hypomnema 1.6.2 → 1.7.0

package/hooks/hypo-shared.mjs

@@ -16,8 +16,12 @@ import {
   rmSync,
   readdirSync,
   realpathSync,
+  openSync,
+  closeSync,
+  unlinkSync,
+  renameSync,
 } from 'fs';
-import { join, relative, basename } from 'path';
+import { join, relative, basename, dirname } from 'path';
 import { homedir, hostname, tmpdir } from 'os';
 import { spawnSync } from 'child_process';
 
@@ -525,7 +529,12 @@ function _lastSeg(p) {
 // declines (null) so the caller falls back to recency. `projects` is the whole
 // universe (for the uniqueness gate); `eligible` restricts the answer.
 export function pickProjectByCwd(projects, cwd, opts = {}) {
-  const { eligible = null, realpathCwd = null, caseInsensitive = isCaseInsensitiveFs() } = opts;
+  const {
+    eligible = null,
+    realpathCwd = null,
+    caseInsensitive = isCaseInsensitiveFs(),
+    rejectAmbiguous = false,
+  } = opts;
   if (!cwd && !realpathCwd) return null;
   const eligibleSet = eligible ? new Set(eligible) : null;
   const isEligible = (slug) => !eligibleSet || eligibleSet.has(slug);
@@ -545,20 +554,35 @@ export function pickProjectByCwd(projects, cwd, opts = {}) {
     if (n && !cwds.includes(n)) cwds.push(n);
   }
 
-  // Tier 1: first cwd variant with any longest-prefix match wins.
+  // Tier 1: first cwd variant with any longest-prefix match wins. With
+  // rejectAmbiguous (session-cwd close check), two DISTINCT projects sharing the same
+  // longest matching working_dir (a monorepo config with no uniqueness invariant)
+  // is a genuine tie we must NOT break arbitrarily — silently picking the first
+  // would attribute a close to the wrong project and either mask a real failure
+  // (false-green) or block the wrong one (false-block). Decline the tie → null,
+  // so the caller degrades to the unresolved-cwd path instead of guessing.
   for (const c of cwds) {
     const cf = _fold(c, caseInsensitive);
     let bestSlug = null;
     let bestLen = -1;
+    let bestTied = false;
     for (const e of entries) {
       if (!isEligible(e.slug)) continue;
       const pf = _fold(e.path, caseInsensitive);
-      if ((cf === pf || cf.startsWith(`${pf}/`)) && e.path.length > bestLen) {
-        bestLen = e.path.length;
-        bestSlug = e.slug;
+      if (cf === pf || cf.startsWith(`${pf}/`)) {
+        if (e.path.length > bestLen) {
+          bestLen = e.path.length;
+          bestSlug = e.slug;
+          bestTied = false;
+        } else if (e.path.length === bestLen && e.slug !== bestSlug) {
+          bestTied = true;
+        }
       }
     }
-    if (bestSlug) return bestSlug;
+    if (bestSlug) {
+      if (bestTied && rejectAmbiguous) return null;
+      return bestSlug;
+    }
   }
 
   // Tier 2: unique-basename ancestor, but only when the chain points at exactly
@@ -1130,7 +1154,10 @@ export function sessionCloseGlobalStatus(hypoDir, opts = {}) {
 
   // primary = the recency project when it is itself today-active, else the first
   // today-active slug (stable order from the candidate set). Used only as the
-  // single-slug alias (marker `project` field, message header) — never to gate.
+  // single-slug alias for the message header and the flat `close.project` field.
+  // It is NEVER an attribution source: the marker is stamped from close evidence
+  // (explicit --project, transcript close-files, apply's payload.project), so this
+  // recency-derived value cannot leak into a marker and back into the next gate.
   const primary = recency && todayActive.includes(recency) ? recency : todayActive[0];
   const ordered = [primary, ...todayActive.filter((p) => p !== primary)];
 
@@ -1203,6 +1230,133 @@ export function rootLogEntry(slug, date, headingTail) {
  * @param {string} hypoDir
  * @returns {number} count of entries appended to log.md
  */
+// ── append-only file lock ───────────────────────────────────────────────────
+// Serializes the read → dedup → rebuild → temp+rename sequence on append-only
+// history files (session-log shards, log.md) so two concurrent session closes
+// never lose an entry. The lock does NOT replace the existing write-isolation:
+// each writer still rebuilds the full content and commits via atomicWrite
+// (temp write + rename), so a partial write lands on a throwaway temp and the
+// target is never torn. The lock only makes the read-modify-write exclusive, so
+// the second closer re-reads the first's committed bytes and appends onto them
+// (last-writer-wins can no longer drop the earlier entry), and exact-entry dedup
+// becomes precise rather than best-effort.
+//
+// Why not O_APPEND: an in-place append that short-writes (ENOSPC / EDQUOT /
+// RLIMIT_FSIZE / a split write() killed mid-loop) leaves a torn dated heading on
+// the real file that the freshness gate mis-reads as valid close evidence, and
+// it cannot be rolled back once a concurrent appender has written past it. That
+// is a normal-operation regression temp+rename does not have (a failed temp
+// write never runs the rename, so the target stays untouched). Confirmed against
+// Node/libuv write-loop behavior and POSIX write(2) partial-write semantics.
+//
+// Local-FS only: `openSync(lock, 'wx')` is not atomic on NFS — the same caveat
+// the vault already carries. Power-loss durability is unchanged from today
+// (atomicWrite never fsync'd), so it is out of scope here.
+function sleepSync(ms) {
+  // Synchronous sleep with no busy-spin: block this thread on an Atomics.wait
+  // against a private SharedArrayBuffer that is never signaled, so it always
+  // times out after `ms`. Hooks run in a short-lived sync context.
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, Math.max(0, ms | 0));
+}
+
+// Commit `content` via temp write + rename so a partial/failed write lands on a
+// throwaway temp and the target is never torn (mirrors crystallize.mjs's
+// atomicWrite). Rename atomicity swaps the directory entry; it is NOT power-loss
+// durable (no fsync) — same as everything else in the vault.
+function atomicWriteShared(path, content) {
+  mkdirSync(dirname(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.${Math.random().toString(36).slice(2, 10)}.tmp`;
+  writeFileSync(tmp, content);
+  renameSync(tmp, path);
+}
+
+/**
+ * Run `fn` while holding an exclusive lock on `<targetPath>.lock`.
+ *
+ * Acquire is a spin on `openSync(lock, 'wx')`: EEXIST means another writer holds
+ * it, so poll until it frees. A lock whose holder looks dead (mtime older than
+ * `staleMs`) is stolen. Steal is recoverable friction in the normal case (the
+ * stealer re-reads the committed bytes before writing), but NOT loss-free in two
+ * edge cases, both requiring the lock to sit untouched for `staleMs`: (1) a LIVE
+ * holder preempted past `staleMs` gets stolen from, so two writers run the
+ * critical section and one update is lost; (2) between the stale `statSync` and
+ * the `unlinkSync`, the holder can release and a fresh holder grab the same path,
+ * whose lock we then remove. `staleMs` is set well above a normal close (seconds)
+ * to make both extreme-low-probability. If the lock cannot be acquired within
+ * `timeoutMs`, throw so the caller can fall back to the write=proposal gate — for
+ * an append that means blocking the close (proposal-pending) with no artifact; the
+ * next close re-appends (architecturally consistent with the existing fail-safe).
+ *
+ * @param {string} targetPath file being guarded (lock is a sibling `.lock`)
+ * @param {() => T} fn critical section
+ * @param {{timeoutMs?: number, staleMs?: number, pollMs?: number}} [opts]
+ * @returns {T} whatever `fn` returns
+ * @template T
+ */
+export function withFileLock(targetPath, fn, opts = {}) {
+  const { timeoutMs = 5000, staleMs = 30000, pollMs = 50 } = opts;
+  const lockPath = `${targetPath}.lock`;
+  mkdirSync(dirname(lockPath), { recursive: true });
+  const start = Date.now();
+  let fd;
+  for (;;) {
+    try {
+      fd = openSync(lockPath, 'wx');
+      break;
+    } catch (err) {
+      if (err.code !== 'EEXIST') throw err;
+      // Held by another writer. Steal ONLY a demonstrably stale lock; otherwise
+      // wait and eventually time out. The stat and the unlink are handled
+      // separately on purpose: an un-removable stale lock (EACCES/EPERM/EBUSY)
+      // and a fresh lock must both fall through to the timeout check — never
+      // `continue` past it, or an un-unlinkable lock spins forever and violates
+      // the timeoutMs → ELOCKTIMEOUT contract (caller falls to the proposal gate).
+      let stale = false;
+      try {
+        // Steal a lock whose holder looks dead. Loss-free unless the holder is
+        // actually live-but-preempted past staleMs (see JSDoc edge cases).
+        stale = Date.now() - statSync(lockPath).mtimeMs > staleMs;
+      } catch (statErr) {
+        if (statErr.code === 'ENOENT') continue; // lock vanished; retry create now
+        throw statErr; // unexpected stat failure — surface it, don't mask
+      }
+      if (stale) {
+        try {
+          unlinkSync(lockPath);
+          continue; // stole it; retry the create immediately
+        } catch (unlinkErr) {
+          if (unlinkErr.code === 'ENOENT') continue; // another stealer won; retry
+          // Cannot remove it: do NOT spin — fall through to timeout/sleep so
+          // acquisition eventually throws ELOCKTIMEOUT instead of hanging.
+        }
+      }
+      if (Date.now() - start > timeoutMs) {
+        // Tagged so callers can distinguish "could not get the lock" (fall to the
+        // proposal gate) from a real fn() write error (mkdir/openSync/disk-full),
+        // which must NOT be masked as a timeout.
+        const e = new Error(`lock-timeout: ${lockPath}`);
+        e.code = 'ELOCKTIMEOUT';
+        throw e;
+      }
+      sleepSync(pollMs);
+    }
+  }
+  try {
+    return fn();
+  } finally {
+    try {
+      closeSync(fd);
+    } catch {
+      /* fd already gone */
+    }
+    try {
+      unlinkSync(lockPath);
+    } catch {
+      /* lock already stolen/removed */
+    }
+  }
+}
+
 export function deriveRootLogEntries(hypoDir) {
   const logPath = join(hypoDir, 'log.md');
   if (!existsSync(logPath)) return 0;
@@ -1259,19 +1413,44 @@ export function deriveRootLogEntries(hypoDir) {
         const { heading, block } = rootLogEntry(slug, date, m[1]);
         if (seenHeadings.has(heading)) continue; // exact-line dedup (log.md + queued)
         seenHeadings.add(heading);
-        additions.push(block);
+        additions.push({ heading, block });
       }
     }
   }
 
   if (additions.length === 0) return 0;
-  const sep = logContent.endsWith('\n') ? '\n' : '\n\n';
+
+  // Serialize the read-modify-write on log.md: a concurrent session close (its
+  // own crystallize apply, or another project's derive) may commit between the
+  // read above and the write below. Under the lock we RE-READ the latest
+  // committed log.md and re-run exact-heading dedup, so this derive appends onto
+  // the other writer's entry instead of a full-file overwrite dropping it. The
+  // same lock guards crystallize.mjs's per-close log.md append, so the two
+  // paths never race. On lock-timeout, skip (best-effort backfill; the next
+  // close re-derives) rather than risk a lost update.
   try {
-    writeFileSync(logPath, logContent + sep + additions.join('\n\n') + '\n');
+    return withFileLock(logPath, () => {
+      let current;
+      try {
+        current = readFileSync(logPath, 'utf-8');
+      } catch {
+        return 0;
+      }
+      const seen = new Set((current || '').split(/\r?\n/));
+      const fresh = additions.filter(({ heading }) => {
+        if (seen.has(heading)) return false;
+        seen.add(heading);
+        return true;
+      });
+      if (fresh.length === 0) return 0;
+      const sep = current.endsWith('\n') ? '\n' : '\n\n';
+      atomicWriteShared(logPath, current + sep + fresh.map((a) => a.block).join('\n\n') + '\n');
+      return fresh.length;
+    });
   } catch {
+    // lock-timeout or unexpected lock error: skip this backfill pass.
     return 0;
   }
-  return additions.length;
 }
 
 // ── sync-state ────────────────────────────────────────────
@@ -1401,16 +1580,34 @@ export function commitWikiChanges(hypoDir) {
     spawnSync('git', ['-C', hypoDir, ...args], { encoding: 'utf-8', timeout: 30000 });
   if (git('rev-parse', '--is-inside-work-tree').status !== 0)
     return { committed: false, reason: `not a git repository: ${hypoDir}` };
-  const porcelain = git('status', '--porcelain', '-uall');
+  // `-z`: NUL-separated records with verbatim paths — no surrounding quotes and
+  // no octal escaping, so non-ASCII paths (Korean page names are normal input
+  // here) survive intact. Without it, `core.quotepath=true` (the default) yields
+  // `"pages/\355\225\234\352\270\200.md"` and the old quote-strip parser fed that
+  // literal, non-existent path to `git add` — failing the whole commit.
+  // `-z`: NUL-separated records with verbatim paths — no surrounding quotes and
+  // no octal escaping, so non-ASCII paths (Korean page names are normal input
+  // here) survive intact. Without it, `core.quotepath=true` (the default) yields
+  // `"pages/\355\225\234\352\270\200.md"` and the old quote-strip parser fed that
+  // literal, non-existent path to `git add` — failing the whole commit.
+  const porcelain = git('status', '--porcelain', '-uall', '-z');
   if (porcelain.status !== 0)
     return { committed: false, reason: `git status failed in ${hypoDir}` };
   // `.hypoignore` is the project privacy boundary. `git add -A` ignores it, so
   // enumerate changed paths, drop ignored ones, then stage explicitly.
   const ignorePatterns = loadHypoIgnore(hypoDir);
   const paths = [];
-  for (const line of (porcelain.stdout || '').split('\n')) {
-    if (!line) continue;
-    const file = line.slice(3).replace(/^"|"$/g, '').split(' -> ').pop().trim();
+  const records = (porcelain.stdout || '').split('\0');
+  for (let i = 0; i < records.length; i++) {
+    const rec = records[i];
+    if (!rec) continue;
+    const xy = rec.slice(0, 2);
+    const file = rec.slice(3); // `XY <path>`; the destination path for a rename/copy
+    // A rename OR copy emits two records (`to\0from`); consume the trailing
+    // `from`. Copy `C` records only appear under `status.renames=copies`, but
+    // when they do, missing this skip feeds the `from` path to `git add` as a
+    // bogus pathspec — the exact auto-commit failure this parser fixes.
+    if (xy[0] === 'R' || xy[1] === 'R' || xy[0] === 'C' || xy[1] === 'C') i++;
     if (!file) continue;
     if (ignorePatterns.length > 0 && isIgnored(join(hypoDir, file), hypoDir, ignorePatterns))
       continue;
@@ -1799,9 +1996,22 @@ export function writeSessionClosedMarker(hypoDir, sessionId, info = {}) {
     // attribution). Readers (precompactGateStatus / --check-session-close) key
     // the gate semantics on this field, so it must be recorded.
     const scope = info.scope === 'log-only' ? 'log-only' : 'project';
+    // v4 attribution discriminator (session-close attribution). `projects` is the evidence-based
+    // set this session actually closed — explicit --project ∪ transcript
+    // close-file edits ∪ apply's authoritative payload.project — and NEVER the
+    // recency primary. Its PRESENCE marks a v4 marker whose scope resolveCloseScope
+    // trusts directly; a pre-v4 marker carries only `project` and is treated as an
+    // uncorroborated legacy hint (see resolveCloseScope). `project` stays as
+    // projects[0] for back-compat with the flat-field readers.
+    const projects = Array.isArray(info.projects)
+      ? [...new Set(info.projects.filter(Boolean))]
+      : info.project
+        ? [info.project]
+        : [];
     const payload = {
       session_id: sessionId,
-      project: info.project || null,
+      project: info.project || projects[0] || null,
+      projects,
       scope,
       transcript_path: info.transcript_path || null,
       closed_at: new Date().toISOString(),
@@ -2170,6 +2380,64 @@ export function isUnderProjectDirs(file, slugs) {
   return (slugs || []).some((s) => s && (f === `projects/${s}` || f.startsWith(`projects/${s}/`)));
 }
 
+/**
+ * The session-close FILES of some project, as a path matcher. Used to attribute a
+ * close to a session: a transcript that edited `projects/<slug>/session-state.md`
+ * (or that project's hot.md / a session-log shard) is evidence THIS session was
+ * closing <slug>. Any other file under `projects/<slug>/` is NOT evidence — merely
+ * editing a page or an ADR there says nothing about whose close is whose, and
+ * treating it as attribution would re-block a session for a project it only read
+ * around in (codex design review).
+ */
+const CLOSE_FILE_RE = /^projects\/([^/]+)\/(session-state\.md|hot\.md|session-log\/[^/]+\.md)$/;
+
+/** Slugs whose close files this session edited directly (Write/Edit tool_use). */
+function projectsFromTouchedCloseFiles(transcriptPath, hypoDir) {
+  const out = new Set();
+  if (!transcriptPath) return out;
+  for (const f of extractTouchedWikiFiles(transcriptPath, hypoDir)) {
+    const m = posixPath(f).match(CLOSE_FILE_RE);
+    if (m) out.add(m[1]);
+  }
+  return out;
+}
+
+/**
+ * closeScope: the projects THIS session is accountable for closing. The union of
+ * three signals, because no single one covers every close path:
+ *
+ *   1. `opts.closeScope` — the caller states it outright. `--apply-session-close`
+ *      passes `payload.project` (it is the authority on what it just closed) and
+ *      `--mark-session-closed --project=<slug>` passes its attribution slug. This
+ *      signal is LOAD-BEARING, not a convenience: the documented close path writes
+ *      its files from inside a Bash call, so they never surface as Edit/Write
+ *      `file_path`s and signal 2 cannot see them (the same blind spot that forces
+ *      closeFileTargets() to seed the lint scope explicitly).
+ *   2. close files the transcript shows this session editing — the hand-written
+ *      close, which bypasses the script entirely.
+ *   3. `marker.project` — after a scripted close marked, this is how a later reader
+ *      (PreCompact) recovers signal 1. It is what keeps the marker == compact-ready
+ *      invariant: the writer scopes by `payload.project`, PreCompact re-scopes by
+ *      the `project` that same writer recorded, so the two can never disagree.
+ */
+export function resolveCloseScope(hypoDir, opts = {}, marker = null) {
+  const scope = new Set(opts.closeScope || []);
+  for (const p of projectsFromTouchedCloseFiles(opts.transcriptPath, hypoDir)) scope.add(p);
+  // Marker attribution (session-close attribution). A v4 marker carries `projects` — the
+  // evidence-based set it closed (never recency) — trusted directly. A pre-v4
+  // legacy marker carries only `project` with no provenance, and that value may be
+  // recency-derived (the P1 bug). An uncorroborated legacy attribution must NOT
+  // enable partitioning, or a stale/wrong slug could demote a real failure to
+  // foreign debt. So a legacy `project` enters scope only when the direct signals
+  // above (explicit close scope or transcript close-file edits) already corroborate
+  // the SAME slug; otherwise it stays a display hint. This narrow gap self-heals as
+  // pre-v4 markers expire (7-day TTL).
+  if (Array.isArray(marker?.projects)) {
+    for (const p of marker.projects) if (p) scope.add(p);
+  }
+  return scope;
+}
+
 // ── PreCompact gate — single source of truth ────────────────────────────────
 /**
  * The full PreCompact gate decision as a READ-ONLY status. This is the single
@@ -2201,7 +2469,15 @@ export function isUnderProjectDirs(file, slugs) {
  * ignored.
  *
  * @param {string} hypoDir
- * @param {{lintScope?: Iterable<string>, transcriptPath?: string|null, claudeHome?: string, projectOverride?: string|null}} [opts]
+ * opts.sessionCwd (session-cwd close check): the authoritative cwd of the session being
+ * gated (hook payload.cwd, or the CLI --session-cwd flag — never process.cwd(),
+ * which is post-`cd` non-authoritative). When set and not log-only, the project
+ * that owns this cwd is checked for close-completeness as an INDEPENDENT blocker,
+ * catching a session whose own project close was never started. Unmatched/ambiguous
+ * cwd yields a best-effort notice, not a block. apply never passes it (its launch
+ * cwd may differ from the authoritative payload.project).
+ *
+ * @param {{lintScope?: Iterable<string>, transcriptPath?: string|null, claudeHome?: string, projectOverride?: string|null, sessionCwd?: string|null, sessionId?: string|null, logOnly?: boolean, closeScope?: string[]}} [opts]
  * @returns {{ok: boolean, close: object, blockers: {type:string,reason:string}[], notices: {type:string,reason:string,file?:string}[], driftTargets: string[], skipped: {lint:boolean, feedback:boolean}}}
  */
 export function precompactGateStatus(hypoDir, opts = {}) {
@@ -2267,6 +2543,72 @@ export function precompactGateStatus(hypoDir, opts = {}) {
     // projectOverride narrows the close status to one project (check-only); a
     // marker-writing caller never sets it, so the marker path stays global.
     close = sessionCloseGlobalStatus(hypoDir, { projectOverride: opts.projectOverride });
+
+    // Attribute the close debt before blocking on it. An incomplete close belongs
+    // to whichever session performed it; charging it to an unrelated session is the
+    // false block this partition exists to stop. The gate already draws exactly this
+    // line for LINT debt (partitionLintScope: errors in files THIS session touched
+    // block, pre-existing debt elsewhere is a notice) — close-file debt was the one
+    // check still hard-blocking globally on another session's work.
+    //
+    // Two fail-closed guards keep the partition from eating a real blocker:
+    //   - close.fallback: no project closed today, so this is the "you have not
+    //     closed this session AT ALL" path. It must block unconditionally; demoting
+    //     it would gut the gate's whole purpose.
+    //   - empty scope: no positive attribution signal, so we cannot tell whose debt
+    //     it is. Never demote on a guess — fall back to today's global block.
+    //   - projectOverride: the caller asked "is THIS project close-complete?".
+    //     Demoting the very project it named would answer a question nobody asked.
+    //
+    // Bounded tradeoff (codex design review, accepted rather than closed). A
+    // scripted close that CRASHES mid-write leaves no marker and no transcript trace
+    // (it writes from inside a Bash call), so its own project carries no attribution.
+    // If that same session had also hand-edited SOME OTHER project's close files, the
+    // scope is non-empty but omits the torn project, and its debt is demoted. The
+    // window is narrow and self-limiting: apply writes the project files, then the
+    // session-log, then the root log entry, so the only torn state that reaches this
+    // partition at all is a missing log.md entry — which deriveRootLogEntries
+    // regenerates from the session-log heading. A crash before the session-log is not
+    // detected as today-active by hasTodayCloseActivity in the first place (the
+    // pre-existing tradeoff documented there). And the marker is never written, so the
+    // Stop hook still refuses to end the session. Closing this properly needs a
+    // durable close-attempt record; it is not worth a new state-file lifecycle here.
+    const scopeSet = resolveCloseScope(hypoDir, opts, marker);
+    const failed = (close.projects || []).filter((p) => !p.ok);
+    const partition =
+      !close.fallback && !opts.projectOverride && scopeSet.size > 0 && failed.length > 0;
+
+    close.scope = [...scopeSet];
+    close.debt = [];
+    // Re-project the flat aliases onto what actually BLOCKS, so `ok` and
+    // `stale`/`missing` can never contradict each other (a reader that treats a
+    // non-empty `missing` as failure stays correct). Demoted debt moves to its own
+    // `debt` field instead of masquerading as this session's unfinished work.
+    //
+    // ONLY when partitioning. Deriving `ok` from the per-project rows unconditionally
+    // would silently drop the failures that have NO project row to be derived from:
+    // an unresolvable active project yields `projects: []` with
+    // `missing: ['hot.md (no active project in pointer table)']`, so an empty `failed`
+    // would read as "nothing failed" and flip a red gate green (codex pre-commit
+    // BLOCKER, reproduced on a vault with no active-project row). Outside the
+    // partition the close status stands exactly as sessionCloseGlobalStatus computed it.
+    if (partition) {
+      const mine = failed.filter((p) => scopeSet.has(p.project));
+      const foreign = failed.filter((p) => !scopeSet.has(p.project));
+      close.debt = foreign.map((p) => ({ project: p.project, stale: p.stale, missing: p.missing }));
+      close.stale = [...new Set(mine.flatMap((p) => p.stale))];
+      close.missing = [...new Set(mine.flatMap((p) => p.missing))];
+      close.ok = mine.length === 0;
+      // The flat `project` alias must follow the scope too: it names the project the
+      // rest of this status describes, and every consumer that renders a per-file
+      // checklist builds it from that name. Left as the global `primary` it can point
+      // at a DEMOTED foreign project, and the checklist then reports ✓ for files the
+      // debt list simultaneously calls missing (codex pre-commit CONCERN).
+      if (!scopeSet.has(close.project)) {
+        close.project = mine[0]?.project ?? [...scopeSet][0] ?? close.project;
+      }
+    }
+
     if (!close.ok) {
       blockers.push({
         type: 'close',
@@ -2276,6 +2618,74 @@ export function precompactGateStatus(hypoDir, opts = {}) {
         ].join(', ')}`,
       });
     }
+    for (const p of close.debt) {
+      notices.push({
+        type: 'close-debt',
+        project: p.project,
+        reason: `${p.project}: incomplete session close from another session (${[
+          ...p.missing.map((f) => `${f} (missing)`),
+          ...p.stale.map((f) => `${f} (stale)`),
+        ].join(', ')}) — not blocking; that project's next close will fix it`,
+      });
+    }
+  }
+
+  // 3b. session-cwd close (session-cwd close check). The current session's cwd project is an
+  // INDEPENDENT close responsibility. sessionCloseGlobalStatus above only sees
+  // projects that left an authoritative close-activity trace (a session-log
+  // heading / log.md entry), so a project whose close was NEVER STARTED is
+  // invisible — and if the recency project was closed the same day, the gate would
+  // go green while this session's real project stays unclosed (the false-green this
+  // closes). Evaluate it here, AFTER the partition and OUTSIDE scopeSet /
+  // close.projects, so it can neither be demoted to foreign debt (partition) nor
+  // spawn a W8 design-history blocker (which derives from close.projects). log-only
+  // sessions are exempt (no project to close). apply never passes sessionCwd (its
+  // launch cwd may differ from the authoritative payload.project — a supported
+  // cross-project close), so this runs only on the read / mark paths.
+  if (!logOnly && opts.sessionCwd) {
+    const cwdProject = pickProjectByCwd(collectProjectWorkingDirs(hypoDir), opts.sessionCwd, {
+      rejectAmbiguous: true,
+    });
+    if (cwdProject) {
+      const s = sessionCloseFileStatus(hypoDir, { projectOverride: cwdProject });
+      if (!s.ok) {
+        // ALWAYS emit the typed close-cwd blocker when the cwd project's close is
+        // incomplete — never suppress it as a duplicate of the global `close`
+        // blocker. The Stop hook keys its marker re-check on this exact type, so
+        // hiding it (even when a `close` blocker names the same project) would let
+        // Stop honor a stale marker and end the session green (codex pre-commit
+        // BLOCKER). A second entry for the same slug is merely noisy, never wrong.
+        blockers.push({
+          type: 'close-cwd',
+          project: cwdProject,
+          reason: `session cwd project '${cwdProject}' has an incomplete session close: ${[
+            ...s.missing.map((f) => `${f} (missing)`),
+            ...s.stale.map((f) => `${f} (stale)`),
+          ].join(', ')}`,
+        });
+        // If the partition demoted this project to foreign debt, it is NOT another
+        // session's work — it is THIS session's, and we just BLOCKED on it. Remove
+        // it from BOTH the debt notice and close.debt so the status cannot report
+        // the same project as non-blocking debt and a blocker at once (codex
+        // pre-commit CONCERN: crystallize renders close_debt from close.debt).
+        for (let i = notices.length - 1; i >= 0; i--) {
+          if (notices[i].type === 'close-debt' && notices[i].project === cwdProject)
+            notices.splice(i, 1);
+        }
+        if (Array.isArray(close.debt))
+          close.debt = close.debt.filter((d) => d.project !== cwdProject);
+      }
+    } else {
+      // cwd is under no project working_dir, or ambiguously under several (a
+      // monorepo tie pickProjectByCwd declined): we cannot attribute a close
+      // responsibility, so we do NOT hard-block (nothing proves there is anything
+      // to close). Surface a best-effort notice so the coverage gap is visible.
+      notices.push({
+        type: 'close-cwd-unresolved',
+        reason:
+          'session cwd did not resolve to a unique project — the P2 cwd close check is best-effort here; pass --project or --log-only to be explicit',
+      });
+    }
   }
 
   // 4. lint blockers + W8 design-history (scoped). Mirrors hypo-personal-check.
@@ -2425,8 +2835,55 @@ export function precompactGateStatus(hypoDir, opts = {}) {
           .map(([n]) => n);
         const overCapT = entries.filter(([, t]) => t.overCap).map(([n]) => n);
         const driftedT = entries.filter(([, t]) => t.dirty).map(([n]) => n);
-        if (!report || !(conflictedT.length || overCapT.length || driftedT.length)) {
-          skipped.feedback = true; // buildError / unparseable / non-actionable → fail-open
+        // A target whose file EXISTS but cannot be projected into (its
+        // <learned_behaviors> container is gone) reports dirty:false with no
+        // conflict flag — it cannot be built, so nothing "would change". That
+        // shape used to fall into the non-actionable branch below and fail OPEN,
+        // the worst possible reading: a projection that loads ZERO rules on this
+        // machine was classified as "nothing to do" and waved through. It is a
+        // blocker, not a shrug.
+        //
+        // ONLY kind 'build-failed'. A 'target-missing' buildError (no ~/.claude/
+        // CLAUDE.md yet) is the ordinary first-run state and must keep failing
+        // OPEN, or the gate blocks every new user on their first /compact.
+        const buildErrT = entries
+          .filter(([, t]) => t.buildError && t.buildErrorKind === 'build-failed')
+          .map(([n]) => n);
+        // Side-file I/O trouble (an unreadable feedback_<slug>.md under the
+        // project memory dir) is a NOTICE, never a blocker: the primary
+        // projection still loads every rule, and the only fix is a permission
+        // bit on that path — `--ensure-container` cannot touch it. A gate that
+        // blocks on a condition its own named remedy cannot clear is a gate that
+        // gets bypassed.
+        const sideWarnT = entries.filter(([, t]) => (t.sideWarnings || []).length);
+        if (
+          !report ||
+          !(
+            conflictedT.length ||
+            overCapT.length ||
+            driftedT.length ||
+            buildErrT.length ||
+            sideWarnT.length
+          )
+        ) {
+          skipped.feedback = true; // unparseable / non-actionable → fail-open
+        } else if (buildErrT.length) {
+          // Name the EXACT target file and the remedy for THIS cause. "Restore
+          // the managed container" with no path is a dead end, and so is naming
+          // `--ensure-container` for a permission error or a dangling symlink,
+          // which it cannot fix — a blocker with no way through gets bypassed
+          // rather than obeyed. t.buildError carries the target's absolute path
+          // and t.buildErrorRemedy the cause-specific way out; feedback-sync
+          // makes that judgment once, at the branch that detects the cause.
+          const failed = entries.filter(([n]) => buildErrT.includes(n));
+          const details = failed.map(([n, t]) => `${n}: ${t.buildError}`).join('; ');
+          const remedies = [
+            ...new Set(failed.map(([, t]) => t.buildErrorRemedy).filter(Boolean)),
+          ].join(' ');
+          blockers.push({
+            type: 'feedback',
+            reason: `feedback projection cannot be built — ${details} — no rules are loaded from it. ${remedies}`,
+          });
         } else if (conflictedT.length) {
           blockers.push({
             type: 'feedback',
@@ -2437,13 +2894,23 @@ export function precompactGateStatus(hypoDir, opts = {}) {
             type: 'feedback',
             reason: `feedback projection over cap (${overCapT.join(', ')}) — demote/archive feedback pages`,
           });
-        } else {
+        } else if (driftedT.length) {
           driftTargets.push(...driftedT); // pure drift → self-healable, not a blocker
           notices.push({
             type: 'feedback',
             reason: `feedback projection drift (${driftedT.join(', ')}) — will self-heal at /compact`,
           });
         }
+        // Additive, and deliberately outside the chain above: a side-file I/O
+        // problem is orthogonal to the primary target's health, so it is a notice
+        // whatever else is (or is not) going on. It names the path and the
+        // permission fix, because that — not a command — is the way out.
+        for (const [n, t] of sideWarnT) {
+          notices.push({
+            type: 'feedback',
+            reason: `feedback projection side file unreadable (${n}): ${t.sideWarnings.join('; ')} — fix the permissions on that path; the primary projection still loads every rule (\`--ensure-container\` does not fix this)`,
+          });
+        }
       }
     } catch {
       skipped.feedback = true;
@@ -2516,6 +2983,29 @@ export function isCompactOrClearCommand(prompt) {
  * @returns {string} newline-joined user text, or '' on any failure (fail-open)
  */
 export function extractUserMessages(transcriptPath, tailN = 30) {
+  return extractUserMessageRecords(transcriptPath, tailN, { keepEmpty: true }).join('\n');
+}
+
+/**
+ * Same extraction as {@link extractUserMessages}, but ONE STRING PER TRANSCRIPT
+ * RECORD instead of one flat blob. The message boundary is the point: a gate that
+ * asks "did the user say exactly X" cannot ask it of text that has been joined
+ * across turns, because any line of any message then looks like a whole message.
+ * {@link hasTypedUserApproval} needs that boundary; the close-intent readers, which
+ * only ever ask "does this text contain a close phrase", do not.
+ *
+ * @param {string} transcriptPath
+ * @param {number} tailN  how many trailing lines to scan (Infinity → whole file)
+ * @param {{keepEmpty?: boolean}} [opts]  keepEmpty preserves a '' per dropped record,
+ *   so the joined form stays byte-identical to what extractUserMessages always returned.
+ * @returns {string[]} user-typed text per record, or [] on any failure (fail-open)
+ */
+export function extractUserMessageRecords(transcriptPath, tailN = 30, { keepEmpty } = {}) {
+  const records = extractUserRecordTexts(transcriptPath, tailN);
+  return keepEmpty ? records : records.filter((t) => t !== '');
+}
+
+function extractUserRecordTexts(transcriptPath, tailN) {
   try {
     const lines = readFileSync(transcriptPath, 'utf-8').split('\n');
     // tailN === Infinity → whole transcript (the marker-write hard gate needs the
@@ -2523,51 +3013,49 @@ export function extractUserMessages(transcriptPath, tailN = 30) {
     // checklist). The Stop hook keeps the 30-line default so a stale old close
     // signal doesn't re-trigger every turn.
     const tail = Number.isFinite(tailN) ? lines.slice(-tailN) : lines;
-    return tail
-      .map((line) => {
-        try {
-          const obj = JSON.parse(line);
-          // Skill-injection vector: drop system-injected role:user
-          // messages before they pollute the close-intent signal.
-          //  • isMeta:true   — slash-command bodies, skill bodies, local-command
-          //    caveats. Their text is docs/specs, often full of close vocabulary
-          //    (e.g. the /hypo:crystallize spec literally contains close phrases),
-          //    which would let the gate self-satisfy the moment the model invokes
-          //    a close command. Confirmed isMeta:true in the transcript.
-          //  • promptSource system|sdk — task-notifications (system) and
-          //    SDK / QA-harness synthetic prompts (sdk). Neither is user-typed.
-          if (obj.isMeta === true) return '';
-          if (obj.promptSource === 'system' || obj.promptSource === 'sdk') return '';
-          const msg = obj.message ?? obj;
-          const role = msg.role ?? obj.role ?? obj.type;
-          if (role !== 'user') return '';
-          const content = msg.content ?? obj.content;
-          if (typeof content === 'string') {
-            // Stop-hook block feedback is recorded as a role:user string. It is
-            // the hook's OWN nudge ("[WIKI_AUTOCLOSE] … Run crystallize …"), not
-            // user intent — counting it would be circular (the hook that prods the
-            // model to close would become proof the user wanted to close).
-            return content.startsWith('Stop hook feedback') ? '' : content;
-          }
-          if (Array.isArray(content)) {
-            // Only genuine user-typed text blocks. tool_result blocks are also
-            // recorded with role:'user' in the Claude Code transcript; slurping
-            // them via JSON.stringify let tool output (e.g. close-pattern example
-            // strings read out of code/docs) trip the close-intent gate.
-            // Do NOT recurse into tool_result.content, or the pollution returns.
-            return content
-              .filter((b) => b && b.type === 'text' && typeof b.text === 'string')
-              .map((b) => b.text)
-              .join('\n');
-          }
-          return '';
-        } catch {
-          return '';
+    return tail.map((line) => {
+      try {
+        const obj = JSON.parse(line);
+        // Skill-injection vector: drop system-injected role:user
+        // messages before they pollute the close-intent signal.
+        //  • isMeta:true   — slash-command bodies, skill bodies, local-command
+        //    caveats. Their text is docs/specs, often full of close vocabulary
+        //    (e.g. the /hypo:crystallize spec literally contains close phrases),
+        //    which would let the gate self-satisfy the moment the model invokes
+        //    a close command. Confirmed isMeta:true in the transcript.
+        //  • promptSource system|sdk — task-notifications (system) and
+        //    SDK / QA-harness synthetic prompts (sdk). Neither is user-typed.
+        if (obj.isMeta === true) return '';
+        if (obj.promptSource === 'system' || obj.promptSource === 'sdk') return '';
+        const msg = obj.message ?? obj;
+        const role = msg.role ?? obj.role ?? obj.type;
+        if (role !== 'user') return '';
+        const content = msg.content ?? obj.content;
+        if (typeof content === 'string') {
+          // Stop-hook block feedback is recorded as a role:user string. It is
+          // the hook's OWN nudge ("[WIKI_AUTOCLOSE] … Run crystallize …"), not
+          // user intent — counting it would be circular (the hook that prods the
+          // model to close would become proof the user wanted to close).
+          return content.startsWith('Stop hook feedback') ? '' : content;
         }
-      })
-      .join('\n');
+        if (Array.isArray(content)) {
+          // Only genuine user-typed text blocks. tool_result blocks are also
+          // recorded with role:'user' in the Claude Code transcript; slurping
+          // them via JSON.stringify let tool output (e.g. close-pattern example
+          // strings read out of code/docs) trip the close-intent gate.
+          // Do NOT recurse into tool_result.content, or the pollution returns.
+          return content
+            .filter((b) => b && b.type === 'text' && typeof b.text === 'string')
+            .map((b) => b.text)
+            .join('\n');
+        }
+        return '';
+      } catch {
+        return '';
+      }
+    });
   } catch {
-    return '';
+    return [];
   }
 }
 
@@ -2678,83 +3166,295 @@ export function resolveTranscriptBySessionId(
 }
 
 /**
- * Returns true iff the transcript carries a genuine USER session-close signal —
- * the hard gate for the session-closed marker writers. Scans the FULL
- * transcript: a close request can precede the marker write by the entire close
- * checklist, so the Stop hook's 30-line tail would miss it.
- *
- * Evidence (any one is sufficient):
- *   1. a de-polluted NL close phrase — isClosePattern over extractUserMessages,
- *      which already drops injected / tool / hook-feedback text;
- *   2. a `/compact` invocation (queue-operation). `/clear` is deliberately NOT
- *      counted: it abandons context, whereas a session-close PRESERVES the work
- *      to the wiki — a different intent;
- *   3. an AskUserQuestion answer whose SELECTED value names a close action (the
- *      canonical "offer [세션 마무리] → user picks it" flow).
- *
- * A Stop-hook block is NOT evidence: it is the hook's own nudge to close, so
- * counting it would be circular (the incident's block told the model to write the
- * marker). extractUserMessages already strips it.
- *
- * Fail-closed: any read error → false (caller refuses the marker).
+ * Returns true iff the transcript's LATEST live user decision is to close — the
+ * hard gate for the session-closed marker writers. This is a state predicate, not
+ * an existence one: "is close still approved right now", not "did a
+ * close signal ever appear". Scans the FULL transcript in line order, classifies
+ * each record, and tracks the approval as a LEASE.
+ *
+ * Classification (structural fields only — never content heuristics for producer):
+ *   • GRANT      a genuine user close: an NL close phrase in user text that
+ *                survives {@link eventUserText}'s exclusions; a `/compact`
+ *                queue-op; a remove-path queued_command attachment carrying a
+ *                close with an audited human producer (origin.kind "human"); a
+ *                correlated, non-error AskUserQuestion answer naming a close.
+ *   • INVALIDATE a fresh user intent that expires the lease: any other genuine
+ *                user text, `/clear`, `popAll`, a non-close queued_command, a
+ *                non-close AskUserQuestion selection.
+ *   • NEUTRAL    everything the model can produce or the harness injects: system/
+ *                sdk replay, isMeta bodies, sidechain, interruptedMessageId
+ *                companions, assistant, tool_result, task-notification.
+ *   • FATAL      an unparseable line — the transcript is being appended to or is
+ *                corrupt, so refuse rather than read a half-written record.
+ *
+ * The last grant wins and a later invalidate expires it, so a stale close (Defect
+ * B), a queued "keep working" after a close, and a non-close AskUserQuestion
+ * selection all correctly read as NOT closed. Abandoned-branch staleness is a
+ * known limit (no leaf pointer exists to resolve it — see the branch note on the
+ * function), mitigated by the lease.
+ *
+ * Threat model: an honest-but-drifting model that does not forge the
+ * transcript. This is a safety interlock, not an authorization boundary — a model
+ * that forges records is out of scope and documented so.
+ *
+ * Fail-closed: any read/parse error, or an unresolvable branch, → false.
  */
+// Genuine user text of a record, or null when the record is on a channel the
+// honest-but-drifting model can reach (so it is never user intent — NEUTRAL).
+// role:user is the boundary the model cannot cross: it authors role:assistant,
+// so a user record that survives every exclusion below is genuine user text.
+// The exclusions are exactly the model-reachable channels:
+//   • isMeta            slash-command / skill bodies and local-command caveats
+//   • promptSource system|sdk   queue replay of injected text, SDK prompts
+//   • isSidechain       subagent context (a subagent must not close the session)
+//   • interruptedMessageId  the harness cut the model off; user-SHAPED, not a
+//                       user decision (e.g. the [Request interrupted by user]
+//                       companion of a delivered /compact)
+//   • Stop-hook feedback  the hook's own close nudge — circular
+//   • tool_result blocks  tool output, not typed text
+// No promptSource allowlist is required: requiring `typed` would drop the
+// legacy absent-promptSource close the older gate has always honoured, while the
+// dangerous replay/injection paths carry system|sdk|isMeta|isSidechain and are
+// excluded here anyway.
+function eventUserText(obj) {
+  if (obj.isMeta === true) return null;
+  if (obj.promptSource === 'system' || obj.promptSource === 'sdk') return null;
+  if (obj.isSidechain === true) return null;
+  if (obj.interruptedMessageId) return null;
+  const msg = obj.message ?? obj;
+  const role = msg.role ?? obj.role ?? obj.type;
+  if (role !== 'user') return null;
+  const content = msg.content ?? obj.content;
+  if (typeof content === 'string') {
+    return content.startsWith('Stop hook feedback') ? null : content;
+  }
+  if (Array.isArray(content)) {
+    const texts = content
+      .filter((b) => b && b.type === 'text' && typeof b.text === 'string')
+      .map((b) => b.text);
+    return texts.length ? texts.join('\n') : null;
+  }
+  return null;
+}
+
+// A record on a channel the honest-but-drifting model can reach, so it can never
+// be a user decision. Used to keep injected / replayed / subagent records out of
+// BOTH the user-text and the AskUserQuestion-answer classifiers.
+function isModelReachableRecord(obj) {
+  return (
+    obj.isMeta === true ||
+    obj.promptSource === 'system' ||
+    obj.promptSource === 'sdk' ||
+    obj.isSidechain === true
+  );
+}
+
 export function hasUserCloseSignal(transcriptPath) {
   if (!transcriptPath) return false;
-  let lines;
+  let raw;
   try {
-    lines = readFileSync(transcriptPath, 'utf-8').split('\n');
+    raw = readFileSync(transcriptPath, 'utf-8');
   } catch {
     return false;
   }
-  // (1) NL close over the full, de-polluted transcript.
-  if (isClosePattern(extractUserMessages(transcriptPath, Infinity))) return true;
-  // AskUserQuestion answers (3) must be correlated to a real AskUserQuestion
-  // tool_use by id — otherwise ANY tool_result string containing "have been
-  // answered" (e.g. a Read/Grep of this very file, or of a transcript) would
-  // satisfy the gate, reintroducing the tool_result pollution the de-pollution
-  // layer closes. First pass collects the genuine AskUserQuestion tool_use ids;
-  // the tool_use (assistant) always precedes its tool_result (user) in the log,
-  // so a single forward scan suffices.
-  const askIds = new Set();
-  for (const line of lines) {
+  // FATAL: a non-empty line that will not parse means the transcript is being
+  // appended to (a half-written record) or is corrupt. Skipping it would let a
+  // stale prior grant survive past an event we cannot read, so refuse. A line
+  // that parses to a non-object (a bare null / string / number) is valid JSON but
+  // not a record — noise, not corruption — so it is skipped, not fatal, and never
+  // reaches the field reads below.
+  const recs = [];
+  for (const line of raw.split('\n')) {
     if (!line.trim()) continue;
-    let obj;
+    let o;
     try {
-      obj = JSON.parse(line);
+      o = JSON.parse(line);
     } catch {
+      return false;
+    }
+    if (o === null || typeof o !== 'object') continue;
+    recs.push(o);
+  }
+
+  // The approval is a LEASE, not an existence fact: walk the transcript in line
+  // order and track whether the LATEST user decision is a grant. Each grant sets
+  // it true, each invalidate sets it false, neutral leaves it — so at the end
+  // `granted` is "the most recent user decision was to close, and nothing has
+  // expired it since", which is how a stale close and a queued change-of-mind
+  // read as NOT closed.
+  //
+  // Branch note: line order mixes an abandoned branch's records with the live
+  // ones. A leaf-pointer ancestry filter was tried and withdrawn — the transcript
+  // carries no authoritative leaf pointer (measured: 0 leafUuid / summary
+  // records), so a heuristic leaf can skip the real invalidator and PRESERVE a
+  // stale grant (a fail-open, not a conservative filter). Until such a pointer
+  // exists, a close on a branch abandoned under a neutral tail is a known
+  // staleness limit, mitigated by the lease: any later live user intent, on any
+  // branch, still expires it.
+  const askIds = new Set();
+  let granted = false;
+
+  for (const o of recs) {
+    // Queue operations. The queue carries no correlation key (measured), so the
+    // ENQUEUE content is the decision — not a later contentless dequeue, which
+    // would need pairing we cannot do. Reading the enqueue also keeps the live
+    // PreCompact gate working (it sees the enqueue) and avoids double-counting the
+    // replay companion of an already-decided item (the /compact replay is not a
+    // fresh decision). popAll cancels the queue → invalidate. Delivery ops
+    // (dequeue, remove) carry no fresh decision here — a content-bearing remove of
+    // an NL queued command is handled by its queued_command attachment below.
+    if (o.type === 'queue-operation') {
+      if (o.operation === 'popAll') {
+        granted = false;
+        continue;
+      }
+      if (o.operation !== 'enqueue') continue;
+      const c = typeof o.content === 'string' ? o.content.trim() : '';
+      if (/^\/compact(?:\s|$)/.test(c))
+        granted = true; // a user compaction preserves the work → grant
+      else if (/^\/clear(?:\s|$)/.test(c))
+        granted = false; // abandons context → invalidate
+      else if (!c || c.startsWith('<task-notification>')) {
+        /* model-caused / empty — neutral */
+      } else if (isClosePattern(c)) {
+        /* NL close via the queue — the open dequeue gap: the producer cannot be
+           attributed (a peer/model enqueue wears the same shape), so no grant */
+      } else granted = false; // a queued non-close user intent → invalidate (change of mind)
       continue;
     }
-    // (2) /compact (queue-operation). Not /clear — see doc above.
-    if (
-      obj.type === 'queue-operation' &&
-      typeof obj.content === 'string' &&
-      /^\/compact(?:\s|$)/.test(obj.content.trim())
-    ) {
-      return true;
+
+    // remove-path delivery of a queued natural-language command (measured: the
+    // item leaves the queue as it is handed to the model, landing as an
+    // `attachment` of type queued_command with the prompt verbatim). A close here
+    // grants ONLY with an audited human producer — origin.kind "human", present
+    // on every 2.1.181+ user delivery (measured). A legacy origin-absent delivery
+    // cannot attest a producer, so it does not grant (fail-closed). A NON-close
+    // queued command (e.g. "keep working") is a fresh user intent and INVALIDATES
+    // a prior grant regardless of origin — that is what closes the re-close hole
+    // where a queued "continue" after a close leaves the stale lease live.
+    if (o.type === 'attachment' && o.attachment && o.attachment.type === 'queued_command') {
+      const prompt = typeof o.attachment.prompt === 'string' ? o.attachment.prompt : '';
+      const humanOrigin = !!(o.attachment.origin && o.attachment.origin.kind === 'human');
+      if (isClosePattern(prompt)) {
+        if (humanOrigin) granted = true;
+      } else if (prompt) {
+        granted = false;
+      }
+      continue;
     }
-    const content = (obj.message ?? obj).content;
-    if (!Array.isArray(content)) continue;
-    for (const b of content) {
-      if (!b || typeof b !== 'object') continue;
-      // record AskUserQuestion tool_use ids
-      if (b.type === 'tool_use' && b.name === 'AskUserQuestion' && b.id) {
-        askIds.add(b.id);
-        continue;
+
+    // Record AskUserQuestion tool_use ids (assistant record, always precedes its
+    // answer in line order).
+    const content = (o.message ?? o).content;
+    if (Array.isArray(content)) {
+      for (const b of content) {
+        if (
+          b &&
+          typeof b === 'object' &&
+          b.type === 'tool_use' &&
+          b.name === 'AskUserQuestion' &&
+          b.id
+        )
+          askIds.add(b.id);
       }
-      // (3) AskUserQuestion answer naming a close action — only when this
-      // tool_result actually answers a recorded AskUserQuestion. The answer lands
-      // in a role:user tool_result string: `… have been answered: "Q"="A". …`.
-      // Match the answer value(s) (the `="…"` side), never the question text, and
-      // run the SAME isClosePattern as the NL path so the two channels agree.
-      if (b.type === 'tool_result' && b.tool_use_id && askIds.has(b.tool_use_id)) {
+    }
+
+    // Genuine user text → grant on a close phrase, invalidate on anything else.
+    const text = eventUserText(o);
+    if (text != null && text !== '') {
+      granted = isClosePattern(text);
+      continue;
+    }
+
+    // AskUserQuestion answer, correlated to a recorded AskUserQuestion, EXCLUDED
+    // and HARDENED. isModelReachableRecord keeps an injected / sdk / sidechain
+    // record from reaching the answer parser. is_error:false AND the host's
+    // success marker are required because a malformed AskUserQuestion echoes the
+    // raw input back in an is_error result, and the model authors the option
+    // labels. A close selection grants; any other real selection invalidates.
+    if (Array.isArray(content) && !isModelReachableRecord(o)) {
+      for (const b of content) {
+        if (!b || typeof b !== 'object') continue;
+        if (b.type !== 'tool_result' || !b.tool_use_id || !askIds.has(b.tool_use_id)) continue;
+        if (b.is_error === true) continue;
         const s = typeof b.content === 'string' ? b.content : JSON.stringify(b.content);
+        if (!/have been answered/.test(s)) continue;
+        let sawAnswer = false;
+        let sawClose = false;
         for (const m of s.matchAll(/="([^"]*)"/g)) {
-          if (isClosePattern(m[1])) return true;
+          sawAnswer = true;
+          if (isClosePattern(m[1])) sawClose = true;
         }
+        if (sawClose) granted = true;
+        else if (sawAnswer) granted = false;
       }
     }
   }
-  return false;
+  return granted;
+}
+
+/** The literal the user must type to approve a parked-overwrite batch. */
+export const APPROVAL_PHRASE = 'apply-proposals';
+
+/**
+ * True iff the transcript carries a user's TYPED approval of the batch this nonce
+ * was minted for — the authorization gate for a transcript-approved apply.
+ *
+ * Deliberately NOT hasUserCloseSignal. That function answers "did the user want to
+ * end the session", and it accepts a correlated AskUserQuestion answer as evidence
+ * (see above). Reusing it here would let a SESSION-CLOSE approval spend itself as an
+ * OVERWRITE approval: different authority, different question. Two gates, two
+ * matchers.
+ *
+ * Typed text only, and an AskUserQuestion click is refused ON PURPOSE. The model
+ * authors the option labels, and it authors them AFTER it has seen the nonce — so
+ * it could place `apply-proposals <nonce>` on a "no" option, on every option, or
+ * under a question that asks something else entirely. A click would prove a click.
+ * Typing the nonce proves the user produced THIS phrase.
+ *
+ * The nonce carries the freshness: it is minted (crypto-random) only once the diff
+ * has been re-read from disk and shown, so a turn that predates the diff cannot
+ * contain it, and `resolve` spends the challenge BEFORE it writes, so it cannot be
+ * replayed.
+ *
+ * extractUserMessageRecords does the de-pollution: it drops `isMeta` bodies
+ * (slash-command and skill text, so a doc that quotes this phrase cannot satisfy the
+ * gate), `promptSource: system|sdk`, Stop-hook feedback, and `tool_result` blocks (so
+ * neither a tool's output nor a Read of a file that contains the phrase counts).
+ * The model's own words are role:assistant and never reach it.
+ *
+ * Fail-closed: no path, a nonce that is not the minted shape, or an unreadable
+ * transcript all return false.
+ *
+ * @param {string} transcriptPath
+ * @param {string} nonce hex, as minted by `proposal challenge`
+ */
+export function hasTypedUserApproval(transcriptPath, nonce) {
+  if (!transcriptPath || typeof nonce !== 'string') return false;
+  // Pin the shape rather than accept any string: a caller that passed '' or a
+  // regex-ish value would otherwise turn the match into a wildcard.
+  if (!/^[a-f0-9]{32,}$/.test(nonce)) return false;
+  // A MESSAGE that IS the phrase, not a message that has the phrase somewhere in it.
+  // Line-exactness is not enough, because the user is TOLD to type this phrase and so
+  // it is natural to quote it back while hesitating:
+  //
+  //     I do not consent; I am only quoting the command:
+  //         apply-proposals <nonce>
+  //
+  // Every line-level matcher reads that as approval, and the user has authorized an
+  // overwrite by refusing one. The whole eligible message must be the phrase and
+  // nothing else, which is the bar the TTY channel has always held (`apply <id>`,
+  // alone, on the prompt). The two channels must not disagree about what consent
+  // looks like.
+  //
+  // Measured, not assumed: across 468 eligible user records in this project's
+  // transcripts, none carried a second text block and none carried injected
+  // system-reminder text, so a turn whose only content is the phrase survives
+  // extraction as exactly the phrase. A false negative costs a retype; a false
+  // positive costs the user's file.
+  const want = `${APPROVAL_PHRASE} ${nonce}`;
+  const records = extractUserMessageRecords(transcriptPath, Infinity);
+  return records.some((msg) => msg.trim() === want);
 }
 
 /**
@@ -2876,7 +3576,8 @@ export function isCloseReconfirmDeclined(transcriptPath) {
     // system/sdk synthetic prompts, and (via the array-content branch below)
     // tool_result blocks, which are role:'user' in the transcript but are NOT
     // user-typed text.
-    const isInjected = obj.isMeta === true || obj.promptSource === 'system' || obj.promptSource === 'sdk';
+    const isInjected =
+      obj.isMeta === true || obj.promptSource === 'system' || obj.promptSource === 'sdk';
     const role = msg.role ?? obj.role ?? obj.type;
     if (!isInjected && role === 'user') {
       if (typeof content === 'string') {
@@ -2962,7 +3663,15 @@ export function computeSessionGrowth(hypoDir) {
     // more expensive `git diff HEAD --unified=0` — Stop hook P95 win.
     // `-uall` expands untracked directories so a brand-new `pages/new.md`
     // isn't hidden behind a single `?? pages/` line.
-    const porcelain = spawnSync('git', ['-C', hypoDir, 'status', '--porcelain', '-uall'], {
+    // `-z`: NUL-separated, verbatim paths (see commitWikiChanges). The old
+    // newline/quote-strip parser left octal escapes in place, so Korean page
+    // names silently failed the `pages/`·`projects/` scope match and dropped
+    // out of the growth count.
+    // `-z`: NUL-separated, verbatim paths (see commitWikiChanges). The old
+    // newline/quote-strip parser left octal escapes in place, so Korean page
+    // names silently failed the `pages/`·`projects/` scope match and dropped
+    // out of the growth count.
+    const porcelain = spawnSync('git', ['-C', hypoDir, 'status', '--porcelain', '-uall', '-z'], {
       encoding: 'utf-8',
       timeout: 5000,
     });
@@ -2976,10 +3685,14 @@ export function computeSessionGrowth(hypoDir) {
     // intentionally excluded — they're scaffolding, not page growth.
     const inPagesScope = (file) =>
       file.endsWith('.md') && (file.startsWith('pages/') || file.startsWith('projects/'));
-    for (const line of (porcelain.stdout || '').split('\n')) {
-      if (!line) continue;
-      const xy = line.slice(0, 2);
-      const file = line.slice(3).replace(/^"|"$/g, '').split(' -> ').pop().trim();
+    const records = (porcelain.stdout || '').split('\0');
+    for (let i = 0; i < records.length; i++) {
+      const rec = records[i];
+      if (!rec) continue;
+      const xy = rec.slice(0, 2);
+      const file = rec.slice(3); // destination path for a rename/copy
+      // A rename OR copy emits two records (`to\0from`); consume the trailing `from`.
+      if (xy[0] === 'R' || xy[1] === 'R' || xy[0] === 'C' || xy[1] === 'C') i++;
       if (!inPagesScope(file)) continue;
       if (xy === '??') {
         untrackedMd.push(file);
@@ -2987,7 +3700,8 @@ export function computeSessionGrowth(hypoDir) {
         continue;
       }
       hasTrackedMdChange = true;
-      if (xy.includes('A')) addedPages++;
+      // A copy's destination is a brand-new page, so it counts as added like `A`.
+      if (xy.includes('A') || xy.includes('C')) addedPages++;
       else if (xy.includes('M') || xy.includes('R')) updatedPages++;
     }
     if (!hasTrackedMdChange && untrackedMd.length === 0) return empty;
@@ -3079,3 +3793,65 @@ export function isIgnored(filePath, hypoDir, patterns) {
   }
   return false;
 }
+
+// ── visibility scope ─────────────────────────────────────────────────────────
+// The machine-scoped visibility namespace (`visibility_scope: machine:<device>`)
+// requires that the SAME device string is produced at write time (audit device
+// stamps) and at lookup time (the visibility filter) — otherwise a page never
+// matches its own machine. So this is the single source for both. NOT cached:
+// each call reads env fresh so in-process tests can override via HYPO_DEVICE
+// (os.hostname is not mockable). CR/LF are stripped so the value stays a single
+// frontmatter token.
+export function currentDevice() {
+  // Strip CR/LF BEFORE the fallback chain, not after: a HYPO_DEVICE of only
+  // CR/LF is truthy, so stripping after `||` would yield '' and make
+  // scopeVisible('machine:', '') pass — the empty-owner page must hide
+  // everywhere. Stripping first collapses such a value to '' so it falls through
+  // to hostname, keeping the result non-empty on every path.
+  const env = String(process.env.HYPO_DEVICE || '').replace(/[\r\n]/g, '');
+  if (env) return env;
+  const host = String(hostname() || '').replace(/[\r\n]/g, '');
+  return host || 'unknown';
+}
+
+// Extract the top-level `visibility_scope` from a page's raw content. Mirrors
+// scripts/lib/frontmatter.mjs normalization (top-level only, first-wins, strip a
+// whitespace-led trailing YAML comment, strip surrounding quotes) rather than
+// importing it: hooks deploy to ~/.claude/hooks/ with no external imports. The
+// five consumers must call this instead of a local last-wins/no-comment parser,
+// else a `machine:devA # note` value fails to match on its own machine. Returns
+// '' when absent (which scopeVisible treats as shared).
+export function readVisibilityScope(raw) {
+  const m = String(raw || '').match(/^---\r?\n([\s\S]*?)\r?\n---/);
+  if (!m) return '';
+  for (const line of m[1].split(/\r?\n/)) {
+    if (/^\s/.test(line) || /^-(\s|$)/.test(line)) continue; // nested / list item
+    const idx = line.indexOf(':');
+    if (idx < 0) continue;
+    if (line.slice(0, idx).trim() !== 'visibility_scope') continue;
+    return line
+      .slice(idx + 1)
+      .trim()
+      .replace(/\s+#.*$/, '')
+      .replace(/^["']|["']$/g, '');
+  }
+  return '';
+}
+
+// The single visibility decision, shared by lookup / query / file-watch /
+// page-usage / crystallize. `scopeValue` is a readVisibilityScope() output,
+// `device` a currentDevice() output. Prefix dispatch, fail-open on anything
+// unrecognized so the field is purely additive:
+//   ''/'shared'       → visible (the implicit default of every pre-existing page)
+//   'machine:<owner>' → visible only on the owning machine. Empty owner
+//                       (`machine:`) hides everywhere: '' can never equal
+//                       currentDevice()'s non-empty fallback.
+//   'agent:<id>'      → visible; value space reserved, no writer yet (forward-compat)
+//   anything else     → visible (fail-open)
+export function scopeVisible(scopeValue, device) {
+  const v = String(scopeValue || '').trim();
+  if (v === '' || v === 'shared') return true;
+  if (v.startsWith('machine:')) return v.slice('machine:'.length) === device;
+  if (v.startsWith('agent:')) return true;
+  return true;
+}