hypomnema 1.7.2 → 1.7.4

package/scripts/lib/extensions.mjs

@@ -28,6 +28,12 @@ import {
   unlinkSync,
   mkdirSync,
   lstatSync,
+  statSync,
+  fstatSync,
+  chmodSync,
+  fchmodSync,
+  openSync,
+  closeSync,
   rmdirSync,
 } from 'fs';
 import { join, dirname, relative, resolve, posix, sep } from 'path';
@@ -894,9 +900,46 @@ export function readExtensionPkgStateNoMutate(pkgPath, target) {
 
 // ── sync orchestration ─────────────────────────────────────────────────────────
 
-function writeFreshAtomic(dest, content) {
+/** Carry only src's execute bits (owner/group/other) onto a mode value; every
+ * other permission bit (dest's own read/write, however umask shaped it) is
+ * left alone. This is the one place forward-sync decides "should this file be
+ * executable", so every writer of dest routes through it. Exported so
+ * capture.mjs's own atomic writer (a captured file's FIRST write into the wiki)
+ * applies the identical rule; the wiki copy must not lose the bit before
+ * forward-sync ever gets a chance to carry it further. */
+export function withSrcExecBits(destMode, srcMode) {
+  return (destMode & ~0o111) | (srcMode & 0o111);
+}
+
+/** Add only the execute bits src has that dest is missing, onto dest — every bit
+ * dest already carries (owner/group/other, ours or the user's) survives untouched.
+ * This is the additive counterpart to `withSrcExecBits` above: that one REPLACES
+ * dest's exec bits wholesale, which is right for a fresh write (there is no prior
+ * dest state worth keeping) but wrong for healing an existing file, where treating
+ * "executable" as one boolean instead of three independent bits made a cross
+ * combination (src owner-only, dest group-only) read as already-satisfied and
+ * never get healed. Used only by copyOne's content-identical branch. */
+export function addSrcExecBits(destMode, srcMode) {
+  return destMode | (srcMode & 0o111);
+}
+
+function writeFreshAtomic(dest, content, srcMode) {
+  // `wx` (O_CREAT|O_EXCL) refuses to open a path that already exists, symlink
+  // included, so a predictable tmp name can't be raced into following one, the
+  // same hardening capture.mjs's own writeAtomic already carries.
   const tmp = `${dest}.tmp.${process.pid}.${Date.now()}`;
-  writeFileSync(tmp, content);
+  const fd = openSync(tmp, 'wx');
+  try {
+    writeFileSync(fd, content);
+    if (srcMode != null) {
+      // No fd-based write has a mode option that survives umask, so the execute
+      // bit has to be applied explicitly, and before the rename: otherwise dest
+      // is briefly visible with the wrong mode to anything racing this write.
+      fchmodSync(fd, withSrcExecBits(fstatSync(fd).mode, srcMode));
+    }
+  } finally {
+    closeSync(fd);
+  }
   try {
     renameSync(tmp, dest);
   } catch (err) {
@@ -914,13 +957,26 @@ function writeFreshAtomic(dest, content) {
  * overwrites user-modified / unowned files; without it those are left untouched and
  * surface as drift/conflict. A symlink/non-regular dest is never followed even under
  * force (the isRegularFile guard precedes the force branch).
+ *
+ * The executable bit is not tracked anywhere (no mode column in the SHA map's
+ * ownership model), so src's mode is the only source of truth for it and gets
+ * carried onto dest on every branch that (re)writes it. The content-identical
+ * branch below is the exception: it only ADDS a bit src has that dest lacks
+ * (per owner/group/other, not "executable" as one boolean), never turns one
+ * off, since a dest exec bit that src lacks can't be told apart from one the
+ * user set. `typeDir` is the symlink-ancestor boundary for that same branch's
+ * chmod: every caller passes the extension-type root (`~/.claude/hooks`, etc.)
+ * so a symlinked ancestor there is never chmod'd through to whatever it points
+ * at (codex pre-commit BLOCKER — the flat-file and manifest callers had no
+ * such guard, unlike the skill loop's own pre-check on `destPath`).
  */
-function copyOne({ srcPath, destPath, key, recordedSHA, apply, force }) {
+function copyOne({ srcPath, destPath, key, recordedSHA, apply, force, typeDir }) {
   const srcContent = readFileSync(srcPath);
   const srcSHA = sha256(srcContent);
+  const srcMode = statSync(srcPath).mode;
 
   if (!existsSync(destPath)) {
-    if (apply) writeFreshAtomic(destPath, srcContent);
+    if (apply) writeFreshAtomic(destPath, srcContent, srcMode);
     return { action: 'create', sha: srcSHA };
   }
   if (!isRegularFile(destPath)) {
@@ -933,6 +989,30 @@ function copyOne({ srcPath, destPath, key, recordedSHA, apply, force }) {
   }
   const onDiskSHA = sha256(onDisk);
   if (onDiskSHA === srcSHA) {
+    // Content already matches, but the exec bit can still be stale: this used to
+    // be a pure no-op, which is exactly why a missing bit here never healed. Only
+    // heal by ADDING the specific bits src has that dest lacks (owner/group/other
+    // checked independently — a prior boolean "is anything executable" check made
+    // a cross combination like src=owner-only/dest=group-only read as already
+    // satisfied and skip healing the owner bit entirely, codex pre-commit BLOCKER).
+    // A dest bit src lacks is always left alone, because that could be this same
+    // heal from an older run, or a bit the user set on purpose, and we have no way
+    // to tell those apart. This also means a wiki copy captured before this fix
+    // (recorded 644 for a 755 local original) can no longer strip the local file
+    // back to 644 on the next sync; it can only ever add bits.
+    // Reported as 'update' (not a new action) so every existing "N to sync" /
+    // "N synced" count and log line already keyed on create/update/force-update
+    // picks it up for free.
+    // ponytail: add-only means a dest that lost a bit src still has (content
+    // matches, exec bit was stripped some other way) never gets it back either.
+    // Upgrade path: record mode next to sha in the pkg-json map so a user's own
+    // bit can be told apart from our default and healed in both directions.
+    const destMode = statSync(destPath).mode;
+    const missingBits = srcMode & 0o111 & ~destMode;
+    if (missingBits !== 0 && !hasSymlinkAncestor(typeDir, destPath)) {
+      if (apply) chmodSync(destPath, addSrcExecBits(destMode, srcMode));
+      return { action: 'update', sha: srcSHA };
+    }
     return { action: 'up-to-date', sha: srcSHA };
   }
   if (recordedSHA && onDiskSHA === recordedSHA) {
@@ -942,7 +1022,7 @@ function copyOne({ srcPath, destPath, key, recordedSHA, apply, force }) {
       if (!verify || sha256(verify) !== recordedSHA) {
         return { action: 'skip-changed', sha: recordedSHA };
       }
-      writeFreshAtomic(destPath, srcContent);
+      writeFreshAtomic(destPath, srcContent, srcMode);
     }
     return { action: 'update', sha: srcSHA };
   }
@@ -950,7 +1030,7 @@ function copyOne({ srcPath, destPath, key, recordedSHA, apply, force }) {
   if (force) {
     if (apply) {
       writeFreshAtomic(`${destPath}.bak`, onDisk);
-      writeFreshAtomic(destPath, srcContent);
+      writeFreshAtomic(destPath, srcContent, srcMode);
     }
     return { action: 'force-update', sha: srcSHA };
   }
@@ -1058,6 +1138,7 @@ function syncOneSkill({
       recordedSHA: recordedNested[f.rel],
       apply,
       force,
+      typeDir,
     });
     if (res.sha != null) newNested[f.rel] = res.sha;
     result.actions.push({ target, file: fileKey, action: res.action });
@@ -1375,6 +1456,7 @@ export function syncExtensions({
         recordedSHA: recorded[fileKey],
         apply,
         force,
+        typeDir,
       });
       if (fileRes.sha != null) newSHAs[fileKey] = fileRes.sha;
       result.actions.push({ target, file: fileKey, action: fileRes.action });
@@ -1409,6 +1491,7 @@ export function syncExtensions({
           recordedSHA: recorded[mKey],
           apply,
           force,
+          typeDir,
         });
         if (mRes.sha != null) newSHAs[mKey] = mRes.sha;
         result.actions.push({ target, file: mKey, action: mRes.action });

package/scripts/lib/git-hooks-dir.mjs

@@ -38,6 +38,143 @@ import { execFileSync } from 'child_process';
 import { existsSync, lstatSync, realpathSync, statSync } from 'fs';
 import { basename, dirname, isAbsolute, join, resolve, sep } from 'path';
 
+// ── shared install/uninstall markers ────────────────────────────────────────
+// init.mjs writes these when it installs the wiki's git pre-commit hook and
+// the shell rc block; uninstall.mjs reads them back to remove exactly what
+// init created. Defined once here, imported by both, so the two scripts can
+// never drift into recognizing different markers.
+export const WIKI_PRE_COMMIT_MARKER_START = '# hypo-managed:pre-commit:start';
+export const WIKI_PRE_COMMIT_MARKER_END = '# hypo-managed:pre-commit:end';
+export const SHELL_MARKER_START = '# hypo-managed:shell-setup:start';
+export const SHELL_MARKER_END = '# hypo-managed:shell-setup:end';
+
+// ── marker-span validation (shared by both the writer in init.mjs and both
+// removal paths in uninstall.mjs) ───────────────────────────────────────────
+//
+// Two independent indexOf() calls cannot tell "well-formed" apart from
+// "duplicated" or "swapped": if a file happens to hold two full copies of the
+// block, indexOf finds only the first END, so slicing [firstStart, firstEnd]
+// leaves the second copy's install behind with no report of it. If END
+// precedes START (a hand-edited or corrupted file), slicing [start, end) with
+// start > end does not error, it silently duplicates whatever sits between
+// them into the "removed" (or, on the writer's side, the "replaced") span.
+// Neither script has a way back from either outcome, so a span is only
+// trusted when both markers appear EXACTLY once and START comes before END.
+function countOccurrences(content, needle) {
+  let count = 0;
+  let idx = 0;
+  while ((idx = content.indexOf(needle, idx)) !== -1) {
+    count++;
+    idx += needle.length;
+  }
+  return count;
+}
+
+export function findMarkerSpan(content, startMarker, endMarker) {
+  const startCount = countOccurrences(content, startMarker);
+  const endCount = countOccurrences(content, endMarker);
+  if (startCount !== 1 || endCount !== 1) {
+    return {
+      ok: false,
+      reason: `expected exactly one start and one end marker, found ${startCount} start / ${endCount} end`,
+    };
+  }
+  const startIdx = content.indexOf(startMarker);
+  const endIdx = content.indexOf(endMarker);
+  if (!(startIdx < endIdx)) {
+    return { ok: false, reason: 'the end marker appears before the start marker' };
+  }
+  return { ok: true, startIdx, endIdx };
+}
+
+// ── body-shape validation (shared by both removal paths in uninstall.mjs) ──
+//
+// findMarkerSpan proves the span itself is well-formed. It says nothing about
+// what sits INSIDE that span. A well-formed marker pair is trivial to forge
+// around arbitrary content — a user's own shell function, a user's own
+// pre-commit check — and codex reproduced exactly that (2026-08-27): a marker
+// pair wrapped around `echo USER_OWNED_DEPLOY_CHECK` passed every prior check
+// (one start, one end, start before end, a leading shebang) and got deleted
+// along with the user's line, because nothing ever looked at the body text
+// itself. These two functions are that missing check.
+//
+// The shell block is fully static — init never bakes a path into it — so its
+// body can be matched byte-for-byte against SHELL_FUNCTION_BODY below. The
+// pre-commit body cannot: it embeds the absolute install root, which moves
+// across machines and package versions, so requiring an exact match would
+// refuse to remove a hook a real (older, or differently-installed) init.mjs
+// actually wrote. It is matched structurally instead — the "one or two `node
+// '<path>' ... || exit 1` steps, then `exit 0`" shape — checking only that
+// the referenced script is ours (ends in `/hooks/hypo-pre-commit.mjs` or
+// `/scripts/lint.mjs`), not which root it lives under.
+//
+// Both directions of a mismatch here are unequal: failing to recognize a
+// hook init actually wrote costs a re-run with --force-*; deleting a file
+// that was never ours has no recovery. So an unrecognized shape is always
+// treated as "not ours" and left standing, never as "close enough".
+
+const PRE_COMMIT_WORKER_LINE = /^node '(.+)' \|\| exit 1$/;
+const PRE_COMMIT_LINT_LINE = /^node '(.+)' --hypo-dir='(?:.+)' --strict \|\| exit 1$/;
+
+// Reverses shellSingleQuote()'s escaping (a literal `'` becomes `'\''`) so the
+// captured path can be compared against the suffix it must end in.
+function unescapeShellSingleQuoted(s) {
+  return s.split("'\\''").join("'");
+}
+
+/**
+ * @param {string} content full pre-commit hook file content
+ * @param {{startIdx: number, endIdx: number}} span a `findMarkerSpan` result
+ *   already confirmed `ok: true` for WIKI_PRE_COMMIT_MARKER_START/END
+ * @returns {boolean} true when the text between the markers is recognizable
+ *   as a body init.mjs's wikiPreCommitContent() writes
+ */
+export function isOwnedWikiPreCommitBody(content, span) {
+  const body = content.slice(span.startIdx + WIKI_PRE_COMMIT_MARKER_START.length, span.endIdx);
+  const lines = body.split('\n');
+  // wikiPreCommitContent() always places a bare "\n" right after START and
+  // right before END, so the first and last split segments must be empty.
+  if (lines[0] !== '' || lines[lines.length - 1] !== '') return false;
+  const middle = lines.slice(1, -1);
+  if (middle.length < 2 || middle.length > 3 || middle[middle.length - 1] !== 'exit 0') {
+    return false;
+  }
+  const steps = middle.slice(0, -1);
+  const worker = PRE_COMMIT_WORKER_LINE.exec(steps[0]);
+  if (!worker || !unescapeShellSingleQuoted(worker[1]).endsWith('/hooks/hypo-pre-commit.mjs')) {
+    return false;
+  }
+  if (steps.length === 2) {
+    const lint = PRE_COMMIT_LINT_LINE.exec(steps[1]);
+    if (!lint || !unescapeShellSingleQuoted(lint[1]).endsWith('/scripts/lint.mjs')) return false;
+  }
+  return true;
+}
+
+// The exact text init.mjs's shellFunctionBlock() writes between the shell
+// markers. Exported so init.mjs builds the block FROM this constant rather
+// than a second copy of the same literal — the two can then never drift the
+// way independent copies of the pre-commit worker line already could not
+// (see the module-level comment on the markers above).
+export const SHELL_FUNCTION_BODY = `
+function claude() {
+  echo "{\\"cwd\\":\\"$(pwd)\\"}" | node "$HOME/.claude/hooks/hypo-session-start.mjs" > /dev/null 2>&1
+  command claude "$@"
+}
+`;
+
+/**
+ * @param {string} content full rc file content
+ * @param {{startIdx: number, endIdx: number}} span a `findMarkerSpan` result
+ *   already confirmed `ok: true` for SHELL_MARKER_START/END
+ * @returns {boolean} true when the text between the markers is byte-identical
+ *   to what init.mjs writes
+ */
+export function isOwnedShellFunctionBody(content, span) {
+  const body = content.slice(span.startIdx + SHELL_MARKER_START.length, span.endIdx);
+  return body === SHELL_FUNCTION_BODY;
+}
+
 // Fallback scrub list for git versions without `rev-parse --local-env-vars`.
 // Mirrors scripts/install-git-hooks.mjs, which established this trust model.
 const STATIC_LOCAL_ENV_VARS = [
@@ -72,7 +209,7 @@ function buildScrubbedEnv(localEnvList) {
 // Canonicalize a path that may not exist yet: realpath the deepest existing
 // ancestor and re-append the rest. Without this, a hooks dir git will create
 // lazily could evade the containment check via an unresolved symlinked parent.
-function canonicalize(p) {
+export function canonicalize(p) {
   let cur = resolve(p);
   const tail = [];
   for (;;) {
@@ -91,7 +228,7 @@ function canonicalize(p) {
   }
 }
 
-function isInside(child, parent) {
+export function isInside(child, parent) {
   return child === parent || child.startsWith(parent + sep);
 }
 

package/scripts/lib/slug-resolver.mjs

@@ -0,0 +1,181 @@
+// scripts/lib/slug-resolver.mjs — shared slug resolution, extracted from
+// lint.mjs and rename.mjs so a future consumer does not grow its own copy.
+//
+// Exposes TWO modes, deliberately not folded into one:
+//
+//   - existence-check (lint)         — buildSlugMap: a Set, membership only.
+//     Fast, but cannot say WHICH page owns a form or whether it is shared.
+//   - collision-aware owner (rename) — buildFormIndex + classifyTarget +
+//     newTargetFor: a form → Set<rel> map, so a caller can tell an
+//     unambiguous resolution from a shared one and refuse to auto-rewrite
+//     the latter.
+//
+// Folding these into one structure would be a regression: lint only needs to
+// know a link resolves to SOMETHING, while rename must refuse to touch a link
+// whose form is shared by more than one page. Collectors stay separate too —
+// lint's target universe is pages/projects/journal plus root .md and
+// sources/* (collectLinkTargets, still in lint.mjs); rename scans the whole
+// vault root and treats journal/session-log/weekly/archive/postmortems and
+// sources/* as immutable link SOURCES (preservationClass, below).
+//
+// Masking, link-body parsing, and the immutability/realpath-containment rules
+// travel with owner mode because rename's rewrite pipeline needs all of them
+// together: mask non-wikilink regions, parse a link body, classify it against
+// the form index, and refuse a target that resolves outside the vault.
+
+import { lstatSync, realpathSync } from 'fs';
+import { dirname, sep } from 'path';
+import { slugForms } from './wikilink.mjs';
+
+// ── existence-check slug map (lint mode) ────────────────────────────────────
+// `extraTargets` are link-target-only slugs (root *.md, sources/*) that
+// resolve wikilinks but are not themselves linted — added verbatim, with NO
+// derived basename/dir-relative aliases, so they can't mask an unrelated
+// broken link.
+export function buildSlugMap(pages, extraTargets = []) {
+  const map = new Set();
+  for (const { rel } of pages) {
+    const noExt = rel.replace(/\.md$/, '').replace(/\\/g, '/');
+    const { full, bare, dirRel } = slugForms(noExt);
+    map.add(full);
+    map.add(bare);
+    if (dirRel) map.add(dirRel);
+  }
+  for (const t of extraTargets) map.add(t);
+  return map;
+}
+
+// ── collision-aware form index (owner mode) ─────────────────────────────────
+export const dirRelForm = (slug) => slugForms(slug).dirRel;
+
+// Unlike buildSlugMap above (a Set that silently dedups collisions), owner
+// mode needs to KNOW when a form is shared, so it maps each form to the SET
+// of page rels that expose it. Precedence forms per page: full noExt slug,
+// bare basename, dir-relative (drop the leading scan-dir segment).
+export function buildFormIndex(pages) {
+  const index = new Map(); // form → Set<rel>
+  const add = (form, rel) => {
+    if (!form) return;
+    if (!index.has(form)) index.set(form, new Set());
+    index.get(form).add(rel);
+  };
+  for (const p of pages) {
+    add(p.slug, p.rel);
+    // sources/* are full-slug-only link targets, exactly as lint's
+    // collectLinkTargets treats them: a bare `[[name]]` must NOT resolve to a
+    // source file. Adding their bare/dir-relative aliases here would make a
+    // real page's bare link look ambiguous and skip a legitimate rewrite.
+    if (/(^|\/)sources(\/|$)/.test(p.rel)) continue;
+    add(p.bare, p.rel);
+    add(dirRelForm(p.slug), p.rel);
+  }
+  return index;
+}
+
+// Classify a link target against the from-page. Returns the form KIND when
+// the target points at from-page, plus whether that form is ambiguous
+// (shared with another page → unsafe to auto-rewrite).
+export function classifyTarget(target, fromPage, formIndex) {
+  const owners = formIndex.get(target);
+  if (!owners || !owners.has(fromPage.rel)) return { kind: null, ambiguous: false };
+  const ambiguous = owners.size > 1;
+  let kind = null;
+  if (target === fromPage.slug) kind = 'full';
+  else if (target === dirRelForm(fromPage.slug)) kind = 'dirrel';
+  else if (target === fromPage.bare) kind = 'bare';
+  return { kind, ambiguous };
+}
+
+// The new target string for a matched form kind — same kind, new page.
+export function newTargetFor(kind, toPage) {
+  if (kind === 'full') return toPage.slug;
+  if (kind === 'dirrel') return dirRelForm(toPage.slug) ?? toPage.bare;
+  return toPage.bare; // bare
+}
+
+// ── wikilink masking (owner mode) ───────────────────────────────────────────
+// Blank out fenced code, inline code, and HTML comments WITHOUT changing
+// length, so a [[ref]] match index in the mask aligns with the same index in
+// the source. Rewriting then edits the source at those exact spans, never
+// touching a link that only appears inside a code sample.
+export function maskNonWikilinkRegions(content) {
+  let out = content;
+  out = out.replace(/^[ \t]{0,3}```[\s\S]*?^[ \t]{0,3}```/gm, (m) => m.replace(/[^\n]/g, ' '));
+  out = out.replace(/^[ \t]{0,3}~~~[\s\S]*?^[ \t]{0,3}~~~/gm, (m) => m.replace(/[^\n]/g, ' '));
+  out = out.replace(/<!--[\s\S]*?-->/g, (m) => m.replace(/[^\n]/g, ' '));
+  out = out.replace(/``[^`\n]*``/g, (m) => ' '.repeat(m.length));
+  out = out.replace(/`[^`\n]*`/g, (m) => ' '.repeat(m.length));
+  return out;
+}
+
+// Parse the inside of a `[[ ... ]]` into { target, suffix } where suffix is
+// the alias/anchor tail to preserve verbatim (including a table-escaped
+// `\|`). The target capture stops before an optional `\` preceding the
+// `|`/`#` delimiter, matching lint's extractor exactly.
+export function splitLinkBody(body) {
+  const m = body.match(/^([^|#\\]+?)(\\?[|#][\s\S]*)?$/);
+  if (!m) return null;
+  return { target: m[1].trim(), suffix: m[2] || '' };
+}
+
+// ── preservation class of a link-source path (owner mode) ──────────────────
+// Two distinct reasons a file is normally skipped as a link SOURCE, kept
+// separate because directory-mode renames treat them differently:
+//
+//   'timerecord' — append-only snapshots (journal / session-log / weekly /
+//      archive / postmortems + root log.md). Rewriting a [[old]] inside a
+//      past entry would falsify that moment.
+//   'sources'    — sources/* immutable CAPTURED material. Never rewritten,
+//      not even inside a moved subtree.
+//
+// Matches a path SEGMENT so `pages/journal/x.md` and
+// `projects/p/session-log/y.md` both qualify. Returns null for ordinary live
+// pages.
+export function preservationClass(rel) {
+  const p = rel.replace(/\\/g, '/');
+  if (/(^|\/)sources(\/|$)/.test(p)) return 'sources';
+  if (p === 'log.md') return 'timerecord';
+  if (/(^|\/)(journal|session-log|weekly|archive|postmortems)(\/|$)/.test(p)) return 'timerecord';
+  return null;
+}
+
+// A rename elsewhere in the vault must never churn a frozen snapshot or a
+// source — both preservation classes count as a preserved link SOURCE.
+export function isPreservedSource(rel) {
+  return preservationClass(rel) !== null;
+}
+
+// ── realpath containment (owner mode) ───────────────────────────────────────
+// Verify a path resolves, following any symlink ANCESTOR, to a location
+// inside the real vault root. A lexical ../-check cannot catch this: a
+// symlinked directory that is lexically in-vault can still resolve outside
+// it. The destination may not exist, so the deepest existing prefix is
+// resolved (its realpath is where a write would actually land). Fail-closed:
+// returns false on any resolution error.
+//
+// The walk uses lstat (NOT existsSync) so a DANGLING symlink prefix is
+// detected as present-but-unresolvable rather than skipped as absent —
+// otherwise the walk would step past it to an in-vault parent and wrongly
+// report containment.
+export function realContainedInVault(absPath, realRoot) {
+  let probe = absPath;
+  for (;;) {
+    let exists = true;
+    try {
+      lstatSync(probe);
+    } catch {
+      exists = false;
+    }
+    if (exists) break;
+    const parent = dirname(probe);
+    if (parent === probe) return false;
+    probe = parent;
+  }
+  let real;
+  try {
+    real = realpathSync(probe); // follows links; throws on a dangling symlink
+  } catch {
+    return false;
+  }
+  return real === realRoot || real.startsWith(realRoot + sep);
+}

package/scripts/lint.mjs

@@ -19,7 +19,7 @@
 import { existsSync, readFileSync, writeFileSync, readdirSync, statSync } from 'fs';
 import { join, extname, basename } from 'path';
 import { resolveHypoRootInfo, checkVaultOrExit, expandHome } from './lib/hypo-root.mjs';
-import { SESSION_STATE_NEXT_HEADINGS } from '../hooks/hypo-shared.mjs';
+import { SESSION_STATE_NEXT_HEADINGS, closeFileTargetsGlobal } from '../hooks/hypo-shared.mjs';
 import { loadHypoIgnore, isScanIgnored } from './lib/hypo-ignore.mjs';
 import {
   parseSchemaVocab,
@@ -30,8 +30,9 @@ import {
 import { findDesignHistoryStale } from './lib/design-history-stale.mjs';
 import { FEEDBACK_SCOPE_RE } from './lib/feedback-scope.mjs';
 import { FAILURE_TYPE_ENUM } from './lib/failure-type.mjs';
-import { collectPagesLint, collectPagesLinkable, slugForms } from './lib/wikilink.mjs';
+import { collectPagesLint, collectPagesLinkable } from './lib/wikilink.mjs';
 import { parseFrontmatter, SEQUENCE_ENTRY_RE } from './lib/frontmatter.mjs';
+import { buildSlugMap } from './lib/slug-resolver.mjs';
 
 // ── arg parsing ──────────────────────────────────────────────────────────────
 
@@ -176,28 +177,9 @@ const TYPE_ENUM_FIELDS = {
 };
 
 // ── page collector ────────────────────────────────────────────────────────────
-
-// ── slug map ─────────────────────────────────────────────────────────────────
-
-// `extraTargets` are link-target-only slugs (root *.md, sources/*) that resolve
-// wikilinks but are not themselves linted — added verbatim, with NO derived
-// basename/dir-relative aliases, so they can't mask an unrelated broken link.
-function buildSlugMap(pages, extraTargets = []) {
-  const map = new Set();
-  for (const { rel } of pages) {
-    const noExt = rel.replace(/\.md$/, '').replace(/\\/g, '/');
-    // full slug + bare basename + dir-relative alias (drop the leading scan-dir
-    // segment so the convention link [[learnings/foo]] resolves to
-    // pages/learnings/foo.md). slugForms returns dirRel=null when the slug has no
-    // `/` (a page directly under a scan dir has no extra segment to drop).
-    const { full, bare, dirRel } = slugForms(noExt);
-    map.add(full);
-    map.add(bare);
-    if (dirRel) map.add(dirRel);
-  }
-  for (const t of extraTargets) map.add(t);
-  return map;
-}
+//
+// buildSlugMap (existence-check mode) now lives in ./lib/slug-resolver.mjs,
+// shared with rename.mjs's collision-aware owner mode.
 
 // Link-target-only slugs: files that are valid wikilink destinations but are
 // NOT linted themselves. Root-level *.md (hot.md / log.md / hypo-guide.md /
@@ -308,6 +290,10 @@ const issues = [];
 //   W3 missing-updated  → excluded (auto-repaired by --fix).
 //   W8 design-history-stale → excluded (hypo-personal-check handles it; would
 //                             double-gate).
+//   W14 design-history-missing → excluded, same reason as W8, and deliberately
+//                             a different id so hypo-shared.mjs's W8-only
+//                             blocker filter never sees it (stays warn, never
+//                             hard-blocks PreCompact).
 // NOTE: no gate currently passes --strict (npm run lint / CI / release.yml /
 // crystallize / the close-gate all run plain lint), so promotion is
 // forward-looking: these surface as warnings today. The deliverable is
@@ -554,11 +540,73 @@ const validTypes = new Set([...VALID_TYPES, ...parseSchemaTypes(args.hypoDir)]);
 
 for (const page of pages) lintPage(page, slugMap, tagVocab, pageDirs, validTypes);
 
+// W4 (broken-wikilink only, NOT the full lintPage) for close's root-level
+// write targets that fall outside pages/projects/journal: hot.md and log.md
+// today. closeFileTargetsGlobal is the one list of what close writes
+// (hooks/hypo-shared.mjs), reused here instead of re-derived, so a future
+// close target is covered automatically. Only the entries NOT already under
+// a scanDir are new; closeFileTargetsGlobal's projects/<slug>/* entries are
+// already linted in full above.
+//
+// Why link-only and not the full lintPage: measured, not assumed. On the
+// packaged templates/ (hot.md type:reference, log.md type:log, both declared
+// in templates/SCHEMA.md's taxonomy), full lintPage on both files comes back
+// completely clean, so "these types trip W2" is not the reason to hold back.
+// The real reason is that live vaults do not all match the template. A vault
+// whose SCHEMA.md predates the `log` type row (or has none) gets a fresh
+// "Unknown type: log" W2 the moment log.md is run through lintPage, and a
+// vault whose root log.md predates the frontmatter convention entirely (no
+// leading `---` block at all, confirmed against a real maintainer vault)
+// gets a fresh "No frontmatter found" W1. Both W1 and W2 are in
+// STRICT_PROMOTE_IDS, so under --strict a vault that lint has always passed
+// would start failing on a file whose content this fix never touched. Full
+// lintPage stays reserved for pages/projects/journal, where every file was
+// already being linted before this change and there is no such newly-exposed
+// vault. W4 itself stays warn-only outside --strict, and postApply
+// (crystallize.mjs) gates only on errors, so this addition can add a new
+// warning to a close's lint output but can never fail one.
+const closeRootTargets = [...closeFileTargetsGlobal(args.hypoDir)].filter(
+  (f) => !f.startsWith('pages/') && !f.startsWith('projects/') && !f.startsWith('journal/'),
+);
+for (const rel of closeRootTargets) {
+  const full = join(args.hypoDir, rel);
+  if (!existsSync(full) || isScanIgnored(full, args.hypoDir, ignorePatterns)) continue;
+  let content;
+  try {
+    content = readFileSync(full, 'utf-8');
+  } catch {
+    continue;
+  }
+  for (const link of extractWikilinks(content)) {
+    if (!slugMap.has(link)) {
+      issue('warn', rel, `Broken wikilink: [[${link}]]`, null, 'W4');
+    }
+  }
+}
+
 // W8: design-history.md stale relative to session-log.md. Emitted once per
 // project (not per page) — runs outside the page loop. POSIX-separated path
 // literal (not path.join) so consumers can rely on `file.split('/')` shape
 // regardless of host OS — `hooks/hypo-personal-check.mjs:246` depends on this.
+//
+// W14: design-history.md does not exist at all, but session-log carries a
+// design-relevant entry with nowhere to land. Distinct id from W8 on purpose —
+// hypo-shared.mjs's PreCompact gate filters strictly on `w.id === 'W8'` to
+// hard-block an active project on staleness, and W14 must NOT enter that path
+// (a bootstrapping gap on 14 of 16 live projects would block every one of
+// them). W14 stays a plain warn: never added to STRICT_PROMOTE_IDS, never
+// matched by that W8-only filter.
 for (const s of findDesignHistoryStale(args.hypoDir)) {
+  if (s.kind === 'missing') {
+    issue(
+      'warn',
+      `projects/${s.project}/design-history.md`,
+      `design-history missing: session-log 설계-관련 최신=${s.lastSession}인데 projects/${s.project}/design-history.md가 없습니다 — 파일을 새로 만들어 설계 변경 사항을 append 하는 것을 권고합니다`,
+      null,
+      'W14',
+    );
+    continue;
+  }
   const gap = s.diffDays != null ? ` (${s.diffDays}일 차이)` : '';
   issue(
     'warn',