hypomnema 1.8.2 → 1.9.0

package/scripts/lib/crystallize-close-apply.mjs

@@ -2,19 +2,22 @@ import {
   existsSync,
   statSync,
   readFileSync,
-  writeFileSync,
   mkdirSync,
-  renameSync,
   openSync,
   writeSync,
   closeSync,
+  unlinkSync,
+  readdirSync,
 } from 'fs';
 import { join, dirname } from 'path';
 import { spawnSync } from 'child_process';
 import { fileURLToPath } from 'url';
+import { randomBytes, createHash } from 'crypto';
 import { expandHome } from './hypo-root.mjs';
+import { parseStrictDate } from './time.mjs';
 import { isValidProjectName, substituteTokens, TEMPLATE_DIR } from './project-create.mjs';
 import { appendPendingTags, checkForbidden } from './schema-vocab.mjs';
+import { atomicWrite } from '../../hooks/atomic-write.mjs';
 import {
   sessionCloseFileStatus,
   sessionCloseGlobalStatus,
@@ -36,22 +39,58 @@ import {
   withFileLock,
   resolveGateProjectOverride,
 } from '../../hooks/hypo-shared.mjs';
+import {
+  CERT_CHECKPOINT,
+  CERT_CLOSE_FILES,
+  RECEIPT_SCHEMA_VERSION,
+  invalidateCloseArtifacts,
+  receiptPath,
+  verifyEntriesInCommit,
+  writeReceiptAtomic,
+} from '../../hooks/close-receipt.mjs';
 import {
   hashContent,
   readBaseEntry,
-  advanceBase,
   readObservedHash,
   wasObservedTruncated,
+  readAppliedHash,
+  advanceBaseAndRecordApplied,
 } from '../../hooks/base-store.mjs';
-import { writeProposal } from '../../hooks/proposal-store.mjs';
+import {
+  writeProposal,
+  listProposalsChecked,
+  isValidSessionId,
+} from '../../hooks/proposal-store.mjs';
 import {
   recordGateClosed,
   resolutionStamp,
   closeGateStatus,
+  hostTagWarningWithUndo,
 } from '../../hooks/close-gate-store.mjs';
+import { readJournal, recordJournalEntry, clearJournal } from '../../hooks/close-journal.mjs';
 import { requireProjectDir } from './crystallize-close-gate.mjs';
 import { summarizeLintForOutput } from './crystallize-helpers.mjs';
 
+// Raw-byte sha256 of a string written to disk, hashed exactly the way
+// close-receipt.mjs's verifyEntriesInCommit hashes the committed blob (a
+// Buffer, never a decoded JS string): see that module's own comment on why
+// an overwrite/create proof entry is never trusted on a UTF-8 round trip.
+function bytesSha256(content) {
+  return createHash('sha256').update(Buffer.from(content, 'utf-8')).digest('hex');
+}
+
+// The commit this apply's marker phase just made (or confirmed already
+// clean), read under the SAME vault-commit lock the commit itself ran
+// inside, never a second, unlocked `git rev-parse HEAD` afterwards, which a
+// concurrent close landing in the gap could move out from under this read
+// (the commit a receipt certifies is `commitOutcome.sha`, or, when the commit
+// was a `scoped: 0` no-op, this locked HEAD read).
+function readHeadShaLocked(hypoDir) {
+  const res = spawnSync('git', ['-C', hypoDir, 'rev-parse', 'HEAD'], { encoding: 'utf-8' });
+  if (res.error || res.status !== 0) return null;
+  return (res.stdout || '').trim() || null;
+}
+
 // LINT_SCRIPT is resolved relative to this lib file rather than via
 // crystallize.mjs's own import.meta.url, so it keeps pointing at the sibling
 // scripts/lint.mjs — same absolute path either way.
@@ -90,12 +129,19 @@ function runLint(hypoDir) {
 }
 
 // ── session-close apply ────────────────────────────────────────────
-// Idempotent payload-driven application of the 5 mandatory session-close memory
+// Idempotent payload-driven application of the 4 mandatory session-close memory
 // files (+ optional open-questions). Used by the LLM session-close flow as the
 // canonical entrypoint instead of issuing 5+ Write tool calls by hand.
 //
+// The root pointer table (`hot.md`) used to be a fifth file here, composed by
+// hand into every payload. It is now a projection the SessionStart and Stop
+// hooks regenerate from `projects/*/hot.md`, so a close that wrote it would
+// only be overwritten by its own turn's Stop hook. It left the payload, the
+// overwrite set, and the base snapshot together; a payload that still carries
+// `rootHot` is reported, not applied (see `obsoleteFieldNotices`).
+//
 // Idempotency:
-//   • full-content fields (sessionState/projectHot/rootHot/openQuestions): write
+//   • full-content fields (sessionState/projectHot/openQuestions): write
 //     only when on-disk bytes differ — re-running with same payload is a no-op.
 //   • append fields (sessionLog/log): skip when the dated heading/entry is
 //     already present (regex shared with sessionCloseFileStatus via hypo-shared).
@@ -131,14 +177,12 @@ function readPayload(source) {
 // spinning the full 5s. Not a documented production knob.
 const APPEND_LOCK_TIMEOUT_MS = Number(process.env.HYPO_APPEND_LOCK_TIMEOUT_MS) || 5000;
 
-/** Atomic write via tmp+rename. `<path>.<pid>.<rand>.tmp` so concurrent helpers
- * don't fight over the same shared `<path>.tmp` slot. */
-function atomicWrite(path, content) {
-  mkdirSync(dirname(path), { recursive: true });
-  const tmp = `${path}.${process.pid}.${Math.random().toString(36).slice(2, 10)}.tmp`;
-  writeFileSync(tmp, content);
-  renameSync(tmp, path);
-}
+// atomicWrite is now the shared hooks/atomic-write.mjs implementation
+// (imported above). Six byte-identical copies of this function used to live
+// in hooks/ and scripts/lib/, and a fix landed in only two of them (#296).
+// this file was one of the four that kept the bug (a rename failure leaked
+// its tmp file forever, because the cleanup called `rmSync` without ever
+// importing it). See hooks/atomic-write.mjs's own doc comment.
 
 /**
  * Read a target's current bytes, distinguishing "absent" from "unreadable" the
@@ -178,40 +222,113 @@ function readTarget(path) {
  *   `null` when it was never shown anything current), plus whether the one
  *   shown-but-not-licensing case (a truncated injection) applies — used only
  *   to pick which park reason to report, never to license a write on its own.
+ * @param {string|null} appliedHash what THIS overwrite call itself last wrote
+ *   for this target, this session (base-store's `readAppliedHash`): narrower
+ *   than `entry.hash`, which also moves on a same-session hand edit
+ *   (`advanceBaseForWrite`) and so cannot by itself tell "nothing moved since
+ *   my own last apply" from "my own hand edit moved it and I re-observed my
+ *   own bytes as the new base".
+ * @param {string|null} payloadHash hash of the content THIS call is about to
+ *   write. Unused by the guard below (kept as a parameter for callers and
+ *   tests that already pass it, and because a future narrower predicate may
+ *   need it again): see the guard's own comment for why r5-w3 blocker 2
+ *   stopped comparing it to `appliedHash`.
  * @returns {string|null} a conflict reason, or null when this session may write
  */
-export function overwriteConflictReason(entry, disk, observed = { hash: null, truncated: false }) {
+export function overwriteConflictReason(
+  entry,
+  disk,
+  observed = { hash: null, truncated: false },
+  appliedHash = null,
+  payloadHash = null,
+) {
   // Cannot read what we are about to replace: fail safe, never assume unchanged.
   if (disk === undefined) return 'target-unreadable';
   const observedHash = observed && observed.hash;
   const observedTruncated = !!(observed && observed.truncated);
+  let reason;
   switch (entry.state) {
     case 'unknown':
-      // No snapshot for this (session, target). Someone else's edits could be
-      // sitting on disk and we would have no way to tell.
-      return 'base-unknown';
+      // No snapshot for this (session, target): someone else's edits could be
+      // sitting on disk with no way to tell, so this always parks. An earlier
+      // cut of this guard let a session's own touched-paths record
+      // (hooks/hypo-auto-stage.mjs) waive that park. It was removed
+      // 2026-09-11: hypo-auto-commit clears touched-paths.json at every Stop
+      // once a commit lands (even a no-op commit), so by the time a close
+      // reads it here it is empty in every real session that has crossed a
+      // Stop since its last Write/Edit — the escape never actually fired.
+      reason = 'base-unknown';
+      break;
     case 'absent':
       // We observed no file. Creating it is safe; finding one now means another
       // writer got there first, UNLESS this session was later shown exactly
       // those bytes by a resume/compact SessionStart.
-      if (disk === null) return null;
-      if (observedHash && observedHash === hashContent(disk)) return null;
-      return observedTruncated
-        ? 'base-mismatch-truncated-observation'
-        : 'base-absent-target-exists';
+      if (disk === null) {
+        reason = null;
+      } else if (observedHash && observedHash === hashContent(disk)) {
+        reason = null;
+      } else {
+        reason = observedTruncated
+          ? 'base-mismatch-truncated-observation'
+          : 'base-absent-target-exists';
+      }
+      break;
     case 'hash':
-      if (disk === null) return 'base-hash-target-missing';
-      if (hashContent(disk) === entry.hash) return null;
-      // Drifted from the original base — still allowed when this session was
-      // shown these exact drifted bytes by a later SessionStart. A truncated
-      // injection never reaches `observedHash` (readObservedHash refuses it),
-      // so it falls through here and gets its own reason instead of the plain
-      // `base-mismatch` a no-observation-at-all case reports.
-      if (observedHash && observedHash === hashContent(disk)) return null;
-      return observedTruncated ? 'base-mismatch-truncated-observation' : 'base-mismatch';
+      if (disk === null) {
+        reason = 'base-hash-target-missing';
+      } else if (hashContent(disk) === entry.hash) {
+        reason = null;
+      } else if (observedHash && observedHash === hashContent(disk)) {
+        // Drifted from the original base: still allowed when this session was
+        // shown these exact drifted bytes by a later SessionStart. A truncated
+        // injection never reaches `observedHash` (readObservedHash refuses it),
+        // so it falls through here and gets its own reason instead of the plain
+        // `base-mismatch` a no-observation-at-all case reports.
+        reason = null;
+      } else {
+        reason = observedTruncated ? 'base-mismatch-truncated-observation' : 'base-mismatch';
+      }
+      break;
     default:
-      return 'base-unknown';
+      reason = 'base-unknown';
   }
+  // `entry`/`disk` alone read this as clean whenever a same-session hand edit
+  // is what last advanced the base: that write IS this session's own, so it
+  // rightly does not park on its own account. But if THIS overwrite call
+  // previously applied different bytes and disk has since moved away from
+  // them (a hand edit landed AFTER that apply, with no new apply since), the
+  // caller is about to write OVER that edit with no proposal, no notice,
+  // nothing, whether or not the payload happens to be the exact old bytes.
+  //
+  // review r4-w4 major 1 narrowed this to `payloadHash === appliedHash` (only
+  // the exact stale reapply parks), so that a payload which folds the hand
+  // edit back in and adds a legitimate close on top would not also park.
+  // review r5-w3 blocker 2 found the hole that narrowing opened: this
+  // function cannot tell "folded the edit in" from "unrelated new bytes that
+  // still ignore the edit" from the hashes alone, so ANY payload change at
+  // all (including one that drops the edit entirely) passed the narrowed
+  // check just by being different from the old applied bytes. Comparing
+  // `payloadHash` here can only ever answer "is this the exact same payload
+  // as before", never "does this payload account for the edit", so it is
+  // dropped rather than replaced: there is no hash-only predicate between
+  // those two questions for a whole-file markdown overwrite (the same
+  // block-context problem the section-loss guard's own comment names above).
+  // Reverting to "any drift from appliedHash parks" is a straight tradeoff,
+  // not a fix without a cost: a close that DOES fold the edit in now also
+  // parks, and needs the same human approval
+  // (`hypomnema proposal challenge`/`proposal resolve`) as one that does not.
+  // That friction is accepted because the alternative (a hand edit silently
+  // discarded with no record it ever existed) is the worse failure for a
+  // guard whose whole purpose is not losing someone's edit.
+  if (
+    reason === null &&
+    typeof disk === 'string' &&
+    appliedHash &&
+    hashContent(disk) !== appliedHash
+  ) {
+    return 'will-overwrite-local-change';
+  }
+  return reason;
 }
 
 /**
@@ -251,7 +368,7 @@ function todayLocal() {
   return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;
 }
 
-// Spec §5.2.7 / §8.3: 4 mandatory + 2 optional (`log`, `openQuestions`).
+// Spec §5.2.7 / §8.3: 3 mandatory + 2 optional (`log`, `openQuestions`).
 // The payload shape MUST mirror that contract — missing a mandatory field is a
 // payload bug, not a no-op. Caller is the LLM session-close flow, which composes
 // the payload deliberately; partial payloads must fail loudly so caller fixes
@@ -262,7 +379,6 @@ function todayLocal() {
 const REQUIRED_PAYLOAD_FIELDS = [
   ['sessionState', 'content'],
   ['projectHot', 'content'],
-  ['rootHot', 'content'],
   ['sessionLog', 'entry'],
 ];
 
@@ -296,8 +412,14 @@ function validatePayloadShape(payload) {
       errs.push('payload.log, when present, must be { entry: string }');
     }
   }
-  if (payload.date !== undefined && !/^\d{4}-\d{2}-\d{2}$/.test(String(payload.date))) {
-    errs.push('payload.date, when present, must be YYYY-MM-DD');
+  // A format-only check reads `2026-09-31` as a valid YYYY-MM-DD literal, but
+  // there is no such day: `new Date('2026-09-31')` silently normalizes to
+  // October 1 instead of failing, so the old regex-only check would have
+  // let a calendar-overflow payload.date through to stamp a session-log
+  // heading and shard filename with a date that does not exist.
+  // parseStrictDate (lib/time.mjs) rejects that case too.
+  if (payload.date !== undefined && parseStrictDate(payload.date) == null) {
+    errs.push('payload.date, when present, must be a real calendar date in YYYY-MM-DD form');
   }
   if (
     payload.sessionId !== undefined &&
@@ -309,6 +431,218 @@ function validatePayloadShape(payload) {
   return errs;
 }
 
+// Payload fields this apply no longer applies. `rootHot` is the only one so far:
+// the root pointer table became a hook-generated projection of `projects/*/hot.md`,
+// so nothing composed by hand for it can survive the same turn's Stop hook.
+//
+// An installed copy that still carries the OLD `commands/crystallize.md` keeps
+// sending the field, and that payload must neither fail (the close is otherwise
+// correct, and refusing it would strand every not-yet-upgraded install) nor pass
+// in silence (the author believed a file got written). One reported line is the
+// middle: the close proceeds, and the reason the bytes are not on disk is in the
+// result where the author looks for it.
+//
+// @returns {string[]} one line per obsolete field present, empty when there is none
+function obsoleteFieldNotices(payload) {
+  if (!payload || typeof payload !== 'object') return [];
+  const out = [];
+  if (payload.rootHot !== undefined) {
+    out.push(
+      'payload.rootHot was ignored: the root hot.md pointer table is regenerated by the ' +
+        'SessionStart and Stop hooks from projects/*/hot.md, so close no longer writes it. ' +
+        'Drop the field from your payload.',
+    );
+  }
+  return out;
+}
+
+// `--mark-session-closed` has no payload, so it has no operation-supplied
+// expected bytes to prove against, only "a fresh version is committed"
+// (CERT_CLOSE_FILES, weaker than the apply path's CERT_CHECKPOINT). This confirms exactly that for one path: worktree,
+// index, and HEAD all agree (`git status --porcelain` empty means tracked,
+// nothing staged, nothing unstaged, nothing untracked at this path), then
+// hashes the disk bytes for the proof entry. `null` on anything else (dirty,
+// untracked, unreadable, or not a git repo at all): the caller's contract is
+// to treat that as "this target is not provably closed", never as "clean".
+function markCloseWorktreeProofEntry(hypoDir, relPath) {
+  const st = spawnSync('git', ['-C', hypoDir, 'status', '--porcelain', '--', relPath], {
+    encoding: 'utf-8',
+  });
+  if (st.error || st.status !== 0 || (st.stdout || '').trim() !== '') return null;
+  let content;
+  try {
+    content = readFileSync(join(hypoDir, relPath));
+  } catch {
+    return null;
+  }
+  return { path: relPath, kind: 'overwrite', expected: { bytesSha256: bytesSha256(content) } };
+}
+
+/**
+ * The certification proof for `--mark-session-closed`. `--log-only` needs
+ * only `log.md` committed fresh; a project mark needs, for EVERY project in
+ * `markerProjects`, session-state.md, hot.md, the exact session-log evidence
+ * file `sessionCloseFileStatus` accepted for freshness (never a different
+ * hybrid-cutover candidate), and log.md, all committed, not merely present.
+ * A project whose status is not ok, or that has no session-log evidence file
+ * to name, is incomplete: dropping the session-log target from the proof
+ * would certify a close whose session-log was never checked. One incomplete
+ * project withholds the WHOLE certification and names which project failed;
+ * this never partially certifies.
+ * @returns {{ok: boolean, entries: object[], incompleteProjects: string[]}}
+ */
+export function buildMarkCloseProof(hypoDir, markerProjects, logOnly) {
+  if (logOnly) {
+    const e = markCloseWorktreeProofEntry(hypoDir, 'log.md');
+    return e
+      ? { ok: true, entries: [e], incompleteProjects: [] }
+      : { ok: false, entries: [], incompleteProjects: ['(log-only)'] };
+  }
+  const byPath = new Map();
+  const incompleteProjects = [];
+  for (const p of markerProjects) {
+    const status = sessionCloseFileStatus(hypoDir, { projectOverride: p });
+    if (!status.ok || !status.sessionLogEvidence?.path) {
+      incompleteProjects.push(p);
+      continue;
+    }
+    const targets = [
+      join('projects', p, 'session-state.md'),
+      join('projects', p, 'hot.md'),
+      status.sessionLogEvidence.path,
+      'log.md',
+    ];
+    const projectEntries = [];
+    let projectOk = true;
+    for (const t of targets) {
+      const e = markCloseWorktreeProofEntry(hypoDir, t);
+      if (!e) {
+        projectOk = false;
+        break;
+      }
+      projectEntries.push(e);
+    }
+    if (!projectOk) {
+      incompleteProjects.push(p);
+      continue;
+    }
+    for (const e of projectEntries) byPath.set(e.path, e);
+  }
+  return {
+    ok: incompleteProjects.length === 0 && markerProjects.length > 0,
+    entries: [...byPath.values()],
+    incompleteProjects,
+  };
+}
+
+/**
+ * Take back the receipt at this session's path, but only if it is the one this
+ * close filed. A different `generation` on disk belongs to another close of the
+ * same session that landed in the meantime, and removing it would undo a close
+ * that did succeed. An absent file is left alone (nothing of ours to take back).
+ * A file that cannot be read or parsed is treated as ours: the rename that put
+ * it there is what made it unreadable to the re-read, and no other close writes
+ * a partial receipt (all writers are temp+rename).
+ * @returns {{ok: true, withdrawn: boolean} | {ok: false, reason: string}}
+ */
+export function withdrawOwnReceipt(hypoDir, sessionId, generation) {
+  const path = receiptPath(hypoDir, sessionId);
+  if (!path || !existsSync(path)) return { ok: true, withdrawn: false };
+  try {
+    const onDisk = JSON.parse(readFileSync(path, 'utf-8'));
+    if (typeof onDisk?.generation === 'string' && onDisk.generation !== generation) {
+      return { ok: true, withdrawn: false };
+    }
+  } catch {
+    // Unreadable or unparseable: fall through and withdraw.
+  }
+  const retracted = invalidateCloseArtifacts(hypoDir, sessionId);
+  return retracted.ok ? { ok: true, withdrawn: true } : { ok: false, reason: retracted.reason };
+}
+
+/**
+ * File the close checkpoint receipt, then the compat marker that projects it,
+ * and take the receipt back if the marker does not land. The two writers
+ * (`--apply-session-close` and `--mark-session-closed`) share this so they
+ * cannot disagree about what a half-landed close looks like.
+ *
+ * Why the take-back: a receipt that stays valid while the run reports the
+ * marker as not landed (exit 1, close signal unspent) splits the readers. A
+ * receipt-first Stop reads the session as closed, a marker-only reader reads
+ * it as open, and the operator who was told "not closed" is contradicted by
+ * the newer reader. Withdrawing the receipt makes "marker did not land" mean
+ * the same thing to every reader.
+ *
+ * `writeMarker` is injected so a test can make it fail deterministically. It
+ * returns truthy when it wrote; a throw counts as not written. Landing also
+ * requires the marker file to exist on disk: the writer says it wrote, the
+ * disk says it is there, and a leftover file from an earlier attempt satisfies
+ * neither on its own.
+ *
+ * A receipt write that reports failure after its rename (the re-read failed or
+ * did not match) may still have left this close's receipt on disk, and a
+ * transient re-read error would let it stand as valid with no marker. That
+ * branch takes the receipt back too, through `withdrawOwnReceipt`.
+ *
+ * @returns {{ok: true} |
+ *   {ok: false, reason: 'receipt-write-failed', writeReason: string, retractFailed?: string} |
+ *   {ok: false, reason: 'marker-did-not-land', retractFailed?: string}}
+ *   `retractFailed` is set only when withdrawing the receipt failed too, which
+ *   leaves a valid receipt behind a run that reports failure.
+ */
+export function landReceiptThenMarker(hypoDir, sessionId, receipt, writeMarker) {
+  const written = writeReceiptAtomic(hypoDir, sessionId, receipt);
+  if (!written.ok) {
+    // Only the re-read reasons mean the rename happened. 'write-failed' and
+    // 'invalid-session-id' never put this close's bytes at the path.
+    const withdrawal = written.reason.startsWith('reread-')
+      ? withdrawOwnReceipt(hypoDir, sessionId, receipt.generation)
+      : { ok: true };
+    return {
+      ok: false,
+      reason: 'receipt-write-failed',
+      writeReason: written.reason,
+      ...(withdrawal.ok ? {} : { retractFailed: withdrawal.reason }),
+    };
+  }
+  let wrote = false;
+  try {
+    wrote = !!writeMarker();
+  } catch {
+    // A writer that throws did not write. Same outcome as returning false.
+  }
+  if (wrote && existsSync(sessionClosedMarkerPath(hypoDir, sessionId))) return { ok: true };
+  const retracted = invalidateCloseArtifacts(hypoDir, sessionId);
+  return {
+    ok: false,
+    reason: 'marker-did-not-land',
+    ...(retracted.ok ? {} : { retractFailed: retracted.reason }),
+  };
+}
+
+// The commit a session's OLD close receipt certified, when that commit is no
+// longer an ancestor of HEAD (a `git reset --hard` or rebase dropped it).
+// Reads the receipt JSON itself instead of readReceiptStrict: that returns no
+// receipt object once the commit is unreachable, which is exactly this case.
+// A missing or unparsable file, a commit field that is not an object id, or a
+// repository git cannot resolve HEAD in all return null, so --mark keeps its
+// old behavior there.
+function priorReceiptCommitRewritten(hypoDir, sessionId) {
+  const path = receiptPath(hypoDir, sessionId);
+  if (!path || !existsSync(path)) return null;
+  let commit;
+  try {
+    commit = JSON.parse(readFileSync(path, 'utf-8'))?.commit;
+  } catch {
+    return null;
+  }
+  if (typeof commit !== 'string' || !/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i.test(commit)) return null;
+  const git = (...a) => spawnSync('git', ['-C', hypoDir, ...a], { encoding: 'utf-8' });
+  if (git('rev-parse', '--verify', '--quiet', 'HEAD').status !== 0) return null;
+  const ancestry = git('merge-base', '--is-ancestor', commit, 'HEAD');
+  return ancestry.error || ancestry.status === 0 ? null : commit;
+}
+
 // ── session-close marker (amendment 2026-05-19) ───────────────
 // Standalone marker writer. Used when the LLM closes the session via direct
 // Write tool calls (not --apply-session-close). Hook `hypo-auto-minimal-
@@ -337,14 +671,16 @@ export function runMarkSessionClosed(args) {
   // --log-only mark attributes to no project, so --project is moot there).
   if (args.project && !args.logOnly) requireProjectDir(args, args.project);
   // The per-session marker is the THIRD session-close completion
-  // signal (after the PreCompact gate and `--check-session-close`). It must use
-  // the SAME gate that governs /compact — precompactGateStatus — so the marker
-  // can never attest "closed" while /compact would still block. This subsumes
-  // the prior (sessionCloseGlobalStatus + hypoIsClean + scoped-lint) gate and
-  // additionally enforces feedback projection (over-cap/conflict), W8 design-
-  // history staleness, and root hot.md structure — the checks that the narrower
-  // marker gate skipped (the divergence behind this fix). git-clean is now a
-  // `git` blocker inside the gate. Pass --transcript-path to widen the lint
+  // signal (after the PreCompact gate and `--check-session-close`). It uses
+  // precompactGateStatus, the gate /compact uses, with one deliberate
+  // difference: `checkpointMode` (set below) replaces the git axis. /compact
+  // blocks on any uncommitted vault change, while the checkpoint blocks only
+  // on an uncommitted write THIS session still owns, so another session's
+  // dirty file can make /compact wait while this checkpoint still lands.
+  // Every other axis is the same, so the marker still enforces feedback
+  // projection (over-cap/conflict), W8 design-history staleness, and root
+  // hot.md structure, the checks the earlier narrower marker gate skipped.
+  // Pass --transcript-path to widen the lint
   // scope to this session's edited files exactly as the interactive hook does;
   // without it the scope is the mandatory close files only.
   // --log-only marks a non-project (tooling / wiki-only) session as
@@ -388,6 +724,51 @@ export function runMarkSessionClosed(args) {
           sessionCwd: args.sessionCwd || null,
         })
       : null;
+  // --mark invalidates right at its own gate call (there is no payload or
+  // preflight to race, unlike the apply path's authority check). A prior
+  // receipt/marker for THIS session must not keep certifying a close once a
+  // fresh `--mark-session-closed` is attempted, whether or not this attempt
+  // goes on to succeed.
+  // The one exception is a prior receipt whose commit history no longer
+  // contains (reset/rebase): invalidating it and certifying today's other
+  // close files would report "closed" while the original close record is gone.
+  // Refuse before anything is touched so the old receipt stays as evidence.
+  const rewritten = priorReceiptCommitRewritten(args.hypoDir, args.sessionId);
+  if (rewritten) {
+    const msg =
+      `--mark-session-closed refused: the commit this session's earlier close proved ` +
+      `(${rewritten}) is no longer in the branch history. Restore that commit, or ask the ` +
+      `user to close again and run --apply-session-close with a new payload.`;
+    console.log(
+      args.json
+        ? JSON.stringify(
+            {
+              ok: false,
+              session_id: args.sessionId,
+              reason: 'prior-checkpoint-rewritten',
+              prior_commit: rewritten,
+              error: msg,
+            },
+            null,
+            2,
+          )
+        : `✗ ${msg}`,
+    );
+    process.exit(1);
+  }
+  const invalidated = invalidateCloseArtifacts(args.hypoDir, args.sessionId);
+  if (!invalidated.ok) {
+    const msg =
+      `--mark-session-closed refused before the gate ran: could not invalidate this session's ` +
+      `prior close receipt/marker (${invalidated.reason}). Fix the underlying problem (usually a ` +
+      `permission or disk issue under .cache/) and retry.`;
+    console.log(
+      args.json
+        ? JSON.stringify({ ok: false, session_id: args.sessionId, error: msg }, null, 2)
+        : `✗ ${msg}`,
+    );
+    process.exit(1);
+  }
   const gate = precompactGateStatus(args.hypoDir, {
     ...(args.project && !args.logOnly ? { closeScope: [args.project] } : {}),
     ...(closeTranscript ? { transcriptPath: closeTranscript } : {}),
@@ -396,6 +777,11 @@ export function runMarkSessionClosed(args) {
     // session's cwd project has an unstarted close. logOnly exempts it in-gate.
     ...(args.sessionCwd ? { sessionCwd: args.sessionCwd } : {}),
     ...(attributionScope ? { attributionScope } : {}),
+    // One of the two marker-writing paths, which must share ONE `ok`
+    // invariant with the apply path's own marker phase (see that call
+    // site's identical comment).
+    checkpointMode: true,
+    sessionId: args.sessionId,
   });
   const status = gate.close;
   if (!gate.ok) {
@@ -424,18 +810,59 @@ export function runMarkSessionClosed(args) {
   // /compact, or an AskUserQuestion close answer). This is the hard backstop for
   // model over-close, where prose guidance lost to a conflicting global rule.
   // Fail-closed when the transcript can't be resolved.
+  // One call, read by BOTH paths below. It used to sit inside the refusal
+  // branch, which left the success path with no way to see a hostTagWarning at
+  // all: a close that survived a pasted host tag wrote its marker, unblocked
+  // the Stop chain, and said nothing, on the one entry point a model reaches
+  // after closing by hand. Hoisting changes no gate decision: the decision
+  // below still reads the raw `isCloseGateOpen` boolean per this file's
+  // "runMarkSessionClosed stays on isCloseGateOpen" contract, and this result
+  // is only ever read for its two strings. `null` when there is no transcript
+  // to read either from.
+  const gateStatus = closeTranscript
+    ? closeGateStatus({
+        transcriptPath: closeTranscript,
+        hypoDir: args.hypoDir,
+        sessionId: args.sessionId,
+      })
+    : null;
+  // This path writes one thing, the marker, and makes no commit, so the undo
+  // it offers is the marker alone. A revert instruction here would point at
+  // something this run never created. No 5th argument: kind 'marker-only'
+  // never reads commitSha (its message names only the marker file, see
+  // hostTagWarningWithUndo's own `undo` table), and this call site made no
+  // commit at all to report one for, so leaving it `undefined` here is the
+  // honest answer, not a shortcut.
+  const hostTagWarning = hostTagWarningWithUndo(
+    gateStatus?.hostTagWarning,
+    'marker-only',
+    args.hypoDir,
+    args.sessionId,
+  );
   if (!closeTranscript || !isCloseGateOpen(closeTranscript)) {
     const reason = !closeTranscript
       ? `cannot resolve a transcript for session ${args.sessionId} — the session-closed marker requires a verifiable user close signal`
       : "no user close signal in this session's transcript — marker refused (the user did not signal session close)";
+    // This path used to collapse straight to the bare `no-user-close-signal`
+    // string, so a stale HOST_TAG_NAMES allowlist was invisible here even
+    // though verifyCloseAuthority's own refusal (the apply path, before any
+    // write) already surfaces it via `gateReason`. Reusing that same field
+    // name and the same source (closeGateStatus, hoisted above) closes the
+    // gap. `null` when there is no transcript to read one from at all.
+    const gateReason = gateStatus?.reason ?? null;
     const result = {
       ok: false,
       session_id: args.sessionId,
       project: status.project,
       skipReason: 'no-user-close-signal',
+      ...(gateReason ? { gateReason } : {}),
       error: reason,
     };
-    console.log(args.json ? JSON.stringify(result, null, 2) : `✗ ${reason}`);
+    console.log(
+      args.json
+        ? JSON.stringify(result, null, 2)
+        : `✗ ${reason}${gateReason ? `\nGate detail: ${gateReason}` : ''}`,
+    );
     process.exit(1);
   }
   // Marker attribution comes from EVIDENCE, never from the gate's global
@@ -492,21 +919,105 @@ export function runMarkSessionClosed(args) {
   const verifiedScope = args.logOnly
     ? { kind: 'log-only' }
     : { kind: 'global', projects: evaluatedProjects };
-  writeSessionClosedMarker(args.hypoDir, args.sessionId, {
-    project: markerProject,
-    projects: args.logOnly ? [] : markerProjects,
-    ...(args.logOnly ? { scope: 'log-only' } : {}),
-    verifiedScope,
-  });
-  // Marker writer swallows IO errors (best-effort, see hypo-shared.mjs). Verify
-  // the file actually landed before claiming success — otherwise CLI exits 0
-  // while next Stop re-blocks, hiding a permission/disk problem.
-  // Codex Worker-2 CONCERN (pre-commit review).
-  if (!existsSync(sessionClosedMarkerPath(args.hypoDir, args.sessionId))) {
-    const err = 'marker file did not land after write (likely .cache permission/disk issue)';
+  // Build and verify the CERT_CLOSE_FILES proof, read the C this proof is
+  // verified against, and land the receipt and its marker, all inside the
+  // vault-commit lock, the same lock the apply path's own commit step holds,
+  // so a concurrent close cannot land a commit in the gap between this
+  // proof's worktree reads and the HEAD this call certifies against.
+  // A lock timeout is contention, not a crash: it gets the same JSON and
+  // exit 1 as every other refusal here (the apply path maps the same timeout
+  // to commit-failed). Any other throw is a real fault and still propagates.
+  let receiptResult;
+  try {
+    receiptResult = withFileLock(vaultCommitLockTarget(args.hypoDir), () => {
+      const proof = buildMarkCloseProof(args.hypoDir, markerProjects, args.logOnly);
+      if (!proof.ok)
+        return { ok: false, reason: 'incomplete', incompleteProjects: proof.incompleteProjects };
+      const head = readHeadShaLocked(args.hypoDir);
+      const repo = head ? repoIdentity(args.hypoDir) : null;
+      if (!head || !repo) return { ok: false, reason: 'no-commit-identity' };
+      const verify = verifyEntriesInCommit(args.hypoDir, head, proof.entries);
+      if (!verify.ok) return { ok: false, reason: 'mismatch', mismatches: verify.mismatches };
+      const generation = randomBytes(16).toString('hex');
+      const receipt = {
+        schemaVersion: RECEIPT_SCHEMA_VERSION,
+        certification: CERT_CLOSE_FILES,
+        generation,
+        sessionId: args.sessionId,
+        repo,
+        commit: head,
+        scope: args.logOnly
+          ? { mode: 'log-only', projects: [] }
+          : { mode: 'project', projects: markerProjects },
+        entries: proof.entries,
+        skipped: gate.skipped || { lint: false, feedback: false },
+        createdAt: new Date().toISOString(),
+      };
+      const landed = landReceiptThenMarker(args.hypoDir, args.sessionId, receipt, () =>
+        writeSessionClosedMarker(args.hypoDir, args.sessionId, {
+          project: markerProject,
+          projects: args.logOnly ? [] : markerProjects,
+          ...(args.logOnly ? { scope: 'log-only' } : {}),
+          verifiedScope,
+          // Same residual the console line below reports, kept in the marker so a
+          // reader auditing this close later sees the same thing the operator saw
+          // at the time. The apply path stamps its own marker the same way.
+          ...(hostTagWarning ? { hostTagWarning } : {}),
+          // Names the receipt this marker projects. See writeSessionClosedMarker's
+          // own doc comment for what a new Stop does with this field.
+          receiptGeneration: generation,
+        }),
+      );
+      if (landed.ok) return { ok: true };
+      return landed.reason === 'receipt-write-failed'
+        ? {
+            ok: false,
+            reason: 'write-failed',
+            writeReason: landed.writeReason,
+            ...(landed.retractFailed ? { retractFailed: landed.retractFailed } : {}),
+          }
+        : {
+            ok: false,
+            reason: 'marker-did-not-land',
+            ...(landed.retractFailed ? { retractFailed: landed.retractFailed } : {}),
+          };
+    });
+  } catch (e) {
+    if (e?.code !== 'ELOCKTIMEOUT') throw e;
+    receiptResult = { ok: false, reason: 'vault-commit-lock-timeout' };
+  }
+  if (!receiptResult.ok) {
+    const detail =
+      receiptResult.reason === 'incomplete'
+        ? `incomplete for project(s): ${receiptResult.incompleteProjects.join(', ')} (session-state.md, hot.md, the session-log evidence file, and log.md must all be committed, not merely present)`
+        : receiptResult.reason === 'mismatch'
+          ? `proof mismatch: ${JSON.stringify(receiptResult.mismatches)}`
+          : receiptResult.reason === 'write-failed'
+            ? `receipt write failed: ${receiptResult.writeReason}` +
+              (receiptResult.retractFailed
+                ? `; withdrawing what it may have left failed too (${receiptResult.retractFailed}), so a stale receipt may remain`
+                : '')
+            : receiptResult.reason === 'vault-commit-lock-timeout'
+              ? 'another close or commit held the vault-commit lock past the timeout; re-run shortly'
+              : 'no commit identity (not a git repository, or no commit exists yet)';
+    // A marker that did not land after a certified receipt keeps its own
+    // wording: it is a disk problem under .cache/, not a proof problem, and the
+    // receipt filed for it has already been withdrawn.
+    const err =
+      receiptResult.reason === 'marker-did-not-land'
+        ? 'marker file did not land after write (likely .cache permission/disk issue); ' +
+          'the close checkpoint receipt filed for it was withdrawn' +
+          (receiptResult.retractFailed
+            ? `, but withdrawing it failed (${receiptResult.retractFailed}), so a stale receipt may remain`
+            : '')
+        : `session-close checkpoint could not be certified, marker not written (${detail})`;
     console.log(
       args.json
-        ? JSON.stringify({ ok: false, session_id: args.sessionId, error: err }, null, 2)
+        ? JSON.stringify(
+            { ok: false, session_id: args.sessionId, error: err, ...receiptResult },
+            null,
+            2,
+          )
         : `✗ ${err}`,
     );
     process.exit(1);
@@ -518,6 +1029,10 @@ export function runMarkSessionClosed(args) {
     scope: args.logOnly ? 'log-only' : 'project',
     date: status.dates[0],
     notices: gate.notices,
+    // The close-time residual, on the success path this entry point owns.
+    // Present exactly when closeGateStatus named a neutralized host tag, and
+    // carrying the marker-only undo (no commit exists on this path).
+    ...(hostTagWarning ? { hostTagWarning } : {}),
     // pure feedback-projection drift is a non-blocker: the marker
     // attests "compact-ready (no human-fixable blocker)", and the PreCompact
     // hook self-heals the projection (feedback-sync --write) at /compact. Surface
@@ -537,6 +1052,10 @@ export function runMarkSessionClosed(args) {
         `  · feedback projection drift (${gate.driftTargets.join(', ')}) — will self-heal at /compact.`,
       );
     }
+    // Once per run, next to the marker this run just wrote. The apply path
+    // prints the same string next to its own commit; both read one value
+    // computed once per run, so neither repeats on a later gate read.
+    if (hostTagWarning) console.log(`\n⚠ ${hostTagWarning}`);
   }
   process.exit(0);
 }
@@ -602,6 +1121,40 @@ export function closeResultContradiction({ ok, markerWritten, markerSkipReason }
   return null;
 }
 
+// A withheld marker with a legitimate reason is not, by itself, a
+// reason to fail the apply. Most of planMarkerDecision's skip branches
+// (compact-gate-not-ok, no-user-close-signal, transcript-unresolved,
+// commit-failed) name a condition THIS SAME SESSION can clear and retry,
+// see the "a marker withheld by a real vault-commit failure leaves the close
+// signal unspent for a retry" test, whose whole point is that ok stays true
+// there and the close signal is not burned. Forcing ok:false on every one of
+// those would resurrect that exact regression's failure mode from the other
+// direction.
+//
+// 'marker-did-not-land' is not one of those. runMarkerPhase only reaches it
+// after `planMarkerDecision` has already returned `write: true`, meaning the
+// compact gate passed, a user close signal was present, and the commit
+// landed. Every precondition `--mark-session-closed` also requires before
+// writing the SAME marker was already satisfied here; the only thing that
+// then failed is the write itself (a `.cache` permission/disk issue), which
+// `--mark-session-closed` already treats as fatal (exit 1). Before this
+// check, `--apply-session-close` was the one entry point that swallowed that
+// exact failure as ok:true. The same failure landing on two different exit
+// codes depending on which command hit it.
+export function markerWriteGenuinelyFailed({ markerWritten, markerSkipReason }) {
+  // The two new receipt-stage skip reasons are exactly as fatal
+  // as 'marker-did-not-land': every precondition cleared (gate, commit,
+  // user signal) and the close still could not certify itself. A caller
+  // reading only `$?` must see this as unclosed, same as a marker write
+  // that never landed.
+  return (
+    markerWritten !== true &&
+    (markerSkipReason === 'marker-did-not-land' ||
+      markerSkipReason === 'receipt-proof-mismatch' ||
+      markerSkipReason === 'receipt-write-failed')
+  );
+}
+
 // What the model should do when the close is refused. Deliberately does NOT name
 // a flag: the way out of this gate cannot be an argument the model can add, or
 // the gate is decorative. The way out is the user, which is the one input the
@@ -629,7 +1182,11 @@ const CLOSE_REFUSAL_HELP = [
  * model cannot author: the user's own words are in it, and nothing the model says
  * counts (extractUserMessages drops injected, tool, and hook-feedback text).
  *
- *   { ok: true }
+ *   { ok: true, hostTagWarning? }   `hostTagWarning` is present only when
+ *     closeGateStatus reported one: this close survived a HOST_TAG_NAMES-shaped
+ *     queue item reading as neutral rather than a retraction (see that field's
+ *     own doc comment). Threaded through by the caller so it is surfaced once,
+ *     at commit time, rather than guessed against on every gate read.
  *   { ok: false, reason, error, gateReason? }   reason: session-id-required |
  *     transcript-unresolved | no-user-close-signal. `gateReason` is only present
  *     when `reason` is `no-user-close-signal`, and carries closeGateStatus's own
@@ -678,7 +1235,10 @@ function verifyCloseAuthority(sessionId, hypoDir) {
         `Gate detail: ${gateStatus.reason}`,
     };
   }
-  return { ok: true };
+  return {
+    ok: true,
+    ...(gateStatus.hostTagWarning ? { hostTagWarning: gateStatus.hostTagWarning } : {}),
+  };
 }
 
 // A-1 (project index lifecycle): seed projects/<project>/index.md from the
@@ -719,7 +1279,15 @@ function verifyCloseAuthority(sessionId, hypoDir) {
 // atomicWrite's use case (replacing bytes a reader might already be mid-read
 // of), a `wx` create can never observably tear — the file either doesn't
 // exist yet (nothing to tear) or the open fails outright.
-export function ensureProjectIndex(hypoDir, project, relPath, today) {
+// `sessionId` (optional, added for the close journal) records this create in
+// hooks/close-journal.mjs immediately after the bytes land, so a retry of the
+// SAME close that finds index.md already present (applyOverwrites' retry
+// branch) can tell "I created this and it is still exactly what I left it"
+// apart from a hand edit. Omitted entirely by callers outside a close
+// (tests/crystallize-apply.test.mjs's race-condition check), where there is
+// no session to journal against and recordJournalEntry's own `!sessionId`
+// guard makes the call a no-op.
+export function ensureProjectIndex(hypoDir, project, relPath, today, sessionId) {
   const dest = join(hypoDir, relPath);
   const src = join(TEMPLATE_DIR, 'index.md');
   if (!existsSync(src)) return null; // template missing — nothing to scaffold from
@@ -742,6 +1310,7 @@ export function ensureProjectIndex(hypoDir, project, relPath, today) {
   } finally {
     closeSync(fd);
   }
+  recordJournalEntry(hypoDir, sessionId, relPath, hashContent(content));
   return relPath;
 }
 
@@ -777,7 +1346,11 @@ export function ensureProjectIndex(hypoDir, project, relPath, today) {
 //
 // Refuses in place (console.log + process.exit(1)) instead of returning a
 // verdict: process.exit never returns, so the caller's flow stops exactly where
-// it stopped before this section was a function of its own.
+// it stopped before this section was a function of its own. On success it
+// returns `hostTagWarning` (string, or null) instead of exiting, so the
+// caller can carry it through the rest of this apply and surface it exactly
+// once, alongside the commit it is now about to make, rather than here
+// before anything has actually happened yet.
 function refuseUnlessCloseRequested(args) {
   const closeAuth = args.payload
     ? verifyCloseAuthority(args.sessionId, args.hypoDir)
@@ -804,6 +1377,32 @@ function refuseUnlessCloseRequested(args) {
     );
     process.exit(1);
   }
+  // Invalidate this session's prior close receipt and compat marker the
+  // moment a NEW close is authorized, before payload validation or preflight,
+  // not later at writeCloseIntent. A close authorized now that later fails preflight must not leave a stale
+  // "closed" proof standing for Stop to trust; the user asked to close again,
+  // so the old proof is spent the instant that request is accepted, whether
+  // or not this particular attempt goes on to succeed. `--mark-session-closed`
+  // invalidates at its own gate call instead (no payload/preflight to race).
+  if (args.payload && args.sessionId) {
+    const invalidated = invalidateCloseArtifacts(args.hypoDir, args.sessionId);
+    if (!invalidated.ok) {
+      const msg =
+        `session-close apply refused before any wiki write or commit: could not invalidate ` +
+        `this session's prior close receipt/marker (${invalidated.reason}). Fix the underlying ` +
+        `problem (usually a permission or disk issue under .cache/) and retry; nothing was written.`;
+      const out = {
+        ok: false,
+        stage: 'invalidate-failed',
+        error: msg,
+        applied: [],
+        committed: null,
+      };
+      console.log(args.json ? JSON.stringify(out, null, 2) : `✗ ${msg}`);
+      process.exit(1);
+    }
+  }
+  return closeAuth.hostTagWarning || null;
 }
 
 // Read the payload, check its shape, and bind it to THIS session. Exits 1 on any
@@ -1002,7 +1601,6 @@ function runPreflight(args, payload, project, date) {
   const overwriteTargets = new Set();
   if (payload.sessionState) overwriteTargets.add(join('projects', project, 'session-state.md'));
   if (payload.projectHot) overwriteTargets.add(join('projects', project, 'hot.md'));
-  if (payload.rootHot) overwriteTargets.add('hot.md');
   if (payload.openQuestions) overwriteTargets.add(join('pages', 'open-questions.md'));
 
   // Bug B: the documented close path must not be blocked by lint debt OUTSIDE
@@ -1102,6 +1700,200 @@ function runPreflight(args, payload, project, date) {
   return { preflightLint, payloadScope, indexRelPath, indexMissing };
 }
 
+// ── section-loss guard (2026-08-10 incident) ────────────────────────────────
+//
+// The base-store guard above answers "did someone ELSE change this page since
+// I looked at it". It cannot answer "did the payload I am about to write throw
+// away structure that was already here" — a session that legitimately observed
+// its own prior base (no drift, no conflict) can still overwrite a multi-track
+// session-state.md or hot.md with a payload that only carries the ONE track it
+// was working on, silently dropping the others. That is exactly what happened
+// to security-backoffice: three tracks, two of them vanished, and the base
+// guard had nothing to say about it because it was never a conflict in the
+// guard's sense — it was a normal, unopposed overwrite.
+//
+// This is deliberately a COUNT of `##` headings that vanish between disk and
+// payload, not a markdown-aware diff. The block-parser lesson from the base
+// guard above applies here too: a predicate that reads content and claims to
+// know what was "provably" preserved is the thing four review rounds already
+// broke. Counting exact-line survival is cheap, has no false negatives worth
+// chasing (a heading either survives verbatim or it does not), and its one
+// failure mode (a legitimately reworded heading reads as "lost") is exactly
+// what the escape hatch below is for.
+// A ratio floor alone gets LOOSER as a file grows, exactly backwards from what
+// this guard is for: a file running more tracks in parallel is bigger (a bigger
+// denominator), and that is the one where losing a fixed handful of sections
+// should trip sooner, not later. A distribution was counted against the real
+// vault on 2026-09-11 with `grep -c '^## ' <file>` (every LINE starting with
+// `## `, duplicates included) against every hot.md / session-state.md /
+// open-questions.md: project hot.md ran 4-9 such lines (harness's was 9),
+// project session-state.md ran 1-12 (harness's was 12), pages/open-questions.md
+// had 8, root hot.md had 2. That is a different measurement than this guard's
+// own denominator: `h2Headings` below dedupes into a `Set`, so a file that
+// repeats one `## ` heading verbatim reports a smaller count here than the grep
+// tally did. The two agree on every file this repo actually has (none repeats a
+// heading), but the grep number is not proof of what `h2Headings` counts.
+//
+// At a ratio-only gate, losing 4 of a real 12-section session-state.md
+// (4/12 = 0.333) or 3 of a real 9-section hot.md (3/9 = 0.333) both stayed just
+// under a 0.34 floor and passed through untouched — real files, real sizes, a
+// real miss. An absolute floor was added so a bigger file could not buy a bigger
+// free pass just by being bigger, but the first cut of that floor (3) missed the
+// shape it was named for: the security-backoffice incident itself lost 2 of 3
+// tracks, and 2 lost sections clears neither a 3-floor nor, on a 6-12 section
+// file, the 0.34 ratio (2/12 = 0.167). So the floor is 2, matching
+// SECTION_LOSS_MIN_COUNT below — and once the two are equal, the ratio branch
+// can no longer change the outcome: past the MIN_COUNT guard, `lost.length` is
+// always >= 2, which trips the absolute floor unconditionally, so
+// `!ratioTrips && !absTrips` can never be true. The two thresholds and the ratio
+// check that used to sit between them are folded into the one count check below
+// rather than kept as a branch that reads as live but never decides anything.
+const SECTION_LOSS_MIN_COUNT = 2; // an ordinary single-section edit (finishing one track,
+// retiring one open question) stays under this and must not park; 2 or more is
+// the incident's own shape and always trips, at any file size.
+
+// A fence marker line: 0-3 leading spaces (CommonMark still calls that "unindented"),
+// then a run of 3+ backticks or 3+ tildes, then the rest of the line. `m[1]` is the
+// marker run itself (so its first char and length identify what closes it); `m[2]` is
+// whatever follows, an info string on the opening line, and required to be blank
+// (after trim) on a line being checked as a close.
+const FENCE_RE = /^ {0,3}(`{3,}|~{3,})(.*)$/;
+
+/**
+ * Which line indices are inside a fenced code block, for one file's lines.
+ *
+ * A fence opens on any line FENCE_RE matches while not already inside one, and
+ * closes only on a later line whose marker is the SAME character and AT LEAST as
+ * long (a 4-backtick open is not closed by 3 backticks, a CommonMark rule, and the
+ * one this guard's predecessor ignored: the section-loss bypass this closes moved
+ * two `##` headings into a properly-closed ```md fence and the old line-scan still
+ * counted them as real headings because it never looked for a fence at all).
+ *
+ * An opening fence that never finds a matching close before EOF is treated as
+ * NEVER HAVING OPENED (every line from that marker to EOF is unhidden here). That
+ * is the safe direction for a guard whose entire job is "did content silently
+ * disappear": the same function extracts headings from both disk and payload, so
+ * treating an unclosed run as fenced would let it swallow real headings on
+ * whichever side has the malformed markdown: undercounting disk (hiding sections
+ * the guard should have protected) or undercounting payload (reporting a section
+ * as lost when the payload never actually removed it). Treating it as prose
+ * instead only risks the opposite: an occasional false park on a document with a
+ * genuinely broken fence, which is recoverable through the same
+ * `restructure: true` / proposal-resolve door every other park in this guard
+ * already uses, not a silent loss.
+ *
+ * Declined on purpose, not CommonMark-complete: an opening line's info string is
+ * never checked for a stray backtick (CommonMark forbids one in a backtick fence's
+ * info string; this scan does not care), and a fence inside a blockquote or list
+ * item is scanned exactly like a top-level one. Both would need block-context
+ * tracking this guard's own doc comment (above, the base-conflict guard section)
+ * already argues against building here. Getting the two reproduced bypasses closed
+ * cheaply matters more than a complete parser.
+ *
+ * @returns {boolean[]} same length as `lines`, true where the line is fenced
+ */
+function fencedLineMask(lines) {
+  const hidden = new Array(lines.length).fill(false);
+  let openIdx = -1;
+  let fenceChar = null;
+  let fenceLen = 0;
+  for (let i = 0; i < lines.length; i++) {
+    if (openIdx === -1) {
+      const m = lines[i].match(FENCE_RE);
+      if (m) {
+        openIdx = i;
+        fenceChar = m[1][0];
+        fenceLen = m[1].length;
+        hidden[i] = true; // tentative, unhidden below if this never closes
+      }
+      continue;
+    }
+    hidden[i] = true; // tentative, unhidden below if this never closes
+    const m = lines[i].match(FENCE_RE);
+    if (m && m[1][0] === fenceChar && m[1].length >= fenceLen && m[2].trim() === '') {
+      openIdx = -1;
+      fenceChar = null;
+      fenceLen = 0;
+    }
+  }
+  if (openIdx !== -1) {
+    for (let i = openIdx; i < lines.length; i++) hidden[i] = false;
+  }
+  return hidden;
+}
+
+/**
+ * Extract this file's `##` section headings, in order, as a MULTISET (every
+ * occurrence kept, none deduped) with fenced-code lines excluded. Only `##`
+ * (not `#`/`###`), the granularity the section-loss incident was measured at.
+ *
+ * Multiset, not a `Set`, because a dedup here silently halves the denominator
+ * a file that legitimately repeats one `## ` heading twice: the old `Set`-based
+ * version counted "## TODO" appearing twice on disk as ONE section, so a
+ * payload that kept only one copy compared as "the heading is still present"
+ * with nothing lost at all: the second bypass this pass closes.
+ *
+ * Known limit, left as-is (see fencedLineMask's own doc comment for the fuller
+ * case against building a real parser here): this still reads every non-fenced
+ * line as prose, so a `## ` line inside an indented (non-fenced) code block, a
+ * blockquote, or a list item is still counted as a real heading. That is a
+ * false positive (an occasional unnecessary park), not the silent-loss failure
+ * mode this guard exists to close, so it is accepted rather than fixed here.
+ * @returns {string[]}
+ */
+function h2Headings(content) {
+  const lines = (content || '').split(/\r?\n/);
+  const hidden = fencedLineMask(lines);
+  const out = [];
+  for (let i = 0; i < lines.length; i++) {
+    if (!hidden[i] && /^##\s+\S/.test(lines[i])) out.push(lines[i]);
+  }
+  return out;
+}
+
+/**
+ * Whether `payloadContent` drops enough of `diskContent`'s `##` sections to
+ * warrant withholding the write. Compared as a multiset: each disk occurrence
+ * is matched off against one still-unconsumed payload occurrence of the exact
+ * same line, in disk order, so losing one copy of a heading that appears twice
+ * on disk is visible even though the same title still appears once in the
+ * payload. A "lost" occurrence is one with no remaining payload copy to match,
+ * reworded, split, or genuinely deleted headings all read the same way here
+ * (see the module doc comment above for why that is the accepted
+ * false-positive, not a defect to fix), and a heading moved into a fenced code
+ * block no longer counts as a payload occurrence at all (h2Headings excludes
+ * fenced lines on both sides).
+ *
+ * An ordinary edit that drops a single section (finishing one track, retiring
+ * one open question) must not park; losing 2 or more is the incident's own
+ * shape (security-backoffice lost 2 of its 3 tracks) and trips regardless of
+ * how big the file is. See SECTION_LOSS_MIN_COUNT's comment above for why this
+ * is now a single count check rather than a count-and-ratio pair.
+ *
+ * @returns {{lost: string[], diskCount: number}|null} the lost occurrences
+ *   (duplicates repeated once per lost copy) and how many `##` heading
+ *   occurrences disk had (also a multiset count, not deduped; see
+ *   h2Headings), or null when the write is fine
+ */
+export function sectionLossReason(diskContent, payloadContent) {
+  const diskHeadings = h2Headings(diskContent);
+  if (diskHeadings.length === 0) return null; // nothing to lose
+  const payloadHeadings = h2Headings(payloadContent);
+  const remaining = new Map();
+  for (const h of payloadHeadings) remaining.set(h, (remaining.get(h) || 0) + 1);
+  const lost = [];
+  for (const h of diskHeadings) {
+    const n = remaining.get(h) || 0;
+    if (n > 0) {
+      remaining.set(h, n - 1);
+    } else {
+      lost.push(h);
+    }
+  }
+  if (lost.length < SECTION_LOSS_MIN_COUNT) return null;
+  return { lost, diskCount: diskHeadings.length };
+}
+
 /**
  * Replace every whole-page overwrite target, then fill a missing project index.
  *
@@ -1116,7 +1908,10 @@ function runPreflight(args, payload, project, date) {
  *
  *   1. idempotent skip (disk already equals the payload)
  *   2. conflict (base unknown, or disk drifted away from base)
- *   3. direct write, then advance the base
+ *   3. section-loss guard (payload drops most of disk's `## `
+ *      sections: parks either way; `restructure: true` only changes WHICH
+ *      park reason is recorded, it no longer lets the write through)
+ *   4. direct write, then advance the base
  *
  * Step 1 must come first for two reasons. It keeps every existing
  * `--apply-session-close --session-id` test green (they read the payload
@@ -1124,21 +1919,421 @@ function runPreflight(args, payload, project, date) {
  * the apply-then-reclose loop: once a human applies proposal P, disk == proposed
  * == payload.content, so the next close skips before it can re-raise a conflict.
  *
+ * Step 3 runs only once step 2 has already cleared: a base conflict already
+ * withholds the write on its own, and reporting BOTH reasons for the same
+ * withheld byte would tell a resolving human two different stories about why
+ * their proposal review matters.
+ *
  * There is no caller here without a `--session-id`. verifyCloseAuthority refuses
  * that at the door, before a byte is written, so a session id is always present
  * by the time this runs and the base lookup always has something to look up.
  */
-function applyOverwrites(args, payload, project, date, indexRelPath, indexMissing, acc) {
-  const { applied, skipped, appliedPaths, conflicts } = acc;
+// ── close-intent durability (major finding: close's file set is not atomic) ──
+// applyOverwrites below writes up to 3 target files (session-state.md,
+// project hot.md, open-questions.md) as 3 SEPARATE atomicWrite calls. Each
+// individual write is torn-proof (temp + rename), but the SET is not: a
+// SIGKILL between the first rename and the second write leaves one target
+// holding new bytes and the next holding whatever was there before, with
+// nothing on disk saying this is an in-progress set rather than a finished
+// one. sessionCloseFileStatus's freshness check is content-blind by design,
+// so if the untouched target already happened to carry today's date (an
+// unrelated earlier edit, not this close), a later freshness-only read sees
+// the set as complete when it never was.
+//
+// This intent file is the missing witness. `writeCloseIntent` records every
+// target this apply is about to attempt and the hash each one is expected to
+// land at, BEFORE the first overwrite runs, with `phase: 'writing'`.
+// `markCloseIntentApplied` moves it to `phase: 'applied'` once applyOverwrites
+// has returned, and `clearCloseIntent` removes it only once the commit that
+// follows has landed. It used to be cleared right after applyOverwrites,
+// before the log appends and the commit: a process that died in that window
+// left every target at today's date with no record and no commit, and the
+// next probe read that as a finished close. A leftover record therefore means
+// the LAST close that started this set never got its bytes committed, whether
+// it died mid-write or later. `hasTornCloseIntent` is what the no-payload
+// probe branch (`alreadyComplete`) checks before trusting a green freshness
+// read, since that is the one path in THIS file that could otherwise report
+// success purely on freshness.
+//
+// A close that ends ok:false (a withheld conflict, a lint failure, a failed
+// commit) never reaches the commit, so it leaves its record behind on
+// purpose. Its bytes are on disk and uncommitted, and that is exactly what
+// the probe must not call complete. The cost is bounded: the retry that
+// re-runs the payload writes its own record over this one and clears it once
+// its commit lands, and CLOSE_INTENT_MAX_AGE_MS expires it otherwise.
+//
+// Every record also carries an `attemptId` (major fix): the path this file
+// lives at is keyed on `sessionId` alone, so a retry of the SAME session
+// (a resume after a crash, or an overlapping second apply) writes a SECOND
+// record to the exact same path a first attempt is still holding open. With
+// no identity beyond the path, the first attempt's own `clearCloseIntent`
+// (or `hasTornCloseIntent`'s expiry sweep) cannot tell "the record I am
+// about to delete is still the one I wrote" from "someone else's live
+// record now sits where mine used to be": deleting on path alone would
+// silently erase a second attempt's still-in-progress witness. `attemptId`
+// is this call's own identity: a clear only ever removes the file when a
+// FRESH re-read, taken under the same lock, still shows this exact
+// `attemptId`. A record with no `attemptId` at all (written by a build of
+// this file from before this fix) is handled by the same comparison, not a
+// special case: `undefined === undefined` still matches, so a legacy record
+// clears exactly when nothing newer has since overwritten it, and stops
+// matching the instant a NEW (attemptId-bearing) record replaces it, the
+// same protection this fix gives every record going forward.
+export function closeIntentPath(hypoDir, sessionId) {
+  if (!isValidSessionId(sessionId)) return null;
+  return join(hypoDir, '.cache', 'close-intent', `${sessionId}.json`);
+}
+
+function closeIntentTargetsFor(payload, project) {
+  const targets = [
+    {
+      relPath: join('projects', project, 'session-state.md'),
+      hash: hashContent(payload.sessionState.content),
+    },
+    {
+      relPath: join('projects', project, 'hot.md'),
+      hash: hashContent(payload.projectHot.content),
+    },
+  ];
+  if (payload.openQuestions) {
+    targets.push({
+      relPath: join('pages', 'open-questions.md'),
+      hash: hashContent(payload.openQuestions.content),
+    });
+  }
+  return targets;
+}
+
+// MAJOR fix: this used to swallow every failure (lock timeout, EACCES, a
+// full disk under .cache/) and let applyOverwrites start writing target
+// files anyway. The witness this record exists to provide never got
+// written, and the first target rename could still be the last thing this
+// process does before it dies, leaving hasTornCloseIntent's next probe
+// with literally nothing to find, so a torn set reads as a clean, finished
+// close. The whole point of writing this BEFORE the first byte moves is
+// defeated if a failure to write it is not itself fatal to the close: the
+// caller now checks `.ok` and refuses before applyOverwrites ever runs (see
+// applySessionClose's own call site), so a transient lock/permission/disk
+// problem here blocks the close instead of silently disabling its own
+// safety net.
+// @returns {{ok: true, attemptId: string} | {ok: false, reason: string}}
+export function writeCloseIntent(hypoDir, sessionId, targets) {
+  const path = closeIntentPath(hypoDir, sessionId);
+  // No usable session id: there is no path to key a witness to, the same
+  // gap `isValidSessionId` has always left open elsewhere in this file. Not
+  // a failure of THIS write: there was nothing for it to attempt, so it
+  // reports ok, degrading this run back to freshness-alone exactly as
+  // before this fix, never worse.
+  if (!path) return { ok: true, attemptId: null };
+  const attemptId = randomBytes(8).toString('hex');
+  try {
+    withFileLock(path, () => {
+      // Carry the PRIOR record's `sideEffects` forward into this new
+      // attempt, before overwriting it. A side effect (SCHEMA.md's
+      // Pending registration, a seeded projects/*/index.md) an earlier,
+      // uncommitted attempt at this SAME close already wrote survives this
+      // rewrite so a retry can still recognize it and restage it; only the
+      // read below (not a write) happens on the OLD bytes, so a corrupt or
+      // missing prior record just starts this attempt with none, same as
+      // if it had never existed.
+      let priorSideEffects = [];
+      try {
+        const prior = JSON.parse(readFileSync(path, 'utf-8'));
+        if (prior && Array.isArray(prior.sideEffects)) priorSideEffects = prior.sideEffects;
+      } catch {
+        // no prior record, or unreadable: nothing to carry forward
+      }
+      atomicWrite(
+        path,
+        JSON.stringify({
+          v: 1,
+          attemptId,
+          phase: 'writing',
+          targets,
+          sideEffects: priorSideEffects,
+          startedAt: new Date().toISOString(),
+        }),
+      );
+    });
+    return { ok: true, attemptId };
+  } catch (err) {
+    return { ok: false, reason: err?.message || String(err) };
+  }
+}
+
+/**
+ * Every side-effect entry `readCloseIntentSideEffects`/`recordCloseIntentSideEffect`
+ * carry: `{ path, kind: 'create' | 'schema-pending', bytesSha256, tags?: string[] }`.
+ * `tags` is present only for `kind: 'schema-pending'` (the exact tags a prior
+ * attempt registered into SCHEMA.md's Pending block, needed to rebuild the
+ * proof entry on restage without re-parsing anything).
+ *
+ * Record one side effect this attempt just made, under the SAME
+ * attemptId-matching discipline as `markCloseIntentApplied`: a write here
+ * only lands when the record at this path still shows the attemptId this
+ * call was given, so a newer attempt (or a stale one racing after its own
+ * clear) can never have its record corrupted by an older writer. Best-effort:
+ * a lost side-effect record just means a later retry treats this path as
+ * unexplained dirt again, the same fail-closed outcome as no record at all.
+ * @param {{path: string, kind: 'create'|'schema-pending', bytesSha256: string, tags?: string[]}} entry
+ */
+export function recordCloseIntentSideEffect(hypoDir, sessionId, attemptId, entry) {
+  const path = closeIntentPath(hypoDir, sessionId);
+  if (!path) return;
+  try {
+    withFileLock(path, () => {
+      let current;
+      try {
+        current = JSON.parse(readFileSync(path, 'utf-8'));
+      } catch {
+        return;
+      }
+      if (!current || current.attemptId !== attemptId) return; // a newer record owns this path now
+      const rest = (Array.isArray(current.sideEffects) ? current.sideEffects : []).filter(
+        (e) => e && e.path !== entry.path,
+      );
+      atomicWrite(path, JSON.stringify({ ...current, sideEffects: [...rest, entry] }));
+    });
+  } catch {
+    // best-effort, see doc comment above
+  }
+}
+
+/**
+ * This session's own close-intent record's `sideEffects`, whatever attempt
+ * (this one, or one carried forward by `writeCloseIntent`) last wrote them.
+ * `[]` on any read failure or when no record exists, never thrown: a caller
+ * treats an empty result exactly like "no side effect to restage", which is
+ * the safe, fail-closed default.
+ * @returns {Array<{path: string, kind: string, bytesSha256: string, tags?: string[]}>}
+ */
+export function readCloseIntentSideEffects(hypoDir, sessionId) {
+  const path = closeIntentPath(hypoDir, sessionId);
+  if (!path) return [];
+  try {
+    const current = JSON.parse(readFileSync(path, 'utf-8'));
+    return Array.isArray(current?.sideEffects) ? current.sideEffects : [];
+  } catch {
+    return [];
+  }
+}
+
+// Records that applyOverwrites returned: every target is now written, skipped,
+// or withheld, and what is still missing is the commit. Rewrites this call's
+// OWN record only (same attemptId check as the clear below), so a newer
+// attempt's record at the same path is left alone. Best-effort: a failed
+// rewrite leaves `phase: 'writing'`, which blocks the probe just the same.
+export function markCloseIntentApplied(hypoDir, sessionId, attemptId) {
+  const path = closeIntentPath(hypoDir, sessionId);
+  if (!path) return;
+  try {
+    withFileLock(path, () => {
+      const current = JSON.parse(readFileSync(path, 'utf-8'));
+      if (!current || current.attemptId !== attemptId) return;
+      atomicWrite(path, JSON.stringify({ ...current, phase: 'applied' }));
+    });
+  } catch {
+    // see above: the record stays at 'writing', still a live record
+  }
+}
+
+// Shared by `clearCloseIntent` (a finished apply removing its own record)
+// and `hasTornCloseIntent`'s expiry sweep (deleting a record too old to
+// trust): both need the SAME protection, re-read `path` UNDER THE SAME LOCK
+// a write would take and unlink only when the bytes still show exactly
+// `attemptId`, never on the strength of what an earlier, lock-free read
+// already saw. Without this, a second writer racing in between that earlier
+// read and the unlink (a same-session retry sharing this path, major fix
+// 3, or simply a session that starts a brand-new close on the same
+// sessionId right as an old record expires) has its still-live record
+// deleted as collateral by a caller that only ever meant to remove the
+// stale bytes it originally read.
+// `expectedAttemptId` compares with `===`, so `undefined` matches
+// `undefined`: a record from before this fix shipped (no `attemptId` field
+// at all) still clears correctly as long as nothing newer has since
+// overwritten it. That is the legacy-record policy this file's header
+// comment documents, not a special case bolted on here.
+function unlinkCloseIntentIfMatching(path, expectedAttemptId) {
+  withFileLock(path, () => {
+    let current;
+    try {
+      current = JSON.parse(readFileSync(path, 'utf-8'));
+    } catch {
+      return; // gone, or unreadable/corrupt: not provably still the record we read, leave it
+    }
+    if (!current || current.attemptId !== expectedAttemptId) return; // a newer record owns this path now
+    try {
+      unlinkSync(path);
+    } catch (e) {
+      if (e?.code !== 'ENOENT') throw e;
+    }
+  });
+}
+
+// Removes this call's OWN record, never a path on trust alone (major fix,
+// same-session-retry race). Two attempts for the SAME sessionId share one
+// path (`closeIntentPath` keys on sessionId, not on attempt): if a first
+// attempt's clear ran on the path alone, a second attempt's still-live
+// record sitting at that same path afterwards would be deleted as
+// collateral the instant the first attempt finishes, even though the
+// second attempt never crashed and is still relying on that witness.
+export function clearCloseIntent(hypoDir, sessionId, attemptId) {
+  const path = closeIntentPath(hypoDir, sessionId);
+  if (!path) return;
+  try {
+    unlinkCloseIntentIfMatching(path, attemptId);
+  } catch {
+    // A leftover record after a run that actually finished reads back as
+    // "died mid-set" by the next check: a false alarm, not a silent pass,
+    // which is the safe direction for a best-effort clear to fail in.
+  }
+}
+
+// A record older than this never gets a second chance to finish: the session
+// that wrote it is treated as dead, not merely slow. applyOverwrites (the
+// only writer between writeCloseIntent and clearCloseIntent) is a bounded
+// sequence of small synchronous file writes that normally lands in low
+// seconds; this is not tuned to that, it is tuned to the failure mode a
+// missed expiry causes. Without one, a single crashed session's leftover
+// record blocks EVERY later no-payload probe for this vault forever (the
+// writing session never retries, so nothing ever calls clearCloseIntent for
+// it). 30 minutes is arbitrary, chosen only to be comfortably longer than any
+// real apply (even a slow disk or a huge payload) while still bounding that
+// "every close treated as torn" window to well under a day. Same role as
+// PROPOSAL_TMP_GRACE_MS in hooks/proposal-store.mjs, different scale because
+// this window is bounding a stuck DIAGNOSIS, not a stuck RENAME.
+const CLOSE_INTENT_MAX_AGE_MS = 30 * 60 * 1000;
+
+/**
+ * Scan `.cache/close-intent/` for a leftover record whose promised targets no
+ * longer match disk. Returns one of three states, not a boolean, because
+ * "cannot tell" and "confirmed clean" are different answers a caller must not
+ * collapse into each other:
+ *
+ * - `'torn'`: some earlier close began writing this set and never reached
+ *   `clearCloseIntent`, exactly the case a bare freshness check cannot tell
+ *   apart from a normal finished close.
+ * - `'unreadable'`: the directory, a record, or one of a record's targets
+ *   could not be read or parsed, so no comparison against disk was possible
+ *   for it. This used to read as `false` (fail open, like every other cache
+ *   read in this file), but this function exists SPECIFICALLY to catch what
+ *   freshness alone cannot, so failing open here means an EACCES or a
+ *   half-written record makes a torn set look clean to the one check built to
+ *   catch it. A caller must treat this the same as `'torn'`: fall through to
+ *   a real apply rather than trust the freshness probe.
+ * - `'uncommitted'`: a live record whose targets all match disk. The files
+ *   landed but the commit that clears the record never did (a crash after
+ *   the writes, or a close that ended ok:false). This used to read as
+ *   `'clean'`, which is how a close that died between its writes and its
+ *   commit passed the probe. A caller treats it like `'torn'`.
+ * - `'clean'`: every record read fine and had expired, or there were no
+ *   records at all.
+ *
+ * A record older than CLOSE_INTENT_MAX_AGE_MS is treated as neither torn nor
+ * unreadable and is deleted here: the session that wrote it is gone, and
+ * without this an EACCES-free crash from months ago would still be judged
+ * torn (or worse, unreadable, if it happens to also be malformed) on every
+ * single close from here on. Deletion is best-effort; a failed unlink just
+ * means the next call tries again.
+ *
+ * MAJOR fix (same-session-retry race, #3): the delete used to unlink `path`
+ * straight off the bytes this scan already read, with no lock held between
+ * the read and the unlink. If a NEW session (or the same sessionId retrying)
+ * writes a fresh record at that exact path in that window, this deletes the
+ * new, still-live record as collateral: the file this scan judged expired
+ * is not necessarily the file still sitting there by the time the unlink
+ * runs. `unlinkCloseIntentIfMatching` closes that window: it re-reads under
+ * the same lock a write would take and only unlinks when the bytes still
+ * show the exact `attemptId` this scan read a moment ago.
+ */
+function hasTornCloseIntent(hypoDir) {
+  const dir = join(hypoDir, '.cache', 'close-intent');
+  let names;
+  try {
+    names = readdirSync(dir);
+  } catch (e) {
+    // ENOENT means no close has ever written a record here: the ordinary,
+    // overwhelmingly common state, and genuinely clean, not merely
+    // unreadable. Every other errno (EACCES, ENOTDIR, ...) means the
+    // directory exists but this could not examine it, which is the case
+    // this function must not fail open on (see the doc comment above).
+    return e && e.code === 'ENOENT' ? 'clean' : 'unreadable';
+  }
+  let sawUnreadable = false;
+  let sawLive = false;
+  for (const name of names) {
+    if (!name.endsWith('.json')) continue;
+    const path = join(dir, name);
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync(path, 'utf-8'));
+    } catch {
+      sawUnreadable = true;
+      continue;
+    }
+    if (!parsed || !Array.isArray(parsed.targets)) {
+      sawUnreadable = true;
+      continue;
+    }
+    const startedAt = Date.parse(parsed.startedAt);
+    if (Number.isFinite(startedAt) && Date.now() - startedAt > CLOSE_INTENT_MAX_AGE_MS) {
+      try {
+        unlinkCloseIntentIfMatching(path, parsed.attemptId);
+      } catch {
+        // best-effort: a leftover expired record just gets re-evaluated (and
+        // re-attempted) on the next call
+      }
+      continue;
+    }
+    for (const t of parsed.targets) {
+      if (!t || typeof t.relPath !== 'string' || typeof t.hash !== 'string') {
+        sawUnreadable = true;
+        continue;
+      }
+      const disk = readTarget(join(hypoDir, t.relPath));
+      if (typeof disk !== 'string' || hashContent(disk) !== t.hash) return 'torn';
+    }
+    sawLive = true;
+  }
+  if (sawUnreadable) return 'unreadable';
+  return sawLive ? 'uncommitted' : 'clean';
+}
+
+function applyOverwrites(args, payload, project, date, indexRelPath, indexMissing, acc, attemptId) {
+  const { applied, skipped, appliedPaths, conflicts, restructureWaivers, proofEntries } = acc;
+  // Read once per close, not once per field: it is a single small JSON read,
+  // and every skip branch below needs the same session-scoped record.
+  const journal = readJournal(args.hypoDir, args.sessionId);
 
   const overwrite = (key, relPath, field) => {
     if (!field || typeof field.content !== 'string') return; // optional / absent
     const full = join(args.hypoDir, relPath);
     const disk = readTarget(full);
 
-    // (1) idempotent skip — preserves writeIfChanged's contract
+    // (1) idempotent skip — preserves writeIfChanged's contract. "Already
+    // current" collapses two different histories that look identical from
+    // here: disk always held these bytes, or THIS session wrote them in an
+    // earlier, uncommitted attempt at this same close. Only the journal tells
+    // them apart. A record for this path whose hash still matches what is on
+    // disk means the second history — restage it so the retry's commit picks
+    // up bytes an earlier attempt already paid for. No record, or a hash that
+    // no longer matches (someone touched the file since), leaves it out: the
+    // gate should keep blocking on drift it cannot attribute to this close.
     if (disk === field.content) {
+      const journalHash = journal[relPath];
+      if (journalHash && journalHash === hashContent(field.content)) {
+        appliedPaths.push(relPath);
+      }
       skipped.push(`${key} (${relPath})`);
+      // Already current: the close proof still needs an entry naming this
+      // target (skipped targets are included), since the receipt
+      // certifies the payload's own version is IN the commit, not that this
+      // apply wrote it just now.
+      proofEntries.push({
+        path: relPath,
+        kind: 'overwrite',
+        expected: { bytesSha256: bytesSha256(field.content) },
+      });
       return;
     }
 
@@ -1172,10 +2367,14 @@ function applyOverwrites(args, payload, project, date, indexRelPath, indexMissin
       // see base-store.mjs's recordObserved/readObservedHash docs.
       const observedTruncated =
         !observedHash && wasObservedTruncated(args.hypoDir, args.sessionId, relPath);
-      const reason = overwriteConflictReason(entry, disk, {
-        hash: observedHash,
-        truncated: observedTruncated,
-      });
+      const appliedHash = readAppliedHash(args.hypoDir, args.sessionId, relPath);
+      const reason = overwriteConflictReason(
+        entry,
+        disk,
+        { hash: observedHash, truncated: observedTruncated },
+        appliedHash,
+        hashContent(field.content),
+      );
       if (reason) {
         conflicts.push({
           key,
@@ -1189,27 +2388,194 @@ function applyOverwrites(args, payload, project, date, indexRelPath, indexMissin
       }
     }
 
-    // (3) write, then the content we just wrote IS this session's new base
+    // (3) Section-loss guard: this overwrite would drop most of disk's `## ` sections.
+    // Computed regardless of `restructure`, so a `true` value set on a field that
+    // tripped a REAL loss can be told apart from one set on a field that never had
+    // a loss to waive.
+    //
+    // `field.restructure === true` used to be a full escape hatch: it let the
+    // write through immediately, with only `restructureWaivers` left behind as an
+    // after-the-fact audit trail. That made the flag self-approving:
+    // the party the guard exists to check (the model composing the payload) was
+    // also the only party who could clear it, with no human between the claim and
+    // the disk write. `restructure: true` no longer bypasses anything. It only
+    // picks WHICH park reason applies; either way the bytes are withheld and go
+    // through the SAME human-approval door a base conflict already uses
+    // (`hypomnema proposal challenge` / `proposal resolve`, a nonce a human types
+    // after reviewing the diff). A field that never had a loss to waive still adds
+    // no entry to `restructureWaivers`. The flag did nothing there, which is not
+    // this field's job to flag.
+    if (typeof disk === 'string') {
+      const loss = sectionLossReason(disk, field.content);
+      if (loss) {
+        const restructureRequested = field.restructure === true;
+        conflicts.push({
+          key,
+          target: relPath,
+          reason: restructureRequested
+            ? 'section-loss-guard-restructure-pending'
+            : 'section-loss-guard',
+          lostSections: loss.lost,
+          diskSectionCount: loss.diskCount,
+          baseHash: args.sessionId
+            ? readBaseEntry(args.hypoDir, args.sessionId, relPath).hash
+            : null,
+          currentHash: hashContent(disk),
+          proposedContent: field.content,
+        });
+        if (restructureRequested) {
+          // The model's claim is still worth recording, just not as approval:
+          // it tells the human reviewing the parked proposal that the payload
+          // author believed this restructure was intentional, which is exactly
+          // the context `hypomnema proposal challenge` shows them before they
+          // type the nonce.
+          restructureWaivers.push({ target: relPath, lostSections: loss.lost });
+        }
+        return; // target bytes untouched either way
+      }
+    }
+
+    // (4) write, then the content we just wrote IS this session's new base.
+    // This target's expected post-write hash is already recorded in this
+    // session's close-intent file (written before applyOverwrites started,
+    // see closeIntentPath above), so a crash right here (between this
+    // rename landing and a sibling field's own write) leaves that record
+    // behind for hasTornCloseIntent to find, rather than a silent gap.
     atomicWrite(full, field.content);
-    if (args.sessionId)
-      advanceBase(args.hypoDir, args.sessionId, relPath, hashContent(field.content));
+    if (args.sessionId) {
+      // Base and applied-hash move together, in ONE base.json write
+      // (advanceBaseAndRecordApplied), not two calls back to back. Two
+      // separate writes (advanceBase, then recordAppliedHash) had a window
+      // where the first landed and the second failed, leaving the base moved
+      // but the applied record stale (review r4-w4 major 2's silent
+      // fall-back to the pre-guard overwrite). A merged write either lands
+      // whole or leaves both fields exactly as they were, so a failure here
+      // is a normal fail-safe: the base does not move, and the next look at
+      // this target sees the same base-mismatch a foreign write would get.
+      //
+      // The page bytes above are already on disk by the time either call
+      // below runs, so neither failure can be undone from here: the guard
+      // this section exists to keep honest depends on base.json, not on the
+      // page itself. review r5-w3 major 1 named the silent-ignore of these
+      // two return values; surfaced to stderr rather than to the result JSON,
+      // since the latter is a wider change to `acc`'s shape than this
+      // overwrite step owns. A failure here is loud but not fatal: the next
+      // close on this target degrades to `base-unknown`/a journal-less retry,
+      // both of which already fail safe into a park rather than a silent
+      // overwrite.
+      if (
+        !advanceBaseAndRecordApplied(
+          args.hypoDir,
+          args.sessionId,
+          relPath,
+          hashContent(field.content),
+        )
+      ) {
+        process.stderr.write(
+          `[crystallize] warning: wrote ${relPath} but could not record its new base/applied hash (base.json write failed): the next close on this target may park as base-unknown\n`,
+        );
+      }
+      // Record what THIS write just put down, so a retry after a partial
+      // close (a sibling field conflicts, the commit fails, the process
+      // dies) can tell its own uncommitted bytes apart from someone else's —
+      // see the journal read in step (1) above and the doc comment on
+      // hooks/close-journal.mjs. `recordJournalEntry` itself returns nothing
+      // to check (best-effort, swallows its own failures): that function
+      // lives in hooks/close-journal.mjs, outside this fix's write scope, so
+      // its silent-ignore half of review r5-w3 major 1 is not closed here.
+      recordJournalEntry(args.hypoDir, args.sessionId, relPath, hashContent(field.content));
+    }
     applied.push(`${key} (${relPath})`);
     appliedPaths.push(relPath);
+    proofEntries.push({
+      path: relPath,
+      kind: 'overwrite',
+      expected: { bytesSha256: bytesSha256(field.content) },
+    });
   };
 
   overwrite('sessionState', join('projects', project, 'session-state.md'), payload.sessionState);
   overwrite('projectHot', join('projects', project, 'hot.md'), payload.projectHot);
-  overwrite('rootHot', 'hot.md', payload.rootHot);
   overwrite('openQuestions', join('pages', 'open-questions.md'), payload.openQuestions);
 
   // A-1: fill a missing project index as part of this close's writes (after
   // preflight passed, so an aborted close never leaves a half-applied side
   // effect on disk).
   if (indexMissing) {
-    const createdIndex = ensureProjectIndex(args.hypoDir, project, indexRelPath, date);
+    const createdIndex = ensureProjectIndex(
+      args.hypoDir,
+      project,
+      indexRelPath,
+      date,
+      args.sessionId,
+    );
     if (createdIndex) {
       applied.push(`projectIndex (${createdIndex})`);
       appliedPaths.push(createdIndex);
+      // Read the bytes back rather than re-deriving substituteTokens' output a
+      // second time here: ensureProjectIndex just landed them via atomic
+      // create, and re-reading is the same "trust what's actually on disk"
+      // discipline every other proof entry in this file follows.
+      const createdContent = readTarget(join(args.hypoDir, createdIndex));
+      if (typeof createdContent === 'string') {
+        const bytesSha = bytesSha256(createdContent);
+        proofEntries.push({
+          path: createdIndex,
+          kind: 'create',
+          expected: { bytesSha256: bytesSha },
+        });
+        // Witness this create as a close-intent side effect
+        // too, alongside the journal record ensureProjectIndex already wrote.
+        // A retry that (for any reason) cannot trust the journal still has
+        // this to fall back on.
+        recordCloseIntentSideEffect(args.hypoDir, args.sessionId, attemptId, {
+          path: createdIndex,
+          kind: 'create',
+          bytesSha256: bytesSha,
+        });
+      }
+    }
+  } else {
+    // The retry path. A first attempt that seeds index.md and then fails to
+    // commit leaves it dirty; this run finds it already there, so the branch
+    // above does nothing and the file would drop out of the commit scope
+    // entirely, blocking the gate forever with no retry ever picking it back
+    // up. Restaging it is only safe when the journal says THIS session wrote
+    // exactly the bytes still on disk — the same rule step (1)'s idempotent
+    // skip applies, reused here because ensureProjectIndex never reaches
+    // step (1) at all (it is a template-seeded create, not a payload
+    // overwrite field). A hand-edited index.md (no journal record, or a
+    // journal record whose hash no longer matches) is left OUT of
+    // appliedPaths on purpose: those are bytes this close never wrote, and
+    // sweeping them into its commit would ship an edit the payload never
+    // carried.
+    const full = join(args.hypoDir, indexRelPath);
+    const disk = readTarget(full);
+    const journalHash = journal[indexRelPath];
+    if (journalHash && typeof disk === 'string' && journalHash === hashContent(disk)) {
+      appliedPaths.push(indexRelPath);
+      proofEntries.push({
+        path: indexRelPath,
+        kind: 'create',
+        expected: { bytesSha256: bytesSha256(disk) },
+      });
+    } else if (typeof disk === 'string') {
+      // Fallback witness: no journal record (or a stale one), but
+      // this session's own close-intent still names this exact create as a
+      // side effect, and the bytes on disk still match it byte for byte.
+      // Same restage judgment as the journal branch above, from a second
+      // witness.
+      const priorIndex = readCloseIntentSideEffects(args.hypoDir, args.sessionId).find(
+        (e) => e && e.path === indexRelPath && e.kind === 'create',
+      );
+      if (priorIndex && bytesSha256(disk) === priorIndex.bytesSha256) {
+        appliedPaths.push(indexRelPath);
+        proofEntries.push({
+          path: indexRelPath,
+          kind: 'create',
+          expected: { bytesSha256: priorIndex.bytesSha256 },
+        });
+      }
     }
   }
 }
@@ -1225,10 +2591,17 @@ const entryAlreadyPresent = (entry) => (content) =>
 // Append this close's entry to the project's daily session-log shard, pushing the
 // outcome into the shared `acc` bag.
 function appendSessionLogEntry(args, payload, project, date, acc) {
-  const { applied, skipped, appliedPaths, conflicts } = acc;
+  const { applied, skipped, appliedPaths, conflicts, proofEntries } = acc;
   const rel = join('projects', project, 'session-log', `${date}.md`);
   const full = join(args.hypoDir, rel);
   const isPresent = entryAlreadyPresent(payload.sessionLog.entry);
+  const journal = readJournal(args.hypoDir, args.sessionId);
+  // Which file actually carries this close's entry: the daily shard `rel`
+  // on a create/append, or whichever hybrid-cutover candidate the "already
+  // present" scan below matched. The proof entry must name THAT path: an
+  // append proof against `rel` when the entry in fact lives in the legacy
+  // monthly file would never verify against the commit.
+  let evidencePath = rel;
   // Serialize dedup + create/append on the daily shard so two concurrent
   // closes never lose an entry: the second closer takes the lock only after
   // the first committed, re-reads the shard under the lock, and appends onto
@@ -1251,7 +2624,10 @@ function appendSessionLogEntry(args, payload, project, date, acc) {
           const cf = join(args.hypoDir, cand);
           if (!existsSync(cf)) continue;
           try {
-            if (isPresent(readFileSync(cf, 'utf-8'))) return 'skipped';
+            if (isPresent(readFileSync(cf, 'utf-8'))) {
+              evidencePath = cand; // the candidate that actually carries the entry
+              return 'skipped';
+            }
           } catch {
             /* unreadable candidate — fall through to the write path */
           }
@@ -1292,7 +2668,40 @@ function appendSessionLogEntry(args, payload, project, date, acc) {
       { timeoutMs: APPEND_LOCK_TIMEOUT_MS },
     );
     (outcome === 'skipped' ? skipped : applied).push(`sessionLog (${rel})`);
-    if (outcome !== 'skipped') appliedPaths.push(rel);
+    if (outcome !== 'skipped') {
+      appliedPaths.push(rel);
+      // Same journal contract as applyOverwrites: record the FULL file's hash
+      // right after this write, not just the entry, since a retry's own
+      // "already present" skip below reads the whole file back to compare.
+      const written = readTarget(full);
+      if (typeof written === 'string')
+        recordJournalEntry(args.hypoDir, args.sessionId, rel, hashContent(written));
+    } else {
+      // "Already present" collapses the same two histories the overwrite
+      // guard's step (1) does: this entry could have sat in the shard since
+      // before this close ever ran, or THIS session appended it in an
+      // earlier, uncommitted attempt at the same close. Restage only the
+      // second — a journal record whose hash still matches the shard on
+      // disk. (A hybrid-month fallback hit above never reaches here with
+      // `full` matching the journal's recorded target, since the evidence in
+      // that case lives in the legacy monthly file instead — nothing to
+      // restore for the daily shard because this close never wrote one.)
+      const journalHash = journal[rel];
+      if (journalHash) {
+        const disk = readTarget(full);
+        if (typeof disk === 'string' && journalHash === hashContent(disk)) {
+          appliedPaths.push(rel);
+        }
+      }
+    }
+    // session-log evidence (always included): the exact path
+    // sessionCloseFileStatus's freshness check would accept for THIS
+    // close's entry, whichever of the hybrid candidates actually carries it.
+    proofEntries.push({
+      path: evidencePath,
+      kind: 'append',
+      expected: { entryBlocks: [payload.sessionLog.entry] },
+    });
   } catch (err) {
     // Only a lock-TIMEOUT is withheld as a conflict. A real fn() write error
     // (disk-full, EACCES, mkdir failure) must NOT be masked as a proposal-
@@ -1335,9 +2744,35 @@ function appendSessionLogEntry(args, payload, project, date, acc) {
 // (the Stop-hook backfill in hypo-shared.mjs). Both take the SAME lock on
 // log.md, so a concurrent close's append and this close's append serialize
 // instead of overwriting each other.
+// log.md is a single shared file both branches below append to, so a
+// "wrote nothing new" outcome from either one needs the same journal-based
+// restore-vs-leave-dirty judgment applyOverwrites' step (1) already makes:
+// this session's own prior, uncommitted append restages; anything else does
+// not. Centralized here rather than duplicated per branch, and rather than
+// merely commented twice, because a fix to one copy silently drifting from
+// the other is exactly the failure mode two near-identical blocks invite.
+function restageOrRecordLogMd(args, logFull, journal, wroteNew, acc) {
+  const { appliedPaths } = acc;
+  if (wroteNew) {
+    appliedPaths.push('log.md');
+    const written = readTarget(logFull);
+    if (typeof written === 'string')
+      recordJournalEntry(args.hypoDir, args.sessionId, 'log.md', hashContent(written));
+    return;
+  }
+  const journalHash = journal['log.md'];
+  if (journalHash) {
+    const disk = readTarget(logFull);
+    if (typeof disk === 'string' && journalHash === hashContent(disk)) {
+      appliedPaths.push('log.md');
+    }
+  }
+}
+
 function appendRootLogEntry(args, payload, project, date, acc) {
-  const { applied, skipped, appliedPaths, conflicts } = acc;
+  const { applied, skipped, conflicts, proofEntries } = acc;
   const logFull = join(args.hypoDir, 'log.md');
+  const journal = readJournal(args.hypoDir, args.sessionId);
   if (payload.log) {
     try {
       const wrote = withFileLock(
@@ -1346,7 +2781,14 @@ function appendRootLogEntry(args, payload, project, date, acc) {
         { timeoutMs: APPEND_LOCK_TIMEOUT_MS },
       );
       (wrote ? applied : skipped).push('log (log.md)');
-      if (wrote) appliedPaths.push('log.md');
+      restageOrRecordLogMd(args, logFull, journal, wrote, acc);
+      // Append proof is the ENTRY, never just a heading: a sibling body
+      // under the same heading must not verify.
+      proofEntries.push({
+        path: 'log.md',
+        kind: 'append',
+        expected: { entryBlocks: [payload.log.entry] },
+      });
     } catch (err) {
       if (err?.code !== 'ELOCKTIMEOUT') throw err;
       // proposedContent is append-ready root-log bytes (the custom log line).
@@ -1366,6 +2808,11 @@ function appendRootLogEntry(args, payload, project, date, acc) {
     // the global path. Exact-line dedup on the heading keeps a second apply (or a
     // titleless vs titled same-day pair) from duplicating.
     const headingRe = new RegExp(`^#{1,6} \\[${date}\\]\\s*(.*)$`, 'gm');
+    // A payload can carry more than one dated heading, and
+    // each derives its OWN root-log block, the proof must cover every one,
+    // not just the first, or a second heading's block could be missing from
+    // the commit with nothing here to catch it.
+    const derivedBlocks = [];
     try {
       const wroteAny = withFileLock(
         logFull,
@@ -1373,6 +2820,7 @@ function appendRootLogEntry(args, payload, project, date, acc) {
           let w = false;
           for (const m of (payload.sessionLog.entry || '').matchAll(headingRe)) {
             const { heading, block } = rootLogEntry(project, date, m[1]);
+            derivedBlocks.push(block);
             const wrote = appendIfAbsent(logFull, block, (c) =>
               (c || '').split(/\r?\n/).includes(heading),
             );
@@ -1383,7 +2831,14 @@ function appendRootLogEntry(args, payload, project, date, acc) {
         { timeoutMs: APPEND_LOCK_TIMEOUT_MS },
       );
       (wroteAny ? applied : skipped).push('log (log.md, derived)');
-      if (wroteAny) appliedPaths.push('log.md');
+      restageOrRecordLogMd(args, logFull, journal, wroteAny, acc);
+      if (derivedBlocks.length > 0) {
+        proofEntries.push({
+          path: 'log.md',
+          kind: 'append',
+          expected: { entryBlocks: derivedBlocks },
+        });
+      }
     } catch (err) {
       if (err?.code !== 'ELOCKTIMEOUT') throw err;
       // `derived: true` discriminates this from the payload.log conflict above:
@@ -1420,6 +2875,64 @@ function appendRootLogEntry(args, payload, project, date, acc) {
 // append-only history file. Append conflicts still sit in `conflicts`, so the
 // close still goes proposal-pending — they just get no artifact and no
 // human-apply step.
+// Human-readable park reason, keyed by `c.reason`. Add a line here for every
+// new reason string a `conflicts.push(...)` call introduces (applyOverwrites,
+// the append-lock-timeout sites below) — before this lookup existed, the report
+// only branched on `c.kind === 'append'` and printed one fixed sentence
+// ("the page changed since this session read it") for every other reason,
+// which is a flat lie for `section-loss-guard`: nothing external changed
+// there, the PAYLOAD dropped its own sections. A reason with no entry here
+// falls through to the default below, worded to admit it does not know the
+// cause rather than repeat a specific wrong one.
+const CONFLICT_WHY = {
+  'append-lock-timeout': () =>
+    'could not acquire the append lock in time; the next close re-applies',
+  'base-unknown': () =>
+    'no base snapshot exists for this target for this session, so another writer could be sitting on disk with no way to tell',
+  'base-hash-target-missing': () =>
+    'the page changed since this session read it (it existed at base, and is missing now)',
+  'base-mismatch': () => 'the page changed since this session read it',
+  'base-mismatch-truncated-observation': () =>
+    'the page changed since this session read it, and the last resume/compact only showed a truncated slice of it',
+  'base-absent-target-exists': () =>
+    'the page changed since this session read it (nothing existed at base, another writer created it since)',
+  'target-unreadable': () =>
+    'the target could not be read just now; failing safe rather than assuming it is unchanged',
+  'will-overwrite-local-change': () =>
+    'this session applied a payload to this target before, and the disk bytes have since changed (a hand edit, most likely): writing this payload now, unmodified or not, would silently discard that edit, because there is no way from here to tell a payload that folds the edit in from one that does not. A human must review the diff and approve it with `proposal challenge` / `proposal resolve` (`/hypo:crystallize` runs them for you), whether the payload already accounts for the edit or not',
+  // This message used to end with "or set \"restructure\": true after confirming
+  // with the user that dropping them is intended". That instruction stopped
+  // being true the moment the flag stopped authorising the write, and a park
+  // message that hands back a step which no longer lands the bytes is worse
+  // than one that offers nothing. The two real ways out are below.
+  'section-loss-guard': (c) =>
+    `this payload drops ${c.lostSections.length} of ${c.diskSectionCount} \`##\` section(s) already on disk (${c.lostSections.join(', ')}). The page did not change, and the payload did not carry those sections forward. Either add the missing sections back into the payload, or, if dropping them is intended, have a human approve the parked write with \`proposal challenge\` / \`proposal resolve\` (\`/hypo:crystallize\` runs them for you). Setting "restructure": true records that intent for the reviewer; it does not land the write`,
+  // `restructure: true` used to let this write straight through, a
+  // model-set boolean approving its own destructive overwrite, with no human in
+  // the loop. It still parks, exactly like the unset case above; the only
+  // difference is this message, which tells the reviewing human the payload
+  // author already claims the drop is intentional.
+  'section-loss-guard-restructure-pending': (c) =>
+    `this payload drops ${c.lostSections.length} of ${c.diskSectionCount} \`##\` section(s) already on disk (${c.lostSections.join(', ')}) and set "restructure": true. The payload's own claim is not authority to drop them. A human must review the diff and approve it with \`proposal challenge\` / \`proposal resolve\` (\`/hypo:crystallize\` runs them for you) before this write lands`,
+};
+
+export function conflictWhy(c) {
+  const fn = CONFLICT_WHY[c.reason];
+  if (!fn) return `unrecognized park reason "${c.reason}" — cause not determined`;
+  // An entry reads whatever fields its own reason carries, and the section-loss
+  // one needs two the others never set. That was harmless while this only fed
+  // the text report; the JSON close path now calls it for every conflict, so a
+  // future reason pushed without the fields its entry expects would throw
+  // mid-close and take the whole apply with it. The explanation is the least
+  // important thing happening here: degrade to the raw reason rather than lose
+  // the close over a message.
+  try {
+    return fn(c);
+  } catch {
+    return `${c.reason} (details unavailable)`;
+  }
+}
+
 function parkOverwriteConflicts(args, conflicts) {
   const proposals = [];
   const proposalStoreFailures = [];
@@ -1434,6 +2947,20 @@ function parkOverwriteConflicts(args, conflicts) {
         proposedContent: c.proposedContent, // internal (pre-drop) full page bytes
         sessionId: args.sessionId, // may be null; writeProposal coerces it
         device,
+        // The same human-readable cause the JSON result's conflicts[].why now
+        // carries (buildCloseResult) — stored here too because a proposal
+        // artifact outlives this close's own stdout, and `hypomnema proposal
+        // list`/`apply` reads only the artifact, never this run's JSON. Without
+        // it, the reviewer sees the raw `reason` code and nothing else (codex
+        // 3rd-pass finding: the park-reason wording fix never reached this file).
+        parkReason: conflictWhy(c),
+        // Section-loss detail: only meaningful for those two reasons, so only
+        // sent for them. An absent field on every other conflict is the correct
+        // shape, not a gap.
+        ...(c.reason === 'section-loss-guard' ||
+        c.reason === 'section-loss-guard-restructure-pending'
+          ? { lostSections: c.lostSections, diskSectionCount: c.diskSectionCount }
+          : {}),
       });
       proposals.push({ id: saved.id, target: saved.target, path: saved.path });
       // Supersede-delete failure is NON-fatal: the new artifact IS parked, only
@@ -1448,7 +2975,7 @@ function parkOverwriteConflicts(args, conflicts) {
       proposalStoreFailures.push({ target: c.target, key: c.key, error });
       process.stderr.write(
         `\n🛑 PROPOSAL STORE FAILED for ${c.key} (${c.target}): ${error}\n` +
-          `    This close WITHHELD the target (it drifted from your observed base) but\n` +
+          `    This close WITHHELD the target (${conflictWhy(c)}) but\n` +
           `    could NOT write the .cache/proposals/ artifact either. The payload bytes\n` +
           `    are on NEITHER disk NOR a proposal — re-run the close once the .cache/\n` +
           `    directory is writable so the withheld content is not lost.\n`,
@@ -1483,21 +3010,99 @@ const unknownTagRe = /^Unknown tag: "(.+)" \(not in SCHEMA\.md Tag Vocabulary\)/
 // check and runPostApplyLint's payload-scope promotion below.
 const INVALID_YAML_WARN_RE = /^Invalid YAML frontmatter: /;
 
-function registerPendingTags(args, preflightLint, hasConflicts) {
+// SCHEMA.md registration is called from INSIDE runMarkerPhase's
+// vault-commit lock, once `ok` is already settled, right before the commit
+// that follows it, never at its old call site (before postApplyLint even
+// ran). Registering earlier used to mutate SCHEMA.md on a close that was
+// still going to fail (or park a conflict): the file changed, uncommitted,
+// on a run whose whole point was to write nothing.
+//
+// Also requires SCHEMA.md to be CLEAN against HEAD (not dirty, not
+// untracked) before touching it: a dirty SCHEMA.md may be someone else's
+// uncommitted edit, and layering a registration onto it would (a) fold
+// their bytes into THIS close's commit with no proof entry covering them,
+// and (b) make the registration itself uncommitted right alongside it.
+// Deferring costs nothing: the tag stays a non-blocking unknown-tag warn
+// until a later close finds SCHEMA.md clean.
+function registerPendingTagsLocked(
+  args,
+  preflightLint,
+  hasConflicts,
+  appliedPaths,
+  proofEntries,
+  attemptId,
+) {
+  const schemaPath = join(args.hypoDir, 'SCHEMA.md');
+  if (!existsSync(schemaPath)) return;
+
+  // Retry restage: a PRIOR attempt at this SAME close already
+  // registered pending tags into SCHEMA.md and left the write uncommitted
+  // (the commit that was supposed to land it failed, or the process died
+  // between the write and the commit). Once those tags sit in the file,
+  // `preflightLint` below no longer flags them as unknown at all, so the
+  // normal registration path never even sees them again. Without this check
+  // that dirty SCHEMA.md would sit unexplained forever, deferred every close
+  // for a reason the SESSION ITSELF already resolved. A byte-for-byte match
+  // against the recorded side effect is what tells "my own unfinished write"
+  // apart from someone else's unrelated edit landing on the same file in the
+  // meantime; only the first restages.
+  let disk;
+  try {
+    disk = readFileSync(schemaPath);
+  } catch {
+    disk = null;
+  }
+  if (disk) {
+    const priorSchema = readCloseIntentSideEffects(args.hypoDir, args.sessionId).find(
+      (e) => e && e.path === 'SCHEMA.md' && e.kind === 'schema-pending',
+    );
+    if (priorSchema && bytesSha256(disk) === priorSchema.bytesSha256) {
+      appliedPaths.push('SCHEMA.md');
+      proofEntries.push({
+        path: 'SCHEMA.md',
+        kind: 'schema-pending',
+        expected: { tags: priorSchema.tags },
+      });
+      return;
+    }
+  }
+
   const pendingTags = [];
   for (const w of preflightLint.warns || []) {
     const m = unknownTagRe.exec(w.message || '');
     if (m && !checkForbidden(m[1])) pendingTags.push(m[1]);
   }
-  // Withheld a target? Then register nothing. This close is going to be re-run
-  // once a human resolves the conflict, and its `ok:false` skips the commit below
-  // (`if (ok && args.sessionId)`) — so registering here would leave SCHEMA.md
-  // mutated, uncommitted, and absent from `applied`, i.e. a silent side effect of
-  // a close whose whole point was to write nothing. Registration is
-  // eventually-consistent by design, so deferring it to the next close costs
-  // nothing (codex W2 CONCERN).
-  if (pendingTags.length > 0 && !hasConflicts) {
-    appendPendingTags(args.hypoDir, pendingTags);
+  if (pendingTags.length === 0 || hasConflicts) return;
+  const diffRes = spawnSync('git', [
+    '-C',
+    args.hypoDir,
+    'diff',
+    '--quiet',
+    'HEAD',
+    '--',
+    'SCHEMA.md',
+  ]);
+  if (diffRes.error || diffRes.status !== 0) return; // dirty vs HEAD, or no HEAD yet: defer
+  const statusRes = spawnSync(
+    'git',
+    ['-C', args.hypoDir, 'status', '--porcelain', '--', 'SCHEMA.md'],
+    { encoding: 'utf-8' },
+  );
+  if (statusRes.error || /^\?\?/.test((statusRes.stdout || '').trim())) return; // untracked: defer
+  const result = appendPendingTags(args.hypoDir, pendingTags);
+  if (result.tags.length > 0 && typeof result.content === 'string') {
+    appliedPaths.push('SCHEMA.md');
+    proofEntries.push({
+      path: 'SCHEMA.md',
+      kind: 'schema-pending',
+      expected: { tags: result.tags },
+    });
+    recordCloseIntentSideEffect(args.hypoDir, args.sessionId, attemptId, {
+      path: 'SCHEMA.md',
+      kind: 'schema-pending',
+      bytesSha256: bytesSha256(result.content),
+      tags: result.tags,
+    });
   }
 }
 
@@ -1589,44 +3194,83 @@ function runPostApplyLint(args, payloadScope) {
 // reported by the result JSON: `null` when this apply never reached the commit
 // step at all (ok:false before the writes were even verified), distinct from a
 // commit that ran and reported `committed:false`.
-function runMarkerPhase(args, project, appliedPaths, ok) {
+// Which undo advice this run has earned, or null when it left nothing to undo
+// and so nothing to warn about. The hostTagWarning used to hang off `ok`,
+// which got it backwards on the one path that matters most: 'marker-did-not-
+// land' flips `ok` to false AFTER the payload is already committed, so a close
+// that may not reflect the user's decision sat in the vault's history with the
+// warning suppressed. What the warning is actually about is "this run put
+// something on disk you may want back", so that is the condition it reads.
+function hostTagUndoKind({ committed, markerWritten, wroteBytes }) {
+  if (committed) return markerWritten ? 'commit-and-marker' : 'commit-only';
+  return wroteBytes ? 'uncommitted-writes' : null;
+}
+
+// commitWikiChanges' own `sha` field collapses two different histories to
+// the same falsy value: a real `scoped: 0` no-op (nothing was ever staged,
+// so the field is `undefined`) and a REAL commit whose `rev-parse HEAD`
+// afterwards failed (the field is `null`, per commitWikiChanges' own doc
+// comment). hostTagWarningWithUndo needs those told apart: `null` says
+// "nothing to revert", `undefined` says "a commit exists, look it up
+// yourself", and `commitOutcome.sha` alone cannot tell them apart, since
+// both land on a value that reads as "no sha". `scoped === 0` is the only
+// signal that actually distinguishes them: it is `0` on the no-op path and
+// a positive count on the failed-rev-parse path, regardless of what `sha`
+// itself holds.
+//
+// MAJOR fix: this function used to return `commitOutcome.sha` verbatim on
+// the `scoped !== 0` branch, so a real commit with a null `sha` (the
+// failed-rev-parse case) fell through unchanged and hostTagWarningWithUndo
+// read it exactly like the true no-op, "nothing needs reverting", for a
+// commit that had, in fact, just landed. `?? undefined` is what remaps that
+// one case: `sha` a string passes through untouched, `sha: null` (the only
+// other value `commitWikiChanges` ever returns here) becomes `undefined` so
+// the caller gets the honest "look it up yourself" wording instead of a
+// false "there is nothing here".
+export function commitShaForUndo(commitOutcome) {
+  if (!commitOutcome) return undefined;
+  if (commitOutcome.scoped === 0) return null;
+  return commitOutcome.sha ?? undefined;
+}
+
+// `git rev-parse --show-toplevel` / `--show-prefix`, for the receipt's
+// `repo` field. `null` on any git failure: the receipt writer treats a
+// missing repo identity the same as any other reason not to issue one.
+function repoIdentity(hypoDir) {
+  const top = spawnSync('git', ['-C', hypoDir, 'rev-parse', '--show-toplevel'], {
+    encoding: 'utf-8',
+  });
+  if (top.error || top.status !== 0) return null;
+  const toplevel = (top.stdout || '').trim();
+  if (!toplevel) return null;
+  const pfx = spawnSync('git', ['-C', hypoDir, 'rev-parse', '--show-prefix'], {
+    encoding: 'utf-8',
+  });
+  const prefix = !pfx.error && pfx.status === 0 ? (pfx.stdout || '').trim() : '';
+  return { toplevel, prefix };
+}
+
+function runMarkerPhase(args, project, appliedPaths, ok, hostTagWarning, receiptCtx = {}) {
+  const {
+    preflightLint = null,
+    hasConflicts = false,
+    proofEntries = [],
+    attemptId = null,
+  } = receiptCtx;
   let markerWritten = false;
   let markerSkipReason = null;
+  let markerGateReason = null;
   let commitOutcome = null;
+  let receiptMismatches = null;
+  // What the gate waved through on the way to the marker. The demotions are
+  // only honest if the operator can see them, and this is the path that runs
+  // on a real close: `--mark-session-closed` already reported them, while
+  // `--apply-session-close` dropped them on the floor.
+  let gateNotices = [];
+  // What the gate refused on, so a compact-gate-not-ok result names its own
+  // blockers instead of sending the caller to a different, wider check.
+  let gateBlockers = [];
   if (ok && args.sessionId) {
-    // Close-gate resolution: apply succeeding (`ok`) IS the resolution, not
-    // whether the per-session marker below happens to land. The marker can
-    // be withheld for reasons that have nothing to do with whether this
-    // apply's own writes were valid (a stale git tree, a feedback-projection
-    // cap, W8 design-history staleness) — none of that should leave the
-    // resolution unrecorded, because the wiki writes already happened, and
-    // re-running the SAME apply with no fresh user close signal is exactly
-    // what this record exists to block. So this sits OUTSIDE and ahead of
-    // the marker's own commit-gated logic below, resolving its own
-    // transcript rather than sharing the marker's `closeTranscript` (which
-    // stays null whenever the commit fails) — a commit failure withholds
-    // the marker but must not also withhold the resolution.
-    //
-    // Best-effort like every other write in this store: resolutionStamp
-    // returns null on anything it cannot read as a Buffer, recordGateClosed
-    // refuses a null stamp, and both fail silently, so a transcript that
-    // vanishes mid-read (or a cache-write failure) can never turn an
-    // otherwise-successful apply into a failure.
-    try {
-      const resolutionTranscriptPath = resolveTranscriptBySessionId(args.sessionId);
-      if (resolutionTranscriptPath) {
-        recordGateClosed(
-          args.hypoDir,
-          args.sessionId,
-          resolutionStamp(readFileSync(resolutionTranscriptPath)),
-        );
-      }
-    } catch {
-      // Unreadable at the moment of a successful close is not this apply's
-      // problem to surface — the resolution just stays unrecorded, same as
-      // if this session had never resolved at all (NO_CONSTRAINT).
-    }
-
     // IO stays lazy so this preserves the exact side-effect order (codex design
     // review): commit first (the only mutation), then resolve the
     // transcript, then run the compact gate with that transcript, then scan the
@@ -1641,13 +3285,41 @@ function runMarkerPhase(args, project, appliedPaths, ok) {
     // apply's stage+commit. A lock-timeout is treated exactly like any other
     // commit failure below (skip the marker, surface the reason) rather than
     // crashing the apply.
+    //
+    // registerPendingTagsLocked runs INSIDE this same lock, right before the
+    // commit: a SCHEMA.md registration it makes here
+    // pushes 'SCHEMA.md' onto `appliedPaths` first, so commitWikiChanges below
+    // picks it up in the SAME commit this apply is already making, atomically.
+    // The HEAD read happens in this same critical section too, never a
+    // second, unlocked `git rev-parse HEAD` afterwards, which a concurrent
+    // close landing in the gap could move.
+    let headAfterCommit = null;
     try {
-      commitOutcome = withFileLock(vaultCommitLockTarget(args.hypoDir), () =>
-        commitWikiChanges(args.hypoDir, appliedPaths),
-      );
+      const locked = withFileLock(vaultCommitLockTarget(args.hypoDir), () => {
+        registerPendingTagsLocked(
+          args,
+          preflightLint,
+          hasConflicts,
+          appliedPaths,
+          proofEntries,
+          attemptId,
+        );
+        const outcome = commitWikiChanges(args.hypoDir, appliedPaths);
+        const head = readHeadShaLocked(args.hypoDir);
+        return { outcome, head };
+      });
+      commitOutcome = locked.outcome;
+      headAfterCommit = locked.head;
     } catch (err) {
       commitOutcome = { committed: false, reason: `vault-commit-lock: ${err?.message || err}` };
     }
+    // Once these bytes are committed, the journal's only job (telling a
+    // retry's own uncommitted work apart from someone else's) is done —
+    // clear it rather than let a stale record outlive this close and later
+    // match a coincidence it was never meant to license. A commit that
+    // failed leaves the journal in place on purpose: that is exactly the
+    // case the next retry needs it for.
+    if (commitOutcome.committed) clearJournal(args.hypoDir, args.sessionId);
     let closeTranscript = null;
     let gateOk = false;
     // verified_scope evidence (session-close-scope-boundary spec §3, revised
@@ -1656,6 +3328,7 @@ function runMarkerPhase(args, project, appliedPaths, ok) {
     // (uncommitted, no transcript) — normalizeVerifiedScope drops an empty
     // 'global' scope to "field absent" rather than persist a false claim.
     let gateEvaluatedProjects = [];
+    let gateSkipped = { lint: false, feedback: false };
     if (commitOutcome.committed) {
       closeTranscript = resolveTranscriptBySessionId(args.sessionId);
       // closeScope: apply KNOWS which project it just closed, and it wrote
@@ -1680,8 +3353,18 @@ function runMarkerPhase(args, project, appliedPaths, ok) {
         closeScope: [project],
         ...(closeTranscript ? { transcriptPath: closeTranscript } : {}),
         ...(autoMarkerOverride ? { attributionScope: autoMarkerOverride } : {}),
+        // This is one of the two marker-writing paths that must share ONE
+        // `ok` invariant with `--mark-session-closed`. checkpointMode narrows the git axis to "is
+        // there an uncommitted write THIS session still owns" instead of
+        // refusing on any unattributed dirty root file; every other axis
+        // (close files, cwd, hot, lint, W8, feedback) is unchanged.
+        checkpointMode: true,
+        sessionId: args.sessionId,
       });
       gateOk = gateStatus.ok;
+      gateNotices = gateStatus.notices || [];
+      gateBlockers = gateStatus.ok ? [] : gateStatus.blockers || [];
+      gateSkipped = gateStatus.skipped || gateSkipped;
       // `closeScope` above widens the partition, it never narrows
       // sessionCloseGlobalStatus (only opts.projectOverride does, and this
       // call never sets it) — so gate.close.projects is the actual evaluated
@@ -1699,19 +3382,37 @@ function runMarkerPhase(args, project, appliedPaths, ok) {
       transcriptResolved: !!closeTranscript,
       // Scan the signal only when the gate passed AND a transcript resolved —
       // isCloseGateOpen never runs earlier than the original nested `else if`.
-      // Reads the raw walkCloseGate open, not closeGateStatus: this apply's
-      // OWN recordGateClosed call above already ran with this transcript's
-      // full record count as closedAtIndex, and openedAtIndex can never reach
-      // or pass a count taken from the very same transcript (see
-      // closeGateStatus's doc comment) — so gating this diagnostic on .ok
-      // would read false on every apply, unconditionally, not just a stale
-      // one. This field asks a narrower question than closeGateStatus
-      // answers: "did the transcript carry a close signal", not "is this
-      // apply itself still authorized" (verifyCloseAuthority already settled
-      // that, before any byte was written).
+      // Reads the raw walkCloseGate open, not closeGateStatus: closeGateStatus
+      // would also weigh this session's recorded resolution, and the
+      // resolution below is now written ONLY once the marker itself lands
+      // (this change). A retry after a withheld marker (dirty wiki, a
+      // failed commit, a lock timeout) has no resolution recorded yet, but it
+      // still needs THIS check to see the transcript's existing close phrase
+      // as authorization, not a fresh one. This field asks a narrower
+      // question than closeGateStatus answers: "did the transcript carry a
+      // close signal", not "is this apply itself still authorized to run at
+      // all" (verifyCloseAuthority already settled that, before any byte was
+      // written).
       hasUserSignal: gateOk && !!closeTranscript && isCloseGateOpen(closeTranscript),
     });
     markerSkipReason = decision.skipReason;
+    // MAJOR FIX (codex cross-review round 5): the marker phase reads the raw
+    // walkCloseGate boolean above (`hasUserSignal`) on purpose: see that
+    // field's own comment for why closeGateStatus's resolution-aware answer
+    // would be the wrong question here. That deliberate choice is exactly why
+    // this path had no access to WHICH tag, if any, retracted the close: the
+    // boolean alone cannot say. Compute closeGateStatus's reason string
+    // separately, purely for diagnostics, only on the branch that actually
+    // withheld the marker for lack of a signal: `!open` is guaranteed true
+    // here too (same transcript, same walk), so closeGateStatus's resolution
+    // check never runs and this cannot silently change `decision` above.
+    if (markerSkipReason === 'no-user-close-signal' && closeTranscript) {
+      markerGateReason = closeGateStatus({
+        transcriptPath: closeTranscript,
+        hypoDir: args.hypoDir,
+        sessionId: args.sessionId,
+      }).reason;
+    }
     if (decision.write) {
       // apply KNOWS its authoritative payload.project — stamp it as the v4
       // evidence set so PreCompact trusts this marker's scope directly (session-close attribution).
@@ -1721,23 +3422,151 @@ function runMarkerPhase(args, project, appliedPaths, ok) {
       // call never sets it. The gate ran unnarrowed, so `kind` is 'global',
       // with `projects` the set gate.close actually evaluated
       // (gateEvaluatedProjects), never `[project]` verbatim.
-      writeSessionClosedMarker(args.hypoDir, args.sessionId, {
-        project,
-        projects: [project],
-        verifiedScope: { kind: 'global', projects: gateEvaluatedProjects },
-      });
-      // Codex CONCERN: the writer swallows IO errors (best-effort).
-      // Verify the file actually landed — mirroring the standalone path — instead of
-      // asserting markerWritten=true, so a .cache permission/disk problem surfaces
-      // rather than the caller reporting "closed" while the next Stop re-blocks.
-      if (existsSync(sessionClosedMarkerPath(args.hypoDir, args.sessionId))) {
-        markerWritten = true;
+      // The marker is only ever written on a run whose commit already landed
+      // (that commit is a precondition of reaching here), so the copy stored
+      // in the marker is the one that can honestly name both halves of the
+      // undo: revert that commit, and delete this file.
+      // commitShaForUndo(commitOutcome) here is a string (the commit that
+      // just landed above) or `null` (this round's scope was `scoped: 0`,
+      // so there is nothing to revert). Never `undefined`: the commit
+      // already ran by this point, so "caller did not say" would be a
+      // worse answer than the real one this call already has.
+      const markerHostTagWarning = hostTagWarningWithUndo(
+        hostTagWarning,
+        'commit-and-marker',
+        args.hypoDir,
+        args.sessionId,
+        commitShaForUndo(commitOutcome),
+      );
+      // Certify the close BEFORE writing the compat marker.
+      // `commitOutcome.sha` is unset on a `scoped: 0` no-op (nothing this
+      // apply wrote needed a fresh commit: every target was already
+      // current), so C falls back to the HEAD this same lock read a moment
+      // ago.
+      const commitSha = commitOutcome.sha || headAfterCommit;
+      const repo = commitSha ? repoIdentity(args.hypoDir) : null;
+      if (commitSha && repo) {
+        const verify = verifyEntriesInCommit(args.hypoDir, commitSha, proofEntries);
+        if (verify.ok) {
+          const receiptGeneration = randomBytes(16).toString('hex');
+          const receipt = {
+            schemaVersion: RECEIPT_SCHEMA_VERSION,
+            certification: CERT_CHECKPOINT,
+            generation: receiptGeneration,
+            sessionId: args.sessionId,
+            repo,
+            commit: commitSha,
+            // The project this apply proved, not the wider set the gate
+            // evaluated: the entries above prove only this project's files.
+            // The marker's verified_scope below still records the evaluated set.
+            scope: { mode: 'project', projects: [project] },
+            entries: proofEntries,
+            skipped: gateSkipped,
+            createdAt: new Date().toISOString(),
+          };
+          // Receipt, then marker, and the receipt comes back out if the marker
+          // does not land (see landReceiptThenMarker). The writer swallows IO
+          // errors (best-effort), so the helper checks the file actually
+          // landed instead of this path asserting markerWritten=true: a
+          // .cache permission/disk problem must surface rather than the
+          // caller reporting "closed" while the next Stop re-blocks. That
+          // check decides whether the close signal below gets spent, and
+          // spending it on a marker this run did not write is the failure
+          // this whole phase was reordered to avoid.
+          const landed = landReceiptThenMarker(args.hypoDir, args.sessionId, receipt, () =>
+            writeSessionClosedMarker(args.hypoDir, args.sessionId, {
+              project,
+              projects: [project],
+              verifiedScope: { kind: 'global', projects: gateEvaluatedProjects },
+              // Carried through from refuseUnlessCloseRequested's gate check,
+              // computed once before any write in this apply and unchanged since:
+              // this close survived a HOST_TAG_NAMES-shaped queue item reading as
+              // neutral, so the marker records the same residual the console
+              // output also warns about once.
+              ...(markerHostTagWarning ? { hostTagWarning: markerHostTagWarning } : {}),
+              // Names the receipt this marker is a compat projection
+              // of. A new Stop refuses to trust this marker alone once it sees
+              // this field: it must find the matching, valid receipt too.
+              receiptGeneration,
+            }),
+          );
+          if (landed.ok) {
+            markerWritten = true;
+            // Close-gate resolution: record it here, ONLY now that the RECEIPT
+            // has landed (a close approval is spent only after the receipt
+            // lands), not merely once the compat marker exists.
+            // Recording it earlier used to sit right after `ok && args.sessionId`,
+            // ahead of commit, gate, and marker entirely, on the theory that the
+            // wiki writes already happened so the resolution should stick
+            // regardless. That let a run which committed the payload but then
+            // had its marker withheld (compact-gate-not-ok on a dirty wiki, a
+            // lock timeout, a disk failure) burn the session's one close signal
+            // anyway: the next run hit closeGateStatus's
+            // `no-new-open-since-resolution` and refused, with no marker ever
+            // written and no way back short of a brand-new user close phrase.
+            // Tying the record to a landed receipt+marker means a withheld one
+            // leaves the signal untouched, so a retry (once the wiki is clean,
+            // the proof mismatch is fixed, or the transient failure clears) is
+            // still authorized by the same close phrase. `closeTranscript` is
+            // reused here rather than re-resolved: `decision.write` can only be
+            // true when `transcriptResolved` was true in `planMarkerDecision`'s
+            // inputs above, so it is guaranteed non-null at this point.
+            //
+            // Best-effort like every other write in this store: resolutionStamp
+            // returns null on anything it cannot read as a Buffer, recordGateClosed
+            // refuses a null stamp, and both fail silently, so a transcript that
+            // vanishes mid-read (or a cache-write failure) can never turn an
+            // otherwise-successful close into a failure.
+            try {
+              recordGateClosed(
+                args.hypoDir,
+                args.sessionId,
+                resolutionStamp(readFileSync(closeTranscript)),
+              );
+            } catch {
+              // Unreadable at the moment of a successful close is not this
+              // apply's problem to surface, the resolution just stays
+              // unrecorded, same as if this session had never resolved at all
+              // (NO_CONSTRAINT).
+            }
+          } else if (landed.reason === 'receipt-write-failed') {
+            markerSkipReason = 'receipt-write-failed';
+            receiptMismatches = [
+              { path: '(receipt)', reason: landed.writeReason },
+              ...(landed.retractFailed
+                ? [{ path: '(receipt)', reason: `retract-failed: ${landed.retractFailed}` }]
+                : []),
+            ];
+          } else {
+            markerSkipReason = 'marker-did-not-land';
+            // The receipt was withdrawn. Only when even that failed is there
+            // something to report beside the stage, because a valid receipt is
+            // then left standing behind a run that exits 1.
+            if (landed.retractFailed) {
+              receiptMismatches = [
+                { path: '(receipt)', reason: `retract-failed: ${landed.retractFailed}` },
+              ];
+            }
+          }
+        } else {
+          markerSkipReason = 'receipt-proof-mismatch';
+          receiptMismatches = verify.mismatches;
+        }
       } else {
-        markerSkipReason = 'marker-did-not-land';
+        markerSkipReason = 'receipt-proof-mismatch';
+        receiptMismatches = [{ path: '(commit)', reason: 'no-commit-identity' }];
       }
     }
   }
-  return { markerWritten, markerSkipReason, commitOutcome };
+  return {
+    markerWritten,
+    markerSkipReason,
+    markerGateReason,
+    commitOutcome,
+    gateNotices,
+    gateBlockers,
+    receiptMismatches,
+  };
 }
 
 // A conflict outranks the downstream gates: verification and lint both describe
@@ -1773,14 +3602,24 @@ function buildCloseResult({
   proposals,
   proposalStoreFailed,
   proposalStoreFailures,
+  parkedTotal,
+  parkedUnreadable,
+  parkedOrphanTmp,
   verification,
   sessionId,
   markerWritten,
   markerSkipReason,
+  markerGateReason,
+  receiptMismatches,
   preflightLint,
   postApplyLint,
   closeScopeNotice,
   otherDebtCount,
+  gateNotices,
+  gateBlockers,
+  restructureWaivers,
+  obsoleteNotices,
+  hostTagWarning,
 }) {
   return {
     ok,
@@ -1810,12 +3649,36 @@ function buildCloseResult({
     // NO artifact and is re-tried automatically by the next close. `proposedContent`
     // is dropped from the reported shape either way (the artifact / the next close
     // holds the bytes; a whole page or an append entry does not belong in the JSON).
-    conflicts: conflicts.map(({ proposedContent: _drop, ...rest }) => rest),
+    // `why` is the human-readable cause (conflictWhy), the same string
+    // printCloseReport already prints in the non-JSON path — a `--json` close
+    // used to carry only the raw `reason` code here, so the caller had no prose
+    // to surface and the fix to conflictWhy's wording never reached a `--json`
+    // close (which is how every real close runs; printCloseReport is a path a
+    // normal apply never takes).
+    conflicts: conflicts.map((c) => {
+      const { proposedContent: _drop, ...rest } = c;
+      return { ...rest, why: conflictWhy(c) };
+    }),
     // Parked overwrite proposals (id/target/path), one per drifted overwrite
     // target. Empty when only append conflicts (or none) occurred. The T7 CLI
     // lists and applies these; append conflicts never appear here.
     proposals,
     ...(proposalStoreFailed ? { proposalStoreFailures } : {}),
+    // Vault-wide count of every parked write-proposal artifact (this close's own
+    // new ones included), same visibility contract as `otherDebtCount` below:
+    // always present so a caller cannot mistake a missing key for zero, and
+    // never gated (a growing pile of parks is a review backlog, not a close
+    // failure). `null` means the inventory itself could not be enumerated, not
+    // that it is empty; see the comment where this is computed. A caller must
+    // check for `null` before treating this as a count.
+    parkedTotal,
+    // Filenames under `.cache/proposals` that exist as `.json` candidates but
+    // could not be parsed into an artifact (see the comment where this is
+    // computed). Always present, possibly empty, never folded into
+    // parkedTotal above, and never allowed to silently disappear the way it
+    // did before this field existed.
+    parkedUnreadable,
+    parkedOrphanTmp,
     // Partial close: some overwrite direct-writes (and/or appends) already landed
     // on disk while at least one conflict withheld the rest. Because the close is
     // ok:false, commitWikiChanges + the marker are skipped — so those written
@@ -1827,8 +3690,25 @@ function buildCloseResult({
       : {}),
     verification,
     // Surface the marker outcome instead of skipping silently, so the
-    // caller can tell "closed" from "applied but not marked".
-    ...(sessionId ? { markerWritten, markerSkipReason } : {}),
+    // caller can tell "closed" from "applied but not marked". `markerGateReason`
+    // (MAJOR FIX, codex cross-review round 5) is closeGateStatus's own reason
+    // string, present only when `markerSkipReason` is 'no-user-close-signal'.
+    // The raw-boolean decision this phase actually acts on (see runMarkerPhase's
+    // `hasUserSignal` comment) stays unchanged; this only adds the diagnostic a
+    // maintainer needs to tell a stale HOST_TAG_NAMES allowlist apart from an
+    // ordinary retraction, the same detail verifyCloseAuthority's own
+    // `gateReason` already carries for the earlier, whole-apply refusal.
+    ...(sessionId
+      ? {
+          markerWritten,
+          markerSkipReason,
+          ...(markerGateReason ? { markerGateReason } : {}),
+          // Present only when markerSkipReason is 'receipt-proof-mismatch'
+          // or 'receipt-write-failed': the entries that failed to verify against
+          // the commit, or the single reason the receipt write itself failed.
+          ...(receiptMismatches ? { mismatches: receiptMismatches } : {}),
+        }
+      : {}),
     lint: {
       preflight: summarizeLintForOutput(preflightLint),
       postApply: summarizeLintForOutput(postApplyLint),
@@ -1840,11 +3720,54 @@ function buildCloseResult({
     // pages, root files) folds into otherDebtCount so the same untouched-file
     // debt does not re-list its filenames on every close (run `node
     // scripts/lint.mjs` for the full list).
-    notices: [...new Set(closeScopeNotice.map((e) => e.file))],
+    // Obsolete-field lines lead, then the lint-debt filenames. The two share
+    // this array because both mean "read this, nothing is blocked on it", and a
+    // reader that expected only filenames still gets a string it can print.
+    notices: [...(obsoleteNotices || []), ...new Set(closeScopeNotice.map((e) => e.file))],
     otherDebtCount,
+    // Separate from `notices` above, which is lint debt. These are the close
+    // GATE's demotions: what it declined to block on. `--mark-session-closed`
+    // has always reported them and this path did not, so a demotion on the
+    // canonical close path was invisible — the gate's promise is that it never
+    // waves something through silently, and half the paths were breaking it.
+    // A new key rather than a merge into `notices`, whose entries are filename
+    // strings that an existing reader would choke on if they became objects.
+    gateNotices: gateNotices || [],
+    // The checkpoint gate's own blockers when it refused the marker
+    // (markerSkipReason compact-gate-not-ok); empty otherwise. --check-session-close
+    // judges the whole vault on a wider git axis, so it is not a substitute.
+    gateBlockers: gateBlockers || [],
+    // Always present (possibly empty), same visibility contract as `notices`/
+    // `otherDebtCount` above — a caller should not have to guess whether the
+    // key's absence means "none" or "this apply predates the field". One entry
+    // per overwrite field where `restructure: true` was claimed on a REAL
+    // section-loss trip (a field that carried the flag but never had a loss to
+    // waive adds no entry here). The claim no longer applies the write:
+    // the matching target is still in `conflicts` above, withheld
+    // pending human approval via `proposal challenge`/`proposal resolve`; this
+    // is only the audit trail of what the payload author asserted.
+    restructureWaivers,
+    // Present when this close survived a HOST_TAG_NAMES-shaped queue item
+    // reading as neutral (see closeGateStatus's own field doc comment) AND
+    // this run left something on disk to take back. NOT gated on `ok`: the
+    // caller settled that question with hostTagUndoKind and passed null when
+    // there was nothing to undo, which is what lets the warning still reach a
+    // reader on 'marker-did-not-land' (committed, ok:false). This is the
+    // `--json` half of the warn-once contract; printCloseReport below carries
+    // the same string to the console path, and the marker (runMarkerPhase)
+    // carries its own wording to a reader of that file after the fact. All of
+    // them descend from ONE walk result computed before any write in this
+    // apply, so there is one warning per run, not one per gate read.
+    ...(hostTagWarning ? { hostTagWarning } : {}),
   };
 }
 
+// Where to send a person for doctor. Both forms, no runtime guess: the
+// `hypomnema` bin comes only with the npm install, so a plugin-only user has
+// `/hypo:doctor` and nothing else, and a shell user may have only the bin.
+const DOCTOR_HINT =
+  'doctor (`/hypo:doctor` in Claude Code, or `hypomnema doctor` with the npm CLI)';
+
 // The human-readable (non --json) rendering of the same settled state.
 function printCloseReport({
   project,
@@ -1853,31 +3776,48 @@ function printCloseReport({
   skipped,
   conflicts,
   proposals,
+  parkedTotal,
+  parkedUnreadable,
+  parkedOrphanTmp,
   ok,
   markerWritten,
   markerSkipReason,
+  markerGateReason,
   verification,
   postLintOk,
   postBlocking,
   closeScopeNotice,
   otherDebtCount,
+  restructureWaivers,
+  obsoleteNotices,
+  hostTagWarning,
 }) {
   console.log(`Session-close apply (project: ${project}, date: ${date}):`);
   for (const a of applied) console.log(`  ✓ wrote ${a}`);
   for (const s of skipped) console.log(`  · skipped ${s} (already current)`);
+  // Not a skip and not a conflict: a field this apply no longer has a target
+  // for. Printed before the rest so an old payload's author sees it even when
+  // the close otherwise succeeds and they stop reading at the ✓ line.
+  for (const n of obsoleteNotices || []) console.log(`  · ${n}`);
+  // Surfaced unconditionally, success or failure. `restructure: true` no
+  // longer waives the guard: the target below is still WITHHELD
+  // and shows up in the conflicts loop right after this one. This line only
+  // flags that the payload author claimed the drop was intentional, so a human
+  // reviewing the parked proposal has that context before typing the nonce.
+  for (const w of restructureWaivers) {
+    console.log(
+      `  ⚠ restructure:true claimed for ${w.target}, parked pending human approval. Dropped: ${w.lostSections.join(', ')}`,
+    );
+  }
   // Never let a withheld target read as a skip: `skipped` means "already current",
-  // this means "your bytes are NOT on disk". Overwrite conflicts drifted from base;
-  // an append conflict is a lock-timeout (someone else held the file's lock), which
-  // is transient — the next close re-applies.
+  // this means "your bytes are NOT on disk".
   for (const c of conflicts) {
-    const why =
-      c.kind === 'append'
-        ? 'could not acquire the append lock in time; the next close re-applies'
-        : 'the page changed since this session read it';
-    console.log(`  ⚠ WITHHELD ${c.key} (${c.target}) — ${c.reason}; ${why}`);
+    console.log(`  ⚠ WITHHELD ${c.key} (${c.target}) — ${c.reason}; ${conflictWhy(c)}`);
   }
   for (const p of proposals) {
-    console.log(`  · parked proposal ${p.id} for ${p.target} (review with \`hypomnema proposal\`)`);
+    console.log(
+      `  · parked proposal ${p.id} for ${p.target} (review it through \`/hypo:crystallize\`, or \`hypomnema proposal list\` with the npm CLI)`,
+    );
   }
   if (applied.length > 0 && conflicts.length > 0) {
     console.log(
@@ -1886,19 +3826,73 @@ function printCloseReport({
         '  target(s) are resolved and the close re-runs.',
     );
   }
+  // Surfaced unconditionally, success or failure. This used to sit inside the
+  // `if (ok)` success branch below, so a close that just parked a NEW overwrite
+  // conflict (`ok:false`, `stage: 'proposal-pending'`, exactly the case that
+  // grows this total) never printed it: a terminal-only user saw the id(s)
+  // this run just withheld (the `parked proposal <id>` lines above) but never
+  // the vault-wide count they add to. `doctor`, not `proposal list`, is where
+  // the breakdown lives: this total mixes pending, already-approved-but-
+  // unreconciled, and evidence-broken artifacts (see `classifyProposals`), and
+  // telling every one of them to "review" the whole number would send a human
+  // back to artifacts `proposal reconcile` had already settled.
+  if (parkedTotal === null) {
+    console.log(
+      `  · parked write-proposal count unavailable: \`.cache/proposals\` could not be listed (run ${DOCTOR_HINT}).`,
+    );
+  } else if (parkedTotal > 0) {
+    console.log(
+      `  · ${parkedTotal} parked write-proposal artifact(s) vault-wide: run ${DOCTOR_HINT} for a breakdown by state.`,
+    );
+  }
+  // Surfaced unconditionally too, and NOT folded into the parkedTotal branch
+  // above: this is exactly the case a reader would otherwise never see, a
+  // vault whose only `.cache/proposals` contents are unreadable prints
+  // `parkedTotal` as either 0 or null and, before this line existed, nothing
+  // else. `doctor` is still where a human goes to act on this; `--json`
+  // carries the same filenames in `parkedUnreadable`.
+  if (parkedUnreadable.length > 0) {
+    const shown = parkedUnreadable.slice(0, 3).join(', ');
+    const rest = parkedUnreadable.length > 3 ? `, +${parkedUnreadable.length - 3} more` : '';
+    console.log(
+      `  ⚠ ${parkedUnreadable.length} file(s) in .cache/proposals could not be read or parsed (corrupt, permission-denied, or hand-edited): ${shown}${rest}. Not counted above; run ${DOCTOR_HINT} to inspect.`,
+    );
+    // This line is the one a person actually reads after a close; doctor is a
+    // second command they may never run. Without this sentence the wording
+    // above tells them a recoverable proposal body is corrupt, and the obvious
+    // response to "corrupt" is to delete it. Naming the count here and the
+    // exact restore command in doctor keeps this line short without leaving
+    // the destructive reading as the only one available.
+    if (parkedOrphanTmp.length > 0) {
+      console.log(
+        `    ↳ ${parkedOrphanTmp.length} of those are not corrupt: a writer finished but its rename never landed, so the body is probably intact. Do not delete them; ${DOCTOR_HINT} prints the command that restores each one.`,
+      );
+    }
+  }
   if (ok) {
     // When the marker was withheld, qualify the success line so a reader scanning
     // stdout alone cannot mistake "verified" for "fully closed". markerSkipReason
     // is non-null exactly when args.sessionId is set and the marker did not land.
     if (markerSkipReason) {
       console.log(
-        '\n✓ session-close files verified (all 5 mandatory files fresh, lint clean).' +
+        '\n✓ session-close files verified (all 4 mandatory files fresh, lint clean).' +
           '\n  session NOT fully closed: the Stop-chain marker was not written (see warning below).',
       );
     } else {
-      console.log('\n✓ session-close verified — all 5 mandatory files fresh, lint clean.');
+      console.log('\n✓ session-close verified (all 4 mandatory files fresh, lint clean).');
     }
   }
+  // Warn once per run, not on every gate read, which is exactly the
+  // repeated-nag cost the enqueue-branch reversion in hooks/hypo-shared.mjs
+  // was measured against. Deliberately outside the `ok` block above: the
+  // caller already decided whether this run left anything to take back
+  // (hostTagUndoKind) and passed null when it did not, and the string it
+  // passed names only what this run actually did. Gating on `ok` here is what
+  // silenced the warning on 'marker-did-not-land', where the payload was
+  // committed and only the marker write failed.
+  if (hostTagWarning) {
+    console.log(`\n⚠ ${hostTagWarning}`);
+  }
   // When ok:true but the session-close marker was NOT written, the Stop-chain
   // still sees an open session and will re-prompt at the next Stop. Surface this
   // loudly so neither the human nor a skill-following model reads "ok:true" as
@@ -1906,16 +3900,74 @@ function printCloseReport({
   // written" line cannot fire on the contradiction-B path (a written marker that
   // also carried a skip reason) — there the invariant's own 🛑 line already
   // explains the failure, and this message would contradict markerWritten:true.
+  //
+  // Two shapes reach here now, and they need different words. A policy withhold
+  // still leaves ok:true and asks for the right --session-id. A marker write
+  // that genuinely failed flips ok to false, so claiming "(ok:true)" there
+  // would contradict the JSON this same run printed, and pointing at
+  // --session-id would send the user after a problem they do not have.
+  //
+  // Note this whole block only runs on the non-JSON path; the documented
+  // production call is --json, which prints nothing here.
   if (markerSkipReason && !markerWritten) {
+    const diskFailure = markerSkipReason === 'marker-did-not-land';
+    // The two receipt stages also flip ok to false, and their recoveries are
+    // opposite: one is about what is committed, the other about writing under
+    // .cache/. Neither is the policy withhold the fallback text below describes,
+    // and neither is the gate refusal (compact-gate-not-ok), which stays ok:true.
+    const receiptFailure =
+      markerSkipReason === 'receipt-proof-mismatch'
+        ? `    The 4 mandatory files were applied, but the close checkpoint receipt\n` +
+          `    could not prove them against the commit (see mismatches[] in --json\n` +
+          `    output). This run reports ok:false and exits 1. The session is NOT closed.\n` +
+          `    To fix: check the listed paths with git status, commit the ones you\n` +
+          `    have reviewed, then re-run the same close. No fresh close phrase is needed.\n`
+        : markerSkipReason === 'receipt-write-failed'
+          ? `    The 4 mandatory files were applied and committed, but writing the close\n` +
+            `    checkpoint receipt under .cache/sessions/<session-id>/ failed. This run\n` +
+            `    reports ok:false and exits 1. The session is NOT closed.\n` +
+            `    To fix: clear whatever blocks that directory (permissions, disk space),\n` +
+            `    then re-run the same close. No fresh close phrase is needed.\n`
+          : // A gate refusal keeps ok:true (the files verified) but the marker was denied
+            // by a compact-gate blocker. It is not a session-id problem and not a receipt
+            // problem, so it gets its own words.
+            markerSkipReason === 'compact-gate-not-ok'
+            ? `    The 4 mandatory files were applied and verified, but the compact gate\n` +
+              `    refused the per-session Stop-chain marker because a gate blocker\n` +
+              `    remains. The session is NOT fully closed: the Stop hook will re-prompt\n` +
+              `    until the marker is present. This is not a --session-id problem.\n` +
+              `    To fix: resolve the gate blocker (run git status in the vault: commit\n` +
+              `    or revert an uncommitted file in the project folder being closed, or\n` +
+              `    clear whichever other blocker the gate names), then re-run the same\n` +
+              `    close. No fresh close phrase is needed: a close signal is spent only\n` +
+              `    once the marker lands.\n`
+            : null;
     process.stderr.write(
       `\n⚠️  session-close marker NOT written (reason: ${markerSkipReason})\n` +
-        `    The 5 mandatory files were applied and verified (ok:true), but the\n` +
-        `    per-session Stop-chain marker was withheld. The session is NOT fully\n` +
-        `    closed: the Stop hook will re-prompt until the marker is present.\n` +
-        `    To fix: re-run with the correct main-conversation --session-id (NOT\n` +
-        `    a background task or Agent UUID from a /tmp/... path).\n` +
-        `    Example: crystallize.mjs --apply-session-close --payload=<path>\n` +
-        `             --session-id=<main-conversation-id> --hypo-dir=<path>\n`,
+        // MAJOR FIX (codex cross-review round 5): only present when the reason
+        // is 'no-user-close-signal', and only when a tag-shaped retraction
+        // named itself; see closeGateStatus's own reason string for what a
+        // maintainer does with it. Without this line, the non-JSON path told
+        // the user only that the marker was withheld, never why the gate read
+        // the transcript that way.
+        (markerGateReason ? `    Gate detail: ${markerGateReason}\n` : '') +
+        (receiptFailure ??
+          (diskFailure
+            ? `    The 4 mandatory files were applied and committed, but writing the\n` +
+              `    per-session Stop-chain marker itself failed. This run reports\n` +
+              `    ok:false and exits 1. The session is NOT closed: the Stop hook\n` +
+              `    will re-prompt until the marker is present.\n` +
+              `    To fix: clear whatever blocks the marker path under .cache/\n` +
+              `    (permissions, a directory sitting where the marker file goes,\n` +
+              `    disk space), then re-run the same close. No fresh close phrase\n` +
+              `    is needed: a close signal is spent only once the marker lands.\n`
+            : `    The 4 mandatory files were applied and verified (ok:true), but the\n` +
+              `    per-session Stop-chain marker was withheld. The session is NOT fully\n` +
+              `    closed: the Stop hook will re-prompt until the marker is present.\n` +
+              `    To fix: re-run with the correct main-conversation --session-id (NOT\n` +
+              `    a background task or Agent UUID from a /tmp/... path).\n` +
+              `    Example: crystallize.mjs --apply-session-close --payload=<path>\n` +
+              `             --session-id=<main-conversation-id> --hypo-dir=<path>\n`)),
     );
   }
   if (!ok) {
@@ -1963,7 +4015,16 @@ export function applySessionClose(args) {
     // No-payload "already complete?" probe uses the
     // global invariant, not a recency pick.
     const probe = sessionCloseGlobalStatus(args.hypoDir);
-    if (probe.ok) {
+    // A leftover close-intent record (see closeIntentPath's doc comment)
+    // means some earlier apply began this file set and never finished it.
+    // `probe.ok` is a freshness read alone, so trusting it here would be
+    // exactly the silent "torn set with an already-todayed leftover file"
+    // pass this record exists to catch. Only 'clean' clears the probe:
+    // 'unreadable' and 'uncommitted' fall through the same as 'torn' (see
+    // hasTornCloseIntent's doc comment). A judgment this function could not
+    // make is not evidence of a finished close, and neither are files that
+    // landed without the commit that would have cleared their record.
+    if (probe.ok && hasTornCloseIntent(args.hypoDir) === 'clean') {
       const result = {
         ok: true,
         alreadyComplete: true,
@@ -1983,8 +4044,10 @@ export function applySessionClose(args) {
     // "payload is required" with the same error shape as before.
   }
 
-  refuseUnlessCloseRequested(args);
+  const hostTagWarning = refuseUnlessCloseRequested(args);
   const payload = loadValidatedPayload(args);
+  // Computed off the payload as read, before any write phase can consume it.
+  const obsoleteNotices = obsoleteFieldNotices(payload);
   const project = resolveCloseProject(args, payload);
   const date = payload.date || todayLocal();
   assertPayloadFreshnessContract(args, payload, project, date);
@@ -2007,17 +4070,107 @@ export function applySessionClose(args) {
   // it. T6 turns these into `.cache/proposals/` artifacts; here they are already
   // enough to withhold the bytes and fail the close.
   const conflicts = [];
-  // One bag for the four accumulators, passed to every write phase below. They
+  // Overwrite fields where `restructure: true` was claimed on a REAL
+  // section-loss trip (no longer a waiver, the matching target is
+  // STILL in `conflicts` above, withheld pending human approval). Kept
+  // separate so the audit trail of what the payload author asserted survives
+  // even though it decided nothing.
+  const restructureWaivers = [];
+  // Close-receipt proof entries: one per write phase's own
+  // target, whether this attempt wrote fresh bytes or found them already
+  // current, never for a target withheld to `conflicts`. Consumed by
+  // runMarkerPhase after the commit lands, to verify against the commit
+  // itself rather than trust that a write happened.
+  const proofEntries = [];
+  // One bag for the six accumulators, passed to every write phase below. They
   // push into it in call order; nothing is merged back afterwards, so the
   // report lines keep the exact order the inline version produced.
-  const acc = { applied, skipped, appliedPaths, conflicts };
+  const acc = { applied, skipped, appliedPaths, conflicts, restructureWaivers, proofEntries };
 
-  applyOverwrites(args, payload, project, date, indexRelPath, indexMissing, acc);
+  // Record this set's targets BEFORE the first byte is written (see
+  // closeIntentPath's doc comment above applyOverwrites), and remove the
+  // record only once the commit in runMarkerPhase has landed. A crash
+  // anywhere before that, or a close that ends ok:false, leaves the record
+  // behind on purpose, for hasTornCloseIntent to find on a later probe.
+  //
+  // MAJOR fix: a failed write here used to be swallowed (writeCloseIntent's
+  // own try/catch) and applyOverwrites ran regardless. The one call meant
+  // to leave a witness before any target byte moves left none, silently,
+  // and a crash between the first and second target write then had nothing
+  // for hasTornCloseIntent to find. Refuse the close here instead, before
+  // applyOverwrites is ever reached: zero target bytes are written on this
+  // path, same contract as every other pre-write refusal in this function.
+  const intentResult = writeCloseIntent(
+    args.hypoDir,
+    args.sessionId,
+    closeIntentTargetsFor(payload, project),
+  );
+  if (!intentResult.ok) {
+    const msg =
+      `session-close apply refused before any target file was written: could not record the ` +
+      `close-intent witness under .cache/close-intent/ (${intentResult.reason}). This is usually ` +
+      `a transient lock, permission, or disk problem: fix it and retry; nothing was written.`;
+    const out = {
+      ok: false,
+      stage: 'close-intent-write-failed',
+      error: msg,
+      applied: [],
+      committed: null,
+    };
+    console.log(args.json ? JSON.stringify(out, null, 2) : `✗ ${msg}`);
+    process.exit(1);
+  }
+  applyOverwrites(
+    args,
+    payload,
+    project,
+    date,
+    indexRelPath,
+    indexMissing,
+    acc,
+    intentResult.attemptId,
+  );
+  markCloseIntentApplied(args.hypoDir, args.sessionId, intentResult.attemptId);
   appendSessionLogEntry(args, payload, project, date, acc);
   appendRootLogEntry(args, payload, project, date, acc);
 
   const { proposals, proposalStoreFailures } = parkOverwriteConflicts(args, conflicts);
   const proposalStoreFailed = proposalStoreFailures.length > 0;
+  // Vault-wide total, not just what THIS close just parked: `proposals` above is
+  // this run's own new artifacts, and a close that never parks anything can still
+  // sit behind dozens accumulated by earlier sessions with no path here that says
+  // so. This used to reuse `doctor`'s `classifyProposals` judgment so the two
+  // surfaces could never disagree about the number, but that judgment reads the
+  // WHOLE audit log and re-hashes every recoverable candidate's target file, on
+  // every close, whether or not anything here needs the pending/recoverable/
+  // evidence-broken breakdown. `listProposalsChecked` counts the SAME artifacts
+  // (classifyProposals emits exactly one entry per valid artifact, so the totals
+  // agree) without either cost: a directory listing plus each artifact's own
+  // JSON, nothing from `applied.log` and no target re-read. The breakdown by
+  // state still lives in `hypomnema doctor`, which is what actually tells a
+  // human whether a parked artifact needs review or just a `proposal reconcile`.
+  // `ok: false` here means the inventory itself could not be enumerated
+  // (permissions, or a file sitting where the directory should be): a real
+  // "unmeasured", not "empty", so `parkedTotal` stays `null` rather than lie
+  // that the backlog is zero.
+  const proposalInventory = listProposalsChecked(args.hypoDir);
+  const parkedTotal = proposalInventory.ok ? proposalInventory.proposals.length : null;
+  // Candidate `.json` files inside a LISTABLE `.cache/proposals` that
+  // listProposalsChecked could not parse into an artifact (corrupt, permission-
+  // denied, or hand-edited into an unrecognizable shape). These are not folded
+  // into parkedTotal above (that count stays "artifacts this close's callers
+  // can actually act on"), but a close must never let one sit invisible: before
+  // this field, an unreadable artifact simply vanished from the count, and a
+  // vault with nothing BUT unreadable ones reported `parkedTotal: 0` with no
+  // line anywhere naming the file. Always an array (empty when nothing is
+  // wrong, or when the whole directory could not even be listed, that failure
+  // already reads as `parkedTotal: null`, not a lying zero here).
+  const parkedUnreadable = proposalInventory.unreadable;
+  // Subset of the line above whose bytes are probably intact: the writer
+  // finished and only the rename never landed. Carried as its own field
+  // rather than carved out of parkedUnreadable, so a `--json` consumer that
+  // already counts unreadable files keeps counting the same set.
+  const parkedOrphanTmp = proposalInventory.orphanTmp || [];
 
   // Same-date-tie fix: verify against the SAME project this apply just wrote
   // (`project` = payload.project || probe.project, resolved at the top). Without
@@ -2026,8 +4179,6 @@ export function applySessionClose(args) {
   // a completed close (the 2026-06-09 security-ops-kb incident).
   const verification = sessionCloseFileStatus(args.hypoDir, { projectOverride: project });
 
-  registerPendingTags(args, preflightLint, conflicts.length > 0);
-
   const { postApplyLint, postBlocking, postNotice, postLintOk } = runPostApplyLint(
     args,
     payloadScope,
@@ -2048,11 +4199,42 @@ export function applySessionClose(args) {
   const closeScopeNotice = postNotice.filter((e) => isUnderProjectDirs(e.file, [project]));
   const otherDebtCount = postNotice.length - closeScopeNotice.length;
 
-  const { markerWritten, markerSkipReason, commitOutcome } = runMarkerPhase(
-    args,
-    project,
-    appliedPaths,
-    ok,
+  const {
+    markerWritten,
+    markerSkipReason,
+    markerGateReason,
+    commitOutcome,
+    gateNotices,
+    gateBlockers,
+    receiptMismatches,
+  } = runMarkerPhase(args, project, appliedPaths, ok, hostTagWarning, {
+    preflightLint,
+    hasConflicts: conflicts.length > 0,
+    proofEntries,
+    attemptId: intentResult.attemptId,
+  });
+  // Only a landed commit retires the close-intent record. Everything before
+  // this point (the appends, a withheld conflict, a lint or commit failure)
+  // leaves it in place: see closeIntentPath's doc comment for why an ok:false
+  // close keeps its record.
+  if (commitOutcome?.committed === true) {
+    clearCloseIntent(args.hypoDir, args.sessionId, intentResult.attemptId);
+  }
+  // The residual named by the gate walk (one value, computed before any write
+  // in this apply) paired with the undo THIS run can honestly offer. A run
+  // that neither committed nor wrote a byte gets null back and says nothing:
+  // there is nothing on disk to take back, so a warning would only send the
+  // reader looking for a change that is not there.
+  const hostTagNotice = hostTagWarningWithUndo(
+    hostTagWarning,
+    hostTagUndoKind({
+      committed: commitOutcome?.committed === true,
+      markerWritten,
+      wroteBytes: appliedPaths.length > 0,
+    }),
+    args.hypoDir,
+    args.sessionId,
+    commitShaForUndo(commitOutcome),
   );
 
   let stage = resolveCloseStage({ ok, proposalStoreFailed, conflicts, verification, postLintOk });
@@ -2077,6 +4259,16 @@ export function applySessionClose(args) {
           `    cannot masquerade as a successful close. The applied payload files stand;\n` +
           `    re-running apply is idempotent once the pipeline is fixed.\n`,
       );
+    } else if (ok && markerWriteGenuinelyFailed({ markerWritten, markerSkipReason })) {
+      // Unlike the contradiction above this is not a pipeline bug.
+      // every precondition cleared and the marker write itself still failed, the
+      // one skip reason `--mark-session-closed` also treats as fatal. Unify the
+      // exit code so a caller reading only `$?` cannot see this as a closed
+      // session. The `⚠️ session-close marker NOT written` warning below still
+      // fires unconditionally and names the same reason; this only changes
+      // whether the process exits 0 or 1 over it.
+      ok = false;
+      stage = markerSkipReason;
     }
   }
   const result = buildCloseResult({
@@ -2091,14 +4283,24 @@ export function applySessionClose(args) {
     proposals,
     proposalStoreFailed,
     proposalStoreFailures,
+    parkedTotal,
+    parkedUnreadable,
+    parkedOrphanTmp,
     verification,
     sessionId: args.sessionId,
     markerWritten,
     markerSkipReason,
+    markerGateReason,
+    receiptMismatches,
     preflightLint,
     postApplyLint,
     closeScopeNotice,
     otherDebtCount,
+    gateNotices,
+    gateBlockers,
+    restructureWaivers,
+    obsoleteNotices,
+    hostTagWarning: hostTagNotice,
   });
 
   if (args.json) {
@@ -2111,14 +4313,21 @@ export function applySessionClose(args) {
       skipped,
       conflicts,
       proposals,
+      parkedTotal,
+      parkedUnreadable,
+      parkedOrphanTmp,
       ok,
       markerWritten,
       markerSkipReason,
+      markerGateReason,
       verification,
       postLintOk,
       postBlocking,
       closeScopeNotice,
       otherDebtCount,
+      restructureWaivers,
+      obsoleteNotices,
+      hostTagWarning: hostTagNotice,
     });
   }
   process.exit(ok ? 0 : 1);