hypomnema 1.8.2 → 1.9.0

package/hooks/hypo-shared.mjs

@@ -18,7 +18,6 @@ import {
   realpathSync,
   openSync,
   unlinkSync,
-  renameSync,
   linkSync,
 } from 'fs';
 import { join, relative, basename, dirname, isAbsolute } from 'path';
@@ -26,6 +25,8 @@ import { homedir, hostname, tmpdir } from 'os';
 import { spawnSync } from 'child_process';
 import { randomBytes, createHash } from 'crypto';
 import { fileURLToPath } from 'url';
+import { atomicWrite } from './atomic-write.mjs';
+import { isValidSessionId } from './proposal-store.mjs';
 
 const HOME = homedir();
 
@@ -712,8 +713,12 @@ export function hotMdIsClean(dir = HYPO_DIR) {
 // ── strict session-close verification ────────────────────────────
 // spec §5.2.7 / §8.3 (updated 2026-05-15): session-close = steps 1~6 of the
 // 11-step crystallize checklist (synthesis is steps 7~11). The hard gate
-// (sessionCloseFileStatus) confirms the 5 mandatory files — session-state.md,
-// project hot.md, root hot.md, session-log/YYYY-MM-DD.md, and log.md.
+// (sessionCloseFileStatus) confirms the 4 mandatory files: session-state.md,
+// project hot.md, session-log/YYYY-MM-DD.md, and log.md. Root hot.md is NOT
+// one of them: it became a hook-generated projection, so the close no longer
+// writes it and the gate no longer checks it (see the note at the
+// checkUpdated calls in sessionCloseFileStatus for why its `updated:` field
+// cannot be read as this project's own date).
 // pages/open-questions.md (step 5) is conditional ("변경 시") — it is a
 // cross-project queue, so a session that raises no questions should not be
 // forced to touch it. Gating it would produce false-blocks; spec §5.2.7
@@ -1209,8 +1214,25 @@ export function pickProjectByCwd(projects, cwd, opts = {}) {
 export function collectProjectWorkingDirs(hypoDir) {
   const projectsDir = join(hypoDir, 'projects');
   if (!existsSync(projectsDir)) return [];
+  // existsSync is true for a regular file too, and it says nothing about
+  // permissions, so readdirSync here can still throw ENOTDIR or EACCES. It
+  // used to, and the caller that matters is SessionStart's cwd-to-project
+  // resolution, which runs long before the projection writer. An unguarded
+  // throw there took the whole hook to its top-level catch, which meant the
+  // projection's own scanError branch (the one that tells a person WHICH
+  // directory to fix) could never be reached on the real hook path: it was
+  // dead code for exactly the inputs it existed to report. Degrade to "no
+  // projects" instead. Resolving cwd to a project is a convenience, and the
+  // projection scan re-reads this same directory moments later and surfaces
+  // the real failure with its own notice.
+  let slugs;
+  try {
+    slugs = readdirSync(projectsDir);
+  } catch {
+    return [];
+  }
   const out = [];
-  for (const slug of readdirSync(projectsDir)) {
+  for (const slug of slugs) {
     if (slug === '_template') continue;
     const dir = join(projectsDir, slug);
     try {
@@ -1372,11 +1394,12 @@ export function findBackfillCandidate(cwd, hypoDir = HYPO_DIR) {
 
 /**
  * When the session cwd is a project working_dir distinct from the vault root,
- * the wiki/knowledge files live in the VAULT, not in this cwd. SessionStart and
- * CwdChanged inject hot.md/session-state content but never the vault's absolute
- * path, so the AI re-discovers it each session and can wrongly conclude a wiki
- * file is missing after checking only the code repo (a real misjudgment seen in
- * a dev-repo session, 2026-06-23).
+ * the wiki/knowledge files live in the VAULT, not in this cwd. SessionStart puts
+ * hot.md/session-state content in the model's context, and CwdChanged surfaces
+ * the same content as a terminal notification the model does not see, but
+ * neither carries the vault's absolute path, so the AI re-discovers it each
+ * session and can wrongly conclude a wiki file is missing after checking only
+ * the code repo (a real misjudgment seen in a dev-repo session, 2026-06-23).
  *
  * Returns a one-line "look in the vault, not here" orientation carrying the
  * absolute vault path, or '' when cwd is anywhere inside the vault tree (the
@@ -1439,6 +1462,953 @@ function pickByCwd(hypoDir, slugs, cwd) {
   });
 }
 
+// ── root hot.md projection ──────────────────────────────────────────────────
+// Root hot.md stops being a file Claude edits and becomes a deterministic
+// projection of `projects/<slug>/hot.md`: whoever reads it (resolveActiveProject,
+// closeCandidateSlugs, SessionStart's injection) gets a table built fresh off
+// disk, never a hand-maintained one that can drop a row or go stale. The row
+// set comes ONLY from a directory scan, never from parsing the previous root
+// file: that old parse (hypo-hot-rebuild.mjs's retired parsePointerRows) is
+// exactly what let a manually deleted row stay deleted forever.
+//
+// Three functions, split on purpose: scanRootHotProjectionSources does the
+// one directory walk and reports what it saw, INCLUDING whether the walk
+// itself failed; formatRootHotProjection turns scanned rows into the
+// canonical markdown, pure and disk-free; renderRootHotProjection composes
+// the two into the same pure string generator every existing caller already
+// expects, so a scan error there still resolves to "no rows" exactly like
+// before (out of scope for this pure entry point: see writeRootHotProjection
+// for the one caller that DOES act on scanError). writeRootHotProjection is
+// the only thing that ever touches disk, skipping the write entirely when the
+// projection is byte-identical to what is already there (so a no-op run
+// never dirties the file's mtime or trips a git diff), and refusing to write
+// at all when the scan itself failed (a transient read error must not commit
+// an empty/partial table over real content).
+
+const ROOT_HOT_PROJECTS_TEMPLATE_SLUG = '_template';
+
+// This exact sentence has been part of every generated root hot.md since the
+// projection shipped (separately pinned by 'generated body text is pinned' in
+// tests/session-hooks.test.mjs), so its presence on disk is proof the file is
+// already projection-owned and safe to overwrite without a backup. Its
+// absence means a hand-authored file, or one from before this projection
+// existed. See writeRootHotProjection's migration-backup step below.
+const ROOT_HOT_PROJECTION_MARKER = 'generated projection of `projects/*/hot.md`';
+
+// Sits next to hot.md itself so a person who opens the vault root finds it
+// without hunting: `hot.md.pre-projection-backup.md`. Written every time
+// writeRootHotProjection sees content it does not own (readRootHotProjectionOwnership's
+// hash comparison, not a one-shot marker check), and there is no cap: each
+// unowned write that finds the plain suffix already taken gets its own
+// numbered path from nextRootHotBackupPath, without limit.
+export const ROOT_HOT_BACKUP_SUFFIX = '.pre-projection-backup.md';
+
+// Root-anchored (leading `/`) so this only ever matches the backup sitting
+// next to hot.md itself, never an unrelated file elsewhere in the vault that
+// happens to share the tail of the name. The trailing `*` covers every
+// variant nextRootHotBackupPath can produce: the plain suffix, a `-2`/`-3`/...
+// counter, and the timestamp fallback.
+const ROOT_HOT_BACKUP_GITIGNORE_PATTERN = '/hot.md.pre-projection-backup*.md';
+
+// minor fix: atomicWrite's own temp file for a backup write
+// (`<backupPath>.<pid>.<random>.tmp`, see atomic-write.mjs) carries the exact
+// same hand-authored bytes the backup above protects, but the pattern above
+// only matches the FINAL `.md` name. A kill or power loss between that temp
+// write and its rename leaves the temp sitting unignored: no cleanup runs
+// on the next start, and nothing reads or removes it, so `git add -A`
+// exposes it. The glob's `*` matches the `.md` in the middle too (gitignore
+// globs don't stop at `.`, only at `/`), so this one pattern covers the temp
+// name for every backupPath variant nextRootHotBackupPath can produce.
+const ROOT_HOT_BACKUP_TMP_GITIGNORE_PATTERN = '/hot.md.pre-projection-backup*.tmp';
+
+/**
+ * The one recovery sentence for a hand-authored root hot.md that just got
+ * backed up before a projection write replaced it (major fix, codex 3rd-tier
+ * finding 6). Naming the backup file alone is not a recovery path: copying
+ * it back onto root hot.md just gets it replaced again on the next rebuild.
+ * Three writers can trigger this backup: SessionStart's own direct write,
+ * the Stop-hook rebuild (hypo-hot-rebuild.mjs), and project-create's own
+ * `writeRootHotProjection` call. Before this fix only SessionStart's
+ * own write site carried the guidance half of the message; the Stop-hook's
+ * health notice and project-create's warnings named the filename alone,
+ * with no route back to the content. One formatter, used by all three, so
+ * they cannot drift into three different wordings of the same advice (and
+ * so a future fourth call site gets the full message by construction,
+ * not by remembering to copy it). Matches the longer version already
+ * carried in both READMEs; do not change the wording without updating those
+ * too.
+ * @param {string} backupPath absolute path to the migration backup
+ * @returns {string}
+ */
+export function rootHotBackupRecoveryNotice(backupPath) {
+  return (
+    `루트 hot.md 의 이전 내용을 ${basename(backupPath)} 로 백업했습니다 (손으로 편집한 내용이 있었습니다). ` +
+    `루트로 되돌리지 마세요. 다음 훅 실행이 다시 덮어씁니다. 열어 본 뒤 남길 내용을 projects/<slug>/hot.md 나 별도 페이지로 옮기고 백업은 지우세요.`
+  );
+}
+
+const ROOT_HOT_PROJECTION_STATE_FILENAME = 'root-hot-projection-state.json';
+
+function sha256Hex(content) {
+  return createHash('sha256').update(content, 'utf-8').digest('hex');
+}
+
+/**
+ * Durable "did WE write the bytes currently on disk" state, read from
+ * `.cache/`. Replaces a plain `ROOT_HOT_PROJECTION_MARKER` substring check: a
+ * hand-authored hot.md that happens to quote that exact sentence (copied out
+ * of documentation, for instance) used to read as "already ours" under the
+ * substring check and skip the backup step outright, destroying real content
+ * with nothing left to recover it from. A hash of the exact bytes this
+ * function itself last wrote cannot collide by accident the way a fixed
+ * sentence can. Missing or corrupt state resolves to "no prior hash": the
+ * safe direction, since the only cost is one extra (harmless, since it is
+ * never lost) backup on the next write, never a silently skipped one.
+ * @returns {{lastHash: string|null}}
+ */
+function readRootHotProjectionOwnership(hypoDir) {
+  const path = join(hypoDir, '.cache', ROOT_HOT_PROJECTION_STATE_FILENAME);
+  if (!existsSync(path)) return { lastHash: null };
+  try {
+    const parsed = JSON.parse(readFileSync(path, 'utf-8'));
+    return { lastHash: typeof parsed?.lastHash === 'string' ? parsed.lastHash : null };
+  } catch {
+    return { lastHash: null };
+  }
+}
+
+/** Best-effort: a failure here only costs one extra backup on the NEXT
+ * write (ownership falls back to "no prior hash"), never a lost one. */
+function writeRootHotProjectionOwnership(hypoDir, hash) {
+  try {
+    atomicWrite(
+      join(hypoDir, '.cache', ROOT_HOT_PROJECTION_STATE_FILENAME),
+      JSON.stringify({ lastHash: hash }),
+    );
+  } catch {
+    // see doc comment above
+  }
+}
+
+// n1 fix (3rd-round codex review): a per-SESSION companion to the global
+// ownership state above. The global hash only proves "SOME session's write
+// is what is on disk right now": any session's writeRootHotProjection call
+// updates it, including one that runs AFTER this session claimed 'hot.md'
+// but BEFORE this session's own Stop. A vault has exactly one root hot.md,
+// so two sessions across DIFFERENT projects race it constantly (measured
+// against 349 real sessions: 2081 overlapping pairs). Without this,
+// hypo-auto-commit.mjs's rootHotProjectionIsCurrent check read "disk matches
+// the last write" as true and staged a SIBLING session's bytes into this
+// session's commit, content this session never produced. Each session's own
+// receipt records the exact digest ITS OWN write last produced, so the
+// commit-time check below can require BOTH the global hash and this
+// session's own receipt to agree with the current disk bytes.
+const ROOT_HOT_PROJECTION_RECEIPT_FILENAME = 'root-hot-projection-receipt.json';
+
+function rootHotProjectionReceiptPath(hypoDir, sessionId) {
+  return join(sessionCacheDir(hypoDir, sessionId), ROOT_HOT_PROJECTION_RECEIPT_FILENAME);
+}
+
+/**
+ * Read the digest THIS session's own write last recorded. Missing, corrupt,
+ * or no session_id all resolve to `null`: the safe direction, since the
+ * only cost of a false `null` is this session's legitimate write sitting
+ * uncommitted for one extra Stop (see rootHotProjectionIsCurrent below),
+ * never a wrongly staged write.
+ * @returns {{digest: string|null}}
+ */
+function readRootHotProjectionReceipt(hypoDir, sessionId) {
+  if (!sessionId) return { digest: null };
+  const path = rootHotProjectionReceiptPath(hypoDir, sessionId);
+  if (!existsSync(path)) return { digest: null };
+  try {
+    const parsed = JSON.parse(readFileSync(path, 'utf-8'));
+    return { digest: typeof parsed?.digest === 'string' ? parsed.digest : null };
+  } catch {
+    return { digest: null };
+  }
+}
+
+/**
+ * Best-effort, same shape as writeRootHotProjectionOwnership: a failure here
+ * only costs THIS session's own write not being recognized as current at ITS
+ * OWN Stop (a missing/stale receipt reads as "not proven mine" and excludes
+ * hot.md from this round's commit), never a lost write. The bytes are
+ * already durable on disk either way, and the next SessionStart/Stop that
+ * runs a write re-establishes both records. No-op without a session_id:
+ * there is no per-session file to write one to.
+ */
+function writeRootHotProjectionReceipt(hypoDir, sessionId, digest) {
+  if (!sessionId) return;
+  try {
+    atomicWrite(rootHotProjectionReceiptPath(hypoDir, sessionId), JSON.stringify({ digest }));
+  } catch {
+    // see doc comment above
+  }
+}
+
+/** Does the CURRENT on-disk hot.md match the bytes this function itself last
+ * wrote? See readRootHotProjectionOwnership for why this replaced a
+ * substring check on ROOT_HOT_PROJECTION_MARKER. Exported: hypo-auto-commit.mjs's
+ * scoped-commit wrapper re-runs this at commit time (see
+ * rootHotProjectionIsCurrent below) rather than trusting a session's
+ * touched-paths claim alone. */
+export function ownershipMatches(hypoDir, current) {
+  const { lastHash } = readRootHotProjectionOwnership(hypoDir);
+  return !!lastHash && sha256Hex(current) === lastHash;
+}
+
+/**
+ * Whether the bytes CURRENTLY on disk at the vault's root hot.md are exactly
+ * what writeRootHotProjection itself last wrote or confirmed. This is the
+ * commit-time half of the blocker fix in r5-w1.md: 'hot.md' can sit in a
+ * session's touched-paths set without this session's own write having
+ * actually landed there (a scanError that never clears the pre-write claim,
+ * a lock-timeout on the post-write record, or simply a claim made before a
+ * human's own edit lands mid-session): the claim only ever proves intent,
+ * never the bytes on disk at commit time. hypo-auto-commit.mjs's scoped-commit
+ * wrapper calls this immediately before staging, so a stale claim over
+ * content this session did not actually write is excluded there no matter
+ * how or why it went stale, instead of enumerating every write-outcome
+ * branch and remembering to revoke the claim on each one. A staged content
+ * this rejects is not lost: the next SessionStart or Stop that manages a
+ * successful scan runs writeRootHotProjection again, which backs up
+ * non-owned content through this SAME check before overwriting it, exactly
+ * like any other external edit.
+ *
+ * n1 fix (3rd-round codex review): the global ownership check alone only
+ * proves SOME session's write produced the current bytes, never that THIS
+ * session's did: a sibling session's write between this session's claim and
+ * its own Stop updates the global hash to the SIBLING's digest, and the old
+ * global-only check read that as "current" and staged the sibling's bytes
+ * into this session's commit. `sessionId` is now required to also prove
+ * OWNERSHIP: this session's own receipt (see writeRootHotProjectionReceipt)
+ * must independently match the current disk digest, not just the global
+ * record every session's write shares.
+ * @param {string} hypoDir
+ * @param {string|null|undefined} sessionId the session about to stage hot.md
+ * @returns {boolean} true when there is no root hot.md at all (nothing to
+ *   protect against) or its bytes hash-match both the global ownership hash
+ *   AND this session's own last-recorded receipt; false when it exists, is
+ *   readable, and either does not match, is unreadable, or `sessionId` never
+ *   recorded a matching receipt, none of which can prove THIS session
+ *   produced what is on disk right now.
+ */
+export function rootHotProjectionIsCurrent(hypoDir, sessionId) {
+  const hotPath = join(hypoDir, 'hot.md');
+  if (!existsSync(hotPath)) return true;
+  let content;
+  try {
+    content = readFileSync(hotPath, 'utf-8');
+  } catch {
+    return false; // unreadable: cannot prove it is ours, so do not stage it
+  }
+  if (!ownershipMatches(hypoDir, content)) return false;
+  const { digest } = readRootHotProjectionReceipt(hypoDir, sessionId);
+  return !!digest && digest === sha256Hex(content);
+}
+
+/**
+ * First unused backup path for `hotPath`: the plain suffix if free, else a
+ * numbered variant. Before this, a SECOND external overwrite arriving after
+ * the first migration backup already existed was silently destroyed --
+ * writeRootHotProjection saw the fixed backup filename already taken, skipped
+ * the backup step entirely, and overwrote hot.md anyway. Every later
+ * non-owned overwrite now gets its own place to land instead.
+ */
+function nextRootHotBackupPath(hotPath) {
+  const plain = `${hotPath}${ROOT_HOT_BACKUP_SUFFIX}`;
+  if (!existsSync(plain)) return plain;
+  const stem = ROOT_HOT_BACKUP_SUFFIX.slice(0, -'.md'.length); // '.pre-projection-backup'
+  for (let n = 2; n <= 9999; n++) {
+    const candidate = `${hotPath}${stem}-${n}.md`;
+    if (!existsSync(candidate)) return candidate;
+  }
+  // Practically unreachable (9998 prior collisions), but never reuse a path
+  // silently: a millisecond timestamp is guaranteed distinct from every
+  // numbered candidate already checked above.
+  return `${hotPath}${stem}-${Date.now()}.md`;
+}
+
+/**
+ * Back `content` up next to `hotPath`, unless a backup already holds exactly
+ * these bytes.
+ *
+ * minor fix: the backup and the `.gitignore` update run BEFORE the write that
+ * replaces hot.md, so a write that fails afterwards (disk full, a rename
+ * error) leaves the original in place and the next run sees the same
+ * non-owned file again. Without the content comparison that run made a
+ * SECOND, numbered copy of bytes already sitting in the first one, and a
+ * loop that keeps failing kept minting them. Comparing what is already there
+ * makes the retry converge instead: one backup per distinct content, however
+ * many times the write after it fails.
+ *
+ * Reuses nextRootHotBackupPath's candidate order, so the paths checked here
+ * are exactly the ones a fresh backup could occupy, and an unreadable
+ * candidate counts as "not a match" (the safe direction: one extra copy, not
+ * a skipped one).
+ * `testHooks.beforeBackupWrite` is test-only: called with the fresh backup
+ * path right before its write, so a test can fail the backup alone while the
+ * projection write after it would still succeed. Failing the whole directory
+ * cannot tell "the backup ran and failed" from "the backup never ran", since
+ * the projection write fails there too.
+ * @returns {string} the backup path now holding `content`, fresh or reused
+ */
+function backUpOnce(hotPath, content, testHooks) {
+  const stem = ROOT_HOT_BACKUP_SUFFIX.slice(0, -'.md'.length);
+  const holdsContent = (candidate) => {
+    try {
+      return readFileSync(candidate, 'utf-8') === content;
+    } catch {
+      return false; // unreadable: cannot prove it already holds these bytes
+    }
+  };
+  const plain = `${hotPath}${ROOT_HOT_BACKUP_SUFFIX}`;
+  // The plain name is always taken first, so its absence means no backup
+  // exists yet and the numbered scan below has nothing to find.
+  if (existsSync(plain)) {
+    if (holdsContent(plain)) return plain;
+    for (let n = 2; n <= 9999; n++) {
+      const candidate = `${hotPath}${stem}-${n}.md`;
+      if (!existsSync(candidate)) break;
+      if (holdsContent(candidate)) return candidate;
+    }
+  }
+  const fresh = nextRootHotBackupPath(hotPath);
+  testHooks?.beforeBackupWrite?.(fresh);
+  atomicWrite(fresh, content);
+  return fresh;
+}
+
+/**
+ * Append `pattern` to the vault's own `.gitignore` when it is not already
+ * there. NOT best-effort: called right before the FIRST backup write of a
+ * migration (see writeRootHotProjection), and a failure here propagates like
+ * the backup write's own failure does: a backup file git can see and
+ * auto-commit is not a backup, it is a leak, so the write that would create
+ * one must never proceed once this step has been skipped by a thrown error.
+ * @returns {boolean} true when the file was actually changed
+ */
+function ensureVaultGitignorePattern(hypoDir, pattern) {
+  const path = join(hypoDir, '.gitignore');
+  const content = existsSync(path) ? readFileSync(path, 'utf-8') : '';
+  if (content.split('\n').some((l) => l.trim() === pattern)) return false;
+  const next =
+    content.length > 0 && !content.endsWith('\n')
+      ? `${content}\n${pattern}\n`
+      : `${content}${pattern}\n`;
+  atomicWrite(path, next);
+  return true;
+}
+
+/**
+ * Scan `projects/*\/hot.md` and report both the rows and whether the scan
+ * itself succeeded. Rows come only from directories that carry a `hot.md`: a
+ * project without one yet gets no row, since the table's link column would
+ * otherwise point at a file that does not exist (a broken wikilink under
+ * lint). `_template` is never a row.
+ *
+ * `projects/` itself not existing is NOT a scan error: a fresh vault has no
+ * projects dir yet, and an empty row set is the honest answer for that case.
+ * `scanError` is reserved for `projects/` existing but `readdirSync` failing
+ * (permission error, transient I/O): the one case that used to collapse into
+ * the same empty array as "no projects yet," letting a transient read failure
+ * render (and, through writeRootHotProjection, WRITE) an empty table over a
+ * populated one. A per-project `hot.md` that exists but fails to read is
+ * narrower: the directory walk itself succeeded, so the row is kept with a
+ * blank date (same as before) plus a warning instead of a silently blanked
+ * date.
+ *
+ * Per row: display name is always the slug, never that project's frontmatter
+ * `title`: a project's `title` is that page's own heading text (things like
+ * `hot: hypomnema` or `security-backoffice: Hot Cache`), not a name a human
+ * chose to read in this table's Project column. An earlier version of this
+ * function read `title` here on the mistaken belief that it would agree with
+ * the slug; measured against a real vault it rewrote the Project column on 15
+ * of 38 rows for no actual information gain. Date is that project's
+ * frontmatter `updated`, left BLANK (never defaulted to today) when absent,
+ * unreadable, OR not a well-formed `YYYY-MM-DD` string: a malformed value
+ * (`stale`, `2026-9-1`, a YAML-parsed non-string) is left blank rather than
+ * passed through, because it would otherwise flow unvalidated into a raw
+ * string compare (`r.date > max` below) where a token like `"stale"` sorts
+ * ahead of every real ISO date, and into the root file's own frontmatter
+ * `updated:` (formatRootHotProjection takes the max of every row's date),
+ * leaving a token like `stale` sitting in that field for as long as this
+ * project's row stays malformed. Root hot.md's `updated:` is the max of the
+ * project rows, not the date the file itself was last rewritten. That is why
+ * sessionCloseFileStatus no longer checks this field against today's date:
+ * a sibling project's later row would otherwise fail a close that did
+ * everything right. The test 'n1: root hot.md must not be reported stale by a
+ * sibling project whose row date is the max' pins that exemption.
+ * A malformed value surfacing to a human at all is left to
+ * `hypo:lint`'s wave-3 project-file checks, out of this wave's scope; this
+ * function's job is only to keep the bad token from leaking into ANYTHING it
+ * generates. Rows sort by date
+ * descending, blank dates last, ties broken by slug ascending, so two
+ * machines scanning the same tree produce byte-identical output.
+ * @param {string} hypoDir
+ * @returns {{rows: Array<{slug: string, date: string}>, scanError: boolean, warnings: string[]}}
+ */
+export function scanRootHotProjectionSources(hypoDir) {
+  const projectsDir = join(hypoDir, 'projects');
+  const rows = [];
+  const warnings = [];
+  let scanError = false;
+  if (existsSync(projectsDir)) {
+    let entries = [];
+    try {
+      entries = readdirSync(projectsDir);
+    } catch (err) {
+      scanError = true;
+      warnings.push(`projects/ 디렉터리를 읽지 못했습니다: ${err?.message ?? String(err)}`);
+      entries = [];
+    }
+    for (const slug of entries) {
+      if (slug === ROOT_HOT_PROJECTS_TEMPLATE_SLUG) continue;
+      const hotPath = join(projectsDir, slug, 'hot.md');
+      // Read directly instead of gating on existsSync first: existsSync folds
+      // EVERY stat failure (a permission error, not just "genuinely absent")
+      // into `false`, which used to delete this project's row from the table
+      // exactly like a real ENOENT would, with no warning at all. Only ENOENT
+      // (and ENOTDIR, a parent segment turning out not to be a directory)
+      // means "no hot.md here yet". Every other error (EACCES, EIO, ...)
+      // keeps the row with a blank date and a warning, same as a read failure
+      // that happens after a successful existsSync always did.
+      let content = '';
+      let present = true;
+      try {
+        content = readFileSync(hotPath, 'utf-8');
+      } catch (err) {
+        if (err?.code === 'ENOENT' || err?.code === 'ENOTDIR') {
+          present = false;
+        } else {
+          warnings.push(
+            `projects/${slug}/hot.md 를 읽지 못해 날짜를 비웠습니다: ${err?.message ?? String(err)}`,
+          );
+          content = '';
+        }
+      }
+      if (!present) continue;
+      const rawDate = parseFrontmatterField(content, 'updated');
+      const date = /^\d{4}-\d{2}-\d{2}$/.test(rawDate || '') ? rawDate : '';
+      rows.push({ slug, date });
+    }
+  }
+  return { rows: sortRootHotRows(rows), scanError, warnings };
+}
+
+/**
+ * Sort scanned rows date descending, blank dates last, ties broken by slug
+ * ascending, so two directory scans of the same tree agree on row order
+ * regardless of what order the filesystem itself handed the entries back in.
+ * Mutates and returns `rows`.
+ *
+ * The slug tie-break is defence in depth, and a mutation test could not pin
+ * it while this lived inline inside the scan loop above: on this machine
+ * (macOS, APFS), readdirSync returns entries already sorted even when the
+ * filesystem itself does not (measured 2026-09-17: same directory, raw order
+ * "bb zz aa mm", readdirSync order "aa bb mm zz"), so a real directory scan
+ * on this machine always hands this function slug-ascending input, and a
+ * stable sort keeps that order with or without the tie-break. That ordering
+ * is not guaranteed elsewhere: a filesystem like ext4 with `dir_index`
+ * enabled returns entries in hash order, not name order, so the tie-break
+ * is load-bearing there even though it never fires on this machine's tests.
+ * Extracted into its own function so a test can
+ * call it directly against a fixed adversarial input order instead of going
+ * through a live scan. The date comparator's two other axes were always
+ * reachable through a scan (flipping descending to ascending, or swapping the
+ * blank-date placement, each reddens `row order` regardless of input order).
+ * @param {Array<{slug: string, date: string}>} rows
+ * @returns {Array<{slug: string, date: string}>}
+ */
+export function sortRootHotRows(rows) {
+  return rows.sort((a, b) => {
+    if (a.date !== b.date) {
+      if (!a.date) return 1;
+      if (!b.date) return -1;
+      return b.date.localeCompare(a.date);
+    }
+    return a.slug.localeCompare(b.slug);
+  });
+}
+
+/**
+ * Format already-scanned rows into the canonical root hot.md markdown. Pure:
+ * never touches disk. Frontmatter `updated:` is the max row date (or '' when
+ * every row is dateless), never today: a today value would make the same
+ * tree produce different bytes on different days, which is the one property
+ * this projection exists to have. That also means this field is not the date
+ * the file itself was last rewritten, which is why the session-close gate
+ * exempts it. See the note where sessionCloseFileStatus stops short of
+ * checking the root file, and the test that pins that exemption.
+ *
+ * Exported for one reason beyond `renderRootHotProjection`: `scripts/init.mjs`
+ * writes `formatRootHotProjection([])` straight into a brand-new vault as its
+ * root hot.md. There is no template copy to drift from it any more. If init
+ * wrote anything else, the first SessionStart would see bytes it did not
+ * write, back them up, and tell the person their hand edits were preserved,
+ * in a vault nobody has edited yet. tests/init.test.mjs pins that init's
+ * output is exactly this function's.
+ * @param {Array<{slug: string, date: string}>} rows
+ * @returns {string}
+ */
+export function formatRootHotProjection(rows) {
+  const tableRows = rows
+    .map((r) => `| ${r.slug} | ${r.date} | [[projects/${r.slug}/hot]] |`)
+    .join('\n');
+  const updated = rows.reduce((max, r) => (r.date && r.date > max ? r.date : max), '');
+
+  return `---
+title: "Hot Cache: Pointer"
+type: reference
+updated: ${updated}
+tags: [wiki, operations]
+---
+
+# Hot Cache
+
+> Read at session start → navigate to the relevant project session-state.md and hot.md.
+> This "Active Projects" table is a ${ROOT_HOT_PROJECTION_MARKER}, rebuilt at every session start and stop. Update session-state.md and hot.md in the relevant project instead: a hand edit to this table is overwritten by the next session.
+
+## Active Projects
+
+| Project | Last Session | Hot Cache |
+|---|---|---|
+${tableRows}
+
+## Session Start Checklist
+
+1. Check this file for the relevant project link
+2. Read \`projects/<name>/session-state.md\` for next tasks if it exists
+3. Read \`projects/<name>/hot.md\` for project background
+`;
+}
+
+/**
+ * Build the canonical root hot.md content by scanning `projects/*\/hot.md`.
+ * Pure: reads disk, never writes, and stays a plain string return so every
+ * existing caller/test keeps working unchanged. A scan error (see
+ * scanRootHotProjectionSources) resolves to an empty row set here, same as
+ * before this split: this entry point has no way to signal "the scan
+ * failed" to a caller that only wants a string. writeRootHotProjection below
+ * is the one caller that needs that signal and gets it directly from
+ * scanRootHotProjectionSources instead of through this function.
+ * @param {string} hypoDir
+ * @returns {string}
+ */
+export function renderRootHotProjection(hypoDir) {
+  const { rows } = scanRootHotProjectionSources(hypoDir);
+  return formatRootHotProjection(rows);
+}
+
+/**
+ * Regenerate root hot.md and write it only when the bytes actually changed.
+ *
+ * The lock-free body. Every caller goes through writeRootHotProjection below,
+ * which holds the vault commit lock around this whole function; see there for
+ * why the lock has to cover the read as well as the write.
+ *
+ * Called from both hypo-session-start.mjs (SessionStart, before the file is
+ * read by resolveActiveProject/closeCandidateSlugs/the injection below) and
+ * hypo-hot-rebuild.mjs (Stop). Both hooks calling the same function is the
+ * point: there is exactly one generator, not two copies that can drift.
+ *
+ * A scan error (projects/ directory exists but cannot be read) skips the
+ * write entirely and leaves whatever is already on disk untouched: see
+ * scanRootHotProjectionSources.
+ *
+ * The FIRST time this overwrites a file whose bytes do not match what this
+ * function itself last wrote (a hand-authored hot.md, one written before
+ * this projection existed, or ANY later external overwrite, per
+ * ownershipMatches), the existing bytes are backed up next to it
+ * (nextRootHotBackupPath: the plain `hot.md` + ROOT_HOT_BACKUP_SUFFIX name if
+ * free, else a numbered variant, so a second external overwrite after the
+ * first migration backup still lands somewhere instead of being silently
+ * destroyed) before the projection is written. Immediately before that FIRST
+ * backup write, the vault's own `.gitignore` is made to cover the backup
+ * filename pattern if it does not already (ensureVaultGitignorePattern): a
+ * backup file that a scoped auto-commit can see and push is a leak of
+ * whatever secret a person's uncommitted manual notes held, not a backup.
+ * Neither the gitignore update nor the backup write is best-effort: a
+ * failure in either throws out of this function (both call sites already
+ * wrap this in try/catch), which aborts the write, so a person's unsaved
+ * content is never replaced without somewhere ignored-and-recoverable to
+ * find it. Every write after the first sees the ownership hash already
+ * match and skips this step, and an existing backup file is never
+ * overwritten by a later one.
+ * major fix (TOCTOU): the ownership check above reads `hotPath` once, then
+ * this function still has to run ensureVaultGitignorePattern and the backup
+ * write (both real I/O against OTHER files) before it ever gets to the
+ * rename that actually replaces `hotPath`. A human's own save can land in
+ * that gap: it would be read as "ours" by the stale `current` and vanish
+ * with no backup, since atomic rename only ever protects against a reader
+ * seeing a torn write, never against this compare-then-replace race. This
+ * function re-reads `hotPath` a second time, immediately before the
+ * replacing write, and folds ANY bytes that appeared in that gap into the
+ * backup too. That shrinks the race to the two lines directly around the
+ * final `atomicWrite` call below (a read and a rename with nothing else in
+ * between), which is as far as this can be narrowed without an advisory
+ * lock that a person's own editor or shell would not honor anyway (see the
+ * major finding in r5-w1.md for why that is not pursued here).
+ * @param {string} hypoDir
+ * @param {{ beforeFinalWrite?: (hotPath: string) => void, beforeBackupWrite?: (backupPath: string) => void }} [testHooks]
+ *   `beforeBackupWrite` is test-only too: see backUpOnce.
+ *   `beforeFinalWrite` is test-only: called with `hotPath` right after the
+ *   second read below and before the final `atomicWrite`, so a test can
+ *   write NEW bytes to `hotPath` at exactly the point a real concurrent
+ *   writer would need to land in to be missed: genuine two-process timing
+ *   inside one synchronous call cannot be reproduced deterministically
+ *   otherwise. Production callers never pass this.
+ * @param {string|null} [sessionId] n1 fix: when given, this call's own
+ *   digest is recorded as THIS session's receipt (see
+ *   writeRootHotProjectionReceipt), so rootHotProjectionIsCurrent can later
+ *   tell this session's own write apart from a sibling session's. Omitted by
+ *   every caller that does not need commit-time attribution (most existing
+ *   tests, a direct `--json` CLI run).
+ * @returns {{written: boolean, scanError: boolean, lockTimeout: boolean, backedUp: boolean, backupPath: string|null, gitignoreUpdated: boolean, warnings: string[], content: string|null}}
+ *   content is the bytes now on disk (whether this call wrote them or they
+ *   were already there), null only on a scanError. Callers that need to hash
+ *   what actually landed (hypo-hot-rebuild.mjs's advanceBase) use this
+ *   instead of a second, separate scan that could observe different bytes if
+ *   a sibling session writes a project's hot.md in between the two scans.
+ *   `lockTimeout` is true only on the wrapper's own refusal (see
+ *   writeRootHotProjection below): nothing was read, written, or recorded.
+ */
+function writeRootHotProjectionUnlocked(hypoDir, testHooks, sessionId) {
+  const { rows, scanError, warnings } = scanRootHotProjectionSources(hypoDir);
+  if (scanError) {
+    return {
+      written: false,
+      scanError: true,
+      lockTimeout: false,
+      backedUp: false,
+      backupPath: null,
+      gitignoreUpdated: false,
+      warnings,
+      content: null,
+    };
+  }
+  const projection = formatRootHotProjection(rows);
+  const hotPath = join(hypoDir, 'hot.md');
+  // BLOCKER fix: only a genuinely absent file (ENOENT) may be treated as "no
+  // prior content to protect". Any other read failure (permissions,
+  // transient I/O) used to fold into the same `null` and skip the backup
+  // step below outright, reproducing the exact data-loss the backup exists
+  // to prevent. Throwing here (rather than returning a sentinel) reuses the
+  // try/catch both call sites already wrap this function in.
+  let current = null;
+  try {
+    current = readFileSync(hotPath, 'utf-8');
+  } catch (err) {
+    if (err?.code !== 'ENOENT') throw err;
+    current = null;
+  }
+  if (current === projection) {
+    // Establish/refresh ownership even on a no-op write: a vault upgrading
+    // onto this fix has a genuinely-owned hot.md but no prior recorded hash
+    // yet, and this is the cheap place to record one without risking a
+    // spurious backup on the NEXT real write. Best-effort by design (see
+    // writeRootHotProjectionOwnership): a failure here just costs one
+    // extra harmless backup later, never a lost one.
+    writeRootHotProjectionOwnership(hypoDir, sha256Hex(projection));
+    // n1 fix: a no-op still confirms this session's OWN projection algorithm
+    // produced exactly what is on disk right now, so it is legitimate for
+    // this session to also record a receipt for it: the bytes are not
+    // borrowed from whichever session wrote them first, they are identical
+    // regardless of who computed them.
+    writeRootHotProjectionReceipt(hypoDir, sessionId, sha256Hex(projection));
+    return {
+      written: false,
+      scanError: false,
+      lockTimeout: false,
+      backedUp: false,
+      backupPath: null,
+      gitignoreUpdated: false,
+      warnings,
+      content: projection,
+    };
+  }
+  let backedUp = false;
+  let backupPath = null;
+  let gitignoreUpdated = false;
+  const ensureBackupIgnored = () => {
+    // Both patterns, not best-effort either: see the doc comment above --
+    // the second covers atomicWrite's own temp file for the backup write
+    // itself (minor fix, r5-w1.md), which would otherwise carry the same
+    // hand-authored bytes unignored if this process is killed between that
+    // temp write and its rename.
+    const a = ensureVaultGitignorePattern(hypoDir, ROOT_HOT_BACKUP_GITIGNORE_PATTERN);
+    const b = ensureVaultGitignorePattern(hypoDir, ROOT_HOT_BACKUP_TMP_GITIGNORE_PATTERN);
+    return a || b;
+  };
+  if (current !== null && !ownershipMatches(hypoDir, current)) {
+    gitignoreUpdated = ensureBackupIgnored();
+    backupPath = backUpOnce(hotPath, current, testHooks);
+    backedUp = true;
+  }
+  // major fix (TOCTOU narrowing): re-read right before the write that
+  // actually replaces `hotPath`, rather than trusting the `current` read
+  // from above (see this function's own doc comment for why). Anything
+  // that differs from `current` gets its own backup here too, so a save
+  // landing during ensureBackupIgnored/the backup write above is still
+  // caught instead of silently discarded by the rename below. `testHooks`
+  // fires BEFORE this read (a no-op in production) so a test can write new
+  // bytes at exactly the point this read needs to observe them; in
+  // production nothing runs between `current`'s read above and this one.
+  //
+  // What this re-read is NOT: a safety boundary. It is best-effort salvage,
+  // and calling it "a race narrowed to microseconds" overstates it. Work
+  // still happens after this read: the `.gitignore` update and the backup
+  // write below both run against other files, and atomicWrite itself writes a
+  // whole temp file before the rename. A person's save landing anywhere in
+  // there is still replaced with no copy kept, and an editor that saves in
+  // place (truncate, then write) can leave a partial file for this read to
+  // back up, so even a salvaged backup is not guaranteed to hold a complete
+  // document. Nothing here can close that: POSIX rename has no general
+  // compare-and-swap ("replace only if the bytes are still X"), and an
+  // editor honors no advisory lock this file could take. The real fix is to
+  // stop sharing one pathname between a generated file and a hand-edited
+  // one, which this change does not do.
+  testHooks?.beforeFinalWrite?.(hotPath);
+  let latest = current;
+  try {
+    latest = readFileSync(hotPath, 'utf-8');
+  } catch (err) {
+    if (err?.code !== 'ENOENT') throw err;
+    latest = null;
+  }
+  if (latest !== current && latest !== null && !ownershipMatches(hypoDir, latest)) {
+    if (!gitignoreUpdated) gitignoreUpdated = ensureBackupIgnored();
+    backupPath = backUpOnce(hotPath, latest, testHooks);
+    backedUp = true;
+  }
+  // atomicWrite, not writeFileSync: this write now happens at BOTH
+  // SessionStart and Stop (previously Stop-only), so two sessions starting
+  // around the same time can race this write against each other. A plain
+  // writeFileSync truncates before writing its new bytes, so a reader
+  // (another SessionStart's read of hot.md, or hypo-file-watch, if it ever
+  // gains a trigger) could observe a torn/empty file mid-write; atomicWrite
+  // (temp file + rename) never exposes that state. log.md's append path
+  // (deriveRootLogEntries below) already uses atomicWrite for the same
+  // reason.
+  atomicWrite(hotPath, projection);
+  writeRootHotProjectionOwnership(hypoDir, sha256Hex(projection));
+  writeRootHotProjectionReceipt(hypoDir, sessionId, sha256Hex(projection)); // n1 fix
+  return {
+    written: true,
+    scanError: false,
+    lockTimeout: false,
+    backedUp,
+    backupPath,
+    gitignoreUpdated,
+    warnings,
+    content: projection,
+  };
+}
+
+/**
+ * The locked entry point every caller uses. Holds the vault commit lock
+ * (vaultCommitLockTarget, the same one hypo-auto-commit.mjs and
+ * crystallize.mjs's apply take around stage+commit) across the WHOLE
+ * projection write: the first read of hot.md, the ownership check, the
+ * backup, the replacing rename, and the ownership/receipt records.
+ *
+ * BLOCKER fix: without this the writer took no lock at all, so a sibling
+ * session's rename could land between hypo-auto-commit.mjs's ownership and
+ * receipt check and the `git add` that follows it, inside the auto-commit's
+ * own lock hold. The sibling's bytes then went into THIS session's commit
+ * looking like a normal update, and the touched record that would have
+ * flagged it was gone. One lock shared by the writer and the commit fence is
+ * what makes that check mean anything at commit time. The receipt check
+ * stays regardless: it is the fail-closed half for everything this lock
+ * cannot cover (a lock we failed to take, a person's editor, another tool).
+ *
+ * The lock is NOT reentrant, so nothing inside `writeRootHotProjectionUnlocked`
+ * may take it again, and a caller that already holds it must call the
+ * unlocked form instead, as claimAndWriteRootHotProjection (below) does.
+ * hypo-session-start.mjs takes it for its own `git pull` and releases it
+ * before calling claimAndWriteRootHotProjection,
+ * hypo-hot-rebuild.mjs (Stop) runs before hypo-auto-commit.mjs rather than
+ * inside it, and scripts/lib/project-create.mjs holds no lock.
+ *
+ * A lock timeout is NOT an error here: it returns `lockTimeout: true` with
+ * `written: false` and a warning row, so the caller can say the pointer table
+ * was left as-is and move on. Throwing would turn a busy vault into a failed
+ * `project-create`, and waiting longer would eat a SessionStart's 30s budget
+ * for a file the session can still read the previous version of.
+ * @param {string} hypoDir
+ * @param {{ beforeFinalWrite?: (hotPath: string) => void, beforeBackupWrite?: (backupPath: string) => void }} [testHooks]
+ * @param {string|null} [sessionId]
+ * @returns {{written: boolean, scanError: boolean, lockTimeout: boolean, backedUp: boolean, backupPath: string|null, gitignoreUpdated: boolean, warnings: string[], content: string|null}}
+ */
+export function writeRootHotProjection(hypoDir, testHooks, sessionId) {
+  try {
+    return withFileLock(
+      vaultCommitLockTarget(hypoDir),
+      () => writeRootHotProjectionUnlocked(hypoDir, testHooks, sessionId),
+      // Read per call, not at module load, so a test can force a fast
+      // timeout on a lock it holds itself (same env var hypo-auto-commit.mjs
+      // reads for the same lock).
+      { timeoutMs: Number(process.env.HYPO_VAULT_LOCK_TIMEOUT_MS) || 5000 },
+    );
+  } catch (err) {
+    if (err?.code !== 'ELOCKTIMEOUT') throw err;
+    return rootHotLockTimeoutResult();
+  }
+}
+
+function rootHotLockTimeoutResult() {
+  return {
+    written: false,
+    scanError: false,
+    lockTimeout: true,
+    backedUp: false,
+    backupPath: null,
+    gitignoreUpdated: false,
+    warnings: [
+      'root hot.md: 다른 세션이 저장소 잠금을 쥐고 있어 이번에는 갱신하지 않았습니다 (이전 내용을 그대로 둡니다).',
+    ],
+    content: null,
+  };
+}
+
+/**
+ * SessionStart's root hot.md write: claim 'hot.md' in this session's
+ * touched-paths set and write the projection inside ONE hold of the vault
+ * lock. Lock order is vault, then per-session (the claim), the same order
+ * hypo-auto-commit.mjs takes them in.
+ *
+ * The claim used to be taken before the lock. A Stop for the same session_id
+ * (the same session run by two processes) could take the vault lock in that
+ * gap, find hot.md claimed but still clean, commit nothing, and retire the
+ * claim. The write that followed then left hot.md dirty with no claim, so the
+ * checkpoint gate read it as ownerless and let the close through. Inside the
+ * lock, a Stop either runs entirely before the claim or waits until the write
+ * has landed.
+ *
+ * Kept from the unlocked sequence: a failed claim skips the write
+ * (`claimFailed: true`, `result: null`), and a write that throws drops the
+ * claim only when this call is the one that added it, before the lock is
+ * released, then rethrows. A vault lock timeout now returns before any claim
+ * is made, so there is nothing to drop.
+ *
+ * `testHooks.afterClaim` runs right after a successful claim, still inside
+ * the lock (a no-op in production); the rest of `testHooks` goes to the
+ * writer as with writeRootHotProjection.
+ *
+ * @param {string} hypoDir
+ * @param {string|null|undefined} sessionId
+ * @param {{ afterClaim?: () => void, beforeFinalWrite?: (hotPath: string) => void, beforeBackupWrite?: (backupPath: string) => void }} [testHooks]
+ * @returns {{claimFailed: boolean, result: ReturnType<typeof writeRootHotProjection>|null}}
+ */
+export function claimAndWriteRootHotProjection(hypoDir, sessionId, testHooks) {
+  // Checked before the lock: without a session_id the claim can only fail,
+  // and a busy vault must not turn that into a lock-timeout notice instead.
+  if (!sessionId) return { claimFailed: true, result: null };
+  try {
+    return withFileLock(
+      vaultCommitLockTarget(hypoDir),
+      () => {
+        const claim = claimProjectionWrite(hypoDir, sessionId, ['hot.md']);
+        if (!claim.ok) return { claimFailed: true, result: null };
+        testHooks?.afterClaim?.();
+        try {
+          return {
+            claimFailed: false,
+            result: writeRootHotProjectionUnlocked(hypoDir, testHooks, sessionId),
+          };
+        } catch (err) {
+          // No write happened, so a claim this call added would let whatever
+          // another session or a person writes to hot.md next be committed
+          // as this session's change. An earlier invocation's claim on the
+          // same (resumed) session_id is left alone.
+          if (claim.added) clearTouchedPaths(hypoDir, sessionId, ['hot.md']);
+          throw err;
+        }
+      },
+      { timeoutMs: Number(process.env.HYPO_VAULT_LOCK_TIMEOUT_MS) || 5000 },
+    );
+  } catch (err) {
+    if (err?.code !== 'ELOCKTIMEOUT') throw err;
+    return { claimFailed: false, result: rootHotLockTimeoutResult() };
+  }
+}
+
+const ROOT_HOT_HEALTH_NOTICE_FILENAME = 'root-hot-projection-notice.json';
+
+/**
+ * Leave a durable note for the NEXT SessionStart when the Stop-hook rebuild
+ * (hypo-hot-rebuild.mjs) fails or hits a scan error: Stop's own stdout is
+ * suppressed (`{ suppressOutput: true }`), so a failure there is otherwise
+ * invisible to the user until they go looking at stderr. Best-effort like
+ * every other cache write in this file: a hook must not fail Stop over a
+ * notice file.
+ * @param {string} hypoDir
+ * @param {string} message
+ */
+export function writeRootHotHealthNotice(hypoDir, message) {
+  const path = join(hypoDir, '.cache', ROOT_HOT_HEALTH_NOTICE_FILENAME);
+  try {
+    // Same lock consumeRootHotHealthNotice takes, so this write can never
+    // land inside a concurrent reader's read-then-unlink window (which would
+    // otherwise let this brand-new notice be deleted by a reader that read
+    // the OLD one, or read half-written bytes from atomicWrite's rename).
+    withFileLock(path, () => {
+      atomicWrite(path, JSON.stringify({ message, ts: Date.now() }));
+    });
+  } catch {
+    // best-effort: losing the notice is strictly better than crashing Stop
+    // over it.
+  }
+}
+
+/**
+ * Read and delete a pending root-hot-projection health notice left by a
+ * prior Stop. One-shot (unlinked on read) so it surfaces exactly once, at
+ * the next SessionStart. Returns null when nothing is pending or the file is
+ * unreadable/corrupt.
+ *
+ * Guarded by the same per-target file lock every other read-then-mutate in
+ * this file uses (withFileLock), so two SessionStarts racing this call
+ * (a shared vault, two machines) cannot both read the same notice and both
+ * display it: only the lock holder sees a non-null message, the other finds
+ * the file already gone. This does not make delivery exactly-once across a
+ * crash (a process that dies between the unlink and actually showing the
+ * message still loses it, same as before this lock existed). Only the
+ * concurrent double-read is closed here; a true crash-safe exactly-once
+ * would need a durable ack, which this file does not keep.
+ * @param {string} hypoDir
+ * @returns {string|null}
+ */
+export function consumeRootHotHealthNotice(hypoDir) {
+  const path = join(hypoDir, '.cache', ROOT_HOT_HEALTH_NOTICE_FILENAME);
+  if (!existsSync(path)) return null;
+  try {
+    return withFileLock(path, () => {
+      if (!existsSync(path)) return null; // a concurrent reader already claimed it
+      let message = null;
+      try {
+        const parsed = JSON.parse(readFileSync(path, 'utf-8'));
+        message = parsed && typeof parsed.message === 'string' ? parsed.message : null;
+      } catch {
+        message = null;
+      }
+      try {
+        unlinkSync(path);
+      } catch {
+        // best-effort cleanup: a leftover file just gets read (and re-shown)
+        // again next time, rather than losing anything.
+      }
+      return message;
+    });
+  } catch {
+    // lock-timeout: leave the file exactly as-is, same as every other
+    // lock-timeout path in this file: the notice just waits for the next
+    // reader instead of being lost.
+    return null;
+  }
+}
+
 /**
  * Resolve the active project slug from root hot.md. With a cwd, a project whose
  * working_dir contains it wins (cwd-first); otherwise the
@@ -1461,8 +2431,9 @@ export function resolveActiveProject(hypoDir, cwd = null) {
   if (!existsSync(hotPath)) return null;
   let content;
   try {
-    // Strip HTML comments before parsing so the canonical-format example row
-    // in templates/hot.md (`<!-- Row format: ... -->`) is not picked up as data.
+    // Strip HTML comments before parsing so a commented example row, which
+    // vaults created before the root table became generated still carry
+    // (`<!-- Row format: ... -->`), is not picked up as data.
     content = readFileSync(hotPath, 'utf-8').replace(/<!--[\s\S]*?-->/g, '');
   } catch {
     return null;
@@ -1537,6 +2508,7 @@ export function sessionCloseFileStatus(hypoDir, { projectOverride = null } = {})
       dates,
       stale: [],
       missing: ['hot.md (no active project in pointer table)'],
+      sessionLogEvidence: null,
     };
   }
 
@@ -1561,13 +2533,26 @@ export function sessionCloseFileStatus(hypoDir, { projectOverride = null } = {})
 
   checkUpdated(join('projects', project, 'session-state.md'));
   checkUpdated(join('projects', project, 'hot.md'));
-  checkUpdated('hot.md');
+  // Root hot.md is deliberately not checked here. Its `updated:` is a max
+  // across every project row (see formatRootHotProjection), not this project's
+  // own date, so a sibling project's later row would push the field past today
+  // and stale-flag a session that did everything right. The pointer table is a
+  // projection the hooks regenerate; it is not a file this close writes.
+  // Pinned by 'n1: root hot.md must not be reported stale by a sibling project
+  // whose row date is the max' in tests/session-hooks.test.mjs.
 
   // session-log: daily shard, with legacy monthly fallback: must
   // carry a today-dated heading in whichever file holds it. Daily-first read
   // order short-circuits on the small shard. When no match is found, the gap is
   // reported under the canonical daily shard for the local date (dates[0]).
   let sessionLogOk = false;
+  // The candidate that actually satisfied freshness, captured so a caller
+  // that must certify a SPECIFIC committed version (a close receipt) knows
+  // which of the (up to) four local/UTC × daily/monthly candidates is the
+  // one this check actually trusted, rather than re-deriving (and possibly
+  // picking a DIFFERENT one, since `closeFileTargetsForProject` recomputes
+  // both dates independently) which file to prove.
+  let sessionLogEvidence = null;
   for (const date of dates) {
     for (const rel of sessionLogReadCandidates(project, date)) {
       const full = join(hypoDir, rel);
@@ -1580,6 +2565,7 @@ export function sessionCloseFileStatus(hypoDir, { projectOverride = null } = {})
       }
       if (hasSessionLogHeading(content, date)) {
         sessionLogOk = true;
+        sessionLogEvidence = { path: rel, date };
         break;
       }
     }
@@ -1605,7 +2591,14 @@ export function sessionCloseFileStatus(hypoDir, { projectOverride = null } = {})
     if (content && !logFresh) stale.push('log.md');
   }
 
-  return { ok: stale.length === 0 && missing.length === 0, project, dates, stale, missing };
+  return {
+    ok: stale.length === 0 && missing.length === 0,
+    project,
+    dates,
+    stale,
+    missing,
+    sessionLogEvidence,
+  };
 }
 
 // ── global session-close gate ────────────────
@@ -1652,6 +2645,17 @@ function closeCandidateSlugs(hypoDir, dates) {
     try {
       entries = readdirSync(projectsDir);
     } catch {
+      // Swallowing this is the same shape as the fail-open hasTornCloseIntent
+      // was hardened out of (a judgment that could not be made reading as
+      // "nothing found"), and it is deliberate only because this is one of
+      // THREE unioned sources, not the whole answer: an unreadable projects/
+      // still leaves today's log.md entries and today's root hot.md rows to
+      // name the same slug. A close goes unnoticed only when all three miss it
+      // at once. Signalling the uncertainty instead would mean carrying a
+      // scanError out through sessionCloseGlobalStatus, whose result is read
+      // in five places, so it is a separate change rather than a line here.
+      // If you are adding a FOURTH source or removing one of the other two,
+      // this comment stops being true and the gate needs the scanError.
       entries = [];
     }
     for (const p of entries) {
@@ -1704,10 +2708,12 @@ function closeCandidateSlugs(hypoDir, dates) {
 //     the "next tasks" section (a cross-block incident: editing one project's
 //     tracker bumped session-state and blocked an unrelated project's /compact).
 //   - project hot.md `updated:`    — project-create stamps the template `updated: today`.
-//   - root hot.md ROW date         — project-create inserts a today-dated row, and
-//     hypo-hot-rebuild defaults a row to today when a project hot.md is missing.
-// (Root hot.md *frontmatter* was already never a signal — it is shared and
-// hypo-hot-rebuild stamps it today every session.)
+//   - root hot.md ROW date:         project-create inserts a today-dated row. Root
+//     hot.md's row set is now a directory-scan projection (renderRootHotProjection):
+//     a row's date is that project's own hot.md `updated:`, left BLANK rather than
+//     defaulted to today when absent or malformed.
+// (Root hot.md *frontmatter* was already never a signal: it is shared, and it is
+// now the MAX row date across the projection, never today.)
 //
 // Tradeoff (documented, accepted): apply writes session-state.md FIRST, then the
 // project files, then the session-log + log entry. A process crash before the
@@ -1945,16 +2951,10 @@ function sleepSync(ms) {
   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, Math.max(0, ms | 0));
 }
 
-// Commit `content` via temp write + rename so a partial/failed write lands on a
-// throwaway temp and the target is never torn (mirrors crystallize.mjs's
-// atomicWrite). Rename atomicity swaps the directory entry; it is NOT power-loss
-// durable (no fsync) — same as everything else in the vault.
-function atomicWriteShared(path, content) {
-  mkdirSync(dirname(path), { recursive: true });
-  const tmp = `${path}.${process.pid}.${Math.random().toString(36).slice(2, 10)}.tmp`;
-  writeFileSync(tmp, content);
-  renameSync(tmp, path);
-}
+// Commit via temp write + rename now lives in ./atomic-write.mjs, imported
+// above as `atomicWrite`. It used to be a local copy here (`atomicWriteShared`)
+// that only cleaned up the tmp file on a rename failure; the shared version
+// also cleans up on a write failure. See that file's own doc comment.
 
 // Read the pid the current holder recorded in its lockfile (see withFileLock).
 // Returns null for anything we can't trust as a pid: empty/missing content (a
@@ -2264,7 +3264,7 @@ export function deriveRootLogEntries(hypoDir) {
       });
       if (fresh.length === 0) return 0;
       const sep = current.endsWith('\n') ? '\n' : '\n\n';
-      atomicWriteShared(logPath, current + sep + fresh.map((a) => a.block).join('\n\n') + '\n');
+      atomicWrite(logPath, current + sep + fresh.map((a) => a.block).join('\n\n') + '\n');
       return fresh.length;
     });
   } catch {
@@ -2349,71 +3349,228 @@ export function appendSyncFailure(hypoDir, op, error) {
   }
 }
 
+const syncGit = (hypoDir, ...args) =>
+  spawnSync('git', ['-C', hypoDir, ...args], { encoding: 'utf-8', timeout: 30000 });
+
 /**
- * Pull + push the wiki against its remote, guaranteeing the working tree is
- * never left half-merged. Called by the auto-commit Stop hook after a local
- * commit succeeds.
+ * The tree-mutating half of a sync: `git pull --no-rebase`, plus the abort
+ * that keeps the working tree from being left half-merged.
  *
- * Failure policy (v1.4 "sync hardening"):
- *   - clean fast-forward / conflict-free merge → push.
+ * Split out of syncRemote (review r5-w4 major 2) so a caller can hold the
+ * vault commit lock across this and NOT across the push. This half has to
+ * stay inside the lock: it rewrites files another session could be reading,
+ * staging, or committing at the same moment. See hypo-auto-commit.mjs for the
+ * other side of that split.
+ *
+ * Failure policy (v1.4 "sync hardening"), unchanged by the split:
+ *   - clean fast-forward / conflict-free merge → `{pulled: true}`, caller pushes.
  *   - MERGE CONFLICT (`git pull --no-rebase` leaves unmerged paths): abort the
  *     merge so the tree returns to the just-committed local state ("ours"),
- *     record op='conflict', and do NOT push (a diverged branch cannot
- *     fast-forward, so the push would only add a noisy second failure). No data
- *     is lost: ours stays committed locally, "theirs" stays on the remote, and
- *     the divergence is surfaced by session-start + doctor until the user merges
- *     manually. Inline auto-resolution (preserving the losing version as a
- *     `.conflict-*` sibling) is deferred.
+ *     record op='conflict', and report `{conflict: true}` so the caller does
+ *     NOT push (a diverged branch cannot fast-forward, so the push would only
+ *     add a noisy second failure). No data is lost: ours stays committed
+ *     locally, "theirs" stays on the remote, and the divergence is surfaced by
+ *     session-start + doctor until the user merges manually. Inline
+ *     auto-resolution (preserving the losing version as a `.conflict-*`
+ *     sibling) is deferred.
  *   - non-conflict pull failure (network/auth: no unmerged paths) → record
- *     op='pull', then still attempt push (a transient pull blip should not block
- *     an otherwise-pushable commit); record op='push' if that also fails.
+ *     op='pull' and report `{pulled: false, conflict: false}`; the caller still
+ *     pushes, since a transient pull blip should not block an otherwise
+ *     pushable commit.
  *
- * Best-effort: never throws — a sync failure must not break the Stop hook.
+ * Best-effort: never throws. A sync failure must not break the Stop hook. A
+ * throw is reported as `{pulled: false, conflict: false}`, which lets the
+ * caller attempt the push, exactly as the combined function did.
  *
  * @param {string} hypoDir
- * @returns {{pulled: boolean, pushed: boolean, conflict: boolean}}
+ * @returns {{pulled: boolean, conflict: boolean}}
  */
-export function syncRemote(hypoDir) {
-  const git = (...args) =>
-    spawnSync('git', ['-C', hypoDir, ...args], { encoding: 'utf-8', timeout: 30000 });
-  const result = { pulled: false, pushed: false, conflict: false };
+export function pullRemote(hypoDir) {
+  const git = (...args) => syncGit(hypoDir, ...args);
   try {
     const pull = git('pull', '--no-rebase', '-q');
     if (pull.status === 0) {
-      result.pulled = true;
       recordSyncSuccess(hypoDir, 'pull');
-    } else {
-      // A merge conflict leaves unmerged index entries; a network/auth failure
-      // leaves none. Only the former must be aborted to keep the tree clean.
-      const unmerged = git('ls-files', '-u');
-      const hasConflict = unmerged.status === 0 && (unmerged.stdout || '').trim().length > 0;
-      if (hasConflict) {
-        // Abort to return the tree to the just-committed local state. Verify the
-        // abort actually cleaned up: if it fails (filesystem/concurrent-mutation
-        // edge), the tree may still be half-merged, so record that distinctly
-        // ('conflict-unresolved') rather than masking it as a clean abort.
-        const abort = git('merge', '--abort');
-        const stillUnmerged = git('ls-files', '-u');
-        const aborted = abort.status === 0 && (stillUnmerged.stdout || '').trim().length === 0;
-        appendSyncFailure(
-          hypoDir,
-          aborted ? 'conflict' : 'conflict-unresolved',
-          pull.stderr || pull.stdout,
-        );
-        result.conflict = true;
-        return result; // do not push from a diverged branch
-      }
-      appendSyncFailure(hypoDir, 'pull', pull.stderr || pull.stdout);
+      return { pulled: true, conflict: false };
     }
-    const push = git('push');
+    // A merge conflict leaves unmerged index entries; a network/auth failure
+    // leaves none. Only the former must be aborted to keep the tree clean.
+    const unmerged = git('ls-files', '-u');
+    const hasConflict = unmerged.status === 0 && (unmerged.stdout || '').trim().length > 0;
+    if (hasConflict) {
+      // Abort to return the tree to the just-committed local state. Verify the
+      // abort actually cleaned up: if it fails (filesystem/concurrent-mutation
+      // edge), the tree may still be half-merged, so record that distinctly
+      // ('conflict-unresolved') rather than masking it as a clean abort.
+      const abort = git('merge', '--abort');
+      const stillUnmerged = git('ls-files', '-u');
+      const aborted = abort.status === 0 && (stillUnmerged.stdout || '').trim().length === 0;
+      appendSyncFailure(
+        hypoDir,
+        aborted ? 'conflict' : 'conflict-unresolved',
+        pull.stderr || pull.stdout,
+      );
+      return { pulled: false, conflict: true };
+    }
+    appendSyncFailure(hypoDir, 'pull', pull.stderr || pull.stdout);
+    return { pulled: false, conflict: false };
+  } catch {
+    // best-effort: never break the Stop hook
+    return { pulled: false, conflict: false };
+  }
+}
+
+/**
+ * Pin WHAT the push will send and WHERE, so the push itself carries no
+ * ambiguity about either.
+ *
+ * Meant to be called from inside the vault commit lock, right after the
+ * commit and the pull that this session performed. A bare `git push` resolves
+ * its source at push time, from whatever HEAD is then: release the lock, let a
+ * sibling session commit, and the push sends the SIBLING's newer commit rather
+ * than the one this session just made and verified. Reading the OID here, still
+ * under the lock, makes that impossible: the push sends this exact object or it
+ * sends nothing.
+ *
+ * `oid` defaults to HEAD, which is correct for the Stop hook's use even though
+ * the commit it made has its own sha: a non-conflicting `git pull --no-rebase`
+ * can add a merge commit on top, and pushing the pre-merge sha would be
+ * rejected as a non-fast-forward. HEAD under the lock, after the pull,
+ * contains this session's commit and nothing a sibling added afterwards.
+ *
+ * Destination comes from the current branch's configured upstream, read as a
+ * full `refs/heads/<name>` so no `push.default` mode, no `remote.<n>.push`
+ * refspec, and no branch-name-to-remote-name guess gets to reinterpret it.
+ * Returns null when the branch is detached or has no upstream: a null target
+ * makes pushRemote decline to push at all, which is the safe end of the trade.
+ * Pushing SOMETHING under an unresolvable destination is how a vault ends up
+ * with a branch nobody meant to publish.
+ *
+ * Best-effort: never throws.
+ *
+ * @param {string} hypoDir
+ * @param {string} [oid] the exact commit to send; defaults to current HEAD
+ * @returns {{remote: string, remoteRef: string, oid: string}|null}
+ */
+export function resolvePushTarget(hypoDir, oid) {
+  try {
+    const branch = syncGit(hypoDir, 'symbolic-ref', '--quiet', '--short', 'HEAD');
+    if (branch.status !== 0) return null; // detached HEAD: no branch, no upstream
+    const name = (branch.stdout || '').trim();
+    if (!name) return null;
+    // for-each-ref, not `rev-parse @{upstream}`: this yields the remote NAME and
+    // the remote-side ref SEPARATELY and already fully qualified
+    // (`refs/heads/main`), where `@{upstream}` yields one `origin/main` string a
+    // caller has to split on the first slash and then guess whether the rest is
+    // a branch (it is not, for a remote whose name contains a slash, or a ref
+    // outside refs/heads).
+    const up = syncGit(
+      hypoDir,
+      'for-each-ref',
+      '--format=%(upstream:remotename)%09%(upstream:remoteref)',
+      `refs/heads/${name}`,
+    );
+    if (up.status !== 0) return null;
+    const [remote, remoteRef] = (up.stdout || '').trim().split('\t');
+    if (!remote || !remoteRef) return null; // no upstream configured
+    const head = syncGit(hypoDir, 'rev-parse', oid || 'HEAD');
+    if (head.status !== 0) return null;
+    const resolved = (head.stdout || '').trim();
+    if (!/^[0-9a-f]{40}$/.test(resolved)) return null;
+    return { remote, remoteRef, oid: resolved };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The network half of a sync: push one pinned commit to one pinned
+ * destination.
+ *
+ * Runs OUTSIDE the vault commit lock (review r5-w4 major 2). Holding the lock
+ * across a network round trip made one session's Stop own the vault for up to
+ * a minute, and a sibling SessionStart needs that same lock twice (its own
+ * `git pull` and the root hot.md projection write), each with a 5s timeout,
+ * out of a 30s hook budget.
+ *
+ * The earlier justification for putting the push outside the lock was that
+ * a push changes nothing locally. Half of that is closed here and half is not:
+ *
+ *   - CLOSED: "a push sends whatever HEAD is at push time". It sends `target`
+ *     and only `target`, decided under the lock by resolvePushTarget.
+ *   - OPEN, and it stays open: a client-side `pre-push` hook is an arbitrary
+ *     program that git runs inside this `git push`, with the working tree and
+ *     the index right there. A user whose pre-push builds, formats, or stages
+ *     anything is mutating the vault from outside the lock, racing the
+ *     projection write and the commit fence exactly as a pull would. This is
+ *     not theoretical: tests/session-hooks.test.mjs observes the lock boundary
+ *     THROUGH a pre-push hook, so the mechanism is exercised on every run.
+ *     `--no-verify` would close it and is deliberately not used: it overrides
+ *     the user's own push policy, which is not this hook's call to make, and it
+ *     would blind the one observation point the boundary has. Closing it for
+ *     real means either pushing from a scratch clone or taking the lock back
+ *     across the network, both bigger than this fix.
+ *
+ * Callers must not call this after a pullRemote that reported `conflict`:
+ * pushing from a diverged branch only records a second, redundant failure.
+ *
+ * Best-effort: never throws.
+ *
+ * @param {string} hypoDir
+ * @param {{remote: string, remoteRef: string, oid: string}|null} target
+ * @returns {{pushed: boolean}}
+ */
+export function pushRemote(hypoDir, target) {
+  try {
+    if (!target || !target.remote || !target.remoteRef || !target.oid) {
+      // No destination this function is willing to name. Not pushing is the
+      // conservative outcome and it is recorded like any other push failure, so
+      // session-start and doctor surface it instead of letting a vault look
+      // synced while it silently never pushes again.
+      appendSyncFailure(
+        hypoDir,
+        'push',
+        'push destination could not be resolved (detached HEAD, or the current branch has no upstream); nothing was pushed',
+      );
+      return { pushed: false };
+    }
+    const push = syncGit(hypoDir, 'push', target.remote, `${target.oid}:${target.remoteRef}`);
     if (push.status === 0) {
-      result.pushed = true;
       recordSyncSuccess(hypoDir, 'push');
-    } else appendSyncFailure(hypoDir, 'push', push.stderr || push.stdout);
+      return { pushed: true };
+    }
+    appendSyncFailure(hypoDir, 'push', push.stderr || push.stdout);
+    return { pushed: false };
   } catch {
-    // best-effort — never break the Stop hook
+    // best-effort: never break the Stop hook
+    return { pushed: false };
   }
-  return result;
+}
+
+/**
+ * Pull + push the wiki against its remote, guaranteeing the working tree is
+ * never left half-merged.
+ *
+ * The two halves in their original order, for every caller that does not hold
+ * the vault commit lock and so has no reason to care where the boundary is.
+ * hypo-auto-commit.mjs does hold it and calls pullRemote/pushRemote itself;
+ * see there. The ordering guarantee lives here as well as there: a conflicting
+ * pull returns before the push, so a diverged branch is never pushed from.
+ *
+ * Best-effort: never throws. A sync failure must not break the Stop hook.
+ *
+ * @param {string} hypoDir
+ * @returns {{pulled: boolean, pushed: boolean, conflict: boolean}}
+ */
+export function syncRemote(hypoDir) {
+  const { pulled, conflict } = pullRemote(hypoDir);
+  if (conflict) return { pulled: false, pushed: false, conflict: true };
+  // Resolved here rather than left to the push: the target is what makes the
+  // push unambiguous, and a caller of this combined form has no other place to
+  // decide it. HEAD right after the pull, which is what a bare `git push` would
+  // have sent anyway, minus the window between this line and the push itself.
+  const { pushed } = pushRemote(hypoDir, resolvePushTarget(hypoDir));
+  return { pulled, pushed, conflict: false };
 }
 
 // ── touched-paths (scope the auto-commit to session-touched paths) ───────────
@@ -2435,7 +3592,12 @@ export function syncRemote(hypoDir) {
 // No session_id → never accumulate, and never fall back to a shared "default"
 // bucket: a path recorded under the wrong key could leak between sessions.
 
-/** Directory holding one session's cache artifacts, incl. touched-paths.json. */
+/** Directory holding one session's cache artifacts: touched-paths.json and,
+ * since the n1 fix above, root-hot-projection-receipt.json. Neither is
+ * cleaned up when a session ends normally or dies mid-session, same as
+ * every other file already living here before this fix. An abandoned
+ * receipt from a crashed session is inert: nothing ever reads it again,
+ * since no other session shares that same session_id to look it up under. */
 function sessionCacheDir(hypoDir, sessionId) {
   return join(hypoDir, '.cache', 'sessions', sanitizeSessionId(sessionId));
 }
@@ -2470,10 +3632,20 @@ function readTouchedPathsFile(path) {
 }
 
 /**
- * Accumulate vault-relative touched paths for `sessionId`. Best-effort,
- * dedup-on-insert, JSON array (not delimiter-joined — survives non-ASCII and
- * any byte a filename can legally hold). No-op without a session_id: never
- * accumulate into a shared bucket.
+ * Accumulate vault-relative touched paths for `sessionId`. Best-effort in the
+ * sense that it never throws, but no longer silent about it: it now reports
+ * whether the accumulation actually landed, because a caller that treats a
+ * write as accounted-for the moment it calls this (root hot.md's projection
+ * writers, see hypo-session-start.mjs / hypo-hot-rebuild.mjs) needs to know
+ * when that assumption was wrong. A lock-timeout or write failure used to be
+ * indistinguishable from success: the write would go through, this would
+ * swallow the error, and the file would sit dirty with nothing in ANY
+ * session's touched-paths set to bring it into an auto-commit, orphaned
+ * until some unrelated write happens to touch the same path again. Dedup-on-
+ * insert, JSON array (not delimiter-joined, survives non-ASCII and any byte
+ * a filename can legally hold). No-op (and reports true, nothing to fail)
+ * without a session_id or with an empty path list: never accumulate into a
+ * shared bucket, and an empty call isn't a failure.
  *
  * Read-merge-write is guarded by the per-session file lock (the SAME lock
  * `drainTouchedPaths` takes), so a PostToolUse hook accumulating concurrently
@@ -2484,30 +3656,199 @@ function readTouchedPathsFile(path) {
  * @param {string} hypoDir
  * @param {string|null|undefined} sessionId
  * @param {string|string[]} relPaths one or more vault-relative paths
+ * @returns {boolean} true when the accumulation is durably recorded (or there
+ *   was nothing to record); false when a lock-timeout or write failure means
+ *   the caller cannot assume this path is in ANY session's touched-paths set.
  */
+/**
+ * Shared read-merge-write body for accumulating touched paths, factored out
+ * so `recordTouchedPaths` and `claimProjectionWrite` cannot drift on the
+ * merge itself, only on what each reports about the outcome. Runs OUTSIDE
+ * any lock; every caller wraps it in `withFileLock(path, ...)`.
+ *
+ * A corrupt/unreadable file (`readTouchedPathsFile` returns `null`) is
+ * recovered from here, not preserved: an accumulate is additive by nature
+ * (there is nothing salvageable to merge with), so starting fresh from
+ * `incoming` is the correct best-effort behavior, unlike `clearTouchedPaths`,
+ * where the same `null` MUST NOT be treated as empty (see
+ * `readTouchedPathsFile`).
+ *
+ * @returns {{added: boolean}} whether at least one of `incoming` was NOT
+ *   already present in the set before this call, the bit a pre-write claim
+ *   needs to tell "I just claimed this" from "this was already claimed",
+ *   e.g. by an earlier SessionStart invocation in the same resumed session.
+ */
+function mergeIncomingTouchedPaths(hypoDir, sessionId, incoming, hashFor) {
+  const path = touchedPathsPath(hypoDir, sessionId);
+  const current = readTouchedPathsFile(path);
+  const merged = new Set(current === null ? [] : current);
+  let added = false;
+  for (const p of incoming) {
+    if (!merged.has(p)) added = true;
+    merged.add(p);
+  }
+  // Hashes first, the set second. A failure between the two leaves a hash
+  // for a path the set may not hold (never read: only paths in the set are
+  // looked up) or the previous hash of a path the set already held (at worst
+  // a false drift, which keeps the path out of the commit and blocks, never
+  // one that sweeps foreign bytes in).
+  const hashPath = touchedHashesPath(hypoDir, sessionId);
+  const hashes = readTouchedHashesFile(hashPath);
+  for (const p of incoming) {
+    const h = hashFor(p);
+    if (h === undefined) delete hashes[p];
+    else hashes[p] = h;
+  }
+  atomicWrite(hashPath, JSON.stringify(hashes));
+  atomicWrite(path, JSON.stringify([...merged]));
+  return { added };
+}
+
+/**
+ * Where the per-path content hashes recorded alongside a session's
+ * touched-paths set live: `{ "<vault-relative path>": "<sha256 hex>" | null }`,
+ * `null` meaning the file did not exist when it was recorded. A separate file
+ * rather than a new shape for touched-paths.json, so every reader of that
+ * array (hypo-close-guard.mjs parses it itself) keeps working unchanged, and a
+ * set written before hashes existed simply has no entry here.
+ *
+ * What the hash is for: the set records that this session wrote a path, not
+ * which bytes. When a clear after a successful commit fails, the stale claim
+ * outlives its commit, and a later edit by ANOTHER session to that same path
+ * would be swept into this session's next commit. Comparing the bytes on disk
+ * with the bytes recorded here at commit time is what tells the two apart
+ * (see commitTouchedPaths).
+ */
+export function touchedHashesPath(hypoDir, sessionId) {
+  return join(sessionCacheDir(hypoDir, sessionId), 'touched-hashes.json');
+}
+
+/** Absent, corrupt, or not an object all read as `{}`: no hash recorded for
+ * any path, which is exactly how a set from before hashes existed behaves. */
+function readTouchedHashesFile(path) {
+  try {
+    const parsed = JSON.parse(readFileSync(path, 'utf-8'));
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+/** sha256 of a vault file's bytes, `null` when it does not exist, `undefined`
+ * when it exists but cannot be read (nothing trustworthy to record). */
+function vaultFileHash(hypoDir, relPath) {
+  try {
+    return sha256Hex(readFileSync(join(hypoDir, relPath)));
+  } catch (err) {
+    return err?.code === 'ENOENT' ? null : undefined;
+  }
+}
+
+/** sha256 of a vault path's blob in HEAD, `null` when HEAD has no such path
+ * (or there is no HEAD to read). `./` makes git resolve the path from the
+ * vault, which may sit below the repository root. */
+function headFileHash(hypoDir, relPath) {
+  const r = spawnSync('git', ['-C', hypoDir, 'cat-file', 'blob', `HEAD:./${relPath}`], {
+    timeout: 30000,
+    maxBuffer: 64 * 1024 * 1024,
+  });
+  return r.status === 0 && r.stdout ? sha256Hex(r.stdout) : null;
+}
+
+/** Whether a hash was recorded for `relPath` and the bytes on disk no longer
+ * match it. A path with no recorded hash never counts as drifted. */
+function recordedHashDrifted(hypoDir, hashes, relPath) {
+  return Object.hasOwn(hashes, relPath) && vaultFileHash(hypoDir, relPath) !== hashes[relPath];
+}
+
+/** Drop hash entries for paths no longer in the set. Best-effort: a leftover
+ * entry is never read (lookups are by paths in the set) and is overwritten
+ * the next time that path is recorded. */
+function pruneTouchedHashes(hypoDir, sessionId, remaining) {
+  const hashPath = touchedHashesPath(hypoDir, sessionId);
+  try {
+    if (remaining.length === 0) {
+      rmSync(hashPath, { force: true });
+      return;
+    }
+    const hashes = readTouchedHashesFile(hashPath);
+    const kept = {};
+    for (const p of remaining) if (Object.hasOwn(hashes, p)) kept[p] = hashes[p];
+    atomicWrite(hashPath, JSON.stringify(kept));
+  } catch {
+    // best-effort, see above
+  }
+}
+
 export function recordTouchedPaths(hypoDir, sessionId, relPaths) {
-  if (!sessionId) return;
+  if (!sessionId) return true;
   const incoming = (Array.isArray(relPaths) ? relPaths : [relPaths]).filter(
     (p) => typeof p === 'string' && p.length > 0,
   );
-  if (incoming.length === 0) return;
+  if (incoming.length === 0) return true;
   const path = touchedPathsPath(hypoDir, sessionId);
   try {
-    withFileLock(path, () => {
-      const current = readTouchedPathsFile(path);
-      // A corrupt/unreadable file (current === null) is recovered from here,
-      // not preserved: an accumulate is additive by nature (there is nothing
-      // salvageable to merge with), so starting fresh from `incoming` is the
-      // correct best-effort behavior — unlike clearTouchedPaths, where the
-      // same `null` MUST NOT be treated as empty (see readTouchedPathsFile).
-      const merged = new Set(current === null ? [] : current);
-      for (const p of incoming) merged.add(p);
-      atomicWriteShared(path, JSON.stringify([...merged]));
-    });
+    withFileLock(path, () =>
+      mergeIncomingTouchedPaths(hypoDir, sessionId, incoming, (p) => vaultFileHash(hypoDir, p)),
+    );
+    return true;
+  } catch {
+    // Never throws out to the caller (a hook must not fail a tool call over
+    // a cache write, includes a lock-timeout), but no longer silent: the
+    // false return is what lets a caller decide whether to trust this write
+    // as accounted for.
+    return false;
+  }
+}
+
+/**
+ * Fail-closed pre-claim for a write that MUST have a session to be
+ * accounted for, unlike recordTouchedPaths' every other caller. The generic
+ * function above returns `true` on a missing session_id, correct for a
+ * best-effort accumulate (there is nothing to accumulate, so nothing failed),
+ * but the root-hot-projection pre-claim (hypo-session-start.mjs /
+ * hypo-hot-rebuild.mjs) uses that same `true` to decide whether to go ahead
+ * and write hot.md at all. A missing session_id there must not read as
+ * "claimed": it would let hot.md be rewritten with no session's
+ * touched-paths set able to ever bring the change into a commit, an orphan
+ * write no different from a genuine lock-timeout, just for a different
+ * reason. Every other property (locking, dedup, atomic merge) is identical;
+ * this only tightens the missing-session_id case to `false`.
+ *
+ * Returns `added` alongside the old boolean (now `ok`) so a caller that must
+ * later UNDO a failed write (hypo-session-start.mjs's SessionStart, on a
+ * `writeRootHotProjection` lock-timeout or thrown failure) can tell "this
+ * call is the one that put the claim there" from "the claim was already
+ * sitting in this session's touched-paths set before this call ran", the
+ * second case is a SECOND SessionStart on the same (resumed) session_id,
+ * where an earlier invocation's still-unresolved claim must survive this
+ * invocation's own failure, not be swept away by it.
+ *
+ * @param {string} hypoDir
+ * @param {string|null|undefined} sessionId
+ * @param {string|string[]} relPaths
+ * @returns {{ok: boolean, added: boolean}}
+ */
+export function claimProjectionWrite(hypoDir, sessionId, relPaths) {
+  if (!sessionId) return { ok: false, added: false };
+  const incoming = (Array.isArray(relPaths) ? relPaths : [relPaths]).filter(
+    (p) => typeof p === 'string' && p.length > 0,
+  );
+  if (incoming.length === 0) return { ok: true, added: false };
+  const path = touchedPathsPath(hypoDir, sessionId);
+  try {
+    // No hash for a projection claim: it is taken BEFORE the write, so the
+    // bytes it will cover are not known yet, and a hash refreshed after the
+    // write could itself fail and leave the claim looking drifted over this
+    // session's own write. Root hot.md's ownership is checked per session by
+    // its receipt at Stop instead (rootHotProjectionIsCurrent). Deleting the
+    // entry also drops a hash an earlier Edit of the same path left behind.
+    const { added } = withFileLock(path, () =>
+      mergeIncomingTouchedPaths(hypoDir, sessionId, incoming, () => undefined),
+    );
+    return { ok: true, added };
   } catch {
-    // best-effort: a hook must never fail a tool call over a cache write
-    // (includes a lock-timeout — a dropped accumulation here is the same
-    // fail-safe shape as every other best-effort cache write in this file).
+    return { ok: false, added: false };
   }
 }
 
@@ -2544,6 +3885,7 @@ export function drainTouchedPaths(hypoDir, sessionId) {
       if (result === null) return []; // corrupt/unreadable: leave the file for inspection, never delete
       try {
         rmSync(path, { force: true });
+        pruneTouchedHashes(hypoDir, sessionId, []);
       } catch {
         // best-effort
       }
@@ -2583,6 +3925,66 @@ export function peekTouchedPaths(hypoDir, sessionId) {
   }
 }
 
+/**
+ * Like `peekTouchedPaths`, but does not collapse "corrupt", "lock timeout"
+ * and "empty" into the same silent `[]`. A `checkpointMode` gate treats
+ * the three differently: a lock timeout is transient (another writer holds
+ * the lock right now) and blocks so the retry reads the real set; a corrupt
+ * file stays corrupt on every retry, so the gate reads it as "no record"
+ * and says so in a notice instead of refusing forever. `peekTouchedPaths`
+ * itself is unchanged: its callers already treat its `[]` as
+ * fail-safe-to-no-scope for a best-effort commit attempt.
+ *
+ * @param {string} hypoDir
+ * @param {string|null|undefined} sessionId
+ * @returns {{state: 'ok'|'empty'|'unreadable'|'locked', paths: string[]}}
+ *   'ok': a non-empty set was read. 'empty': no session_id, or the file is
+ *   absent/genuinely empty. 'unreadable': the file exists but is corrupt, or
+ *   the lock could not be taken for a reason other than a timeout (an
+ *   unwritable directory). 'locked': the per-session lock timed out. paths
+ *   is always `[]` unless 'ok', since nothing safely known could be returned.
+ */
+export function readTouchedPathsStrict(hypoDir, sessionId) {
+  if (!sessionId) return { state: 'empty', paths: [] };
+  const path = touchedPathsPath(hypoDir, sessionId);
+  try {
+    return withFileLock(path, () => {
+      const result = readTouchedPathsFile(path);
+      if (result === null) return { state: 'unreadable', paths: [] };
+      return result.length === 0 ? { state: 'empty', paths: [] } : { state: 'ok', paths: result };
+    });
+  } catch (err) {
+    return { state: err?.code === 'ELOCKTIMEOUT' ? 'locked' : 'unreadable', paths: [] };
+  }
+}
+
+/**
+ * The paths in a session's touched-paths set whose bytes on disk no longer
+ * match the hash recorded for them (see touchedHashesPath): another write
+ * landed after this session recorded the path, so Stop keeps it out of the
+ * auto-commit. A separate reader, not a new field on readTouchedPathsStrict,
+ * so that function's `{state, paths}` shape stays exactly what its callers
+ * compare against. Only for wording a blocker; `[]` on no session_id or a
+ * lock timeout, since readTouchedPathsStrict already decides whether to block.
+ *
+ * @param {string} hypoDir
+ * @param {string|null|undefined} sessionId
+ * @returns {string[]}
+ */
+export function readTouchedPathsDrifted(hypoDir, sessionId) {
+  if (!sessionId) return [];
+  const path = touchedPathsPath(hypoDir, sessionId);
+  try {
+    return withFileLock(path, () => {
+      const current = readTouchedPathsFile(path) || [];
+      const hashes = readTouchedHashesFile(touchedHashesPath(hypoDir, sessionId));
+      return current.filter((p) => recordedHashDrifted(hypoDir, hashes, p));
+    });
+  } catch {
+    return [];
+  }
+}
+
 /**
  * Remove exactly `paths` from a session's touched-paths set — a set
  * difference, not a clear, and NOT a drain: any path a concurrent
@@ -2639,8 +4041,9 @@ export function clearTouchedPaths(hypoDir, sessionId, paths) {
           // best-effort
         }
       } else {
-        atomicWriteShared(path, JSON.stringify(remaining));
+        atomicWrite(path, JSON.stringify(remaining));
       }
+      pruneTouchedHashes(hypoDir, sessionId, remaining);
     });
   } catch {
     // lock-timeout or unexpected error: leave the file as-is. Safe per the
@@ -2685,9 +4088,29 @@ export function clearTouchedPaths(hypoDir, sessionId, paths) {
  * ever written to the corrupt file; it is left exactly as it was for a
  * human or a future recovery pass to look at.
  *
+ * A `committed: true` result clears the whole peeked scope EXCEPT
+ * `result.ignoredPaths`: the paths `commitFn` reports as still dirty but kept
+ * out of the commit by `.hypoignore`. Those stay in the touched-paths set,
+ * still blocking as a known, unresolved session write, instead of reading as
+ * "resolved" because their siblings committed. Everything else is retired,
+ * including a claim that was already clean at Stop time or that the caller
+ * deliberately left out of the scope (the root hot.md projection claim when
+ * its bytes are not this session's own): keeping those would let a path
+ * another session later edits be blocked on, or swept into, this session's
+ * next commit. A `commitFn` that reports no `ignoredPaths` (an older or
+ * test-only stand-in for `commitWikiChanges`) keeps nothing, the plain
+ * whole-scope clear.
+ *
+ * `commitFn` does not always get the whole set. A path whose bytes on disk
+ * differ from the hash recorded for it (touchedHashesPath) is left out, and
+ * is then either retired (HEAD already holds the recorded bytes, or the file
+ * is clean) or kept alongside `ignoredPaths` (another write landed after the
+ * record). The same-session case this also catches, a Bash rewrite of a
+ * path after its last Edit, is left out too: the conservative direction.
+ *
  * @param {string} hypoDir
  * @param {string|null|undefined} sessionId
- * @param {(paths: string[]) => {committed: boolean, [k: string]: unknown}} commitFn
+ * @param {(paths: string[]) => {committed: boolean, ignoredPaths?: string[], [k: string]: unknown}} commitFn
  * @returns {{committed: boolean, [k: string]: unknown}} whatever `commitFn` returned,
  *   or `{committed: false, reason: 'touched-paths-lock-timeout'}` if the lock
  *   itself could not be acquired (commitFn never ran; the file is untouched)
@@ -2705,18 +4128,55 @@ export function commitTouchedPaths(hypoDir, sessionId, commitFn) {
         // delete it.
         return commitFn([]);
       }
-      const result = commitFn(current);
+      // Content check before the commit, for every path that has a recorded
+      // hash (see touchedHashesPath). Bytes still equal to what this session
+      // recorded go into the scope. Anything else is left out of THIS commit,
+      // because the bytes on disk are no longer the ones this session wrote:
+      //   - HEAD already holds the recorded bytes: an old claim whose commit
+      //     landed but whose clear failed. Retired, so another session's
+      //     later edit of the path is never swept in under it.
+      //   - HEAD already holds the bytes on disk: nothing is dirty. Retired.
+      //   - neither: some other write landed after this session recorded the
+      //     path. Kept, so the checkpoint gate still blocks on it and says
+      //     why (readTouchedPathsDrifted), instead of the path reading as
+      //     ownerless.
+      // A path with no recorded hash (a set from before hashes existed, a
+      // projection claim, an unreadable file) goes into the scope as before.
+      const hashes = readTouchedHashesFile(touchedHashesPath(hypoDir, sessionId));
+      const scope = [];
+      const driftKept = [];
+      for (const p of current) {
+        if (!recordedHashDrifted(hypoDir, hashes, p)) {
+          scope.push(p);
+          continue;
+        }
+        const head = headFileHash(hypoDir, p);
+        if (head === hashes[p] || head === vaultFileHash(hypoDir, p)) continue;
+        driftKept.push(p);
+      }
+      const result = commitFn(scope);
       if (result && result.committed && current.length > 0) {
         // Still under the SAME lock acquired above: no recordTouchedPaths
         // call for this session can have landed since `current` was read
         // (it takes this exact lock too), so the set on disk right now is
-        // EXACTLY `current` — clearing it needs no re-read or set
-        // difference, just remove what we already know is the whole thing.
-        try {
-          rmSync(path, { force: true });
-        } catch {
-          // best-effort: the committed paths just linger on disk; the next
-          // Stop re-peeks them and re-runs commitFn, a clean no-op.
+        // EXACTLY `current`, the removal below needs no re-read.
+        const keep = new Set([
+          ...(Array.isArray(result.ignoredPaths) ? result.ignoredPaths : []),
+          ...driftKept,
+        ]);
+        const remaining = current.filter((p) => keep.has(p));
+        if (remaining.length < current.length) {
+          try {
+            if (remaining.length === 0) {
+              rmSync(path, { force: true });
+            } else {
+              atomicWrite(path, JSON.stringify(remaining));
+            }
+            pruneTouchedHashes(hypoDir, sessionId, remaining);
+          } catch {
+            // best-effort: the retired paths just linger on disk; the next
+            // Stop re-peeks them and re-runs commitFn, a clean no-op.
+          }
         }
       }
       return result;
@@ -2774,10 +4234,23 @@ function projectOfPath(relPath) {
  *
  * @param {string} hypoDir
  * @param {string[]} [paths] vault-relative paths this caller wrote/owns this close
- * @returns {{committed: boolean, scoped?: number, reason?: string}} committed:true
- *   when a commit was created OR nothing needed committing (scoped:0 in the
- *   latter case); committed:false (with reason) on a real failure: not a git
- *   repo, or git status/add/commit erroring.
+ * @returns {{committed: boolean, scoped?: number, sha?: string|null, committedPaths?: string[], ignoredPaths?: string[], reason?: string}}
+ *   committed:true when a commit was created OR nothing needed committing
+ *   (scoped:0 in the latter case); committed:false (with reason) on a real
+ *   failure: not a git repo, or git status/add/commit erroring. `sha` is the
+ *   commit this call created, and is present ONLY on that branch: a
+ *   `scoped: 0` success created no commit, so it carries no sha rather than
+ *   an unrelated HEAD a caller could tell someone to revert. It is `null`
+ *   when the commit succeeded but reading its hash did not. `committedPaths`
+ *   is present on every `committed: true` outcome, `[]` for a no-op, and
+ *   names exactly the paths THIS call actually staged into the commit (the
+ *   rename-collapsed destination set `git diff --cached --name-only` itself
+ *   reports). `ignoredPaths` (also on every `committed: true` outcome) names
+ *   the supplied paths that ARE dirty but were kept out of the commit only
+ *   because `.hypoignore` matches them, so a caller clearing a per-session
+ *   pending-write set (Stop's `commitTouchedPaths`) can keep exactly those as
+ *   unresolved. A stale or already-clean supplied path is never listed:
+ *   nothing about it is left unresolved.
  */
 export function commitWikiChanges(hypoDir, paths) {
   const git = (...args) =>
@@ -2788,7 +4261,8 @@ export function commitWikiChanges(hypoDir, paths) {
   const supplied = new Set(
     (Array.isArray(paths) ? paths : []).filter((p) => typeof p === 'string' && p.length > 0),
   );
-  if (supplied.size === 0) return { committed: true, scoped: 0 };
+  if (supplied.size === 0)
+    return { committed: true, scoped: 0, committedPaths: [], ignoredPaths: [] };
 
   // `-z`: NUL-separated records with verbatim paths — no surrounding quotes and
   // no octal escaping, so non-ASCII paths (Korean page names are normal input
@@ -2798,17 +4272,31 @@ export function commitWikiChanges(hypoDir, paths) {
   const porcelain = git('status', '--porcelain', '-uall', '-z');
   if (porcelain.status !== 0)
     return { committed: false, reason: `git status failed in ${hypoDir}` };
+  // porcelain paths are repository-root relative, while `supplied` and every
+  // pathspec below are vault relative (git resolves pathspecs against -C). A
+  // vault nested inside a larger repository therefore needs its prefix
+  // stripped before matching, the same rule gitDirtyFiles uses; a record
+  // outside the vault is out of scope.
+  const prefixRes = git('rev-parse', '--show-prefix');
+  if (prefixRes.status !== 0)
+    return { committed: false, reason: `git rev-parse --show-prefix failed in ${hypoDir}` };
+  const prefix = (prefixRes.stdout || '').replace(/\n$/, '');
+  const toVaultRelative = (f) => {
+    if (!f || !prefix) return f || null;
+    return f.startsWith(prefix) ? f.slice(prefix.length) : null;
+  };
   // `.hypoignore` is the project privacy boundary. `git add -A` ignores it, so
   // enumerate changed paths, drop ignored ones, then stage explicitly.
   const ignorePatterns = loadHypoIgnore(hypoDir);
   const scoped = []; // pathspec for `git add -A` — worktree/index paths only
   const commitScope = []; // pathspec for the final diff/commit --only (superset)
+  const ignoredPaths = []; // supplied, dirty, but excluded by .hypoignore
   const records = (porcelain.stdout || '').split('\0');
   for (let i = 0; i < records.length; i++) {
     const rec = records[i];
     if (!rec) continue;
     const xy = rec.slice(0, 2);
-    const file = rec.slice(3); // `XY <path>`; the destination path for a rename/copy
+    const file = toVaultRelative(rec.slice(3)); // `XY <path>`; the destination for a rename/copy
     const isRename = xy[0] === 'R' || xy[1] === 'R';
     // A rename OR copy emits two records (`to\0from`); consume the trailing
     // `from`. Copy `C` records only appear under `status.renames=copies`, but
@@ -2817,12 +4305,14 @@ export function commitWikiChanges(hypoDir, paths) {
     let fromFile = null;
     if (isRename || xy[0] === 'C' || xy[1] === 'C') {
       i++;
-      fromFile = records[i] || null;
+      fromFile = toVaultRelative(records[i] || null);
     }
     if (!file) continue;
     if (!supplied.has(file)) continue; // out of this caller's scope
-    if (ignorePatterns.length > 0 && isIgnored(join(hypoDir, file), hypoDir, ignorePatterns))
+    if (ignorePatterns.length > 0 && isIgnored(join(hypoDir, file), hypoDir, ignorePatterns)) {
+      ignoredPaths.push(file);
       continue;
+    }
     scoped.push(file);
     commitScope.push(file);
     // A rename's `from` path is the SAME change as its destination — without
@@ -2836,7 +4326,8 @@ export function commitWikiChanges(hypoDir, paths) {
     // in at all: the caller must name it explicitly if it wants it in scope.
     if (isRename && fromFile) commitScope.push(fromFile);
   }
-  if (scoped.length === 0 && commitScope.length === 0) return { committed: true, scoped: 0 };
+  if (scoped.length === 0 && commitScope.length === 0)
+    return { committed: true, scoped: 0, committedPaths: [], ignoredPaths };
 
   if (scoped.length > 0) {
     const add = git('add', '-A', '--', ...scoped);
@@ -2851,9 +4342,11 @@ export function commitWikiChanges(hypoDir, paths) {
   // pathspec (commitScope, the rename-aware superset of `scoped`) — this step
   // must not widen back to whole-tree either, or another session's already-
   // staged file would slip into the commit here.
-  const staged = git('diff', '--cached', '--name-only', '-z', '--', ...commitScope);
+  // `--relative`: name the staged paths from the vault, like everything above.
+  const staged = git('diff', '--cached', '--name-only', '--relative', '-z', '--', ...commitScope);
   const stagedFiles = (staged.stdout || '').split('\0').filter(Boolean);
-  if (stagedFiles.length === 0) return { committed: true, scoped: 0 };
+  if (stagedFiles.length === 0)
+    return { committed: true, scoped: 0, committedPaths: [], ignoredPaths };
 
   const projects = new Set(stagedFiles.map(projectOfPath));
   const today = new Date().toISOString().slice(0, 10);
@@ -2879,7 +4372,23 @@ export function commitWikiChanges(hypoDir, paths) {
       committed: false,
       reason: `git commit failed: ${(commit.stderr || '').trim() || 'unknown'}`,
     };
-  return { committed: true, scoped: stagedFiles.length };
+  // MAJOR fix: name the commit this call just created. A caller that has to
+  // tell a user how to take it back (close-gate-store.mjs's
+  // hostTagWarningWithUndo) cannot derive it afterwards: on a shared vault
+  // HEAD by then may be a concurrent session's commit, and reverting that
+  // undoes someone else's work. Read right here, still inside the caller's
+  // lock hold. `null` when rev-parse somehow fails: an undo instruction with
+  // no target is a smaller failure than one with the wrong target, and the
+  // commit itself did succeed, so this must not turn into `committed: false`.
+  const head = git('rev-parse', 'HEAD');
+  const sha = head.status === 0 ? (head.stdout || '').trim() || null : null;
+  return {
+    committed: true,
+    scoped: stagedFiles.length,
+    sha,
+    committedPaths: stagedFiles,
+    ignoredPaths,
+  };
 }
 
 /**
@@ -3031,7 +4540,7 @@ export function recordSyncSuccess(hypoDir, op) {
         // carry the corruption forward.
       }
       current[op] = { timestamp: new Date().toISOString(), host: hostname() };
-      atomicWriteShared(path, JSON.stringify(current, null, 2) + '\n');
+      atomicWrite(path, JSON.stringify(current, null, 2) + '\n');
     });
   } catch {
     // best-effort: lock timeout or write failure must never break the caller
@@ -3388,14 +4897,25 @@ export function normalizeVerifiedScope(verifiedScope) {
  *
  * @param {string} hypoDir
  * @param {string} sessionId
- * @param {{project?: string, scope?: string, transcript_path?: string, verifiedScope?: {kind: 'log-only'|'project'|'global', projects?: string[]}}} info
+ * @param {{project?: string, scope?: string, transcript_path?: string, verifiedScope?: {kind: 'log-only'|'project'|'global', projects?: string[]}, hostTagWarning?: string}} info
+ *   `hostTagWarning` is optional and, when present, is persisted as
+ *   `host_tag_warning` (see the payload below): the close-time residual a
+ *   reader of this file after the fact would otherwise have no record of.
+ *   `receiptGeneration`: when a caller wrote a close
+ *   receipt (`hooks/close-receipt.mjs`) for this session BEFORE calling this
+ *   function, it passes that receipt's `generation` here. A new Stop keys its
+ *   `legacy-closed` acceptance on this field's ABSENCE: a marker written by
+ *   an old build (or a caller that skipped the receipt) has no generation and
+ *   is accepted as a weaker, time-limited proof; a marker that carries one
+ *   promises a receipt exists, and Stop refuses to trust the marker alone
+ *   when that receipt is missing, invalid, or unreachable.
  */
 export function writeSessionClosedMarker(hypoDir, sessionId, info = {}) {
-  if (!sessionId) return;
+  if (!sessionId) return false;
   try {
     const cacheDir = join(hypoDir, '.cache');
     if (!existsSync(cacheDir)) mkdirSync(cacheDir, { recursive: true });
-    // scope distinguishes a project close (the 5 mandatory files were verified
+    // scope distinguishes a project close (the 4 mandatory files were verified
     // fresh) from a log-only close (a non-project session, no project
     // attribution). Readers (precompactGateStatus / --check-session-close) key
     // the gate semantics on this field, so it must be recorded.
@@ -3426,10 +4946,36 @@ export function writeSessionClosedMarker(hypoDir, sessionId, info = {}) {
       // adopted this field reads back byte-identical to before it existed —
       // doctor's reader treats "field absent" as "no additional scope check".
       ...(verifiedScope ? { verified_scope: verifiedScope } : {}),
+      // Same omit-when-absent contract. Set only when this close survived a
+      // HOST_TAG_NAMES-shaped queue item reading as neutral rather than a
+      // retraction (see walkCloseGate's neutralizedHostTagName and
+      // closeGateStatus's hostTagWarning): a caller inspecting the marker
+      // after the fact can then see the same residual the close-time console
+      // output already warned about once.
+      ...(info.hostTagWarning ? { host_tag_warning: info.hostTagWarning } : {}),
+      // Omit-when-absent, same contract as the two fields above: a marker
+      // written with no receipt behind it (or by a caller that predates the
+      // receipt writer) must read back exactly as it always has.
+      ...(info.receiptGeneration ? { receipt_generation: info.receiptGeneration } : {}),
     };
-    writeFileSync(sessionClosedMarkerPath(hypoDir, sessionId), JSON.stringify(payload) + '\n');
+    // Atomic, and it reports. Two reasons, and the caller needs both.
+    //
+    // A plain writeFileSync can leave a truncated file behind, and the reader
+    // below drops a marker it cannot parse. That combination turns one failed
+    // write into a session that can never close: the caller sees a file, calls
+    // the close signal spent, and the next Stop deletes the unparseable marker.
+    // temp+rename means the target is either the old bytes or the whole new
+    // ones, never half.
+    //
+    // And existsSync cannot answer the question the caller is really asking.
+    // "A marker file is there" is not "this run put it there" — a corrupt
+    // marker from an earlier attempt satisfies it just as well. So say whether
+    // THIS write landed and let the caller key on that.
+    atomicWrite(sessionClosedMarkerPath(hypoDir, sessionId), JSON.stringify(payload) + '\n');
+    return true;
   } catch (err) {
     process.stderr.write(`[hypo] session-closed marker write failed: ${err?.message || err}\n`);
+    return false;
   }
 }
 
@@ -3953,7 +5499,7 @@ export function resolveCloseScope(hypoDir, opts = {}, marker = null) {
  * cwd yields a best-effort notice, not a block. apply never passes it (its launch
  * cwd may differ from the authoritative payload.project).
  *
- * @param {{lintScope?: Iterable<string>, transcriptPath?: string|null, claudeHome?: string, projectOverride?: string|null, attributionScope?: string|null, sessionCwd?: string|null, sessionId?: string|null, logOnly?: boolean, closeScope?: string[]}} [opts]
+ * @param {{lintScope?: Iterable<string>, transcriptPath?: string|null, claudeHome?: string, projectOverride?: string|null, attributionScope?: string|null, sessionCwd?: string|null, sessionId?: string|null, closeMarker?: object|null, logOnly?: boolean, closeScope?: string[]}} [opts]
  * @returns {{ok: boolean, close: object, blockers: {type:string,reason:string}[], notices: {type:string,reason:string,file?:string}[], driftTargets: string[], skipped: {lint:boolean, feedback:boolean}}}
  */
 export function precompactGateStatus(hypoDir, opts = {}) {
@@ -3972,7 +5518,20 @@ export function precompactGateStatus(hypoDir, opts = {}) {
   // below. Exempting only the close blocker would still let an unrelated project's
   // stale design-history / lint block the non-project session (codex design
   // BLOCKER). git / hot / lint(self) / feedback all still apply — not a bypass.
-  const marker = opts.sessionId ? readSessionClosedMarker(hypoDir, opts.sessionId) : null;
+  // opts.closeMarker, when the key is set, is the marker the caller already
+  // judged with closeCheckpointState (hooks/close-receipt.mjs): the marker of a
+  // finished close, or null when the close is broken or open. Stop, PreCompact
+  // and --check-session-close pass it, so a marker whose receipt is missing or
+  // invalid never sets log-only mode or attribution here. It is injected rather
+  // than computed because close-receipt.mjs imports this module. Without it the
+  // raw marker is read as before (the apply paths, which invalidate this
+  // session's marker before they reach this gate).
+  const marker =
+    opts.closeMarker !== undefined
+      ? opts.closeMarker
+      : opts.sessionId
+        ? readSessionClosedMarker(hypoDir, opts.sessionId)
+        : null;
   const logOnly = opts.logOnly === true || marker?.scope === 'log-only';
 
   // Paths this session is accountable for at THIS close: the same signals the
@@ -4024,21 +5583,25 @@ export function precompactGateStatus(hypoDir, opts = {}) {
     }
   }
 
-  // 1. wiki git state. Uncommitted changes (real unsaved work) BLOCK, but only
-  //    the ones inside closeAccountableScope, and only when sessionTouchTrusted
-  //    (above) says that scope can actually be trusted: a session's own scoped
-  //    auto-commit (commitWikiChanges, PR #222) can leave the working tree
-  //    non-empty when a DIFFERENT session sharing this vault still has its own
-  //    file dirty, the 2026-08-03 multi-session block. That dirty file is
-  //    human-fixable by whoever owns it, not by this session, so it demotes to
-  //    a notice (listed by path, never silently dropped) instead of refusing
-  //    this session's marker. A dirty file THIS session owns still blocks
-  //    unconditionally (fail-closed is unchanged for scope this session
-  //    actually touched), and so does an unattributable state: a git failure
-  //    gitDirtyFiles can't enumerate (dirty.length === 0 despite
-  //    git.uncommitted === true), OR a scope we cannot trust
-  //    (!sessionTouchTrusted) both fall back to the original unscoped blocker:
-  //    "cannot attribute" is not "clean".
+  // 1. wiki git state. Uncommitted changes (real unsaved work) BLOCK, but a
+  //    file this session cannot be held to still demotes to a notice: a
+  //    session's own scoped auto-commit (commitWikiChanges, PR #222) can
+  //    leave the working tree non-empty when a DIFFERENT session sharing
+  //    this vault still has its own file dirty, the 2026-08-03 multi-session
+  //    block. That dirty file is human-fixable by whoever owns it, not by
+  //    this session, so it demotes to a notice (listed by path, never
+  //    silently dropped) instead of refusing this session's marker. Which
+  //    set decides "not mine" depends on what the caller told us: a
+  //    caller-provided project (--project, or the cwd-derived
+  //    attributionScope) demotes by PATH STRUCTURE alone
+  //    (isForeignProjectFile below), independent of transcript trust; with
+  //    no such scope, only a trusted transcript's closeAccountableScope can
+  //    tell mine from foreign, so an untrusted,
+  //    unscoped session falls back to the original unscoped blocker:
+  //    "cannot attribute" is not "clean". A dirty file THIS session owns
+  //    still blocks unconditionally either way, and so does the
+  //    enumeration-failed case below (dirty.length === 0 despite
+  //    git.uncommitted === true).
   //    Unpushed commits (ahead) DEMOTE to a notice regardless of scope: push is
   //    automatic (auto-commit Stop hook) and its failures are already non-fatal, so
   //    "ahead" is a transient sync state, not a human-fixable blocker. Demoting it
@@ -4046,24 +5609,138 @@ export function precompactGateStatus(hypoDir, opts = {}) {
   //    a committed-but-unpushed close marks AND compacts, instead of the close writer
   //    committing its own payload and then being blocked by its own (unpushed) commit.
   const git = hypoIsClean(hypoDir);
-  if (git.uncommitted) {
+  // checkpointMode: a marker-writing
+  // path's own gate call, replacing the whole git axis above with a narrower
+  // question: "is there an uncommitted write THIS session is known to still
+  // own, or any uncommitted file in the project folder being closed".
+  // Everything else (close files, cwd, hot structure, lint, W8,
+  // feedback) is untouched below; Stop, PreCompact and check never set this.
+  if (opts.checkpointMode) {
+    if (!isValidSessionId(opts.sessionId)) {
+      blockers.push({
+        type: 'checkpoint-session',
+        reason: 'checkpointMode requires a validated sessionId',
+      });
+    } else if (git.uncommitted) {
+      const dirty = gitDirtyFiles(hypoDir);
+      if (dirty.length === 0) {
+        // Enumeration itself failed (or nothing is actually dirty despite the
+        // porcelain status): fail closed exactly like the unscoped path below.
+        blockers.push({ type: 'git', reason: git.reason });
+      } else {
+        const touched = readTouchedPathsStrict(hypoDir, opts.sessionId);
+        if (touched.state === 'locked') {
+          // Another writer holds this session's touched-paths lock right now
+          // (usually this session's own Stop auto-commit). Transient, so
+          // block: the retry reads the real set instead of guessing.
+          blockers.push({
+            type: 'known-session-write',
+            reason: 'touched-paths lock timed out (다른 쓰기가 끝난 뒤 다시 시도하면 된다)',
+          });
+        } else {
+          // A corrupt set reads as "no record". It would read the same on
+          // every retry, and nothing clears it, so blocking on it refused
+          // every close for good. The project folder rule below does not
+          // depend on the record, so that folder stays protected; only the
+          // ownership of files outside it goes unjudged, and the notice
+          // says so.
+          if (touched.state === 'unreadable') {
+            notices.push({
+              type: 'touched-paths-unreadable',
+              reason:
+                'touched-paths unreadable: ownership of dirty files outside the project folder being closed was not judged (touched-paths 기록을 읽지 못해 프로젝트 폴더 밖 파일의 소유를 판정하지 못했다)',
+            });
+          }
+          // The project folder this close is closing blocks on any dirty
+          // file, recorded or not, as the gate did before checkpointMode.
+          // The record is not complete enough to be the only guard there: a
+          // failed record (a hash sidecar or list write that did not land)
+          // leaves this session's own write unlisted, and a close that died
+          // between creating a new project's index.md and writing it leaves
+          // an empty file no session ever recorded. Root files and other
+          // projects' folders keep the record-only rule, since those are
+          // where another session's dirty file stopped a close for good.
+          // With no project named (a --mark without --project), whose folder
+          // it is cannot be told, so every projects/ file blocks. A log-only
+          // close names no project by design, so none does.
+          const closeSlug = opts.projectOverride || opts.attributionScope || null;
+          const inClosedProject = (f) =>
+            closeSlug
+              ? f.startsWith(`projects/${closeSlug}/`)
+              : !logOnly && f.startsWith('projects/');
+          const touchedSet = new Set((touched.paths || []).map(posixPath));
+          const driftedSet = new Set(
+            readTouchedPathsDrifted(hypoDir, opts.sessionId).map(posixPath),
+          );
+          const ignorePatterns = loadHypoIgnore(hypoDir);
+          for (const f of dirty) {
+            if (touchedSet.has(posixPath(f))) {
+              // A touched file .hypoignore keeps out of every commit stays
+              // dirty forever on its own: say how to get out. A file whose
+              // bytes changed after this session recorded it is kept out of
+              // the auto-commit (commitTouchedPaths), so say that too.
+              const ignoredHint =
+                ignorePatterns.length > 0 && isIgnored(join(hypoDir, f), hypoDir, ignorePatterns)
+                  ? ' (.hypoignore 대상이라 자동 커밋되지 않는다. 손으로 커밋하거나 .hypoignore 에서 빼야 close 가 된다)'
+                  : driftedSet.has(posixPath(f))
+                    ? ' (이 세션이 기록한 뒤 다른 쓰기가 이 파일을 바꿔서 자동 커밋에서 빠진다. 지금 내용이 맞는지 확인하고 손으로 커밋해야 close 가 된다)'
+                    : '';
+              blockers.push({
+                type: 'known-session-write',
+                file: f,
+                reason: `this session's own write is still uncommitted: ${f}${ignoredHint}`,
+              });
+            } else if (inClosedProject(posixPath(f))) {
+              blockers.push({
+                type: 'git',
+                file: f,
+                reason: closeSlug
+                  ? `uncommitted file in the project folder being closed: ${f} (close 하는 프로젝트 폴더 안의 미커밋 파일은 이 세션의 쓰기 기록에 없어도 막는다. 커밋하거나 되돌려야 close 가 된다)`
+                  : `uncommitted file under projects/ and this close names no project: ${f} (close 하는 프로젝트를 알 수 없어 projects/ 아래 미커밋 파일은 쓰기 기록에 없어도 막는다. --project 로 프로젝트를 지정하거나, 커밋하거나 되돌려야 close 가 된다)`,
+              });
+            } else {
+              notices.push({
+                type: 'unresolved',
+                file: f,
+                reason: `uncommitted changes, ownership unknown: ${f}`,
+              });
+            }
+          }
+        }
+      }
+    } else if (git.ahead) {
+      notices.push({
+        type: 'git-sync',
+        reason: `unpushed commits in ${hypoDir} (push deferred to Stop hook)`,
+      });
+    }
+  } else if (git.uncommitted) {
     const dirty = gitDirtyFiles(hypoDir);
     if (dirty.length === 0) {
       // Enumeration itself failed (or nothing is actually dirty despite the
       // porcelain status): "cannot attribute" is not "clean", block exactly
       // as before, override or not.
       blockers.push({ type: 'git', reason: git.reason });
-    } else if (!sessionTouchTrusted && (opts.projectOverride || opts.attributionScope)) {
-      // session-close-scope-boundary spec §2b: a broken/missing transcript
-      // normally means "cannot attribute, fail closed" (the branch below).
-      // But when the CALLER told us which project is ours (an explicit
-      // --project, or the cwd-derived attributionScope), a dirty file that
-      // lives structurally under a DIFFERENT eligible project's own directory
-      // needs no attribution inference at all: the path alone proves it is
-      // not this session's file. Everything else (this session's own
-      // project, pages/, an unregistered or _template project dir) keeps the
-      // pre-existing fail-closed behavior; only a provably-foreign path is
-      // demoted.
+    } else if (opts.projectOverride || opts.attributionScope) {
+      // session-close-scope-boundary spec §2b, revised 2026-09-11: a
+      // caller-provided scope (an explicit --project, or the cwd-derived
+      // attributionScope) proves which project is ours PATH-STRUCTURALLY,
+      // regardless of transcript trust. This used to run only when
+      // !sessionTouchTrusted, on the theory that a trusted transcript could
+      // fall back to closeAccountableScope instead. But closeAccountableScope
+      // is `closeFileTargetsGlobal` whenever opts.projectOverride is unset
+      // (every caller here passes attributionScope, never projectOverride;
+      // see crystallize-close-apply.mjs), which unions in every OTHER
+      // today-active project's own mandatory close files too. That let a
+      // different session's still-dirty close files (session-state.md,
+      // project hot.md, today's session-log shard) block THIS session's
+      // marker even with --project set. A dirty file that lives structurally
+      // under a DIFFERENT eligible project's own
+      // directory needs no attribution inference at all: the path alone
+      // proves it is not this session's file. Everything else (this
+      // session's own project, pages/, an unregistered or _template project
+      // dir) keeps the pre-existing fail-closed behavior; only a
+      // provably-foreign path is demoted.
       const effectiveOverride = opts.projectOverride || opts.attributionScope;
       // Computed once per gate call, never per file (collectProjectWorkingDirs
       // walks the projects/ dir and reads every index.md). A throw here (a
@@ -4085,6 +5762,20 @@ export function precompactGateStatus(hypoDir, opts = {}) {
       const isForeign = (f) =>
         isForeignProjectFile(f, { eligibleSlugs, effectiveOverride, transcriptTouched });
       const foreign = dirty.filter(isForeign);
+      // A dirty file inside the scoped project's OWN directory blocks, even one
+      // this close does not write. An earlier revision demoted those to notices
+      // to escape a deadlock: a close whose commit fails leaves
+      // `projects/<p>/index.md` (seeded by ensureProjectIndex) uncommitted, the
+      // retry skips every payload field as already-current without re-staging
+      // it, and the marker can then never land again no matter how often the
+      // user retries.
+      //
+      // That demotion was far wider than the deadlock it answered. It waved
+      // through every unsaved file in the project, which is exactly the work a
+      // close is supposed to refuse to walk away from. The deadlock is fixed at
+      // its source instead: applyOverwrites re-stages index.md on the retry
+      // path (crystallize-close-apply.mjs), so the file this branch used to
+      // demote is now in the close's own commit scope and never reaches here.
       const rest = dirty.filter((f) => !isForeign(f));
       if (rest.length > 0) {
         blockers.push({
@@ -4984,12 +6675,28 @@ export function resolveTranscriptBySessionId(
  *
  * Fail-closed: any read/parse error → not open.
  *
- * @returns {{open: boolean, openedAtIndex: number}} `openedAtIndex` is the
- *   position, in the FATAL-filtered record array this walk builds internally
- *   (blank lines dropped, non-object JSON values dropped, first parse failure
- *   returns early), of the most recent event that opened the gate, or -1 if
- *   none ever did. `close-gate-store.mjs`'s `resolutionStamp` counts records
- *   by the same definition, so the two indices are comparable.
+ * @returns {{open: boolean, openedAtIndex: number, retractedByUnknownTagName: string|null, neutralizedHostTagName: string|null}}
+ *   `openedAtIndex` is the position, in the FATAL-filtered record array this
+ *   walk builds internally (blank lines dropped, non-object JSON values
+ *   dropped, first parse failure returns early), of the most recent event
+ *   that opened the gate, or -1 if none ever did. `close-gate-store.mjs`'s
+ *   `resolutionStamp` counts records by the same definition, so the two
+ *   indices are comparable. `retractedByUnknownTagName` names the tag (e.g.
+ *   `"any-new-host-tag"`) when the CURRENT `open: false` came from a
+ *   tag-shaped queue enqueue that is not one of `HOST_TAG_NAMES`, so a caller
+ *   can tell a maintainer which name to add; null whenever the current state
+ *   has another explanation or the gate is open. `neutralizedHostTagName`
+ *   names a `HOST_TAG_NAMES` tag (e.g. `"agent-message"`) that most recently
+ *   read as neutral, rather than a retraction, since the LAST event that
+ *   opened the gate, so a caller can warn that the close now in effect
+ *   survived a shape a person could also have pasted verbatim. Reset to null
+ *   by every event that (re)opens the gate, so it never survives past the
+ *   open it describes; null when nothing neutral has happened since that
+ *   open. Do NOT read it when `open` is false: the events that CLOSE the
+ *   gate (popAll, `/clear`, an unregistered tag, an attachment retraction, a
+ *   declined reconfirm) leave this field untouched, so on a closed gate it
+ *   can still name a tag from the open that was already retracted. Every
+ *   consumer today reads it only on an open gate.
  */
 // Genuine user text of a record, or null when the record is on a channel the
 // honest-but-drifting model can reach (so it is never user intent — NEUTRAL).
@@ -5097,23 +6804,192 @@ function isModelReachableRecord(obj) {
 // notification the host injects on the model's behalf. Shared by the enqueue
 // branch and the remove-path (queued_command attachment) branch below so a
 // task notification reads as neutral on BOTH delivery shapes of the same host
-// event. Before this was extracted, only the enqueue branch filtered it — the
+// event. Before this was extracted, only the enqueue branch filtered it: the
 // attachment branch treated any non-close prompt, including a task
-// notification, as a change-of-mind close: a close typed by the user opened
-// the gate, then the notification for an unrelated background task landed
-// via this path and flipped it shut again.
+// notification, as a change-of-mind close, so a close typed by the user
+// opened the gate and the notification for an unrelated background task then
+// flipped it shut again.
+//
+// The prefix check used to be a literal `<task-notification>` string, which
+// missed two other host-minted tags this file had never been taught by name:
+// a subagent hand-back (`<agent-message from="...">`) and a cross-session
+// message (`<cross-session-message from="...">`). Measured 2026-09-17
+// against ~4.6K enqueue records across 431 transcripts (the corpus is live
+// and grows every session, so these counts are a snapshot, not a
+// reproducible figure; the ratios are what hold): task-notification (no
+// attributes) ~3890, agent-message (attributed) ~166, cross-session-message
+// (attributed) ~27, plain user prose ~518, slash commands ~53. Of the
+// records that start with `<` (~4.1K), exactly these three distinct tag
+// names occur, all host-minted.
+//
+// A first attempt widened the match to ANY leading tag name (`<name ...>` or
+// `<name>`, attributes optional), on the reasoning that a fourth host tag
+// would then read as neutral without a code change. That widening was
+// reverted: a queue-operation enqueue has no `origin` or `commandMode` field
+// to fall back on, so a leading-tag check is the ONLY signal this branch has,
+// and it cannot tell a host tag from a person's own bracketed text. Two
+// shapes a person can plausibly type or paste both matched the wide version:
+// a label like `<TODO> 계속 작업해줘`, and an unterminated prefix such as
+// `<please keep working` (the regex needed only a following space, not a
+// closing `>`). Both would have read as model-caused and neutral, silently
+// dropping a real change of mind instead of closing the gate. So the match
+// stays a closed allowlist of the three names this corpus has actually
+// produced (HOST_TAG_NAMES below), not a name-shaped pattern. A fourth host
+// tag this file has not been taught by name still falls through to the
+// enqueue branch's `else open = false` and retracts a close; that is the same
+// residual the enqueue branch's own comment already carries for any
+// unrecognized shape, not a new one this allowlist introduces.
+//
+// The slash-command ~53 does NOT mean "handled above, never reaches here".
+// Only `/clear` (~3) is caught by the branch above this one. The other ~50
+// (`/hypo:resume` ~40, `/reload-plugins` ~8, `/resume` ~1, `/operations…`
+// ~1) DO reach this filter, read as not-machine (no leading `<`), and fall
+// through to the enqueue branch's `else open = false`, same as any other
+// unrecognized non-close text. That classification is not obviously wrong
+// for `/hypo:resume` (typed by a human resuming work), but a queued
+// `/reload-plugins` right after a close retracts that close the same way,
+// and this file has never separately reasoned about whether that one
+// should. Confirmed against `walkCloseGate` directly: `close, then enqueue
+// "/reload-plugins"` reads false (closed), same as `/hypo:resume` and
+// `/clear`; only `/compact` reads true.
+//
+// None of the ~518 plain-prose records carry any of six known
+// machine-marker substrings (`[Subagent`, `hand-back`, `SYSTEM
+// NOTIFICATION`, `task-notification`, `Caveat:`, `automated`) in their first
+// 200 characters; some are as short as "reply with ok". So on the ENQUEUE
+// channel, in this corpus, one of these three leading tags separates
+// machine-caused content from user prose with zero false positives and zero
+// false negatives at this sample, but that separation is scoped to the
+// three names it checks, by design: it says nothing about a tag this corpus
+// has not produced.
+//
+// This predicate must not be reused on the typed (eventUserText) channel
+// either. 61 records that channel accepts as genuine user prose start with a
+// host tag too (`<bash-input>` ~24, `<bash-stdout>` ~24,
+// `<local-command-stdout>` ~13); `<bash-input>` is the user's own `!`
+// command. Those shapes do not occur on the queue channel today, so the two
+// channels read the same prefix in opposite directions and must stay on
+// separate predicates.
+//
+// Attachment-side note: this same function backstops the queued_command
+// branch below, but that branch now only reaches it when it has no producer
+// signal at all. `origin.kind` "human" overrides this body check there
+// entirely (see that branch's comment) rather than being weighed against it,
+// because a human-authored prompt can start with one of these three strings
+// too, by coincidence or by paste, and a producer field the host stamps is
+// stronger evidence than a string the host also mints. Measured: of 1796
+// queued_command attachments, 0 carry both a host-tag-shaped prefix and
+// origin.kind "human", so this ordering changes 0 outcomes at this sample;
+// it is a defense against a shape the corpus has not produced yet.
+//
+// ENQUEUE-BRANCH REVERSION (2026-09-18): a prior pass (codex cross-review
+// round 5, blocker) changed this branch to close on every non-empty,
+// non-close body, tag-shaped or not. Its reasoning still holds as a fact:
+// `queue-operation enqueue` carries no `origin` or `commandMode` field, so a
+// HOST_TAG_NAMES match here was never PROOF of a host producer, only a
+// corpus fact that no other producer had used the shape yet. What moved is
+// the judgment about which mistake costs more, once the corpus this file
+// actually runs against was measured. Of 433 sessions carrying a close
+// signal, 95 (21.9%, snapshot of a live and growing corpus, so the count
+// drifts but the ratio held at measurement time) hit that retraction, and 66
+// of those repeated the reconfirm five times or more, a friction this
+// file's own users hit daily. The event that retraction was defending
+// against, a person typing or pasting a HOST_TAG_NAMES shape verbatim, has
+// not been observed in this corpus at all; the trade was a confirmed daily
+// cost against an unmeasured one. A codex design consultation split the two
+// failure directions by recoverability instead of by which reading is more
+// often right: a commit opened by mistake is auditable and revertable in
+// git, while a permission closed by mistake just keeps asking the same user
+// to reconfirm a decision they already made. So the enqueue branch below
+// calls this function again and reads a HOST_TAG_NAMES match as neutral, the
+// same shape it read before the amendment. The residual that reopens, a
+// pasted tag keeping a spent close alive, is not guessed against on every
+// gate read; it is named once, via `neutralizedHostTagName` below, and
+// surfaced once at commit time by crystallize-close-apply.mjs rather than on
+// every read that would otherwise repeat the same nag the measurement above
+// found costly. This function's host-tag branch was already authoritative
+// for the queued_command attachment branch below (it never adopted the
+// amendment), which has `origin.kind` and `commandMode` to weigh a tag match
+// against, signals the enqueue shape does not carry.
+//
+// Exported so close-gate-store.mjs's `closeGateStatus` can tell a KNOWN host
+// tag apart from an unrecognized one when it names the culprit in its
+// `no-open` reason string: the advice differs (a known tag closing the gate
+// is the enqueue-branch fix above working as intended; an unrecognized one is
+// the "which tag to add" diagnostic that already existed).
+export const HOST_TAG_NAMES = ['task-notification', 'agent-message', 'cross-session-message'];
+// Capturing, not `(?:`, so hostTagNameOf below reads the matched name off the
+// same regex that decides neutrality. Two places in walkCloseGate need that
+// name, and giving either one its own pattern is how HOST_TAG_NAMES grows in
+// one of them and not the other.
+const HOST_TAG_PREFIX = new RegExp(`^<(${HOST_TAG_NAMES.join('|')})(?=[\\s>])`);
 function isModelCausedQueueContent(text) {
   const c = typeof text === 'string' ? text.trim() : '';
-  return !c || c.startsWith('<task-notification>');
+  return !c || HOST_TAG_PREFIX.test(c);
+}
+
+// The allowlisted tag name a queued body starts with, or null when it starts
+// with anything else. Diagnostic only, exactly like TAG_SHAPE_PREFIX below:
+// it never decides the gate, it only lets walkCloseGate say WHICH tag read as
+// neutral. Both neutral enqueue branches call this rather than re-deriving
+// the name, so adding a fourth name to HOST_TAG_NAMES moves both at once.
+function hostTagNameOf(text) {
+  const m = HOST_TAG_PREFIX.exec(typeof text === 'string' ? text.trim() : '');
+  return m ? m[1] : null;
+}
+
+// Diagnostic only, never a gate decision on its own. HOST_TAG_PREFIX above is
+// the closed allowlist that actually decides neutrality; this is deliberately
+// wider, so it also matches a name the allowlist has not been taught
+// (`<any-new-host-tag ...>`) and a human's own bracketed paste (`<TODO>`,
+// `<please keep working`). It exists so the enqueue branch below can NAME a
+// retraction's shape in closeGateStatus's `no-open` reason string, closing a
+// gap a codex cross-review named: nothing today tells a maintainer the
+// allowlist has gone stale, so a fourth host tag silently retracts real
+// closes until someone reads this corpus by hand and notices.
+const TAG_SHAPE_PREFIX = /^<([A-Za-z][\w-]*)(?:[\s>]|$)/;
+
+/**
+ * The tag name of a tag-shaped body whose name is NOT in HOST_TAG_NAMES, or
+ * null (no tag shape at all, or a registered one). This is the fail-closed
+ * judgment the enqueue branch runs FIRST, ahead of the close-phrase check:
+ * see that branch for why an unregistered tag must retract even when its body
+ * reads like a close.
+ *
+ * Deliberately not the negation of hostTagNameOf: that one requires `[\s>]`
+ * after the name, so a bare `<task-notification` (no bracket, nothing after)
+ * misses it. Matching TAG_SHAPE_PREFIX and then checking the NAME against the
+ * allowlist keeps such a body out of this retraction, leaving it to the same
+ * final `else` that already closed on it before this function existed.
+ */
+function unregisteredTagNameOf(text) {
+  const m = TAG_SHAPE_PREFIX.exec(typeof text === 'string' ? text.trim() : '');
+  if (!m) return null;
+  return HOST_TAG_NAMES.includes(m[1]) ? null : m[1];
+}
+
+// The fail-closed shape of this walk's return, built fresh on every call.
+// A shared module-level constant would hand every caller the same object, so
+// one caller stashing or mutating what it got back would reach into the next
+// call's answer. The three early returns below all use this so a caller
+// destructuring the two diagnostic fields gets `null`, not `undefined`, on
+// the paths that never walk a record (see this function's @returns).
+function closedGateResult() {
+  return {
+    open: false,
+    openedAtIndex: -1,
+    retractedByUnknownTagName: null,
+    neutralizedHostTagName: null,
+  };
 }
 
 export function walkCloseGate(transcriptPath) {
-  if (!transcriptPath) return { open: false, openedAtIndex: -1 };
+  if (!transcriptPath) return closedGateResult();
   let raw;
   try {
     raw = readFileSync(transcriptPath, 'utf-8');
   } catch {
-    return { open: false, openedAtIndex: -1 };
+    return closedGateResult();
   }
   // FATAL: a non-empty line that will not parse means the transcript is being
   // appended to (a half-written record) or is corrupt. Skipping it would let a
@@ -5128,7 +7004,7 @@ export function walkCloseGate(transcriptPath) {
     try {
       o = JSON.parse(line);
     } catch {
-      return { open: false, openedAtIndex: -1 };
+      return closedGateResult();
     }
     if (o === null || typeof o !== 'object') continue;
     recs.push(o);
@@ -5160,6 +7036,21 @@ export function walkCloseGate(transcriptPath) {
   const markedAskIds = new Set();
   let open = false;
   let openedAtIndex = -1;
+  // Names the tag-shaped queue item that most recently retracted a close (one
+  // NOT in HOST_TAG_NAMES, the only shape that still retracts), so
+  // closeGateStatus's `no-open` reason can surface it instead of leaving it as
+  // a fact only a transcript dump reveals. Cleared at every OTHER state change
+  // so it never survives past the retraction it explains; see the enqueue
+  // branch's final `else` for where it is set.
+  let retractedByUnknownTagName = null;
+  // Names a HOST_TAG_NAMES tag that most recently read as neutral, rather
+  // than a retraction, since the last event that opened the gate: the
+  // residual the enqueue-branch reversion above accepts. Reset to null by
+  // every `open = true` assignment below so it only ever describes the close
+  // currently in effect, never one already resolved by a later close phrase.
+  // Read once, at commit time, by crystallize-close-apply.mjs's warn-once
+  // path; see closeGateStatus for where it turns into a message.
+  let neutralizedHostTagName = null;
 
   for (let i = 0; i < recs.length; i++) {
     const o = recs[i];
@@ -5177,22 +7068,125 @@ export function walkCloseGate(transcriptPath) {
     // an NL queued command is handled by its queued_command attachment below.
     if (o.type === 'queue-operation') {
       if (o.operation === 'popAll') {
+        // Unconditional close, and that is deliberate. A 2026-09-17 attempt to
+        // read this branch's content the way the enqueue branch below does was
+        // reverted: the measurement behind it was truncated and wrong.
+        //
+        // What the corpus actually holds (~66 popAll records, live corpus so a
+        // snapshot): 0 have missing or empty content, 63 carry content identical
+        // to the preceding enqueue, 2 follow an enqueue with different content,
+        // 1 follows a `remove`. None start with a host tag, so a content check
+        // would change the outcome of exactly 0 of them while newly letting a
+        // user's own `<TODO> ...` paste through as neutral.
+        //
+        // The one record that looked machine-authored is worse than useless as
+        // evidence. Read untruncated it is 465 chars: this hook's own relayed
+        // notice with the USER'S question appended by the host after a blank
+        // line ("...back in sync.\n\n업데이트했는데 이렇게 에러 뜨는 이유는?").
+        // All 4 records carrying that relay prefix are such composites. Treating
+        // the prefix as proof of machine authorship reads a real retraction as
+        // neutral, which keeps a spent close alive and lets crystallize apply
+        // writes the user already took back. Condition-hit accuracy was 0 of 5.
+        //
+        // This channel cannot do better: a queue-operation record's keys are
+        // content/operation/sessionId/timestamp/type, with no origin and no
+        // promptSource, so there is nothing here that attests a producer. Until
+        // the host stamps one, popAll closes and the user re-confirms.
         open = false;
+        retractedByUnknownTagName = null; // a fully-understood close, no diagnostic needed
         continue;
       }
       if (o.operation !== 'enqueue') continue;
       const c = typeof o.content === 'string' ? o.content.trim() : '';
+      // Judged ahead of the branch chain so the fail-closed branch below can
+      // read it without running the regex twice.
+      const unregisteredTag = unregisteredTagNameOf(c);
       if (/^\/compact(?:\s|$)/.test(c)) {
         open = true; // a user compaction preserves the work → open
         openedAtIndex = i;
+        retractedByUnknownTagName = null;
+        neutralizedHostTagName = null;
       } else if (/^\/clear(?:\s|$)/.test(c)) {
         open = false; // abandons context → close
-      } else if (isModelCausedQueueContent(c)) {
-        /* model-caused / empty — neutral */
+        retractedByUnknownTagName = null;
+      } else if (!c) {
+        /* empty: neutral. Empty content names no producer in either
+           direction: there is no text to be a host tag, a close phrase, or a
+           person's own words, so this is one of the two cases the enqueue
+           branch grants for free; see the HOST_TAG_NAMES branch below for the
+           other. */
+      } else if (unregisteredTag) {
+        /* MAJOR fix (fail-closed): a tag-shaped body whose name is NOT in
+           HOST_TAG_NAMES retracts the close, and that judgment now runs
+           BEFORE the close-phrase branch below. It used to run after, in the
+           final `else`, which meant an unregistered tag whose body happened
+           to carry close wording (`<future-host>오늘은 여기까지 하자</future-host>`)
+           fell into the isClosePattern branch instead and did neither: it
+           left the previous close standing AND named nothing, so
+           closeGateStatus returned no warning on any of its three surfaces
+           and the apply that followed looked ordinary.
+
+           Fail-closed means the unknown shape is treated as the user's own
+           retraction until someone proves otherwise by registering the tag.
+           What that opens: a genuine host notification from a tag this build
+           has never heard of now costs the user one re-confirmation of their
+           close. The reason string names the tag so the fix (add it to
+           HOST_TAG_NAMES) is one edit away; see closeGateStatus's `no-open`
+           wording. */
+        retractedByUnknownTagName = unregisteredTag;
+        open = false;
       } else if (isClosePattern(c)) {
-        /* NL close via the queue — the open dequeue gap: the producer cannot be
-           attributed (a peer/model enqueue wears the same shape), so no open */
-      } else open = false; // a queued non-close user intent → close (change of mind)
+        /* NL close via the queue: the open dequeue gap. The producer cannot be
+           attributed (a peer/model enqueue wears the same shape), so no open.
+
+           Ordered AHEAD of the host-tag branch below on purpose. A body that
+           is both host-tag shaped and close worded must not open the gate off
+           a shape a person can paste, and this is the branch that refuses to
+           open; putting the host-tag branch first would change nothing about
+           that outcome but would spread the no-open reasoning over two
+           places. What the order did cost is a warning that never fired:
+           isClosePattern is an unanchored substring match, so a genuine host
+           notification whose body happens to carry close wording
+           (`<agent-message from="worker">오늘은 여기까지 진행했습니다</agent-message>`)
+           lands here rather than below, and left neutralizedHostTagName unset.
+           So name the tag here too. The gate decision is untouched (both
+           branches are no-ops on `open`); only the naming widens.
+
+           What that accepts: a real host notification with close-worded prose
+           now also raises the commit-time warning, which is a false alarm.
+           That is one line per apply, not the per-read nag the enqueue-branch
+           reversion note above was measured against, so the two costs are not
+           the same size, and the alternative (an anchored close match here)
+           would trade a false alarm for a missed one. */
+        const hostTag = hostTagNameOf(c);
+        if (hostTag) neutralizedHostTagName = hostTag;
+      } else if (isModelCausedQueueContent(c)) {
+        /* a body shaped like one of HOST_TAG_NAMES: neutral, the same filter
+           the queued_command attachment branch below applies to the same
+           host event on its other delivery shape. This branch has no
+           `origin` field, so a host tag's own shape is not PROOF of a host
+           producer, it only reflects what this corpus has actually produced
+           on this channel (see the doc comment above
+           isModelCausedQueueContent, and the enqueue-branch reversion note
+           right above it for why this reads neutral again rather than
+           closing). Name the tag so a caller can warn once, at commit time,
+           that this close survived a shape a person could also have pasted;
+           see neutralizedHostTagName's own doc comment above. */
+        // isModelCausedQueueContent above matched HOST_TAG_PREFIX on a body
+        // the empty-content branch has already excluded, so this is never
+        // null here; the guard only avoids clobbering a live value on a
+        // mismatch that should not occur.
+        const hostTag = hostTagNameOf(c);
+        if (hostTag) neutralizedHostTagName = hostTag;
+      } else {
+        // Every other non-empty, non-close, non-host-tag-shaped queued item
+        // → close (change of mind). Name the tag here, if there is one, so
+        // closeGateStatus's `no-open` reason can tell a maintainer which
+        // shape closed it: see this field's own doc comment above.
+        const tagShape = TAG_SHAPE_PREFIX.exec(c);
+        retractedByUnknownTagName = tagShape ? tagShape[1] : null;
+        open = false;
+      }
       continue;
     }
 
@@ -5201,14 +7195,25 @@ export function walkCloseGate(transcriptPath) {
     // `attachment` of type queued_command with the prompt verbatim). This opens
     // the gate ONLY with an audited human producer — origin.kind "human", present
     // on every 2.1.181+ user delivery (measured). A legacy origin-absent delivery
-    // cannot attest a producer, so it does not open (fail-closed). A NON-close
-    // queued command (e.g. "keep working") is a fresh user intent and CLOSES
-    // a prior open regardless of origin — that is what closes the re-close hole
-    // where a queued "continue" after a close leaves the stale open live. A
-    // task notification is not that: `modelCaused` below filters it out before
-    // this reaches the change-of-mind close, because the model, not the user,
-    // produced it. This delivery path used to skip that filter and let an
-    // unrelated background-task notification flip a just-opened gate shut.
+    // cannot attest a producer, so it does not open (fail-closed). Closing asks
+    // for the same proof: a NON-close queued command (e.g. "keep working") is a
+    // fresh user intent and retracts a prior open, but only with that same
+    // audited human producer. This branch used to close by default instead,
+    // on the theory that anything the model-caused list did not recognise had
+    // to be the user. That default is what let an unrelated background-task
+    // notification flip a just-opened gate shut, and every new machine-minted
+    // event would have needed its own line in that list to stay safe. Requiring
+    // a positive producer means an event this filter has never seen is neutral
+    // rather than hostile. `modelCaused` below still runs first, so a
+    // recognised notification never reaches either decision.
+    //
+    // The enqueue branch above does NOT share this rule: those records carry no
+    // `origin` at all, so requiring one would stop them closing anything. It
+    // keeps the old enumerate-the-machine default, and the re-close hole (a
+    // queued "continue" after a close leaving the stale open live) is closed
+    // there rather than here. The two delivery shapes of one user action are
+    // therefore judged differently on purpose; see the residual noted on the
+    // queue-operation branch.
     //
     // Scope of "both shapes classify alike": it holds for task notifications and
     // for empty content, which is what this fix is about. It does not hold for
@@ -5243,43 +7248,76 @@ export function walkCloseGate(transcriptPath) {
             ? (contentBlocksText(rawPrompt) ?? '')
             : '';
       const humanOrigin = !!(o.attachment.origin && o.attachment.origin.kind === 'human');
-      // The host labels these deliveries on the record itself, and that label is
-      // the authoritative one: every measured task-notification attachment
+      // The host labels these deliveries on the record itself, and that label
+      // is the authoritative one: every measured task-notification attachment
       // (1040 of 1040) carries commandMode 'task-notification'. Keying only on
       // the '<task-notification>' body prefix would leave the whole filter
       // resting on a string the host owns and can restyle, and a body that
-      // merely gains a line before the tag would slip past it. The queue-op
-      // branch above has no such field to read, so it keeps the body check
-      // alone; here both are available and both are used.
-      const modelCaused =
-        o.attachment.commandMode === 'task-notification' || isModelCausedQueueContent(prompt);
-      // The filter runs FIRST here, exactly as it does in the enqueue branch
-      // above. Order is load-bearing, not cosmetic: a notification body carries
-      // whatever text the finished task was named after, and isClosePattern
-      // matches on a substring ("wrap up", "오늘 여기까지" inside a <summary>
-      // both measure true). Testing isClosePattern first therefore lets a
-      // model-produced event reach the opener, where a human-origin delivery
-      // would set `open` and push `openedAtIndex` forward. That manufactures a
-      // close signal the user never gave, and moves the index the resolution
-      // comparison reads.
+      // merely gains a line before the tag would slip past it. It is checked
+      // first, ahead of `humanOrigin` too: it is the strongest signal this
+      // record has, host-stamped rather than read out of prose either side
+      // could shape.
+      const modelCaused = o.attachment.commandMode === 'task-notification';
+      // A codex cross-review on this exact branch found that a prior pass
+      // (meant to close a DIFFERENT major finding, an over-wide tag regex)
+      // left `humanOrigin` never winning here at all: `isModelCausedQueueContent`
+      // ran first for every case, so an audited human prompt that merely
+      // STARTS WITH one of the three known tag names (`<agent-message ...>`,
+      // `<cross-session-message ...>`) still read as neutral and a real
+      // change of mind was silently dropped. The old "0 of 1796 carry both"
+      // count was an observed-corpus fact, not a schema guarantee: a user
+      // can paste one of these three strings verbatim without any host
+      // change, so "it hasn't happened yet" was never a structural argument.
       //
-      // Reachability, so the next reader does not have to re-measure it: no
-      // recorded delivery hits that path. All 1040 task-notification
-      // attachments in the corpus arrive with no `origin`, so `humanOrigin` is
-      // false and the opener is skipped whichever order the two checks run in.
-      // This is a defensive pin against a host that starts stamping origin on
-      // them, not a repair of an observed failure.
+      // This branch closes that gap for the half of it that carries no new
+      // risk: a human origin paired with text that is NOT a close phrase
+      // always retracts, whatever the body looks like, because retracting is
+      // the safe direction (worst case: the user re-confirms a close they
+      // still want).
+      //
+      // It deliberately does NOT extend the same reordering to a close-phrase
+      // body: `isModelCausedQueueContent(prompt)` still runs, further down,
+      // before `isClosePattern` gets to open anything, exactly as the enqueue
+      // branch above does. A body that both matches a known tag shape AND a
+      // close phrase (a task-notification's own `<summary>` can legitimately
+      // say "wrap up") stays neutral there even with a stray human origin.
+      // That ordering is what `close-signals.test.mjs`'s "task-notification
+      // whose body matches a close pattern opens nothing" fixture pins, and
+      // it exists to stop a mislabeled host notification from manufacturing
+      // an open nobody asked for. Reordering that direction too would trade a
+      // same-severity gap (a dropped close) for a worse one (a granted close
+      // nobody typed), so it stays as it was.
       if (modelCaused) {
-        /* model-caused / empty: neutral, the same filter the enqueue branch
-           above applies to the same host event on its other delivery shape */
+        /* strongest signal, host-stamped: decided before either heuristic
+           below, and before humanOrigin gets a say */
+      } else if (humanOrigin && !isClosePattern(prompt)) {
+        open = false; // an audited human change of mind → close, whatever the body looks like
+        retractedByUnknownTagName = null;
+      } else if (isModelCausedQueueContent(prompt)) {
+        /* model-caused / empty, OR a human-origin close-phrase body that still
+           reads as one of the three known tag shapes (see the comment above):
+           neutral, the same filter the enqueue branch above applies to the
+           same host event on its other delivery shape */
       } else if (isClosePattern(prompt)) {
         if (humanOrigin) {
           open = true;
           openedAtIndex = i;
+          retractedByUnknownTagName = null;
+          neutralizedHostTagName = null;
         }
-      } else {
-        open = false;
+        /* else: no open, producer cannot be attributed */
       }
+      // else: not caught by the known-machine shapes above, not a close
+      // phrase, and no audited human producer either — a host event this
+      // filter does not yet recognize. The old rule closed here by default
+      // (anything not on the model-caused list must be the user), which is
+      // exactly the shape of bug #289 fixed for <task-notification>: a new
+      // kind of unattributed host event would silently retract a close the
+      // user already granted, and every future one would need its own line
+      // in isModelCausedQueueContent to avoid repeating that. Requiring a
+      // POSITIVE human producer to close, instead of enumerating every way to
+      // recognize a machine one, means an event this filter has never seen
+      // still cannot close the gate on its own.
       continue;
     }
 
@@ -5304,8 +7342,11 @@ export function walkCloseGate(transcriptPath) {
       if (isClosePattern(userText)) {
         open = true;
         openedAtIndex = i;
+        retractedByUnknownTagName = null;
+        neutralizedHostTagName = null;
       } else if (isCloseRetractionPattern(userText)) {
         open = false;
+        retractedByUnknownTagName = null;
       }
       continue;
     }
@@ -5356,14 +7397,17 @@ export function walkCloseGate(transcriptPath) {
         // rejection.
         if (sawDecline && markedAskIds.has(b.tool_use_id)) {
           open = false;
+          retractedByUnknownTagName = null;
         } else if (sawClose) {
           open = true;
           openedAtIndex = i;
+          retractedByUnknownTagName = null;
+          neutralizedHostTagName = null;
         }
       }
     }
   }
-  return { open, openedAtIndex };
+  return { open, openedAtIndex, retractedByUnknownTagName, neutralizedHostTagName };
 }
 
 /**