hypomnema 1.4.2 → 1.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hypomnema",
-  "version": "1.4.2",
+  "version": "1.5.0",
   "description": "LLM-native personal wiki system for Claude Code",
   "type": "module",
   "license": "MIT",
@@ -14,6 +14,10 @@
     "!scripts/bump-version.mjs",
     "!scripts/smoke-pack.mjs",
     "!scripts/smoke-plugin.mjs",
+    "!scripts/fix-status-verify.mjs",
+    "!scripts/lib/fix-status-verify.mjs",
+    "!scripts/lib/fix-manifest.mjs",
+    "!scripts/lib/adr-corpus.mjs",
     "commands/",
     "hooks/",
     "skills/",

package/scripts/check-tracker-ids.mjs

@@ -1,13 +1,14 @@
 #!/usr/bin/env node
 /**
  * check-tracker-ids.mjs — CLI gate: no wiki-internal tracker IDs (ISSUE-N,
- * fix #N) in OSS-public artifacts.
+ * fix #N, FEAT-N, IMPR-N, PRAC-N) in OSS-public artifacts.
  *
  * Rule source: CLAUDE.md learned_behaviors (no-internal-tracker-ids-in-oss-
  * artifacts, 2026-06-09). The repo ships through npm + a Claude Code plugin;
- * a `fix #N` / `ISSUE-N` in any shipped file or in README/CHANGELOG is a
- * dangling pointer into the maintainer's PRIVATE wiki tracker. GitHub refs
- * (`PR #N`, `(#N)`, `#N`, issue URLs) are legitimate and never flagged.
+ * an `ISSUE-N` / `fix #N` / `FEAT-N` / `IMPR-N` / `PRAC-N` in any shipped file or
+ * in README/CHANGELOG is a dangling pointer into the maintainer's PRIVATE wiki
+ * tracker. GitHub refs (`PR #N`, `(#N)`, `#N`, issue URLs) are legitimate and
+ * never flagged.
  *
  * Modes:
  *   --all (default)        Walk the public-artifact scope and scan every text
@@ -31,14 +32,16 @@
  * auto-ships it) + shipped trees commands/ hooks/ scripts/ skills/ templates/
  * docs/ .github/ .claude-plugin/. Excluded: tests/ and qa-runs/ (internal
  * maintainer artifacts — a tracker id in a test description aids traceability
- * and never reaches an installed user), node_modules/, .git/. The checker's OWN
- * sources are scanned (NOT exempt); their examples use `N` placeholders so they
- * stay clean.
+ * and never reaches an installed user), node_modules/, .git/, and the
+ * fix-status-verify subsystem (EXCLUDED_FILES — maintainer-only, carries wiki
+ * `decisions/` paths as runtime data, un-shipped from the npm package). The
+ * checker's OWN sources are scanned (NOT exempt); their examples use `N`
+ * placeholders so they stay clean.
  *
- * ADR scope (narrower): README.md, README.ko.md, and docs/ additionally block
- * `ADR NNNN` / `decisions/NNNN` wiki-ADR pointers (USER_FACING_PATTERNS). Shipped
- * code comments and CHANGELOG history keep their ADR anchors, so this set is
- * applied per-file via patternsFor() only inside that doc surface.
+ * ADR scope: `ADR NNNN` / `decisions/NNNN` wiki-ADR pointers (DECISION_PATTERNS)
+ * are blocked everywhere in scope EXCEPT CHANGELOG.md, whose version history
+ * legitimately cites the decision behind a release line. patternsFor() applies the
+ * broader set to every in-scope file but the CHANGELOG.
  */
 
 import { readFileSync, readdirSync, statSync, existsSync } from 'node:fs';
@@ -50,7 +53,7 @@ import {
   stripScissors,
   messageHasGitTemplate,
   BLOCKED_PATTERNS,
-  USER_FACING_PATTERNS,
+  DECISION_PATTERNS,
   TAG_BODY_PATTERNS,
 } from './lib/check-tracker-ids.mjs';
 import {
@@ -70,7 +73,8 @@ const REPO_ROOT = process.env.CHECK_TRACKER_ROOT || join(__dirname, '..');
 
 const RULE_REF =
   'Rule: CLAUDE.md learned_behaviors (no-internal-tracker-ids-in-oss-artifacts). ' +
-  'OSS-public artifacts must not reference the private wiki tracker (ISSUE-N / fix #N). ' +
+  'OSS-public artifacts must not reference the private wiki tracker ' +
+  '(ISSUE-N / fix #N / FEAT-N / IMPR-N / PRAC-N). ' +
   'Use a GitHub ref (#N / PR #N) or drop the reference.';
 
 // Top-level public-artifact entry points. Files are scanned directly; dirs are
@@ -94,15 +98,49 @@ const SCOPE_DIRS = [
 // and never reaches an installed user). The checker's OWN sources are NOT
 // excluded — they use `N` placeholders in their examples so they scan clean.
 const EXCLUDED_DIRS = new Set(['node_modules', '.git', 'tests', 'qa-runs']);
-const EXCLUDED_FILES = new Set();
+// The fix-status-verify subsystem (run only via `npm run fix:verify`, never by a
+// shipped command/hook/skill) is a maintainer evidence-verification tool. Its
+// manifest carries `decisions/NNNN` wiki paths as RUNTIME DATA (resolved against
+// the maintainer's local wiki), so the anchors cannot be stripped the way a
+// comment can. It is removed from the npm package (package.json `files`) and
+// excluded here so the gate does not flag its load-bearing data.
+// Stored POSIX-style ('/'); paths are normalized before lookup (see toPosix).
+const EXCLUDED_FILES = new Set([
+  'scripts/fix-status-verify.mjs',
+  'scripts/lib/fix-status-verify.mjs',
+  'scripts/lib/fix-manifest.mjs',
+  'scripts/lib/adr-corpus.mjs',
+]);
 
 // Only text artifacts. Binary / lockfiles add noise and never carry prose refs.
-const TEXT_EXT = new Set(['.md', '.mjs', '.js', '.cjs', '.json', '.yml', '.yaml', '.sh', '.txt']);
+// .svg is included because the shipped docs/assets/ logos are hand-authored XML
+// text whose <title>/<desc>/comment fields could carry a dangling wiki pointer.
+const TEXT_EXT = new Set([
+  '.md',
+  '.mjs',
+  '.js',
+  '.cjs',
+  '.json',
+  '.yml',
+  '.yaml',
+  '.sh',
+  '.txt',
+  '.svg',
+]);
+
+// Normalize OS separators to '/' so the two scan modes classify a path the same
+// way on every host: --all builds relPath via relative() (platform sep, so '\' on
+// Windows) while --staged takes git's output (always '/'). Without this, a Windows
+// --staged run would neither exclude the verifier files nor recognize scope dirs.
+// No-op on POSIX (sep is already '/').
+function toPosix(relPath) {
+  return sep === '/' ? relPath : relPath.split(sep).join('/');
+}
 
 function isExcludedRel(relPath) {
-  const parts = relPath.split(sep);
-  if (parts.some((p) => EXCLUDED_DIRS.has(p))) return true;
-  if (EXCLUDED_FILES.has(relPath)) return true;
+  const p = toPosix(relPath);
+  if (p.split('/').some((seg) => EXCLUDED_DIRS.has(seg))) return true;
+  if (EXCLUDED_FILES.has(p)) return true;
   return false;
 }
 
@@ -116,22 +154,22 @@ function isTextFile(p) {
 function isInScope(relPath) {
   if (isExcludedRel(relPath)) return false;
   if (!isTextFile(relPath)) return false;
-  if (SCOPE_FILES.includes(relPath)) return true;
-  return SCOPE_DIRS.includes(relPath.split(sep)[0]);
+  const p = toPosix(relPath);
+  if (SCOPE_FILES.includes(p)) return true;
+  return SCOPE_DIRS.includes(p.split('/')[0]);
 }
 
-// User-facing prose surface: README.md, README.ko.md, and the docs/ tree. These
-// additionally block `ADR NNNN` / `decisions/NNNN` (dangling wiki-ADR pointers).
-// Everything else in scope — shipped code, CHANGELOG, package.json — keeps its ADR
-// anchors, so the broader pattern set is applied here ONLY.
-const USER_FACING_DOCS = new Set(['README.md', 'README.ko.md']);
-function isUserFacingDoc(relPath) {
-  return USER_FACING_DOCS.has(relPath) || relPath.split(sep)[0] === 'docs';
-}
+// `ADR NNNN` / `decisions/NNNN` are dangling pointers into the maintainer's
+// private wiki ADR set, so they are blocked everywhere in scope EXCEPT the
+// CHANGELOG, whose version history legitimately cites the decision behind a
+// release line (and never reaches an installed user as a live link). The verifier
+// subsystem that carries `decisions/` paths as runtime data is already removed by
+// EXCLUDED_FILES, so it is never reached here.
+const ADR_EXEMPT_FILES = new Set(['CHANGELOG.md']);
 function patternsFor(relPath) {
-  return isUserFacingDoc(relPath)
-    ? [...BLOCKED_PATTERNS, ...USER_FACING_PATTERNS]
-    : BLOCKED_PATTERNS;
+  return ADR_EXEMPT_FILES.has(toPosix(relPath))
+    ? BLOCKED_PATTERNS
+    : [...BLOCKED_PATTERNS, ...DECISION_PATTERNS];
 }
 
 // Recursively collect in-scope text files under an absolute dir.

package/scripts/crystallize.mjs

@@ -83,6 +83,7 @@ import {
   sessionClosedMarkerPath,
   readSessionClosedMarker,
   partitionLintScope,
+  isUnderProjectDirs,
   sessionLogShardPath,
   sessionLogReadCandidates,
   sessionLogScopePath,
@@ -177,7 +178,7 @@ function parseArgs(argv) {
   return args;
 }
 
-// ── session-close hard gate (ADR 0055) ───────────────────────────────────────
+// ── session-close hard gate ───────────────────────────────────────────────────
 // The marker attests "the USER closed this session". Its evidence transcript is
 // resolved STRICTLY from the session id (a globally-unique UUID) by globbing the
 // Claude project dirs — never from a CLI arg. A model owns the whole subprocess
@@ -208,7 +209,7 @@ function requireProjectDir(args, slug) {
 // flow can self-verify before /compact triggers PreCompact.
 
 function runSessionCloseCheck(args) {
-  // ADR 0046: the check mirrors the FULL PreCompact gate via the shared
+  // The check mirrors the FULL PreCompact gate via the shared
   // precompactGateStatus (close files + lint + design-history + feedback
   // projection), not just the close files — so a green check means /compact
   // won't block on a human-fixable issue. Pass --transcript-path to widen the
@@ -221,9 +222,9 @@ function runSessionCloseCheck(args) {
   // (codex design Finding 2).
   //
   // --project=<slug> narrows BOTH the close status and the lint scope to that one
-  // project: a project-scoped DIAGNOSTIC, NOT the global compact-ready verdict
-  // (ADR 0046 caveat below). It is check-only — the marker writers stay global so
-  // the marker == compact-ready invariant holds (ADR 0047). When narrowed, the
+  // project: a project-scoped DIAGNOSTIC, NOT the global compact-ready verdict.
+  // It is check-only: the marker writers stay global so
+  // the marker == compact-ready invariant holds. When narrowed, the
   // transcript widening is suppressed: a transcript touch in some OTHER project
   // would re-add that project's files to the lint scope and re-block the scoped
   // check, defeating the point. The global (no --project) check keeps widening.
@@ -238,9 +239,9 @@ function runSessionCloseCheck(args) {
   });
   const close = status.close;
 
-  // ADR 0047: when a --session-id is supplied, report whether THIS session's
+  // When a --session-id is supplied, report whether THIS session's
   // per-session marker (the Stop-chain completion signal) exists. This is a
-  // separate field, NOT folded into `ok` — `ok` stays the ADR 0046 compact-
+  // separate field, NOT folded into `ok`: `ok` stays the compact-
   // readiness verdict. A green gate with marker_present=false is exactly the
   // hand-edit close state: close is compact-ready but the Stop hook will
   // still block until the marker is written.
@@ -328,7 +329,7 @@ function runSessionCloseCheck(args) {
   }
   // Beyond the close files: the rest of the PreCompact gate (lint, design-history,
   // feedback over-cap/conflict). These are what made a "close-complete" check
-  // disagree with the real /compact gate before ADR 0046.
+  // disagree with the real /compact gate before this check was added.
   for (const b of status.blockers) {
     if (b.type !== 'close') console.log(`  ✗ ${b.reason}`);
   }
@@ -336,7 +337,7 @@ function runSessionCloseCheck(args) {
     console.log('');
     for (const n of status.notices) console.log(`  · ${n.reason}`);
   }
-  // ADR 0047: surface the per-session marker state (separate from compact-
+  // Surface the per-session marker state (separate from compact-
   // readiness) so a green-but-unmarked close is visible at verify time.
   if (args.sessionId) {
     console.log('');
@@ -450,7 +451,7 @@ function todayLocal() {
   return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;
 }
 
-// Spec §5.2.7 / §8.3 + ADR 0029: 4 mandatory + 2 optional (`log`, `openQuestions`).
+// Spec §5.2.7 / §8.3: 4 mandatory + 2 optional (`log`, `openQuestions`).
 // The payload shape MUST mirror that contract — missing a mandatory field is a
 // payload bug, not a no-op. Caller is the LLM session-close flow, which composes
 // the payload deliberately; partial payloads must fail loudly so caller fixes
@@ -501,14 +502,14 @@ function validatePayloadShape(payload) {
   return errs;
 }
 
-// ── session-close marker (ADR 0022 amendment 2026-05-19) ──────
+// ── session-close marker (amendment 2026-05-19) ───────────────
 // Standalone marker writer. Used when the LLM closes the session via direct
 // Write tool calls (not --apply-session-close). Hook `hypo-auto-minimal-
 // crystallize` is the only Reader; writer authority is intentionally split
 // between this CLI and the auto-write at the tail of applySessionClose.
 //
 // Contract: the marker is written only when the FULL /compact gate
-// (precompactGateStatus, ADR 0046) is green. A failed gate exits 1 with no
+// (precompactGateStatus) is green. A failed gate exits 1 with no
 // marker — the next Stop hook re-blocks.
 
 function runMarkSessionClosed(args) {
@@ -520,12 +521,12 @@ function runMarkSessionClosed(args) {
   // --project=<slug> on --mark is ATTRIBUTION ONLY (the marker's `project` field).
   // The gate stays GLOBAL — never narrowed — because a marker that narrowed its
   // gate could attest compact-ready while PreCompact re-checks all of today's
-  // projects and stays red (the marker == compact-ready invariant, ADR 0047 /
+  // projects and stays red (the marker == compact-ready invariant,
   // codex design finding 1/2). Validate the attribution slug exists as a
   // directory, exactly as --check does, but only when it is actually used (a
   // --log-only mark attributes to no project, so --project is moot there).
   if (args.project && !args.logOnly) requireProjectDir(args, args.project);
-  // ADR 0047: the per-session marker is the THIRD session-close completion
+  // The per-session marker is the THIRD session-close completion
   // signal (after the PreCompact gate and `--check-session-close`). It must use
   // the SAME gate that governs /compact — precompactGateStatus — so the marker
   // can never attest "closed" while /compact would still block. This subsumes
@@ -570,7 +571,7 @@ function runMarkSessionClosed(args) {
     }
     process.exit(1);
   }
-  // User-close hard gate (ADR 0055): the compact gate above only proves the wiki
+  // User-close hard gate: the compact gate above only proves the wiki
   // is compact-ready; it does NOT prove the USER asked to close. Refuse the marker
   // unless the transcript carries a genuine user close signal (NL close phrase,
   // /compact, or an AskUserQuestion close answer). This is the hard backstop for
@@ -618,7 +619,7 @@ function runMarkSessionClosed(args) {
     scope: args.logOnly ? 'log-only' : 'project',
     date: status.dates[0],
     notices: gate.notices,
-    // ADR 0047: pure feedback-projection drift is a non-blocker — the marker
+    // pure feedback-projection drift is a non-blocker: the marker
     // attests "compact-ready (no human-fixable blocker)", and the PreCompact
     // hook self-heals the projection (feedback-sync --write) at /compact. Surface
     // the deferral so the caller knows MEMORY/CLAUDE sync is pending, not lost.
@@ -652,7 +653,7 @@ function applySessionClose(args) {
   // for any actual apply work (readPayload below surfaces "payload is
   // required" the same way it always has).
   if (!args.force && !args.payload) {
-    // ADR 0043: no-payload "already complete?" probe uses the
+    // No-payload "already complete?" probe uses the
     // global invariant, not a recency pick.
     const probe = sessionCloseGlobalStatus(args.hypoDir);
     if (probe.ok) {
@@ -793,7 +794,7 @@ function applySessionClose(args) {
   // payloadScope = every file this apply writes or appends. Both lint passes are
   // judged against it; errors elsewhere are surfaced as notices, never blocking.
   //
-  // session-log needs TWO entries (ADR 0050): the daily WRITE target (what this
+  // session-log needs TWO entries: the daily WRITE target (what this
   // apply creates/appends, judged by post-apply lint) AND the freshness EVIDENCE
   // file. They coincide except in the hybrid cutover month, where a fallback-
   // aware no-op (the identical entry already lives in the legacy monthly file)
@@ -837,7 +838,7 @@ function applySessionClose(args) {
       ok: false,
       stage: 'preflight-lint',
       error: 'lint preflight failed — apply aborted (no payload bytes written)',
-      lint: { ...preflightLint, blockingErrors },
+      lint: { ...summarizeLintForOutput(preflightLint), blockingErrors },
     };
     if (args.json) {
       console.log(JSON.stringify(out, null, 2));
@@ -875,7 +876,7 @@ function applySessionClose(args) {
     const rel = join('projects', project, 'session-log', `${date}.md`);
     const full = join(args.hypoDir, rel);
     const isPresent = entryAlreadyPresent(payload.sessionLog.entry);
-    // Fallback-aware idempotency (ADR 0050 hybrid cutover): during the month the
+    // Fallback-aware idempotency (hybrid cutover): during the month the
     // shard takes over, today's entry may already live in the legacy monthly
     // file from an earlier (pre-cutover) close. Treat presence in EITHER the
     // daily shard or the legacy monthly file as "already written" so a same-day
@@ -905,7 +906,7 @@ function applySessionClose(args) {
       // otherwise mistake it for the evidence file. The dated `## [date] ...`
       // heading lives inside the entry, so freshness / derive / design-history
       // are unchanged.
-      // PRAC-17 audit fields. The shard frontmatter is git-tracked and synced, so
+      // Audit fields (device, session_id). The shard frontmatter is git-tracked and synced, so
       // `device` is an INTENTIONAL synced multi-machine identifier (privacy note:
       // docs/ARCHITECTURE.md). It is a CREATOR-only stamp — only the session/
       // machine that first seeds the daily shard is recorded; later same-day
@@ -1037,11 +1038,17 @@ function applySessionClose(args) {
   const postLintOk = !postApplyCrashed && postBlocking.length === 0;
   const ok = verification.ok && postLintOk;
 
-  // ADR 0022 amendment 2026-05-19: auto-write the per-session
+  // Scope the non-blocking notice to the close-target project: debt under
+  // projects/<project>/ stays listed; debt elsewhere folds to a count so the
+  // same untouched-file debt does not re-list its filenames on every close.
+  const closeScopeNotice = postNotice.filter((e) => isUnderProjectDirs(e.file, [project]));
+  const otherDebtCount = postNotice.length - closeScopeNotice.length;
+
+  // Amendment 2026-05-19: auto-write the per-session
   // closed marker on a verified close. Hook authority is read-only; this is
   // one of the two writer paths (the other is --mark-session-closed standalone).
   //
-  // ADR 0047: the marker write is governed by the SAME gate as standalone
+  // The marker write is governed by the SAME gate as standalone
   // --mark-session-closed and /compact (precompactGateStatus), NOT just apply's
   // `ok` + git-clean. Apply's payload preflight/post-apply lint and `ok` still
   // govern apply SUCCESS (exit code below), but the marker must additionally
@@ -1049,13 +1056,13 @@ function applySessionClose(args) {
   // path could issue a marker the standalone path would refuse (the second
   // divergence codex flagged).
   //
-  // ADR 0056: apply just wrote the payload, so the tree is dirty by its OWN
-  // writes — the gate's `uncommitted` git blocker would always trip and the
+  // Apply just wrote the payload, so the tree is dirty by its OWN
+  // writes: the gate's `uncommitted` git blocker would always trip and the
   // marker would be skipped, deferring the close to a manual --mark-session-closed
-  // (the ADR 0047 "done but still blocked" regression). Commit the payload HERE, via
+  // ("done but still blocked" regression). Commit the payload HERE, via
   // the SAME .hypoignore-aware helper the auto-commit Stop hook uses, so the gate sees
   // a committed tree. Push stays deferred to the Stop hook; the resulting
-  // committed-but-unpushed state is a gate notice, not a blocker (ADR 0056), so
+  // committed-but-unpushed state is a gate notice, not a blocker, so
   // this still marks. A commit failure (not a repo / pre-commit reject / git error)
   // skips the marker WITH a surfaced reason — today's behavior was also "no marker",
   // but silently.
@@ -1077,14 +1084,14 @@ function applySessionClose(args) {
         // (feedback/W8/hot/lint — git is now committed) is resolved.
         markerSkipReason = 'compact-gate-not-ok';
       } else if (!closeTranscript || !hasUserCloseSignal(closeTranscript)) {
-        // User-close hard gate (ADR 0055): apply succeeded (payload files written)
+        // User-close hard gate: apply succeeded (payload files written)
         // but the user never signalled session close, so the marker — which attests
         // "user closed" — is withheld. The wiki record stands; the session is simply
         // not marked closed. Surfaced (not silent) so the caller knows.
         markerSkipReason = closeTranscript ? 'no-user-close-signal' : 'transcript-unresolved';
       } else {
         writeSessionClosedMarker(args.hypoDir, args.sessionId, { project });
-        // Codex CONCERN (ADR 0055/0056): the writer swallows IO errors (best-effort).
+        // Codex CONCERN: the writer swallows IO errors (best-effort).
         // Verify the file actually landed — mirroring the standalone path — instead of
         // asserting markerWritten=true, so a .cache permission/disk problem surfaces
         // rather than the caller reporting "closed" while the next Stop re-blocks.
@@ -1111,13 +1118,22 @@ function applySessionClose(args) {
     applied,
     skipped,
     verification,
-    // ADR 0055: surface the marker outcome instead of skipping silently, so the
+    // Surface the marker outcome instead of skipping silently, so the
     // caller can tell "closed" from "applied but not marked".
     ...(args.sessionId ? { markerWritten, markerSkipReason } : {}),
-    lint: { preflight: preflightLint, postApply: postApplyLint },
-    // Pre-existing lint debt in files this close did not author (Bug B): surfaced
-    // for visibility, never gated. Empty on a clean vault.
-    notices: [...new Set(postNotice.map((e) => e.file))],
+    lint: {
+      preflight: summarizeLintForOutput(preflightLint),
+      postApply: summarizeLintForOutput(postApplyLint),
+    },
+    // Pre-existing lint debt in files this close did not author: surfaced for
+    // visibility, never gated. Empty on a clean vault. Scoped to the close-target
+    // project's own dir — debt under projects/<project>/ is this close's
+    // neighborhood and stays listed; debt elsewhere (other projects, shared
+    // pages, root files) folds into otherDebtCount so the same untouched-file
+    // debt does not re-list its filenames on every close (run `node
+    // scripts/lint.mjs` for the full list).
+    notices: [...new Set(closeScopeNotice.map((e) => e.file))],
+    otherDebtCount,
   };
 
   if (args.json) {
@@ -1171,13 +1187,18 @@ function applySessionClose(args) {
         console.log('  Payload introduced a lint blocker — fix the payload content and retry.');
       }
     }
-    if (postNotice.length > 0) {
+    if (closeScopeNotice.length > 0) {
       console.log(
-        `\n· ${postNotice.length} pre-existing lint issue(s) in untouched files (not blocking): ${[
-          ...new Set(postNotice.map((e) => e.file)),
+        `\n· ${closeScopeNotice.length} pre-existing lint issue(s) in untouched files (not blocking): ${[
+          ...new Set(closeScopeNotice.map((e) => e.file)),
         ]
           .slice(0, 5)
-          .join(', ')}${postNotice.length > 5 ? ', …' : ''}`,
+          .join(', ')}${closeScopeNotice.length > 5 ? ', …' : ''}`,
+      );
+    }
+    if (otherDebtCount > 0) {
+      console.log(
+        `\n· +${otherDebtCount} pre-existing lint issue(s) elsewhere in the vault (other projects / shared pages, not blocking) — run \`node scripts/lint.mjs\` for the full list.`,
       );
     }
   }
@@ -1186,6 +1207,29 @@ function applySessionClose(args) {
 
 // ── helpers ──────────────────────────────────────────────────────────────────
 
+// Cap the warn list in MODEL-FACING lint output. `result.lint` is serialized
+// into the --json apply result the documented close path reads, and lint runs
+// twice per close (preflight + post-apply), so an un-capped warn list (e.g.
+// hundreds of broken-wikilink warnings) lands in model context twice on every
+// close. Errors stay full (few, actionable); warns collapse to a count plus a
+// small sample for quick diagnosis. The INTERNAL preflightLint / postApplyLint
+// objects are untouched — the blocking filter and the pending-tag scan still
+// read the full warn list. lint.mjs --json itself also stays full: its
+// programmatic consumers (the pending-tag scan, the PreCompact W8 filter, tests)
+// need every warn.
+function summarizeLintForOutput(l) {
+  const SAMPLE = 10;
+  const warns = l.warns || [];
+  const out = {
+    ok: l.ok,
+    errors: l.errors || [],
+    warnCount: warns.length,
+    warns: warns.slice(0, SAMPLE),
+  };
+  if (warns.length > SAMPLE) out.warnsTruncated = warns.length - SAMPLE;
+  return out;
+}
+
 function parseFrontmatter(content) {
   const m = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
   if (!m) return null;

package/scripts/doctor.mjs

@@ -221,7 +221,7 @@ function checkDirectories(hypoDir) {
     'pages',
     'projects',
     'sources',
-    // Extensions baseline (ADR 0024). Existence only — SHA / settings /
+    // Extensions baseline. Existence only — SHA / settings /
     // manifest integrity is E5.
     'extensions/hooks',
     'extensions/commands',
@@ -308,7 +308,7 @@ function checkSettingsJson() {
   }
 
   // stale hypo-* entries (uninstall remnants).
-  // hypo-ext-* commands are user-extension entries (ADR 0024) — not core hooks,
+  // hypo-ext-* commands are user-extension entries — not core hooks,
   // so they are intentionally absent from HOOK_MAP. Excluded here; their
   // integrity (SHA + manifest + entry match) is checked separately in E5.
   const isExtCommand = (cmd) => /(?:^|[/\s])hypo-ext-[^/\s]+\.mjs(?=$|["'\s])/.test(cmd);
@@ -545,7 +545,7 @@ function checkSyncState(hypoDir) {
 }
 
 function checkProjectSuggestions(hypoDir) {
-  // ADR 0023: the auto-project skip-persistence store. Absent file is
+  // Auto-project skip-persistence store. Absent file is
   // healthy (no offers declined yet). Validate the RAW JSON shape here rather
   // than via readProjectSuggestions(): that helper deliberately normalizes a
   // non-array `skips` to [] for fail-open hook reads, which would mask a
@@ -665,7 +665,7 @@ function checkCodexPaths() {
   }
 }
 
-// ── extensions integrity (ADR 0024, E5) ───────────────────────────
+// ── extensions integrity (E5) ─────────────────────────────────────
 
 // Detect drift between the user's `~/hypomnema/extensions/` source, the recorded
 // per-target SHA map (`hypo-pkg.json`), and the installed copies + settings.json
@@ -685,7 +685,7 @@ function checkCodexPaths() {
 //
 // E5 is doctor SURFACE for extensions integrity. The mixed-group surgical
 // *write* (preserve sibling-plugin hooks, swap only ours) used to be deferred
-// here; ADR 0024 amendment 2026-05-23 lifted that deferral —
+// here; amendment 2026-05-23 lifted that deferral:
 // registerSettings (extensions.mjs:478 docstring) now does occurrence-first +
 // 8-rank canonical write, and the (b) loop below mirrors that read-path via
 // collectOurOccurrences so a valid mixed-group occurrence is no longer warned
@@ -926,7 +926,7 @@ function checkExtensions(hypoDir, claudeHome, target = 'claude') {
   else warn(label, `${sample}${extra}`);
 }
 
-// ── feedback projection (ADR 0031) ──────────────────────────────
+// ── feedback projection ──────────────────────────────────────────
 
 // Spawn feedback-sync.mjs --check --json and map its drift report onto doctor's
 // pass/warn/fail. Integrity violations (exit-3 class: conflict / unpaired marker
@@ -1015,7 +1015,7 @@ function checkFeedbackProjection(hypoDir, claudeHome, projectId) {
   }
 }
 
-// ── stale sibling install (ADR 0038, D) ──────────────────────────────────────
+// ── stale sibling install (D) ────────────────────────────────────────────────
 //
 // Detect a SECOND, older Hypomnema that owns the `hypomnema` bin on PATH while a
 // newer copy owns the active hooks. That sibling is a footgun: `hypomnema init` /

package/scripts/feedback-sync.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * feedback-sync.mjs — project wiki feedback as SoT, external memory as projection (ADR 0031)
+ * feedback-sync.mjs — project wiki feedback as SoT, external memory as projection
  *
  * Wiki `pages/feedback/<slug>.md` is the single source of truth for
  * learning/correction knowledge. Two Claude Code memory surfaces are derived
@@ -506,7 +506,7 @@ async function resolveProjectId(args, { prompt = defaultPrompt, isTTY } = {}) {
 //
 // Both modes are *reverse* one-time helpers that scaffold wiki DRAFTS under
 // pages/feedback/_drafts/ — they NEVER write pages/feedback/<slug>.md directly
-// (the single-direction invariant, ADR 0031 §6). A human reviews each draft,
+// (the single-direction invariant). A human reviews each draft,
 // fills the decision fields (scope/tier/targets/promote_to_global), and moves
 // it into pages/feedback/. _drafts/ is excluded from sync candidates
 // (loadFeedbackPages) and from lint (collectPages skips `_`-dirs), so an
@@ -856,7 +856,7 @@ function run(args, resolvedPid = null) {
   // not actionable drift — contract §5 step 4 promises this never hard-fails,
   // so it must stay OUT of strictWarnings or the PreCompact gate (#3, which
   // runs `--check --strict`) would block every first-run user. A private-
-  // sensitivity page IS a real SoT violation (ADR 0031 §7; lint #8 blocks it
+  // sensitivity page IS a real SoT violation (lint #8 blocks it
   // at the source) so it stays strict-escalatable as defense-in-depth.
   const warnings = [];
   const strictWarnings = [];
@@ -875,8 +875,8 @@ function run(args, resolvedPid = null) {
 
   // pass 1: preflight every target before touching disk — validates the write
   // plan (container/anchor, markers) and computes next content. A conflict /
-  // over-cap / build error in ANY target blocks writes to ALL (atomicity — ADR
-  // 0031 Decision §6 "no auto-merge"; avoids a partial write where one target
+  // over-cap / build error in ANY target blocks writes to ALL (atomicity:
+  // "no auto-merge"; avoids a partial write where one target
   // lands and another refuses).
   const evals = targets.map((target) => ({ target, res: evaluateTarget(pages, target) }));
   for (const { target, res } of evals) {

package/scripts/feedback.mjs

@@ -3,8 +3,8 @@
  * Hypomnema feedback script
  *
  * Creates or appends to pages/feedback/<topic>.md with a behaviour-correction
- * entry. The wiki feedback page is the single source of truth (ADR 0031 / fix
- * #37); MEMORY.md and CLAUDE.md <learned_behaviors> are one-way *projections*
+ * entry. The wiki feedback page is the single source of truth; MEMORY.md and
+ * CLAUDE.md <learned_behaviors> are one-way *projections*
  * derived from it. Never hand-edit those targets — this script writes the page
  * and then runs `feedback-sync --write` to refresh the projection automatically.
  *
@@ -123,7 +123,7 @@ function listTopics(hypoDir) {
   for (const f of files) console.log(`  ${f.replace(/\.md$/, '')}`);
 }
 
-// ── classification validation (mirrors lint #8 / ADR 0031 §6) ──────────────────
+// ── classification validation (mirrors lint #8) ─────────────────────────────────
 
 const TIER_ENUM = ['L1', 'L2'];
 const SENSITIVITY_ENUM = ['public', 'sanitized']; // private is forbidden (wiki is git-public)
@@ -136,7 +136,7 @@ function parseTargets(raw) {
     .filter(Boolean);
 }
 
-// FEAT-1: `failure_type` is OPTIONAL — an unset value is always fine. A set value
+// `failure_type` is OPTIONAL: an unset value is always fine. A set value
 // must be one of the eight enum members (same vocabulary lint enforces). Returns
 // an error string or null. Shared by create (validateClassification) and append.
 function failureTypeError(value) {
@@ -168,7 +168,7 @@ function validateClassification(args, targets) {
   const ftErr = failureTypeError(args.failureType);
   if (ftErr) errs.push(ftErr);
 
-  // CLAUDE.md projection candidates must be global + L1 (ADR 0031 §6 filter), and
+  // CLAUDE.md projection candidates must be global + L1 (SoT filter), and
   // carry the two conditional fields (lint #8). Enforce here so we never write a
   // claude-learned page that lint rejects or that silently never projects.
   if (targets.includes('claude-learned')) {
@@ -176,9 +176,8 @@ function validateClassification(args, targets) {
       errs.push('--global-summary is required when --targets includes claude-learned');
     if (!args.promoteToGlobal)
       errs.push('--promote-to-global is required when --targets includes claude-learned');
-    if (args.scope !== 'global')
-      errs.push('claude-learned projection requires --scope=global (ADR 0031 §6)');
-    if (args.tier !== 'L1') errs.push('claude-learned projection requires --tier=L1 (ADR 0031 §6)');
+    if (args.scope !== 'global') errs.push('claude-learned projection requires --scope=global');
+    if (args.tier !== 'L1') errs.push('claude-learned projection requires --tier=L1');
   }
   return errs;
 }
@@ -279,7 +278,7 @@ function writeFeedback(args, today) {
     // Append a dated entry; preserve existing frontmatter classification.
     mode = 'append';
     const existing = readFileSync(filePath, 'utf-8');
-    // FEAT-1: failure_type is a per-page classification property. On append,
+    // failure_type is a per-page classification property. On append,
     // set it if the page has none, error if it conflicts with an existing value,
     // no-op if it matches. Without the flag, append is byte-for-byte unchanged.
     const existingFt = (parseFrontmatter(existing) || {}).failure_type || null;
@@ -348,7 +347,7 @@ function writeFeedback(args, today) {
   return { wrote: true };
 }
 
-// ── projection post-step (ADR 0031) ────────────────────────────────────────────
+// ── projection post-step ────────────────────────────────────────────────────────
 
 // Refresh the MEMORY.md / CLAUDE.md projection from the just-written page. This
 // is best-effort and NON-blocking: a projection failure (over-cap, conflict,