hypomnema 1.7.1 → 1.7.3

package/hooks/hypo-shared.mjs

@@ -24,7 +24,7 @@ import {
 import { join, relative, basename, dirname, isAbsolute } from 'path';
 import { homedir, hostname, tmpdir } from 'os';
 import { spawnSync } from 'child_process';
-import { randomBytes } from 'crypto';
+import { randomBytes, createHash } from 'crypto';
 import { fileURLToPath } from 'url';
 
 const HOME = homedir();
@@ -149,7 +149,14 @@ function readCachedPkgRoot() {
 // Hypomnema — e.g. `$HOME/package.json` from an unrelated project. This
 // contract answers "is this a real, resolvable directory", not "is this OUR
 // package". Callers that need the latter also require self-containment.
-function isUsablePkgRootLocal(pkgRoot) {
+//
+// Exported so scripts/doctor.mjs can apply the SAME predicate to a sidecar's
+// recorded pkgRoot that readVerifiedProvenancePkgRoot() below applies at
+// runtime — doctor used to hand-roll a thinner name+hash check that a
+// version-less "name":"hypomnema" root would pass while the runtime resolver
+// rejects it, so doctor could PASS a sidecar the runtime treats as null. The
+// import direction stays scripts/ → hooks/, never the reverse.
+export function isUsablePkgRootLocal(pkgRoot) {
   if (typeof pkgRoot !== 'string' || !pkgRoot || !isAbsolute(pkgRoot)) return false;
   try {
     const v = JSON.parse(readFileSync(join(pkgRoot, 'package.json'), 'utf-8')).version;
@@ -205,16 +212,25 @@ function candidateContainsRunningModule(candidateRoot, ownRealPath) {
 // candidateContainsRunningModule rejects it: that ancestor's own hooks/
 // subdirectory (if it even has one) is not this file.
 //
-// Bounded walk: up to 6 candidate ancestors above hooks/'s own parent (the
+// Bounded walk: up to 6 candidate ancestors above hooksDir's own parent (the
 // ordinary root sits at the very first one; a few extra levels tolerate an
 // unusual nesting depth). Never throws, fails open to null on any error.
-function selfLocationPkgRoot() {
-  let hooksDir, ownRealPath;
+//
+// Split out from selfLocationPkgRoot() (below) so scripts/doctor.mjs can ask
+// the same question about an ARBITRARY installed hooks directory
+// (~/.claude/hooks, ~/.codex/hooks) instead of only about wherever THIS
+// running module happens to live. doctor needs that to tell "self-location
+// genuinely can't resolve for this install" (the standalone-copy steady
+// state, silence is correct) apart from "self-location would resolve but the
+// provenance sidecar is missing/broken" (a real gap — see CONCERN 4's
+// PKG_ROOT-null-and-silent fix in checkProvenanceSidecar). Exported;
+// scripts/ → hooks/ stays the only allowed import direction.
+export function selfLocationPkgRootFrom(hooksDir) {
+  let ownRealPath;
   try {
-    hooksDir = dirname(fileURLToPath(import.meta.url));
     ownRealPath = realpathSync(join(hooksDir, 'hypo-shared.mjs'));
   } catch {
-    return null; // can't even resolve our own path — nothing to self-contain against
+    return null; // can't even resolve the module at hooksDir — nothing to self-contain against
   }
   try {
     let dir = dirname(hooksDir); // first candidate: the ordinary root, one level above hooks/
@@ -232,16 +248,93 @@ function selfLocationPkgRoot() {
   }
 }
 
+function selfLocationPkgRoot() {
+  let hooksDir;
+  try {
+    hooksDir = dirname(fileURLToPath(import.meta.url));
+  } catch {
+    return null; // can't even resolve our own path
+  }
+  return selfLocationPkgRootFrom(hooksDir);
+}
+
+// Copy-time provenance sidecar (`.hypo-provenance.json`, written next to a
+// standalone-copied hooks/ dir by installHooks/applyHookFiles — see
+// scripts/lib/pkg-provenance.mjs, the writer half of this contract) is the
+// ONLY fallback resolvePkgRoot() gets when self-location can't resolve. The
+// filename and the "hypomnema" name check below must stay byte-identical
+// with scripts/lib/pkg-provenance.mjs — hooks can't import scripts/ (no
+// reaching outside hooks/), so the contract is duplicated, not shared.
+//
+// This is accidental-staleness protection, not a security boundary: any
+// process running as this OS user can edit this JSON file (or hypo-shared.mjs
+// itself) freely. It only catches what installHooks/applyHookFiles left
+// unguarded before this fix — a manual-install hooks/ copy left pointing at
+// an old pkgVersion because a skip-then-refresh-the-cache-anyway sequence
+// (init re-run against an unchanged hooks/ dir) recorded a version the copy
+// on disk never actually became.
+//
+// Producer proof, BOTH required before this pkgRoot is trusted:
+//   - the recorded pkgRoot's package.json "name" must be "hypomnema" (not
+//     merely "some usable versioned package.json" — isUsablePkgRootLocal
+//     alone would accept $HOME/package.json from an unrelated project)
+//   - the recorded hypoSharedSha256 must match the SHA-256 of THIS running
+//     hypo-shared.mjs file — ties the sidecar to the exact copy it was
+//     written next to, so a sidecar surviving a partial re-install (new
+//     hooks/*.mjs dropped in, old sidecar left behind) is rejected rather
+//     than silently trusted.
+//
+// Scope, stated honestly: hypoSharedSha256 pins ONE file — this file. A
+// sidecar surviving a re-install that touched some OTHER hook (e.g.
+// hypo-personal-check.mjs got a new version, hypo-shared.mjs itself didn't
+// change a byte) still passes this check and PKG_ROOT still resolves,
+// because the running module — the one thing this function can verify
+// without cost — never changed. Catching that wider drift needs hashing
+// every file hooks.json wires up, which is too expensive to do on every
+// hook load (this function runs on every single hook invocation); that
+// broader, once-per-`doctor`-run check is `hooksDigest`
+// (scripts/lib/pkg-provenance.mjs's computeHooksDigest, verified by
+// scripts/doctor.mjs), deliberately NOT read here.
+const PROVENANCE_FILENAME = '.hypo-provenance.json';
+const EXPECTED_PKG_NAME = 'hypomnema';
+
+function readVerifiedProvenancePkgRoot(hooksDir) {
+  try {
+    const raw = JSON.parse(readFileSync(join(hooksDir, PROVENANCE_FILENAME), 'utf-8'));
+    const { pkgRoot, hypoSharedSha256 } = raw || {};
+    if (!isUsablePkgRootLocal(pkgRoot)) return null;
+    const producerPkgJson = JSON.parse(readFileSync(join(pkgRoot, 'package.json'), 'utf-8'));
+    if (producerPkgJson.name !== EXPECTED_PKG_NAME) return null;
+    if (typeof hypoSharedSha256 !== 'string' || !hypoSharedSha256) return null;
+    const ownHash = createHash('sha256')
+      .update(readFileSync(join(hooksDir, 'hypo-shared.mjs')))
+      .digest('hex');
+    if (ownHash !== hypoSharedSha256) return null;
+    return pkgRoot;
+  } catch {
+    return null;
+  }
+}
+
 // Resolution order: self-location wins whenever it resolves — it is a direct,
 // self-containment-verified fact about the code currently running, not an
 // inference. Only when it cannot resolve (the standalone-copied hooks case
-// above, or a genuine read failure) does the cache get to answer, and only
-// after passing the same usable-root contract as everything else here.
+// above, or a genuine read failure) does the verified provenance sidecar get
+// to answer, checked against the same directory this module is actually
+// running from. The cache (readCachedPkgRoot/hypo-pkg.json) is deliberately
+// NOT a resolution fallback here — a disagreeing provenance sidecar means
+// "stop", not "ask the cache", because the cache is exactly what can be
+// stale (that staleness is this fix's whole premise). readCachedPkgRoot stays
+// in this file only for pkgRootDriftStatus()'s surfacing comparison below.
 function resolvePkgRoot() {
   const self = selfLocationPkgRoot();
   if (self) return self;
-  const cached = readCachedPkgRoot();
-  return isUsablePkgRootLocal(cached) ? cached : null;
+  try {
+    const hooksDir = dirname(fileURLToPath(import.meta.url));
+    return readVerifiedProvenancePkgRoot(hooksDir);
+  } catch {
+    return null;
+  }
 }
 export const PKG_ROOT = resolvePkgRoot();
 
@@ -352,6 +445,72 @@ export function hypoIsClean(dir = HYPO_DIR) {
   }
 }
 
+/**
+ * Repo-relative POSIX paths with uncommitted changes (tracked or untracked) in
+ * `dir`. Reuses the SAME `-z` rename-aware porcelain parsing as
+ * commitWikiChanges (PR #222): a rename or copy emits `to\0from`, and both
+ * sides count as dirty (a rename's source still shows staged until the rename
+ * itself lands). This is the read-only half of that fix's pathspec boundary:
+ * commitWikiChanges narrows what gets COMMITTED to a caller-supplied scope;
+ * this narrows what counts as a BLOCKER the same way, for precompactGateStatus
+ * to attribute dirty files to the session that owns them instead of the whole
+ * shared working tree.
+ *
+ * Paths are normalized to be relative to `dir` itself, NOT to the git
+ * repository's top level: `git -C <dir> status --porcelain` prints paths
+ * relative to the repo TOP LEVEL even under `-C` (verified empirically: a
+ * vault nested under `<repo>/vault/` reports `vault/hot.md`, not `hot.md`).
+ * Every other path this file compares against (closeAccountableScope,
+ * closeFileTargetsGlobal, extractTouchedWikiFiles) is `dir`-relative, so
+ * without this normalization a nested vault's OWN files would never match
+ * its own scope and every one of them would look foreign (codex pre-commit
+ * review BLOCKER 2). `git rev-parse --show-prefix` gives exactly the prefix
+ * to strip; a dirty path that does not start with it lives outside the
+ * vault entirely (the rest of a bigger host repo) and is dropped, never
+ * "mine".
+ *
+ * @returns {string[]} dirty paths relative to `dir`, or `[]` on any git
+ *   failure (the caller already has its own git-status result via
+ *   hypoIsClean and treats that failure as an unconditional blocker; an
+ *   empty return here just means "cannot attribute", not "clean").
+ */
+function gitDirtyFiles(dir) {
+  const prefixRes = spawnSync('git', ['-C', dir, 'rev-parse', '--show-prefix'], {
+    encoding: 'utf-8',
+  });
+  if (prefixRes.status !== 0) return []; // can't resolve the repo → cannot attribute
+  const prefix = (prefixRes.stdout || '').trim();
+
+  const porcelain = spawnSync('git', ['-C', dir, 'status', '--porcelain', '-uall', '-z'], {
+    encoding: 'utf-8',
+  });
+  if (porcelain.status !== 0) return [];
+  const out = [];
+  const records = (porcelain.stdout || '').split('\0');
+  const toDirRelative = (f) => {
+    if (!f) return null;
+    if (!prefix) return f; // dir IS the repo top level, nothing to strip
+    return f.startsWith(prefix) ? f.slice(prefix.length) : null; // outside the vault
+  };
+  for (let i = 0; i < records.length; i++) {
+    const rec = records[i];
+    if (!rec) continue;
+    const xy = rec.slice(0, 2);
+    const file = rec.slice(3); // destination path for a rename/copy
+    const isRenameOrCopy = xy[0] === 'R' || xy[1] === 'R' || xy[0] === 'C' || xy[1] === 'C';
+    let fromFile = null;
+    if (isRenameOrCopy) {
+      i++;
+      fromFile = records[i] || null;
+    }
+    const rel = toDirRelative(file);
+    if (rel) out.push(rel);
+    const relFrom = toDirRelative(fromFile);
+    if (relFrom) out.push(relFrom);
+  }
+  return out;
+}
+
 export function hotMdIsClean(dir = HYPO_DIR) {
   const hotPath = dir === HYPO_DIR ? HOT_PATH : join(dir, 'hot.md');
   if (!existsSync(hotPath)) return { clean: true };
@@ -709,7 +868,10 @@ function gitIgnoresPageUsageCached(hypoDir, sessionId, probeFn = runGitCheckIgno
   if (!probe || (probe.status !== 0 && probe.status !== 1)) {
     if (scoped) {
       try {
-        writeFileSync(cachePath, JSON.stringify({ unavailableUntil: Date.now() + PROBE_BACKOFF_MS }));
+        writeFileSync(
+          cachePath,
+          JSON.stringify({ unavailableUntil: Date.now() + PROBE_BACKOFF_MS }),
+        );
       } catch {
         // non-fatal; the probe just runs again next prompt
       }
@@ -1628,89 +1790,89 @@ export function withFileLock(targetPath, fn, opts = {}) {
   let loggedLiveHolder = false;
   let loggedSteal = false;
   try {
-  for (;;) {
-    try {
-      if (!staged) {
+    for (;;) {
+      try {
+        if (!staged) {
+          try {
+            writeFileSync(tmpPath, String(process.pid), { flag: 'wx' });
+            staged = true;
+          } catch (stageErr) {
+            // Staging fails for the same reason acquisition does — an unwritable
+            // directory — and `openSync(lock,'wx')` used to report exactly that as
+            // EEXIST whenever a lock was already sitting there, sending it down the
+            // contention path. Preserve that: contend if a lock exists, and surface
+            // a genuine write failure otherwise rather than masking it as a timeout.
+            if (!existsSync(lockPath)) throw stageErr;
+            throw Object.assign(new Error('lock-contended'), { code: 'EEXIST' });
+          }
+        }
+        // Kept separate from staging on purpose: EPERM/EMLINK from the link are
+        // real failures, not contention, and must not decay into ELOCKTIMEOUT.
+        linkSync(tmpPath, lockPath);
+        break;
+      } catch (err) {
+        if (err.code !== 'EEXIST') throw err;
+        // Held by another writer. Steal ONLY a demonstrably stale lock; otherwise
+        // wait and eventually time out. The stat and the unlink are handled
+        // separately on purpose: an un-removable stale lock (EACCES/EPERM/EBUSY)
+        // and a fresh lock must both fall through to the timeout check — never
+        // `continue` past it, or an un-unlinkable lock spins forever and violates
+        // the timeoutMs → ELOCKTIMEOUT contract (caller falls to the proposal gate).
+        let stale = false;
         try {
-          writeFileSync(tmpPath, String(process.pid), { flag: 'wx' });
-          staged = true;
-        } catch (stageErr) {
-          // Staging fails for the same reason acquisition does — an unwritable
-          // directory — and `openSync(lock,'wx')` used to report exactly that as
-          // EEXIST whenever a lock was already sitting there, sending it down the
-          // contention path. Preserve that: contend if a lock exists, and surface
-          // a genuine write failure otherwise rather than masking it as a timeout.
-          if (!existsSync(lockPath)) throw stageErr;
-          throw Object.assign(new Error('lock-contended'), { code: 'EEXIST' });
+          // Steal-eligible by age alone; liveness is checked separately below
+          // before we actually act on it.
+          stale = Date.now() - statSync(lockPath).mtimeMs > staleMs;
+        } catch (statErr) {
+          if (statErr.code === 'ENOENT') continue; // lock vanished; retry create now
+          throw statErr; // unexpected stat failure — surface it, don't mask
         }
-      }
-      // Kept separate from staging on purpose: EPERM/EMLINK from the link are
-      // real failures, not contention, and must not decay into ELOCKTIMEOUT.
-      linkSync(tmpPath, lockPath);
-      break;
-    } catch (err) {
-      if (err.code !== 'EEXIST') throw err;
-      // Held by another writer. Steal ONLY a demonstrably stale lock; otherwise
-      // wait and eventually time out. The stat and the unlink are handled
-      // separately on purpose: an un-removable stale lock (EACCES/EPERM/EBUSY)
-      // and a fresh lock must both fall through to the timeout check — never
-      // `continue` past it, or an un-unlinkable lock spins forever and violates
-      // the timeoutMs → ELOCKTIMEOUT contract (caller falls to the proposal gate).
-      let stale = false;
-      try {
-        // Steal-eligible by age alone; liveness is checked separately below
-        // before we actually act on it.
-        stale = Date.now() - statSync(lockPath).mtimeMs > staleMs;
-      } catch (statErr) {
-        if (statErr.code === 'ENOENT') continue; // lock vanished; retry create now
-        throw statErr; // unexpected stat failure — surface it, don't mask
-      }
-      if (stale) {
-        const holderPid = readLockHolderPid(lockPath);
-        if (holderPid !== null && isPidAlive(holderPid)) {
-          // LIVE holder preempted past staleMs: do NOT steal. Surface it so the
-          // preemption is visible, then fall through to the poll/timeout path
-          // below instead of racing a second writer into the critical section.
-          if (!loggedLiveHolder) {
+        if (stale) {
+          const holderPid = readLockHolderPid(lockPath);
+          if (holderPid !== null && isPidAlive(holderPid)) {
+            // LIVE holder preempted past staleMs: do NOT steal. Surface it so the
+            // preemption is visible, then fall through to the poll/timeout path
+            // below instead of racing a second writer into the critical section.
+            if (!loggedLiveHolder) {
+              console.error(
+                `[hypomnema] withFileLock: NOT stealing ${lockPath} — holder pid ${holderPid} is still alive past staleMs=${staleMs}`,
+              );
+              loggedLiveHolder = true;
+            }
+            stale = false;
+          } else if (!loggedSteal) {
+            // Also once per acquire: an un-removable stale lock re-enters this
+            // branch on every poll, and the steal is one event either way.
             console.error(
-              `[hypomnema] withFileLock: NOT stealing ${lockPath} — holder pid ${holderPid} is still alive past staleMs=${staleMs}`,
+              `[hypomnema] withFileLock: stealing stale lock ${lockPath}` +
+                (holderPid !== null
+                  ? ` (holder pid ${holderPid} is no longer running)`
+                  : ' (no readable holder pid — pre-liveness lockfile)'),
             );
-            loggedLiveHolder = true;
+            loggedSteal = true;
           }
-          stale = false;
-        } else if (!loggedSteal) {
-          // Also once per acquire: an un-removable stale lock re-enters this
-          // branch on every poll, and the steal is one event either way.
-          console.error(
-            `[hypomnema] withFileLock: stealing stale lock ${lockPath}` +
-              (holderPid !== null
-                ? ` (holder pid ${holderPid} is no longer running)`
-                : ' (no readable holder pid — pre-liveness lockfile)'),
-          );
-          loggedSteal = true;
         }
-      }
-      if (stale) {
-        try {
-          unlinkSync(lockPath);
-          continue; // stole it; retry the create immediately
-        } catch (unlinkErr) {
-          if (unlinkErr.code === 'ENOENT') continue; // another stealer won; retry
-          // Cannot remove it: do NOT spin — fall through to timeout/sleep so
-          // acquisition eventually throws ELOCKTIMEOUT instead of hanging.
+        if (stale) {
+          try {
+            unlinkSync(lockPath);
+            continue; // stole it; retry the create immediately
+          } catch (unlinkErr) {
+            if (unlinkErr.code === 'ENOENT') continue; // another stealer won; retry
+            // Cannot remove it: do NOT spin — fall through to timeout/sleep so
+            // acquisition eventually throws ELOCKTIMEOUT instead of hanging.
+          }
         }
+        if (Date.now() - start > timeoutMs) {
+          // Tagged so callers can distinguish "could not get the lock" (fall to the
+          // proposal gate) from a real fn() write error (mkdir/openSync/disk-full),
+          // which must NOT be masked as a timeout.
+          const e = new Error(`lock-timeout: ${lockPath}`);
+          e.code = 'ELOCKTIMEOUT';
+          throw e;
+        }
+        sleepSync(pollMs);
       }
-      if (Date.now() - start > timeoutMs) {
-        // Tagged so callers can distinguish "could not get the lock" (fall to the
-        // proposal gate) from a real fn() write error (mkdir/openSync/disk-full),
-        // which must NOT be masked as a timeout.
-        const e = new Error(`lock-timeout: ${lockPath}`);
-        e.code = 'ELOCKTIMEOUT';
-        throw e;
-      }
-      sleepSync(pollMs);
     }
-  }
   } finally {
     // The sibling is only ever a staging file: once linked, the lock IS the
     // link, and on every failure path it must not survive as litter.
@@ -3185,22 +3347,32 @@ function toHypoRel(absPath, hypoDir) {
 }
 
 /**
- * Repo-relative POSIX paths of wiki files this session edited via direct
- * Edit/Write/MultiEdit/NotebookEdit tool_use. Returns a Set; empty when the
- * transcript is missing/unreadable (callers decide the fallback). A per-line
- * JSON parse error skips that line only (transcripts occasionally truncate).
+ * Same walk as extractTouchedWikiFiles, but also reports whether the walk can
+ * be TRUSTED as a complete enumeration: `trusted: false` when the transcript
+ * is missing, unreadable, or contains a line that failed to parse (transcripts
+ * occasionally truncate mid-write). `extractTouchedWikiFiles` collapses all of
+ * that to an empty/partial Set, indistinguishable from "this session touched
+ * nothing", which is fine for lint's existing debt-partition (a false notice is not a
+ * false pass), but NOT fine for an attribution-sensitive caller like
+ * precompactGateStatus's git-scope check: treating an untrustworthy empty Set
+ * as "nothing to widen" would let a session's own dirty file, invisible only
+ * because its transcript could not be read, pass as someone else's foreign
+ * debt (codex pre-commit review BLOCKER 1).
+ *
+ * @returns {{files: Set<string>, trusted: boolean}}
  */
-export function extractTouchedWikiFiles(transcriptPath, hypoDir) {
+export function extractTouchedWikiFilesWithTrust(transcriptPath, hypoDir) {
   const out = new Set();
   if (!transcriptPath || typeof transcriptPath !== 'string' || !existsSync(transcriptPath)) {
-    return out;
+    return { files: out, trusted: false };
   }
   let raw;
   try {
     raw = readFileSync(transcriptPath, 'utf-8');
   } catch {
-    return out;
+    return { files: out, trusted: false };
   }
+  let trusted = true;
   for (const line of raw.split('\n')) {
     const t = line.trim();
     if (!t) continue;
@@ -3208,6 +3380,7 @@ export function extractTouchedWikiFiles(transcriptPath, hypoDir) {
     try {
       entry = JSON.parse(t);
     } catch {
+      trusted = false; // a truncated/corrupt line: the walk may be incomplete
       continue;
     }
     for (const fp of extractTranscriptToolFilePaths(entry)) {
@@ -3215,7 +3388,19 @@ export function extractTouchedWikiFiles(transcriptPath, hypoDir) {
       if (rel) out.add(rel);
     }
   }
-  return out;
+  return { files: out, trusted };
+}
+
+/**
+ * Repo-relative POSIX paths of wiki files this session edited via direct
+ * Edit/Write/MultiEdit/NotebookEdit tool_use. Returns a Set; empty when the
+ * transcript is missing/unreadable (callers decide the fallback). A per-line
+ * JSON parse error skips that line only (transcripts occasionally truncate).
+ * A caller that needs to tell "genuinely empty" apart from "could not fully
+ * enumerate" wants extractTouchedWikiFilesWithTrust instead.
+ */
+export function extractTouchedWikiFiles(transcriptPath, hypoDir) {
+  return extractTouchedWikiFilesWithTrust(transcriptPath, hypoDir).files;
 }
 
 /**
@@ -3443,20 +3628,89 @@ export function precompactGateStatus(hypoDir, opts = {}) {
   const marker = opts.sessionId ? readSessionClosedMarker(hypoDir, opts.sessionId) : null;
   const logOnly = opts.logOnly === true || marker?.scope === 'log-only';
 
-  // 1. wiki git state. Uncommitted changes (real unsaved work) BLOCK:
-  //    they are human-fixable. Unpushed commits (ahead) DEMOTE to a notice: push is
+  // Paths this session is accountable for at THIS close: the same signals the
+  // lint partition below already trusts for exactly this question ("is this
+  // file mine or pre-existing debt"), hoisted so the git check (step 1) can
+  // partition on it too. Base = the mandatory close-target files (opts.lintScope
+  // override, else the log-only shared root files, else one project's close
+  // files under projectOverride, else every today-active project's); widened by
+  // every file this session's transcript shows it editing directly.
+  const closeAccountableScope = new Set(
+    opts.lintScope ||
+      (logOnly
+        ? ['hot.md', 'log.md']
+        : opts.projectOverride
+          ? closeFileTargetsForProject(hypoDir, opts.projectOverride)
+          : closeFileTargetsGlobal(hypoDir)),
+  );
+  // Trust signal for the git-scope check below (codex pre-commit review
+  // BLOCKER 1): closeAccountableScope's mandatory-files base is always
+  // reliable, but the transcript widening that catches an ad hoc page this
+  // session edited is only as good as the transcript. No opts.transcriptPath
+  // at all, an unreadable file, or a line that fails to parse all mean the
+  // widened scope may be under-inclusive, NOT that this session touched
+  // nothing extra. Only a fully-read, fully-parsed transcript earns
+  // sessionTouchTrusted:true. A single tool_use with no file_path does NOT
+  // lower trust: most tool_use blocks (Read, Bash, Grep, ...) never carry one
+  // and that is expected, not corruption, so treating it as untrustworthy
+  // would make almost every real transcript untrusted and defeat the scoping
+  // this fix exists to add.
+  let sessionTouchTrusted = false;
+  if (opts.transcriptPath) {
+    const widened = extractTouchedWikiFilesWithTrust(opts.transcriptPath, hypoDir);
+    sessionTouchTrusted = widened.trusted;
+    for (const f of widened.files) closeAccountableScope.add(f);
+  }
+
+  // 1. wiki git state. Uncommitted changes (real unsaved work) BLOCK, but only
+  //    the ones inside closeAccountableScope, and only when sessionTouchTrusted
+  //    (above) says that scope can actually be trusted: a session's own scoped
+  //    auto-commit (commitWikiChanges, PR #222) can leave the working tree
+  //    non-empty when a DIFFERENT session sharing this vault still has its own
+  //    file dirty, the 2026-08-03 multi-session block. That dirty file is
+  //    human-fixable by whoever owns it, not by this session, so it demotes to
+  //    a notice (listed by path, never silently dropped) instead of refusing
+  //    this session's marker. A dirty file THIS session owns still blocks
+  //    unconditionally (fail-closed is unchanged for scope this session
+  //    actually touched), and so does an unattributable state: a git failure
+  //    gitDirtyFiles can't enumerate (dirty.length === 0 despite
+  //    git.uncommitted === true), OR a scope we cannot trust
+  //    (!sessionTouchTrusted) both fall back to the original unscoped blocker:
+  //    "cannot attribute" is not "clean".
+  //    Unpushed commits (ahead) DEMOTE to a notice regardless of scope: push is
   //    automatic (auto-commit Stop hook) and its failures are already non-fatal, so
   //    "ahead" is a transient sync state, not a human-fixable blocker. Demoting it
   //    here (the shared gate) keeps the marker == compact-ready invariant:
   //    a committed-but-unpushed close marks AND compacts, instead of the close writer
   //    committing its own payload and then being blocked by its own (unpushed) commit.
   const git = hypoIsClean(hypoDir);
-  if (git.uncommitted) blockers.push({ type: 'git', reason: git.reason });
-  else if (git.ahead)
+  if (git.uncommitted) {
+    const dirty = gitDirtyFiles(hypoDir);
+    if (dirty.length === 0 || !sessionTouchTrusted) {
+      blockers.push({ type: 'git', reason: git.reason });
+    } else {
+      const mine = dirty.filter((f) => closeAccountableScope.has(posixPath(f)));
+      const foreign = dirty.filter((f) => !closeAccountableScope.has(posixPath(f)));
+      if (mine.length > 0) {
+        blockers.push({
+          type: 'git',
+          reason: `uncommitted changes in ${hypoDir}: ${mine.join(', ')}`,
+        });
+      }
+      for (const f of foreign) {
+        notices.push({
+          type: 'git',
+          file: f,
+          reason: `uncommitted changes outside this session's scope: ${f}`,
+        });
+      }
+    }
+  } else if (git.ahead) {
     notices.push({
       type: 'git-sync',
       reason: `unpushed commits in ${hypoDir} (push deferred to Stop hook)`,
     });
+  }
 
   // 2. root hot.md structure
   const hot = hotMdIsClean(hypoDir);
@@ -3666,25 +3920,13 @@ export function precompactGateStatus(hypoDir, opts = {}) {
       const parsed = JSON.parse(r.stdout);
       const allErrors = parsed.errors || [];
       const allW8 = (parsed.warns || []).filter((w) => w.id === 'W8');
-      // log-only base scope = the shared root files only (hot.md / log.md) — NOT
-      // closeFileTargetsGlobal, which would fold the active/phantom project's
-      // mandatory files in and re-introduce the cross-project attribution. The
-      // session's own transcript-touched files are still added below (a log-only
-      // session is accountable for the wiki files it actually edited).
-      // Lint scope: explicit opts.lintScope wins; else log-only uses the shared
-      // root files only; else projectOverride narrows to that one project's close
-      // files (matching the narrowed close status above); else the global set.
-      const scope = new Set(
-        opts.lintScope ||
-          (logOnly
-            ? ['hot.md', 'log.md']
-            : opts.projectOverride
-              ? closeFileTargetsForProject(hypoDir, opts.projectOverride)
-              : closeFileTargetsGlobal(hypoDir)),
-      );
-      if (opts.transcriptPath && existsSync(opts.transcriptPath)) {
-        for (const f of extractTouchedWikiFiles(opts.transcriptPath, hypoDir)) scope.add(f);
-      }
+      // Lint scope = closeAccountableScope, hoisted above step 1 so the git
+      // check can partition on the same "is this mine" answer. See that
+      // hoisted comment for what feeds it (opts.lintScope override, else
+      // log-only's shared root files, else one project's close files under
+      // projectOverride, else the global set, widened by transcript-touched
+      // files).
+      const scope = closeAccountableScope;
       const part = partitionLintScope(allErrors, scope);
       if (part.blocking.length > 0) {
         blockers.push({
@@ -4154,7 +4396,11 @@ const CLOSE_COMMIT_MESSAGE = new RegExp(
  *   is the YYYY-MM-DD captured from the artifact's own heading, or null for a
  *   commit-message match (the caller already has the commit's date).
  */
-export function detectSessionCloseArtifact({ path = null, content = null, commitMessage = null } = {}) {
+export function detectSessionCloseArtifact({
+  path = null,
+  content = null,
+  commitMessage = null,
+} = {}) {
   if (typeof commitMessage === 'string' && CLOSE_COMMIT_MESSAGE.test(commitMessage)) {
     return { matched: true, kind: 'commit-message', date: null };
   }