hypomnema 1.7.3 → 1.8.0

package/hooks/hypo-shared.mjs

@@ -1063,6 +1063,63 @@ export function collectProjectWorkingDirs(hypoDir) {
   return out;
 }
 
+// One place that answers "is this string a slug naming a real project directory?".
+// Both resolveGateProjectOverride (a caller-supplied --project) and the gate's
+// mustEvaluate filter (slugs arriving from a transcript or a marker) need it, and
+// having the grammar in two inline copies is the duplication this release spent a
+// codex round removing elsewhere. Not exported: scripts/ has its own validator,
+// and importing that here would invert the one-way hooks/ <- scripts/ dependency.
+function isProjectSlugDirectory(hypoDir, slug) {
+  if (typeof slug !== 'string' || !/^[A-Za-z0-9._-]+$/.test(slug)) return false;
+  if (/^\.+$/.test(slug) || !/[A-Za-z0-9]/.test(slug)) return false;
+  try {
+    return statSync(join(hypoDir, 'projects', slug)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+// session-close-scope-boundary spec §2: the one place that turns a caller-
+// supplied project name into precompactGateStatus's opts.projectOverride. Four
+// call sites share it (--mark-session-closed, apply's auto-marker, PreCompact,
+// Stop) so a foreign project's dangling close files demote to a notice instead
+// of blocking a session that never touched them, everywhere the gate runs.
+//
+// `project` is trusted nowhere upstream of this function: crystallize.mjs's
+// own --project only gets slug-syntax + directory-existence checked when the
+// CLI itself parses it (parseArgs + requireProjectDir); a value that arrives
+// via a hook payload or apply's JSON body never passes through that. So this
+// re-validates from scratch — same charset rule as project-create.mjs's
+// isValidProjectName, duplicated rather than imported because hooks/ cannot
+// import scripts/ (dependency direction is one-way) — plus a directory
+// existence check. Either failure returns null, the same as "no project was
+// given": a garbage slug must never narrow the gate's scope, only a real one
+// may (spec success criterion: "opts.projectOverride 가 없는 slug 이면 게이트가
+// 그것을 거절한다").
+//
+// With no `project`, the override is inferred from `sessionCwd` via
+// pickProjectByCwd's rejectAmbiguous mode — the same mode the gate's own
+// close-cwd check already trusts. Without rejectAmbiguous, two projects
+// sharing one working_dir (a monorepo with no uniqueness invariant) would
+// silently resolve to the first slug and could narrow the gate to a project
+// whose OWN close is still incomplete while the real cwd project goes
+// unchecked. A decline here (null) is not a failure: precompactGateStatus
+// falls back to the global, unscoped judgment, which is exactly the STOP-hook
+// call site's actual point (session-close-scope-boundary spec §2: "해석 실패면
+// 기존 fail-closed 가 받아 준다는 틀렸다 ... cwd 미해결을 마커 차단으로 만들지 않는다").
+//
+// @param {string} hypoDir
+// @param {{project?: string|null, sessionCwd?: string|null}} [opts]
+// @returns {string|null}
+export function resolveGateProjectOverride(hypoDir, { project = null, sessionCwd = null } = {}) {
+  if (project) {
+    return isProjectSlugDirectory(hypoDir, project) ? project : null;
+  }
+  return pickProjectByCwd(collectProjectWorkingDirs(hypoDir), sessionCwd, {
+    rejectAmbiguous: true,
+  });
+}
+
 // A project without a working_dir anchor (no index.md, or an index.md missing
 // the field) never enters collectProjectWorkingDirs' universe, so cwd-first
 // resume always MISSes for it — the SessionStart/CwdChanged MISS branch would
@@ -1451,7 +1508,7 @@ function closeCandidateSlugs(hypoDir, dates) {
         // slug yields a token that no longer maps to a `projects/<slug>/`
         // directory — gating on disk keeps it out of the dangling-close set.
         // Directory (not bare-exists) mirrors the apply-path project check
-        // (crystallize.mjs:193).
+        // (crystallize-args.mjs).
         const dir = join(projectsDir, m[1]);
         if (existsSync(dir) && statSync(dir).isDirectory()) slugs.add(m[1]);
       }
@@ -1526,10 +1583,17 @@ export function sessionCloseGlobalStatus(hypoDir, opts = {}) {
   // projectOverride (check-only): the caller (`crystallize --check-session-close
   // --project=<slug>`) wants THIS project's close status, not the recency pick —
   // bypass discovery and report the single project, preserving the global return
-  // shape. NEVER threaded from a marker-writing path (--mark / apply auto-marker /
-  // PreCompact): those stay global so the marker == compact-ready invariant holds
-  // (codex design review). A green status here is a project-scoped
-  // diagnostic, not the global compact-readiness verdict.
+  // shape. This is the ONLY caller of projectOverride now: the four marker-writing
+  // paths (--mark / apply auto-marker / PreCompact / Stop) attribute through
+  // `opts.attributionScope` instead (resolveCloseScope, below this function), which
+  // only widens the mine/foreign partition's scope Set and leaves this function
+  // evaluating every project, same as an unscoped call. A green status here is a
+  // project-scoped diagnostic, not the global compact-readiness verdict. The
+  // invariant that once justified keeping the writer paths fully unscoped
+  // ("marker == compact-ready", codex design review) is superseded by that
+  // partition, not restored by it — a marker's own `verified_scope`, attesting
+  // exactly what it checked, is still missing (session-close-scope-boundary
+  // spec §3, next wave).
   if (opts.projectOverride) {
     const s = sessionCloseFileStatus(hypoDir, { projectOverride: opts.projectOverride });
     return {
@@ -1547,11 +1611,30 @@ export function sessionCloseGlobalStatus(hypoDir, opts = {}) {
   }
   const dates = freshDates();
   const recency = resolveActiveProject(hypoDir); // no cwd — close never picks by cwd
-  const todayActive = [...closeCandidateSlugs(hypoDir, dates)].filter((p) =>
+  // opts.mustEvaluate: slugs this session ATTRIBUTED its close to (explicit
+  // --project, transcript close-file edits, a prior marker). They are evaluated
+  // even when they are not today-active candidates, because the marker writer
+  // stamps the attribution scope: a slug that reaches the marker but never
+  // reached this evaluation would be attested as closed without ever being
+  // checked (codex pre-commit BLOCKER, reproduced with an empty projects/orphan/).
+  // `projects/<slug>/` must exist on disk; a slug naming a directory that is gone
+  // (a stale marker inside its 7-day TTL) is dropped rather than turned into a
+  // permanent blocker for a project nobody can close any more.
+  // existsSync alone would admit a file, or a traversal like '..', from a
+  // malformed marker or transcript slug and turn it into a surprise blocker.
+  // Same slug grammar the CLI and resolveGateProjectOverride validate against.
+  const mustEvaluate = [...(opts.mustEvaluate || [])].filter((p) =>
+    isProjectSlugDirectory(hypoDir, p),
+  );
+  // The fallback decision reads REAL today activity only. Letting mustEvaluate
+  // populate it would mean an attributed slug suppresses the "this session closed
+  // nothing at all" branch, and that branch is a fail-closed guard the partition
+  // below depends on (`!close.fallback`).
+  const activeCandidates = [...closeCandidateSlugs(hypoDir, dates)].filter((p) =>
     hasTodayCloseActivity(hypoDir, p, dates),
   );
 
-  if (todayActive.length === 0) {
+  if (activeCandidates.length === 0) {
     const legacy = sessionCloseFileStatus(hypoDir);
     return {
       ok: legacy.ok,
@@ -1567,6 +1650,8 @@ export function sessionCloseGlobalStatus(hypoDir, opts = {}) {
     };
   }
 
+  const todayActive = [...new Set([...activeCandidates, ...mustEvaluate])];
+
   // primary = the recency project when it is itself today-active, else the first
   // today-active slug (stable order from the candidate set). Used only as the
   // single-slug alias for the message header and the flat `close.project` field.
@@ -3504,6 +3589,12 @@ export function partitionLintScope(findings, scope) {
  * every close. Same path policy as the lint-scope matcher above: separators
  * normalized to POSIX, exact prefix at a segment boundary.
  */
+// This function keeps the posixPath() normalization deliberately, unlike
+// isForeign (§2b), which reads the raw porcelain path so a literal-backslash
+// filename cannot be misread as a nested projects/<slug>/ path. Every caller
+// of isUnderProjectDirs would need to be checked before applying the same
+// raw-path treatment here, and that audit has not been done, so the existing
+// behavior stays until it has.
 export function isUnderProjectDirs(file, slugs) {
   const f = posixPath(file);
   return (slugs || []).some((s) => s && (f === `projects/${s}` || f.startsWith(`projects/${s}/`)));
@@ -3550,6 +3641,15 @@ function projectsFromTouchedCloseFiles(transcriptPath, hypoDir) {
  *      the `project` that same writer recorded, so the two can never disagree.
  */
 export function resolveCloseScope(hypoDir, opts = {}, marker = null) {
+  // `direct` is the subset attributable to THIS close attempt: explicit
+  // --project/closeScope, this session's transcript close-file edits, and the
+  // resolved attributionScope. A marker's `projects` is PAST evidence of a close
+  // that already happened, so it belongs in the partition scope (it must not be
+  // demoted as foreign debt) but NOT in the mandatory-evaluation set: a 7-day-TTL
+  // marker naming a project that is no longer today-active would otherwise make
+  // that project's stale close block an unrelated close today (codex round 2,
+  // reproduced with a 24h-old marker). The returned Set carries `direct` as a
+  // property so the caller does not re-derive it, and the transcript is parsed once.
   const scope = new Set(opts.closeScope || []);
   for (const p of projectsFromTouchedCloseFiles(opts.transcriptPath, hypoDir)) scope.add(p);
   // Marker attribution (session-close attribution). A v4 marker carries `projects` — the
@@ -3561,6 +3661,20 @@ export function resolveCloseScope(hypoDir, opts = {}, marker = null) {
   // above (explicit close scope or transcript close-file edits) already corroborate
   // the SAME slug; otherwise it stays a display hint. This narrow gap self-heals as
   // pre-v4 markers expire (7-day TTL).
+  // opts.attributionScope (session-close-scope-boundary spec §2/§3): a fourth
+  // signal, one slug, from resolveGateProjectOverride. A cwd that unambiguously
+  // owns one project, or an explicit --project the caller already validated, is
+  // evidence this session is closing THAT project — the same standing the three
+  // signals above already have. It is the opt key the four marker-writing paths
+  // (PreCompact, Stop, --mark-session-closed, apply's auto-marker) pass instead
+  // of `opts.projectOverride`: that key stays the check-only diagnostic's (it
+  // also narrows sessionCloseGlobalStatus's own evaluation and turns off the
+  // partition below), while this one only widens the set the partition demotes
+  // everything outside of.
+  if (opts.attributionScope) scope.add(opts.attributionScope);
+  // Snapshot the direct signals BEFORE the marker union below widens the set.
+  scope.direct = new Set(scope);
+
   if (Array.isArray(marker?.projects)) {
     for (const p of marker.projects) if (p) scope.add(p);
   }
@@ -3590,12 +3704,22 @@ export function resolveCloseScope(hypoDir, opts = {}, marker = null) {
  * opts.projectOverride (CHECK-ONLY) narrows BOTH the close status and the lint
  * scope to a single project, for `--check-session-close --project=<slug>`. A
  * green result is then a project-scoped diagnostic, NOT the global compact-ready
- * verdict: the caller must surface the scope. It is NEVER passed from
- * a marker-writing path (--mark / apply auto-marker / PreCompact); those stay
- * global so a marker can't attest compact-ready while PreCompact re-checks red
- * (the marker == compact-ready invariant, codex design review). When a
- * log-only marker governs the session, log-only mode wins and projectOverride is
- * ignored.
+ * verdict: the caller must surface the scope. The four marker-writing paths
+ * (--mark / apply auto-marker / PreCompact / Stop) never set this — they pass
+ * `opts.attributionScope` instead, which only feeds resolveCloseScope's set and
+ * leaves this status evaluating every project, so the mine/foreign partition
+ * below can tell their own incomplete close from someone else's debt. The
+ * invariant that once justified keeping those paths fully unscoped ("marker ==
+ * compact-ready", codex design review) is replaced by that partition, not
+ * restored by it — a marker's own `verified_scope`, attesting exactly what it
+ * checked, is still missing (session-close-scope-boundary spec §3, next wave).
+ * Either key ALSO feeds the git-dirty partition (spec §2b): with an untrusted
+ * transcript (missing/corrupt), a dirty file structurally under a DIFFERENT
+ * eligible project's own directory is demoted to a notice, because the path
+ * alone proves it is not this session's; everything else keeps blocking.
+ * When a log-only marker governs the session, log-only mode wins for the
+ * close-status and lint scope (scope selection above); the git-dirty
+ * partition in spec §2b still applies regardless of projectOverride.
  *
  * @param {string} hypoDir
  * opts.sessionCwd (session-cwd close check): the authoritative cwd of the session being
@@ -3606,7 +3730,7 @@ export function resolveCloseScope(hypoDir, opts = {}, marker = null) {
  * cwd yields a best-effort notice, not a block. apply never passes it (its launch
  * cwd may differ from the authoritative payload.project).
  *
- * @param {{lintScope?: Iterable<string>, transcriptPath?: string|null, claudeHome?: string, projectOverride?: string|null, sessionCwd?: string|null, sessionId?: string|null, logOnly?: boolean, closeScope?: string[]}} [opts]
+ * @param {{lintScope?: Iterable<string>, transcriptPath?: string|null, claudeHome?: string, projectOverride?: string|null, attributionScope?: string|null, sessionCwd?: string|null, sessionId?: string|null, logOnly?: boolean, closeScope?: string[]}} [opts]
  * @returns {{ok: boolean, close: object, blockers: {type:string,reason:string}[], notices: {type:string,reason:string,file?:string}[], driftTargets: string[], skipped: {lint:boolean, feedback:boolean}}}
  */
 export function precompactGateStatus(hypoDir, opts = {}) {
@@ -3656,10 +3780,25 @@ export function precompactGateStatus(hypoDir, opts = {}) {
   // would make almost every real transcript untrusted and defeat the scoping
   // this fix exists to add.
   let sessionTouchTrusted = false;
+  // Transcript-derived files ONLY (not closeAccountableScope's mandatory-files
+  // base, which comes from closeFileTargetsGlobal and would fold every close
+  // file of every eligible project into "this session touched it"). §2b's
+  // isForeign below needs exactly this narrower set: a file this session's own
+  // Edit/Write proves it touched, even on a PARTIALLY-parsed transcript (the
+  // trailing line of an append-in-progress JSONL truncates in the ordinary
+  // course of a live session, not as an exceptional failure), must never be
+  // classified foreign by path prefix alone. Widening this to
+  // closeAccountableScope would re-open the exact foreign-close-file leak
+  // (b) fixed above (a genuinely different project's close file would count
+  // as "touched" just because it shares the mandatory-files base).
+  let transcriptTouched = new Set();
   if (opts.transcriptPath) {
     const widened = extractTouchedWikiFilesWithTrust(opts.transcriptPath, hypoDir);
     sessionTouchTrusted = widened.trusted;
-    for (const f of widened.files) closeAccountableScope.add(f);
+    for (const f of widened.files) {
+      closeAccountableScope.add(f);
+      transcriptTouched.add(f);
+    }
   }
 
   // 1. wiki git state. Uncommitted changes (real unsaved work) BLOCK, but only
@@ -3686,7 +3825,72 @@ export function precompactGateStatus(hypoDir, opts = {}) {
   const git = hypoIsClean(hypoDir);
   if (git.uncommitted) {
     const dirty = gitDirtyFiles(hypoDir);
-    if (dirty.length === 0 || !sessionTouchTrusted) {
+    if (dirty.length === 0) {
+      // Enumeration itself failed (or nothing is actually dirty despite the
+      // porcelain status): "cannot attribute" is not "clean", block exactly
+      // as before, override or not.
+      blockers.push({ type: 'git', reason: git.reason });
+    } else if (!sessionTouchTrusted && (opts.projectOverride || opts.attributionScope)) {
+      // session-close-scope-boundary spec §2b: a broken/missing transcript
+      // normally means "cannot attribute, fail closed" (the branch below).
+      // But when the CALLER told us which project is ours (an explicit
+      // --project, or the cwd-derived attributionScope), a dirty file that
+      // lives structurally under a DIFFERENT eligible project's own directory
+      // needs no attribution inference at all: the path alone proves it is
+      // not this session's file. Everything else (this session's own
+      // project, pages/, an unregistered or _template project dir) keeps the
+      // pre-existing fail-closed behavior; only a provably-foreign path is
+      // demoted.
+      const effectiveOverride = opts.projectOverride || opts.attributionScope;
+      // Computed once per gate call, never per file (collectProjectWorkingDirs
+      // walks the projects/ dir and reads every index.md). A throw here (a
+      // readdirSync failure it does not catch itself) must not escape as an
+      // exception, the PreCompact hook's outermost catch would turn that
+      // into a silent, fully-suppressed gate result, the opposite of "fail
+      // closed". Treat any failure as "no eligible projects known", which
+      // makes isForeign() below always false and every dirty file falls
+      // through to the unconditional blocker.
+      let eligibleSlugs = null;
+      try {
+        eligibleSlugs = new Set(collectProjectWorkingDirs(hypoDir).map((p) => p.slug));
+      } catch {
+        eligibleSlugs = null;
+      }
+      // Lexical, on the RAW git-porcelain path, BEFORE posixPath()'s
+      // unconditional `\` -> `/` conversion. A file whose actual NAME
+      // contains a literal backslash (`projects\other\x.md`, one path
+      // segment, no real subdirectory) must not be reinterpreted as living
+      // under `projects/other/` just because posixPath() would rewrite it
+      // that way; testing the raw string here means it never matches this
+      // regex and falls through to fail-closed instead.
+      const isForeign = (f) => {
+        // The transcript already PROVES this session edited f, whatever its
+        // path prefix says: transcript evidence outranks the path-prefix
+        // heuristic below, which only exists to cover files the (untrusted)
+        // transcript could not vouch for either way.
+        if (transcriptTouched.has(posixPath(f))) return false;
+        if (!eligibleSlugs) return false;
+        const m = /^projects\/([^/]+)\/.+$/.exec(f);
+        if (!m) return false;
+        const slug = m[1];
+        return slug !== effectiveOverride && eligibleSlugs.has(slug);
+      };
+      const foreign = dirty.filter(isForeign);
+      const rest = dirty.filter((f) => !isForeign(f));
+      if (rest.length > 0) {
+        blockers.push({
+          type: 'git',
+          reason: `uncommitted changes in ${hypoDir}: ${rest.join(', ')}`,
+        });
+      }
+      for (const f of foreign) {
+        notices.push({
+          type: 'git',
+          file: f,
+          reason: `uncommitted changes outside this session's scope: ${f}`,
+        });
+      }
+    } else if (!sessionTouchTrusted) {
       blockers.push({ type: 'git', reason: git.reason });
     } else {
       const mine = dirty.filter((f) => closeAccountableScope.has(posixPath(f)));
@@ -3739,8 +3943,21 @@ export function precompactGateStatus(hypoDir, opts = {}) {
     }
   } else {
     // projectOverride narrows the close status to one project (check-only); a
-    // marker-writing caller never sets it, so the marker path stays global.
-    close = sessionCloseGlobalStatus(hypoDir, { projectOverride: opts.projectOverride });
+    // marker-writing caller never sets it. It attributes instead through
+    // opts.attributionScope, consumed a few lines down by resolveCloseScope, so
+    // the status computed here stays global and only the partition below scopes it.
+    // scopeSet is computed BEFORE the status so the attributed slugs become
+    // mandatory evaluation targets (sessionCloseGlobalStatus's mustEvaluate).
+    // Computing it after would let a slug reach the marker that the status never
+    // looked at, which is the false-green this ordering exists to stop.
+    const attributedScope = resolveCloseScope(hypoDir, opts, marker);
+    close = sessionCloseGlobalStatus(hypoDir, {
+      projectOverride: opts.projectOverride,
+      // direct only: a past marker's projects must not become mandatory
+      // evaluation targets (codex round 2). They stay in attributedScope so the
+      // partition still treats them as this session's, not foreign debt.
+      mustEvaluate: attributedScope.direct,
+    });
 
     // Attribute the close debt before blocking on it. An incomplete close belongs
     // to whichever session performed it; charging it to an unrelated session is the
@@ -3771,7 +3988,7 @@ export function precompactGateStatus(hypoDir, opts = {}) {
     // pre-existing tradeoff documented there). And the marker is never written, so the
     // Stop hook still refuses to end the session. Closing this properly needs a
     // durable close-attempt record; it is not worth a new state-file lifecycle here.
-    const scopeSet = resolveCloseScope(hypoDir, opts, marker);
+    const scopeSet = attributedScope;
     const failed = (close.projects || []).filter((p) => !p.ok);
     const partition =
       !close.fallback && !opts.projectOverride && scopeSet.size > 0 && failed.length > 0;
@@ -3878,6 +4095,11 @@ export function precompactGateStatus(hypoDir, opts = {}) {
       // monorepo tie pickProjectByCwd declined): we cannot attribute a close
       // responsibility, so we do NOT hard-block (nothing proves there is anything
       // to close). Surface a best-effort notice so the coverage gap is visible.
+      // This reason names --project / --log-only, the crystallize CLI flags:
+      // correct for a --check-session-close caller, but not a lever a
+      // PreCompact hook reader has. The hook renderer (hypo-personal-check.mjs)
+      // builds its own sentence for this notice type instead of echoing this
+      // one verbatim; keep both in sync if the underlying condition changes.
       notices.push({
         type: 'close-cwd-unresolved',
         reason:
@@ -4306,9 +4528,41 @@ export function isClosePattern(text) {
   return [...krPatterns, ...enPatterns].some((re) => re.test(text));
 }
 
+/**
+ * Retraction TRIPWIRE for the close gate — a mitigation that can only CLOSE the
+ * gate, never open it. The gate no longer has its old per-turn overwrite (any
+ * typed text that was not a close phrase used to expire the approval outright),
+ * because an unknown typed phrase must not silently retract an approval the
+ * user actually gave — that is what turned the close skill's own "did you mean
+ * X or Y" reflection question into a false retraction. Under the new
+ * rule, typed text that is neither a close phrase nor a retraction phrase is
+ * NEUTRAL: it leaves the gate exactly where it was.
+ *
+ * This function is the one deliberate exception, and its asymmetry is the
+ * safety property: a phrase MISSING from the corpus below just falls through
+ * to neutral, which is the ordinary, already-accepted behaviour of an unknown
+ * typed message. So the corpus can be grown at any time without weakening an
+ * existing guarantee — the worst case of a miss is a gate that stays open,
+ * not one that opens when it should not. That asymmetry is also why this is
+ * NOT a counterexample to the rule that a defence is written as an effect,
+ * not a name list: a name list is dangerous exactly when it backs a GRANT,
+ * because the one name missing from it is a silent bypass. Here the missing
+ * name is a silent no-op.
+ *
+ * If this function is ever consumed by an opening decision instead of a
+ * closing one, that asymmetry disappears and the rule for an unknown
+ * value (route to the cautious branch) applies again — do not repurpose it
+ * without re-deriving the corpus under that rule.
+ */
+export function isCloseRetractionPattern(text) {
+  if (!text || typeof text !== 'string') return false;
+  const patterns = [/아\s*잠깐,?\s*이(?:것도|거)\s*(?:먼저\s*)?고쳐줘/, /하나만\s*더\s*해줘/];
+  return patterns.some((re) => re.test(text));
+}
+
 // ── close ARTIFACTS, not the marker (issue: close gate lives on one writer) ──
 //
-// hasUserCloseSignal/isClosePattern answer "did the user ask to close" — the
+// isCloseGateOpen/isClosePattern answer "did the user ask to close" — the
 // input side of the gate. This answers a different question: "does this file
 // or commit message already READ as closed to a human", independent of
 // whether any marker writer ever ran. The 2026-07-28 incident produced a
@@ -4464,77 +4718,69 @@ export function resolveTranscriptBySessionId(
 }
 
 /**
- * Returns true iff the transcript's LATEST live user decision is to close — the
- * hard gate for the session-closed marker writers. This is a state predicate, not
- * an existence one: "is close still approved right now", not "did a
- * close signal ever appear". Scans the FULL transcript in line order, classifies
- * each record, and tracks the approval as a LEASE.
+ * Internal walk: does this transcript's typed/queued/answered event history
+ * currently leave the close gate OPEN? This is the TRANSCRIPT axis only — a
+ * resolution recorded separately in the vault (`close-gate-store.mjs`)
+ * can only narrow this result further, never widen it, and is computed
+ * elsewhere entirely.
  *
  * Classification (structural fields only — never content heuristics for producer):
- *   • GRANT      a genuine user close: an NL close phrase in user text that
- *                survives {@link eventUserText}'s exclusions; a `/compact`
- *                queue-op; a remove-path queued_command attachment carrying a
- *                close with an audited human producer (origin.kind "human"); a
- *                correlated, non-error AskUserQuestion answer naming a close.
- *   • INVALIDATE a fresh user intent that expires the lease: any other genuine
- *                user text, `/clear`, `popAll`, a non-close queued_command, a
- *                non-close AskUserQuestion selection.
- *   • NEUTRAL    additionally: a typed `apply-proposals <nonce>` whose nonce this
- *                transcript shows `proposal challenge` minting (see "the approval
- *                line" below).
- *   • NEUTRAL    everything the model can produce or the harness injects: system/
- *                sdk replay, isMeta bodies, sidechain, interruptedMessageId
- *                companions, assistant, tool_result, task-notification.
- *   • FATAL      an unparseable line — the transcript is being appended to or is
- *                corrupt, so refuse rather than read a half-written record.
+ *   • OPEN    a genuine user close: an NL close phrase in user text that
+ *             survives {@link eventUserText}'s exclusions; a `/compact`
+ *             queue-op; a remove-path queued_command attachment carrying a
+ *             close with an audited human producer (origin.kind "human"); a
+ *             correlated, non-error AskUserQuestion answer naming a close.
+ *   • CLOSE   a fresh user intent that closes the gate: `/clear`, `popAll`, a
+ *             non-close queued_command, a decline answering an AskUserQuestion
+ *             whose own prompt carried {@link CLOSE_RECONFIRM_MARK} (ours, so
+ *             the decline rejects OUR close question and nobody else's), or
+ *             typed text matching {@link isCloseRetractionPattern} (the
+ *             retraction tripwire). Two things that used to close no longer do:
+ *             plain typed text that is merely not a close phrase, and an
+ *             ordinary non-close answer to an unmarked question. Both are
+ *             NEUTRAL below.
+ *   • NEUTRAL everything the model can produce or the harness injects: system/
+ *             sdk replay, isMeta bodies, sidechain, interruptedMessageId
+ *             companions, a command-invocation record, assistant,
+ *             tool_result, task-notification — and, under the current rule, any typed
+ *             text that is neither a close phrase nor a retraction phrase. An
+ *             unrecognized message must not silently close a gate the user
+ *             already opened; that per-turn overwrite (`granted =
+ *             isClosePattern(userText)` on every typed record) is exactly what
+ *             produced the close skill's own reflection question reading as a
+ *             retraction, and is what this walk replaces.
+ *   • FATAL   an unparseable line — the transcript is being appended to or is
+ *             corrupt, so refuse rather than read a half-written record.
  *
- * The last grant wins and a later invalidate expires it, so a stale close (Defect
- * B), a queued "keep working" after a close, and a non-close AskUserQuestion
- * selection all correctly read as NOT closed. Abandoned-branch staleness is a
- * known limit (no leaf pointer exists to resolve it — see the branch note on the
- * function), mitigated by the lease.
+ * The last OPEN/CLOSE event wins, so a stale close (Defect B), a queued "keep
+ * working" after a close, and a non-close AskUserQuestion selection all
+ * correctly read as not open. Abandoned-branch staleness is a known limit (no
+ * leaf pointer exists to resolve it — see the branch note in the body),
+ * mitigated the same way: any later live user intent, on any branch, still
+ * closes it.
  *
- * THE APPROVAL LINE IS NOT A CHANGE OF MIND. The lease exists to catch a user who
- * changed their mind, and it also caught the user for doing what the close
- * procedure told them to do. `proposal challenge` instructs the user to type
- * `apply-proposals <nonce>`, which can never be a close phrase, so typing it
- * expired the close grant given a turn earlier (measured 2026-08-06: the close
- * needed three approval round trips because of it). Two gates read one transcript
- * under two rules, and passing one broke the other.
- *
- * So one carve-out: a user message that IS the approval line, for a nonce this
- * transcript shows being minted, is NEUTRAL. It never grants; a lease that was not
- * already live stays dead. The mint has to be correlated, not merely present:
- * `collectMinted` reads only a tool_result correlated to a Bash tool_use, and only
- * when the surrounding challenge framing is there too, so a hex the model typed in
- * its own prose (or any other tool's output) is not a mint. Order is part of it:
- * the set fills as the walk goes, so a message can never mint the nonce it spends.
- * An unminted hex is ordinary text and still expires the lease.
- *
- * What this does NOT cover: an AskUserQuestion answer during the close procedure
- * (the skill's Step 1a reflections) still expires the lease. A carve-out was
- * written for it and withdrawn, because "the answer does not read as a retraction"
- * is fail-open on an open class of phrasings, and this repo routes an unknown value
- * to the cautious branch. Recognizing a close-procedure answer POSITIVELY needs a
- * marker on the question, and the model authors the question. The round trip stays.
+ * The typed `apply-proposals <nonce>` approval line no longer needs its own
+ * carve-out. It used to: the old per-turn rule closed on ANY typed text that
+ * was not itself a close phrase, and the approval line the close procedure
+ * instructs the user to type can never BE a close phrase — so following that
+ * instruction closed the gate the instruction was for (measured 2026-08-06:
+ * three round trips to close because of it). With the per-turn overwrite gone,
+ * the approval line is ordinary typed text — neither a close phrase nor a
+ * retraction phrase — so it falls to NEUTRAL by the same rule every other
+ * unrecognized message gets, with no special case required.
  *
  * Threat model: an honest-but-drifting model that does not forge the
- * transcript. This is a safety interlock, not an authorization boundary — a model
- * that forges records is out of scope and documented so. The carve-out does not
- * move that boundary: it only PRESERVES a grant the user already gave, so the model
- * still cannot manufacture one. The residual it does carry: a model that runs an
- * arbitrary Bash command can print the challenge framing itself and plant a mint.
- * That buys it nothing on its own, because the user still has to send the approval
- * line, and the result is neutrality rather than a grant.
+ * transcript. This is a safety interlock, not an authorization boundary — a
+ * model that forges records is out of scope and documented so.
  *
- * A command invocation is NOT a channel here. `/hypo:crystallize` typed by the user
- * was accepted as a grant for one review round and removed: the harness records a
- * model-issued Skill call as the same non-meta `<command-name>` user record
- * (verified against Claude Code 2.1.243's `processPromptSlashCommand`), so the
- * model could have closed the session by calling its own skill. The premise that a
- * command tag proves a human typed it is false.
+ * Fail-closed: any read/parse error → not open.
  *
- * Fail-closed: any read/parse error, or an unresolvable branch, → false.
+ * @returns {{open: boolean, openedAtIndex: number}} `openedAtIndex` is the
+ *   position, in the FATAL-filtered record array this walk builds internally
+ *   (blank lines dropped, non-object JSON values dropped, first parse failure
+ *   returns early), of the most recent event that opened the gate, or -1 if
+ *   none ever did. `close-gate-store.mjs`'s `resolutionStamp` counts records
+ *   by the same definition, so the two indices are comparable.
  */
 // Genuine user text of a record, or null when the record is on a channel the
 // honest-but-drifting model can reach (so it is never user intent — NEUTRAL).
@@ -4549,10 +4795,20 @@ export function resolveTranscriptBySessionId(
 //                       companion of a delivered /compact)
 //   • Stop-hook feedback  the hook's own close nudge — circular
 //   • tool_result blocks  tool output, not typed text
+//   • a command-invocation tag (<command-name>/<command-message>/<command-args>)
+//     anywhere in the text. Claude Code routes a model-issued Skill
+//     call through the same processPromptSlashCommand path a human's typed
+//     `/hypo:crystallize` goes through, and both land as this identical
+//     non-meta role:user record — so a tag proves nothing about who produced
+//     it. Excluding the whole text, not just the tag substring, means a close
+//     phrase riding along in <command-args> (e.g. `/hypo:crystallize 세션
+//     마무리해줘`) cannot open the gate either; the user still opens it by
+//     saying the same words in plain text.
 // No promptSource allowlist is required: requiring `typed` would drop the
 // legacy absent-promptSource close the older gate has always honoured, while the
 // dangerous replay/injection paths carry system|sdk|isMeta|isSidechain and are
 // excluded here anyway.
+const COMMAND_INVOCATION_TAG = /<command-(?:name|message|args)>/;
 function eventUserText(obj) {
   if (obj.isMeta === true) return null;
   if (obj.promptSource === 'system' || obj.promptSource === 'sdk') return null;
@@ -4562,16 +4818,42 @@ function eventUserText(obj) {
   const role = msg.role ?? obj.role ?? obj.type;
   if (role !== 'user') return null;
   const content = msg.content ?? obj.content;
+  let text = null;
   if (typeof content === 'string') {
-    return content.startsWith('Stop hook feedback') ? null : content;
-  }
-  if (Array.isArray(content)) {
+    text = content.startsWith('Stop hook feedback') ? null : content;
+  } else if (Array.isArray(content)) {
     const texts = content
       .filter((b) => b && b.type === 'text' && typeof b.text === 'string')
       .map((b) => b.text);
-    return texts.length ? texts.join('\n') : null;
+    text = texts.length ? texts.join('\n') : null;
+    // A command-invocation tag split across adjacent text blocks (e.g.
+    // '<command-na' + 'me>/hypo:crystallize</command-name>') would survive the
+    // '\n'-joined `text` above with a newline spliced into the middle of the
+    // tag name, so the plain check below can miss it entirely. Today's actual
+    // host format sends the whole invocation as ONE string, so this exact
+    // split is not reproducible against a live session yet — but a check for
+    // "did the host format ever put the tag exactly on a block boundary"
+    // should not depend on where a future host happens to cut the blocks. So
+    // also test each run of CONSECUTIVE text blocks joined with no separator.
+    // This must stay scoped to consecutive text blocks only, never the whole
+    // array: joining across a non-text block in between (an image, say) would
+    // synthesize a tag that never existed in the real content, and that is a
+    // different bug, not a fix — it would throw away a genuine close spoken
+    // next to an unrelated attachment. So a non-text block ends the current
+    // run and starts a new one; it never bridges two runs into one string.
+    let tightRun = '';
+    for (const b of content) {
+      if (b && b.type === 'text' && typeof b.text === 'string') {
+        tightRun += b.text;
+        continue;
+      }
+      if (COMMAND_INVOCATION_TAG.test(tightRun)) return null;
+      tightRun = '';
+    }
+    if (COMMAND_INVOCATION_TAG.test(tightRun)) return null;
   }
-  return null;
+  if (text != null && COMMAND_INVOCATION_TAG.test(text)) return null;
+  return text;
 }
 
 // A record on a channel the honest-but-drifting model can reach, so it can never
@@ -4586,17 +4868,17 @@ function isModelReachableRecord(obj) {
   );
 }
 
-export function hasUserCloseSignal(transcriptPath) {
-  if (!transcriptPath) return false;
+export function walkCloseGate(transcriptPath) {
+  if (!transcriptPath) return { open: false, openedAtIndex: -1 };
   let raw;
   try {
     raw = readFileSync(transcriptPath, 'utf-8');
   } catch {
-    return false;
+    return { open: false, openedAtIndex: -1 };
   }
   // FATAL: a non-empty line that will not parse means the transcript is being
   // appended to (a half-written record) or is corrupt. Skipping it would let a
-  // stale prior grant survive past an event we cannot read, so refuse. A line
+  // stale prior open survive past an event we cannot read, so refuse. A line
   // that parses to a non-object (a bare null / string / number) is valid JSON but
   // not a record — noise, not corruption — so it is skipped, not fatal, and never
   // reaches the field reads below.
@@ -4607,136 +4889,121 @@ export function hasUserCloseSignal(transcriptPath) {
     try {
       o = JSON.parse(line);
     } catch {
-      return false;
+      return { open: false, openedAtIndex: -1 };
     }
     if (o === null || typeof o !== 'object') continue;
     recs.push(o);
   }
 
-  // The approval is a LEASE, not an existence fact: walk the transcript in line
-  // order and track whether the LATEST user decision is a grant. Each grant sets
-  // it true, each invalidate sets it false, neutral leaves it — so at the end
-  // `granted` is "the most recent user decision was to close, and nothing has
-  // expired it since", which is how a stale close and a queued change-of-mind
-  // read as NOT closed.
+  // Walk the transcript in line order and track whether the LATEST event opened
+  // or closed the gate — last event wins, so a stale open and a queued
+  // change-of-mind both correctly read as closed.
   //
   // Branch note: line order mixes an abandoned branch's records with the live
   // ones. A leaf-pointer ancestry filter was tried and withdrawn — the transcript
   // carries no authoritative leaf pointer (measured: 0 leafUuid / summary
-  // records), so a heuristic leaf can skip the real invalidator and PRESERVE a
-  // stale grant (a fail-open, not a conservative filter). Until such a pointer
-  // exists, a close on a branch abandoned under a neutral tail is a known
-  // staleness limit, mitigated by the lease: any later live user intent, on any
-  // branch, still expires it.
+  // records), so a heuristic leaf can skip the real closing event and PRESERVE a
+  // stale open (a fail-open, not a conservative filter). Until such a pointer
+  // exists, an open on a branch abandoned under a neutral tail is a known
+  // staleness limit, mitigated the same way: any later live user intent, on any
+  // branch, still closes it.
   const askIds = new Set();
-  // Bash tool_use ids, so a mint can be tied to a command that actually ran rather
-  // than to any string in the file. Filled in the same content scan as askIds.
-  const bashIds = new Set();
-  let granted = false;
-  // The nonces this transcript shows `proposal challenge` minting. Producer, not
-  // just presence: the hex has to arrive in a NON-error tool_result of a Bash
-  // tool_use, wrapped in the challenge's own framing. Model prose carrying a
-  // plausible hex, an isMeta/system body, and any other tool's output all fail
-  // that, which matters because a mint neutralizes the user's next message. The
-  // set fills as the walk goes, so a message cannot mint the nonce it spends.
-  const mintedNonces = new Set();
-  const challengeMint = new RegExp(
-    `must type this line in the conversation:\\s*${APPROVAL_PHRASE} ([a-f0-9]{32,})\\s*Then run: hypomnema proposal resolve`,
-    'g',
-  );
-  const approvalLine = new RegExp(`^${APPROVAL_PHRASE}\\s+([a-f0-9]{32,})$`);
-  const collectMinted = (o) => {
-    const c = (o.message ?? o).content;
-    if (!Array.isArray(c)) return;
-    for (const b of c) {
-      if (!b || typeof b !== 'object') continue;
-      if (b.type !== 'tool_result' || !b.tool_use_id || !bashIds.has(b.tool_use_id)) continue;
-      if (b.is_error === true) continue;
-      const text = typeof b.content === 'string' ? b.content : JSON.stringify(b.content);
-      if (typeof text !== 'string' || !text.includes(APPROVAL_PHRASE)) continue;
-      for (const m of text.matchAll(challengeMint)) mintedNonces.add(m[1]);
-    }
-  };
-
-  for (const o of recs) {
+  // Subset of askIds whose tool_use input carries CLOSE_RECONFIRM_MARK, i.e.
+  // it IS our close-reconfirm prompt, not some unrelated question the model
+  // happens to ask around the same time. Same correlation guard
+  // isCloseReconfirmDeclined uses (see its doc comment below), reimplemented
+  // here rather than calling that function: its re-arm rule only recognizes a
+  // typed close phrase, which misses the three new openers this walk already
+  // tracks (a queued /compact, a human-origin queued delivery, an
+  // AskUserQuestion close answer). Driving decline off this walk instead means
+  // any of those already reopens the gate for free, with no separate re-arm
+  // rule to keep in sync.
+  const markedAskIds = new Set();
+  let open = false;
+  let openedAtIndex = -1;
+
+  for (let i = 0; i < recs.length; i++) {
+    const o = recs[i];
     // Genuine user text of this record, or null when the record is on a channel
-    // the model can reach. Computed once here: the mint scan below is the exact
-    // complement of it (mint from everything that is NOT the user's own text).
+    // the model can reach (including a command-invocation record).
     const userText = eventUserText(o);
-    if (userText == null) collectMinted(o);
 
     // Queue operations. The queue carries no correlation key (measured), so the
     // ENQUEUE content is the decision — not a later contentless dequeue, which
     // would need pairing we cannot do. Reading the enqueue also keeps the live
     // PreCompact gate working (it sees the enqueue) and avoids double-counting the
     // replay companion of an already-decided item (the /compact replay is not a
-    // fresh decision). popAll cancels the queue → invalidate. Delivery ops
+    // fresh decision). popAll cancels the queue → close. Delivery ops
     // (dequeue, remove) carry no fresh decision here — a content-bearing remove of
     // an NL queued command is handled by its queued_command attachment below.
     if (o.type === 'queue-operation') {
       if (o.operation === 'popAll') {
-        granted = false;
+        open = false;
         continue;
       }
       if (o.operation !== 'enqueue') continue;
       const c = typeof o.content === 'string' ? o.content.trim() : '';
-      if (/^\/compact(?:\s|$)/.test(c))
-        granted = true; // a user compaction preserves the work → grant
-      else if (/^\/clear(?:\s|$)/.test(c))
-        granted = false; // abandons context → invalidate
-      else if (!c || c.startsWith('<task-notification>')) {
+      if (/^\/compact(?:\s|$)/.test(c)) {
+        open = true; // a user compaction preserves the work → open
+        openedAtIndex = i;
+      } else if (/^\/clear(?:\s|$)/.test(c)) {
+        open = false; // abandons context → close
+      } else if (!c || c.startsWith('<task-notification>')) {
         /* model-caused / empty — neutral */
       } else if (isClosePattern(c)) {
         /* NL close via the queue — the open dequeue gap: the producer cannot be
-           attributed (a peer/model enqueue wears the same shape), so no grant */
-      } else granted = false; // a queued non-close user intent → invalidate (change of mind)
+           attributed (a peer/model enqueue wears the same shape), so no open */
+      } else open = false; // a queued non-close user intent → close (change of mind)
       continue;
     }
 
     // remove-path delivery of a queued natural-language command (measured: the
     // item leaves the queue as it is handed to the model, landing as an
-    // `attachment` of type queued_command with the prompt verbatim). A close here
-    // grants ONLY with an audited human producer — origin.kind "human", present
+    // `attachment` of type queued_command with the prompt verbatim). This opens
+    // the gate ONLY with an audited human producer — origin.kind "human", present
     // on every 2.1.181+ user delivery (measured). A legacy origin-absent delivery
-    // cannot attest a producer, so it does not grant (fail-closed). A NON-close
-    // queued command (e.g. "keep working") is a fresh user intent and INVALIDATES
-    // a prior grant regardless of origin — that is what closes the re-close hole
-    // where a queued "continue" after a close leaves the stale lease live.
+    // cannot attest a producer, so it does not open (fail-closed). A NON-close
+    // queued command (e.g. "keep working") is a fresh user intent and CLOSES
+    // a prior open regardless of origin — that is what closes the re-close hole
+    // where a queued "continue" after a close leaves the stale open live.
     if (o.type === 'attachment' && o.attachment && o.attachment.type === 'queued_command') {
       const prompt = typeof o.attachment.prompt === 'string' ? o.attachment.prompt : '';
       const humanOrigin = !!(o.attachment.origin && o.attachment.origin.kind === 'human');
       if (isClosePattern(prompt)) {
-        if (humanOrigin) granted = true;
+        if (humanOrigin) {
+          open = true;
+          openedAtIndex = i;
+        }
       } else if (prompt) {
-        granted = false;
+        open = false;
       }
       continue;
     }
 
     // Record AskUserQuestion tool_use ids (assistant record, always precedes its
-    // answer in line order). Bash ids ride along in the same scan, for the mint
-    // correlation above.
+    // answer in line order), and separately mark the ones that ARE our
+    // close-reconfirm prompt (input carries CLOSE_RECONFIRM_MARK).
     const content = (o.message ?? o).content;
     if (Array.isArray(content)) {
       for (const b of content) {
         if (!b || typeof b !== 'object' || b.type !== 'tool_use' || !b.id) continue;
-        if (b.name === 'AskUserQuestion') askIds.add(b.id);
-        else if (b.name === 'Bash') bashIds.add(b.id);
+        if (b.name !== 'AskUserQuestion') continue;
+        askIds.add(b.id);
+        if (JSON.stringify(b.input ?? null).includes(CLOSE_RECONFIRM_MARK)) markedAskIds.add(b.id);
       }
     }
 
-    // Genuine user text → grant on a close phrase, invalidate on anything else,
-    // minus the one carve-out for what the product itself asked the user to send.
+    // Genuine typed user text. A close phrase opens the gate; the retraction
+    // tripwire closes it; everything else is neutral (an
+    // unrecognized phrase must not silently close a gate the user opened, so
+    // there is no default "else close" branch here the way there used to be).
     if (userText != null && userText !== '') {
-      const spend = approvalLine.exec(userText.trim());
-      if (spend && mintedNonces.has(spend[1])) {
-        // The approval line `proposal challenge` tells the user to type, bound to a
-        // nonce this transcript minted. Neutral, never a grant: an untouched
-        // `granted` that was false stays false. An unminted hex is ordinary text and
-        // falls through to the invalidating branch below.
-        continue;
+      if (isClosePattern(userText)) {
+        open = true;
+        openedAtIndex = i;
+      } else if (isCloseRetractionPattern(userText)) {
+        open = false;
       }
-      granted = isClosePattern(userText);
       continue;
     }
 
@@ -4745,7 +5012,20 @@ export function hasUserCloseSignal(transcriptPath) {
     // record from reaching the answer parser. is_error:false AND the host's
     // success marker are required because a malformed AskUserQuestion echoes the
     // raw input back in an is_error result, and the model authors the option
-    // labels. A close selection grants; any other real selection invalidates.
+    // labels.
+    //
+    // T5: a close phrase in the answer opens the gate, same as before. But a
+    // decline no longer closes it on its own: only a decline answering a
+    // MARKED prompt (ours, see markedAskIds above) does. Every other answer,
+    // including a non-close, non-decline click and a decline to an unmarked
+    // question, is neutral. The old default (any other real selection closed
+    // the gate) let a reflection question the close skill's own Step 1a asks
+    // mid-procedure cancel the approval that started that procedure: the
+    // model asks something adjacent, the user answers plainly, and the answer
+    // was not a close phrase, so the old rule read it as a change of mind.
+    // The loss this buys: an unmarked question answered with "지금 종료하지
+    // 말아 줘" (a real request to keep going, just not phrased as a decline
+    // to OUR prompt) now passes through neutral instead of closing the gate.
     if (Array.isArray(content) && !isModelReachableRecord(o)) {
       for (const b of content) {
         if (!b || typeof b !== 'object') continue;
@@ -4753,18 +5033,46 @@ export function hasUserCloseSignal(transcriptPath) {
         if (b.is_error === true) continue;
         const s = typeof b.content === 'string' ? b.content : JSON.stringify(b.content);
         if (!/have been answered/.test(s)) continue;
-        let sawAnswer = false;
         let sawClose = false;
+        let sawDecline = false;
         for (const m of s.matchAll(/="([^"]*)"/g)) {
-          sawAnswer = true;
+          // Independent checks, not else-if: a marked prompt's decline option
+          // can itself contain close wording (the model authors the text),
+          // and the decline-wins priority below only works if sawDecline gets
+          // set even when the same string also matches isClosePattern.
           if (isClosePattern(m[1])) sawClose = true;
+          if (CLOSE_RECONFIRM_DECLINE_WORDS.test(m[1])) sawDecline = true;
+        }
+        // A decline on a MARKED prompt wins over a close match checked on the
+        // same answer. The model authors the option text, and a marked prompt
+        // exists precisely to ask "close now, yes or no", so an answer that
+        // reads as a decline of THAT question must not be overridable by a
+        // close phrase riding along elsewhere in the same answer string. If
+        // the close check ran first, the model could word a decline option to
+        // also contain a close phrase and force the gate open on its own
+        // rejection.
+        if (sawDecline && markedAskIds.has(b.tool_use_id)) {
+          open = false;
+        } else if (sawClose) {
+          open = true;
+          openedAtIndex = i;
         }
-        if (sawClose) granted = true;
-        else if (sawAnswer) granted = false;
       }
     }
   }
-  return granted;
+  return { open, openedAtIndex };
+}
+
+/**
+ * Public opening-axis predicate: does this transcript's typed/queued/answered
+ * event history currently leave the close gate open? A thin boolean wrapper
+ * over {@link walkCloseGate} — every caller that only needs the verdict uses
+ * this. `close-gate-store.mjs`'s `closeGateStatus` imports `walkCloseGate`
+ * directly instead, because it also needs `openedAtIndex` to order the open
+ * against a recorded resolution.
+ */
+export function isCloseGateOpen(transcriptPath) {
+  return walkCloseGate(transcriptPath).open;
 }
 
 /** The literal the user must type to approve a parked-overwrite batch. */
@@ -4774,7 +5082,7 @@ export const APPROVAL_PHRASE = 'apply-proposals';
  * True iff the transcript carries a user's TYPED approval of the batch this nonce
  * was minted for — the authorization gate for a transcript-approved apply.
  *
- * Deliberately NOT hasUserCloseSignal. That function answers "did the user want to
+ * Deliberately NOT isCloseGateOpen. That function answers "did the user want to
  * end the session", and it accepts a correlated AskUserQuestion answer as evidence
  * (see above). Reusing it here would let a SESSION-CLOSE approval spend itself as an
  * OVERWRITE approval: different authority, different question. Two gates, two
@@ -4887,6 +5195,16 @@ export function hasPendingBackgroundWork(payload) {
 // reason silently break this correlation with no test to catch it.
 export const CLOSE_RECONFIRM_MARK = '지금 닫기';
 
+// The decline vocabulary shared by walkCloseGate's marked-reconfirm click
+// branch and isCloseReconfirmDeclined below. One constant so the two walks
+// cannot drift into recognizing different words for the same "not now"
+// answer: they stay separate WALKS on purpose (isCloseReconfirmDeclined's
+// re-arm rule only recognizes a typed close phrase, which is too narrow for
+// walkCloseGate's other openers), but the vocabulary they match against is
+// one value, not two copies that a future edit could update in only one
+// place.
+const CLOSE_RECONFIRM_DECLINE_WORDS = /(아직|나중|not\s?yet|later)/i;
+
 /**
  * True iff the LATEST correlated AskUserQuestion answer in the transcript
  * declined an autoclose reconfirm prompt ("아직" / "나중" / "not yet" /
@@ -4895,10 +5213,11 @@ export const CLOSE_RECONFIRM_MARK = '지금 닫기';
  *
  * Read-only, forward scan over the FULL transcript (no tail truncation — a
  * decline can precede the next Stop by any number of turns). Reuses the same
- * askIds + tool_use_id correlation `hasUserCloseSignal` (above) uses to bind
+ * askIds + tool_use_id correlation `walkCloseGate` (above) uses to bind
  * an AskUserQuestion answer to its own tool_use, so an unrelated tool_result
- * string can't forge a decline. Unlike `hasUserCloseSignal` (which is a
- * "any evidence, ever" OR), this tracks a single latest-wins boolean as it
+ * string can't forge a decline. Unlike `walkCloseGate` (which is already a
+ * latest-event-wins walk, not an "any evidence, ever" OR), this tracks a
+ * separate single latest-wins boolean as it
  * scans: a decline answer sets it true, and any later GENUINE USER close
  * signal resets it to false — the user asked to close again, so the prior
  * decline no longer applies.
@@ -4931,7 +5250,6 @@ export function isCloseReconfirmDeclined(transcriptPath) {
   } catch {
     return false;
   }
-  const DECLINE = /(아직|나중|not\s?yet|later)/i;
   const askIds = new Set();
   let declined = false;
   for (const line of lines) {
@@ -4980,7 +5298,7 @@ export function isCloseReconfirmDeclined(transcriptPath) {
       if (b.type === 'tool_result' && b.tool_use_id && askIds.has(b.tool_use_id)) {
         const s = typeof b.content === 'string' ? b.content : JSON.stringify(b.content);
         for (const m of s.matchAll(/="([^"]*)"/g)) {
-          if (DECLINE.test(m[1])) declined = true;
+          if (CLOSE_RECONFIRM_DECLINE_WORDS.test(m[1])) declined = true;
         }
       }
     }