hypomnema 1.8.1 → 1.8.2

package/hooks/hypo-web-fetch-ingest.mjs

@@ -15,11 +15,11 @@
  *     graph before adding a new source.
  *
  * Output contract — Claude Code docs, "Add context for Claude":
- *   PostToolUse uses **nested** hookSpecificOutput.additionalContext, NOT
- *   the top-level additionalContext that UserPromptSubmit hooks use.
- *   buildOutput() in hypo-shared.mjs is the top-level helper used by
- *   hypo-first-prompt / hypo-lookup; intentionally not reused here. See
- *   commit 515458f for the per-event matrix this codebase follows.
+ *   PostToolUse uses **nested** hookSpecificOutput.additionalContext, the
+ *   same shape every other injecting event in this codebase now uses.
+ *   buildOutput() in hypo-shared.mjs emits that nested shape given the
+ *   hookEventName, so this hook calls it too instead of building the
+ *   object by hand.
  *
  * URL redaction:
  *   additionalContext lands in the transcript. Query strings and
@@ -41,7 +41,7 @@
  * in-hook failure branch is needed.
  */
 
-import { isGateSkipped } from './hypo-shared.mjs';
+import { isGateSkipped, buildOutput } from './hypo-shared.mjs';
 
 let input = {};
 try {
@@ -58,13 +58,9 @@ try {
 }
 
 const context = buildContext(input);
-const output = { continue: true, suppressOutput: true };
-if (context) {
-  output.hookSpecificOutput = {
-    hookEventName: 'PostToolUse',
-    additionalContext: context,
-  };
-}
+const output = context
+  ? buildOutput('PostToolUse', context, { continue: true, suppressOutput: true })
+  : { continue: true, suppressOutput: true };
 console.log(JSON.stringify(output));
 
 function buildContext(data) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hypomnema",
-  "version": "1.8.1",
+  "version": "1.8.2",
   "description": "LLM-native personal wiki system for Claude Code",
   "type": "module",
   "license": "MIT",
@@ -87,6 +87,7 @@
     "fix:verify": "node scripts/fix-status-verify.mjs",
     "graph": "node scripts/graph.mjs",
     "smoke-pack": "node scripts/smoke-pack.mjs",
+    "check:release-vehicle": "node scripts/check-release-vehicle.mjs",
     "check:versions": "node scripts/check-versions.mjs",
     "smoke:plugin": "node scripts/smoke-plugin.mjs",
     "check:bilingual": "node scripts/check-bilingual.mjs --changelog",

package/scripts/doctor.mjs

@@ -34,6 +34,7 @@ import {
   collectProjectWorkingDirs,
   detectSessionCloseArtifact,
   localAndUtcDates,
+  normalizeVerifiedScope,
   SESSION_CLOSED_MARKER_STALE_MS,
   isUsablePkgRootLocal,
   selfLocationPkgRootFrom,
@@ -916,14 +917,32 @@ function deriveCommitProjects(hypoDir, hash) {
 //     an artifact with no verifiable scope, so this never matches, ever.
 //   • 'projects' — a project file, or a commit that touched one or more
 //     identifiable projects/<slug>/ paths. EVERY named project must appear
-//     in the marker's own `projects` list.
+//     in the marker's own `projects` list, AND, when the marker carries a
+//     `verified_scope` (session-close-scope-boundary spec §3), in that
+//     scope's own `projects` too — an AND, never an OR. `projects` is
+//     evidence-based attribution; `verified_scope` is what the gate that
+//     wrote this marker actually checked, and the two can diverge (an
+//     unnarrowed gate run can attribute to more projects than it verified).
+//     A `verified_scope` of kind 'log-only' verified no project at all, so it
+//     can never cover a 'projects'-scoped artifact. A marker with NO
+//     `verified_scope` (every marker before this field existed) skips this
+//     extra check entirely — it neither tightens nor loosens the membership
+//     check above, so old markers read back byte-for-byte as before.
 function markerCoversArtifact(marker, artifact) {
   if (!marker.dates.includes(artifact.date)) return false;
   switch (artifact.scope.kind) {
     case 'root-universal':
       return true;
     case 'projects':
-      return artifact.scope.projects.every((p) => marker.projects.includes(p));
+      if (!artifact.scope.projects.every((p) => marker.projects.includes(p))) return false;
+      if (!marker.verifiedScope) return true;
+      // Unreachable for a 'projects' artifact today: a log-only close writes
+      // `projects: []`, so the membership check above already returned false.
+      // Kept deliberately, not by oversight — it states the kind's meaning
+      // (log-only verified no project at all) so this stays correct if
+      // `projects` ever carries something for a log-only close.
+      if (marker.verifiedScope.kind === 'log-only') return false;
+      return artifact.scope.projects.every((p) => marker.verifiedScope.projects.includes(p));
     default:
       return false; // 'unscoped'
   }
@@ -1035,7 +1054,17 @@ function checkSessionCloseArtifacts(hypoDir) {
       // and doctor has no corroborating signal of its own to add, so it
       // must refuse it too rather than re-opening the same hole standalone.
       const projects = Array.isArray(data?.projects) ? data.projects.filter(Boolean) : [];
-      markers.push({ projects: [...new Set(projects)], dates: localAndUtcDates(new Date(ts)) });
+      // verified_scope (session-close-scope-boundary spec §3): the SAME
+      // collapse the writer runs (hooks/hypo-shared.mjs), not a hand-rolled
+      // copy — a shape this reader doesn't recognize, or a 'project'/'global'
+      // scope with an empty `projects`, reads back as "field absent" (`null`),
+      // never as a false claim.
+      const verifiedScope = normalizeVerifiedScope(data?.verified_scope);
+      markers.push({
+        projects: [...new Set(projects)],
+        dates: localAndUtcDates(new Date(ts)),
+        verifiedScope,
+      });
     } catch {
       // corrupt marker — not this check's job to clean up
     }

package/scripts/graph.mjs

@@ -22,12 +22,32 @@ import { collectPagesGraph, extractWikilinks } from './lib/wikilink.mjs';
 
 // ── arg parsing ───────────────────────────────────────────────────────────────
 
+const ALLOWED_FLAGS = ['--hypo-dir=<path>', '--format=<fmt>', '--min-edges=<n>'];
+
 function parseArgs(argv) {
   const args = { hypoDir: null, format: 'json', minEdges: 0 };
   for (const arg of argv.slice(2)) {
-    if (arg.startsWith('--hypo-dir=')) args.hypoDir = expandHome(arg.slice(11));
-    else if (arg.startsWith('--format=')) args.format = arg.slice(9);
+    if (arg.startsWith('--hypo-dir=')) {
+      // See lint.mjs's parseArgs for why an empty raw value (--hypo-dir=,
+      // or --hypo-dir="$VAULT" with VAULT unset) is rejected instead of
+      // falling through to the default-resolution branch below.
+      const raw = arg.slice(11);
+      if (!raw) {
+        console.error(`graph.mjs: --hypo-dir requires a non-empty value (got '${arg}')`);
+        console.error(`graph.mjs accepts: ${ALLOWED_FLAGS.join(', ')}`);
+        process.exit(2);
+      }
+      args.hypoDir = expandHome(raw);
+    } else if (arg.startsWith('--format=')) args.format = arg.slice(9);
     else if (arg.startsWith('--min-edges=')) args.minEdges = parseInt(arg.slice(12), 10) || 0;
+    else {
+      // No positional arguments here either, so an unmatched arg is rejected
+      // rather than dropped. See lint.mjs's parseArgs for the background
+      // this closes.
+      console.error(`graph.mjs: unrecognized argument '${arg}'`);
+      console.error(`graph.mjs accepts: ${ALLOWED_FLAGS.join(', ')}`);
+      process.exit(2);
+    }
   }
   if (!args.hypoDir) {
     const info = resolveHypoRootInfo();

package/scripts/lib/crystallize-args.mjs

@@ -3,6 +3,22 @@ import { isValidProjectName } from './project-create.mjs';
 
 // ── arg parsing ──────────────────────────────────────────────────────────────
 
+const ALLOWED_FLAGS = [
+  '--hypo-dir=<path>',
+  '--min-group=<n>',
+  '--check-session-close',
+  '--apply-session-close',
+  '--mark-session-closed',
+  '--log-only',
+  '--session-id=<id>',
+  '--payload=<path|->',
+  '--transcript-path=<path>',
+  '--session-cwd=<path>',
+  '--project=<slug>',
+  '--force',
+  '--json',
+];
+
 export function parseArgs(argv) {
   const args = {
     hypoDir: null,
@@ -19,8 +35,20 @@ export function parseArgs(argv) {
     project: null,
   };
   for (const arg of argv.slice(2)) {
-    if (arg.startsWith('--hypo-dir=')) args.hypoDir = expandHome(arg.slice(11));
-    else if (arg.startsWith('--min-group=')) args.minGroup = parseInt(arg.slice(12), 10) || 2;
+    if (arg.startsWith('--hypo-dir=')) {
+      // See scripts/lint.mjs's parseArgs for why an empty raw value
+      // (--hypo-dir=, or --hypo-dir="$VAULT" with VAULT unset) is rejected
+      // instead of falling through to resolveHypoRoot() below. For this
+      // script specifically, a silent fallback here means a session-close
+      // apply writes to the wrong vault.
+      const raw = arg.slice(11);
+      if (!raw) {
+        console.error(`crystallize.mjs: --hypo-dir requires a non-empty value (got '${arg}')`);
+        console.error(`crystallize.mjs accepts: ${ALLOWED_FLAGS.join(', ')}`);
+        process.exit(2);
+      }
+      args.hypoDir = expandHome(raw);
+    } else if (arg.startsWith('--min-group=')) args.minGroup = parseInt(arg.slice(12), 10) || 2;
     else if (arg === '--check-session-close') args.checkSessionClose = true;
     else if (arg === '--apply-session-close') args.applySessionClose = true;
     else if (arg === '--mark-session-closed') args.markSessionClosed = true;
@@ -32,6 +60,14 @@ export function parseArgs(argv) {
     else if (arg.startsWith('--project=')) args.project = arg.slice(10);
     else if (arg === '--force') args.force = true;
     else if (arg === '--json') args.json = true;
+    else {
+      // No positional arguments here either, so an unmatched arg is rejected
+      // rather than dropped. See scripts/lint.mjs's parseArgs for the
+      // background this closes.
+      console.error(`crystallize.mjs: unrecognized argument '${arg}'`);
+      console.error(`crystallize.mjs accepts: ${ALLOWED_FLAGS.join(', ')}`);
+      process.exit(2);
+    }
   }
   if (!args.hypoDir) args.hypoDir = resolveHypoRoot();
   // --project=<slug> override (check/mark only). Validate the SYNTAX here so a

package/scripts/lib/crystallize-close-apply.mjs

@@ -472,10 +472,31 @@ export function runMarkSessionClosed(args) {
     process.exit(1);
   }
   const markerProject = !args.logOnly && args.project ? args.project : markerProjects[0];
+  // verified_scope (session-close-scope-boundary spec §3, revised 2026-09-07):
+  // records the set the gate ABOVE actually made a row for and evaluated —
+  // never `markerProjects` (evidence-based attribution, `projects` above).
+  // `closeScope: [args.project]` widens resolveCloseScope's mine/foreign
+  // partition (it feeds `opts.closeScope`, never `opts.projectOverride`), so
+  // it does NOT narrow `sessionCloseGlobalStatus`: the gate ran unnarrowed
+  // regardless of --project (resolveGateProjectOverride's own doc comment;
+  // hypo-shared.mjs's sessionCloseGlobalStatus/precompactGateStatus doc
+  // comments). `kind` is therefore always 'global' here. 'project' stays a
+  // shape normalizeVerifiedScope and doctor's reader accept — for a future
+  // writer that DOES pass opts.projectOverride, which none of the four
+  // marker-writing paths do today. The earlier premise here (an explicit
+  // --project earns 'project') was a doctor regression: a transcript-widened
+  // scope can attribute a project the gate never put a row for, and stamping
+  // markerProjects verbatim let that project's close artifacts pass doctor's
+  // correlation unchecked.
+  const evaluatedProjects = (status.projects || []).map((p) => p.project).filter(Boolean);
+  const verifiedScope = args.logOnly
+    ? { kind: 'log-only' }
+    : { kind: 'global', projects: evaluatedProjects };
   writeSessionClosedMarker(args.hypoDir, args.sessionId, {
     project: markerProject,
     projects: args.logOnly ? [] : markerProjects,
     ...(args.logOnly ? { scope: 'log-only' } : {}),
+    verifiedScope,
   });
   // Marker writer swallows IO errors (best-effort, see hypo-shared.mjs). Verify
   // the file actually landed before claiming success — otherwise CLI exits 0
@@ -609,8 +630,12 @@ const CLOSE_REFUSAL_HELP = [
  * counts (extractUserMessages drops injected, tool, and hook-feedback text).
  *
  *   { ok: true }
- *   { ok: false, reason, error }   reason: session-id-required | transcript-unresolved
- *                                          | no-user-close-signal
+ *   { ok: false, reason, error, gateReason? }   reason: session-id-required |
+ *     transcript-unresolved | no-user-close-signal. `gateReason` is only present
+ *     when `reason` is `no-user-close-signal`, and carries closeGateStatus's own
+ *     reason string (no-open / transcript-rewrite-detected /
+ *     no-new-open-since-resolution) for a caller that wants to tell those three
+ *     apart without parsing `error`.
  */
 function verifyCloseAuthority(sessionId, hypoDir) {
   if (!sessionId) {
@@ -640,6 +665,13 @@ function verifyCloseAuthority(sessionId, hypoDir) {
     return {
       ok: false,
       reason: 'no-user-close-signal',
+      // The user-facing `reason` above stays the single collapsed string
+      // tests and downstream tooling already key on (see this function's own
+      // doc comment). `gateReason` carries closeGateStatus's actual reason
+      // (no-open / transcript-rewrite-detected / no-new-open-since-resolution)
+      // as a separate, machine-readable field, so a caller can tell the three
+      // apart without parsing the "Gate detail: ..." substring out of `error`.
+      gateReason: gateStatus.reason,
       error:
         "session-close apply refused before any wiki write or commit: this session's transcript " +
         'carries no user close signal. The user did not ask to close. ' +
@@ -755,6 +787,11 @@ function refuseUnlessCloseRequested(args) {
       ok: false,
       stage: 'no-user-close-signal',
       reason: closeAuth.reason,
+      // Only set when `reason` is 'no-user-close-signal' (undefined otherwise,
+      // and JSON.stringify drops an undefined-valued key). Lets a caller tell
+      // apart the three closeGateStatus refusals collapsed into that one
+      // `reason` string, without parsing "Gate detail: ..." out of `error`.
+      gateReason: closeAuth.gateReason,
       applied: [],
       // `null`, not `false`: this refusal fires before the commit step is ever
       // reached (see the general result's own `committed` contract below).
@@ -1613,6 +1650,12 @@ function runMarkerPhase(args, project, appliedPaths, ok) {
     }
     let closeTranscript = null;
     let gateOk = false;
+    // verified_scope evidence (session-close-scope-boundary spec §3, revised
+    // 2026-09-07): the set the gate below actually put a row for, filled in
+    // once the gate below runs. Stays [] on any path that never reaches it
+    // (uncommitted, no transcript) — normalizeVerifiedScope drops an empty
+    // 'global' scope to "field absent" rather than persist a false claim.
+    let gateEvaluatedProjects = [];
     if (commitOutcome.committed) {
       closeTranscript = resolveTranscriptBySessionId(args.sessionId);
       // closeScope: apply KNOWS which project it just closed, and it wrote
@@ -1633,11 +1676,19 @@ function runMarkerPhase(args, project, appliedPaths, ok) {
       // `project` alone, going green on a foreign project's incomplete close
       // instead of demoting it to a notice.
       const autoMarkerOverride = resolveGateProjectOverride(args.hypoDir, { project });
-      gateOk = precompactGateStatus(args.hypoDir, {
+      const gateStatus = precompactGateStatus(args.hypoDir, {
         closeScope: [project],
         ...(closeTranscript ? { transcriptPath: closeTranscript } : {}),
         ...(autoMarkerOverride ? { attributionScope: autoMarkerOverride } : {}),
-      }).ok;
+      });
+      gateOk = gateStatus.ok;
+      // `closeScope` above widens the partition, it never narrows
+      // sessionCloseGlobalStatus (only opts.projectOverride does, and this
+      // call never sets it) — so gate.close.projects is the actual evaluated
+      // set, not necessarily just `[project]`.
+      gateEvaluatedProjects = (gateStatus.close.projects || [])
+        .map((p) => p.project)
+        .filter(Boolean);
     }
     const decision = planMarkerDecision({
       ok,
@@ -1664,7 +1715,17 @@ function runMarkerPhase(args, project, appliedPaths, ok) {
     if (decision.write) {
       // apply KNOWS its authoritative payload.project — stamp it as the v4
       // evidence set so PreCompact trusts this marker's scope directly (session-close attribution).
-      writeSessionClosedMarker(args.hypoDir, args.sessionId, { project, projects: [project] });
+      // verified_scope (revised 2026-09-07): `closeScope: [project]` above
+      // widens resolveCloseScope's partition, it does not narrow
+      // sessionCloseGlobalStatus — only opts.projectOverride does, and this
+      // call never sets it. The gate ran unnarrowed, so `kind` is 'global',
+      // with `projects` the set gate.close actually evaluated
+      // (gateEvaluatedProjects), never `[project]` verbatim.
+      writeSessionClosedMarker(args.hypoDir, args.sessionId, {
+        project,
+        projects: [project],
+        verifiedScope: { kind: 'global', projects: gateEvaluatedProjects },
+      });
       // Codex CONCERN: the writer swallows IO errors (best-effort).
       // Verify the file actually landed — mirroring the standalone path — instead of
       // asserting markerWritten=true, so a .cache permission/disk problem surfaces

package/scripts/lint.mjs

@@ -13,7 +13,9 @@
  *   --fix               Auto-add missing `updated` field (safe repairs only)
  *   --strict            Promote selected warnings (STRICT_PROMOTE_IDS) to errors
  *                       so they exit 1. Opt-in gate for release-checklist /
- *                       pre-commit; default mode stays byte-identical.
+ *                       pre-commit. Adding the flag did not change what default
+ *                       mode emits; a new warning class still adds warnings
+ *                       there, as every W9..W16 addition has.
  */
 
 import { existsSync, readFileSync, writeFileSync, readdirSync, statSync } from 'fs';
@@ -30,19 +32,45 @@ import {
 import { findDesignHistoryStale } from './lib/design-history-stale.mjs';
 import { FEEDBACK_SCOPE_RE } from './lib/feedback-scope.mjs';
 import { FAILURE_TYPE_ENUM } from './lib/failure-type.mjs';
-import { collectPagesLint, collectPagesLinkable } from './lib/wikilink.mjs';
+import { collectPagesLint, collectPagesLinkable, slugForms } from './lib/wikilink.mjs';
 import { parseFrontmatter, SEQUENCE_ENTRY_RE } from './lib/frontmatter.mjs';
 import { buildSlugMap } from './lib/slug-resolver.mjs';
 
 // ── arg parsing ──────────────────────────────────────────────────────────────
 
+const ALLOWED_FLAGS = ['--hypo-dir=<path>', '--json', '--fix', '--strict'];
+
 function parseArgs(argv) {
   const args = { hypoDir: null, json: false, fix: false, strict: false };
   for (const arg of argv.slice(2)) {
-    if (arg.startsWith('--hypo-dir=')) args.hypoDir = expandHome(arg.slice(11));
-    else if (arg === '--json') args.json = true;
+    if (arg.startsWith('--hypo-dir=')) {
+      // A raw value of '' (either `--hypo-dir=` typed directly or a shell
+      // variable that expanded to nothing, e.g. --hypo-dir="$VAULT" with
+      // VAULT unset) must not fall through to expandHome('') → '' → the
+      // `!args.hypoDir` default-resolution branch below. That silent
+      // fallback is exactly the bug this flag exists to close: a caller who
+      // believes they pointed at a specific vault ends up reading/writing
+      // the default one instead.
+      const raw = arg.slice(11);
+      if (!raw) {
+        console.error(`lint.mjs: --hypo-dir requires a non-empty value (got '${arg}')`);
+        console.error(`lint.mjs accepts: ${ALLOWED_FLAGS.join(', ')}`);
+        process.exit(2);
+      }
+      args.hypoDir = expandHome(raw);
+    } else if (arg === '--json') args.json = true;
     else if (arg === '--fix') args.fix = true;
     else if (arg === '--strict') args.strict = true;
+    else {
+      // lint.mjs takes no positional arguments, so anything unmatched above
+      // (a typo'd flag, "--", a bare "-", a stray word) is a mistake, not a
+      // no-op. Silently dropping it let a wrong flag point at the wrong
+      // vault for months: docs told models to pass --wiki-dir, but no
+      // script here ever parsed that flag.
+      console.error(`lint.mjs: unrecognized argument '${arg}'`);
+      console.error(`lint.mjs accepts: ${ALLOWED_FLAGS.join(', ')}`);
+      process.exit(2);
+    }
   }
   if (!args.hypoDir) {
     const info = resolveHypoRootInfo();
@@ -277,11 +305,33 @@ const VALID_TYPES = [
 
 const issues = [];
 
+// W15 bookkeeping, filled inside lintPage as it already reads+parses every
+// page once. Reused after the main page loop instead of re-reading every file
+// a second time just to compare `updated` dates.
+//   bySlugForm maps every page's slug form (full/bare/dirRel, the same three
+//   forms buildSlugMap derives) to { updated, count }. `count` is how many
+//   pages claim that form, because a shared bare form is NOT the same
+//   ambiguity the wikilink checker lives with: W4 only asks whether a target
+//   exists, while this rule has to pick one page's date. Picking first-wins
+//   would make the verdict depend on directory walk order. A form claimed
+//   twice is treated as unresolvable instead.
+//   `updated` is null for a page that has none (W3's concern), which is
+//   recorded rather than skipped so the source is known to exist.
+//   synthesisPages holds the type:synthesis pages that declare
+//   sources_consulted, collected for the post-loop comparison below.
+// Dates are compared as strings, which is only the same as comparing time
+// when every value is zero-padded YYYY-MM-DD. `2026-3-1 > 2026-12-15` is true
+// lexically and false in fact, so anything off this shape is excluded from the
+// comparison and reported instead of silently deciding the verdict.
+const ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+const bySlugForm = new Map();
+const synthesisPages = [];
+
 // Stable warning class IDs (W1..Wn). `--strict` promotes a frozen subset to
 // errors by ID — never by brittle message-text matching. W8 (design-history
-// stale) predates this scheme; hooks/hypo-personal-check.mjs filters `w.id ===
-// 'W8'`, so it must keep that number — the W5..W7 gap is honest history, not a
-// bug. (spec-v1.3.0 Track E)
+// stale) predates this scheme; the close gate in hooks/hypo-shared.mjs filters
+// `w.id === 'W8'`, so it must keep that number. The W5..W7 gap is honest
+// history, not a bug. (spec-v1.3.0 Track E)
 //
 // STRICT_PROMOTE_IDS (OQ-E1, frozen as a code constant): confirmed content
 // defects only.
@@ -301,6 +351,13 @@ const issues = [];
 //                             PreCompact hook no longer blocks /compact, so
 //                             that set is what --check-session-close and
 //                             --mark-session-closed read, not a compact stop.
+//   W15 synthesis-stale     → excluded, same reason as W8/W14 (a freshness
+//                             signal to triage, not a content defect), and
+//                             its own id for the same reason W14 has one: the
+//                             W8-only close-gate filter must not pick it up.
+//   W16 sources-unresolved  → excluded, same reasons as W15. It reports what
+//                             W15 could not read, so promoting one without the
+//                             other would block on the weaker signal.
 // NOTE: npm run lint / CI / release.yml / crystallize / the close-gate all
 // run plain lint, not --strict, so promotion is forward-looking there: these
 // still surface as warnings on those paths. But --strict is not unused —
@@ -392,6 +449,27 @@ function lintPage({ path, rel }, slugMap, tagVocab, pageDirs, validTypes) {
     issue('warn', rel, 'Missing frontmatter field: updated', path, 'W3');
   }
 
+  // W15 bookkeeping: record this page's slug forms → updated date, and, if it
+  // is itself a synthesis page citing sources, queue it for the post-loop
+  // check. Recorded here (not re-derived after the loop) because content and
+  // fm are already in hand from the reads above.
+  {
+    const noExt = rel.replace(/\.md$/, '').replace(/\\/g, '/');
+    // Deduplicate within one page first. slugForms collapses bare and dirRel
+    // to the same string for a page directly under pages/, so counting raw
+    // values would make every such page look like a two-page collision.
+    for (const form of new Set(Object.values(slugForms(noExt)))) {
+      if (!form) continue;
+      const prior = bySlugForm.get(form);
+      if (prior) prior.count += 1;
+      else bySlugForm.set(form, { updated: fm.updated || null, count: 1 });
+    }
+  }
+  if (fm.type === 'synthesis' && fm.sources_consulted) {
+    const sources = parseTagsField(fm.sources_consulted) || [];
+    if (sources.length > 0) synthesisPages.push({ rel, updated: fm.updated, sources });
+  }
+
   // type-conditional required fields
   if (fm.type && TYPE_CONDITIONAL_FIELDS[fm.type]) {
     for (const field of TYPE_CONDITIONAL_FIELDS[fm.type]) {
@@ -660,6 +738,81 @@ for (const s of findDesignHistoryStale(args.hypoDir)) {
   );
 }
 
+// W15: synthesis page stale relative to its own sources_consulted. A
+// type:synthesis page absorbs and condenses what other pages already
+// learned; if a listed source has moved on (its `updated` is newer than the
+// synthesis's own `updated`), the synthesis has not caught up. Runs off the
+// bookkeeping lintPage already filled above, so no page is read twice.
+//
+// A source name absent from bySlugForm (a typo, a directory rather than a
+// page, or a path outside the vault) has no date to compare, so W15 cannot
+// judge it either way. W4 does not cover it: that rule reads `[[...]]` out of
+// page bodies and never looks at frontmatter, so an unresolved name here would
+// be reported nowhere. W16 below reports it instead, which is what keeps a
+// page that resolves 4 of its 11 sources from producing a confident-looking
+// W15 built on a third of the evidence.
+// The skip in the loop states that intent; it does not change the outcome. An
+// undefined date loses every comparison it enters, so dropping the guard
+// leaves the same warnings (measured: removing it keeps all four W15 tests
+// green). It stays because the alternative parks undefined in `newest`.
+//
+// Deliberately excluded from STRICT_PROMOTE_IDS, same reasoning as W8/W14: a
+// synthesis lagging its sources is a content-freshness signal for a human to
+// triage, not a defect `--strict` should hard-block a commit on. Given its
+// own id (not W8) so hypo-shared.mjs's `w.id === 'W8'` close-gate filter
+// never mistakes it for a design-history finding.
+for (const { rel, updated, sources } of synthesisPages) {
+  let newest = null;
+  const unresolved = [];
+  for (const source of sources) {
+    const hit = bySlugForm.get(source);
+    // Three ways a source yields no date, kept apart because they tell the
+    // author to do different things. Every one of them lands in W16 below;
+    // removing this branch is what would make W16 stop reporting.
+    if (!hit) {
+      unresolved.push(`${source} (없는 이름)`);
+      continue;
+    }
+    if (hit.count > 1) {
+      unresolved.push(`${source} (${hit.count}개 페이지가 같은 이름)`);
+      continue;
+    }
+    if (!ISO_DATE_RE.test(hit.updated || '')) {
+      unresolved.push(`${source} (updated 없음 또는 YYYY-MM-DD 아님)`);
+      continue;
+    }
+    if (!newest || hit.updated > newest) newest = hit.updated;
+  }
+  const ownDateUsable = ISO_DATE_RE.test(updated || '');
+  if (newest && ownDateUsable && newest > updated) {
+    issue(
+      'warn',
+      rel,
+      `synthesis stale: sources_consulted 최신=${newest} > synthesis updated=${updated}. 새로 쌓인 학습을 반영해 갱신하거나, 반영할 내용이 없으면 updated를 확인하세요`,
+      null,
+      'W15',
+    );
+  }
+  // W16: sources W15 could not compare, reported once per page with the reason
+  // for each. Without this the rule fails open, and silently: a page whose
+  // sources mostly do not resolve still gets a W15 (or no warning at all) with
+  // nothing saying how much of the evidence was actually read. The reasons are
+  // kept apart because the fix differs: a name that resolves to nothing is a
+  // typo or a value this field is not meant to hold, a name claimed by two
+  // pages needs the longer form, and a source with no usable `updated` is W3's
+  // problem on that page. Excluded from STRICT_PROMOTE_IDS and given its own id
+  // for the same reasons as W15.
+  if (unresolved.length > 0) {
+    issue(
+      'warn',
+      rel,
+      `sources_consulted 비교 불가 ${unresolved.length}/${sources.length}: ${unresolved.join(', ')}. 이 소스들은 staleness 비교에서 빠졌습니다`,
+      null,
+      'W16',
+    );
+  }
+}
+
 // W12: project directory missing index.md. SCHEMA.md declares project-index
 // at projects/*/index.md and templates/projects/_template/ ships one, so a
 // project without it is a tooling/vault drift, not a legitimate shape — but
@@ -759,10 +912,12 @@ const errors = issues.filter((i) => i.severity === 'error');
 const warns = issues.filter((i) => i.severity === 'warn');
 
 if (args.json) {
-  // Default mode is byte-identical: only W8 carries an `id` in the JSON payload
-  // (hooks/hypo-personal-check.mjs filters on it). All other IDs stay internal
-  // unless `--strict` is set, where the full ID set is exposed so promoted
-  // findings are traceable to their warning class.
+  // The `id` field, not the warning list, is what default mode holds stable:
+  // only W8 carries one (the close gate in hooks/hypo-shared.mjs filters on
+  // it). Every other id stays internal unless `--strict` is set, where the full
+  // set is exposed so promoted findings are traceable to their warning class.
+  // A new rule does add warnings to default output; that is what a new rule is
+  // for, and W9 through W16 all did it.
   const toOut = ({ severity, file, message, id }) =>
     id && (id === 'W8' || args.strict)
       ? { severity, file, message, id }

package/scripts/query.mjs

@@ -24,13 +24,33 @@ import { currentDevice, scopeVisible, readVisibilityScope } from '../hooks/hypo-
 
 // ── arg parsing ──────────────────────────────────────────────────────────────
 
+const ALLOWED_FLAGS = ['--hypo-dir=<path>', '--q=<query>', '--limit=<n>', '--json'];
+
 function parseArgs(argv) {
   const args = { hypoDir: null, query: null, limit: 10, json: false };
   for (const arg of argv.slice(2)) {
-    if (arg.startsWith('--hypo-dir=')) args.hypoDir = expandHome(arg.slice(11));
-    else if (arg.startsWith('--q=')) args.query = arg.slice(4);
+    if (arg.startsWith('--hypo-dir=')) {
+      // See lint.mjs's parseArgs for why an empty raw value (--hypo-dir=,
+      // or --hypo-dir="$VAULT" with VAULT unset) is rejected instead of
+      // falling through to the default-resolution branch below.
+      const raw = arg.slice(11);
+      if (!raw) {
+        console.error(`query.mjs: --hypo-dir requires a non-empty value (got '${arg}')`);
+        console.error(`query.mjs accepts: ${ALLOWED_FLAGS.join(', ')}`);
+        process.exit(2);
+      }
+      args.hypoDir = expandHome(raw);
+    } else if (arg.startsWith('--q=')) args.query = arg.slice(4);
     else if (arg.startsWith('--limit=')) args.limit = parseInt(arg.slice(8), 10) || 10;
     else if (arg === '--json') args.json = true;
+    else {
+      // No positional arguments here either, so an unmatched arg is rejected
+      // rather than dropped. See lint.mjs's parseArgs for the background
+      // this closes.
+      console.error(`query.mjs: unrecognized argument '${arg}'`);
+      console.error(`query.mjs accepts: ${ALLOWED_FLAGS.join(', ')}`);
+      process.exit(2);
+    }
   }
   if (!args.hypoDir) {
     const info = resolveHypoRootInfo();

package/scripts/upgrade.mjs

@@ -924,7 +924,7 @@ function applyCommands(commandResults, force) {
     ...existing,
     pkgRoot: PKG_ROOT,
     pkgVersion,
-    schemaVersion: templateSchemaVersion(PKG_ROOT) ?? '2.1',
+    schemaVersion: templateSchemaVersion(PKG_ROOT) ?? '2.2',
     commands: newSHAs,
   });
   return applied;
@@ -950,7 +950,7 @@ function writePluginModeMetadata() {
     ...existing,
     pkgRoot: PKG_ROOT,
     pkgVersion,
-    schemaVersion: templateSchemaVersion(PKG_ROOT) ?? '2.1',
+    schemaVersion: templateSchemaVersion(PKG_ROOT) ?? '2.2',
   });
   return true;
 }