hypomnema 1.6.1 → 1.7.0

package/hooks/hypo-auto-minimal-crystallize.mjs

@@ -36,8 +36,9 @@
  * gate above was found to be unable to distinguish "close now" from "close
  * once X is done" by regex alone — same sentence shape either way). When the
  * close-intent gate above fires AND the session has a work-incomplete signal
- * (an uncommitted wiki, or an in-flight delegated subagent per
- * hasInFlightSubagent), step 6's block reason is replaced with an
+ * (an uncommitted wiki, or pending background work — a non-terminal
+ * background task or a scheduled cron wake — per hasPendingBackgroundWork),
+ * step 6's block reason is replaced with an
  * AskUserQuestion instruction instead of a crystallize command — the model
  * asks the user "close now?" rather than deciding for them. A correlated
  * "아직"/"나중"/"not yet"/"later" answer (isCloseReconfirmDeclined) suppresses
@@ -65,7 +66,7 @@ import {
   isClosePattern,
   isGateSkipped,
   precompactGateStatus,
-  hasInFlightSubagent,
+  hasPendingBackgroundWork,
   isCloseReconfirmDeclined,
   CLOSE_RECONFIRM_MARK,
 } from './hypo-shared.mjs';
@@ -95,8 +96,8 @@ function emitBlock(sessionId, transcriptPath, gate = null, opts = {}) {
       JSON.stringify({
         decision: 'block',
         reason:
-          `[WIKI_AUTOCLOSE] close 신호가 잡혔지만 아직 커밋되지 않은 변경(또는 진행 중인 ` +
-          `위임 작업)이 있어 지금 닫을지 뒤로 미룰지 모호합니다 (session_id=${sessionId}). ` +
+          `[WIKI_AUTOCLOSE] close 신호가 잡혔지만 아직 커밋되지 않은 변경 또는 진행 중인 ` +
+          `백그라운드·위임 작업이 있어 지금 닫을지 뒤로 미룰지 모호합니다 (session_id=${sessionId}). ` +
           `임의로 닫지 말고 AskUserQuestion으로 사용자에게 지금 세션을 닫을지 물어보세요. ` +
           `선택지는 "${CLOSE_RECONFIRM_MARK}"와 "아직, 계속"으로 제시합니다. 사용자가 ` +
           `"${CLOSE_RECONFIRM_MARK}"를 고른 뒤에만 세션 마무리를 진행하세요. 그전에는 ` +
@@ -122,10 +123,20 @@ function emitBlock(sessionId, transcriptPath, gate = null, opts = {}) {
   // an install/transcript path contains spaces (display text only — never exec'd
   // here).
   const transcriptHint = transcriptPath ? ` --transcript-path="${transcriptPath}"` : '';
+  // Recovery command carries EVIDENCE, never the recency-derived close.project.
+  // The evidence-backed attribution is a singleton close scope (transcript
+  // close-files ∪ this marker's projects); when it is unambiguous, embed it as
+  // --project so the re-run is one-shot instead of failing closed for lack of
+  // evidence. The session cwd (from the payload) rides along so the re-run's own
+  // session-cwd close check runs against the same project this Stop evaluated.
+  const scope = gate?.close?.scope || [];
+  const evidenceProject = scope.length === 1 ? scope[0] : null;
+  const projectHint = evidenceProject ? ` --project=${evidenceProject}` : '';
+  const cwdHint = opts.sessionCwd ? ` --session-cwd="${opts.sessionCwd}"` : '';
   const cliBase = PKG_ROOT ? `node "${join(PKG_ROOT, 'scripts', 'crystallize.mjs')}"` : null;
   const markCmd = cliBase
-    ? `${cliBase} --mark-session-closed --session-id=${sessionId}${transcriptHint}`
-    : `/hypo:crystallize (session_id=${sessionId}${transcriptHint})`;
+    ? `${cliBase} --mark-session-closed --session-id=${sessionId}${projectHint}${transcriptHint}${cwdHint}`
+    : `/hypo:crystallize (session_id=${sessionId}${projectHint}${transcriptHint})`;
   // The log-only escape hatch for a non-project (wiki/tooling-only)
   // session. Offered ONLY as an explicit alternative when a close blocker is
   // present — never as the default recovery, so a real project session is not
@@ -149,7 +160,9 @@ function emitBlock(sessionId, transcriptPath, gate = null, opts = {}) {
     // Only when a project-close blocker is what's holding the session: a
     // non-project session has nothing to close, so offer log-only as the way out
     // (Claude decides whether this session is project-scoped — no auto-attribution).
-    if (gate.blockers.some((b) => b.type === 'close')) {
+    // A session-cwd close blocker (the session's own cwd project is unstarted) is
+    // the same kind of project-close hold, so it gets the same escape.
+    if (gate.blockers.some((b) => b.type === 'close' || b.type === 'close-cwd')) {
       reason += ` If this was a non-project (wiki/tooling-only) session with no project to close, run \`${logOnlyCmd}\` instead (log-only close, no project attribution).`;
     }
   } else {
@@ -201,6 +214,9 @@ process.stdin.on('end', () => {
 
     const sessionId = payload.session_id || payload.sessionId || null;
     const transcriptPath = payload.transcript_path || payload.transcriptPath || null;
+    // Authoritative session cwd (the one verified cwd source) for the session-cwd
+    // close check below. Absent on older Claude Code payloads → the check is skipped.
+    const sessionCwd = payload.cwd || null;
 
     // 3. substantial-session gate. Pure Q&A / incidental-lookup sessions skip
     // the block; mutating sessions AND high-volume read-only investigations
@@ -219,10 +235,49 @@ process.stdin.on('end', () => {
       return;
     }
 
-    // 5. close already verified for this session_id.
-    if (sessionId && readSessionClosedMarker(HYPO_DIR, sessionId)) {
-      emitContinue();
-      return;
+    // Read-only /compact gate (same precompactGateStatus the real PreCompact hook
+    // uses) sharpens the block message and, with sessionCwd, backs the session-cwd
+    // close check below. The hook NEVER writes the marker here (file-header
+    // invariant); this is read-only. Any error → null → emitBlock falls back to the
+    // generic message (fail-open). Computed lazily: the common closed-session path
+    // (a project marker whose cwd project is complete) still short-circuits without
+    // paying the gate cost, unless a cwd signal makes the cwd check meaningful.
+    let gate = null;
+    const computeGate = () => {
+      try {
+        return precompactGateStatus(HYPO_DIR, {
+          ...(transcriptPath ? { transcriptPath } : {}),
+          ...(sessionCwd ? { sessionCwd } : {}),
+          ...(sessionId ? { sessionId } : {}),
+        });
+      } catch {
+        return null;
+      }
+    };
+
+    // 5. close already verified for this session_id — but a project marker only
+    // attests the project(s) it recorded. If THIS session's cwd project still has
+    // an unstarted close, honoring the marker would end the session green while
+    // that project stays open (the session-cwd false-green). So re-check the cwd
+    // project before accepting a project marker. A log-only marker (non-project
+    // session) is exempt, and without a cwd signal we accept the marker as before
+    // (back-compat with payloads that carry no cwd).
+    if (sessionId) {
+      const marker = readSessionClosedMarker(HYPO_DIR, sessionId);
+      if (marker) {
+        if (marker.scope === 'log-only' || !sessionCwd) {
+          emitContinue();
+          return;
+        }
+        gate = computeGate();
+        const cwdBlocked = !!gate?.blockers?.some((b) => b.type === 'close-cwd');
+        if (!cwdBlocked) {
+          emitContinue();
+          return;
+        }
+        // marker present but the session's cwd project close is incomplete: fall
+        // through to block, reusing the gate computed above.
+      }
     }
 
     // 6. block — but only when we have a session_id to address the recovery
@@ -233,31 +288,22 @@ process.stdin.on('end', () => {
       return;
     }
 
-    // Read-only /compact gate (same precompactGateStatus the real
-    // PreCompact hook uses) sharpens the block message — distinguishes "close
-    // is compact-ready, only the marker is missing" from "there are real
-    // blockers". The hook NEVER writes the marker here (file-header invariant);
-    // this is read-only. Any error → null → emitBlock falls back to the generic
-    // message (fail-open).
-    let gate = null;
-    try {
-      gate = precompactGateStatus(HYPO_DIR, transcriptPath ? { transcriptPath } : {});
-    } catch {
-      gate = null;
-    }
+    if (!gate) gate = computeGate();
 
     // Reconfirm decision (conditional-close-reconfirm): "close" and
     // "work-incomplete" together are exactly the case where the transcript's
     // NL close phrase can't tell "close now" from "close once X is done" —
     // regex can't disambiguate this (see spec background). Narrowed to the
-    // two work-incomplete signals only: an uncommitted wiki (`git` blocker;
-    // real unsaved work) OR an in-flight delegated subagent. `hot` / `lint` /
-    // `close` / `design-history` / `feedback` blockers are real close
-    // blockers but not evidence of "later" intent, so they keep the existing
-    // wording (unchanged from before this feature).
+    // work-incomplete signals only: an uncommitted wiki (`git` blocker; real
+    // unsaved work) OR pending background work — a non-terminal background task
+    // (delegated subagent OR shell, e.g. a deferred push/CI wait) or a
+    // scheduled cron wake (hasPendingBackgroundWork). `hot` / `lint` / `close`
+    // / `design-history` / `feedback` blockers are real close blockers but not
+    // evidence of "later" intent, so they keep the existing wording (unchanged
+    // from before this feature).
     const workIncomplete =
       (gate && gate.blockers && gate.blockers.some((b) => b.type === 'git')) ||
-      hasInFlightSubagent(payload);
+      hasPendingBackgroundWork(payload);
     if (workIncomplete && isCloseReconfirmDeclined(transcriptPath)) {
       // The user already answered "아직" to the ambiguous close signal that
       // triggered this Stop turn — suppressing is a continue, not a
@@ -266,7 +312,7 @@ process.stdin.on('end', () => {
       return;
     }
 
-    emitBlock(sessionId, transcriptPath, gate, { reconfirm: workIncomplete });
+    emitBlock(sessionId, transcriptPath, gate, { reconfirm: workIncomplete, sessionCwd });
   } catch (err) {
     // Fail-open on any unexpected error.
     process.stderr.write(`[hypo-auto-minimal-crystallize] error: ${err?.message ?? String(err)}\n`);

package/hooks/hypo-auto-stage.mjs

@@ -6,7 +6,17 @@
  */
 
 import { spawnSync } from 'child_process';
+import { relative } from 'path';
 import { HYPO_DIR, loadHypoIgnore, isIgnored } from './hypo-shared.mjs';
+import { advanceBaseForWrite, hashContent } from './base-store.mjs';
+
+// Tools that REPLACE file bytes. The base advance below must fire only for these:
+// this hook has no matcher in hooks.json (it runs on every PostToolUse), and a
+// read-only tool like Read also carries `tool_input.file_path`. Without this
+// allowlist, merely Reading a target another session had drifted would advance
+// the base to that other session's bytes — silently defeating the write=proposal
+// guard at close. tool_name, not file_path, is the write signal.
+const WRITE_TOOLS = new Set(['Write', 'Edit', 'MultiEdit']);
 
 let input = {};
 try {
@@ -29,6 +39,26 @@ if (filePath.startsWith(HYPO_DIR + '/') || filePath === HYPO_DIR) {
   if (patterns.length === 0 || !isIgnored(filePath, HYPO_DIR, patterns)) {
     spawnSync('git', ['-C', HYPO_DIR, 'add', filePath], { stdio: 'ignore' });
   }
+
+  // Write=proposal gate provenance: when this session's own write lands on one of
+  // the overwrite targets it snapshotted at start, advance that target's base so
+  // the close guard reads the change as "I wrote this", not "someone else did"
+  // (which would fail safe into a false proposal against the session's own edit).
+  // Self-scoping — a no-op unless the path is a tracked base key — so it runs
+  // regardless of .hypoignore (provenance is independent of privacy). Best-effort.
+  //
+  // The Write tool carries its full `content`, so advance to the bytes THIS
+  // session wrote (race-safe: a concurrent write landing between the tool and
+  // this hook cannot be adopted as our base). Edit/MultiEdit have no full content
+  // in the payload, so they fall back to a post-write disk read.
+  if (WRITE_TOOLS.has(input.tool_name) && input.session_id) {
+    const rel = relative(HYPO_DIR, filePath);
+    const known =
+      input.tool_name === 'Write' && typeof input.tool_input?.content === 'string'
+        ? hashContent(input.tool_input.content)
+        : null;
+    advanceBaseForWrite(HYPO_DIR, input.session_id, rel, filePath, known);
+  }
 }
 
 console.log(JSON.stringify({ continue: true, suppressOutput: true }));

package/hooks/hypo-cwd-change.mjs

@@ -24,6 +24,9 @@ import {
   pickProjectByCwd,
   collectProjectWorkingDirs,
   buildVaultOrientation,
+  currentDevice,
+  scopeVisible,
+  readVisibilityScope,
 } from './hypo-shared.mjs';
 
 const PROJECTS_DIR = join(HYPO_DIR, 'projects');
@@ -32,10 +35,32 @@ const MAX_CHARS = 3000;
 
 // Privacy guard: a .hypoignore-matched hot.md must not be
 // re-emitted into additionalContext on cwd change.
+//
+// Visibility guard: same contract as hypo-file-watch and hypo-session-start. A
+// machine-scoped hot.md stays off every machine but its owner. Scope is read
+// from the RAW content before the MAX_CHARS slice, since slicing first could cut
+// the frontmatter off and fail open. The root hot.md carries no frontmatter, so
+// it reads as '' and passes as shared.
 function readIfNotIgnored(path, patterns) {
   if (!path) return null;
   if (patterns.length > 0 && isIgnored(path, HYPO_DIR, patterns)) return null;
-  return readFileSync(path, 'utf-8').slice(0, MAX_CHARS);
+  const raw = readFileSync(path, 'utf-8');
+  if (!scopeVisible(readVisibilityScope(raw), currentDevice())) return null;
+  return raw.slice(0, MAX_CHARS);
+}
+
+// Scoped-out is not absent. Both make readIfNotIgnored return null, but the
+// absent-case placeholder tells the model the file "will be created at session
+// close". On a foreign machine that invites it to author over a hot.md that
+// exists and belongs elsewhere. Report the fact, never the withheld body.
+function isScopedOut(path, patterns) {
+  try {
+    if (!path || !existsSync(path)) return false;
+    if (patterns.length > 0 && isIgnored(path, HYPO_DIR, patterns)) return false;
+    return !scopeVisible(readVisibilityScope(readFileSync(path, 'utf-8')), currentDevice());
+  } catch {
+    return false;
+  }
 }
 
 function findProjectHot(cwd) {
@@ -87,7 +112,11 @@ process.stdin.on('end', () => {
 
     if (newHit) {
       const fromFile = readIfNotIgnored(newHit.hotPath, ignorePatterns);
-      const content = fromFile ?? '(no hot.md yet — will be created at session close)';
+      const content =
+        fromFile ??
+        (isScopedOut(newHit.hotPath, ignorePatterns)
+          ? '(hot.md for this project is scoped to another machine and is not visible here)'
+          : '(no hot.md yet — will be created at session close)');
       // arm the first-prompt marker so the NEXT user prompt re-triggers
       // hypo-first-prompt, which forces a "Resuming <project>" summary line.
       // Only arm when real hot content was actually injected — if hot.md is

package/hooks/hypo-file-watch.mjs

@@ -8,7 +8,14 @@
 
 import { readFileSync, existsSync } from 'fs';
 import { join } from 'path';
-import { HYPO_DIR, loadHypoIgnore, isIgnored } from './hypo-shared.mjs';
+import {
+  HYPO_DIR,
+  loadHypoIgnore,
+  isIgnored,
+  currentDevice,
+  scopeVisible,
+  readVisibilityScope,
+} from './hypo-shared.mjs';
 
 const MAX_CHARS = 2000;
 
@@ -43,7 +50,19 @@ process.stdin.on('end', () => {
       return;
     }
 
-    const content = readFileSync(filePath, 'utf-8').slice(0, MAX_CHARS);
+    const fileRaw = readFileSync(filePath, 'utf-8');
+
+    // Visibility guard: a machine-scoped page (visibility_scope: machine:<owner>)
+    // must not be re-injected on a machine other than its owner. Read the scope
+    // from the raw, unsliced content — slicing to MAX_CHARS first could cut the
+    // frontmatter off and silently make every scoped page pass fail-open.
+    const scope = readVisibilityScope(fileRaw);
+    if (!scopeVisible(scope, currentDevice())) {
+      console.log(JSON.stringify({ continue: true, suppressOutput: true }));
+      return;
+    }
+
+    const content = fileRaw.slice(0, MAX_CHARS);
     const relPath = filePath.replace(HYPO_DIR + '/', '');
 
     console.log(

package/hooks/hypo-first-prompt.mjs

@@ -48,7 +48,17 @@ process.stdin.on('end', () => {
     }
 
     const hasSnapshot = marker.hasSnapshot ?? (marker.hotPath && existsSync(marker.hotPath));
-    const snapshotNote = hasSnapshot ? '' : ' (no snapshot yet — first session)';
+    // A snapshot withheld by visibility_scope is NOT an absent one. session-start
+    // stamps the marker so this hook can tell them apart: without it, a project
+    // resumed on a foreign machine is announced as a first session, and the model
+    // then has every reason to author a fresh hot.md over the one that exists on
+    // the owning machine. Never name the withheld contents, only the fact.
+    const scopedOut = marker.scopedOut === true;
+    const snapshotNote = hasSnapshot
+      ? ''
+      : scopedOut
+        ? ' (snapshot scoped to another machine)'
+        : ' (no snapshot yet — first session)';
     // a cwd-change re-trigger says "Resuming"; a fresh session start
     // (default source) says "Previously working on".
     const verb = marker.source === 'cwd-change' ? 'Resuming' : 'Previously working on';
@@ -63,11 +73,17 @@ process.stdin.on('end', () => {
     // first-ever session (codex v2 review 2026-05-26).
     const exampleLine = hasSnapshot
       ? `${verb} ${projSafe}: [one-line summary]. Continue with [next task]?`
-      : `${verb} ${projSafe}: no prior snapshot yet — first session. What would you like to start with?`;
+      : scopedOut
+        ? `${projSafe}: this project has a prior snapshot, but it is scoped to another machine and is not visible here. What would you like to work on?`
+        : `${verb} ${projSafe}: no prior snapshot yet — first session. What would you like to start with?`;
     const fillNote = hasSnapshot
       ? `Replace the bracketed placeholders using the [HOT] / [SESSION STATE] ` +
         `context already injected this session — do NOT emit the literal brackets.`
-      : `Use the line above verbatim — there is no prior snapshot to summarize.`;
+      : scopedOut
+        ? `Use the line above verbatim. The project has prior work; its snapshot ` +
+          `simply belongs to another machine, so treat it as an existing project ` +
+          `whose history you cannot see from here.`
+        : `Use the line above verbatim — there is no prior snapshot to summarize.`;
 
     console.log(
       JSON.stringify(

package/hooks/hypo-lookup.mjs

@@ -19,6 +19,9 @@ import {
   staleMarkerFor,
   pageUsageLoggingAllowed,
   recordLookupUsage,
+  currentDevice,
+  scopeVisible,
+  readVisibilityScope,
 } from './hypo-shared.mjs';
 
 const INDEX_PATH = join(HYPO_DIR, 'index.md');
@@ -32,7 +35,16 @@ function buildPageMap(dir, root = dir, map = {}, ignorePatterns = [], hypoDir =
   for (const entry of readdirSync(dir)) {
     const full = join(dir, entry);
     if (isIgnored(full, hypoDir, ignorePatterns)) continue;
-    if (statSync(full).isDirectory()) {
+    // Skip an entry we can't stat (dangling symlink, race, permission) instead
+    // of throwing: the map is now built before the miss branch too, so one bad
+    // entry must not sink the whole lookup into the silent outer catch.
+    let st;
+    try {
+      st = statSync(full);
+    } catch {
+      continue;
+    }
+    if (st.isDirectory()) {
       buildPageMap(full, root, map, ignorePatterns, hypoDir);
     } else if (entry.endsWith('.md')) {
       const rel = full.slice(root.length + 1).replace(/\.md$/, '');
@@ -208,25 +220,6 @@ process.stdin.on('end', () => {
     const topScore = scored[0]?.score ?? 0;
     const matched = scored.filter((e) => e.score >= topScore * 0.5);
 
-    if (matched.length === 0) {
-      const topic = keywords.slice(0, 5).join(', ');
-      const closest = bm25Score(keywords, entries)
-        .map((e) => ({ ...e, score: e.score * typePrior(e.slug) }))
-        .sort((a, c) => c.score - a.score)
-        .slice(0, 3)
-        .map((e) => `[[${e.slug}]]`)
-        .join(', ');
-      console.log(
-        JSON.stringify(
-          buildOutput(`[WIKI LOOKUP: miss] "${topic}" — no match. Closest: ${closest || 'none'}`, {
-            continue: true,
-            suppressOutput: true,
-          }),
-        ),
-      );
-      return;
-    }
-
     const ignorePatterns = loadHypoIgnore(HYPO_DIR);
     const pageMap = {
       ...buildPageMap(
@@ -245,19 +238,81 @@ process.stdin.on('end', () => {
       ),
     };
 
+    // Single device snapshot for the whole prompt (currentDevice() itself stays
+    // uncached upstream so tests can override via HYPO_DEVICE; this hook only
+    // needs one read per lookup, not one per candidate).
+    const device = currentDevice();
+
+    // Resolve a slug to its on-disk path the same way the injection loop does.
+    const resolveSlugPath = (slug) =>
+      pageMap[slug] ?? pageMap[slug.replace(/^(pages|projects)\//, '')] ?? pageMap[basename(slug)];
+
+    // Read a page's raw content at most once per lookup: the visibility gate and
+    // the injection loop both need it, so memoize to avoid a double read.
+    const rawCache = new Map();
+    const readRaw = (path) => {
+      if (rawCache.has(path)) return rawCache.get(path);
+      let raw = null;
+      try {
+        raw = readFileSync(path, 'utf-8');
+      } catch {
+        raw = null;
+      }
+      rawCache.set(path, raw);
+      return raw;
+    };
+
+    // Visibility gate: MUST read raw content and go through readVisibilityScope
+    // (never a local frontmatter parser) so first-wins + comment-strip stay in
+    // step with the write side — a local last-wins/no-comment parser would miss
+    // `machine:devA # note` on devA itself. An unresolved/unreadable slug passes
+    // through (nothing to leak; the missing-file paths handle it downstream).
+    const isSlugVisible = (slug) => {
+      const path = resolveSlugPath(slug);
+      if (!path || !existsSync(path)) return true;
+      const raw = readRaw(path);
+      if (raw === null) return true;
+      return scopeVisible(readVisibilityScope(raw), device);
+    };
+
+    // Filter BEFORE the miss decision so a device that matches only machine-other
+    // pages takes the clean miss path (with closest VISIBLE suggestions), not the
+    // "index hit but files missing" branch. Hidden pages never reach injection,
+    // the empty-injection slug branch, or the "+N more" count — all read only
+    // visibleMatched, so no machine-other slug can leak through any path.
+    const visibleMatched = matched.filter((e) => isSlugVisible(e.slug));
+
+    if (visibleMatched.length === 0) {
+      const topic = keywords.slice(0, 5).join(', ');
+      const closest = bm25Score(keywords, entries)
+        .map((e) => ({ ...e, score: e.score * typePrior(e.slug) }))
+        .sort((a, c) => c.score - a.score)
+        .filter((e) => isSlugVisible(e.slug))
+        .slice(0, 3)
+        .map((e) => `[[${e.slug}]]`)
+        .join(', ');
+      console.log(
+        JSON.stringify(
+          buildOutput(`[WIKI LOOKUP: miss] "${topic}" — no match. Closest: ${closest || 'none'}`, {
+            continue: true,
+            suppressOutput: true,
+          }),
+        ),
+      );
+      return;
+    }
+
     // UTC to match doctor.mjs' overdue set (D1/D2). STALE is advisory, so a
     // one-day UTC/local skew never misleads.
     const TODAY = new Date().toISOString().slice(0, 10);
 
     const injected = [];
     const injectedSlugs = [];
-    for (const { slug } of matched.slice(0, MAX_HITS)) {
-      const path =
-        pageMap[slug] ??
-        pageMap[slug.replace(/^(pages|projects)\//, '')] ??
-        pageMap[basename(slug)];
+    for (const { slug } of visibleMatched.slice(0, MAX_HITS)) {
+      const path = resolveSlugPath(slug);
       if (path && existsSync(path)) {
-        const raw = readFileSync(path, 'utf-8');
+        const raw = readRaw(path);
+        if (raw === null) continue;
         // Compute the marker on raw (pre-slice) so a long body can't truncate
         // frontmatter out of reach. fail-open: a marker failure drops the marker,
         // never the page.
@@ -275,7 +330,7 @@ process.stdin.on('end', () => {
     }
 
     if (injected.length === 0) {
-      const slugs = matched
+      const slugs = visibleMatched
         .slice(0, MAX_HITS)
         .map((e) => e.slug)
         .join(', ');
@@ -297,9 +352,11 @@ process.stdin.on('end', () => {
       recordLookupUsage(HYPO_DIR, { sessionId, slugs: injectedSlugs });
     }
 
+    // visibleMatched (not matched): a hidden count would still name a "+N more"
+    // total that includes machine-other pages this device can never see.
     const overflow =
-      matched.length > MAX_HITS
-        ? `\n(+${matched.length - MAX_HITS} more matches — search wiki index for more)`
+      visibleMatched.length > MAX_HITS
+        ? `\n(+${visibleMatched.length - MAX_HITS} more matches — search wiki index for more)`
         : '';
 
     console.log(

package/hooks/hypo-personal-check.mjs

@@ -42,6 +42,7 @@ process.stdin.on('data', (chunk) => (raw += chunk));
 process.stdin.on('end', () => {
   let transcriptPath = null;
   let sessionId = null;
+  let sessionCwd = null;
   try {
     const input = JSON.parse(raw || '{}');
     transcriptPath = input.transcript_path ?? null;
@@ -49,6 +50,11 @@ process.stdin.on('end', () => {
     // semantics (no project attribution) so /compact does not block a closed
     // non-project session on the active/phantom project's files.
     sessionId = input.session_id ?? input.sessionId ?? null;
+    // Authoritative session cwd for the session-cwd close check. This is the one
+    // verified cwd source (mirrors hypo-session-record); it lets /compact block a
+    // session whose own project close was never started, which the recency-based
+    // global status cannot see.
+    sessionCwd = input.cwd ?? null;
   } catch {
     /* fail-open */
   }
@@ -107,6 +113,7 @@ process.stdin.on('end', () => {
     gate = precompactGateStatus(HYPO_DIR, {
       transcriptPath,
       ...(sessionId ? { sessionId } : {}),
+      ...(sessionCwd ? { sessionCwd } : {}),
     });
   } catch (err) {
     // Defense-in-depth: precompactGateStatus fails open per-check, but if it ever
@@ -122,9 +129,11 @@ process.stdin.on('end', () => {
   // turn the (otherwise non-blocking) drift into a blocker, since real drift is
   // confirmed and silently passing it would defeat the gate. --write only applies
   // when no target conflicts/over-caps (code===0 across ALL targets), so a late
-  // race exits non-zero and blocks here. It is semantic-preflight atomic but not
-  // filesystem-atomic (concurrent edit / mid-write I/O fault is best-effort) —
-  // pre-existing engine behavior, not introduced by the self-heal.
+  // race exits non-zero and blocks here. Each FILE it writes is atomic (tmp+
+  // rename, see feedback-sync's atomicWrite), so a mid-write fault can no longer
+  // truncate a target; what is still not atomic is the write ACROSS targets (one
+  // file can land before another fails), which the preflight narrows to genuine
+  // fs errors and no further.
   let feedbackHealed = '';
   if (gate.ok && gate.driftTargets.length > 0) {
     const feedbackPath = PKG_ROOT ? join(PKG_ROOT, 'scripts', 'feedback-sync.mjs') : null;
@@ -179,6 +188,18 @@ process.stdin.on('end', () => {
     const fold = `+${otherDebtCount} pre-existing lint issue(s) elsewhere in the vault (other projects / shared pages, not blocking) — run \`/hypo:lint\` for the full list.`;
     noticeText = noticeText ? `${noticeText}\n${fold}` : `[WIKI CHECK] ${fold}`;
   }
+  // A demoted close: some OTHER session left a project's close incomplete. It no
+  // longer blocks this compact, but it must still be SEEN — a notice list that the
+  // gate silently swallows (suppressOutput when nothing else surfaced) would turn the
+  // demotion into a disappearance, and nobody would ever fix the dangling close
+  // (codex design BLOCKER).
+  const closeDebt = gate.notices.filter((n) => n.type === 'close-debt');
+  if (closeDebt.length > 0) {
+    const line = `[WIKI CHECK] ${closeDebt.length} project(s) with an incomplete session close from another session (not blocking this compact): ${closeDebt
+      .map((n) => n.project)
+      .join(', ')} — each is fixed by that project's next close.`;
+    noticeText = noticeText ? `${noticeText}\n${line}` : line;
+  }
   // Surface the self-heal so a re-synced projection is not a silent mutation of
   // the user's MEMORY.md / CLAUDE.md (transparency).
   if (feedbackHealed) noticeText = noticeText ? `${noticeText}\n${feedbackHealed}` : feedbackHealed;

package/hooks/hypo-session-record.mjs

@@ -12,8 +12,7 @@
 
 import { existsSync, mkdirSync, appendFileSync } from 'fs';
 import { dirname, join } from 'path';
-import { hostname } from 'os';
-import { HYPO_DIR } from './hypo-shared.mjs';
+import { HYPO_DIR, currentDevice } from './hypo-shared.mjs';
 
 const INDEX_PATH = join(HYPO_DIR, '.cache', 'sessions', 'index.jsonl');
 
@@ -54,7 +53,7 @@ process.stdin.on('end', () => {
       // machine identity for multi-machine audit. index.jsonl lives
       // under .cache/ (gitignored in a normal vault), so this is a LOCAL-only
       // per-session record — accurate for every session, no sync/privacy cost.
-      device: hostname() || 'unknown',
+      device: currentDevice(),
     };
     appendFileSync(INDEX_PATH, JSON.stringify(entry) + '\n');
   } catch (err) {