@ -869,14 +1084,14 @@ function applySessionClose(args) {
         // (feedback/W8/hot/lint — git is now committed) is resolved.
         markerSkipReason = 'compact-gate-not-ok';
       } else if (!closeTranscript || !hasUserCloseSignal(closeTranscript)) {
-        // User-close hard gate (ADR 0055): apply succeeded (payload files written)
+        // User-close hard gate: apply succeeded (payload files written)
         // but the user never signalled session close, so the marker — which attests
         // "user closed" — is withheld. The wiki record stands; the session is simply
         // not marked closed. Surfaced (not silent) so the caller knows.
         markerSkipReason = closeTranscript ? 'no-user-close-signal' : 'transcript-unresolved';
       } else {
         writeSessionClosedMarker(args.hypoDir, args.sessionId, { project });
-        // Codex CONCERN (ADR 0055/0056): the writer swallows IO errors (best-effort).
+        // Codex CONCERN: the writer swallows IO errors (best-effort).
         // Verify the file actually landed — mirroring the standalone path — instead of
         // asserting markerWritten=true, so a .cache permission/disk problem surfaces
         // rather than the caller reporting "closed" while the next Stop re-blocks.
@@ -903,13 +1118,22 @@ function applySessionClose(args) {
     applied,
     skipped,
     verification,
-    // ADR 0055: surface the marker outcome instead of skipping silently, so the
+    // Surface the marker outcome instead of skipping silently, so the
     // caller can tell "closed" from "applied but not marked".
     ...(args.sessionId ? { markerWritten, markerSkipReason } : {}),
-    lint: { preflight: preflightLint, postApply: postApplyLint },
-    // Pre-existing lint debt in files this close did not author (Bug B): surfaced
-    // for visibility, never gated. Empty on a clean vault.
-    notices: [...new Set(postNotice.map((e) => e.file))],
+    lint: {
+      preflight: summarizeLintForOutput(preflightLint),
+      postApply: summarizeLintForOutput(postApplyLint),
+    },
+    // Pre-existing lint debt in files this close did not author: surfaced for
+    // visibility, never gated. Empty on a clean vault. Scoped to the close-target
+    // project's own dir — debt under projects/<project>/ is this close's
+    // neighborhood and stays listed; debt elsewhere (other projects, shared
+    // pages, root files) folds into otherDebtCount so the same untouched-file
+    // debt does not re-list its filenames on every close (run `node
+    // scripts/lint.mjs` for the full list).
+    notices: [...new Set(closeScopeNotice.map((e) => e.file))],
+    otherDebtCount,
   };
 
   if (args.json) {
@@ -963,13 +1187,18 @@ function applySessionClose(args) {
         console.log('  Payload introduced a lint blocker — fix the payload content and retry.');
       }
     }
-    if (postNotice.length > 0) {
+    if (closeScopeNotice.length > 0) {
       console.log(
-        `\n· ${postNotice.length} pre-existing lint issue(s) in untouched files (not blocking): ${[
-          ...new Set(postNotice.map((e) => e.file)),
+        `\n· ${closeScopeNotice.length} pre-existing lint issue(s) in untouched files (not blocking): ${[
+          ...new Set(closeScopeNotice.map((e) => e.file)),
         ]
           .slice(0, 5)
-          .join(', ')}${postNotice.length > 5 ? ', …' : ''}`,
+          .join(', ')}${closeScopeNotice.length > 5 ? ', …' : ''}`,
+      );
+    }
+    if (otherDebtCount > 0) {
+      console.log(
+        `\n· +${otherDebtCount} pre-existing lint issue(s) elsewhere in the vault (other projects / shared pages, not blocking) — run \`node scripts/lint.mjs\` for the full list.`,
       );
     }
   }
@@ -978,6 +1207,29 @@ function applySessionClose(args) {
 
 // ── helpers ──────────────────────────────────────────────────────────────────
 
+// Cap the warn list in MODEL-FACING lint output. `result.lint` is serialized
+// into the --json apply result the documented close path reads, and lint runs
+// twice per close (preflight + post-apply), so an un-capped warn list (e.g.
+// hundreds of broken-wikilink warnings) lands in model context twice on every
+// close. Errors stay full (few, actionable); warns collapse to a count plus a
+// small sample for quick diagnosis. The INTERNAL preflightLint / postApplyLint
+// objects are untouched — the blocking filter and the pending-tag scan still
+// read the full warn list. lint.mjs --json itself also stays full: its
+// programmatic consumers (the pending-tag scan, the PreCompact W8 filter, tests)
+// need every warn.
+function summarizeLintForOutput(l) {
+  const SAMPLE = 10;
+  const warns = l.warns || [];
+  const out = {
+    ok: l.ok,
+    errors: l.errors || [],
+    warnCount: warns.length,
+    warns: warns.slice(0, SAMPLE),
+  };
+  if (warns.length > SAMPLE) out.warnsTruncated = warns.length - SAMPLE;
+  return out;
+}
+
 function parseFrontmatter(content) {
   const m = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
   if (!m) return null;