hypomnema 1.7.2 → 1.7.4

package/hooks/hypo-shared.mjs

@@ -445,6 +445,72 @@ export function hypoIsClean(dir = HYPO_DIR) {
   }
 }
 
+/**
+ * Repo-relative POSIX paths with uncommitted changes (tracked or untracked) in
+ * `dir`. Reuses the SAME `-z` rename-aware porcelain parsing as
+ * commitWikiChanges (PR #222): a rename or copy emits `to\0from`, and both
+ * sides count as dirty (a rename's source still shows staged until the rename
+ * itself lands). This is the read-only half of that fix's pathspec boundary:
+ * commitWikiChanges narrows what gets COMMITTED to a caller-supplied scope;
+ * this narrows what counts as a BLOCKER the same way, for precompactGateStatus
+ * to attribute dirty files to the session that owns them instead of the whole
+ * shared working tree.
+ *
+ * Paths are normalized to be relative to `dir` itself, NOT to the git
+ * repository's top level: `git -C <dir> status --porcelain` prints paths
+ * relative to the repo TOP LEVEL even under `-C` (verified empirically: a
+ * vault nested under `<repo>/vault/` reports `vault/hot.md`, not `hot.md`).
+ * Every other path this file compares against (closeAccountableScope,
+ * closeFileTargetsGlobal, extractTouchedWikiFiles) is `dir`-relative, so
+ * without this normalization a nested vault's OWN files would never match
+ * its own scope and every one of them would look foreign (codex pre-commit
+ * review BLOCKER 2). `git rev-parse --show-prefix` gives exactly the prefix
+ * to strip; a dirty path that does not start with it lives outside the
+ * vault entirely (the rest of a bigger host repo) and is dropped, never
+ * "mine".
+ *
+ * @returns {string[]} dirty paths relative to `dir`, or `[]` on any git
+ *   failure (the caller already has its own git-status result via
+ *   hypoIsClean and treats that failure as an unconditional blocker; an
+ *   empty return here just means "cannot attribute", not "clean").
+ */
+function gitDirtyFiles(dir) {
+  const prefixRes = spawnSync('git', ['-C', dir, 'rev-parse', '--show-prefix'], {
+    encoding: 'utf-8',
+  });
+  if (prefixRes.status !== 0) return []; // can't resolve the repo → cannot attribute
+  const prefix = (prefixRes.stdout || '').trim();
+
+  const porcelain = spawnSync('git', ['-C', dir, 'status', '--porcelain', '-uall', '-z'], {
+    encoding: 'utf-8',
+  });
+  if (porcelain.status !== 0) return [];
+  const out = [];
+  const records = (porcelain.stdout || '').split('\0');
+  const toDirRelative = (f) => {
+    if (!f) return null;
+    if (!prefix) return f; // dir IS the repo top level, nothing to strip
+    return f.startsWith(prefix) ? f.slice(prefix.length) : null; // outside the vault
+  };
+  for (let i = 0; i < records.length; i++) {
+    const rec = records[i];
+    if (!rec) continue;
+    const xy = rec.slice(0, 2);
+    const file = rec.slice(3); // destination path for a rename/copy
+    const isRenameOrCopy = xy[0] === 'R' || xy[1] === 'R' || xy[0] === 'C' || xy[1] === 'C';
+    let fromFile = null;
+    if (isRenameOrCopy) {
+      i++;
+      fromFile = records[i] || null;
+    }
+    const rel = toDirRelative(file);
+    if (rel) out.push(rel);
+    const relFrom = toDirRelative(fromFile);
+    if (relFrom) out.push(relFrom);
+  }
+  return out;
+}
+
 export function hotMdIsClean(dir = HYPO_DIR) {
   const hotPath = dir === HYPO_DIR ? HOT_PATH : join(dir, 'hot.md');
   if (!existsSync(hotPath)) return { clean: true };
@@ -3281,22 +3347,32 @@ function toHypoRel(absPath, hypoDir) {
 }
 
 /**
- * Repo-relative POSIX paths of wiki files this session edited via direct
- * Edit/Write/MultiEdit/NotebookEdit tool_use. Returns a Set; empty when the
- * transcript is missing/unreadable (callers decide the fallback). A per-line
- * JSON parse error skips that line only (transcripts occasionally truncate).
+ * Same walk as extractTouchedWikiFiles, but also reports whether the walk can
+ * be TRUSTED as a complete enumeration: `trusted: false` when the transcript
+ * is missing, unreadable, or contains a line that failed to parse (transcripts
+ * occasionally truncate mid-write). `extractTouchedWikiFiles` collapses all of
+ * that to an empty/partial Set, indistinguishable from "this session touched
+ * nothing", which is fine for lint's existing debt-partition (a false notice is not a
+ * false pass), but NOT fine for an attribution-sensitive caller like
+ * precompactGateStatus's git-scope check: treating an untrustworthy empty Set
+ * as "nothing to widen" would let a session's own dirty file, invisible only
+ * because its transcript could not be read, pass as someone else's foreign
+ * debt (codex pre-commit review BLOCKER 1).
+ *
+ * @returns {{files: Set<string>, trusted: boolean}}
  */
-export function extractTouchedWikiFiles(transcriptPath, hypoDir) {
+export function extractTouchedWikiFilesWithTrust(transcriptPath, hypoDir) {
   const out = new Set();
   if (!transcriptPath || typeof transcriptPath !== 'string' || !existsSync(transcriptPath)) {
-    return out;
+    return { files: out, trusted: false };
   }
   let raw;
   try {
     raw = readFileSync(transcriptPath, 'utf-8');
   } catch {
-    return out;
+    return { files: out, trusted: false };
   }
+  let trusted = true;
   for (const line of raw.split('\n')) {
     const t = line.trim();
     if (!t) continue;
@@ -3304,6 +3380,7 @@ export function extractTouchedWikiFiles(transcriptPath, hypoDir) {
     try {
       entry = JSON.parse(t);
     } catch {
+      trusted = false; // a truncated/corrupt line: the walk may be incomplete
       continue;
     }
     for (const fp of extractTranscriptToolFilePaths(entry)) {
@@ -3311,7 +3388,19 @@ export function extractTouchedWikiFiles(transcriptPath, hypoDir) {
       if (rel) out.add(rel);
     }
   }
-  return out;
+  return { files: out, trusted };
+}
+
+/**
+ * Repo-relative POSIX paths of wiki files this session edited via direct
+ * Edit/Write/MultiEdit/NotebookEdit tool_use. Returns a Set; empty when the
+ * transcript is missing/unreadable (callers decide the fallback). A per-line
+ * JSON parse error skips that line only (transcripts occasionally truncate).
+ * A caller that needs to tell "genuinely empty" apart from "could not fully
+ * enumerate" wants extractTouchedWikiFilesWithTrust instead.
+ */
+export function extractTouchedWikiFiles(transcriptPath, hypoDir) {
+  return extractTouchedWikiFilesWithTrust(transcriptPath, hypoDir).files;
 }
 
 /**
@@ -3539,20 +3628,89 @@ export function precompactGateStatus(hypoDir, opts = {}) {
   const marker = opts.sessionId ? readSessionClosedMarker(hypoDir, opts.sessionId) : null;
   const logOnly = opts.logOnly === true || marker?.scope === 'log-only';
 
-  // 1. wiki git state. Uncommitted changes (real unsaved work) BLOCK:
-  //    they are human-fixable. Unpushed commits (ahead) DEMOTE to a notice: push is
+  // Paths this session is accountable for at THIS close: the same signals the
+  // lint partition below already trusts for exactly this question ("is this
+  // file mine or pre-existing debt"), hoisted so the git check (step 1) can
+  // partition on it too. Base = the mandatory close-target files (opts.lintScope
+  // override, else the log-only shared root files, else one project's close
+  // files under projectOverride, else every today-active project's); widened by
+  // every file this session's transcript shows it editing directly.
+  const closeAccountableScope = new Set(
+    opts.lintScope ||
+      (logOnly
+        ? ['hot.md', 'log.md']
+        : opts.projectOverride
+          ? closeFileTargetsForProject(hypoDir, opts.projectOverride)
+          : closeFileTargetsGlobal(hypoDir)),
+  );
+  // Trust signal for the git-scope check below (codex pre-commit review
+  // BLOCKER 1): closeAccountableScope's mandatory-files base is always
+  // reliable, but the transcript widening that catches an ad hoc page this
+  // session edited is only as good as the transcript. No opts.transcriptPath
+  // at all, an unreadable file, or a line that fails to parse all mean the
+  // widened scope may be under-inclusive, NOT that this session touched
+  // nothing extra. Only a fully-read, fully-parsed transcript earns
+  // sessionTouchTrusted:true. A single tool_use with no file_path does NOT
+  // lower trust: most tool_use blocks (Read, Bash, Grep, ...) never carry one
+  // and that is expected, not corruption, so treating it as untrustworthy
+  // would make almost every real transcript untrusted and defeat the scoping
+  // this fix exists to add.
+  let sessionTouchTrusted = false;
+  if (opts.transcriptPath) {
+    const widened = extractTouchedWikiFilesWithTrust(opts.transcriptPath, hypoDir);
+    sessionTouchTrusted = widened.trusted;
+    for (const f of widened.files) closeAccountableScope.add(f);
+  }
+
+  // 1. wiki git state. Uncommitted changes (real unsaved work) BLOCK, but only
+  //    the ones inside closeAccountableScope, and only when sessionTouchTrusted
+  //    (above) says that scope can actually be trusted: a session's own scoped
+  //    auto-commit (commitWikiChanges, PR #222) can leave the working tree
+  //    non-empty when a DIFFERENT session sharing this vault still has its own
+  //    file dirty, the 2026-08-03 multi-session block. That dirty file is
+  //    human-fixable by whoever owns it, not by this session, so it demotes to
+  //    a notice (listed by path, never silently dropped) instead of refusing
+  //    this session's marker. A dirty file THIS session owns still blocks
+  //    unconditionally (fail-closed is unchanged for scope this session
+  //    actually touched), and so does an unattributable state: a git failure
+  //    gitDirtyFiles can't enumerate (dirty.length === 0 despite
+  //    git.uncommitted === true), OR a scope we cannot trust
+  //    (!sessionTouchTrusted) both fall back to the original unscoped blocker:
+  //    "cannot attribute" is not "clean".
+  //    Unpushed commits (ahead) DEMOTE to a notice regardless of scope: push is
   //    automatic (auto-commit Stop hook) and its failures are already non-fatal, so
   //    "ahead" is a transient sync state, not a human-fixable blocker. Demoting it
   //    here (the shared gate) keeps the marker == compact-ready invariant:
   //    a committed-but-unpushed close marks AND compacts, instead of the close writer
   //    committing its own payload and then being blocked by its own (unpushed) commit.
   const git = hypoIsClean(hypoDir);
-  if (git.uncommitted) blockers.push({ type: 'git', reason: git.reason });
-  else if (git.ahead)
+  if (git.uncommitted) {
+    const dirty = gitDirtyFiles(hypoDir);
+    if (dirty.length === 0 || !sessionTouchTrusted) {
+      blockers.push({ type: 'git', reason: git.reason });
+    } else {
+      const mine = dirty.filter((f) => closeAccountableScope.has(posixPath(f)));
+      const foreign = dirty.filter((f) => !closeAccountableScope.has(posixPath(f)));
+      if (mine.length > 0) {
+        blockers.push({
+          type: 'git',
+          reason: `uncommitted changes in ${hypoDir}: ${mine.join(', ')}`,
+        });
+      }
+      for (const f of foreign) {
+        notices.push({
+          type: 'git',
+          file: f,
+          reason: `uncommitted changes outside this session's scope: ${f}`,
+        });
+      }
+    }
+  } else if (git.ahead) {
     notices.push({
       type: 'git-sync',
       reason: `unpushed commits in ${hypoDir} (push deferred to Stop hook)`,
     });
+  }
 
   // 2. root hot.md structure
   const hot = hotMdIsClean(hypoDir);
@@ -3762,25 +3920,13 @@ export function precompactGateStatus(hypoDir, opts = {}) {
       const parsed = JSON.parse(r.stdout);
       const allErrors = parsed.errors || [];
       const allW8 = (parsed.warns || []).filter((w) => w.id === 'W8');
-      // log-only base scope = the shared root files only (hot.md / log.md) — NOT
-      // closeFileTargetsGlobal, which would fold the active/phantom project's
-      // mandatory files in and re-introduce the cross-project attribution. The
-      // session's own transcript-touched files are still added below (a log-only
-      // session is accountable for the wiki files it actually edited).
-      // Lint scope: explicit opts.lintScope wins; else log-only uses the shared
-      // root files only; else projectOverride narrows to that one project's close
-      // files (matching the narrowed close status above); else the global set.
-      const scope = new Set(
-        opts.lintScope ||
-          (logOnly
-            ? ['hot.md', 'log.md']
-            : opts.projectOverride
-              ? closeFileTargetsForProject(hypoDir, opts.projectOverride)
-              : closeFileTargetsGlobal(hypoDir)),
-      );
-      if (opts.transcriptPath && existsSync(opts.transcriptPath)) {
-        for (const f of extractTouchedWikiFiles(opts.transcriptPath, hypoDir)) scope.add(f);
-      }
+      // Lint scope = closeAccountableScope, hoisted above step 1 so the git
+      // check can partition on the same "is this mine" answer. See that
+      // hoisted comment for what feeds it (opts.lintScope override, else
+      // log-only's shared root files, else one project's close files under
+      // projectOverride, else the global set, widened by transcript-touched
+      // files).
+      const scope = closeAccountableScope;
       const part = partitionLintScope(allErrors, scope);
       if (part.blocking.length > 0) {
         blockers.push({
@@ -4160,9 +4306,41 @@ export function isClosePattern(text) {
   return [...krPatterns, ...enPatterns].some((re) => re.test(text));
 }
 
+/**
+ * Retraction TRIPWIRE for the close gate — a mitigation that can only CLOSE the
+ * gate, never open it. The gate no longer has its old per-turn overwrite (any
+ * typed text that was not a close phrase used to expire the approval outright),
+ * because an unknown typed phrase must not silently retract an approval the
+ * user actually gave — that is what turned the close skill's own "did you mean
+ * X or Y" reflection question into a false retraction. Under the new
+ * rule, typed text that is neither a close phrase nor a retraction phrase is
+ * NEUTRAL: it leaves the gate exactly where it was.
+ *
+ * This function is the one deliberate exception, and its asymmetry is the
+ * safety property: a phrase MISSING from the corpus below just falls through
+ * to neutral, which is the ordinary, already-accepted behaviour of an unknown
+ * typed message. So the corpus can be grown at any time without weakening an
+ * existing guarantee — the worst case of a miss is a gate that stays open,
+ * not one that opens when it should not. That asymmetry is also why this is
+ * NOT a counterexample to the rule that a defence is written as an effect,
+ * not a name list: a name list is dangerous exactly when it backs a GRANT,
+ * because the one name missing from it is a silent bypass. Here the missing
+ * name is a silent no-op.
+ *
+ * If this function is ever consumed by an opening decision instead of a
+ * closing one, that asymmetry disappears and the rule for an unknown
+ * value (route to the cautious branch) applies again — do not repurpose it
+ * without re-deriving the corpus under that rule.
+ */
+export function isCloseRetractionPattern(text) {
+  if (!text || typeof text !== 'string') return false;
+  const patterns = [/아\s*잠깐,?\s*이(?:것도|거)\s*(?:먼저\s*)?고쳐줘/, /하나만\s*더\s*해줘/];
+  return patterns.some((re) => re.test(text));
+}
+
 // ── close ARTIFACTS, not the marker (issue: close gate lives on one writer) ──
 //
-// hasUserCloseSignal/isClosePattern answer "did the user ask to close" — the
+// isCloseGateOpen/isClosePattern answer "did the user ask to close" — the
 // input side of the gate. This answers a different question: "does this file
 // or commit message already READ as closed to a human", independent of
 // whether any marker writer ever ran. The 2026-07-28 incident produced a
@@ -4318,77 +4496,69 @@ export function resolveTranscriptBySessionId(
 }
 
 /**
- * Returns true iff the transcript's LATEST live user decision is to close — the
- * hard gate for the session-closed marker writers. This is a state predicate, not
- * an existence one: "is close still approved right now", not "did a
- * close signal ever appear". Scans the FULL transcript in line order, classifies
- * each record, and tracks the approval as a LEASE.
+ * Internal walk: does this transcript's typed/queued/answered event history
+ * currently leave the close gate OPEN? This is the TRANSCRIPT axis only — a
+ * resolution recorded separately in the vault (`close-gate-store.mjs`)
+ * can only narrow this result further, never widen it, and is computed
+ * elsewhere entirely.
  *
  * Classification (structural fields only — never content heuristics for producer):
- *   • GRANT      a genuine user close: an NL close phrase in user text that
- *                survives {@link eventUserText}'s exclusions; a `/compact`
- *                queue-op; a remove-path queued_command attachment carrying a
- *                close with an audited human producer (origin.kind "human"); a
- *                correlated, non-error AskUserQuestion answer naming a close.
- *   • INVALIDATE a fresh user intent that expires the lease: any other genuine
- *                user text, `/clear`, `popAll`, a non-close queued_command, a
- *                non-close AskUserQuestion selection.
- *   • NEUTRAL    additionally: a typed `apply-proposals <nonce>` whose nonce this
- *                transcript shows `proposal challenge` minting (see "the approval
- *                line" below).
- *   • NEUTRAL    everything the model can produce or the harness injects: system/
- *                sdk replay, isMeta bodies, sidechain, interruptedMessageId
- *                companions, assistant, tool_result, task-notification.
- *   • FATAL      an unparseable line — the transcript is being appended to or is
- *                corrupt, so refuse rather than read a half-written record.
- *
- * The last grant wins and a later invalidate expires it, so a stale close (Defect
- * B), a queued "keep working" after a close, and a non-close AskUserQuestion
- * selection all correctly read as NOT closed. Abandoned-branch staleness is a
- * known limit (no leaf pointer exists to resolve it — see the branch note on the
- * function), mitigated by the lease.
- *
- * THE APPROVAL LINE IS NOT A CHANGE OF MIND. The lease exists to catch a user who
- * changed their mind, and it also caught the user for doing what the close
- * procedure told them to do. `proposal challenge` instructs the user to type
- * `apply-proposals <nonce>`, which can never be a close phrase, so typing it
- * expired the close grant given a turn earlier (measured 2026-08-06: the close
- * needed three approval round trips because of it). Two gates read one transcript
- * under two rules, and passing one broke the other.
+ *   • OPEN    a genuine user close: an NL close phrase in user text that
+ *             survives {@link eventUserText}'s exclusions; a `/compact`
+ *             queue-op; a remove-path queued_command attachment carrying a
+ *             close with an audited human producer (origin.kind "human"); a
+ *             correlated, non-error AskUserQuestion answer naming a close.
+ *   • CLOSE   a fresh user intent that closes the gate: `/clear`, `popAll`, a
+ *             non-close queued_command, a decline answering an AskUserQuestion
+ *             whose own prompt carried {@link CLOSE_RECONFIRM_MARK} (ours, so
+ *             the decline rejects OUR close question and nobody else's), or
+ *             typed text matching {@link isCloseRetractionPattern} (the
+ *             retraction tripwire). Two things that used to close no longer do:
+ *             plain typed text that is merely not a close phrase, and an
+ *             ordinary non-close answer to an unmarked question. Both are
+ *             NEUTRAL below.
+ *   • NEUTRAL everything the model can produce or the harness injects: system/
+ *             sdk replay, isMeta bodies, sidechain, interruptedMessageId
+ *             companions, a command-invocation record, assistant,
+ *             tool_result, task-notification — and, under the current rule, any typed
+ *             text that is neither a close phrase nor a retraction phrase. An
+ *             unrecognized message must not silently close a gate the user
+ *             already opened; that per-turn overwrite (`granted =
+ *             isClosePattern(userText)` on every typed record) is exactly what
+ *             produced the close skill's own reflection question reading as a
+ *             retraction, and is what this walk replaces.
+ *   • FATAL   an unparseable line — the transcript is being appended to or is
+ *             corrupt, so refuse rather than read a half-written record.
  *
- * So one carve-out: a user message that IS the approval line, for a nonce this
- * transcript shows being minted, is NEUTRAL. It never grants; a lease that was not
- * already live stays dead. The mint has to be correlated, not merely present:
- * `collectMinted` reads only a tool_result correlated to a Bash tool_use, and only
- * when the surrounding challenge framing is there too, so a hex the model typed in
- * its own prose (or any other tool's output) is not a mint. Order is part of it:
- * the set fills as the walk goes, so a message can never mint the nonce it spends.
- * An unminted hex is ordinary text and still expires the lease.
+ * The last OPEN/CLOSE event wins, so a stale close (Defect B), a queued "keep
+ * working" after a close, and a non-close AskUserQuestion selection all
+ * correctly read as not open. Abandoned-branch staleness is a known limit (no
+ * leaf pointer exists to resolve it — see the branch note in the body),
+ * mitigated the same way: any later live user intent, on any branch, still
+ * closes it.
  *
- * What this does NOT cover: an AskUserQuestion answer during the close procedure
- * (the skill's Step 1a reflections) still expires the lease. A carve-out was
- * written for it and withdrawn, because "the answer does not read as a retraction"
- * is fail-open on an open class of phrasings, and this repo routes an unknown value
- * to the cautious branch. Recognizing a close-procedure answer POSITIVELY needs a
- * marker on the question, and the model authors the question. The round trip stays.
+ * The typed `apply-proposals <nonce>` approval line no longer needs its own
+ * carve-out. It used to: the old per-turn rule closed on ANY typed text that
+ * was not itself a close phrase, and the approval line the close procedure
+ * instructs the user to type can never BE a close phrase — so following that
+ * instruction closed the gate the instruction was for (measured 2026-08-06:
+ * three round trips to close because of it). With the per-turn overwrite gone,
+ * the approval line is ordinary typed text — neither a close phrase nor a
+ * retraction phrase — so it falls to NEUTRAL by the same rule every other
+ * unrecognized message gets, with no special case required.
  *
  * Threat model: an honest-but-drifting model that does not forge the
- * transcript. This is a safety interlock, not an authorization boundary — a model
- * that forges records is out of scope and documented so. The carve-out does not
- * move that boundary: it only PRESERVES a grant the user already gave, so the model
- * still cannot manufacture one. The residual it does carry: a model that runs an
- * arbitrary Bash command can print the challenge framing itself and plant a mint.
- * That buys it nothing on its own, because the user still has to send the approval
- * line, and the result is neutrality rather than a grant.
+ * transcript. This is a safety interlock, not an authorization boundary — a
+ * model that forges records is out of scope and documented so.
  *
- * A command invocation is NOT a channel here. `/hypo:crystallize` typed by the user
- * was accepted as a grant for one review round and removed: the harness records a
- * model-issued Skill call as the same non-meta `<command-name>` user record
- * (verified against Claude Code 2.1.243's `processPromptSlashCommand`), so the
- * model could have closed the session by calling its own skill. The premise that a
- * command tag proves a human typed it is false.
+ * Fail-closed: any read/parse error → not open.
  *
- * Fail-closed: any read/parse error, or an unresolvable branch, → false.
+ * @returns {{open: boolean, openedAtIndex: number}} `openedAtIndex` is the
+ *   position, in the FATAL-filtered record array this walk builds internally
+ *   (blank lines dropped, non-object JSON values dropped, first parse failure
+ *   returns early), of the most recent event that opened the gate, or -1 if
+ *   none ever did. `close-gate-store.mjs`'s `resolutionStamp` counts records
+ *   by the same definition, so the two indices are comparable.
  */
 // Genuine user text of a record, or null when the record is on a channel the
 // honest-but-drifting model can reach (so it is never user intent — NEUTRAL).
@@ -4403,10 +4573,20 @@ export function resolveTranscriptBySessionId(
 //                       companion of a delivered /compact)
 //   • Stop-hook feedback  the hook's own close nudge — circular
 //   • tool_result blocks  tool output, not typed text
+//   • a command-invocation tag (<command-name>/<command-message>/<command-args>)
+//     anywhere in the text. Claude Code routes a model-issued Skill
+//     call through the same processPromptSlashCommand path a human's typed
+//     `/hypo:crystallize` goes through, and both land as this identical
+//     non-meta role:user record — so a tag proves nothing about who produced
+//     it. Excluding the whole text, not just the tag substring, means a close
+//     phrase riding along in <command-args> (e.g. `/hypo:crystallize 세션
+//     마무리해줘`) cannot open the gate either; the user still opens it by
+//     saying the same words in plain text.
 // No promptSource allowlist is required: requiring `typed` would drop the
 // legacy absent-promptSource close the older gate has always honoured, while the
 // dangerous replay/injection paths carry system|sdk|isMeta|isSidechain and are
 // excluded here anyway.
+const COMMAND_INVOCATION_TAG = /<command-(?:name|message|args)>/;
 function eventUserText(obj) {
   if (obj.isMeta === true) return null;
   if (obj.promptSource === 'system' || obj.promptSource === 'sdk') return null;
@@ -4416,16 +4596,42 @@ function eventUserText(obj) {
   const role = msg.role ?? obj.role ?? obj.type;
   if (role !== 'user') return null;
   const content = msg.content ?? obj.content;
+  let text = null;
   if (typeof content === 'string') {
-    return content.startsWith('Stop hook feedback') ? null : content;
-  }
-  if (Array.isArray(content)) {
+    text = content.startsWith('Stop hook feedback') ? null : content;
+  } else if (Array.isArray(content)) {
     const texts = content
       .filter((b) => b && b.type === 'text' && typeof b.text === 'string')
       .map((b) => b.text);
-    return texts.length ? texts.join('\n') : null;
+    text = texts.length ? texts.join('\n') : null;
+    // A command-invocation tag split across adjacent text blocks (e.g.
+    // '<command-na' + 'me>/hypo:crystallize</command-name>') would survive the
+    // '\n'-joined `text` above with a newline spliced into the middle of the
+    // tag name, so the plain check below can miss it entirely. Today's actual
+    // host format sends the whole invocation as ONE string, so this exact
+    // split is not reproducible against a live session yet — but a check for
+    // "did the host format ever put the tag exactly on a block boundary"
+    // should not depend on where a future host happens to cut the blocks. So
+    // also test each run of CONSECUTIVE text blocks joined with no separator.
+    // This must stay scoped to consecutive text blocks only, never the whole
+    // array: joining across a non-text block in between (an image, say) would
+    // synthesize a tag that never existed in the real content, and that is a
+    // different bug, not a fix — it would throw away a genuine close spoken
+    // next to an unrelated attachment. So a non-text block ends the current
+    // run and starts a new one; it never bridges two runs into one string.
+    let tightRun = '';
+    for (const b of content) {
+      if (b && b.type === 'text' && typeof b.text === 'string') {
+        tightRun += b.text;
+        continue;
+      }
+      if (COMMAND_INVOCATION_TAG.test(tightRun)) return null;
+      tightRun = '';
+    }
+    if (COMMAND_INVOCATION_TAG.test(tightRun)) return null;
   }
-  return null;
+  if (text != null && COMMAND_INVOCATION_TAG.test(text)) return null;
+  return text;
 }
 
 // A record on a channel the honest-but-drifting model can reach, so it can never
@@ -4440,17 +4646,17 @@ function isModelReachableRecord(obj) {
   );
 }
 
-export function hasUserCloseSignal(transcriptPath) {
-  if (!transcriptPath) return false;
+export function walkCloseGate(transcriptPath) {
+  if (!transcriptPath) return { open: false, openedAtIndex: -1 };
   let raw;
   try {
     raw = readFileSync(transcriptPath, 'utf-8');
   } catch {
-    return false;
+    return { open: false, openedAtIndex: -1 };
   }
   // FATAL: a non-empty line that will not parse means the transcript is being
   // appended to (a half-written record) or is corrupt. Skipping it would let a
-  // stale prior grant survive past an event we cannot read, so refuse. A line
+  // stale prior open survive past an event we cannot read, so refuse. A line
   // that parses to a non-object (a bare null / string / number) is valid JSON but
   // not a record — noise, not corruption — so it is skipped, not fatal, and never
   // reaches the field reads below.
@@ -4461,136 +4667,121 @@ export function hasUserCloseSignal(transcriptPath) {
     try {
       o = JSON.parse(line);
     } catch {
-      return false;
+      return { open: false, openedAtIndex: -1 };
     }
     if (o === null || typeof o !== 'object') continue;
     recs.push(o);
   }
 
-  // The approval is a LEASE, not an existence fact: walk the transcript in line
-  // order and track whether the LATEST user decision is a grant. Each grant sets
-  // it true, each invalidate sets it false, neutral leaves it — so at the end
-  // `granted` is "the most recent user decision was to close, and nothing has
-  // expired it since", which is how a stale close and a queued change-of-mind
-  // read as NOT closed.
+  // Walk the transcript in line order and track whether the LATEST event opened
+  // or closed the gate — last event wins, so a stale open and a queued
+  // change-of-mind both correctly read as closed.
   //
   // Branch note: line order mixes an abandoned branch's records with the live
   // ones. A leaf-pointer ancestry filter was tried and withdrawn — the transcript
   // carries no authoritative leaf pointer (measured: 0 leafUuid / summary
-  // records), so a heuristic leaf can skip the real invalidator and PRESERVE a
-  // stale grant (a fail-open, not a conservative filter). Until such a pointer
-  // exists, a close on a branch abandoned under a neutral tail is a known
-  // staleness limit, mitigated by the lease: any later live user intent, on any
-  // branch, still expires it.
+  // records), so a heuristic leaf can skip the real closing event and PRESERVE a
+  // stale open (a fail-open, not a conservative filter). Until such a pointer
+  // exists, an open on a branch abandoned under a neutral tail is a known
+  // staleness limit, mitigated the same way: any later live user intent, on any
+  // branch, still closes it.
   const askIds = new Set();
-  // Bash tool_use ids, so a mint can be tied to a command that actually ran rather
-  // than to any string in the file. Filled in the same content scan as askIds.
-  const bashIds = new Set();
-  let granted = false;
-  // The nonces this transcript shows `proposal challenge` minting. Producer, not
-  // just presence: the hex has to arrive in a NON-error tool_result of a Bash
-  // tool_use, wrapped in the challenge's own framing. Model prose carrying a
-  // plausible hex, an isMeta/system body, and any other tool's output all fail
-  // that, which matters because a mint neutralizes the user's next message. The
-  // set fills as the walk goes, so a message cannot mint the nonce it spends.
-  const mintedNonces = new Set();
-  const challengeMint = new RegExp(
-    `must type this line in the conversation:\\s*${APPROVAL_PHRASE} ([a-f0-9]{32,})\\s*Then run: hypomnema proposal resolve`,
-    'g',
-  );
-  const approvalLine = new RegExp(`^${APPROVAL_PHRASE}\\s+([a-f0-9]{32,})$`);
-  const collectMinted = (o) => {
-    const c = (o.message ?? o).content;
-    if (!Array.isArray(c)) return;
-    for (const b of c) {
-      if (!b || typeof b !== 'object') continue;
-      if (b.type !== 'tool_result' || !b.tool_use_id || !bashIds.has(b.tool_use_id)) continue;
-      if (b.is_error === true) continue;
-      const text = typeof b.content === 'string' ? b.content : JSON.stringify(b.content);
-      if (typeof text !== 'string' || !text.includes(APPROVAL_PHRASE)) continue;
-      for (const m of text.matchAll(challengeMint)) mintedNonces.add(m[1]);
-    }
-  };
-
-  for (const o of recs) {
+  // Subset of askIds whose tool_use input carries CLOSE_RECONFIRM_MARK, i.e.
+  // it IS our close-reconfirm prompt, not some unrelated question the model
+  // happens to ask around the same time. Same correlation guard
+  // isCloseReconfirmDeclined uses (see its doc comment below), reimplemented
+  // here rather than calling that function: its re-arm rule only recognizes a
+  // typed close phrase, which misses the three new openers this walk already
+  // tracks (a queued /compact, a human-origin queued delivery, an
+  // AskUserQuestion close answer). Driving decline off this walk instead means
+  // any of those already reopens the gate for free, with no separate re-arm
+  // rule to keep in sync.
+  const markedAskIds = new Set();
+  let open = false;
+  let openedAtIndex = -1;
+
+  for (let i = 0; i < recs.length; i++) {
+    const o = recs[i];
     // Genuine user text of this record, or null when the record is on a channel
-    // the model can reach. Computed once here: the mint scan below is the exact
-    // complement of it (mint from everything that is NOT the user's own text).
+    // the model can reach (including a command-invocation record).
     const userText = eventUserText(o);
-    if (userText == null) collectMinted(o);
 
     // Queue operations. The queue carries no correlation key (measured), so the
     // ENQUEUE content is the decision — not a later contentless dequeue, which
     // would need pairing we cannot do. Reading the enqueue also keeps the live
     // PreCompact gate working (it sees the enqueue) and avoids double-counting the
     // replay companion of an already-decided item (the /compact replay is not a
-    // fresh decision). popAll cancels the queue → invalidate. Delivery ops
+    // fresh decision). popAll cancels the queue → close. Delivery ops
     // (dequeue, remove) carry no fresh decision here — a content-bearing remove of
     // an NL queued command is handled by its queued_command attachment below.
     if (o.type === 'queue-operation') {
       if (o.operation === 'popAll') {
-        granted = false;
+        open = false;
         continue;
       }
       if (o.operation !== 'enqueue') continue;
       const c = typeof o.content === 'string' ? o.content.trim() : '';
-      if (/^\/compact(?:\s|$)/.test(c))
-        granted = true; // a user compaction preserves the work → grant
-      else if (/^\/clear(?:\s|$)/.test(c))
-        granted = false; // abandons context → invalidate
-      else if (!c || c.startsWith('<task-notification>')) {
+      if (/^\/compact(?:\s|$)/.test(c)) {
+        open = true; // a user compaction preserves the work → open
+        openedAtIndex = i;
+      } else if (/^\/clear(?:\s|$)/.test(c)) {
+        open = false; // abandons context → close
+      } else if (!c || c.startsWith('<task-notification>')) {
         /* model-caused / empty — neutral */
       } else if (isClosePattern(c)) {
         /* NL close via the queue — the open dequeue gap: the producer cannot be
-           attributed (a peer/model enqueue wears the same shape), so no grant */
-      } else granted = false; // a queued non-close user intent → invalidate (change of mind)
+           attributed (a peer/model enqueue wears the same shape), so no open */
+      } else open = false; // a queued non-close user intent → close (change of mind)
       continue;
     }
 
     // remove-path delivery of a queued natural-language command (measured: the
     // item leaves the queue as it is handed to the model, landing as an
-    // `attachment` of type queued_command with the prompt verbatim). A close here
-    // grants ONLY with an audited human producer — origin.kind "human", present
+    // `attachment` of type queued_command with the prompt verbatim). This opens
+    // the gate ONLY with an audited human producer — origin.kind "human", present
     // on every 2.1.181+ user delivery (measured). A legacy origin-absent delivery
-    // cannot attest a producer, so it does not grant (fail-closed). A NON-close
-    // queued command (e.g. "keep working") is a fresh user intent and INVALIDATES
-    // a prior grant regardless of origin — that is what closes the re-close hole
-    // where a queued "continue" after a close leaves the stale lease live.
+    // cannot attest a producer, so it does not open (fail-closed). A NON-close
+    // queued command (e.g. "keep working") is a fresh user intent and CLOSES
+    // a prior open regardless of origin — that is what closes the re-close hole
+    // where a queued "continue" after a close leaves the stale open live.
     if (o.type === 'attachment' && o.attachment && o.attachment.type === 'queued_command') {
       const prompt = typeof o.attachment.prompt === 'string' ? o.attachment.prompt : '';
       const humanOrigin = !!(o.attachment.origin && o.attachment.origin.kind === 'human');
       if (isClosePattern(prompt)) {
-        if (humanOrigin) granted = true;
+        if (humanOrigin) {
+          open = true;
+          openedAtIndex = i;
+        }
       } else if (prompt) {
-        granted = false;
+        open = false;
       }
       continue;
     }
 
     // Record AskUserQuestion tool_use ids (assistant record, always precedes its
-    // answer in line order). Bash ids ride along in the same scan, for the mint
-    // correlation above.
+    // answer in line order), and separately mark the ones that ARE our
+    // close-reconfirm prompt (input carries CLOSE_RECONFIRM_MARK).
     const content = (o.message ?? o).content;
     if (Array.isArray(content)) {
       for (const b of content) {
         if (!b || typeof b !== 'object' || b.type !== 'tool_use' || !b.id) continue;
-        if (b.name === 'AskUserQuestion') askIds.add(b.id);
-        else if (b.name === 'Bash') bashIds.add(b.id);
+        if (b.name !== 'AskUserQuestion') continue;
+        askIds.add(b.id);
+        if (JSON.stringify(b.input ?? null).includes(CLOSE_RECONFIRM_MARK)) markedAskIds.add(b.id);
       }
     }
 
-    // Genuine user text → grant on a close phrase, invalidate on anything else,
-    // minus the one carve-out for what the product itself asked the user to send.
+    // Genuine typed user text. A close phrase opens the gate; the retraction
+    // tripwire closes it; everything else is neutral (an
+    // unrecognized phrase must not silently close a gate the user opened, so
+    // there is no default "else close" branch here the way there used to be).
     if (userText != null && userText !== '') {
-      const spend = approvalLine.exec(userText.trim());
-      if (spend && mintedNonces.has(spend[1])) {
-        // The approval line `proposal challenge` tells the user to type, bound to a
-        // nonce this transcript minted. Neutral, never a grant: an untouched
-        // `granted` that was false stays false. An unminted hex is ordinary text and
-        // falls through to the invalidating branch below.
-        continue;
+      if (isClosePattern(userText)) {
+        open = true;
+        openedAtIndex = i;
+      } else if (isCloseRetractionPattern(userText)) {
+        open = false;
       }
-      granted = isClosePattern(userText);
       continue;
     }
 
@@ -4599,7 +4790,20 @@ export function hasUserCloseSignal(transcriptPath) {
     // record from reaching the answer parser. is_error:false AND the host's
     // success marker are required because a malformed AskUserQuestion echoes the
     // raw input back in an is_error result, and the model authors the option
-    // labels. A close selection grants; any other real selection invalidates.
+    // labels.
+    //
+    // T5: a close phrase in the answer opens the gate, same as before. But a
+    // decline no longer closes it on its own: only a decline answering a
+    // MARKED prompt (ours, see markedAskIds above) does. Every other answer,
+    // including a non-close, non-decline click and a decline to an unmarked
+    // question, is neutral. The old default (any other real selection closed
+    // the gate) let a reflection question the close skill's own Step 1a asks
+    // mid-procedure cancel the approval that started that procedure: the
+    // model asks something adjacent, the user answers plainly, and the answer
+    // was not a close phrase, so the old rule read it as a change of mind.
+    // The loss this buys: an unmarked question answered with "지금 종료하지
+    // 말아 줘" (a real request to keep going, just not phrased as a decline
+    // to OUR prompt) now passes through neutral instead of closing the gate.
     if (Array.isArray(content) && !isModelReachableRecord(o)) {
       for (const b of content) {
         if (!b || typeof b !== 'object') continue;
@@ -4607,18 +4811,46 @@ export function hasUserCloseSignal(transcriptPath) {
         if (b.is_error === true) continue;
         const s = typeof b.content === 'string' ? b.content : JSON.stringify(b.content);
         if (!/have been answered/.test(s)) continue;
-        let sawAnswer = false;
         let sawClose = false;
+        let sawDecline = false;
         for (const m of s.matchAll(/="([^"]*)"/g)) {
-          sawAnswer = true;
+          // Independent checks, not else-if: a marked prompt's decline option
+          // can itself contain close wording (the model authors the text),
+          // and the decline-wins priority below only works if sawDecline gets
+          // set even when the same string also matches isClosePattern.
           if (isClosePattern(m[1])) sawClose = true;
+          if (CLOSE_RECONFIRM_DECLINE_WORDS.test(m[1])) sawDecline = true;
+        }
+        // A decline on a MARKED prompt wins over a close match checked on the
+        // same answer. The model authors the option text, and a marked prompt
+        // exists precisely to ask "close now, yes or no", so an answer that
+        // reads as a decline of THAT question must not be overridable by a
+        // close phrase riding along elsewhere in the same answer string. If
+        // the close check ran first, the model could word a decline option to
+        // also contain a close phrase and force the gate open on its own
+        // rejection.
+        if (sawDecline && markedAskIds.has(b.tool_use_id)) {
+          open = false;
+        } else if (sawClose) {
+          open = true;
+          openedAtIndex = i;
         }
-        if (sawClose) granted = true;
-        else if (sawAnswer) granted = false;
       }
     }
   }
-  return granted;
+  return { open, openedAtIndex };
+}
+
+/**
+ * Public opening-axis predicate: does this transcript's typed/queued/answered
+ * event history currently leave the close gate open? A thin boolean wrapper
+ * over {@link walkCloseGate} — every caller that only needs the verdict uses
+ * this. `close-gate-store.mjs`'s `closeGateStatus` imports `walkCloseGate`
+ * directly instead, because it also needs `openedAtIndex` to order the open
+ * against a recorded resolution.
+ */
+export function isCloseGateOpen(transcriptPath) {
+  return walkCloseGate(transcriptPath).open;
 }
 
 /** The literal the user must type to approve a parked-overwrite batch. */
@@ -4628,7 +4860,7 @@ export const APPROVAL_PHRASE = 'apply-proposals';
  * True iff the transcript carries a user's TYPED approval of the batch this nonce
  * was minted for — the authorization gate for a transcript-approved apply.
  *
- * Deliberately NOT hasUserCloseSignal. That function answers "did the user want to
+ * Deliberately NOT isCloseGateOpen. That function answers "did the user want to
  * end the session", and it accepts a correlated AskUserQuestion answer as evidence
  * (see above). Reusing it here would let a SESSION-CLOSE approval spend itself as an
  * OVERWRITE approval: different authority, different question. Two gates, two
@@ -4741,6 +4973,16 @@ export function hasPendingBackgroundWork(payload) {
 // reason silently break this correlation with no test to catch it.
 export const CLOSE_RECONFIRM_MARK = '지금 닫기';
 
+// The decline vocabulary shared by walkCloseGate's marked-reconfirm click
+// branch and isCloseReconfirmDeclined below. One constant so the two walks
+// cannot drift into recognizing different words for the same "not now"
+// answer: they stay separate WALKS on purpose (isCloseReconfirmDeclined's
+// re-arm rule only recognizes a typed close phrase, which is too narrow for
+// walkCloseGate's other openers), but the vocabulary they match against is
+// one value, not two copies that a future edit could update in only one
+// place.
+const CLOSE_RECONFIRM_DECLINE_WORDS = /(아직|나중|not\s?yet|later)/i;
+
 /**
  * True iff the LATEST correlated AskUserQuestion answer in the transcript
  * declined an autoclose reconfirm prompt ("아직" / "나중" / "not yet" /
@@ -4749,10 +4991,11 @@ export const CLOSE_RECONFIRM_MARK = '지금 닫기';
  *
  * Read-only, forward scan over the FULL transcript (no tail truncation — a
  * decline can precede the next Stop by any number of turns). Reuses the same
- * askIds + tool_use_id correlation `hasUserCloseSignal` (above) uses to bind
+ * askIds + tool_use_id correlation `walkCloseGate` (above) uses to bind
  * an AskUserQuestion answer to its own tool_use, so an unrelated tool_result
- * string can't forge a decline. Unlike `hasUserCloseSignal` (which is a
- * "any evidence, ever" OR), this tracks a single latest-wins boolean as it
+ * string can't forge a decline. Unlike `walkCloseGate` (which is already a
+ * latest-event-wins walk, not an "any evidence, ever" OR), this tracks a
+ * separate single latest-wins boolean as it
  * scans: a decline answer sets it true, and any later GENUINE USER close
  * signal resets it to false — the user asked to close again, so the prior
  * decline no longer applies.
@@ -4785,7 +5028,6 @@ export function isCloseReconfirmDeclined(transcriptPath) {
   } catch {
     return false;
   }
-  const DECLINE = /(아직|나중|not\s?yet|later)/i;
   const askIds = new Set();
   let declined = false;
   for (const line of lines) {
@@ -4834,7 +5076,7 @@ export function isCloseReconfirmDeclined(transcriptPath) {
       if (b.type === 'tool_result' && b.tool_use_id && askIds.has(b.tool_use_id)) {
         const s = typeof b.content === 'string' ? b.content : JSON.stringify(b.content);
         for (const m of s.matchAll(/="([^"]*)"/g)) {
-          if (DECLINE.test(m[1])) declined = true;
+          if (CLOSE_RECONFIRM_DECLINE_WORDS.test(m[1])) declined = true;
         }
       }
     }