wendkeep 0.58.1 → 0.59.0

package/hooks/spec-core.mjs

@@ -1,10 +1,12 @@
 // hooks/spec-core.mjs — living spec (07-Specs) + change delta merge (OpenSpec native).
 // Pure parsing/merge + promoteSpecs (fs). No import from change-core (avoids a cycle).
 import { createHash } from 'node:crypto';
-import { existsSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
-import { ensureDir } from './obsidian-common.mjs';
 import { getLocale } from './locale.mjs';
+import {
+  assertVaultPathSafe, assertVaultPathsSafe, mkdirVaultPath, writeVaultFileSync,
+} from './vault-path-safety.mjs';
 
 // Short stable fingerprint of tarefas.md — freshness check between package/verdict and gate.
 export function tasksHashOf(md) {
@@ -122,8 +124,14 @@ export function livingSpecCapabilities(vaultBase) {
 
 export function adoptSpecsState(vaultBase) {
   const state = { version: 1, generatedAt: new Date().toISOString(), specs: readLivingSpecs(vaultBase) };
-  ensureDir(join(vaultBase, '.brain'));
-  writeFileSync(join(vaultBase, SPECS_STATE_FILE), `${JSON.stringify(state, null, 2)}\n`, 'utf8');
+  mkdirVaultPath(vaultBase, join(vaultBase, '.brain'), { label: 'raiz do estado de specs' });
+  writeVaultFileSync(
+    vaultBase,
+    join(vaultBase, SPECS_STATE_FILE),
+    `${JSON.stringify(state, null, 2)}\n`,
+    'utf8',
+    { label: 'estado consolidado de specs' },
+  );
   return state;
 }
 
@@ -150,17 +158,32 @@ function recordPromotedSpecs(vaultBase, capabilities) {
     else delete specs[capability];
   }
   const state = { version: 1, generatedAt: new Date().toISOString(), specs };
-  writeFileSync(join(vaultBase, SPECS_STATE_FILE), `${JSON.stringify(state, null, 2)}\n`, 'utf8');
+  writeVaultFileSync(
+    vaultBase,
+    join(vaultBase, SPECS_STATE_FILE),
+    `${JSON.stringify(state, null, 2)}\n`,
+    'utf8',
+    { label: 'estado consolidado de specs' },
+  );
   return state;
 }
 
 export function captureSpecBaseline(vaultBase, changeDir, { refresh = false } = {}) {
   const path = join(changeDir, SPEC_BASELINE_FILE);
-  if (!refresh && existsSync(path)) {
+  const checked = assertVaultPathSafe(vaultBase, path, {
+    expectedType: 'file', label: 'baseline de specs da change',
+  });
+  if (!refresh && checked.exists) {
     try { return JSON.parse(readFileSync(path, 'utf8')); } catch { /* rebuild malformed baseline */ }
   }
   const baseline = { version: 1, capturedAt: new Date().toISOString(), specs: readLivingSpecs(vaultBase) };
-  writeFileSync(path, `${JSON.stringify(baseline, null, 2)}\n`, 'utf8');
+  writeVaultFileSync(
+    vaultBase,
+    path,
+    `${JSON.stringify(baseline, null, 2)}\n`,
+    'utf8',
+    { label: 'baseline de specs da change' },
+  );
   return baseline;
 }
 
@@ -325,7 +348,7 @@ export function ensureSpecsReadme(vaultBase) {
   const loc = getLocale(vaultBase);
   const en = loc.id === 'en';
   const dir = join(vaultBase, loc.folders.specs);
-  ensureDir(dir);
+  mkdirVaultPath(vaultBase, dir, { label: 'raiz de specs consolidadas' });
   const body = en
     ? `# Specs — generated living contract
 
@@ -355,7 +378,48 @@ Pense como código-fonte vs commits: esta pasta é o *código atual* de cada cap
   \`wendkeep change archive\` promove para esta pasta.
 - Histórico por mudança → \`${loc.folders.changes}/_arquivo/\`. Contrato atual → aqui.
 `;
-  writeFileSync(join(dir, 'README.md'), body, 'utf8');
+  writeVaultFileSync(vaultBase, join(dir, 'README.md'), body, 'utf8', { label: 'README de specs' });
+}
+
+export function assertSpecPromotionTargetsSafe(vaultBase, changeDir, specs) {
+  const loc = getLocale(vaultBase);
+  const specsRoot = join(vaultBase, loc.folders.specs);
+  const checkedRoot = assertVaultPathSafe(vaultBase, specsRoot, {
+    expectedType: 'directory', label: 'raiz de specs consolidadas',
+  });
+  const targets = [
+    { path: join(specsRoot, 'README.md'), expectedType: 'file', label: 'README de specs' },
+    { path: join(vaultBase, '.brain'), expectedType: 'directory', label: 'raiz do estado de specs' },
+    { path: join(vaultBase, SPECS_STATE_FILE), expectedType: 'file', label: 'estado consolidado de specs' },
+  ];
+  if (checkedRoot.exists) {
+    for (const name of readdirSync(checkedRoot.target)) {
+      if (!name.endsWith('.md')) continue;
+      targets.push({
+        path: join(checkedRoot.target, name),
+        allowMissing: false,
+        expectedType: 'file',
+        label: `spec consolidada existente ${name}`,
+      });
+    }
+  }
+  for (const capability of specs) {
+    targets.push(
+      {
+        path: join(changeDir, 'specs', capability, 'spec.md'),
+        allowMissing: false,
+        expectedType: 'file',
+        label: `delta da spec ${capability}`,
+      },
+      {
+        path: join(specsRoot, `${capability}.md`),
+        expectedType: 'file',
+        label: `spec consolidada ${capability}`,
+      },
+    );
+  }
+  assertVaultPathsSafe(vaultBase, targets);
+  return { specsRoot: checkedRoot.target };
 }
 
 // Merge each capability's delta (in the change) into the living spec in 07-Specs.
@@ -364,6 +428,7 @@ export function promoteSpecs(vaultBase, changeDir, specs, { changeWikilink, date
   const specsDir = loc.folders.specs;
   const promoted = [];
   const warnings = [];
+  const { specsRoot } = assertSpecPromotionTargetsSafe(vaultBase, changeDir, specs);
   const state = checkSpecsState(vaultBase);
   const unmanaged = state.missing ? [] : state.changed.filter((capability) => specs.includes(capability));
   if (unmanaged.length) {
@@ -371,6 +436,7 @@ export function promoteSpecs(vaultBase, changeDir, specs, { changeWikilink, date
   }
   const conflicts = specConflicts(vaultBase, changeDir, specs);
   if (conflicts.length) throw new Error(`conflito de spec: ${conflicts.join('; ')} — reconcilie o delta e rode \`wendkeep spec rebase --change <slug> --accept-current\``);
+  const materialized = [];
   for (const cap of specs) {
     let deltaMd;
     try { deltaMd = readFileSync(join(changeDir, 'specs', cap, 'spec.md'), 'utf8'); }
@@ -382,10 +448,23 @@ export function promoteSpecs(vaultBase, changeDir, specs, { changeWikilink, date
     try { current = parseRequirements(readFileSync(livePath, 'utf8')); } catch { /* nova capability */ }
     const applied = applyDelta(current, delta);
     warnings.push(...applied.warnings.map((w) => `${cap}: ${w}`));
-    ensureDir(join(vaultBase, specsDir));
     const footer = changeWikilink ? `Atualizado por ${changeWikilink} em ${dateStr}.` : '';
-    writeFileSync(livePath, renderSpec(cap, applied.reqs, { footer, reqHeading: loc.reqHeading }), 'utf8');
-    promoted.push(cap);
+    materialized.push({
+      capability: cap,
+      livePath,
+      content: renderSpec(cap, applied.reqs, { footer, reqHeading: loc.reqHeading }),
+    });
+  }
+  mkdirVaultPath(vaultBase, specsRoot, { label: 'raiz de specs consolidadas' });
+  for (const item of materialized) {
+    writeVaultFileSync(
+      vaultBase,
+      item.livePath,
+      item.content,
+      'utf8',
+      { label: `spec consolidada ${item.capability}` },
+    );
+    promoted.push(item.capability);
   }
   recordPromotedSpecs(vaultBase, promoted);
   ensureSpecsReadme(vaultBase); // self-heal the explainer so existing vaults get it on archive

package/hooks/subagent-stop.mjs

@@ -20,7 +20,10 @@ export function refreshSubagents(vaultBase, input) {
   if (!sessionRel) return false;
   const sessionPath = join(vaultBase, sessionRel);
   if (!existsSync(sessionPath)) return false;
-  updateSessionObservability({ sessionPath, transcriptPath, caller: 'subagent-stop', canonicalConversationId: identity.canonicalConversationId });
+  updateSessionObservability({
+    vaultBase, sessionPath, transcriptPath, caller: 'subagent-stop',
+    canonicalConversationId: identity.canonicalConversationId,
+  });
   return true;
 }
 

package/hooks/subagent-usage.mjs

@@ -340,7 +340,7 @@ function upsertSection(content, heading, body) {
 }
 
 // Stop-hook entry: scan the session's subagents/workflows, fold into the note. Fail-open.
-export function upsertSubagentUsage(sessionPath, transcriptPath, { lockTimeoutMs } = {}) {
+export function upsertSubagentUsage(sessionPath, transcriptPath, { lockTimeoutMs, vaultBase = '' } = {}) {
   if (!sessionPath || !existsSync(sessionPath)) return false;
   const collected = collectSubagentUsage(sessionDirFromTranscript(transcriptPath));
   if (!collected) return false;
@@ -377,6 +377,6 @@ export function upsertSubagentUsage(sessionPath, transcriptPath, { lockTimeoutMs
     };
     content = setFrontmatterField(content, 'custo_por_modelo_json', `'${JSON.stringify(ledger).replaceAll("'", "''")}'`);
     return upsertSection(content, '## Subagents & Workflows', renderSubagentSection(collected));
-  }, lockTimeoutMs ? { timeoutMs: lockTimeoutMs } : {});
+  }, { ...(lockTimeoutMs ? { timeoutMs: lockTimeoutMs } : {}), vaultBase });
   return outcome.written;
 }

package/hooks/task-log.mjs

@@ -52,7 +52,9 @@ export function logTask(vaultBase, input) {
 
   const heading = getLocale(vaultBase).id === 'en' ? 'Plan progress' : 'Progresso do plano';
   const line = `- [x] ${formatHourMinute(new Date()).replace('-', ':')} ${text}`;
-  return mutateSessionNote(sessionPath, (content) => appendProgress(content, line, heading)).written;
+  return mutateSessionNote(sessionPath, (content) => appendProgress(content, line, heading), {
+    vaultBase,
+  }).written;
 }
 
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {

package/hooks/token-usage.mjs

@@ -986,7 +986,7 @@ export function updateSessionUsage({ vaultBase, sessionRel, sessionPath, transcr
     result = collectSessionUsage({ sessionContent, transcriptPath });
     if (!result) return null; // sem usage OU conteúdo corrompido: não grava
     return upsertUsageSection(result.content, buildUsageSection(result.aggregate, result.entries, result.summary));
-  }, lockTimeoutMs ? { timeoutMs: lockTimeoutMs } : {});
+  }, { ...(lockTimeoutMs ? { timeoutMs: lockTimeoutMs } : {}), vaultBase });
   return outcome.written || outcome.reason === 'unchanged' ? result : null;
 }
 

package/hooks/vault-health.mjs

@@ -13,7 +13,8 @@ import {
 import { getLocale } from './locale.mjs';
 import { parseSharedMemory, validateMemoryEvent } from './memory-schema.mjs';
 import { detectMemoryMode, LEGACY_MEMORY_WARNING } from './memory-mode.mjs';
-import { reduceMemoryEvents } from './memory-store.mjs';
+import { deriveMemoryProjection } from './memory-store.mjs';
+import { assertVaultPathSafe, assertVaultPathsSafe } from './vault-path-safety.mjs';
 import { validateMemoryBundle } from '../src/validate-memory.mjs';
 
 const DEFAULT_PENDING_PATTERNS = [
@@ -100,10 +101,21 @@ function linkedNotesFromSession(content) {
 const MEMORY_STATUS_COMMAND = 'wendkeep memory status --gate --vault <vault>';
 const MEMORY_REPAIR_COMMAND = 'wendkeep memory repair --vault <vault>';
 
-function readJsonLines(path, label) {
-  if (!existsSync(path)) return { items: [], errors: [] };
+function readJsonLines(vaultBase, path, label) {
+  let checked;
+  try {
+    checked = assertVaultPathSafe(vaultBase, path, { expectedType: 'file', label });
+  } catch (error) {
+    return { items: [], errors: [`${label} inseguro: ${error?.message || error}`] };
+  }
+  if (!checked.exists) return { items: [], errors: [] };
   let raw;
-  try { raw = readFileSync(path, 'utf8').replace(/\r\n/g, '\n'); }
+  try {
+    checked = assertVaultPathSafe(vaultBase, checked.target, {
+      allowMissing: false, expectedType: 'file', label,
+    });
+    raw = readFileSync(checked.target, 'utf8').replace(/\r\n/g, '\n');
+  }
   catch (error) { return { items: [], errors: [`${label} ilegível: ${error?.message || error}`] }; }
   const lines = raw.endsWith('\n') ? raw.split('\n').slice(0, -1) : raw.split('\n');
   const items = [];
@@ -121,45 +133,260 @@ function readJsonLines(path, label) {
 
 function inspectOutbox(vaultBase, projectId) {
   const dir = join(vaultBase, '.brain', 'memory-outbox');
-  if (!existsSync(dir)) return { count: 0, errors: [] };
-  const files = readdirSync(dir).filter((name) => name.endsWith('.json')).sort();
+  let checked;
+  try {
+    checked = assertVaultPathSafe(vaultBase, dir, {
+      expectedType: 'directory', label: 'outbox de memória',
+    });
+  } catch (error) {
+    return {
+      count: 0,
+      errors: [`outbox insegura: ${error?.message || error}`],
+      eventIds: new Set(),
+      eventsById: new Map(),
+    };
+  }
+  if (!checked.exists) return {
+    count: 0, errors: [], eventIds: new Set(), eventsById: new Map(),
+  };
+  try {
+    checked = assertVaultPathSafe(vaultBase, checked.target, {
+      allowMissing: false, expectedType: 'directory', label: 'outbox de memória',
+    });
+  } catch (error) {
+    return {
+      count: 0,
+      errors: [`outbox insegura: ${error?.message || error}`],
+      eventIds: new Set(),
+      eventsById: new Map(),
+    };
+  }
+  const files = readdirSync(checked.target).filter((name) => name.endsWith('.json')).sort();
   const errors = [];
+  const eventIds = new Set();
+  const eventsById = new Map();
   for (const name of files) {
-    const path = join(dir, name);
+    const path = join(checked.target, name);
     try {
-      const event = JSON.parse(readFileSync(path, 'utf8'));
+      const file = assertVaultPathSafe(vaultBase, path, {
+        allowMissing: false, expectedType: 'file', label: `evento ${name} da outbox`,
+      });
+      const event = JSON.parse(readFileSync(file.target, 'utf8'));
       const validation = validateMemoryEvent(event, projectId ? { projectId } : {});
       if (!validation.ok) errors.push(`${name}: ${validation.errors.join(' ')}`);
+      else {
+        eventIds.add(event.event_id);
+        eventsById.set(event.event_id, event);
+      }
     } catch (error) {
       errors.push(`${name}: JSON inválido: ${error.message}`);
     }
   }
-  return { count: files.length, errors };
+  return {
+    count: files.length, errors, eventIds, eventsById,
+  };
+}
+
+function memoryMetrics() {
+  return {
+    schemaVersion: null,
+    revision: null,
+    eventCursor: null,
+    stateHash: null,
+    ledgerEvents: 0,
+    pendingOutbox: 0,
+    candidates: 0,
+    activeConflicts: 0,
+  };
+}
+
+function blockedMemoryBoundary(error) {
+  return {
+    ok: false,
+    status: 'blocked',
+    failures: [`Boundary física da memória insegura: ${error?.message || error}`],
+    warnings: [],
+    metrics: memoryMetrics(),
+  };
+}
+
+function preflightMemoryBundle(vaultBase) {
+  const brain = join(vaultBase, '.brain');
+  assertVaultPathSafe(vaultBase, brain, {
+    expectedType: 'directory', label: 'raiz .brain da memória',
+  });
+  assertVaultPathsSafe(vaultBase, [
+    'PROJECT.json', 'CORE.md', 'MEMORY_EVENTS.jsonl', 'SHARED_MEMORY.md',
+    'MEMORY_CANDIDATES.jsonl',
+  ].map((name) => ({
+    path: join(brain, name), expectedType: 'file', label: `${name} ilegível ou inseguro`,
+  })));
+  const outbox = assertVaultPathSafe(vaultBase, join(brain, 'memory-outbox'), {
+    expectedType: 'directory', label: 'outbox de memória',
+  });
+  if (!outbox.exists) return;
+  const entries = readdirSync(outbox.target);
+  for (const name of entries) {
+    assertVaultPathSafe(vaultBase, join(outbox.target, name), {
+      allowMissing: false, label: `entrada ${name} da outbox de memória`,
+    });
+  }
+}
+
+function checkpointMatchesLedgerPrefix(checkpoint, eventIds, ledgerEvents, vaultBase) {
+  if (!checkpoint || typeof checkpoint !== 'object') return false;
+  if (!Number.isInteger(checkpoint.revision) || checkpoint.revision < 0) return false;
+  if (typeof checkpoint.event_cursor !== 'string' || !checkpoint.event_cursor) return false;
+  if (typeof checkpoint.state_hash !== 'string' || !checkpoint.state_hash) return false;
+
+  const cursorIndex = ledgerEvents.findIndex((event) => event?.event_id === checkpoint.event_cursor);
+  if (cursorIndex < 0) return false;
+  const prefix = ledgerEvents.slice(0, cursorIndex + 1);
+  const prefixIds = new Set(prefix.map((event) => event.event_id));
+  if (eventIds.some((eventId) => !prefixIds.has(eventId))) return false;
+
+  try {
+    const replay = deriveMemoryProjection(vaultBase, prefix);
+    const causalMatches = checkpoint.causal_event_cursor === undefined
+      || checkpoint.causal_event_cursor === replay.eventCursor;
+    return checkpoint.revision === replay.checkpoint.revision
+      && checkpoint.event_cursor === replay.checkpoint.event_cursor
+      && checkpoint.state_hash === replay.checkpoint.state_hash
+      && causalMatches;
+  } catch {
+    return false;
+  }
+}
+
+function checkMemoryAttempts(registry, {
+  vaultBase, ledgerEvents = [], outboxEventIds = new Set(), outboxEventsById = new Map(),
+} = {}) {
+  const failures = [];
+  const warnings = [];
+  const ledgerEventIds = new Set(ledgerEvents.map((event) => event?.event_id).filter(Boolean));
+  const ledgerById = new Map(ledgerEvents
+    .filter((event) => event?.event_id)
+    .map((event) => [event.event_id, event]));
+  const attempts = Object.entries(registry?.sessions || {})
+    .map(([sessionId, entry]) => [sessionId, entry?.last_memory_attempt])
+    .filter(([, attempt]) => attempt && typeof attempt === 'object' && attempt.memory_mode === 'v2');
+
+  for (const [sessionId, attempt] of attempts) {
+    const state = String(attempt.state || '');
+    const disposition = String(attempt.disposition || '');
+    const eventIds = Array.isArray(attempt.event_ids)
+      ? [...new Set(attempt.event_ids.filter((eventId) => typeof eventId === 'string' && eventId))]
+      : [];
+
+    if (state === 'skipped' && disposition === 'ambiguous') {
+      failures.push(`Lifecycle de memória v2 ambíguo: Stop pulou a publicação sem identidade causal suficiente. Inspecione com: ${MEMORY_STATUS_COMMAND}.`);
+      continue;
+    }
+
+    if (state === 'skipped' && ['stale_turn', 'superseded'].includes(disposition)) {
+      if (eventIds.length) {
+        failures.push(`Stop stale/superseded emitiu event_ids apesar da rejeição causal. Inspecione com: ${MEMORY_STATUS_COMMAND}.`);
+      } else {
+        warnings.push('Stop stale/superseded foi descartado sem publicar memória.');
+      }
+      continue;
+    }
+
+    if (disposition !== 'applied') {
+      if (state === 'skipped') warnings.push('Attempt de memória v2 foi descartado sem publicação.');
+      else failures.push(`Attempt de memória v2 possui disposition não reconhecida para o estado informado. Inspecione com: ${MEMORY_STATUS_COMMAND}.`);
+      continue;
+    }
+
+    if (!eventIds.length) {
+      failures.push(`Attempt v2 aplicado não declarou event_ids; publicação perdida. Inspecione com: ${MEMORY_STATUS_COMMAND}.`);
+      continue;
+    }
+
+    const identity = {
+      canonical_session_id: sessionId,
+      activation_id: attempt.activation_id,
+      activation_epoch: attempt.activation_epoch,
+      source_turn_id: attempt.turn_id,
+      turn_sequence: attempt.turn_sequence,
+    };
+    const invalidAttemptFields = [];
+    if (attempt.canonical_session_id !== sessionId) invalidAttemptFields.push('canonical_session_id');
+    if (typeof attempt.activation_id !== 'string' || !attempt.activation_id) invalidAttemptFields.push('activation_id');
+    if (!Number.isInteger(attempt.activation_epoch) || attempt.activation_epoch < 0) invalidAttemptFields.push('activation_epoch');
+    if (typeof attempt.turn_id !== 'string' || !attempt.turn_id) invalidAttemptFields.push('turn_id');
+    if (!Number.isInteger(attempt.turn_sequence) || attempt.turn_sequence < 0) invalidAttemptFields.push('turn_sequence');
+    if (invalidAttemptFields.length) {
+      failures.push(`Attempt v2 da sessão ${sessionId} possui identidade causal inválida (${invalidAttemptFields.join(', ')}). Inspecione com: ${MEMORY_STATUS_COMMAND}.`);
+      continue;
+    }
+    const causalMismatches = [];
+    for (const eventId of eventIds) {
+      const event = ledgerById.get(eventId) || outboxEventsById.get(eventId);
+      if (!event) continue;
+      const fields = Object.entries(identity)
+        .filter(([field, expected]) => event[field] !== expected)
+        .map(([field]) => field);
+      if (fields.length) causalMismatches.push(`${eventId}: ${fields.join(', ')}`);
+    }
+    if (causalMismatches.length) {
+      failures.push(`Attempt v2 da sessão ${sessionId} referencia evento(s) com identidade causal divergente (${causalMismatches.join('; ')}). Inspecione com: ${MEMORY_STATUS_COMMAND}.`);
+      continue;
+    }
+
+    if (state === 'enqueued' || state === 'degraded') {
+      const missing = eventIds.filter((eventId) => !ledgerEventIds.has(eventId) && !outboxEventIds.has(eventId));
+      if (missing.length) {
+        failures.push(`Attempt v2 perdeu ${missing.length} evento(s): ausentes do ledger e da outbox. Inspecione com: ${MEMORY_STATUS_COMMAND}.`);
+      } else {
+        warnings.push(`Attempt de memória v2 ${state} permanece recuperável: ${eventIds.length} evento(s) durável(is) no ledger e/ou outbox.`);
+      }
+      continue;
+    }
+
+    if (state === 'projected') {
+      const outsideLedger = eventIds.filter((eventId) => !ledgerEventIds.has(eventId));
+      if (outsideLedger.length) {
+        failures.push(`Attempt projetado perdeu ${outsideLedger.length} evento(s) no ledger. Inspecione com: ${MEMORY_STATUS_COMMAND}.`);
+      } else if (!checkpointMatchesLedgerPrefix(attempt.checkpoint, eventIds, ledgerEvents, vaultBase)) {
+        failures.push(`Checkpoint do attempt projetado diverge do prefixo rederivado do ledger. Inspecione com: ${MEMORY_STATUS_COMMAND}.`);
+      }
+      continue;
+    }
+
+    failures.push(`Attempt de memória v2 possui state inválido. Inspecione com: ${MEMORY_STATUS_COMMAND}.`);
+  }
+
+  return { failures, warnings };
 }
 
 /**
  * Read-only consistency check for the local memory-v2 bundle. It intentionally
  * does not acquire MEMORY.lock or invoke the projector/repair paths.
  */
-export function checkMemoryBundle(vaultBase) {
+export function checkMemoryBundle(vaultBase, { registry } = {}) {
+  if (!existsSync(vaultBase)) {
+    return {
+      ok: false,
+      status: 'blocked',
+      failures: [`Vault not found: ${vaultBase}`],
+      warnings: [],
+      metrics: memoryMetrics(),
+    };
+  }
+  try { preflightMemoryBundle(vaultBase); }
+  catch (error) { return blockedMemoryBoundary(error); }
   const brain = join(vaultBase, '.brain');
-  const mode = detectMemoryMode(vaultBase);
+  let mode;
+  try { mode = detectMemoryMode(vaultBase); }
+  catch (error) { return blockedMemoryBoundary(error); }
   if (mode.mode === 'legacy') {
     return {
       ok: true,
       status: 'legacy',
       failures: [],
       warnings: [LEGACY_MEMORY_WARNING],
-      metrics: {
-        schemaVersion: null,
-        revision: null,
-        eventCursor: null,
-        stateHash: null,
-        ledgerEvents: 0,
-        pendingOutbox: 0,
-        candidates: 0,
-        activeConflicts: 0,
-      },
+      metrics: memoryMetrics(),
     };
   }
   const bundle = validateMemoryBundle(vaultBase);
@@ -170,7 +397,9 @@ export function checkMemoryBundle(vaultBase) {
     : { metadata: {} };
   const metadata = parsedShared.metadata || {};
   const outbox = inspectOutbox(vaultBase, bundle.project?.projectId);
-  const candidates = readJsonLines(join(brain, 'MEMORY_CANDIDATES.jsonl'), 'MEMORY_CANDIDATES.jsonl');
+  const candidates = readJsonLines(
+    vaultBase, join(brain, 'MEMORY_CANDIDATES.jsonl'), 'MEMORY_CANDIDATES.jsonl',
+  );
 
   const ledgerCorrupt = (bundle.ledger?.errors || []).length > 0;
   if (ledgerCorrupt) {
@@ -192,7 +421,7 @@ export function checkMemoryBundle(vaultBase) {
 
   let replay = null;
   if (bundle.ledger?.ok) {
-    try { replay = reduceMemoryEvents(bundle.ledger.events); }
+    try { replay = deriveMemoryProjection(vaultBase, bundle.ledger.events); }
     catch (error) {
       failures.push(`Ledger não pode ser reduzido: ${error.message}. Execute com segurança: ${MEMORY_REPAIR_COMMAND}.`);
     }
@@ -200,13 +429,27 @@ export function checkMemoryBundle(vaultBase) {
   if (replay && bundle.shared?.ok) {
     const divergences = [];
     if (metadata.revision !== replay.revision) divergences.push(`revision ${metadata.revision} != ${replay.revision}`);
-    if (metadata.event_cursor !== replay.eventCursor) divergences.push(`event_cursor ${metadata.event_cursor} != ${replay.eventCursor}`);
+    if (metadata.event_cursor !== replay.ledgerCursor) divergences.push(`event_cursor ${metadata.event_cursor} != ${replay.ledgerCursor}`);
     if (metadata.state_hash !== replay.stateHash) divergences.push(`state_hash ${metadata.state_hash} != ${replay.stateHash}`);
     if (divergences.length) {
       failures.push(`Projeção SHARED stale/lag (${divergences.join('; ')}). Inspecione com: ${MEMORY_STATUS_COMMAND}.`);
     }
   }
 
+  let effectiveRegistry = registry;
+  if (!effectiveRegistry) {
+    try { effectiveRegistry = readSessionRegistry(vaultBase); }
+    catch (error) { failures.push(`SESSION_REGISTRY.json inseguro ou ilegível: ${error?.message || error}.`); }
+  }
+  const lifecycle = checkMemoryAttempts(effectiveRegistry || { version: 2, sessions: {} }, {
+    vaultBase,
+    ledgerEvents: bundle.ledger?.events || [],
+    outboxEventIds: outbox.eventIds,
+    outboxEventsById: outbox.eventsById,
+  });
+  failures.push(...lifecycle.failures);
+  warnings.push(...lifecycle.warnings);
+
   const unresolved = candidates.items.filter((item) => !['resolved', 'rejected', 'superseded'].includes(item?.status));
   const activeConflicts = unresolved.filter((item) => item?.reason === 'conflict');
   const ordinaryCandidates = unresolved.filter((item) => item?.reason !== 'conflict');
@@ -332,7 +575,7 @@ export function runVaultHealth({ vaultBase, session = '' }) {
   ];
   let memory = { status: 'legacy', metrics: {} };
   if (memoryMarkers.some((path) => existsSync(path))) {
-    memory = checkMemoryBundle(vaultBase);
+    memory = checkMemoryBundle(vaultBase, { registry });
     failures.push(...memory.failures.map((item) => `Memória: ${item}`));
     warnings.push(...memory.warnings.map((item) => `Memória: ${item}`));
   } else {