hypomnema 1.6.2 → 1.7.0

package/hooks/hypo-auto-stage.mjs

@@ -6,7 +6,17 @@
  */
 
 import { spawnSync } from 'child_process';
+import { relative } from 'path';
 import { HYPO_DIR, loadHypoIgnore, isIgnored } from './hypo-shared.mjs';
+import { advanceBaseForWrite, hashContent } from './base-store.mjs';
+
+// Tools that REPLACE file bytes. The base advance below must fire only for these:
+// this hook has no matcher in hooks.json (it runs on every PostToolUse), and a
+// read-only tool like Read also carries `tool_input.file_path`. Without this
+// allowlist, merely Reading a target another session had drifted would advance
+// the base to that other session's bytes — silently defeating the write=proposal
+// guard at close. tool_name, not file_path, is the write signal.
+const WRITE_TOOLS = new Set(['Write', 'Edit', 'MultiEdit']);
 
 let input = {};
 try {
@@ -29,6 +39,26 @@ if (filePath.startsWith(HYPO_DIR + '/') || filePath === HYPO_DIR) {
   if (patterns.length === 0 || !isIgnored(filePath, HYPO_DIR, patterns)) {
     spawnSync('git', ['-C', HYPO_DIR, 'add', filePath], { stdio: 'ignore' });
   }
+
+  // Write=proposal gate provenance: when this session's own write lands on one of
+  // the overwrite targets it snapshotted at start, advance that target's base so
+  // the close guard reads the change as "I wrote this", not "someone else did"
+  // (which would fail safe into a false proposal against the session's own edit).
+  // Self-scoping — a no-op unless the path is a tracked base key — so it runs
+  // regardless of .hypoignore (provenance is independent of privacy). Best-effort.
+  //
+  // The Write tool carries its full `content`, so advance to the bytes THIS
+  // session wrote (race-safe: a concurrent write landing between the tool and
+  // this hook cannot be adopted as our base). Edit/MultiEdit have no full content
+  // in the payload, so they fall back to a post-write disk read.
+  if (WRITE_TOOLS.has(input.tool_name) && input.session_id) {
+    const rel = relative(HYPO_DIR, filePath);
+    const known =
+      input.tool_name === 'Write' && typeof input.tool_input?.content === 'string'
+        ? hashContent(input.tool_input.content)
+        : null;
+    advanceBaseForWrite(HYPO_DIR, input.session_id, rel, filePath, known);
+  }
 }
 
 console.log(JSON.stringify({ continue: true, suppressOutput: true }));

package/hooks/hypo-cwd-change.mjs

@@ -24,6 +24,9 @@ import {
   pickProjectByCwd,
   collectProjectWorkingDirs,
   buildVaultOrientation,
+  currentDevice,
+  scopeVisible,
+  readVisibilityScope,
 } from './hypo-shared.mjs';
 
 const PROJECTS_DIR = join(HYPO_DIR, 'projects');
@@ -32,10 +35,32 @@ const MAX_CHARS = 3000;
 
 // Privacy guard: a .hypoignore-matched hot.md must not be
 // re-emitted into additionalContext on cwd change.
+//
+// Visibility guard: same contract as hypo-file-watch and hypo-session-start. A
+// machine-scoped hot.md stays off every machine but its owner. Scope is read
+// from the RAW content before the MAX_CHARS slice, since slicing first could cut
+// the frontmatter off and fail open. The root hot.md carries no frontmatter, so
+// it reads as '' and passes as shared.
 function readIfNotIgnored(path, patterns) {
   if (!path) return null;
   if (patterns.length > 0 && isIgnored(path, HYPO_DIR, patterns)) return null;
-  return readFileSync(path, 'utf-8').slice(0, MAX_CHARS);
+  const raw = readFileSync(path, 'utf-8');
+  if (!scopeVisible(readVisibilityScope(raw), currentDevice())) return null;
+  return raw.slice(0, MAX_CHARS);
+}
+
+// Scoped-out is not absent. Both make readIfNotIgnored return null, but the
+// absent-case placeholder tells the model the file "will be created at session
+// close". On a foreign machine that invites it to author over a hot.md that
+// exists and belongs elsewhere. Report the fact, never the withheld body.
+function isScopedOut(path, patterns) {
+  try {
+    if (!path || !existsSync(path)) return false;
+    if (patterns.length > 0 && isIgnored(path, HYPO_DIR, patterns)) return false;
+    return !scopeVisible(readVisibilityScope(readFileSync(path, 'utf-8')), currentDevice());
+  } catch {
+    return false;
+  }
 }
 
 function findProjectHot(cwd) {
@@ -87,7 +112,11 @@ process.stdin.on('end', () => {
 
     if (newHit) {
       const fromFile = readIfNotIgnored(newHit.hotPath, ignorePatterns);
-      const content = fromFile ?? '(no hot.md yet — will be created at session close)';
+      const content =
+        fromFile ??
+        (isScopedOut(newHit.hotPath, ignorePatterns)
+          ? '(hot.md for this project is scoped to another machine and is not visible here)'
+          : '(no hot.md yet — will be created at session close)');
       // arm the first-prompt marker so the NEXT user prompt re-triggers
       // hypo-first-prompt, which forces a "Resuming <project>" summary line.
       // Only arm when real hot content was actually injected — if hot.md is

package/hooks/hypo-file-watch.mjs

@@ -8,7 +8,14 @@
 
 import { readFileSync, existsSync } from 'fs';
 import { join } from 'path';
-import { HYPO_DIR, loadHypoIgnore, isIgnored } from './hypo-shared.mjs';
+import {
+  HYPO_DIR,
+  loadHypoIgnore,
+  isIgnored,
+  currentDevice,
+  scopeVisible,
+  readVisibilityScope,
+} from './hypo-shared.mjs';
 
 const MAX_CHARS = 2000;
 
@@ -43,7 +50,19 @@ process.stdin.on('end', () => {
       return;
     }
 
-    const content = readFileSync(filePath, 'utf-8').slice(0, MAX_CHARS);
+    const fileRaw = readFileSync(filePath, 'utf-8');
+
+    // Visibility guard: a machine-scoped page (visibility_scope: machine:<owner>)
+    // must not be re-injected on a machine other than its owner. Read the scope
+    // from the raw, unsliced content — slicing to MAX_CHARS first could cut the
+    // frontmatter off and silently make every scoped page pass fail-open.
+    const scope = readVisibilityScope(fileRaw);
+    if (!scopeVisible(scope, currentDevice())) {
+      console.log(JSON.stringify({ continue: true, suppressOutput: true }));
+      return;
+    }
+
+    const content = fileRaw.slice(0, MAX_CHARS);
     const relPath = filePath.replace(HYPO_DIR + '/', '');
 
     console.log(

package/hooks/hypo-first-prompt.mjs

@@ -48,7 +48,17 @@ process.stdin.on('end', () => {
     }
 
     const hasSnapshot = marker.hasSnapshot ?? (marker.hotPath && existsSync(marker.hotPath));
-    const snapshotNote = hasSnapshot ? '' : ' (no snapshot yet — first session)';
+    // A snapshot withheld by visibility_scope is NOT an absent one. session-start
+    // stamps the marker so this hook can tell them apart: without it, a project
+    // resumed on a foreign machine is announced as a first session, and the model
+    // then has every reason to author a fresh hot.md over the one that exists on
+    // the owning machine. Never name the withheld contents, only the fact.
+    const scopedOut = marker.scopedOut === true;
+    const snapshotNote = hasSnapshot
+      ? ''
+      : scopedOut
+        ? ' (snapshot scoped to another machine)'
+        : ' (no snapshot yet — first session)';
     // a cwd-change re-trigger says "Resuming"; a fresh session start
     // (default source) says "Previously working on".
     const verb = marker.source === 'cwd-change' ? 'Resuming' : 'Previously working on';
@@ -63,11 +73,17 @@ process.stdin.on('end', () => {
     // first-ever session (codex v2 review 2026-05-26).
     const exampleLine = hasSnapshot
       ? `${verb} ${projSafe}: [one-line summary]. Continue with [next task]?`
-      : `${verb} ${projSafe}: no prior snapshot yet — first session. What would you like to start with?`;
+      : scopedOut
+        ? `${projSafe}: this project has a prior snapshot, but it is scoped to another machine and is not visible here. What would you like to work on?`
+        : `${verb} ${projSafe}: no prior snapshot yet — first session. What would you like to start with?`;
     const fillNote = hasSnapshot
       ? `Replace the bracketed placeholders using the [HOT] / [SESSION STATE] ` +
         `context already injected this session — do NOT emit the literal brackets.`
-      : `Use the line above verbatim — there is no prior snapshot to summarize.`;
+      : scopedOut
+        ? `Use the line above verbatim. The project has prior work; its snapshot ` +
+          `simply belongs to another machine, so treat it as an existing project ` +
+          `whose history you cannot see from here.`
+        : `Use the line above verbatim — there is no prior snapshot to summarize.`;
 
     console.log(
       JSON.stringify(

package/hooks/hypo-lookup.mjs

@@ -19,6 +19,9 @@ import {
   staleMarkerFor,
   pageUsageLoggingAllowed,
   recordLookupUsage,
+  currentDevice,
+  scopeVisible,
+  readVisibilityScope,
 } from './hypo-shared.mjs';
 
 const INDEX_PATH = join(HYPO_DIR, 'index.md');
@@ -32,7 +35,16 @@ function buildPageMap(dir, root = dir, map = {}, ignorePatterns = [], hypoDir =
   for (const entry of readdirSync(dir)) {
     const full = join(dir, entry);
     if (isIgnored(full, hypoDir, ignorePatterns)) continue;
-    if (statSync(full).isDirectory()) {
+    // Skip an entry we can't stat (dangling symlink, race, permission) instead
+    // of throwing: the map is now built before the miss branch too, so one bad
+    // entry must not sink the whole lookup into the silent outer catch.
+    let st;
+    try {
+      st = statSync(full);
+    } catch {
+      continue;
+    }
+    if (st.isDirectory()) {
       buildPageMap(full, root, map, ignorePatterns, hypoDir);
     } else if (entry.endsWith('.md')) {
       const rel = full.slice(root.length + 1).replace(/\.md$/, '');
@@ -208,25 +220,6 @@ process.stdin.on('end', () => {
     const topScore = scored[0]?.score ?? 0;
     const matched = scored.filter((e) => e.score >= topScore * 0.5);
 
-    if (matched.length === 0) {
-      const topic = keywords.slice(0, 5).join(', ');
-      const closest = bm25Score(keywords, entries)
-        .map((e) => ({ ...e, score: e.score * typePrior(e.slug) }))
-        .sort((a, c) => c.score - a.score)
-        .slice(0, 3)
-        .map((e) => `[[${e.slug}]]`)
-        .join(', ');
-      console.log(
-        JSON.stringify(
-          buildOutput(`[WIKI LOOKUP: miss] "${topic}" — no match. Closest: ${closest || 'none'}`, {
-            continue: true,
-            suppressOutput: true,
-          }),
-        ),
-      );
-      return;
-    }
-
     const ignorePatterns = loadHypoIgnore(HYPO_DIR);
     const pageMap = {
       ...buildPageMap(
@@ -245,19 +238,81 @@ process.stdin.on('end', () => {
       ),
     };
 
+    // Single device snapshot for the whole prompt (currentDevice() itself stays
+    // uncached upstream so tests can override via HYPO_DEVICE; this hook only
+    // needs one read per lookup, not one per candidate).
+    const device = currentDevice();
+
+    // Resolve a slug to its on-disk path the same way the injection loop does.
+    const resolveSlugPath = (slug) =>
+      pageMap[slug] ?? pageMap[slug.replace(/^(pages|projects)\//, '')] ?? pageMap[basename(slug)];
+
+    // Read a page's raw content at most once per lookup: the visibility gate and
+    // the injection loop both need it, so memoize to avoid a double read.
+    const rawCache = new Map();
+    const readRaw = (path) => {
+      if (rawCache.has(path)) return rawCache.get(path);
+      let raw = null;
+      try {
+        raw = readFileSync(path, 'utf-8');
+      } catch {
+        raw = null;
+      }
+      rawCache.set(path, raw);
+      return raw;
+    };
+
+    // Visibility gate: MUST read raw content and go through readVisibilityScope
+    // (never a local frontmatter parser) so first-wins + comment-strip stay in
+    // step with the write side — a local last-wins/no-comment parser would miss
+    // `machine:devA # note` on devA itself. An unresolved/unreadable slug passes
+    // through (nothing to leak; the missing-file paths handle it downstream).
+    const isSlugVisible = (slug) => {
+      const path = resolveSlugPath(slug);
+      if (!path || !existsSync(path)) return true;
+      const raw = readRaw(path);
+      if (raw === null) return true;
+      return scopeVisible(readVisibilityScope(raw), device);
+    };
+
+    // Filter BEFORE the miss decision so a device that matches only machine-other
+    // pages takes the clean miss path (with closest VISIBLE suggestions), not the
+    // "index hit but files missing" branch. Hidden pages never reach injection,
+    // the empty-injection slug branch, or the "+N more" count — all read only
+    // visibleMatched, so no machine-other slug can leak through any path.
+    const visibleMatched = matched.filter((e) => isSlugVisible(e.slug));
+
+    if (visibleMatched.length === 0) {
+      const topic = keywords.slice(0, 5).join(', ');
+      const closest = bm25Score(keywords, entries)
+        .map((e) => ({ ...e, score: e.score * typePrior(e.slug) }))
+        .sort((a, c) => c.score - a.score)
+        .filter((e) => isSlugVisible(e.slug))
+        .slice(0, 3)
+        .map((e) => `[[${e.slug}]]`)
+        .join(', ');
+      console.log(
+        JSON.stringify(
+          buildOutput(`[WIKI LOOKUP: miss] "${topic}" — no match. Closest: ${closest || 'none'}`, {
+            continue: true,
+            suppressOutput: true,
+          }),
+        ),
+      );
+      return;
+    }
+
     // UTC to match doctor.mjs' overdue set (D1/D2). STALE is advisory, so a
     // one-day UTC/local skew never misleads.
     const TODAY = new Date().toISOString().slice(0, 10);
 
     const injected = [];
     const injectedSlugs = [];
-    for (const { slug } of matched.slice(0, MAX_HITS)) {
-      const path =
-        pageMap[slug] ??
-        pageMap[slug.replace(/^(pages|projects)\//, '')] ??
-        pageMap[basename(slug)];
+    for (const { slug } of visibleMatched.slice(0, MAX_HITS)) {
+      const path = resolveSlugPath(slug);
       if (path && existsSync(path)) {
-        const raw = readFileSync(path, 'utf-8');
+        const raw = readRaw(path);
+        if (raw === null) continue;
         // Compute the marker on raw (pre-slice) so a long body can't truncate
         // frontmatter out of reach. fail-open: a marker failure drops the marker,
         // never the page.
@@ -275,7 +330,7 @@ process.stdin.on('end', () => {
     }
 
     if (injected.length === 0) {
-      const slugs = matched
+      const slugs = visibleMatched
         .slice(0, MAX_HITS)
         .map((e) => e.slug)
         .join(', ');
@@ -297,9 +352,11 @@ process.stdin.on('end', () => {
       recordLookupUsage(HYPO_DIR, { sessionId, slugs: injectedSlugs });
     }
 
+    // visibleMatched (not matched): a hidden count would still name a "+N more"
+    // total that includes machine-other pages this device can never see.
     const overflow =
-      matched.length > MAX_HITS
-        ? `\n(+${matched.length - MAX_HITS} more matches — search wiki index for more)`
+      visibleMatched.length > MAX_HITS
+        ? `\n(+${visibleMatched.length - MAX_HITS} more matches — search wiki index for more)`
         : '';
 
     console.log(

package/hooks/hypo-personal-check.mjs

@@ -42,6 +42,7 @@ process.stdin.on('data', (chunk) => (raw += chunk));
 process.stdin.on('end', () => {
   let transcriptPath = null;
   let sessionId = null;
+  let sessionCwd = null;
   try {
     const input = JSON.parse(raw || '{}');
     transcriptPath = input.transcript_path ?? null;
@@ -49,6 +50,11 @@ process.stdin.on('end', () => {
     // semantics (no project attribution) so /compact does not block a closed
     // non-project session on the active/phantom project's files.
     sessionId = input.session_id ?? input.sessionId ?? null;
+    // Authoritative session cwd for the session-cwd close check. This is the one
+    // verified cwd source (mirrors hypo-session-record); it lets /compact block a
+    // session whose own project close was never started, which the recency-based
+    // global status cannot see.
+    sessionCwd = input.cwd ?? null;
   } catch {
     /* fail-open */
   }
@@ -107,6 +113,7 @@ process.stdin.on('end', () => {
     gate = precompactGateStatus(HYPO_DIR, {
       transcriptPath,
       ...(sessionId ? { sessionId } : {}),
+      ...(sessionCwd ? { sessionCwd } : {}),
     });
   } catch (err) {
     // Defense-in-depth: precompactGateStatus fails open per-check, but if it ever
@@ -122,9 +129,11 @@ process.stdin.on('end', () => {
   // turn the (otherwise non-blocking) drift into a blocker, since real drift is
   // confirmed and silently passing it would defeat the gate. --write only applies
   // when no target conflicts/over-caps (code===0 across ALL targets), so a late
-  // race exits non-zero and blocks here. It is semantic-preflight atomic but not
-  // filesystem-atomic (concurrent edit / mid-write I/O fault is best-effort) —
-  // pre-existing engine behavior, not introduced by the self-heal.
+  // race exits non-zero and blocks here. Each FILE it writes is atomic (tmp+
+  // rename, see feedback-sync's atomicWrite), so a mid-write fault can no longer
+  // truncate a target; what is still not atomic is the write ACROSS targets (one
+  // file can land before another fails), which the preflight narrows to genuine
+  // fs errors and no further.
   let feedbackHealed = '';
   if (gate.ok && gate.driftTargets.length > 0) {
     const feedbackPath = PKG_ROOT ? join(PKG_ROOT, 'scripts', 'feedback-sync.mjs') : null;
@@ -179,6 +188,18 @@ process.stdin.on('end', () => {
     const fold = `+${otherDebtCount} pre-existing lint issue(s) elsewhere in the vault (other projects / shared pages, not blocking) — run \`/hypo:lint\` for the full list.`;
     noticeText = noticeText ? `${noticeText}\n${fold}` : `[WIKI CHECK] ${fold}`;
   }
+  // A demoted close: some OTHER session left a project's close incomplete. It no
+  // longer blocks this compact, but it must still be SEEN — a notice list that the
+  // gate silently swallows (suppressOutput when nothing else surfaced) would turn the
+  // demotion into a disappearance, and nobody would ever fix the dangling close
+  // (codex design BLOCKER).
+  const closeDebt = gate.notices.filter((n) => n.type === 'close-debt');
+  if (closeDebt.length > 0) {
+    const line = `[WIKI CHECK] ${closeDebt.length} project(s) with an incomplete session close from another session (not blocking this compact): ${closeDebt
+      .map((n) => n.project)
+      .join(', ')} — each is fixed by that project's next close.`;
+    noticeText = noticeText ? `${noticeText}\n${line}` : line;
+  }
   // Surface the self-heal so a re-synced projection is not a silent mutation of
   // the user's MEMORY.md / CLAUDE.md (transparency).
   if (feedbackHealed) noticeText = noticeText ? `${noticeText}\n${feedbackHealed}` : feedbackHealed;

package/hooks/hypo-session-record.mjs

@@ -12,8 +12,7 @@
 
 import { existsSync, mkdirSync, appendFileSync } from 'fs';
 import { dirname, join } from 'path';
-import { hostname } from 'os';
-import { HYPO_DIR } from './hypo-shared.mjs';
+import { HYPO_DIR, currentDevice } from './hypo-shared.mjs';
 
 const INDEX_PATH = join(HYPO_DIR, '.cache', 'sessions', 'index.jsonl');
 
@@ -54,7 +53,7 @@ process.stdin.on('end', () => {
       // machine identity for multi-machine audit. index.jsonl lives
       // under .cache/ (gitignored in a normal vault), so this is a LOCAL-only
       // per-session record — accurate for every session, no sync/privacy cost.
-      device: hostname() || 'unknown',
+      device: currentDevice(),
     };
     appendFileSync(INDEX_PATH, JSON.stringify(entry) + '\n');
   } catch (err) {

package/hooks/hypo-session-start.mjs

@@ -32,6 +32,9 @@ import {
   collectProjectWorkingDirs,
   buildVaultOrientation,
   staleMarkerFor,
+  currentDevice,
+  scopeVisible,
+  readVisibilityScope,
 } from './hypo-shared.mjs';
 import {
   defaultCachePath,
@@ -46,15 +49,45 @@ import {
   siblingAlreadyNotified,
   markSiblingNotified,
 } from './version-check.mjs';
+import { snapshotBase, overwriteTargets } from './base-store.mjs';
+import { listProposals } from './proposal-store.mjs';
 
 // Privacy guard: refuse to read+inject .hypoignore-matched
 // wiki files into additionalContext. Without this, a user who lists
 // `projects/private/hot.md` in .hypoignore would still see SECRET emit because
 // session-start reads hot/state paths directly.
+//
+// Visibility guard: a machine-scoped page (visibility_scope: machine:<owner>)
+// must not be injected on a machine other than its owner. hypo-file-watch
+// already filters these very files, so leaving session start unfiltered made the
+// SAME file behave differently depending on which path opened it: the user sets
+// the field, sees it honored on edit, and never learns that session start still
+// ships the body. Read the scope from the RAW content before the maxChars slice:
+// slicing first could cut the frontmatter off and silently fail open.
+// The root hot.md is a frontmatter-less pointer table, so it reads as '' and
+// passes (shared) unchanged.
 function readIfNotIgnored(path, maxChars, patterns) {
   if (!path) return null;
   if (patterns.length > 0 && isIgnored(path, HYPO_DIR, patterns)) return null;
-  return readFileSync(path, 'utf-8').slice(0, maxChars);
+  const raw = readFileSync(path, 'utf-8');
+  if (!scopeVisible(readVisibilityScope(raw), currentDevice())) return null;
+  return raw.slice(0, maxChars);
+}
+
+// Scoped-out is not the same as absent. Both make readIfNotIgnored return null,
+// but telling the model "no snapshot yet / first session" when the snapshot merely
+// belongs to another machine is a lie it will act on. Returns false for an ignored
+// or missing file so only a real machine-scope hide reports true.
+// The caller may name the project and the fact, never the withheld body: a message
+// explaining the hide must not re-leak what it hid.
+function isScopedOut(path, patterns) {
+  try {
+    if (!path || !existsSync(path)) return false;
+    if (patterns.length > 0 && isIgnored(path, HYPO_DIR, patterns)) return false;
+    return !scopeVisible(readVisibilityScope(readFileSync(path, 'utf-8')), currentDevice());
+  } catch {
+    return false;
+  }
 }
 
 // Compute the STALE marker for a hot/state file from its RAW content (readIfNotIgnored
@@ -271,6 +304,24 @@ function syncStateNotice(pullOk) {
   }
   return `[WIKI: last sync failed: ${last.op || '?'} — ${last.error || 'unknown'}]`;
 }
+/**
+ * Surface the vault-wide count of parked write-proposals (T8). Routed
+ * exactly like syncStateNotice: the line joins the `notices` array (→
+ * additionalContext) and is also written to stderr, so both the model and the
+ * user's transcript see it. NOT a systemMessage banner (that channel is
+ * reserved for the update/sibling notices). Pure read (listProposals never
+ * mutates); best-effort so a store read failure never breaks SessionStart. '' when
+ * there are no pending proposals, so nothing surfaces on the empty path.
+ */
+function pendingProposalNotice() {
+  try {
+    const n = listProposals(HYPO_DIR).length;
+    if (n === 0) return '';
+    return `[WIKI: 대기 proposal ${n}건 (검토: hypomnema proposal list)]`;
+  } catch {
+    return '';
+  }
+}
 const GLOBAL_HOT = join(HYPO_DIR, 'hot.md');
 const HOT_CHARS = 2000;
 const STATE_CHARS = 2000;
@@ -346,6 +397,7 @@ process.stdin.on('end', () => {
 
     const pullOk = gitPull(HYPO_DIR);
     const syncLine = syncStateNotice(pullOk);
+    const proposalLine = pendingProposalNotice();
     const growthLine = readLastGrowthLine();
     // On source='clear', surface the dying
     // session's identity that hypo-session-end stashed so Claude can recover
@@ -364,11 +416,17 @@ process.stdin.on('end', () => {
     // transcript/--verbose only and out of this banner's scope.)
     const userMessage = [updateLine, siblingLine].filter(Boolean).join('\n\n');
     if (userMessage) outExtra = { ...outExtra, systemMessage: userMessage };
-    const notices = [syncLine, growthLine, clearRecoveryLine, updateLine, siblingLine].filter(
-      Boolean,
-    );
+    const notices = [
+      syncLine,
+      proposalLine,
+      growthLine,
+      clearRecoveryLine,
+      updateLine,
+      siblingLine,
+    ].filter(Boolean);
     let noticePrefix = notices.length ? `${notices.join('\n\n')}\n\n` : '';
     if (syncLine) process.stderr.write(`\n\x1b[33m${syncLine}\x1b[0m\n`);
+    if (proposalLine) process.stderr.write(`\n\x1b[33m${proposalLine}\x1b[0m\n`);
     if (growthLine) process.stderr.write(`\n\x1b[36m${growthLine}\x1b[0m\n`);
     if (clearRecoveryLine)
       process.stderr.write(`\n\x1b[33m${clearRecoveryLine.split('\n')[0]}\x1b[0m\n`);
@@ -379,6 +437,18 @@ process.stdin.on('end', () => {
     const MARKER_FILE = sessionMarkerPath(sessionId);
     const hit = findProjectFiles(cwd);
 
+    // Observed-base snapshot for the write=proposal gate. Deliberately AFTER gitPull: the base must
+    // describe the tree this session actually starts from, remote merges
+    // included, or the first close would raise a proposal against content the
+    // session never had a chance to conflict with. Once per session
+    // (existence-check inside snapshotBase), so resume and compact leave it
+    // alone. `data.session_id` is used raw rather than the 'default' fallback
+    // above. A session with no id has no base and closes down the legacy
+    // direct-write path.
+    if (data.session_id) {
+      snapshotBase(HYPO_DIR, data.session_id, overwriteTargets(hit ? hit.proj : null));
+    }
+
     const ignorePatterns = loadHypoIgnore(HYPO_DIR);
 
     // When cwd is a project working_dir that is NOT the vault itself, tell the
@@ -425,17 +495,29 @@ process.stdin.on('end', () => {
           ),
         );
       } else {
+        // A snapshot that exists but is scoped to another machine must not be
+        // reported as "no snapshot yet": the model would treat a resumed project
+        // as a first session. Say which it is, and say nothing of the contents.
+        const scopedOut =
+          isScopedOut(hit.hotPath, ignorePatterns) || isScopedOut(hit.statePath, ignorePatterns);
+        const reason = scopedOut ? 'snapshot scoped to another machine' : 'no snapshot yet';
         process.stderr.write(
-          `\n\x1b[36m[Hypomnema]\x1b[0m project: \x1b[1m${hit.proj}\x1b[0m (no snapshot yet)\n\n`,
+          `\n\x1b[36m[Hypomnema]\x1b[0m project: \x1b[1m${hit.proj}\x1b[0m (${reason})\n\n`,
         );
+        // Carry the reason into the marker, not just this hook's output.
+        // hypo-first-prompt derives its resume line from the marker alone, so a
+        // marker that says only `hotPath: null` makes the NEXT prompt announce
+        // "first session" for a project that merely belongs to another machine.
+        // That lie is what invites the model to author a fresh hot.md over one
+        // that already exists elsewhere.
         writeFileSync(
           MARKER_FILE,
-          JSON.stringify({ proj: hit.proj, hotPath: null, ts: Date.now() }),
+          JSON.stringify({ proj: hit.proj, hotPath: null, scopedOut, ts: Date.now() }),
         );
         console.log(
           JSON.stringify(
             buildOutput(
-              `${noticePrefix}${hitPrefix}[WIKI HOT CACHE: project=${sanitizeProjForPrompt(hit.proj)}, no snapshot yet]`,
+              `${noticePrefix}${hitPrefix}[WIKI HOT CACHE: project=${sanitizeProjForPrompt(hit.proj)}, ${reason}]`,
               outExtra,
             ),
           ),