wendkeep 0.58.1 → 0.59.0

package/hooks/session-note-io.mjs

@@ -7,32 +7,105 @@
 //
 // `obsidian-common.mjs` já resolvia isso para o SESSION_REGISTRY.json; aqui o mesmo par
 // (tmp + rename, lock por mkdir) fica disponível para a nota de sessão.
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, rmdirSync, statSync, writeFileSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import {
+  existsSync, lstatSync, mkdirSync, readFileSync, renameSync, rmdirSync, statSync, unlinkSync,
+  writeFileSync,
+} from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import {
+  assertVaultPathSafe, VAULT_LOCK_BUSY, withVaultPathLock, writeVaultFileAtomic,
+} from './vault-path-safety.mjs';
 
 export const LOCK_BUSY = Symbol('wendkeep:lock-busy');
+export const LOCK_OWNER_FILE = '.owner.json';
+
+function lockOwnerPath(lock) {
+  return `${lock}/${LOCK_OWNER_FILE}`;
+}
+
+function readLockOwner(lock) {
+  try {
+    const owner = JSON.parse(readFileSync(lockOwnerPath(lock), 'utf8'));
+    if (owner?.v !== 1 || !Number.isInteger(owner.pid) || owner.pid <= 0
+        || typeof owner.token !== 'string' || !owner.token) return null;
+    return owner;
+  } catch {
+    return null;
+  }
+}
+
+function processIsAlive(pid) {
+  if (pid === process.pid) return true;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    // EPERM means the process exists but this user cannot signal it.
+    return error?.code === 'EPERM';
+  }
+}
+
+function releaseUnownedLockDir(lock) {
+  try { unlinkSync(lockOwnerPath(lock)); }
+  catch (error) { if (error?.code !== 'ENOENT') return false; }
+  return releaseLockDir(lock);
+}
 
 // ATENÇÃO: no Windows (Node 24), `rmSync(dir, { recursive: true, force: true })` é um NO-OP
 // SILENCIOSO quando o caminho contém caractere não-ASCII — não remove e não lança. Medido:
 // 20/20 falhas em `02-Sessões`, `ação`, `Mudanças`; 0/20 em caminho ASCII. Como TODA nota de
 // sessão vive sob `02-Sessões/`, usar rmSync aqui deixaria o lock preso para sempre e o
 // segundo escritor desistiria de gravar — perdendo turnos em silêncio.
-// O lock é sempre um diretório vazio, então `rmdirSync` basta e funciona em qualquer caminho.
-export function releaseLockDir(lock) {
+// Locks owner-aware contêm apenas `.owner.json`; locks legados continuam vazios.
+// Quando `expectedToken` é informado, um finally antigo jamais remove um lock que já
+// foi substituído por outro dono (proteção contra ABA).
+export function releaseLockDir(lock, expectedToken = '') {
   try {
+    const ownerPath = lockOwnerPath(lock);
+    if (expectedToken) {
+      const owner = readLockOwner(lock);
+      if (owner?.token !== expectedToken) return false;
+      unlinkSync(ownerPath);
+    } else if (existsSync(ownerPath)) {
+      return false;
+    }
     rmdirSync(lock);
+    return true;
   } catch (error) {
-    if (error?.code === 'ENOENT') return;
-    try { rmSync(lock, { recursive: true, force: true }); } catch { /* lock preso: melhor seguir */ }
+    if (error?.code === 'ENOENT') return true;
+    return false;
   }
 }
 
 const FRONTMATTER = /^---\n[\s\S]*?\n---/;
 
+function inferVaultBase(path) {
+  if (!path) return '';
+  let cursor = resolve(dirname(path));
+  while (true) {
+    try {
+      const brain = lstatSync(join(cursor, '.brain'));
+      if (brain.isDirectory() || brain.isSymbolicLink()) return cursor;
+    } catch (error) {
+      if (error?.code !== 'ENOENT' && error?.code !== 'ENOTDIR') throw error;
+    }
+    const parent = dirname(cursor);
+    if (parent === cursor) return '';
+    cursor = parent;
+  }
+}
+
 export function hasSessionFrontmatter(content) {
   return typeof content === 'string' && FRONTMATTER.test(content);
 }
 
-export function writeFileAtomic(path, content, encoding = 'utf-8') {
+export function writeFileAtomic(path, content, encoding = 'utf-8', { vaultBase = '' } = {}) {
+  if (vaultBase) {
+    return writeVaultFileAtomic(vaultBase, path, content, encoding, {
+      label: 'nota de sessão atômica',
+    });
+  }
   // rename é atômico no mesmo volume: ou o leitor vê o arquivo antigo inteiro, ou o novo.
   const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
   writeFileSync(tmp, content, encoding);
@@ -46,19 +119,46 @@ function waitBriefly(ms) {
 
 // Roda `fn` com o lock do arquivo tomado. Devolve LOCK_BUSY quando o lock não veio dentro
 // do timeout — o chamador desiste da gravação em vez de gravar sem lock.
-export function withPathLock(path, fn, { timeoutMs = 2000, staleMs = 10_000 } = {}) {
+export function withPathLock(path, fn, {
+  timeoutMs = 2000,
+  staleMs = 10_000,
+  vaultBase = '',
+} = {}) {
+  if (vaultBase) {
+    const outcome = withVaultPathLock(vaultBase, path, fn, { timeoutMs, staleMs });
+    return outcome === VAULT_LOCK_BUSY ? LOCK_BUSY : outcome;
+  }
   const lock = `${path}.lock`;
   const deadline = Date.now() + timeoutMs;
+  const token = randomUUID();
 
   while (true) {
     try {
       mkdirSync(lock);
+      try {
+        writeFileSync(lockOwnerPath(lock), `${JSON.stringify({
+          v: 1,
+          pid: process.pid,
+          token,
+          created_at: new Date().toISOString(),
+        })}\n`, { encoding: 'utf8', flag: 'wx' });
+      } catch (error) {
+        // No owner was published, so this is still a legacy-empty directory owned by us.
+        releaseUnownedLockDir(lock);
+        throw error;
+      }
       break;
     } catch (error) {
       if (error?.code !== 'EEXIST') throw error;
       try {
-        // Lock morto (processo caiu antes do finally) não pode travar a sessão inteira.
-        if (Date.now() - statSync(lock).mtimeMs > staleMs) releaseLockDir(lock);
+        if (Date.now() - statSync(lock).mtimeMs > staleMs) {
+          const owner = readLockOwner(lock);
+          // An old mtime is not proof of death: synchronous critical sections cannot
+          // heartbeat. Reap only a legacy-empty lock or a verified dead PID.
+          if (owner) {
+            if (!processIsAlive(owner.pid)) releaseLockDir(lock, owner.token);
+          } else releaseUnownedLockDir(lock);
+        }
       } catch { /* outro processo pode ter liberado o lock no meio da checagem */ }
       // O deadline é checado SEMPRE, inclusive depois de tentar remover um lock morto:
       // `releaseLockDir` engole a falha, então um `continue` direto giraria para sempre.
@@ -70,7 +170,7 @@ export function withPathLock(path, fn, { timeoutMs = 2000, staleMs = 10_000 } =
   try {
     return fn();
   } finally {
-    releaseLockDir(lock);
+    releaseLockDir(lock, token);
   }
 }
 
@@ -78,16 +178,31 @@ export function withPathLock(path, fn, { timeoutMs = 2000, staleMs = 10_000 } =
 // O mutator devolve o conteúdo novo, ou `null` para abortar sem gravar (o caminho
 // fail-closed de quem leu uma nota corrompida).
 export function mutateSessionNote(path, mutator, options = {}) {
-  if (!path || !existsSync(path)) return { written: false, reason: 'missing', content: null };
+  const vaultBase = options.vaultBase || inferVaultBase(path);
+  let target = path;
+  if (vaultBase) {
+    const checked = assertVaultPathSafe(vaultBase, path, {
+      expectedType: 'file', label: 'nota de sessão',
+    });
+    if (!checked.exists) return { written: false, reason: 'missing', content: null };
+    target = checked.target;
+  } else if (!path || !existsSync(path)) {
+    return { written: false, reason: 'missing', content: null };
+  }
 
-  const outcome = withPathLock(path, () => {
-    const original = readFileSync(path, 'utf-8');
+  const outcome = withPathLock(target, () => {
+    if (vaultBase) {
+      assertVaultPathSafe(vaultBase, target, {
+        allowMissing: false, expectedType: 'file', label: 'nota de sessão',
+      });
+    }
+    const original = readFileSync(target, 'utf-8');
     const next = mutator(original);
     if (next === null || next === undefined) return { written: false, reason: 'aborted', content: original };
     if (next === original) return { written: false, reason: 'unchanged', content: original };
-    writeFileAtomic(path, next);
+    writeFileAtomic(target, next, 'utf-8', { vaultBase });
     return { written: true, reason: 'ok', content: next };
-  }, options);
+  }, { ...options, vaultBase });
 
   if (outcome === LOCK_BUSY) return { written: false, reason: 'busy', content: null };
   return outcome;

package/hooks/session-observability.mjs

@@ -159,7 +159,9 @@ export function buildSessionObservability({ sessionContent, transcriptPath }) {
   return { snapshot, content: upsertObservabilitySection(content, renderSessionObservability(snapshot)) };
 }
 
-export function updateSessionObservability({ sessionPath, transcriptPath, caller = 'unknown', canonicalConversationId = '', lockTimeoutMs }) {
+export function updateSessionObservability({
+  vaultBase = '', sessionPath, transcriptPath, caller = 'unknown', canonicalConversationId = '', lockTimeoutMs,
+}) {
   if (!sessionPath || !existsSync(sessionPath)) return null;
   const identity = inspectTranscriptIdentity(transcriptPath);
   let snapshot = null;
@@ -184,7 +186,7 @@ export function updateSessionObservability({ sessionPath, transcriptPath, caller
     if (!result) return null;
     snapshot = result.snapshot;
     return result.content;
-  }, lockTimeoutMs ? { timeoutMs: lockTimeoutMs } : {});
+  }, { ...(lockTimeoutMs ? { timeoutMs: lockTimeoutMs } : {}), vaultBase });
 
   // 'unchanged' também é sucesso: a nota já estava em dia, o snapshot vale.
   return outcome.written || outcome.reason === 'unchanged' ? snapshot : null;

package/hooks/session-stop.mjs

@@ -16,6 +16,12 @@ import { buildSessionMemoryEvents, collectLifecycleEvidence } from './memory-han
 import { enqueueMemoryEvent, projectMemoryOutbox } from './memory-store.mjs';
 import { detectMemoryMode } from './memory-mode.mjs';
 import { sanitizeMemoryText } from './memory-schema.mjs';
+import { assertVaultPathSafe } from './vault-path-safety.mjs';
+import {
+  projectStopMemoryAttempt,
+  recordStopMemoryOutcome,
+  stageStopMemoryAttempt,
+} from './session-memory-lifecycle.mjs';
 import {
   ensureDir,
   findActiveSessionByTranscript,
@@ -527,12 +533,58 @@ export function parseTranscript(transcriptPath) {
   return parseCodexTranscript(transcriptPath);
 }
 
+export function resolveTurnIdentity(transcript, requestedTurnId = '') {
+  const turns = Array.isArray(transcript?.turns) ? transcript.turns : [];
+  const requested = String(requestedTurnId || '');
+  let index = requested
+    ? turns.findIndex((turn) => String(turn?.turnId || '') === requested)
+    : -1;
+  if (requested && index < 0) return null;
+  if (index < 0 && transcript?.latestTurnId) {
+    index = turns.findIndex((turn) => String(turn?.turnId || '') === String(transcript.latestTurnId));
+  }
+  if (index < 0) index = turns.length - 1;
+  const turn = turns[index];
+  if (!turn?.turnId) return null;
+  return {
+    id: String(turn.turnId),
+    order: index + 1,
+    observedAt: String(turn.timestamp || ''),
+  };
+}
+
+function escapeMarkdownBackticks(text) {
+  let escaped = '';
+  let precedingBackslashes = 0;
+  for (const char of String(text || '')) {
+    if (char === '\\') {
+      escaped += char;
+      precedingBackslashes += 1;
+      continue;
+    }
+    if (char === '`') {
+      if (precedingBackslashes % 2 === 0) escaped += '\\';
+      escaped += char;
+      precedingBackslashes = 0;
+      continue;
+    }
+    escaped += char;
+    precedingBackslashes = 0;
+  }
+  return escaped;
+}
+
 function compactText(text, max = 600) {
   const clean = redactSecrets(String(text || ''))
     .replace(/\r/g, '\n')
     .replace(/\n{3,}/g, '\n\n')
     .trim();
-  return truncate(clean || 'Não capturado automaticamente.', max);
+  const source = clean || 'Não capturado automaticamente.';
+  const compact = source.replace(/\s+/g, ' ').trim();
+  const clipped = truncate(source, max);
+  // Um corte no meio de código inline/fence pode casar com backticks da próxima
+  // entrada gerada. Só snippets realmente truncados perdem a formatação incompleta.
+  return compact.length > max ? escapeMarkdownBackticks(clipped) : clipped;
 }
 
 function selectTurn(tx, turnId) {
@@ -776,7 +828,7 @@ function relocateOrphanIterations(content) {
   return insertIntoIteracoes(head, `\n${demoted}`);
 }
 
-export function insertIteration(sessionPath, block, turnId, tx) {
+export function insertIteration(sessionPath, block, turnId, tx, vaultBase = '') {
   let inserted = false;
   // Sob lock: outro hook (subagent-stop) pode estar reescrevendo a mesma nota agora.
   mutateSessionNote(sessionPath, (original) => {
@@ -790,7 +842,7 @@ export function insertIteration(sessionPath, block, turnId, tx) {
     content = insertIntoIteracoes(content, block);
     inserted = true;
     return applyDedicatedSections(content, tx);
-  });
+  }, { vaultBase });
   return inserted;
 }
 
@@ -821,11 +873,13 @@ export function commitSessionMemory(vaultBase, handoff, { projectOptions = {} }
       status: 'projected',
       eventCount: events.length,
       eventIds,
-      checkpoint: {
-        revision: projection.revision,
-        event_cursor: projection.eventCursor,
-        state_hash: projection.stateHash,
-      },
+      checkpoint: projection.checkpoint && typeof projection.checkpoint === 'object'
+        ? { ...projection.checkpoint }
+        : {
+          revision: projection.revision,
+          event_cursor: projection.eventCursor,
+          state_hash: projection.stateHash,
+        },
     };
   } catch (error) {
     return {
@@ -956,7 +1010,7 @@ function replaceClosingSection(content, closing) {
   return `${content.slice(0, index).trimEnd()}\n\n${closing}\n`;
 }
 
-export function finalizeSessionFile(sessionPath, tx, created, endedAt) {
+export function finalizeSessionFile(sessionPath, tx, created, endedAt, vaultBase = '') {
   const pending = extractPending(tx.rawTextForDetection);
   const links = (items) => items.length ? items.map((rel) => `  - ${wikilinkFromRel(rel)}`).join('\n') : '  - Nenhuma';
   const summary = sessionFinalSummary(tx);
@@ -984,7 +1038,7 @@ ${formatPendingClosing(pending)}
       created,
     ),
     closing,
-  ));
+  ), { vaultBase });
 }
 
 export function sessionFinalSummary(tx) {
@@ -1073,7 +1127,7 @@ function applyLinearLinks(sessionPath, tx, vaultBase, sessionRel) {
 
   mutateSessionNote(sessionPath, (original) => (
     upsertListSection(ensureSection(original, 'Issues Linear', '\n## Encerramento'), 'Issues Linear', lines, null)
-  ));
+  ), { vaultBase });
 }
 
 // Triggers Obsidian Local REST API to re-index the vault after file writes.
@@ -1095,7 +1149,18 @@ function pingObsidianVault(apiKey) {
   } catch {}
 }
 
-function main() {
+export function shouldAbortStopAfterStaging(causalStop, memoryAttempt) {
+  const rejectedByV2Revalidation = memoryAttempt?.memory_mode === 'v2'
+    && memoryAttempt?.state === 'skipped';
+  if (rejectedByV2Revalidation) return true;
+  return Boolean(
+    causalStop
+    && !causalStop.canPromoteMemory
+    && memoryAttempt?.state !== 'enqueued'
+  );
+}
+
+export function main({ stageMemory = stageStopMemoryAttempt } = {}) {
   const input = readHookInput();
   if (input.stop_hook_active) {
     writeHookOutput({});
@@ -1126,21 +1191,43 @@ function main() {
     return;
   }
 
-  const sessionPath = join(vaultBase, sessionRel);
-  if (!existsSync(sessionPath)) {
+  const checkedSession = assertVaultPathSafe(vaultBase, join(vaultBase, sessionRel), {
+    expectedType: 'file', label: 'nota de sessão do Stop',
+  });
+  if (!checkedSession.exists) {
     writeHookOutput({});
     return;
   }
+  const sessionPath = checkedSession.target;
 
-  const tx = parseTranscript(input.transcript_path || input.transcriptPath);
-  const turnId = input.turn_id || tx.latestTurnId || String(Date.now());
+  const tx = parseTranscript(identity.transcriptPath || input.transcript_path || input.transcriptPath);
+  const requestedTurnId = String(input.turn_id || input.turnId || '');
   const sessionId = identity.canonicalConversationId;
   const finalizing = shouldFinalizeSession();
+  const turnIdentity = resolveTurnIdentity(tx, requestedTurnId);
+  if (!turnIdentity) {
+    if (finalizing) {
+      const activeId = String(entry.active_activation_id || '');
+      const active = entry.activations?.[activeId] || {};
+      stageMemory(vaultBase, {
+        sessionId,
+        activationId: activeId,
+        activationEpoch: Number(active.epoch || entry.activation_epoch || 0),
+        turnId: requestedTurnId || 'unresolved-turn',
+        turnSequence: Number(entry.last_turn_sequence || 0),
+        disposition: 'ambiguous',
+        observedAt: new Date(0).toISOString(),
+      });
+    }
+    const message = 'wendkeep: Stop ambiguous; o turno solicitado não foi provado pelo transcript.';
+    process.stderr.write(`[wendkeep] ${message}\n`);
+    writeHookOutput({ systemMessage: message });
+    return;
+  }
+  const turnId = turnIdentity.id;
   const now = finalizing ? new Date() : null;
   const endedAt = finalizing ? formatLocalIso(now) : '';
-  const stopTurnSequence = Number.isSafeInteger(Number(input.turn_sequence))
-    ? Number(input.turn_sequence)
-    : Number(entry.last_turn_sequence || 0);
+  const stopTurnSequence = turnIdentity.order;
   const causalStop = finalizing
     ? mutateSessionRegistry(vaultBase, (registry) => {
       const activationId = resolveStopActivation(registry, {
@@ -1152,6 +1239,7 @@ function main() {
       const cas = applyStopActivation(registry, {
         session_id: sessionId,
         activation_id: activationId,
+        turn_id: turnId,
         turn_sequence: stopTurnSequence,
         ended_at: endedAt,
       });
@@ -1176,13 +1264,61 @@ function main() {
       };
     })
     : null;
-  if (causalStop && !causalStop.canPromoteMemory) {
-    const message = `wendkeep: Stop ${causalStop.stopDisposition}; uma activation mais nova foi preservada e a memória não foi promovida.`;
+  let memoryHandoff = null;
+  let memoryAttempt = null;
+  if (finalizing) {
+    let projectId = '';
+    try {
+      const projectPath = join(vaultBase, '.brain', 'PROJECT.json');
+      let checkedProject = assertVaultPathSafe(vaultBase, projectPath, {
+        expectedType: 'file', label: 'autoridade PROJECT.json do Stop',
+      });
+      if (checkedProject.exists) {
+        checkedProject = assertVaultPathSafe(vaultBase, checkedProject.target, {
+          allowMissing: false, expectedType: 'file', label: 'autoridade PROJECT.json do Stop',
+        });
+        projectId = JSON.parse(readFileSync(checkedProject.target, 'utf8')).projectId || '';
+      }
+    } catch (error) {
+      if (error?.code === 'VAULT_PATH_UNSAFE') throw error;
+      /* the staging validator exposes ordinary missing/invalid PROJECT below */
+    }
+    const finalSummary = sessionFinalSummary(tx);
+    const memoryEvidence = collectLifecycleEvidence(vaultBase, {
+      changeSlug: entry.change_slug,
+      summary: finalSummary,
+      noteRel: sessionRel,
+    });
+    memoryHandoff = {
+      projectId,
+      identity,
+      activation: {
+        id: causalStop?.activationId || '',
+        epoch: Number(causalStop?.activation?.epoch || entry.activation_epoch || 0),
+      },
+      turn: { id: turnId, sequence: stopTurnSequence },
+      noteRel: sessionRel,
+      observedAt: turnIdentity.observedAt || new Date(0).toISOString(),
+      summary: finalSummary,
+      evidence: memoryEvidence,
+    };
+    memoryAttempt = stageMemory(vaultBase, {
+      handoff: memoryHandoff,
+      disposition: causalStop?.stopDisposition || 'ambiguous',
+    });
+  }
+  if (shouldAbortStopAfterStaging(causalStop, memoryAttempt)) {
+    const disposition = memoryAttempt?.disposition || causalStop?.stopDisposition || 'ambiguous';
+    if (disposition === 'duplicate' && memoryAttempt?.state === 'duplicate') {
+      writeHookOutput({});
+      return;
+    }
+    const message = `wendkeep: Stop ${disposition}; uma activation mais nova foi preservada e a memória não foi promovida.`;
     process.stderr.write(`[wendkeep] ${message}\n`);
     writeHookOutput({ systemMessage: message });
     return;
   }
-  const logged = insertIteration(sessionPath, buildIterationBlock(tx, input), turnId, tx);
+  const logged = insertIteration(sessionPath, buildIterationBlock(tx, input), turnId, tx, vaultBase);
 
   try {
     applyLinearLinks(sessionPath, tx, vaultBase, sessionRel);
@@ -1191,7 +1327,9 @@ function main() {
   }
 
   try {
-    updateSessionObservability({ sessionPath, transcriptPath, caller: 'stop', canonicalConversationId: sessionId });
+    updateSessionObservability({
+      vaultBase, sessionPath, transcriptPath, caller: 'stop', canonicalConversationId: sessionId,
+    });
   } catch (error) {
     process.stderr.write(`[wendkeep] Token usage falhou: ${error.message}\n`);
   }
@@ -1226,7 +1364,7 @@ function main() {
     createLinkedNotes(vaultBase, formatDate(now), sessionRel, tx),
     findLinkedDerivedNotes(vaultBase, sessionRel),
   );
-  finalizeSessionFile(sessionPath, tx, created, endedAt);
+  finalizeSessionFile(sessionPath, tx, created, endedAt, vaultBase);
   // Link durável sessão↔change: uma seção "Mudanças" ANTES de `## Encerramento`. O append antigo
   // (após o Encerramento) era apagado a cada reopen por stripClosingSection, perdendo a aresta do
   // grafo quando a change fechava antes do turno seguinte. Aqui sobrevive ao reopen e acumula toda
@@ -1239,7 +1377,7 @@ function main() {
     if (wl) {
       mutateSessionNote(sessionPath, (cur) => (
         upsertListSection(ensureSection(cur, 'Mudanças', '\n## Encerramento'), 'Mudanças', [`- ${wl}`], null)
-      ));
+      ), { vaultBase });
     }
   } catch { /* nunca derruba o Stop */ }
   writeControl(vaultBase, {
@@ -1252,40 +1390,24 @@ function main() {
     last_logged_turn_id: turnId,
   });
 
-  let projectId = '';
-  try {
-    projectId = JSON.parse(readFileSync(join(vaultBase, '.brain', 'PROJECT.json'), 'utf8')).projectId || '';
-  } catch { /* store validator reports a degraded handoff below */ }
-  const finalSummary = sessionFinalSummary(tx);
-  const memoryEvidence = collectLifecycleEvidence(vaultBase, {
-    changeSlug: entry.change_slug,
-    summary: finalSummary,
-    noteRel: sessionRel,
-  });
-  const memoryResult = commitSessionMemory(vaultBase, {
-    projectId,
-    identity,
-    activation: {
-      id: causalStop.activationId,
-      epoch: Number(causalStop.activation?.epoch || entry.activation_epoch || 0),
-    },
-    turn: { id: turnId, sequence: stopTurnSequence },
-    noteRel: sessionRel,
-    observedAt: new Date().toISOString(),
-    summary: finalSummary,
-    evidence: memoryEvidence,
-  });
-  mutateSessionRegistry(vaultBase, (registry) => {
-    const current = registry.sessions[sessionId];
-    if (!current) return null;
-    registry.sessions[sessionId] = {
-      ...current,
-      memory_status: memoryResult.status,
-      memory_activation_id: causalStop.activationId,
-      ...(memoryResult.checkpoint ? { memory_checkpoint: memoryResult.checkpoint } : {}),
-    };
-    return null;
-  });
+  const memoryResult = projectStopMemoryAttempt(vaultBase, memoryAttempt);
+  if (memoryResult.status === 'legacy') {
+    mutateSessionRegistry(vaultBase, (registry) => {
+      const current = registry.sessions[sessionId];
+      const active = current?.activations?.[current.active_activation_id || ''];
+      if (!current
+        || current.active_activation_id !== memoryAttempt.activation_id
+        || Number(active?.epoch || 0) !== Number(memoryAttempt.activation_epoch || 0)) return null;
+      registry.sessions[sessionId] = {
+        ...current,
+        memory_status: 'legacy',
+        memory_activation_id: memoryAttempt.activation_id,
+      };
+      return null;
+    });
+  } else {
+    recordStopMemoryOutcome(vaultBase, memoryAttempt, memoryResult);
+  }
 
   // Reconstrói índice (camada fria) + digest (camada quente) ao finalizar. Nunca derruba o Stop.
   try {