hypomnema 1.7.2 → 1.7.3

package/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "hypo",
       "source": "./",
       "description": "LLM-native personal wiki — session-aware knowledge base for Claude Code",
-      "version": "1.7.2",
+      "version": "1.7.3",
       "homepage": "https://github.com/sk-lim19f/Hypomnema"
     }
   ]

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "hypo",
-  "version": "1.7.2",
+  "version": "1.7.3",
   "description": "LLM-native personal wiki system — session-aware knowledge base for Claude Code",
   "author": {
     "name": "sk-lim19f",

package/commands/crystallize.md

@@ -153,13 +153,13 @@ The result JSON includes a `stage` field when `ok: false`. Branch on it:
 | `post-apply-lint` | The payload introduced an error-level lint blocker in a payload file (malformed body / bad frontmatter), or lint crashed. | Fix the offending content in the payload, then re-run. (Broken wikilinks are W4 warnings — not gated.) |
 | `post-apply-verification+lint` | Both above. | Fix both; re-run. |
 
-Once `ok: true`, report:
+Once `ok: true`, report from the result JSON's `applied` and `skipped` arrays together, not `applied` alone. `applied` lists only the fields this run actually wrote bytes for; `skipped` lists the fields that already matched what was on disk (a re-run of an already-applied payload). An idempotent re-run legitimately reports `applied: []`, and that is success, not a failure to report on: check `skipped` for the same 4-6 entries instead. Read `committed` the same way: `true` covers both a real commit and the case where nothing needed staging (a full no-op re-run); `false` means the commit itself ran and failed (see `markerSkipReason`); `null` means apply never reached the commit step at all, because `ok` was already false (an authority refusal before any write, or a verification/lint failure, or a withheld conflict, per `stage`). `null` does NOT mean nothing was written: `applied` can be non-empty (bytes landed on disk) while `committed` stays `null`, because those bytes were never staged into git.
 
-- ✓ session-state.md applied
-- ✓ hot.md (project + root) applied
-- ✓ session-log entry appended
+- ✓ session-state.md applied (or already current, per `skipped`)
+- ✓ hot.md (project + root) applied (or already current)
+- ✓ session-log entry appended (or already present)
 - ✓ open-questions applied (or skipped if unchanged)
-- ✓ log.md entry appended
+- ✓ log.md entry appended (or already present)
 - ✓ post-apply lint clean
 - **marker written?** (required check): if `markerWritten: true`, report "session-close marker written"; if `markerWritten: false`, report "session-close marker NOT written (reason: `<markerSkipReason>`)" and do NOT declare the session "closed" or "complete". A missing marker means the Stop-chain is still open; recover per the `markerSkipReason` branch below.
 

package/hooks/hypo-hot-rebuild.mjs

@@ -19,6 +19,7 @@ import {
   deriveRootLogEntries,
   recordTouchedPaths,
 } from './hypo-shared.mjs';
+import { advanceBase, hashContent } from './base-store.mjs';
 
 const HOT_PATH = join(HYPO_DIR, 'hot.md');
 const GROWTH_CACHE = join(HYPO_DIR, '.cache', 'last-session-growth.json');
@@ -73,7 +74,7 @@ function parsePointerRows(content) {
 }
 
 /** @returns {boolean} true when hot.md was actually rewritten. */
-function rebuild() {
+function rebuild(sessionId) {
   if (!existsSync(HOT_PATH)) return false;
 
   const current = readFileSync(HOT_PATH, 'utf-8');
@@ -116,6 +117,25 @@ ${tableRows}
 
   if (canonical !== current) {
     writeFileSync(HOT_PATH, canonical);
+    // This write bypasses the Write/Edit tool, so hypo-auto-stage's
+    // PostToolUse-based advanceBaseForWrite never sees it (see the file-header
+    // comment above). Without advancing the base here, this session's own
+    // rewrite of hot.md looks -- at close time -- exactly like a DIFFERENT
+    // session having edited it, and the observed-base guard in crystallize.mjs
+    // parks a false conflict against this session's own work. Mirrors
+    // crystallize.mjs's overwrite(): advanceBase right after the write that
+    // made it true.
+    //
+    // No session_id on stdin (empty/malformed payload): advanceBase is a
+    // no-op without a snapshot anyway, so this stays silent-safe like before
+    // this fix -- just observable on stderr instead of a guess.
+    if (sessionId) {
+      advanceBase(HYPO_DIR, sessionId, 'hot.md', hashContent(canonical));
+    } else {
+      process.stderr.write(
+        '[hypo-hot-rebuild] no session_id on stdin; base not advanced for hot.md\n',
+      );
+    }
     return true;
   }
   return false;
@@ -134,7 +154,7 @@ function emitGrowth() {
 
 let hotWritten = false;
 try {
-  hotWritten = rebuild();
+  hotWritten = rebuild(sessionId);
 } catch (err) {
   process.stderr.write(`[hypo-hot-rebuild] error: ${err?.message ?? String(err)}\n`);
 }

package/hooks/hypo-shared.mjs

@@ -445,6 +445,72 @@ export function hypoIsClean(dir = HYPO_DIR) {
   }
 }
 
+/**
+ * Repo-relative POSIX paths with uncommitted changes (tracked or untracked) in
+ * `dir`. Reuses the SAME `-z` rename-aware porcelain parsing as
+ * commitWikiChanges (PR #222): a rename or copy emits `to\0from`, and both
+ * sides count as dirty (a rename's source still shows staged until the rename
+ * itself lands). This is the read-only half of that fix's pathspec boundary:
+ * commitWikiChanges narrows what gets COMMITTED to a caller-supplied scope;
+ * this narrows what counts as a BLOCKER the same way, for precompactGateStatus
+ * to attribute dirty files to the session that owns them instead of the whole
+ * shared working tree.
+ *
+ * Paths are normalized to be relative to `dir` itself, NOT to the git
+ * repository's top level: `git -C <dir> status --porcelain` prints paths
+ * relative to the repo TOP LEVEL even under `-C` (verified empirically: a
+ * vault nested under `<repo>/vault/` reports `vault/hot.md`, not `hot.md`).
+ * Every other path this file compares against (closeAccountableScope,
+ * closeFileTargetsGlobal, extractTouchedWikiFiles) is `dir`-relative, so
+ * without this normalization a nested vault's OWN files would never match
+ * its own scope and every one of them would look foreign (codex pre-commit
+ * review BLOCKER 2). `git rev-parse --show-prefix` gives exactly the prefix
+ * to strip; a dirty path that does not start with it lives outside the
+ * vault entirely (the rest of a bigger host repo) and is dropped, never
+ * "mine".
+ *
+ * @returns {string[]} dirty paths relative to `dir`, or `[]` on any git
+ *   failure (the caller already has its own git-status result via
+ *   hypoIsClean and treats that failure as an unconditional blocker; an
+ *   empty return here just means "cannot attribute", not "clean").
+ */
+function gitDirtyFiles(dir) {
+  const prefixRes = spawnSync('git', ['-C', dir, 'rev-parse', '--show-prefix'], {
+    encoding: 'utf-8',
+  });
+  if (prefixRes.status !== 0) return []; // can't resolve the repo → cannot attribute
+  const prefix = (prefixRes.stdout || '').trim();
+
+  const porcelain = spawnSync('git', ['-C', dir, 'status', '--porcelain', '-uall', '-z'], {
+    encoding: 'utf-8',
+  });
+  if (porcelain.status !== 0) return [];
+  const out = [];
+  const records = (porcelain.stdout || '').split('\0');
+  const toDirRelative = (f) => {
+    if (!f) return null;
+    if (!prefix) return f; // dir IS the repo top level, nothing to strip
+    return f.startsWith(prefix) ? f.slice(prefix.length) : null; // outside the vault
+  };
+  for (let i = 0; i < records.length; i++) {
+    const rec = records[i];
+    if (!rec) continue;
+    const xy = rec.slice(0, 2);
+    const file = rec.slice(3); // destination path for a rename/copy
+    const isRenameOrCopy = xy[0] === 'R' || xy[1] === 'R' || xy[0] === 'C' || xy[1] === 'C';
+    let fromFile = null;
+    if (isRenameOrCopy) {
+      i++;
+      fromFile = records[i] || null;
+    }
+    const rel = toDirRelative(file);
+    if (rel) out.push(rel);
+    const relFrom = toDirRelative(fromFile);
+    if (relFrom) out.push(relFrom);
+  }
+  return out;
+}
+
 export function hotMdIsClean(dir = HYPO_DIR) {
   const hotPath = dir === HYPO_DIR ? HOT_PATH : join(dir, 'hot.md');
   if (!existsSync(hotPath)) return { clean: true };
@@ -3281,22 +3347,32 @@ function toHypoRel(absPath, hypoDir) {
 }
 
 /**
- * Repo-relative POSIX paths of wiki files this session edited via direct
- * Edit/Write/MultiEdit/NotebookEdit tool_use. Returns a Set; empty when the
- * transcript is missing/unreadable (callers decide the fallback). A per-line
- * JSON parse error skips that line only (transcripts occasionally truncate).
+ * Same walk as extractTouchedWikiFiles, but also reports whether the walk can
+ * be TRUSTED as a complete enumeration: `trusted: false` when the transcript
+ * is missing, unreadable, or contains a line that failed to parse (transcripts
+ * occasionally truncate mid-write). `extractTouchedWikiFiles` collapses all of
+ * that to an empty/partial Set, indistinguishable from "this session touched
+ * nothing", which is fine for lint's existing debt-partition (a false notice is not a
+ * false pass), but NOT fine for an attribution-sensitive caller like
+ * precompactGateStatus's git-scope check: treating an untrustworthy empty Set
+ * as "nothing to widen" would let a session's own dirty file, invisible only
+ * because its transcript could not be read, pass as someone else's foreign
+ * debt (codex pre-commit review BLOCKER 1).
+ *
+ * @returns {{files: Set<string>, trusted: boolean}}
  */
-export function extractTouchedWikiFiles(transcriptPath, hypoDir) {
+export function extractTouchedWikiFilesWithTrust(transcriptPath, hypoDir) {
   const out = new Set();
   if (!transcriptPath || typeof transcriptPath !== 'string' || !existsSync(transcriptPath)) {
-    return out;
+    return { files: out, trusted: false };
   }
   let raw;
   try {
     raw = readFileSync(transcriptPath, 'utf-8');
   } catch {
-    return out;
+    return { files: out, trusted: false };
   }
+  let trusted = true;
   for (const line of raw.split('\n')) {
     const t = line.trim();
     if (!t) continue;
@@ -3304,6 +3380,7 @@ export function extractTouchedWikiFiles(transcriptPath, hypoDir) {
     try {
       entry = JSON.parse(t);
     } catch {
+      trusted = false; // a truncated/corrupt line: the walk may be incomplete
       continue;
     }
     for (const fp of extractTranscriptToolFilePaths(entry)) {
@@ -3311,7 +3388,19 @@ export function extractTouchedWikiFiles(transcriptPath, hypoDir) {
       if (rel) out.add(rel);
     }
   }
-  return out;
+  return { files: out, trusted };
+}
+
+/**
+ * Repo-relative POSIX paths of wiki files this session edited via direct
+ * Edit/Write/MultiEdit/NotebookEdit tool_use. Returns a Set; empty when the
+ * transcript is missing/unreadable (callers decide the fallback). A per-line
+ * JSON parse error skips that line only (transcripts occasionally truncate).
+ * A caller that needs to tell "genuinely empty" apart from "could not fully
+ * enumerate" wants extractTouchedWikiFilesWithTrust instead.
+ */
+export function extractTouchedWikiFiles(transcriptPath, hypoDir) {
+  return extractTouchedWikiFilesWithTrust(transcriptPath, hypoDir).files;
 }
 
 /**
@@ -3539,20 +3628,89 @@ export function precompactGateStatus(hypoDir, opts = {}) {
   const marker = opts.sessionId ? readSessionClosedMarker(hypoDir, opts.sessionId) : null;
   const logOnly = opts.logOnly === true || marker?.scope === 'log-only';
 
-  // 1. wiki git state. Uncommitted changes (real unsaved work) BLOCK:
-  //    they are human-fixable. Unpushed commits (ahead) DEMOTE to a notice: push is
+  // Paths this session is accountable for at THIS close: the same signals the
+  // lint partition below already trusts for exactly this question ("is this
+  // file mine or pre-existing debt"), hoisted so the git check (step 1) can
+  // partition on it too. Base = the mandatory close-target files (opts.lintScope
+  // override, else the log-only shared root files, else one project's close
+  // files under projectOverride, else every today-active project's); widened by
+  // every file this session's transcript shows it editing directly.
+  const closeAccountableScope = new Set(
+    opts.lintScope ||
+      (logOnly
+        ? ['hot.md', 'log.md']
+        : opts.projectOverride
+          ? closeFileTargetsForProject(hypoDir, opts.projectOverride)
+          : closeFileTargetsGlobal(hypoDir)),
+  );
+  // Trust signal for the git-scope check below (codex pre-commit review
+  // BLOCKER 1): closeAccountableScope's mandatory-files base is always
+  // reliable, but the transcript widening that catches an ad hoc page this
+  // session edited is only as good as the transcript. No opts.transcriptPath
+  // at all, an unreadable file, or a line that fails to parse all mean the
+  // widened scope may be under-inclusive, NOT that this session touched
+  // nothing extra. Only a fully-read, fully-parsed transcript earns
+  // sessionTouchTrusted:true. A single tool_use with no file_path does NOT
+  // lower trust: most tool_use blocks (Read, Bash, Grep, ...) never carry one
+  // and that is expected, not corruption, so treating it as untrustworthy
+  // would make almost every real transcript untrusted and defeat the scoping
+  // this fix exists to add.
+  let sessionTouchTrusted = false;
+  if (opts.transcriptPath) {
+    const widened = extractTouchedWikiFilesWithTrust(opts.transcriptPath, hypoDir);
+    sessionTouchTrusted = widened.trusted;
+    for (const f of widened.files) closeAccountableScope.add(f);
+  }
+
+  // 1. wiki git state. Uncommitted changes (real unsaved work) BLOCK, but only
+  //    the ones inside closeAccountableScope, and only when sessionTouchTrusted
+  //    (above) says that scope can actually be trusted: a session's own scoped
+  //    auto-commit (commitWikiChanges, PR #222) can leave the working tree
+  //    non-empty when a DIFFERENT session sharing this vault still has its own
+  //    file dirty, the 2026-08-03 multi-session block. That dirty file is
+  //    human-fixable by whoever owns it, not by this session, so it demotes to
+  //    a notice (listed by path, never silently dropped) instead of refusing
+  //    this session's marker. A dirty file THIS session owns still blocks
+  //    unconditionally (fail-closed is unchanged for scope this session
+  //    actually touched), and so does an unattributable state: a git failure
+  //    gitDirtyFiles can't enumerate (dirty.length === 0 despite
+  //    git.uncommitted === true), OR a scope we cannot trust
+  //    (!sessionTouchTrusted) both fall back to the original unscoped blocker:
+  //    "cannot attribute" is not "clean".
+  //    Unpushed commits (ahead) DEMOTE to a notice regardless of scope: push is
   //    automatic (auto-commit Stop hook) and its failures are already non-fatal, so
   //    "ahead" is a transient sync state, not a human-fixable blocker. Demoting it
   //    here (the shared gate) keeps the marker == compact-ready invariant:
   //    a committed-but-unpushed close marks AND compacts, instead of the close writer
   //    committing its own payload and then being blocked by its own (unpushed) commit.
   const git = hypoIsClean(hypoDir);
-  if (git.uncommitted) blockers.push({ type: 'git', reason: git.reason });
-  else if (git.ahead)
+  if (git.uncommitted) {
+    const dirty = gitDirtyFiles(hypoDir);
+    if (dirty.length === 0 || !sessionTouchTrusted) {
+      blockers.push({ type: 'git', reason: git.reason });
+    } else {
+      const mine = dirty.filter((f) => closeAccountableScope.has(posixPath(f)));
+      const foreign = dirty.filter((f) => !closeAccountableScope.has(posixPath(f)));
+      if (mine.length > 0) {
+        blockers.push({
+          type: 'git',
+          reason: `uncommitted changes in ${hypoDir}: ${mine.join(', ')}`,
+        });
+      }
+      for (const f of foreign) {
+        notices.push({
+          type: 'git',
+          file: f,
+          reason: `uncommitted changes outside this session's scope: ${f}`,
+        });
+      }
+    }
+  } else if (git.ahead) {
     notices.push({
       type: 'git-sync',
       reason: `unpushed commits in ${hypoDir} (push deferred to Stop hook)`,
     });
+  }
 
   // 2. root hot.md structure
   const hot = hotMdIsClean(hypoDir);
@@ -3762,25 +3920,13 @@ export function precompactGateStatus(hypoDir, opts = {}) {
       const parsed = JSON.parse(r.stdout);
       const allErrors = parsed.errors || [];
       const allW8 = (parsed.warns || []).filter((w) => w.id === 'W8');
-      // log-only base scope = the shared root files only (hot.md / log.md) — NOT
-      // closeFileTargetsGlobal, which would fold the active/phantom project's
-      // mandatory files in and re-introduce the cross-project attribution. The
-      // session's own transcript-touched files are still added below (a log-only
-      // session is accountable for the wiki files it actually edited).
-      // Lint scope: explicit opts.lintScope wins; else log-only uses the shared
-      // root files only; else projectOverride narrows to that one project's close
-      // files (matching the narrowed close status above); else the global set.
-      const scope = new Set(
-        opts.lintScope ||
-          (logOnly
-            ? ['hot.md', 'log.md']
-            : opts.projectOverride
-              ? closeFileTargetsForProject(hypoDir, opts.projectOverride)
-              : closeFileTargetsGlobal(hypoDir)),
-      );
-      if (opts.transcriptPath && existsSync(opts.transcriptPath)) {
-        for (const f of extractTouchedWikiFiles(opts.transcriptPath, hypoDir)) scope.add(f);
-      }
+      // Lint scope = closeAccountableScope, hoisted above step 1 so the git
+      // check can partition on the same "is this mine" answer. See that
+      // hoisted comment for what feeds it (opts.lintScope override, else
+      // log-only's shared root files, else one project's close files under
+      // projectOverride, else the global set, widened by transcript-touched
+      // files).
+      const scope = closeAccountableScope;
       const part = partitionLintScope(allErrors, scope);
       if (part.blocking.length > 0) {
         blockers.push({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hypomnema",
-  "version": "1.7.2",
+  "version": "1.7.3",
   "description": "LLM-native personal wiki system for Claude Code",
   "type": "module",
   "license": "MIT",

package/scripts/capture.mjs

@@ -42,9 +42,10 @@ import {
   unlinkSync,
   renameSync,
   realpathSync,
-  lstatSync,
   openSync,
   closeSync,
+  statSync,
+  chmodSync,
 } from 'fs';
 import { randomBytes } from 'crypto';
 import { join, dirname, relative, sep } from 'path';
@@ -76,6 +77,7 @@ import {
   HOOK_EVENT_ALLOWLIST,
   SKILL_ROOT_FILE,
   EXT_PREFIX,
+  withSrcExecBits,
 } from './lib/extensions.mjs';
 import { readCoreHooksConfig, deriveCoreHookBasenames } from './lib/core-hooks.mjs';
 
@@ -582,7 +584,12 @@ function log(msg) {
 // `${dest}.tmp.${pid}` name was predictable, and writeFileSync on a path someone had
 // already planted a symlink at would follow it straight out of the wiki. O_EXCL fails
 // on an existing path of any kind, symlink included.
-function writeAtomic(dest, buf) {
+// `srcMode`, when given, carries the source file's execute bit onto the wiki
+// copy (openSync's own mode argument is clipped by umask same as writeFileSync,
+// so this still has to be a separate chmod). Omitted for a manifest write: that
+// content is JSON we generated, not a copy of something with a mode worth
+// keeping.
+function writeAtomic(dest, buf, srcMode) {
   const tmp = `${dest}.tmp.${process.pid}.${randomBytes(6).toString('hex')}`;
   const fd = openSync(tmp, 'wx');
   try {
@@ -590,6 +597,9 @@ function writeAtomic(dest, buf) {
   } finally {
     closeSync(fd);
   }
+  if (srcMode != null) {
+    chmodSync(tmp, withSrcExecBits(statSync(tmp).mode, srcMode));
+  }
   try {
     renameSync(tmp, dest);
   } catch (err) {
@@ -719,7 +729,8 @@ function writeSkill({ rec, skillRoot, manifestPath, manifest, files, guard, wiki
         madeDirs.add(cur);
       }
     }
-    writeAtomic(destPath, readFileSync(f.srcPath));
+    const buf = readFileSync(f.srcPath);
+    writeAtomic(destPath, buf, statSync(f.srcPath).mode);
     rec.createdFiles.push(destPath);
   }
 }
@@ -814,22 +825,6 @@ function captureOneSkill({ c, extDir, guard, wikiRoot, args, captured, skipped,
     return;
   }
 
-  // Content round-trips; the executable bit does not (forward-sync writes with the
-  // default mode). Say so rather than let a captured `scripts/run.sh` arrive
-  // non-executable on the far machine without a word.
-  const execFiles = c.files.filter((f) => {
-    try {
-      return (lstatSync(f.srcPath).mode & 0o111) !== 0;
-    } catch {
-      return false;
-    }
-  });
-  if (execFiles.length > 0) {
-    log(
-      `! ${label}: ${execFiles.length} executable file(s) — content is captured, but the executable bit is not carried by sync`,
-    );
-  }
-
   if (!args.dryRun) {
     // The ledger is owned by the caller so a throw MID-write is still recoverable: the
     // paths created before the failure are already recorded in it.
@@ -1055,7 +1050,7 @@ function run(args, { claudeHome = join(HOME, '.claude') } = {}) {
         manifestPrevBuf: existingManifestBuf,
       };
       writeAtomic(manifestPath, JSON.stringify(plan.manifest, null, 2) + '\n');
-      writeAtomic(filePath, srcBuf);
+      writeAtomic(filePath, srcBuf, statSync(c.srcPath).mode);
       created.push(rec);
     }
     captured.push({ ...c, installFile, requiredKeys, status: 'ready' });

package/scripts/crystallize.mjs

@@ -109,6 +109,7 @@ import {
   scopeVisible,
   readVisibilityScope,
   withFileLock,
+  extractTouchedWikiFilesWithTrust,
 } from '../hooks/hypo-shared.mjs';
 import { hashContent, readBaseEntry, advanceBase } from '../hooks/base-store.mjs';
 import { writeProposal } from '../hooks/proposal-store.mjs';
@@ -225,6 +226,35 @@ function requireProjectDir(args, slug) {
   }
 }
 
+// When the global gate's own discovery (hot.md pointer table + today
+// close-activity scan, both in hypo-shared.mjs) comes back with NO project at
+// all, a real apply never hits that dead end: it is handed `payload.project`
+// directly and never infers. --check-session-close has no payload, so its one
+// remaining authoritative signal is the same session's own transcript — which
+// project's files did THIS session actually touch. Reusing the exact
+// evidence-resolution helper the widened-lint-scope path already trusts here
+// keeps this a single inference vocabulary (touched wiki files), not a second
+// one: the difference is only which project-shaped question gets asked of it.
+// Never guessed: a transcript touching zero or more than one project's files
+// leaves the check exactly as unresolved as it was before this fallback.
+function deriveTouchedProject(hypoDir, transcriptPath) {
+  if (!transcriptPath) return null;
+  const { files, trusted } = extractTouchedWikiFilesWithTrust(transcriptPath, hypoDir);
+  // `trusted:false` means the walk itself may be incomplete (a missing/unreadable
+  // transcript, or a line that failed to parse). A truncated line could have named
+  // a SECOND project the walk never saw, so treating this Set as "the whole
+  // truth" would resolve a single-project reading off a scope that is only
+  // single-project because part of it is missing, exactly the ambiguity this
+  // fallback exists to refuse rather than guess through.
+  if (!trusted) return null;
+  const slugs = new Set();
+  for (const f of files) {
+    const m = /^projects\/([^/]+)\//.exec(f);
+    if (m && existsSync(join(hypoDir, 'projects', m[1]))) slugs.add(m[1]);
+  }
+  return slugs.size === 1 ? [...slugs][0] : null;
+}
+
 // ── session-close check (spec §5.2.7 / §8.3) ────────────────────────
 // Mirrors the hard gate in hypo-personal-check.mjs so the /hypo:crystallize
 // flow can self-verify before /compact triggers PreCompact.
@@ -261,7 +291,7 @@ function runSessionCloseCheck(args) {
     args.transcriptPath ||
     (args.sessionId ? resolveTranscriptBySessionId(args.sessionId) : null) ||
     null;
-  const status = precompactGateStatus(args.hypoDir, {
+  let status = precompactGateStatus(args.hypoDir, {
     ...(args.project
       ? { projectOverride: args.project }
       : checkTranscript
@@ -276,7 +306,30 @@ function runSessionCloseCheck(args) {
     // enforcement lives in the PreCompact/Stop hooks, which carry payload.cwd).
     ...(args.sessionCwd && !args.project ? { sessionCwd: args.sessionCwd } : {}),
   });
+
+  // check/apply divergence (2026-08-25 QA): a real apply never hits discovery
+  // dead-ends because payload.project is required input, not an inference. This
+  // check has no payload, so when discovery finds NO project at all (not even
+  // the recency fallback), it retries scoped to whatever single project this
+  // session's own transcript shows it touching. This is a diagnostic estimate,
+  // not a preview of what a real apply will do: a payload's `project` field is
+  // whatever the caller puts there and can legitimately name a project the
+  // transcript never mentions. Only fires on a fully unresolved global result,
+  // and only on a TRUSTED single-project reading (see deriveTouchedProject): an
+  // already-successful discovery, an ambiguous/empty transcript, or one the walk
+  // could not fully read is left untouched rather than guessed at.
+  let inferredProject = null;
+  if (!args.project && !status.close.project) {
+    inferredProject = deriveTouchedProject(args.hypoDir, checkTranscript);
+    if (inferredProject) {
+      status = precompactGateStatus(args.hypoDir, {
+        projectOverride: inferredProject,
+        ...(args.sessionId ? { sessionId: args.sessionId } : {}),
+      });
+    }
+  }
   const close = status.close;
+  const scopedProject = args.project || inferredProject;
 
   // When a --session-id is supplied, report whether THIS session's
   // per-session marker (the Stop-chain completion signal) exists. This is a
@@ -301,8 +354,8 @@ function runSessionCloseCheck(args) {
   // log-only marker governs the session, the gate runs in log-only mode and the
   // --project override is IGNORED — surface that rather than implying X was
   // checked (it was not).
-  const logOnlyWon = args.project != null && markerObj?.scope === 'log-only';
-  const scope = args.project ? (logOnlyWon ? 'log-only' : 'project') : 'global';
+  const logOnlyWon = scopedProject != null && markerObj?.scope === 'log-only';
+  const scope = scopedProject ? (logOnlyWon ? 'log-only' : 'project') : 'global';
 
   if (args.json) {
     console.log(
@@ -325,9 +378,13 @@ function runSessionCloseCheck(args) {
           skipped: status.skipped,
           // scope is additive; `global` keeps prior semantics for existing readers
           scope,
-          ...(args.project
+          ...(scopedProject
             ? {
-                scoped_project: args.project,
+                scoped_project: scopedProject,
+                // Distinguishes a user-typed --project from this check picking one
+                // for itself off the transcript — a reader should not mistake the
+                // latter for an explicit ask (see deriveTouchedProject above).
+                ...(inferredProject ? { project_inferred_from_transcript: true } : {}),
                 ...(logOnlyWon ? { project_override_ignored: true } : {}),
               }
             : {}),
@@ -340,13 +397,20 @@ function runSessionCloseCheck(args) {
     process.exit(status.ok ? 0 : 1);
   }
 
+  // Label the scoped project by how it was chosen — an explicit --project reads
+  // as a flag the caller typed; an inferred one reads as this check's own guess
+  // off the transcript, so a reader does not credit the caller with an ask
+  // nobody made.
+  const scopedProjectLabel = args.project
+    ? `--project=${args.project}`
+    : `project=${scopedProject} (inferred from the session transcript, no --project given)`;
   if (logOnlyWon) {
     console.log(
-      `Note: a log-only session-closed marker governs session ${args.sessionId}, so the gate ran in log-only mode and --project=${args.project} was IGNORED (no project was checked).\n`,
+      `Note: a log-only session-closed marker governs session ${args.sessionId}, so the gate ran in log-only mode and ${scopedProjectLabel} was IGNORED (no project was checked).\n`,
     );
   } else if (scope === 'project') {
     console.log(
-      `Note: --project=${args.project} — this is a PROJECT-SCOPED diagnostic, not the global /compact gate. A green result means only ${args.project} is close-complete; another project can still block /compact.\n`,
+      `Note: ${scopedProjectLabel} — this is a PROJECT-SCOPED diagnostic, not the global /compact gate. A green result means only ${scopedProject} is close-complete; another project can still block /compact.\n`,
     );
   }
 
@@ -398,8 +462,8 @@ function runSessionCloseCheck(args) {
     // Do NOT claim global compact-readiness (the whole point of the narrow).
     console.log(
       status.ok
-        ? `✓ ${args.project} is close-complete (project-scoped). This is NOT a global /compact guarantee — run \`--check-session-close\` without --project for that.`
-        : `✗ ${args.project} is not close-complete — resolve the ✗ items above.`,
+        ? `✓ ${scopedProject} is close-complete (project-scoped). This is NOT a global /compact guarantee — run \`--check-session-close\` without --project for that.`
+        : `✗ ${scopedProject} is not close-complete — resolve the ✗ items above.`,
     );
   } else {
     console.log(
@@ -1043,7 +1107,10 @@ function applySessionClose(args) {
       stage: 'no-user-close-signal',
       reason: closeAuth.reason,
       applied: [],
-      committed: false,
+      // `null`, not `false`: this refusal fires before the commit step is ever
+      // reached (see the general result's own `committed` contract below).
+      // `false` is reserved for a commit that actually ran and failed.
+      committed: null,
       error: closeAuth.error,
     };
     console.log(
@@ -1103,7 +1170,9 @@ function applySessionClose(args) {
       stage: 'session-id-mismatch',
       error: msg,
       applied: [],
-      committed: false,
+      // `null`, not `false` — refused before the commit step, same contract as
+      // the `no-user-close-signal` refusal above.
+      committed: null,
     };
     console.log(args.json ? JSON.stringify(out, null, 2) : `✗ ${msg}`);
     process.exit(1);
@@ -1734,6 +1803,10 @@ function applySessionClose(args) {
   // but silently.
   let markerWritten = false;
   let markerSkipReason = null;
+  // Hoisted so the result JSON below can report it: `null` when this apply never
+  // reached the commit step at all (ok:false before the writes were even
+  // verified), distinct from a commit that ran and reported `committed:false`.
+  let commitOutcome = null;
   if (ok && args.sessionId) {
     // IO stays lazy so this preserves the exact side-effect order (codex design
     // review): commit first (the only mutation), then resolve the
@@ -1749,7 +1822,6 @@ function applySessionClose(args) {
     // apply's stage+commit. A lock-timeout is treated exactly like any other
     // commit failure below (skip the marker, surface the reason) rather than
     // crashing the apply.
-    let commitOutcome;
     try {
       commitOutcome = withFileLock(vaultCommitLockTarget(args.hypoDir), () =>
         commitWikiChanges(args.hypoDir, appliedPaths),
@@ -1843,6 +1915,19 @@ function applySessionClose(args) {
     date,
     applied,
     skipped,
+    // Was the general-shape sibling of the two early-refusal `committed:null`
+    // fields (no-user-close-signal / session-id-mismatch), which this path never
+    // carried before: a reader of `applied:[]` on a no-op re-run had no
+    // `committed` value to check against and no way to tell it apart from a run
+    // that never reached the commit step. `null` here means exactly that: `ok`
+    // came back false before the commit ever ran (see `stage` for which check
+    // failed: post-apply-verification, post-apply-lint, or proposal-pending). It
+    // does NOT mean nothing was written — an overwrite/append can already be on
+    // disk (see `applied` / `appliedUncommitted`) while `committed` stays `null`.
+    // `true` covers both an actual commit and the legitimate "nothing to stage"
+    // no-op (commitWikiChanges' own contract, see hooks/hypo-shared.mjs); `false`
+    // is a real commit failure, surfaced together with markerSkipReason below.
+    committed: commitOutcome ? commitOutcome.committed : null,
     // Targets withheld: an overwrite drifted from this session's observed base, or
     // an append could not take the file lock in time (`kind: 'append'`). Two
     // channels resolve these, and `proposals` vs `conflicts[].kind` are the sole

package/scripts/doctor.mjs

@@ -20,7 +20,7 @@ import { fileURLToPath } from 'url';
 import { resolveHypoRoot, expandHome } from './lib/hypo-root.mjs';
 import { loadHypoIgnore, isScanIgnored } from './lib/hypo-ignore.mjs';
 import { readRenameMarker, renameMarkerPath, RENAME_MARKER_REL } from './lib/rename-marker.mjs';
-import { resolveGitHooksDir } from './lib/git-hooks-dir.mjs';
+import { resolveGitHooksDir, WIKI_PRE_COMMIT_MARKER_START } from './lib/git-hooks-dir.mjs';
 import { parseFrontmatter } from './lib/frontmatter.mjs';
 import {
   readSyncState,
@@ -506,7 +506,7 @@ function checkGit(hypoDir) {
         ? 'Not installed — run /hypo:init to install .hypoignore guard'
         : 'Not installed, and /hypo:init will not install into this path — point core.hooksPath back inside the repository, or install the guard yourself',
     );
-  } else if (content.includes('# hypo-managed:pre-commit:start')) {
+  } else if (content.includes(WIKI_PRE_COMMIT_MARKER_START)) {
     pass(label, 'Hypomnema .hypoignore guard installed');
   } else {
     warn(label, 'Exists but not managed by Hypomnema — manual git add can bypass .hypoignore');

package/scripts/init.mjs

@@ -38,7 +38,14 @@ import { execSync, spawnSync } from 'child_process';
 import { fileURLToPath } from 'url';
 import { createHash } from 'crypto';
 import { expandHome, resolveHypoRoot } from './lib/hypo-root.mjs';
-import { hooksDirForInstall, unsafeHookTargetReason } from './lib/git-hooks-dir.mjs';
+import {
+  hooksDirForInstall,
+  unsafeHookTargetReason,
+  WIKI_PRE_COMMIT_MARKER_START,
+  WIKI_PRE_COMMIT_MARKER_END,
+  SHELL_MARKER_START,
+  SHELL_MARKER_END,
+} from './lib/git-hooks-dir.mjs';
 import { readCoreHooksConfig } from './lib/core-hooks.mjs';
 import {
   readPkgJson as readPkgJsonSafe,
@@ -748,9 +755,6 @@ function installPkgGitHook(dryRun) {
 
 // ── wiki pre-commit hook ─────────────────────────────────────────────────────
 
-const WIKI_PRE_COMMIT_MARKER_START = '# hypo-managed:pre-commit:start';
-const WIKI_PRE_COMMIT_MARKER_END = '# hypo-managed:pre-commit:end';
-
 // Single-quote escaping prevents shell expansion of special chars (e.g. $HOME, backticks) in path
 function shellSingleQuote(p) {
   return `'${p.replace(/'/g, "'\\''")}'`;
@@ -859,9 +863,6 @@ function installWikiPreCommitHook(hypoDir, dryRun, force, root, lintStrict) {
 
 // ── shell function setup ─────────────────────────────────────────────────────
 
-const SHELL_MARKER_START = '# hypo-managed:shell-setup:start';
-const SHELL_MARKER_END = '# hypo-managed:shell-setup:end';
-
 function shellFunctionBlock() {
   return `${SHELL_MARKER_START}
 function claude() {

package/scripts/lib/extensions.mjs

@@ -28,6 +28,8 @@ import {
   unlinkSync,
   mkdirSync,
   lstatSync,
+  statSync,
+  chmodSync,
   rmdirSync,
 } from 'fs';
 import { join, dirname, relative, resolve, posix, sep } from 'path';
@@ -894,9 +896,26 @@ export function readExtensionPkgStateNoMutate(pkgPath, target) {
 
 // ── sync orchestration ─────────────────────────────────────────────────────────
 
-function writeFreshAtomic(dest, content) {
+/** Carry only src's execute bits (owner/group/other) onto a mode value; every
+ * other permission bit (dest's own read/write, however umask shaped it) is
+ * left alone. This is the one place forward-sync decides "should this file be
+ * executable", so every writer of dest routes through it. Exported so
+ * capture.mjs's own atomic writer (a captured file's FIRST write into the wiki)
+ * applies the identical rule; the wiki copy must not lose the bit before
+ * forward-sync ever gets a chance to carry it further. */
+export function withSrcExecBits(destMode, srcMode) {
+  return (destMode & ~0o111) | (srcMode & 0o111);
+}
+
+function writeFreshAtomic(dest, content, srcMode) {
   const tmp = `${dest}.tmp.${process.pid}.${Date.now()}`;
   writeFileSync(tmp, content);
+  if (srcMode != null) {
+    // writeFileSync has no mode option that survives umask, so the execute bit
+    // has to be applied explicitly, and before the rename: otherwise dest is
+    // briefly visible with the wrong mode to anything racing this write.
+    chmodSync(tmp, withSrcExecBits(statSync(tmp).mode, srcMode));
+  }
   try {
     renameSync(tmp, dest);
   } catch (err) {
@@ -914,13 +933,19 @@ function writeFreshAtomic(dest, content) {
  * overwrites user-modified / unowned files; without it those are left untouched and
  * surface as drift/conflict. A symlink/non-regular dest is never followed even under
  * force (the isRegularFile guard precedes the force branch).
+ *
+ * The executable bit is not tracked anywhere (no mode column in the SHA map's
+ * ownership model), so src's mode is the only source of truth for it and gets
+ * carried onto dest on every branch that (re)writes it, including the
+ * content-identical `up-to-date` branch below.
  */
 function copyOne({ srcPath, destPath, key, recordedSHA, apply, force }) {
   const srcContent = readFileSync(srcPath);
   const srcSHA = sha256(srcContent);
+  const srcMode = statSync(srcPath).mode;
 
   if (!existsSync(destPath)) {
-    if (apply) writeFreshAtomic(destPath, srcContent);
+    if (apply) writeFreshAtomic(destPath, srcContent, srcMode);
     return { action: 'create', sha: srcSHA };
   }
   if (!isRegularFile(destPath)) {
@@ -933,6 +958,20 @@ function copyOne({ srcPath, destPath, key, recordedSHA, apply, force }) {
   }
   const onDiskSHA = sha256(onDisk);
   if (onDiskSHA === srcSHA) {
+    // Content already matches, but the exec bit can still be stale: this used to
+    // be a pure no-op, which is exactly why a mismatched bit here never healed.
+    // Reported as 'update' (not a new action) so every existing "N to sync" /
+    // "N synced" count and log line already keyed on create/update/force-update
+    // picks it up for free.
+    // ponytail: this also overwrites an exec bit a user deliberately flipped on a
+    // file whose content happens to still match src (chmod -x'd a script they
+    // like read-only). Upgrade path: record mode next to sha in the pkg-json map
+    // so a user's own bit can be told apart from our default and left alone.
+    const destMode = statSync(destPath).mode;
+    if ((destMode & 0o111) !== (srcMode & 0o111)) {
+      if (apply) chmodSync(destPath, withSrcExecBits(destMode, srcMode));
+      return { action: 'update', sha: srcSHA };
+    }
     return { action: 'up-to-date', sha: srcSHA };
   }
   if (recordedSHA && onDiskSHA === recordedSHA) {
@@ -942,7 +981,7 @@ function copyOne({ srcPath, destPath, key, recordedSHA, apply, force }) {
       if (!verify || sha256(verify) !== recordedSHA) {
         return { action: 'skip-changed', sha: recordedSHA };
       }
-      writeFreshAtomic(destPath, srcContent);
+      writeFreshAtomic(destPath, srcContent, srcMode);
     }
     return { action: 'update', sha: srcSHA };
   }
@@ -950,7 +989,7 @@ function copyOne({ srcPath, destPath, key, recordedSHA, apply, force }) {
   if (force) {
     if (apply) {
       writeFreshAtomic(`${destPath}.bak`, onDisk);
-      writeFreshAtomic(destPath, srcContent);
+      writeFreshAtomic(destPath, srcContent, srcMode);
     }
     return { action: 'force-update', sha: srcSHA };
   }

package/scripts/lib/git-hooks-dir.mjs

@@ -38,6 +38,16 @@ import { execFileSync } from 'child_process';
 import { existsSync, lstatSync, realpathSync, statSync } from 'fs';
 import { basename, dirname, isAbsolute, join, resolve, sep } from 'path';
 
+// ── shared install/uninstall markers ────────────────────────────────────────
+// init.mjs writes these when it installs the wiki's git pre-commit hook and
+// the shell rc block; uninstall.mjs reads them back to remove exactly what
+// init created. Defined once here, imported by both, so the two scripts can
+// never drift into recognizing different markers.
+export const WIKI_PRE_COMMIT_MARKER_START = '# hypo-managed:pre-commit:start';
+export const WIKI_PRE_COMMIT_MARKER_END = '# hypo-managed:pre-commit:end';
+export const SHELL_MARKER_START = '# hypo-managed:shell-setup:start';
+export const SHELL_MARKER_END = '# hypo-managed:shell-setup:end';
+
 // Fallback scrub list for git versions without `rev-parse --local-env-vars`.
 // Mirrors scripts/install-git-hooks.mjs, which established this trust model.
 const STATIC_LOCAL_ENV_VARS = [

package/scripts/lint.mjs

@@ -19,7 +19,7 @@
 import { existsSync, readFileSync, writeFileSync, readdirSync, statSync } from 'fs';
 import { join, extname, basename } from 'path';
 import { resolveHypoRootInfo, checkVaultOrExit, expandHome } from './lib/hypo-root.mjs';
-import { SESSION_STATE_NEXT_HEADINGS } from '../hooks/hypo-shared.mjs';
+import { SESSION_STATE_NEXT_HEADINGS, closeFileTargetsGlobal } from '../hooks/hypo-shared.mjs';
 import { loadHypoIgnore, isScanIgnored } from './lib/hypo-ignore.mjs';
 import {
   parseSchemaVocab,
@@ -554,6 +554,50 @@ const validTypes = new Set([...VALID_TYPES, ...parseSchemaTypes(args.hypoDir)]);
 
 for (const page of pages) lintPage(page, slugMap, tagVocab, pageDirs, validTypes);
 
+// W4 (broken-wikilink only, NOT the full lintPage) for close's root-level
+// write targets that fall outside pages/projects/journal: hot.md and log.md
+// today. closeFileTargetsGlobal is the one list of what close writes
+// (hooks/hypo-shared.mjs), reused here instead of re-derived, so a future
+// close target is covered automatically. Only the entries NOT already under
+// a scanDir are new; closeFileTargetsGlobal's projects/<slug>/* entries are
+// already linted in full above.
+//
+// Why link-only and not the full lintPage: measured, not assumed. On the
+// packaged templates/ (hot.md type:reference, log.md type:log, both declared
+// in templates/SCHEMA.md's taxonomy), full lintPage on both files comes back
+// completely clean, so "these types trip W2" is not the reason to hold back.
+// The real reason is that live vaults do not all match the template. A vault
+// whose SCHEMA.md predates the `log` type row (or has none) gets a fresh
+// "Unknown type: log" W2 the moment log.md is run through lintPage, and a
+// vault whose root log.md predates the frontmatter convention entirely (no
+// leading `---` block at all, confirmed against a real maintainer vault)
+// gets a fresh "No frontmatter found" W1. Both W1 and W2 are in
+// STRICT_PROMOTE_IDS, so under --strict a vault that lint has always passed
+// would start failing on a file whose content this fix never touched. Full
+// lintPage stays reserved for pages/projects/journal, where every file was
+// already being linted before this change and there is no such newly-exposed
+// vault. W4 itself stays warn-only outside --strict, and postApply
+// (crystallize.mjs) gates only on errors, so this addition can add a new
+// warning to a close's lint output but can never fail one.
+const closeRootTargets = [...closeFileTargetsGlobal(args.hypoDir)].filter(
+  (f) => !f.startsWith('pages/') && !f.startsWith('projects/') && !f.startsWith('journal/'),
+);
+for (const rel of closeRootTargets) {
+  const full = join(args.hypoDir, rel);
+  if (!existsSync(full) || isScanIgnored(full, args.hypoDir, ignorePatterns)) continue;
+  let content;
+  try {
+    content = readFileSync(full, 'utf-8');
+  } catch {
+    continue;
+  }
+  for (const link of extractWikilinks(content)) {
+    if (!slugMap.has(link)) {
+      issue('warn', rel, `Broken wikilink: [[${link}]]`, null, 'W4');
+    }
+  }
+}
+
 // W8: design-history.md stale relative to session-log.md. Emitted once per
 // project (not per page) — runs outside the page loop. POSIX-separated path
 // literal (not path.join) so consumers can rely on `file.split('/')` shape

package/scripts/uninstall.mjs

@@ -14,6 +14,15 @@
  *   --force-commands     Remove user-modified slash commands instead of preserving them
  *   --force-extensions   Remove user-modified extension files (hypo-ext-*) instead of preserving them
  *   --hooks-dir=<path>   Override Claude hooks directory (default: ~/.claude/hooks)
+ *   --hypo-dir=<path>    Wiki vault to remove the pre-commit hook from (default: auto-resolve,
+ *                        same rules as init/lint/query)
+ *   --shell-config=<path> Shell rc file to strip the shell block from (default: checks both
+ *                        ~/.zshrc and ~/.bashrc, since init may have run under either shell)
+ *
+ * The wiki's git pre-commit hook and the shell rc's `claude()` wrapper function are removed
+ * only when they still carry the marker init.mjs wrote (WIKI_PRE_COMMIT_MARKER_START /
+ * SHELL_MARKER_START, both from ./lib/git-hooks-dir.mjs). A user's own pre-commit hook, a
+ * symlinked hook target, and any rc content outside the marker block are never touched.
  *
  * Extensions: hypo-ext-* hard-copies under
  * ~/.claude/{hooks,commands,skills,agents}/ and ~/.codex/{hooks,commands}/ (with
@@ -23,7 +32,16 @@
  * does not follow them). The wiki source (~/hypomnema/extensions/) is preserved.
  */
 
-import { existsSync, readFileSync, writeFileSync, rmSync, rmdirSync, readdirSync } from 'fs';
+import {
+  existsSync,
+  readFileSync,
+  writeFileSync,
+  rmSync,
+  rmdirSync,
+  readdirSync,
+  statSync,
+  realpathSync,
+} from 'fs';
 import { join } from 'path';
 import { homedir } from 'os';
 import { fileURLToPath } from 'url';
@@ -48,6 +66,15 @@ import {
   buildHookCommand,
 } from './lib/extensions.mjs';
 import { removeProvenanceSidecar } from './lib/pkg-provenance.mjs';
+import {
+  hooksDirForInstall,
+  unsafeHookTargetReason,
+  WIKI_PRE_COMMIT_MARKER_START,
+  WIKI_PRE_COMMIT_MARKER_END,
+  SHELL_MARKER_START,
+  SHELL_MARKER_END,
+} from './lib/git-hooks-dir.mjs';
+import { resolveHypoRoot, expandHome } from './lib/hypo-root.mjs';
 
 const HOME = homedir();
 const SCRIPT_DIR = fileURLToPath(new URL('.', import.meta.url));
@@ -428,6 +455,182 @@ function stripExtensionSettings(settingsPath, hooksDir, apply, ownedCommands = n
   return { stripped };
 }
 
+// ── marker-span validation (shared by both removal paths below) ────────────
+
+// Two independent indexOf() calls cannot tell "well-formed" apart from
+// "duplicated" or "swapped": if a file happens to hold two full copies of the
+// block, indexOf finds only the first END, so slicing [firstStart, firstEnd]
+// leaves the second copy's install behind with no report of it. If END
+// precedes START (a hand-edited or corrupted file), slicing [start, end) with
+// start > end does not error, it silently duplicates whatever sits between
+// them into the "removed" span. Neither this script nor the file it is
+// touching has a way back from either outcome, so a span is only trusted when
+// both markers appear EXACTLY once and START comes before END.
+function countOccurrences(content, needle) {
+  let count = 0;
+  let idx = 0;
+  while ((idx = content.indexOf(needle, idx)) !== -1) {
+    count++;
+    idx += needle.length;
+  }
+  return count;
+}
+
+function findMarkerSpan(content, startMarker, endMarker) {
+  const startCount = countOccurrences(content, startMarker);
+  const endCount = countOccurrences(content, endMarker);
+  if (startCount !== 1 || endCount !== 1) {
+    return {
+      ok: false,
+      reason: `expected exactly one start and one end marker, found ${startCount} start / ${endCount} end`,
+    };
+  }
+  const startIdx = content.indexOf(startMarker);
+  const endIdx = content.indexOf(endMarker);
+  if (!(startIdx < endIdx)) {
+    return { ok: false, reason: 'the end marker appears before the start marker' };
+  }
+  return { ok: true, startIdx, endIdx };
+}
+
+// ── wiki pre-commit hook removal ────────────────────────────────────────────
+
+// Mirrors init.mjs's own resolution (hooksDirForInstall) as the PRIMARY
+// candidate, so this finds the hook wherever init would put it today,
+// including under a core.hooksPath override. A second, best-effort candidate
+// (the vault's plain .git/hooks/pre-commit) is checked too: if core.hooksPath
+// changed after install, the current resolution no longer points at the file
+// init actually wrote, and that file would otherwise never be found. Both
+// candidates go through the same marker/ownership gate below, so widening the
+// search costs nothing in safety, only in how many places we bother to look.
+// A hook that still carries our marker is removed; a user's own pre-commit (no
+// marker), a symlinked/non-regular target, and a hook whose marker is
+// duplicated, swapped, or missing its shebang are all left standing.
+// `pre-commit.bak` (init's --force-commands backup of the user's original
+// hook) is never removed here, only reported so the user knows it exists.
+function removeWikiPreCommitHook(hypoDir, apply) {
+  const result = { removed: [], skipped: [], bakPresent: [] };
+
+  if (!hypoDir || !existsSync(join(hypoDir, 'hypo-config.md'))) {
+    result.skipped.push(`no Hypomnema vault found${hypoDir ? ` at ${hypoDir}` : ''} — nothing to remove`);
+    return result;
+  }
+
+  const candidateDirs = [];
+  const { dir: hooksDir, skip } = hooksDirForInstall(hypoDir);
+  if (hooksDir) candidateDirs.push(hooksDir);
+  else if (skip) result.skipped.push(skip);
+
+  // Best-effort fallback: only when `.git` is a real directory here (a plain
+  // checkout, not a linked worktree's gitdir-pointer FILE, which this join
+  // would misread entirely — resolveGitHooksDir already handles that layout
+  // correctly via the primary candidate above).
+  const legacyGitDir = join(hypoDir, '.git');
+  if (existsSync(legacyGitDir) && statSync(legacyGitDir).isDirectory()) {
+    candidateDirs.push(join(legacyGitDir, 'hooks'));
+  }
+
+  const seen = new Set();
+  for (const dir of candidateDirs) {
+    const hookPath = join(dir, 'pre-commit');
+    // Dedupe by the resolved real path, not the string: the primary candidate
+    // is realpath'd internally (resolveGitHooksDir's canonicalize) while the
+    // legacy join above is not, so the same physical file can arrive under two
+    // different-looking paths. Falling back to the raw path when the file does
+    // not exist is fine — two distinct absent candidates never collide.
+    let key = hookPath;
+    try {
+      key = realpathSync(hookPath);
+    } catch {
+      // leave key as hookPath
+    }
+    if (seen.has(key)) continue;
+    seen.add(key);
+
+    const bakPath = `${hookPath}.bak`;
+    if (existsSync(bakPath)) result.bakPresent.push(bakPath);
+
+    const unsafe = unsafeHookTargetReason(hookPath);
+    if (unsafe) {
+      result.skipped.push(`${hookPath} (${unsafe})`);
+      continue;
+    }
+    if (!existsSync(hookPath)) continue; // already absent, nothing to report
+
+    let content;
+    try {
+      content = readFileSync(hookPath, 'utf-8');
+    } catch (e) {
+      result.skipped.push(`${hookPath} (cannot read: ${e.code || e.message})`);
+      continue;
+    }
+    if (!content.includes(WIKI_PRE_COMMIT_MARKER_START) || !content.includes(WIKI_PRE_COMMIT_MARKER_END)) {
+      result.skipped.push(`${hookPath} (not managed by Hypomnema — preserving)`);
+      continue;
+    }
+
+    const span = findMarkerSpan(content, WIKI_PRE_COMMIT_MARKER_START, WIKI_PRE_COMMIT_MARKER_END);
+    if (!span.ok) {
+      result.skipped.push(`${hookPath} (${span.reason} — preserving)`);
+      continue;
+    }
+
+    // init writes the marker as the ENTIRE hook body: a bare "#!/bin/sh\n"
+    // right before WIKI_PRE_COMMIT_MARKER_START, nothing after
+    // WIKI_PRE_COMMIT_MARKER_END. A file with no shebang there was never
+    // written by init even if it happens to carry a well-formed marker span
+    // (hand-authored or copy-pasted) — deleting it on marker presence alone
+    // would remove code we do not own. A user who appended their own check
+    // after the block turned this into a file we only partly own. init's own
+    // --force-commands path handles the analogous case by OVERWRITING with
+    // equivalent content (a safe merge); uninstall has no such repair, only
+    // rmSync, so treating "extra content" the same as "fully ours" would
+    // silently delete the user's check with no way back.
+    const before = content.slice(0, span.startIdx);
+    const after = content.slice(span.endIdx + WIKI_PRE_COMMIT_MARKER_END.length);
+    if (!/^#![^\n]*\n$/.test(before)) {
+      result.skipped.push(`${hookPath} (hook carries content before the Hypomnema block — preserving)`);
+      continue;
+    }
+    if (after.trim() !== '') {
+      result.skipped.push(`${hookPath} (hook carries content after the Hypomnema block — preserving)`);
+      continue;
+    }
+
+    if (apply) rmSync(hookPath);
+    result.removed.push(hookPath);
+  }
+
+  return result;
+}
+
+// ── shell function block removal ────────────────────────────────────────────
+
+// init picks ONE rc file at install time from $SHELL (or --shell-config), but
+// $SHELL by uninstall time may point somewhere else, or init may have run in
+// a different shell session altogether — so both common rc files are checked
+// by default rather than guessing one. Only the marker span itself is
+// stripped; every other byte in the file, including surrounding blank lines,
+// is left exactly as it was. A malformed span (duplicated or swapped markers,
+// see findMarkerSpan above) leaves the file completely untouched: an rc file
+// is the user's own, and this script has no backup to restore it from.
+function removeShellFunctionBlock(shellConfigPath, apply) {
+  if (!existsSync(shellConfigPath)) return null;
+  const content = readFileSync(shellConfigPath, 'utf-8');
+  if (!content.includes(SHELL_MARKER_START) && !content.includes(SHELL_MARKER_END)) {
+    return null; // block not present here at all
+  }
+
+  const span = findMarkerSpan(content, SHELL_MARKER_START, SHELL_MARKER_END);
+  if (!span.ok) {
+    return { path: shellConfigPath, removed: false, skipped: span.reason };
+  }
+
+  const updated = content.slice(0, span.startIdx) + content.slice(span.endIdx + SHELL_MARKER_END.length);
+  if (apply) writeFileSync(shellConfigPath, updated);
+  return { path: shellConfigPath, removed: true, skipped: null };
+}
+
 // ── arg parsing ──────────────────────────────────────────────────────────────
 
 function parseArgs(argv) {
@@ -437,6 +640,8 @@ function parseArgs(argv) {
     hooksDir: null,
     forceCommands: false,
     forceExtensions: false,
+    hypoDir: null,
+    shellConfig: null,
   };
   for (const arg of argv.slice(2)) {
     if (arg === '--apply') args.apply = true;
@@ -444,6 +649,16 @@ function parseArgs(argv) {
     else if (arg === '--force-commands') args.forceCommands = true;
     else if (arg === '--force-extensions') args.forceExtensions = true;
     else if (arg.startsWith('--hooks-dir=')) args.hooksDir = arg.slice(12);
+    // expandHome mirrors init.mjs's own --hypo-dir/--shell-config parsing
+    // (init.mjs's parseArgs) exactly, reusing the same function from
+    // ./lib/hypo-root.mjs rather than re-deriving it. Uninstall must undo
+    // whatever path init actually wrote to disk, and init resolves a leading
+    // "~/" itself (the shell never does, since the value arrives already
+    // quoted inside "--flag=value"); skipping that step here would silently
+    // fail to find the vault or rc file a user installed with "~/..." to
+    // begin with.
+    else if (arg.startsWith('--hypo-dir=')) args.hypoDir = expandHome(arg.slice(11));
+    else if (arg.startsWith('--shell-config=')) args.shellConfig = expandHome(arg.slice(15));
   }
   return args;
 }
@@ -589,6 +804,20 @@ const hookResult = removeHookFiles(claudeHooksDir, hookFiles, args.apply);
 const settingsResult = stripSettingsJson(claudeSettings, claudeHooksDir, hookMap, args.apply);
 const commandResult = removeCommands(args.apply, args.forceCommands);
 
+// Wiki-side cleanup: the git pre-commit hook and the shell rc block init.mjs
+// installs outside ~/.claude entirely. Both are independent of --codex/--hooks-dir.
+const hypoDir = args.hypoDir ?? resolveHypoRoot();
+const preCommitResult = removeWikiPreCommitHook(hypoDir, args.apply);
+
+const shellConfigCandidates = args.shellConfig
+  ? [args.shellConfig]
+  : [join(HOME, '.zshrc'), join(HOME, '.bashrc')];
+const shellBlockOutcomes = shellConfigCandidates
+  .map((p) => removeShellFunctionBlock(p, args.apply))
+  .filter(Boolean);
+const shellBlockResults = shellBlockOutcomes.filter((r) => r.removed).map((r) => r.path);
+const shellBlockSkipped = shellBlockOutcomes.filter((r) => !r.removed);
+
 // Extensions. Order matters: remove files first, then strip
 // settings, then surgically clear the per-target SHA map. The SHA strip uses
 // removedKeys so a user-modified file we left in place keeps its recorded SHA
@@ -736,6 +965,27 @@ if (hookResult.missing.length)
   lines.push(
     `⊘ Already absent (${hookResult.missing.length}):\n${hookResult.missing.map((p) => `  ${p}`).join('\n')}`,
   );
+if (preCommitResult.removed.length)
+  lines.push(
+    `✓ Wiki pre-commit hook ${dryRun ? 'to remove' : 'removed'} (${preCommitResult.removed.length}):\n${preCommitResult.removed.map((p) => `  ${p}`).join('\n')}`,
+  );
+if (preCommitResult.skipped.length)
+  lines.push(
+    `⊘ Wiki pre-commit hook preserved:\n${preCommitResult.skipped.map((p) => `  ${p}`).join('\n')}`,
+  );
+if (preCommitResult.bakPresent.length)
+  lines.push(
+    `ⓘ Pre-commit backup left in place (from --force-commands, never touched by uninstall):\n${preCommitResult.bakPresent.map((p) => `  ${p}`).join('\n')}`,
+  );
+if (shellBlockResults.length)
+  lines.push(
+    `✓ Shell function block ${dryRun ? 'to remove' : 'removed'} (${shellBlockResults.length}):\n${shellBlockResults.map((p) => `  ${p}`).join('\n')}`,
+  );
+if (shellBlockSkipped.length)
+  lines.push(
+    `⊘ Shell function block preserved:\n${shellBlockSkipped.map((r) => `  ${r.path} (${r.skipped})`).join('\n')}`,
+  );
+
 if (settingsResult.error) lines.push(`⚠ ${settingsResult.error}`);
 if (claudeExtSettings.error) lines.push(`⚠ ${claudeExtSettings.error}`);
 if (codexExtSettings.error) lines.push(`⚠ ${codexExtSettings.error}`);
@@ -750,7 +1000,9 @@ if (
   !pkgJsonRemoved &&
   !commandResult.skippedUserModified.length &&
   !extSkippedUserModified.length &&
-  !extSkippedNonRegular.length
+  !extSkippedNonRegular.length &&
+  !preCommitResult.removed.length &&
+  !shellBlockResults.length
 ) {
   lines.push('Nothing to uninstall — Hypomnema does not appear to be installed.');
 }

package/templates/hypo-config.md

@@ -1,7 +1,7 @@
 ---
 title: Hypomnema Config
 type: config
-version: "1.7.2"
+version: "1.7.3"
 created: YYYY-MM-DD
 ---