hypomnema 1.4.2 → 1.5.1

package/hooks/version-check.mjs

@@ -249,7 +249,7 @@ export function isOptedOut(env = process.env) {
   return Boolean(env.HYPO_NO_UPDATE_CHECK || env.NO_UPDATE_NOTIFIER || env.CI);
 }
 
-// ── stale-sibling detection (ADR 0038) ───────────────────────────────────────
+// ── stale-sibling detection ───────────────────────────────────────────────────
 //
 // A second, OLDER Hypomnema can sit on $PATH (e.g. a stale `npm i -g hypomnema`)
 // while a newer copy owns the active hooks. The CLI bin (`hypomnema`) then routes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hypomnema",
-  "version": "1.4.2",
+  "version": "1.5.1",
   "description": "LLM-native personal wiki system for Claude Code",
   "type": "module",
   "license": "MIT",
@@ -14,6 +14,10 @@
     "!scripts/bump-version.mjs",
     "!scripts/smoke-pack.mjs",
     "!scripts/smoke-plugin.mjs",
+    "!scripts/fix-status-verify.mjs",
+    "!scripts/lib/fix-status-verify.mjs",
+    "!scripts/lib/fix-manifest.mjs",
+    "!scripts/lib/adr-corpus.mjs",
     "commands/",
     "hooks/",
     "skills/",

package/scripts/check-tracker-ids.mjs

@@ -1,13 +1,14 @@
 #!/usr/bin/env node
 /**
  * check-tracker-ids.mjs — CLI gate: no wiki-internal tracker IDs (ISSUE-N,
- * fix #N) in OSS-public artifacts.
+ * fix #N, FEAT-N, IMPR-N, PRAC-N) in OSS-public artifacts.
  *
  * Rule source: CLAUDE.md learned_behaviors (no-internal-tracker-ids-in-oss-
  * artifacts, 2026-06-09). The repo ships through npm + a Claude Code plugin;
- * a `fix #N` / `ISSUE-N` in any shipped file or in README/CHANGELOG is a
- * dangling pointer into the maintainer's PRIVATE wiki tracker. GitHub refs
- * (`PR #N`, `(#N)`, `#N`, issue URLs) are legitimate and never flagged.
+ * an `ISSUE-N` / `fix #N` / `FEAT-N` / `IMPR-N` / `PRAC-N` in any shipped file or
+ * in README/CHANGELOG is a dangling pointer into the maintainer's PRIVATE wiki
+ * tracker. GitHub refs (`PR #N`, `(#N)`, `#N`, issue URLs) are legitimate and
+ * never flagged.
  *
  * Modes:
  *   --all (default)        Walk the public-artifact scope and scan every text
@@ -31,14 +32,16 @@
  * auto-ships it) + shipped trees commands/ hooks/ scripts/ skills/ templates/
  * docs/ .github/ .claude-plugin/. Excluded: tests/ and qa-runs/ (internal
  * maintainer artifacts — a tracker id in a test description aids traceability
- * and never reaches an installed user), node_modules/, .git/. The checker's OWN
- * sources are scanned (NOT exempt); their examples use `N` placeholders so they
- * stay clean.
+ * and never reaches an installed user), node_modules/, .git/, and the
+ * fix-status-verify subsystem (EXCLUDED_FILES — maintainer-only, carries wiki
+ * `decisions/` paths as runtime data, un-shipped from the npm package). The
+ * checker's OWN sources are scanned (NOT exempt); their examples use `N`
+ * placeholders so they stay clean.
  *
- * ADR scope (narrower): README.md, README.ko.md, and docs/ additionally block
- * `ADR NNNN` / `decisions/NNNN` wiki-ADR pointers (USER_FACING_PATTERNS). Shipped
- * code comments and CHANGELOG history keep their ADR anchors, so this set is
- * applied per-file via patternsFor() only inside that doc surface.
+ * ADR scope: `ADR NNNN` / `decisions/NNNN` wiki-ADR pointers (DECISION_PATTERNS)
+ * are blocked everywhere in scope EXCEPT CHANGELOG.md, whose version history
+ * legitimately cites the decision behind a release line. patternsFor() applies the
+ * broader set to every in-scope file but the CHANGELOG.
  */
 
 import { readFileSync, readdirSync, statSync, existsSync } from 'node:fs';
@@ -50,7 +53,7 @@ import {
   stripScissors,
   messageHasGitTemplate,
   BLOCKED_PATTERNS,
-  USER_FACING_PATTERNS,
+  DECISION_PATTERNS,
   TAG_BODY_PATTERNS,
 } from './lib/check-tracker-ids.mjs';
 import {
@@ -70,7 +73,8 @@ const REPO_ROOT = process.env.CHECK_TRACKER_ROOT || join(__dirname, '..');
 
 const RULE_REF =
   'Rule: CLAUDE.md learned_behaviors (no-internal-tracker-ids-in-oss-artifacts). ' +
-  'OSS-public artifacts must not reference the private wiki tracker (ISSUE-N / fix #N). ' +
+  'OSS-public artifacts must not reference the private wiki tracker ' +
+  '(ISSUE-N / fix #N / FEAT-N / IMPR-N / PRAC-N). ' +
   'Use a GitHub ref (#N / PR #N) or drop the reference.';
 
 // Top-level public-artifact entry points. Files are scanned directly; dirs are
@@ -94,15 +98,49 @@ const SCOPE_DIRS = [
 // and never reaches an installed user). The checker's OWN sources are NOT
 // excluded — they use `N` placeholders in their examples so they scan clean.
 const EXCLUDED_DIRS = new Set(['node_modules', '.git', 'tests', 'qa-runs']);
-const EXCLUDED_FILES = new Set();
+// The fix-status-verify subsystem (run only via `npm run fix:verify`, never by a
+// shipped command/hook/skill) is a maintainer evidence-verification tool. Its
+// manifest carries `decisions/NNNN` wiki paths as RUNTIME DATA (resolved against
+// the maintainer's local wiki), so the anchors cannot be stripped the way a
+// comment can. It is removed from the npm package (package.json `files`) and
+// excluded here so the gate does not flag its load-bearing data.
+// Stored POSIX-style ('/'); paths are normalized before lookup (see toPosix).
+const EXCLUDED_FILES = new Set([
+  'scripts/fix-status-verify.mjs',
+  'scripts/lib/fix-status-verify.mjs',
+  'scripts/lib/fix-manifest.mjs',
+  'scripts/lib/adr-corpus.mjs',
+]);
 
 // Only text artifacts. Binary / lockfiles add noise and never carry prose refs.
-const TEXT_EXT = new Set(['.md', '.mjs', '.js', '.cjs', '.json', '.yml', '.yaml', '.sh', '.txt']);
+// .svg is included because the shipped docs/assets/ logos are hand-authored XML
+// text whose <title>/<desc>/comment fields could carry a dangling wiki pointer.
+const TEXT_EXT = new Set([
+  '.md',
+  '.mjs',
+  '.js',
+  '.cjs',
+  '.json',
+  '.yml',
+  '.yaml',
+  '.sh',
+  '.txt',
+  '.svg',
+]);
+
+// Normalize OS separators to '/' so the two scan modes classify a path the same
+// way on every host: --all builds relPath via relative() (platform sep, so '\' on
+// Windows) while --staged takes git's output (always '/'). Without this, a Windows
+// --staged run would neither exclude the verifier files nor recognize scope dirs.
+// No-op on POSIX (sep is already '/').
+function toPosix(relPath) {
+  return sep === '/' ? relPath : relPath.split(sep).join('/');
+}
 
 function isExcludedRel(relPath) {
-  const parts = relPath.split(sep);
-  if (parts.some((p) => EXCLUDED_DIRS.has(p))) return true;
-  if (EXCLUDED_FILES.has(relPath)) return true;
+  const p = toPosix(relPath);
+  if (p.split('/').some((seg) => EXCLUDED_DIRS.has(seg))) return true;
+  if (EXCLUDED_FILES.has(p)) return true;
   return false;
 }
 
@@ -116,22 +154,22 @@ function isTextFile(p) {
 function isInScope(relPath) {
   if (isExcludedRel(relPath)) return false;
   if (!isTextFile(relPath)) return false;
-  if (SCOPE_FILES.includes(relPath)) return true;
-  return SCOPE_DIRS.includes(relPath.split(sep)[0]);
+  const p = toPosix(relPath);
+  if (SCOPE_FILES.includes(p)) return true;
+  return SCOPE_DIRS.includes(p.split('/')[0]);
 }
 
-// User-facing prose surface: README.md, README.ko.md, and the docs/ tree. These
-// additionally block `ADR NNNN` / `decisions/NNNN` (dangling wiki-ADR pointers).
-// Everything else in scope — shipped code, CHANGELOG, package.json — keeps its ADR
-// anchors, so the broader pattern set is applied here ONLY.
-const USER_FACING_DOCS = new Set(['README.md', 'README.ko.md']);
-function isUserFacingDoc(relPath) {
-  return USER_FACING_DOCS.has(relPath) || relPath.split(sep)[0] === 'docs';
-}
+// `ADR NNNN` / `decisions/NNNN` are dangling pointers into the maintainer's
+// private wiki ADR set, so they are blocked everywhere in scope EXCEPT the
+// CHANGELOG, whose version history legitimately cites the decision behind a
+// release line (and never reaches an installed user as a live link). The verifier
+// subsystem that carries `decisions/` paths as runtime data is already removed by
+// EXCLUDED_FILES, so it is never reached here.
+const ADR_EXEMPT_FILES = new Set(['CHANGELOG.md']);
 function patternsFor(relPath) {
-  return isUserFacingDoc(relPath)
-    ? [...BLOCKED_PATTERNS, ...USER_FACING_PATTERNS]
-    : BLOCKED_PATTERNS;
+  return ADR_EXEMPT_FILES.has(toPosix(relPath))
+    ? BLOCKED_PATTERNS
+    : [...BLOCKED_PATTERNS, ...DECISION_PATTERNS];
 }
 
 // Recursively collect in-scope text files under an absolute dir.

package/scripts/crystallize.mjs

@@ -73,6 +73,7 @@ import { fileURLToPath } from 'url';
 import { resolveHypoRoot, expandHome } from './lib/hypo-root.mjs';
 import { loadHypoIgnore } from './lib/hypo-ignore.mjs';
 import { collectPagesCrystallize, extractWikilinks } from './lib/wikilink.mjs';
+import { aggregateColdCandidates } from './lib/page-usage.mjs';
 import { isValidProjectName } from './lib/project-create.mjs';
 import { appendPendingTags, checkForbidden } from './lib/schema-vocab.mjs';
 import {
@@ -83,10 +84,13 @@ import {
   sessionClosedMarkerPath,
   readSessionClosedMarker,
   partitionLintScope,
+  isUnderProjectDirs,
   sessionLogShardPath,
   sessionLogReadCandidates,
   sessionLogScopePath,
   rootLogEntry,
+  hasSessionLogHeading,
+  hasLogEntry,
   resolveTranscriptBySessionId,
   hasUserCloseSignal,
   commitWikiChanges,
@@ -177,7 +181,7 @@ function parseArgs(argv) {
   return args;
 }
 
-// ── session-close hard gate (ADR 0055) ───────────────────────────────────────
+// ── session-close hard gate ───────────────────────────────────────────────────
 // The marker attests "the USER closed this session". Its evidence transcript is
 // resolved STRICTLY from the session id (a globally-unique UUID) by globbing the
 // Claude project dirs — never from a CLI arg. A model owns the whole subprocess
@@ -208,7 +212,7 @@ function requireProjectDir(args, slug) {
 // flow can self-verify before /compact triggers PreCompact.
 
 function runSessionCloseCheck(args) {
-  // ADR 0046: the check mirrors the FULL PreCompact gate via the shared
+  // The check mirrors the FULL PreCompact gate via the shared
   // precompactGateStatus (close files + lint + design-history + feedback
   // projection), not just the close files — so a green check means /compact
   // won't block on a human-fixable issue. Pass --transcript-path to widen the
@@ -221,9 +225,9 @@ function runSessionCloseCheck(args) {
   // (codex design Finding 2).
   //
   // --project=<slug> narrows BOTH the close status and the lint scope to that one
-  // project: a project-scoped DIAGNOSTIC, NOT the global compact-ready verdict
-  // (ADR 0046 caveat below). It is check-only — the marker writers stay global so
-  // the marker == compact-ready invariant holds (ADR 0047). When narrowed, the
+  // project: a project-scoped DIAGNOSTIC, NOT the global compact-ready verdict.
+  // It is check-only: the marker writers stay global so
+  // the marker == compact-ready invariant holds. When narrowed, the
   // transcript widening is suppressed: a transcript touch in some OTHER project
   // would re-add that project's files to the lint scope and re-block the scoped
   // check, defeating the point. The global (no --project) check keeps widening.
@@ -238,9 +242,9 @@ function runSessionCloseCheck(args) {
   });
   const close = status.close;
 
-  // ADR 0047: when a --session-id is supplied, report whether THIS session's
+  // When a --session-id is supplied, report whether THIS session's
   // per-session marker (the Stop-chain completion signal) exists. This is a
-  // separate field, NOT folded into `ok` — `ok` stays the ADR 0046 compact-
+  // separate field, NOT folded into `ok`: `ok` stays the compact-
   // readiness verdict. A green gate with marker_present=false is exactly the
   // hand-edit close state: close is compact-ready but the Stop hook will
   // still block until the marker is written.
@@ -328,7 +332,7 @@ function runSessionCloseCheck(args) {
   }
   // Beyond the close files: the rest of the PreCompact gate (lint, design-history,
   // feedback over-cap/conflict). These are what made a "close-complete" check
-  // disagree with the real /compact gate before ADR 0046.
+  // disagree with the real /compact gate before this check was added.
   for (const b of status.blockers) {
     if (b.type !== 'close') console.log(`  ✗ ${b.reason}`);
   }
@@ -336,7 +340,7 @@ function runSessionCloseCheck(args) {
     console.log('');
     for (const n of status.notices) console.log(`  · ${n.reason}`);
   }
-  // ADR 0047: surface the per-session marker state (separate from compact-
+  // Surface the per-session marker state (separate from compact-
   // readiness) so a green-but-unmarked close is visible at verify time.
   if (args.sessionId) {
     console.log('');
@@ -450,7 +454,7 @@ function todayLocal() {
   return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;
 }
 
-// Spec §5.2.7 / §8.3 + ADR 0029: 4 mandatory + 2 optional (`log`, `openQuestions`).
+// Spec §5.2.7 / §8.3: 4 mandatory + 2 optional (`log`, `openQuestions`).
 // The payload shape MUST mirror that contract — missing a mandatory field is a
 // payload bug, not a no-op. Caller is the LLM session-close flow, which composes
 // the payload deliberately; partial payloads must fail loudly so caller fixes
@@ -501,14 +505,14 @@ function validatePayloadShape(payload) {
   return errs;
 }
 
-// ── session-close marker (ADR 0022 amendment 2026-05-19) ──────
+// ── session-close marker (amendment 2026-05-19) ───────────────
 // Standalone marker writer. Used when the LLM closes the session via direct
 // Write tool calls (not --apply-session-close). Hook `hypo-auto-minimal-
 // crystallize` is the only Reader; writer authority is intentionally split
 // between this CLI and the auto-write at the tail of applySessionClose.
 //
 // Contract: the marker is written only when the FULL /compact gate
-// (precompactGateStatus, ADR 0046) is green. A failed gate exits 1 with no
+// (precompactGateStatus) is green. A failed gate exits 1 with no
 // marker — the next Stop hook re-blocks.
 
 function runMarkSessionClosed(args) {
@@ -520,12 +524,12 @@ function runMarkSessionClosed(args) {
   // --project=<slug> on --mark is ATTRIBUTION ONLY (the marker's `project` field).
   // The gate stays GLOBAL — never narrowed — because a marker that narrowed its
   // gate could attest compact-ready while PreCompact re-checks all of today's
-  // projects and stays red (the marker == compact-ready invariant, ADR 0047 /
+  // projects and stays red (the marker == compact-ready invariant,
   // codex design finding 1/2). Validate the attribution slug exists as a
   // directory, exactly as --check does, but only when it is actually used (a
   // --log-only mark attributes to no project, so --project is moot there).
   if (args.project && !args.logOnly) requireProjectDir(args, args.project);
-  // ADR 0047: the per-session marker is the THIRD session-close completion
+  // The per-session marker is the THIRD session-close completion
   // signal (after the PreCompact gate and `--check-session-close`). It must use
   // the SAME gate that governs /compact — precompactGateStatus — so the marker
   // can never attest "closed" while /compact would still block. This subsumes
@@ -570,7 +574,7 @@ function runMarkSessionClosed(args) {
     }
     process.exit(1);
   }
-  // User-close hard gate (ADR 0055): the compact gate above only proves the wiki
+  // User-close hard gate: the compact gate above only proves the wiki
   // is compact-ready; it does NOT prove the USER asked to close. Refuse the marker
   // unless the transcript carries a genuine user close signal (NL close phrase,
   // /compact, or an AskUserQuestion close answer). This is the hard backstop for
@@ -618,7 +622,7 @@ function runMarkSessionClosed(args) {
     scope: args.logOnly ? 'log-only' : 'project',
     date: status.dates[0],
     notices: gate.notices,
-    // ADR 0047: pure feedback-projection drift is a non-blocker — the marker
+    // pure feedback-projection drift is a non-blocker: the marker
     // attests "compact-ready (no human-fixable blocker)", and the PreCompact
     // hook self-heals the projection (feedback-sync --write) at /compact. Surface
     // the deferral so the caller knows MEMORY/CLAUDE sync is pending, not lost.
@@ -652,7 +656,7 @@ function applySessionClose(args) {
   // for any actual apply work (readPayload below surfaces "payload is
   // required" the same way it always has).
   if (!args.force && !args.payload) {
-    // ADR 0043: no-payload "already complete?" probe uses the
+    // No-payload "already complete?" probe uses the
     // global invariant, not a recency pick.
     const probe = sessionCloseGlobalStatus(args.hypoDir);
     if (probe.ok) {
@@ -752,21 +756,49 @@ function applySessionClose(args) {
   }
   const date = payload.date || todayLocal();
 
-  // B-1 derive precondition: when `log` is omitted, apply reconstructs the root
-  // log.md entry from THIS close's sessionLog heading. If sessionLog.entry has no
-  // `## [<date>] …` heading there is nothing to derive — and on a same-day SECOND
-  // close the date-level freshness verifier would still pass on the earlier
-  // close's entry, so the no-write would slip through as ok:true. Fail loud here,
-  // before any writes (codex pre-commit review).
-  if (
-    !payload.log &&
-    !new RegExp(`^#{1,6} \\[${date}\\]`, 'm').test(payload.sessionLog.entry || '')
-  ) {
-    const msg =
-      `payload.sessionLog.entry has no "## [${date}] …" heading to derive the log.md ` +
-      `entry from. Give it a dated heading, or supply payload.log explicitly.`;
-    console.log(args.json ? JSON.stringify({ ok: false, error: msg }, null, 2) : `✗ ${msg}`);
+  // Pre-apply freshness-contract gate: the post-apply verification holds
+  // sessionCloseFileStatus's hasSessionLogHeading / hasLogEntry as the
+  // definition of "closed today". Enforce that SAME contract on the payload
+  // BEFORE writing a byte, so a heading the gate won't recognize is rejected
+  // here as a format mismatch — not written and then misdiagnosed downstream as
+  // "stale" (the "not updated" vs "format mismatch" conflation). All checks
+  // exit 1 with stage='pre-apply-verification' and leave the tree untouched.
+  const failPreApply = (msg) => {
+    console.log(
+      args.json
+        ? JSON.stringify({ ok: false, stage: 'pre-apply-verification', error: msg }, null, 2)
+        : `✗ ${msg}`,
+    );
     process.exit(1);
+  };
+  // (a) The session-log entry must carry a dated `## [<date>] …` ATX heading. The
+  // post-apply gate checks the session-log file for exactly this heading, so a
+  // headingless entry would write then false-fail as "stale". This also doubles
+  // as the B-1 derive precondition: when `log` is omitted the root log.md entry
+  // is reconstructed from THIS heading, and on a same-day SECOND close the
+  // date-level verifier would still pass on the earlier entry, so a no-derive
+  // would slip through as ok:true. The `!payload.log` branch keeps the original
+  // derive-specific wording (a test asserts it).
+  if (!hasSessionLogHeading(payload.sessionLog.entry || '', date)) {
+    failPreApply(
+      !payload.log
+        ? `payload.sessionLog.entry has no "## [${date}] …" heading to derive the log.md ` +
+            `entry from. Give it a dated heading, or supply payload.log explicitly.`
+        : `payload.sessionLog.entry has no "## [${date}] …" heading. The close gate ` +
+            `identifies a session-log by its dated ATX heading; give the entry a ` +
+            `"## [${date}] <title>" heading (the brackets are required).`,
+    );
+  }
+  // (b) An explicit payload.log entry must match the canonical
+  // `## [<date>] session | <project>` line the gate looks for (colon or space
+  // delimiter after the slug). Otherwise the write lands but post-apply
+  // verification reports log.md as stale. When `log` is omitted the line is
+  // derived canonically (rootLogEntry) so this cannot mismatch.
+  if (payload.log && !hasLogEntry(payload.log.entry || '', date, project)) {
+    failPreApply(
+      `payload.log.entry has no "## [${date}] session | ${project}" heading that the ` +
+        `close gate recognizes. Fix the entry heading, or omit payload.log to derive it.`,
+    );
   }
 
   // Preflight: lint the wiki BEFORE writing any payload bytes. If lint
@@ -793,7 +825,7 @@ function applySessionClose(args) {
   // payloadScope = every file this apply writes or appends. Both lint passes are
   // judged against it; errors elsewhere are surfaced as notices, never blocking.
   //
-  // session-log needs TWO entries (ADR 0050): the daily WRITE target (what this
+  // session-log needs TWO entries: the daily WRITE target (what this
   // apply creates/appends, judged by post-apply lint) AND the freshness EVIDENCE
   // file. They coincide except in the hybrid cutover month, where a fallback-
   // aware no-op (the identical entry already lives in the legacy monthly file)
@@ -837,7 +869,7 @@ function applySessionClose(args) {
       ok: false,
       stage: 'preflight-lint',
       error: 'lint preflight failed — apply aborted (no payload bytes written)',
-      lint: { ...preflightLint, blockingErrors },
+      lint: { ...summarizeLintForOutput(preflightLint), blockingErrors },
     };
     if (args.json) {
       console.log(JSON.stringify(out, null, 2));
@@ -875,7 +907,7 @@ function applySessionClose(args) {
     const rel = join('projects', project, 'session-log', `${date}.md`);
     const full = join(args.hypoDir, rel);
     const isPresent = entryAlreadyPresent(payload.sessionLog.entry);
-    // Fallback-aware idempotency (ADR 0050 hybrid cutover): during the month the
+    // Fallback-aware idempotency (hybrid cutover): during the month the
     // shard takes over, today's entry may already live in the legacy monthly
     // file from an earlier (pre-cutover) close. Treat presence in EITHER the
     // daily shard or the legacy monthly file as "already written" so a same-day
@@ -905,7 +937,7 @@ function applySessionClose(args) {
       // otherwise mistake it for the evidence file. The dated `## [date] ...`
       // heading lives inside the entry, so freshness / derive / design-history
       // are unchanged.
-      // PRAC-17 audit fields. The shard frontmatter is git-tracked and synced, so
+      // Audit fields (device, session_id). The shard frontmatter is git-tracked and synced, so
       // `device` is an INTENTIONAL synced multi-machine identifier (privacy note:
       // docs/ARCHITECTURE.md). It is a CREATOR-only stamp — only the session/
       // machine that first seeds the daily shard is recorded; later same-day
@@ -1037,11 +1069,17 @@ function applySessionClose(args) {
   const postLintOk = !postApplyCrashed && postBlocking.length === 0;
   const ok = verification.ok && postLintOk;
 
-  // ADR 0022 amendment 2026-05-19: auto-write the per-session
+  // Scope the non-blocking notice to the close-target project: debt under
+  // projects/<project>/ stays listed; debt elsewhere folds to a count so the
+  // same untouched-file debt does not re-list its filenames on every close.
+  const closeScopeNotice = postNotice.filter((e) => isUnderProjectDirs(e.file, [project]));
+  const otherDebtCount = postNotice.length - closeScopeNotice.length;
+
+  // Amendment 2026-05-19: auto-write the per-session
   // closed marker on a verified close. Hook authority is read-only; this is
   // one of the two writer paths (the other is --mark-session-closed standalone).
   //
-  // ADR 0047: the marker write is governed by the SAME gate as standalone
+  // The marker write is governed by the SAME gate as standalone
   // --mark-session-closed and /compact (precompactGateStatus), NOT just apply's
   // `ok` + git-clean. Apply's payload preflight/post-apply lint and `ok` still
   // govern apply SUCCESS (exit code below), but the marker must additionally
@@ -1049,13 +1087,13 @@ function applySessionClose(args) {
   // path could issue a marker the standalone path would refuse (the second
   // divergence codex flagged).
   //
-  // ADR 0056: apply just wrote the payload, so the tree is dirty by its OWN
-  // writes — the gate's `uncommitted` git blocker would always trip and the
+  // Apply just wrote the payload, so the tree is dirty by its OWN
+  // writes: the gate's `uncommitted` git blocker would always trip and the
   // marker would be skipped, deferring the close to a manual --mark-session-closed
-  // (the ADR 0047 "done but still blocked" regression). Commit the payload HERE, via
+  // ("done but still blocked" regression). Commit the payload HERE, via
   // the SAME .hypoignore-aware helper the auto-commit Stop hook uses, so the gate sees
   // a committed tree. Push stays deferred to the Stop hook; the resulting
-  // committed-but-unpushed state is a gate notice, not a blocker (ADR 0056), so
+  // committed-but-unpushed state is a gate notice, not a blocker, so
   // this still marks. A commit failure (not a repo / pre-commit reject / git error)
   // skips the marker WITH a surfaced reason — today's behavior was also "no marker",
   // but silently.
@@ -1077,14 +1115,14 @@ function applySessionClose(args) {
         // (feedback/W8/hot/lint — git is now committed) is resolved.
         markerSkipReason = 'compact-gate-not-ok';
       } else if (!closeTranscript || !hasUserCloseSignal(closeTranscript)) {
-        // User-close hard gate (ADR 0055): apply succeeded (payload files written)
+        // User-close hard gate: apply succeeded (payload files written)
         // but the user never signalled session close, so the marker — which attests
         // "user closed" — is withheld. The wiki record stands; the session is simply
         // not marked closed. Surfaced (not silent) so the caller knows.
         markerSkipReason = closeTranscript ? 'no-user-close-signal' : 'transcript-unresolved';
       } else {
         writeSessionClosedMarker(args.hypoDir, args.sessionId, { project });
-        // Codex CONCERN (ADR 0055/0056): the writer swallows IO errors (best-effort).
+        // Codex CONCERN: the writer swallows IO errors (best-effort).
         // Verify the file actually landed — mirroring the standalone path — instead of
         // asserting markerWritten=true, so a .cache permission/disk problem surfaces
         // rather than the caller reporting "closed" while the next Stop re-blocks.
@@ -1111,13 +1149,22 @@ function applySessionClose(args) {
     applied,
     skipped,
     verification,
-    // ADR 0055: surface the marker outcome instead of skipping silently, so the
+    // Surface the marker outcome instead of skipping silently, so the
     // caller can tell "closed" from "applied but not marked".
     ...(args.sessionId ? { markerWritten, markerSkipReason } : {}),
-    lint: { preflight: preflightLint, postApply: postApplyLint },
-    // Pre-existing lint debt in files this close did not author (Bug B): surfaced
-    // for visibility, never gated. Empty on a clean vault.
-    notices: [...new Set(postNotice.map((e) => e.file))],
+    lint: {
+      preflight: summarizeLintForOutput(preflightLint),
+      postApply: summarizeLintForOutput(postApplyLint),
+    },
+    // Pre-existing lint debt in files this close did not author: surfaced for
+    // visibility, never gated. Empty on a clean vault. Scoped to the close-target
+    // project's own dir — debt under projects/<project>/ is this close's
+    // neighborhood and stays listed; debt elsewhere (other projects, shared
+    // pages, root files) folds into otherDebtCount so the same untouched-file
+    // debt does not re-list its filenames on every close (run `node
+    // scripts/lint.mjs` for the full list).
+    notices: [...new Set(closeScopeNotice.map((e) => e.file))],
+    otherDebtCount,
   };
 
   if (args.json) {
@@ -1171,13 +1218,18 @@ function applySessionClose(args) {
         console.log('  Payload introduced a lint blocker — fix the payload content and retry.');
       }
     }
-    if (postNotice.length > 0) {
+    if (closeScopeNotice.length > 0) {
       console.log(
-        `\n· ${postNotice.length} pre-existing lint issue(s) in untouched files (not blocking): ${[
-          ...new Set(postNotice.map((e) => e.file)),
+        `\n· ${closeScopeNotice.length} pre-existing lint issue(s) in untouched files (not blocking): ${[
+          ...new Set(closeScopeNotice.map((e) => e.file)),
         ]
           .slice(0, 5)
-          .join(', ')}${postNotice.length > 5 ? ', …' : ''}`,
+          .join(', ')}${closeScopeNotice.length > 5 ? ', …' : ''}`,
+      );
+    }
+    if (otherDebtCount > 0) {
+      console.log(
+        `\n· +${otherDebtCount} pre-existing lint issue(s) elsewhere in the vault (other projects / shared pages, not blocking) — run \`node scripts/lint.mjs\` for the full list.`,
       );
     }
   }
@@ -1186,6 +1238,29 @@ function applySessionClose(args) {
 
 // ── helpers ──────────────────────────────────────────────────────────────────
 
+// Cap the warn list in MODEL-FACING lint output. `result.lint` is serialized
+// into the --json apply result the documented close path reads, and lint runs
+// twice per close (preflight + post-apply), so an un-capped warn list (e.g.
+// hundreds of broken-wikilink warnings) lands in model context twice on every
+// close. Errors stay full (few, actionable); warns collapse to a count plus a
+// small sample for quick diagnosis. The INTERNAL preflightLint / postApplyLint
+// objects are untouched — the blocking filter and the pending-tag scan still
+// read the full warn list. lint.mjs --json itself also stays full: its
+// programmatic consumers (the pending-tag scan, the PreCompact W8 filter, tests)
+// need every warn.
+function summarizeLintForOutput(l) {
+  const SAMPLE = 10;
+  const warns = l.warns || [];
+  const out = {
+    ok: l.ok,
+    errors: l.errors || [],
+    warnCount: warns.length,
+    warns: warns.slice(0, SAMPLE),
+  };
+  if (warns.length > SAMPLE) out.warnsTruncated = warns.length - SAMPLE;
+  return out;
+}
+
 function parseFrontmatter(content) {
   const m = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
   if (!m) return null;
@@ -1271,8 +1346,12 @@ const synthesisGroups = Object.entries(tagGroups)
   .sort((a, b) => b[1].length - a[1].length)
   .map(([tag, pages]) => ({ tag, pages }));
 
+// Lookup-cold candidates (B): pages with inbound wikilinks that lookup has not
+// injected within the recency window. Advisory only, never gates, never mutates.
+const coldCandidates = aggregateColdCandidates(args.hypoDir, { ignorePatterns });
+
 if (args.json) {
-  console.log(JSON.stringify({ synthesisGroups, unlinked, drafts }, null, 2));
+  console.log(JSON.stringify({ synthesisGroups, unlinked, drafts, coldCandidates }, null, 2));
   process.exit(0);
 }
 
@@ -1302,6 +1381,25 @@ if (drafts.length > 0) {
   console.log('');
 }
 
+// Advisory (non-gating): pages the graph treats as live but lookup has not
+// injected recently. Held until enough page-usage history accrues.
+if (coldCandidates.status === 'ok' && coldCandidates.candidates.length > 0) {
+  found = true;
+  console.log(
+    `Lookup-cold pages (${coldCandidates.candidates.length}), inbound links but not injected recently:`,
+  );
+  for (const p of coldCandidates.candidates) console.log(`  [[${p.slug}]] (${p.title})`);
+  console.log('');
+} else if (
+  coldCandidates.status === 'insufficient-data' &&
+  coldCandidates.reason === 'span-too-short'
+) {
+  // Only surface the "held" notice once a log is actually accruing (span under
+  // the cold-start window). A vault with no log at all stays silent so this
+  // advisory never becomes permanent noise on every crystallize run.
+  console.log('Lookup-cold scan held: not enough page-usage history yet (advisory).\n');
+}
+
 if (!found) {
   console.log('✓ No crystallization candidates found — Hypomnema looks well-connected.');
 }