hypomnema 1.6.2 → 1.7.0

package/scripts/crystallize.mjs

@@ -75,7 +75,6 @@ import {
   realpathSync,
 } from 'fs';
 import { join, dirname } from 'path';
-import { hostname } from 'os';
 import { spawnSync } from 'child_process';
 import { fileURLToPath, pathToFileURL } from 'url';
 import { resolveHypoRoot, expandHome } from './lib/hypo-root.mjs';
@@ -102,7 +101,13 @@ import {
   resolveTranscriptBySessionId,
   hasUserCloseSignal,
   commitWikiChanges,
+  currentDevice,
+  scopeVisible,
+  readVisibilityScope,
+  withFileLock,
 } from '../hooks/hypo-shared.mjs';
+import { hashContent, readBaseEntry, advanceBase } from '../hooks/base-store.mjs';
+import { writeProposal } from '../hooks/proposal-store.mjs';
 
 // This script's own absolute path. Used to print copy-pasteable recovery
 // commands as `node <SELF_SCRIPT> ...` rather than a bare `crystallize` bin,
@@ -169,6 +174,7 @@ function parseArgs(argv) {
     else if (arg.startsWith('--session-id=')) args.sessionId = arg.slice(13);
     else if (arg.startsWith('--payload=')) args.payload = arg.slice(10);
     else if (arg.startsWith('--transcript-path=')) args.transcriptPath = expandHome(arg.slice(18));
+    else if (arg.startsWith('--session-cwd=')) args.sessionCwd = expandHome(arg.slice(14));
     else if (arg.startsWith('--project=')) args.project = arg.slice(10);
     else if (arg === '--force') args.force = true;
     else if (arg === '--json') args.json = true;
@@ -240,13 +246,31 @@ function runSessionCloseCheck(args) {
   // would re-add that project's files to the lint scope and re-block the scoped
   // check, defeating the point. The global (no --project) check keeps widening.
   if (args.project) requireProjectDir(args, args.project);
+  // Resolve the transcript from --session-id when --transcript-path was not given,
+  // exactly as --mark and the apply auto-marker already do. The transcript is what
+  // attributes the close as well as widening the lint scope, and PreCompact
+  // always has one from its hook payload. A check without it would compute an EMPTY
+  // close scope, fall back to the global block, and report RED for debt that /compact
+  // demotes. Checklist step 14 tells the model to trust this command, so an over-red
+  // check is as harmful as an over-green one.
+  const checkTranscript =
+    args.transcriptPath ||
+    (args.sessionId ? resolveTranscriptBySessionId(args.sessionId) : null) ||
+    null;
   const status = precompactGateStatus(args.hypoDir, {
     ...(args.project
       ? { projectOverride: args.project }
-      : args.transcriptPath
-        ? { transcriptPath: args.transcriptPath }
+      : checkTranscript
+        ? { transcriptPath: checkTranscript }
         : {}),
     ...(args.sessionId ? { sessionId: args.sessionId } : {}),
+    // The P2 cwd close check (session-close attribution) applies to the GLOBAL gate only. Under
+    // --project the check is a project-scoped diagnostic, so a cwd blocker for a
+    // DIFFERENT project would muddy that scoped answer — pass sessionCwd only for
+    // the global form. process.cwd() is deliberately NOT a fallback: a check run
+    // after `cd ~/hypomnema` would map to the vault, not the session (authoritative
+    // enforcement lives in the PreCompact/Stop hooks, which carry payload.cwd).
+    ...(args.sessionCwd && !args.project ? { sessionCwd: args.sessionCwd } : {}),
   });
   const close = status.close;
 
@@ -281,11 +305,17 @@ function runSessionCloseCheck(args) {
       JSON.stringify(
         {
           ok: status.ok,
-          // flat close fields preserved for back-compat with prior readers
+          // flat close fields preserved for back-compat with prior readers. They now
+          // describe what BLOCKS: a foreign project's incomplete close is demoted out
+          // of stale/missing into close_debt, so a reader that treats a
+          // non-empty `missing` as failure still agrees with `ok` instead of
+          // contradicting it.
           project: close.project,
           dates: close.dates,
           stale: close.stale,
           missing: close.missing,
+          ...(close.debt?.length ? { close_debt: close.debt } : {}),
+          ...(close.scope ? { close_scope: close.scope } : {}),
           blockers: status.blockers,
           notices: status.notices,
           skipped: status.skipped,
@@ -411,6 +441,14 @@ function readPayload(source) {
   }
 }
 
+// How long an append waits for its per-target lock before withholding to the
+// proposal-pending gate (see withFileLock). A withheld append blocks the close but
+// is NOT parked as a proposal artifact — the next close re-appends. Default 5s is
+// generous for a real close;
+// the env override exists ONLY so tests can force a fast timeout instead of
+// spinning the full 5s. Not a documented production knob.
+const APPEND_LOCK_TIMEOUT_MS = Number(process.env.HYPO_APPEND_LOCK_TIMEOUT_MS) || 5000;
+
 /** Atomic write via tmp+rename. `<path>.<pid>.<rand>.tmp` so concurrent helpers
  * don't fight over the same shared `<path>.tmp` slot. */
 function atomicWrite(path, content) {
@@ -420,17 +458,51 @@ function atomicWrite(path, content) {
   renameSync(tmp, path);
 }
 
-/** Atomic write that skips when on-disk bytes already match `content`. */
-function writeIfChanged(path, content) {
-  if (existsSync(path)) {
-    try {
-      if (readFileSync(path, 'utf-8') === content) return false; // idempotent skip
-    } catch {
-      /* fall through to overwrite */
-    }
+/**
+ * Read a target's current bytes, distinguishing "absent" from "unreadable" the
+ * same way base-store's hashFile does. The overwrite guard needs all three
+ * answers: content to compare, `null` to know creating is safe, `undefined` to
+ * refuse to guess.
+ * @returns {string|null|undefined} bytes, `null` if absent, `undefined` if unreadable
+ */
+function readTarget(path) {
+  if (!existsSync(path)) return null;
+  try {
+    return readFileSync(path, 'utf-8');
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Has the target drifted away from what this session observed at start?
+ *
+ * Branches on base-store's `state` discriminator, never on the truthiness of
+ * `hash`: 'absent' and 'unknown' both carry `hash: null`, and collapsing them
+ * would read never-observed as safe-to-write, defeating the guard entirely.
+ *
+ * @param {{state: 'hash'|'absent'|'unknown', hash: string|null}} entry
+ * @param {string|null|undefined} disk current bytes / absent / unreadable
+ * @returns {string|null} a conflict reason, or null when this session may write
+ */
+function overwriteConflictReason(entry, disk) {
+  // Cannot read what we are about to replace: fail safe, never assume unchanged.
+  if (disk === undefined) return 'target-unreadable';
+  switch (entry.state) {
+    case 'unknown':
+      // No snapshot for this (session, target). Someone else's edits could be
+      // sitting on disk and we would have no way to tell.
+      return 'base-unknown';
+    case 'absent':
+      // We observed no file. Creating it is safe; finding one now means another
+      // writer got there first.
+      return disk === null ? null : 'base-absent-target-exists';
+    case 'hash':
+      if (disk === null) return 'base-hash-target-missing';
+      return hashContent(disk) === entry.hash ? null : 'base-mismatch';
+    default:
+      return 'base-unknown';
   }
-  atomicWrite(path, content);
-  return true;
 }
 
 /**
@@ -444,8 +516,16 @@ function appendIfAbsent(path, entry, alreadyPresent) {
   if (existsSync(path)) {
     try {
       content = readFileSync(path, 'utf-8');
-    } catch {
-      content = '';
+    } catch (err) {
+      // ENOENT here is a narrow existsSync-then-readFileSync race (the file
+      // vanished between the two calls) — content='' is safe, we would create
+      // it fresh anyway. Anything else (EACCES/EISDIR/...) is a PERSISTENT
+      // read failure: retrying (the caller's lock-timeout conflict path) would
+      // never fix it, and swallowing it here would fall through to the
+      // atomicWrite below and silently replace the existing file's bytes with
+      // just this one entry — a data-loss overwrite. So rethrow and let the
+      // withFileLock/call-site catch hard-fail the close instead.
+      if (err?.code !== 'ENOENT') throw err;
     }
   }
   if (alreadyPresent(content)) return false;
@@ -510,6 +590,13 @@ function validatePayloadShape(payload) {
   if (payload.date !== undefined && !/^\d{4}-\d{2}-\d{2}$/.test(String(payload.date))) {
     errs.push('payload.date, when present, must be YYYY-MM-DD');
   }
+  if (
+    payload.sessionId !== undefined &&
+    payload.sessionId !== null &&
+    typeof payload.sessionId !== 'string'
+  ) {
+    errs.push('payload.sessionId, when present, must be a string');
+  }
   return errs;
 }
 
@@ -529,11 +616,14 @@ function runMarkSessionClosed(args) {
     console.log(args.json ? JSON.stringify({ ok: false, error: msg }, null, 2) : `✗ ${msg}`);
     process.exit(1);
   }
-  // --project=<slug> on --mark is ATTRIBUTION ONLY (the marker's `project` field).
-  // The gate stays GLOBAL — never narrowed — because a marker that narrowed its
-  // gate could attest compact-ready while PreCompact re-checks all of today's
-  // projects and stays red (the marker == compact-ready invariant,
-  // codex design finding 1/2). Validate the attribution slug exists as a
+  // --project=<slug> on --mark names the project THIS session closed. It sets the
+  // marker's `project` field AND enters the close scope, so an incomplete close in a
+  // project this session did not touch is demoted to a notice instead of refusing the
+  // marker. It is NOT a gate narrow in the old sense: the marker records the same slug
+  // it scoped by, and PreCompact re-derives its own scope FROM that marker — so the
+  // two can never disagree, which is what the earlier "attribution only, gate stays
+  // global" rule was protecting (it assumed PreCompact stayed global; it no longer
+  // does). Everything else the gate checks stays global. Validate the slug exists as a
   // directory, exactly as --check does, but only when it is actually used (a
   // --log-only mark attributes to no project, so --project is moot there).
   if (args.project && !args.logOnly) requireProjectDir(args, args.project);
@@ -558,8 +648,12 @@ function runMarkSessionClosed(args) {
   // source for the user-close hard gate below.
   const closeTranscript = resolveTranscriptBySessionId(args.sessionId);
   const gate = precompactGateStatus(args.hypoDir, {
+    ...(args.project && !args.logOnly ? { closeScope: [args.project] } : {}),
     ...(closeTranscript ? { transcriptPath: closeTranscript } : {}),
     ...(args.logOnly ? { logOnly: true } : {}),
+    // P2 (session-close attribution): the marker gate must refuse to attest compact-ready while the
+    // session's cwd project has an unstarted close. logOnly exempts it in-gate.
+    ...(args.sessionCwd ? { sessionCwd: args.sessionCwd } : {}),
   });
   const status = gate.close;
   if (!gate.ok) {
@@ -602,12 +696,43 @@ function runMarkSessionClosed(args) {
     console.log(args.json ? JSON.stringify(result, null, 2) : `✗ ${reason}`);
     process.exit(1);
   }
-  // --project attributes the marker to that slug (gate stayed global); falls back
-  // to the gate's resolved primary. log-only marks attribute to no project. Used
-  // for the marker, the JSON result, and the success message so all three agree.
-  const markerProject = !args.logOnly && args.project ? args.project : status.project;
+  // Marker attribution comes from EVIDENCE, never from the gate's global
+  // `primary` (which is recency-derived, hypo-shared.mjs). The marker is what
+  // PreCompact later re-derives its own scope from, so attributing it to a project
+  // this session did not close hands PreCompact a scope the marker never cleared.
+  // The evidence set is the close scope — explicit --project ∪ the transcript's
+  // touched close files ∪ any prior marker for this session — all of which
+  // resolveCloseScope already unioned into status.scope. The recency primary is
+  // deliberately excluded: an empty scope means this session has no proof it closed
+  // any project (evidence-based close attribution), so we FAIL CLOSED rather than misattribute to recency.
+  const closeScope = status.scope || [];
+  const markerProjects = [
+    ...new Set([...(!args.logOnly && args.project ? [args.project] : []), ...closeScope]),
+  ];
+  if (!args.logOnly && markerProjects.length === 0) {
+    const err =
+      'cannot attribute this close to a project — no evidence (no --project, no transcript close-file edits, no prior marker). ' +
+      'Pass --project=<slug> for the project this session closed, or --log-only for a non-project (tooling/wiki-only) session.';
+    console.log(
+      args.json
+        ? JSON.stringify(
+            {
+              ok: false,
+              session_id: args.sessionId,
+              skipReason: 'no-attribution-evidence',
+              error: err,
+            },
+            null,
+            2,
+          )
+        : `✗ ${err}`,
+    );
+    process.exit(1);
+  }
+  const markerProject = !args.logOnly && args.project ? args.project : markerProjects[0];
   writeSessionClosedMarker(args.hypoDir, args.sessionId, {
     project: markerProject,
+    projects: args.logOnly ? [] : markerProjects,
     ...(args.logOnly ? { scope: 'log-only' } : {}),
   });
   // Marker writer swallows IO errors (best-effort, see hypo-shared.mjs). Verify
@@ -714,10 +839,76 @@ export function closeResultContradiction({ ok, markerWritten, markerSkipReason }
   return null;
 }
 
+// What the model should do when the close is refused. Deliberately does NOT name
+// a flag: the way out of this gate cannot be an argument the model can add, or
+// the gate is decorative. The way out is the user, which is the one input the
+// model does not author.
+const CLOSE_REFUSAL_HELP = [
+  'Nothing was written and nothing was committed.',
+  '',
+  'Do NOT add a bypass flag, and do NOT write the close files directly with an editor',
+  'or a shell — that is the same close without the check, and it is the thing this gate',
+  'exists to stop.',
+  '',
+  'If the user has not asked to close: do not close. Session-close is not a reward for',
+  'finishing a task, and a long session is not a close signal. Keep working, or ask ONCE',
+  'whether to wrap up, and take no for an answer.',
+  '',
+  'If the user HAS asked: pass the current main-conversation --session-id (not a',
+  'background-task or agent uuid from a /tmp path) and re-run this exact payload. The',
+  'writes are idempotent.',
+].join('\n');
+
+/**
+ * May this session apply a close at all?
+ *
+ * Authority comes from the transcript, because the transcript is the one input the
+ * model cannot author: the user's own words are in it, and nothing the model says
+ * counts (extractUserMessages drops injected, tool, and hook-feedback text).
+ *
+ *   { ok: true }
+ *   { ok: false, reason, error }   reason: session-id-required | transcript-unresolved
+ *                                          | no-user-close-signal
+ */
+function verifyCloseAuthority(sessionId) {
+  if (!sessionId) {
+    return {
+      ok: false,
+      reason: 'session-id-required',
+      error:
+        'session-close apply refused before any wiki write or commit: --session-id is required, ' +
+        "because the close signal is verified against that session's transcript. Omitting it does " +
+        'not skip the check, it fails it.',
+    };
+  }
+  const transcript = resolveTranscriptBySessionId(sessionId);
+  if (!transcript) {
+    return {
+      ok: false,
+      reason: 'transcript-unresolved',
+      error:
+        `session-close apply refused before any wiki write or commit: no transcript resolves for ` +
+        `session ${sessionId}. Pass the MAIN conversation's session id — a uuid taken from a ` +
+        `background-task output path or an agent thread is not it, and --transcript-path is not ` +
+        `authority here.`,
+    };
+  }
+  if (!hasUserCloseSignal(transcript)) {
+    return {
+      ok: false,
+      reason: 'no-user-close-signal',
+      error:
+        "session-close apply refused before any wiki write or commit: this session's transcript " +
+        'carries no user close signal. The user did not ask to close.',
+    };
+  }
+  return { ok: true };
+}
+
 function applySessionClose(args) {
   // Option D: early-exit fires only when NO payload was supplied.
   // Rationale: payload presence is explicit close intent and must always run
-  // the full apply path — the per-entry idempotency (writeIfChanged +
+  // the full apply path — the per-entry idempotency (overwrite's step-1 skip +
   // exact-entry append dedup) keeps re-apply cheap without short-circuiting,
   // and avoids silent-success when a same-day second close brings new bytes.
   // Payload-less invocation is treated as a cheap "already complete?" probe.
@@ -748,6 +939,51 @@ function applySessionClose(args) {
     // "payload is required" with the same error shape as before.
   }
 
+  // ── close authority: BEFORE any write ──────────────────────────────────────
+  // A payload is a claim that the user asked to close. Verify it here, ahead of
+  // readPayload and every byte that follows, because everything after this point
+  // is authoritative: session-state.md and the hot files are overwritten, the
+  // session-log and log.md are appended, and hypo-auto-commit lands the lot in git
+  // on the next Stop whether or not this command commits.
+  //
+  // The gate used to stand at the END, next to the marker (planMarkerDecision).
+  // It refused the MARKER on a close the user never asked for, and let the writes
+  // and the commit through. Worse, it was opt-in BY THE CALLER: with no
+  // --session-id there was no transcript to check, so the check simply did not
+  // run, and the apply reported ok:true with no skip reason at all. The model
+  // chose whether the model got checked. A model that has already decided to close
+  // does not reach for the flag that would stop it.
+  //
+  // So: no verifiable close signal, no close. Zero bytes, no commit, exit 1.
+  //
+  // What this does and does not promise. It promises that THIS entrypoint refuses
+  // a close with no recognized transcript evidence behind it. It does not promise
+  // the model cannot write these files at all: Write and Bash remain outside this
+  // gate, and the evidence predicate itself is coarse (any close signal anywhere in
+  // the transcript counts, so a stale one from earlier in a long session still
+  // passes, and it is the model that authors the AskUserQuestion option labels the
+  // user picks from). Narrowing that (current-turn binding, revocation, consent
+  // that the model did not word) is the follow-up this ADR names; it is not a
+  // reason to leave the default open in the meantime.
+  // Only a payload-bearing call can write. A payload-less one falls through to the
+  // "payload is required" error below without touching a byte, so gating it here
+  // would just replace one refusal with a less accurate one.
+  const closeAuth = args.payload ? verifyCloseAuthority(args.sessionId) : { ok: true };
+  if (!closeAuth.ok) {
+    const out = {
+      ok: false,
+      stage: 'no-user-close-signal',
+      reason: closeAuth.reason,
+      applied: [],
+      committed: false,
+      error: closeAuth.error,
+    };
+    console.log(
+      args.json ? JSON.stringify(out, null, 2) : `✗ ${closeAuth.error}\n\n${CLOSE_REFUSAL_HELP}`,
+    );
+    process.exit(1);
+  }
+
   let payload;
   try {
     payload = readPayload(args.payload);
@@ -768,6 +1004,43 @@ function applySessionClose(args) {
     process.exit(1);
   }
 
+  // Payload↔session binding (cross-session payload collision). The payload temp
+  // file is now written to a session-scoped path (see commands/crystallize.md), so
+  // two same-day sessions no longer share a file. This is the belt to that
+  // suspenders: if the payload names
+  // the session it was authored for, it must be THIS one — the --session-id whose
+  // transcript already cleared close authority above. A mismatch means the file on
+  // disk is not this session's close (a stray or hand-reused path handed us another
+  // session's payload), and applying it would stamp that content with this session's
+  // marker while the original session's record vanishes — the exact loss this
+  // guard exists to prevent. Refuse before a byte is written.
+  //
+  // Absent field → fail open: older payloads predate this field, and Part 1's unique
+  // path already prevents the collision. So the check only ever tightens; it never
+  // rejects a close it would otherwise have allowed on a matching (or absent) id. It
+  // is deliberately identity-based, not cwd-based: closing project B from a session
+  // whose cwd is project A stays supported (payload.project is authoritative), so a
+  // legitimately cross-project close is untouched.
+  if (
+    payload.sessionId !== undefined &&
+    payload.sessionId !== null &&
+    payload.sessionId !== args.sessionId
+  ) {
+    const msg =
+      `payload.sessionId ${JSON.stringify(payload.sessionId)} does not match --session-id ` +
+      `${JSON.stringify(args.sessionId)}: this payload was authored for a different session, so ` +
+      `it is not this session's close. Refusing before any write (cross-session guard).`;
+    const out = {
+      ok: false,
+      stage: 'session-id-mismatch',
+      error: msg,
+      applied: [],
+      committed: false,
+    };
+    console.log(args.json ? JSON.stringify(out, null, 2) : `✗ ${msg}`);
+    process.exit(1);
+  }
+
   // Resolve project: payload.project is REQUIRED (B-3, close-gate-hardening). The
   // old recency fallback (payload.project || probe.project) could, on a same-date
   // root-hot.md tie, resolve a DIFFERENT project than the one the payload's files
@@ -883,6 +1156,10 @@ function applySessionClose(args) {
   // Append targets (session-log, log.md) are NOT filtered: appending can't
   // repair existing corruption, so a corrupt session-log must still block.
   // Warns are informational (not gated) in either pass.
+  //
+  // The filter says "about to be replaced", and the observed-base guard can later
+  // decline to replace one of these. Preflight runs before the guard, so it cannot
+  // know. Harmless: post-apply lint re-scopes the same file and blocks on it there.
   const overwriteTargets = new Set();
   if (payload.sessionState) overwriteTargets.add(join('projects', project, 'session-state.md'));
   if (payload.projectHot) overwriteTargets.add(join('projects', project, 'hot.md'));
@@ -952,11 +1229,63 @@ function applySessionClose(args) {
 
   const applied = [];
   const skipped = [];
-
+  // Overwrite targets this apply refused to write because the page moved under
+  // it. T6 turns these into `.cache/proposals/` artifacts; here they are already
+  // enough to withhold the bytes and fail the close.
+  const conflicts = [];
+
+  /**
+   * Replace a whole page, guarded by the base this session observed at start.
+   *
+   * The step order is load-bearing, not stylistic:
+   *
+   *   1. idempotent skip (disk already equals the payload)
+   *   2. conflict (base unknown, or disk drifted away from base)
+   *   3. direct write, then advance the base
+   *
+   * Step 1 must come first for two reasons. It keeps every existing
+   * `--apply-session-close --session-id` test green (they read the payload
+   * straight off disk, so they land here before any base lookup). And it breaks
+   * the apply-then-reclose loop: once a human applies proposal P, disk == proposed
+   * == payload.content, so the next close skips before it can re-raise a conflict.
+   *
+   * There is no caller here without a `--session-id`. verifyCloseAuthority refuses
+   * that at the door, before a byte is written, so a session id is always present
+   * by the time this runs and the base lookup always has something to look up.
+   */
   const overwrite = (key, relPath, field) => {
     if (!field || typeof field.content !== 'string') return; // optional / absent
-    const wrote = writeIfChanged(join(args.hypoDir, relPath), field.content);
-    (wrote ? applied : skipped).push(`${key} (${relPath})`);
+    const full = join(args.hypoDir, relPath);
+    const disk = readTarget(full);
+
+    // (1) idempotent skip — preserves writeIfChanged's contract
+    if (disk === field.content) {
+      skipped.push(`${key} (${relPath})`);
+      return;
+    }
+
+    // (2) conflict, only where a session context makes a base observable
+    if (args.sessionId) {
+      const entry = readBaseEntry(args.hypoDir, args.sessionId, relPath);
+      const reason = overwriteConflictReason(entry, disk);
+      if (reason) {
+        conflicts.push({
+          key,
+          target: relPath,
+          reason,
+          baseHash: entry.hash,
+          currentHash: typeof disk === 'string' ? hashContent(disk) : null,
+          proposedContent: field.content,
+        });
+        return; // target bytes untouched
+      }
+    }
+
+    // (3) write, then the content we just wrote IS this session's new base
+    atomicWrite(full, field.content);
+    if (args.sessionId)
+      advanceBase(args.hypoDir, args.sessionId, relPath, hashContent(field.content));
+    applied.push(`${key} (${relPath})`);
   };
 
   overwrite('sessionState', join('projects', project, 'session-state.md'), payload.sessionState);
@@ -976,59 +1305,90 @@ function applySessionClose(args) {
     const rel = join('projects', project, 'session-log', `${date}.md`);
     const full = join(args.hypoDir, rel);
     const isPresent = entryAlreadyPresent(payload.sessionLog.entry);
-    // Fallback-aware idempotency (hybrid cutover): during the month the
-    // shard takes over, today's entry may already live in the legacy monthly
-    // file from an earlier (pre-cutover) close. Treat presence in EITHER the
-    // daily shard or the legacy monthly file as "already written" so a same-day
-    // second close does not duplicate an identical entry across both files —
-    // and so an idempotent re-apply stays a true no-op (no shard is created).
-    let alreadyThere = false;
-    for (const cand of sessionLogReadCandidates(project, date)) {
-      const cf = join(args.hypoDir, cand);
-      if (!existsSync(cf)) continue;
-      try {
-        if (isPresent(readFileSync(cf, 'utf-8'))) {
-          alreadyThere = true;
-          break;
-        }
-      } catch {
-        /* unreadable candidate — fall through to the write path */
-      }
-    }
-    if (alreadyThere) {
-      skipped.push(`sessionLog (${rel})`);
-    } else if (!existsSync(full)) {
-      // A daily shard is a new file most days. Seed minimal valid frontmatter
-      // (title + type, the two REQUIRED_FIELDS) so the shard is a first-class
-      // wiki page rather than a W1 "no frontmatter" warning, and write the header
-      // AND the first entry in ONE atomic write — never leave a header-only shard
-      // on disk, which freshness would skip (no dated heading) while derive could
-      // otherwise mistake it for the evidence file. The dated `## [date] ...`
-      // heading lives inside the entry, so freshness / derive / design-history
-      // are unchanged.
-      // Audit fields (device, session_id). The shard frontmatter is git-tracked and synced, so
-      // `device` is an INTENTIONAL synced multi-machine identifier (privacy note:
-      // docs/ARCHITECTURE.md). It is a CREATOR-only stamp — only the session/
-      // machine that first seeds the daily shard is recorded; later same-day
-      // appends do not touch it. The per-session-accurate store is the LOCAL
-      // (.cache/, gitignored) index.jsonl written by hypo-session-record.mjs.
-      // `session_id` is honest naming: the value is the Claude session UUID, and
-      // it is present only on the Stop-chain close path that passes --session-id.
-      const device = String(hostname() || 'unknown').replace(/[\r\n]/g, '');
-      const auditFm =
-        (args.sessionId ? `session_id: ${String(args.sessionId).replace(/[\r\n]/g, '')}\n` : '') +
-        `device: ${device}\n`;
-      const header =
-        `---\ntitle: Session Log ${date} (${project})\n` +
-        `type: session-log\nupdated: ${date}\n${auditFm}---\n\n` +
-        `# Session Log ${date} (${project})\n`;
-      const entry = payload.sessionLog.entry;
-      const body = entry.endsWith('\n') ? entry : `${entry}\n`;
-      atomicWrite(full, `${header}\n${body}`);
-      applied.push(`sessionLog (${rel})`);
-    } else {
-      const wrote = appendIfAbsent(full, payload.sessionLog.entry, isPresent);
-      (wrote ? applied : skipped).push(`sessionLog (${rel})`);
+    // Serialize dedup + create/append on the daily shard so two concurrent
+    // closes never lose an entry: the second closer takes the lock only after
+    // the first committed, re-reads the shard under the lock, and appends onto
+    // the committed bytes (temp+rename write-isolation is preserved — a partial
+    // write never tears the target). Create and append share ONE lock, so the
+    // "seed a new shard" and "append to an existing shard" branches can't race
+    // each other — only one closer is ever in the create path (closes the
+    // wx-window a bare exclusive-create would leave open).
+    try {
+      const outcome = withFileLock(
+        full,
+        () => {
+          // Fallback-aware idempotency (hybrid cutover): during the month the
+          // shard takes over, today's entry may already live in the legacy monthly
+          // file from an earlier (pre-cutover) close. Treat presence in EITHER the
+          // daily shard or the legacy monthly file as "already written" so a same-day
+          // second close does not duplicate an identical entry across both files —
+          // and so an idempotent re-apply stays a true no-op (no shard is created).
+          for (const cand of sessionLogReadCandidates(project, date)) {
+            const cf = join(args.hypoDir, cand);
+            if (!existsSync(cf)) continue;
+            try {
+              if (isPresent(readFileSync(cf, 'utf-8'))) return 'skipped';
+            } catch {
+              /* unreadable candidate — fall through to the write path */
+            }
+          }
+          if (!existsSync(full)) {
+            // A daily shard is a new file most days. Seed minimal valid frontmatter
+            // (title + type, the two REQUIRED_FIELDS) so the shard is a first-class
+            // wiki page rather than a W1 "no frontmatter" warning, and write the header
+            // AND the first entry in ONE atomic write — never leave a header-only shard
+            // on disk, which freshness would skip (no dated heading) while derive could
+            // otherwise mistake it for the evidence file. The dated `## [date] ...`
+            // heading lives inside the entry, so freshness / derive / design-history
+            // are unchanged.
+            // Audit fields (device, session_id). The shard frontmatter is git-tracked and synced, so
+            // `device` is an INTENTIONAL synced multi-machine identifier (privacy note:
+            // docs/ARCHITECTURE.md). It is a CREATOR-only stamp — only the session/
+            // machine that first seeds the daily shard is recorded; later same-day
+            // appends do not touch it. The per-session-accurate store is the LOCAL
+            // (.cache/, gitignored) index.jsonl written by hypo-session-record.mjs.
+            // `session_id` is honest naming: the value is the Claude session UUID, and
+            // it is present only on the Stop-chain close path that passes --session-id.
+            const device = currentDevice();
+            const auditFm =
+              (args.sessionId
+                ? `session_id: ${String(args.sessionId).replace(/[\r\n]/g, '')}\n`
+                : '') + `device: ${device}\n`;
+            const header =
+              `---\ntitle: Session Log ${date} (${project})\n` +
+              `type: session-log\nupdated: ${date}\n${auditFm}---\n\n` +
+              `# Session Log ${date} (${project})\n`;
+            const entry = payload.sessionLog.entry;
+            const body = entry.endsWith('\n') ? entry : `${entry}\n`;
+            atomicWrite(full, `${header}\n${body}`);
+            return 'created';
+          }
+          return appendIfAbsent(full, payload.sessionLog.entry, isPresent) ? 'appended' : 'skipped';
+        },
+        { timeoutMs: APPEND_LOCK_TIMEOUT_MS },
+      );
+      (outcome === 'skipped' ? skipped : applied).push(`sessionLog (${rel})`);
+    } catch (err) {
+      // Only a lock-TIMEOUT is withheld as a conflict. A real fn() write error
+      // (disk-full, EACCES, mkdir failure) must NOT be masked as a proposal-
+      // pending timeout — rethrow so it hard-fails like the overwrite path does.
+      if (err?.code !== 'ELOCKTIMEOUT') throw err;
+      // Lock-timeout: withhold rather than lose the entry. Recorded as a conflict
+      // so the close goes proposal-pending (ok:false, no marker) and the next
+      // close re-applies. `kind: 'append'` is what T6 branches on to SKIP parking
+      // this: an append conflict never becomes a `.cache/proposals/` artifact —
+      // the lock-timeout is transient and the next close self-heals by
+      // re-appending, whereas a whole-file re-apply would drop this shard's other
+      // entries. It still blocks the close; it just gets no artifact.
+      conflicts.push({
+        key: 'sessionLog',
+        target: rel,
+        reason: 'append-lock-timeout',
+        kind: 'append',
+        baseHash: null,
+        currentHash: null,
+        proposedContent: payload.sessionLog.entry,
+      });
     }
   }
 
@@ -1046,31 +1406,126 @@ function applySessionClose(args) {
   // append onto a deliberately custom payload.log (codex pre-commit review). The
   // two payload paths are mutually exclusive: deriving on top of a present-but-
   // malformed payload.log would mask it and weaken the verifier's fail-loud.
+  // log.md is shared across projects and also written by deriveRootLogEntries
+  // (the Stop-hook backfill in hypo-shared.mjs). Both take the SAME lock on
+  // log.md, so a concurrent close's append and this close's append serialize
+  // instead of overwriting each other.
+  const logFull = join(args.hypoDir, 'log.md');
   if (payload.log) {
-    const wrote = appendIfAbsent(
-      join(args.hypoDir, 'log.md'),
-      payload.log.entry,
-      entryAlreadyPresent(payload.log.entry),
-    );
-    (wrote ? applied : skipped).push('log (log.md)');
+    try {
+      const wrote = withFileLock(
+        logFull,
+        () => appendIfAbsent(logFull, payload.log.entry, entryAlreadyPresent(payload.log.entry)),
+        { timeoutMs: APPEND_LOCK_TIMEOUT_MS },
+      );
+      (wrote ? applied : skipped).push('log (log.md)');
+    } catch (err) {
+      if (err?.code !== 'ELOCKTIMEOUT') throw err;
+      // proposedContent is append-ready root-log bytes (the custom log line).
+      conflicts.push({
+        key: 'log',
+        target: 'log.md',
+        reason: 'append-lock-timeout',
+        kind: 'append',
+        baseHash: null,
+        currentHash: null,
+        proposedContent: payload.log.entry,
+      });
+    }
   } else {
     // matchAll (not exec) mirrors deriveRootLogEntries: a payload that carried
     // more than one dated heading derives one canonical line each, symmetric with
     // the global path. Exact-line dedup on the heading keeps a second apply (or a
     // titleless vs titled same-day pair) from duplicating.
-    const logFull = join(args.hypoDir, 'log.md');
     const headingRe = new RegExp(`^#{1,6} \\[${date}\\]\\s*(.*)$`, 'gm');
-    let wroteAny = false;
-    for (const m of (payload.sessionLog.entry || '').matchAll(headingRe)) {
-      const { heading, block } = rootLogEntry(project, date, m[1]);
-      const wrote = appendIfAbsent(logFull, block, (c) =>
-        (c || '').split(/\r?\n/).includes(heading),
+    try {
+      const wroteAny = withFileLock(
+        logFull,
+        () => {
+          let w = false;
+          for (const m of (payload.sessionLog.entry || '').matchAll(headingRe)) {
+            const { heading, block } = rootLogEntry(project, date, m[1]);
+            const wrote = appendIfAbsent(logFull, block, (c) =>
+              (c || '').split(/\r?\n/).includes(heading),
+            );
+            w = w || wrote;
+          }
+          return w;
+        },
+        { timeoutMs: APPEND_LOCK_TIMEOUT_MS },
       );
-      wroteAny = wroteAny || wrote;
+      (wroteAny ? applied : skipped).push('log (log.md, derived)');
+    } catch (err) {
+      if (err?.code !== 'ELOCKTIMEOUT') throw err;
+      // `derived: true` discriminates this from the payload.log conflict above:
+      // here proposedContent is the session-log entry to RE-DERIVE root-log lines
+      // from (via rootLogEntry over its dated headings), NOT append-ready bytes.
+      // Like every `kind: 'append'` conflict, this is NOT parked as an artifact —
+      // it blocks the close and the next close re-derives + re-appends. The derived
+      // shape only matters to the retry, never to T6's overwrite proposal store.
+      conflicts.push({
+        key: 'log',
+        target: 'log.md',
+        reason: 'append-lock-timeout',
+        kind: 'append',
+        derived: true,
+        baseHash: null,
+        currentHash: null,
+        proposedContent: payload.sessionLog.entry,
+      });
     }
-    (wroteAny ? applied : skipped).push('log (log.md, derived)');
   }
 
+  // T6: park drifted OVERWRITE targets as `.cache/proposals/` artifacts.
+  //
+  // Runs regardless of --json AND regardless of args.sessionId: writing the
+  // artifact is a SIDE EFFECT, not output, so it is conditioned on neither the
+  // report format nor a session context. (In practice an overwrite conflict only
+  // arises with a session id, so a session-less apply just finds no overwrite
+  // conflicts to park — but the loop is unconditional to match that contract.)
+  // Only overwrite conflicts (`kind !== 'append'`) become artifacts. An append
+  // conflict is a transient lock-timeout the NEXT close self-heals by
+  // re-appending; parking it as a whole-file artifact and later re-applying it
+  // (T7 replaces the whole target) would drop every OTHER entry in that
+  // append-only history file. Append conflicts still sit in `conflicts`, so the
+  // close still goes proposal-pending — they just get no artifact and no
+  // human-apply step.
+  const proposals = [];
+  const proposalStoreFailures = [];
+  const device = currentDevice();
+  for (const c of conflicts) {
+    if (c.kind === 'append') continue; // append conflicts are never parked (see above)
+    try {
+      const saved = writeProposal(args.hypoDir, {
+        target: c.target,
+        baseHash: c.baseHash,
+        currentAtProposalHash: c.currentHash,
+        proposedContent: c.proposedContent, // internal (pre-drop) full page bytes
+        sessionId: args.sessionId, // may be null; writeProposal coerces it
+        device,
+      });
+      proposals.push({ id: saved.id, target: saved.target, path: saved.path });
+      // Supersede-delete failure is NON-fatal: the new artifact IS parked, only
+      // a stale sibling lingers (superseded next close). Surface it, don't fail.
+      for (const w of saved.supersedeWarnings) {
+        process.stderr.write(`\n⚠️  ${w} (stale artifact left behind, not fatal)\n`);
+      }
+    } catch (err) {
+      // fail-loud: the target was withheld AND its bytes are now on neither disk
+      // NOR a proposal artifact — a genuine data-loss risk. Never swallow this.
+      const error = (err && err.message) || String(err);
+      proposalStoreFailures.push({ target: c.target, key: c.key, error });
+      process.stderr.write(
+        `\n🛑 PROPOSAL STORE FAILED for ${c.key} (${c.target}): ${error}\n` +
+          `    This close WITHHELD the target (it drifted from your observed base) but\n` +
+          `    could NOT write the .cache/proposals/ artifact either. The payload bytes\n` +
+          `    are on NEITHER disk NOR a proposal — re-run the close once the .cache/\n` +
+          `    directory is writable so the withheld content is not lost.\n`,
+      );
+    }
+  }
+  const proposalStoreFailed = proposalStoreFailures.length > 0;
+
   // Same-date-tie fix: verify against the SAME project this apply just wrote
   // (`project` = payload.project || probe.project, resolved at the top). Without
   // the override, sessionCloseFileStatus re-derives via resolveActiveProject and,
@@ -1099,7 +1554,16 @@ function applySessionClose(args) {
     const m = unknownTagRe.exec(w.message || '');
     if (m && !checkForbidden(m[1])) pendingTags.push(m[1]);
   }
-  if (pendingTags.length > 0) appendPendingTags(args.hypoDir, pendingTags);
+  // Withheld a target? Then register nothing. This close is going to be re-run
+  // once a human resolves the conflict, and its `ok:false` skips the commit below
+  // (`if (ok && args.sessionId)`) — so registering here would leave SCHEMA.md
+  // mutated, uncommitted, and absent from `applied`, i.e. a silent side effect of
+  // a close whose whole point was to write nothing. Registration is
+  // eventually-consistent by design, so deferring it to the next close costs
+  // nothing (codex W2 CONCERN).
+  if (pendingTags.length > 0 && conflicts.length === 0) {
+    appendPendingTags(args.hypoDir, pendingTags);
+  }
 
   // Post-apply lint: payload may have introduced a malformed body or
   // bad frontmatter. Surface as a distinct `stage` so caller can tell "lint
@@ -1138,7 +1602,12 @@ function applySessionClose(args) {
   const postLintOk = !postApplyCrashed && postBlocking.length === 0;
   // `let` (not const): the close-result invariant self-check below may flip this
   // to false when the settled close result is internally contradictory.
-  let ok = verification.ok && postLintOk;
+  //
+  // A withheld conflict target must fail the close on its own, not merely via the
+  // freshness gate. If the other session already touched that page TODAY, freshness
+  // sees a fresh file and passes — and the close would report ok:true, write the
+  // marker, and drop this session's payload silently. `conflicts` closes that hole.
+  let ok = verification.ok && postLintOk && conflicts.length === 0;
 
   // Scope the non-blocking notice to the close-target project: debt under
   // projects/<project>/ stays listed; debt elsewhere folds to a count so the
@@ -1182,10 +1651,15 @@ function applySessionClose(args) {
     let gateOk = false;
     if (commitOutcome.committed) {
       closeTranscript = resolveTranscriptBySessionId(args.sessionId);
-      gateOk = precompactGateStatus(
-        args.hypoDir,
-        closeTranscript ? { transcriptPath: closeTranscript } : {},
-      ).ok;
+      // closeScope: apply KNOWS which project it just closed, and it wrote
+      // that project's files from inside this process — they never appear in the
+      // transcript as Edit/Write, so `payload.project` is the only signal that puts
+      // this close in scope. Without it, apply's own incomplete close could be demoted
+      // to a foreign-debt notice and marked green.
+      gateOk = precompactGateStatus(args.hypoDir, {
+        closeScope: [project],
+        ...(closeTranscript ? { transcriptPath: closeTranscript } : {}),
+      }).ok;
     }
     const decision = planMarkerDecision({
       ok,
@@ -1200,7 +1674,9 @@ function applySessionClose(args) {
     });
     markerSkipReason = decision.skipReason;
     if (decision.write) {
-      writeSessionClosedMarker(args.hypoDir, args.sessionId, { project });
+      // apply KNOWS its authoritative payload.project — stamp it as the v4
+      // evidence set so PreCompact trusts this marker's scope directly (session-close attribution).
+      writeSessionClosedMarker(args.hypoDir, args.sessionId, { project, projects: [project] });
       // Codex CONCERN: the writer swallows IO errors (best-effort).
       // Verify the file actually landed — mirroring the standalone path — instead of
       // asserting markerWritten=true, so a .cache permission/disk problem surfaces
@@ -1212,13 +1688,21 @@ function applySessionClose(args) {
       }
     }
   }
+  // A conflict outranks the downstream gates: verification and lint both describe
+  // a tree this apply declined to finish writing, so naming them would point the
+  // reader at the wrong repair. A proposal-STORE failure outranks even that: the
+  // withheld bytes never reached an artifact, so it is the most urgent repair.
   let stage = ok
     ? null
-    : !verification.ok && !postLintOk
-      ? 'post-apply-verification+lint'
-      : !verification.ok
-        ? 'post-apply-verification'
-        : 'post-apply-lint';
+    : proposalStoreFailed
+      ? 'proposal-store-failed'
+      : conflicts.length > 0
+        ? 'proposal-pending'
+        : !verification.ok && !postLintOk
+          ? 'post-apply-verification+lint'
+          : !verification.ok
+            ? 'post-apply-verification'
+            : 'post-apply-lint';
   // Runtime close-result invariant self-check. When a
   // marker-write path (args.sessionId present) settles into an internally
   // contradictory shape — ok:true with the marker silently withheld and no
@@ -1249,6 +1733,29 @@ function applySessionClose(args) {
     date,
     applied,
     skipped,
+    // Targets withheld: an overwrite drifted from this session's observed base, or
+    // an append could not take the file lock in time (`kind: 'append'`). Two
+    // channels resolve these, and `proposals` vs `conflicts[].kind` are the sole
+    // discriminators: an OVERWRITE conflict is parked as a `.cache/proposals/`
+    // artifact (below) for a human to review and re-apply; an APPEND conflict gets
+    // NO artifact and is re-tried automatically by the next close. `proposedContent`
+    // is dropped from the reported shape either way (the artifact / the next close
+    // holds the bytes; a whole page or an append entry does not belong in the JSON).
+    conflicts: conflicts.map(({ proposedContent: _drop, ...rest }) => rest),
+    // Parked overwrite proposals (id/target/path), one per drifted overwrite
+    // target. Empty when only append conflicts (or none) occurred. The T7 CLI
+    // lists and applies these; append conflicts never appear here.
+    proposals,
+    ...(proposalStoreFailed ? { proposalStoreFailures } : {}),
+    // Partial close: some overwrite direct-writes (and/or appends) already landed
+    // on disk while at least one conflict withheld the rest. Because the close is
+    // ok:false, commitWikiChanges + the marker are skipped — so those written
+    // files sit on disk UNCOMMITTED until the conflict is resolved and the close
+    // re-runs. Named honestly: `appliedUncommitted` covers every write that landed
+    // (overwrite or append), not overwrites alone.
+    ...(applied.length > 0 && conflicts.length > 0
+      ? { partialConflict: true, appliedUncommitted: [...applied] }
+      : {}),
     verification,
     // Surface the marker outcome instead of skipping silently, so the
     // caller can tell "closed" from "applied but not marked".
@@ -1274,6 +1781,29 @@ function applySessionClose(args) {
     console.log(`Session-close apply (project: ${project}, date: ${date}):`);
     for (const a of applied) console.log(`  ✓ wrote ${a}`);
     for (const s of skipped) console.log(`  · skipped ${s} (already current)`);
+    // Never let a withheld target read as a skip: `skipped` means "already current",
+    // this means "your bytes are NOT on disk". Overwrite conflicts drifted from base;
+    // an append conflict is a lock-timeout (someone else held the file's lock), which
+    // is transient — the next close re-applies.
+    for (const c of conflicts) {
+      const why =
+        c.kind === 'append'
+          ? 'could not acquire the append lock in time; the next close re-applies'
+          : 'the page changed since this session read it';
+      console.log(`  ⚠ WITHHELD ${c.key} (${c.target}) — ${c.reason}; ${why}`);
+    }
+    for (const p of proposals) {
+      console.log(
+        `  · parked proposal ${p.id} for ${p.target} (review with \`hypomnema proposal\`)`,
+      );
+    }
+    if (applied.length > 0 && conflicts.length > 0) {
+      console.log(
+        '\n· partial close: the writes above ARE on disk but NOT committed — this close is\n' +
+          '  ok:false, so no commit and no session-close marker run until the withheld\n' +
+          '  target(s) are resolved and the close re-runs.',
+      );
+    }
     if (ok) {
       // When the marker was withheld, qualify the success line so a reader scanning
       // stdout alone cannot mistake "verified" for "fully closed". markerSkipReason
@@ -1430,6 +1960,7 @@ function main() {
     } catch {
       continue;
     }
+    if (!scopeVisible(readVisibilityScope(content), currentDevice())) continue;
     const fm = parseFrontmatter(content);
     if (!fm) continue;