wendkeep 0.66.0 → 0.66.1

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to **wendkeep** are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.66.1] — 2026-07-29
+
+### Fixed
+
+- **A curadoria de candidates agora é durável e idempotente.** `memory promote` e
+  `memory reject` registram decisões causais no ledger; repair/replay não recriam o conflito
+  resolvido, retries não duplicam eventos, candidates sobrepostos permanecem isolados e a
+  promoção recupera o checkpoint divergente do attempt correspondente sem tocar attempt novo.
+- **Promoção de conflito exige escolha explícita.** `memory promote <candidate> --event
+  <event-id>` publica exatamente o evento escolhido, rejeita IDs externos ao candidate e não
+  permite que `blocked_by_core` sobrescreva a autoridade canônica de CORE.
+
 ## [0.66.0] — 2026-07-29
 
 ### Added

package/README.en.md

@@ -294,7 +294,10 @@ backup/audit; divergent mirrors fail closed. A demonstrably superseded
 ambiguity uses `memory reconcile <session> --by-session <successor>
 --reason <reason>` as a dry run and requires `--apply`; the decision is backed up and audited
 without rewriting ledger, CORE, or notes. Run `status --gate` again afterwards. Conflicts require
-explicit curation with `memory promote <id>` or `memory reject <id>`; doctor only diagnoses.
+explicit, durable curation: `memory promote <id> --event <event-id>` selects one event from the
+candidate, while `memory reject <id>` keeps the current value. Decisions are idempotent and
+survive repair/replay; `blocked_by_core` cannot override CORE. Doctor only diagnoses. See
+[memory and curation](docs/en/commands/memory.md).
 
 Session notes use one live `## Agentes, tokens e custos` snapshot. Main-agent and subagent hooks recompose it atomically, with costs, token dimensions, reasoning tokens and effort per model/source. Every hook that rewrites a session note takes a per-file lock and writes through a temp file + rename, so the `SubagentStop` fan-out (one hook run per subagent) can never leave a note half-written; a note whose frontmatter reads back damaged is left untouched rather than patched.
 

package/README.md

@@ -294,7 +294,10 @@ backup/audit; divergent mirrors fail closed. A demonstrably superseded
 ambiguity uses `memory reconcile <session> --by-session <successor>
 --reason <reason>` as a dry run and requires `--apply`; the decision is backed up and audited
 without rewriting ledger, CORE, or notes. Run `status --gate` again afterwards. Conflicts require
-explicit curation with `memory promote <id>` or `memory reject <id>`; doctor only diagnoses.
+explicit, durable curation: `memory promote <id> --event <event-id>` selects one event from the
+candidate, while `memory reject <id>` keeps the current value. Decisions are idempotent and
+survive repair/replay; `blocked_by_core` cannot override CORE. Doctor only diagnoses. See
+[memory and curation](docs/en/commands/memory.md).
 
 Session notes use one live `## Agentes, tokens e custos` snapshot. Main-agent and subagent hooks recompose it atomically, with costs, token dimensions, reasoning tokens and effort per model/source. Every hook that rewrites a session note takes a per-file lock and writes through a temp file + rename, so the `SubagentStop` fan-out (one hook run per subagent) can never leave a note half-written; a note whose frontmatter reads back damaged is left untouched rather than patched.
 

package/docs/en/commands/memory-migration.md

@@ -64,7 +64,8 @@ to revision 1. Replaying that prompt or Stop does not duplicate the event/revisi
 - Partial/corrupt v2 bundle: use status and repair; migration is not a corruption tool.
 - First post-migration Stop is `ambiguous`: verify that its `turn_id` belongs to the transcript and
   that `UserPromptSubmit` opened/advanced the recovery activation.
-- Many candidates: curate gradually with `memory promote`/`memory reject`.
+- Many candidates: curate gradually with `memory promote`/`memory reject`; conflicts require
+  `memory promote <candidate> --event <event-id>` to choose the winner explicitly.
 - Legacy warning remains after apply: verify the selected vault and project binding.
 
 ## Next steps

package/docs/en/commands/memory.md

@@ -26,7 +26,7 @@ Pass the vault explicitly in automation. Preserve backups and evidence before re
 npx wendkeep memory status [--gate] --vault <vault>
 npx wendkeep memory repair --vault <vault>
 npx wendkeep memory reconcile <ambiguous-session> --by-session <successor-session> --reason <reason> [--apply] --vault <vault>
-npx wendkeep memory promote <candidate> --vault <vault>
+npx wendkeep memory promote <candidate> [--event <event-id>] --vault <vault>
 npx wendkeep memory reject <candidate> --vault <vault>
 npx wendkeep validate-memory [CORE-path]
 npx wendkeep validate-memory --vault <v2-vault>
@@ -63,7 +63,14 @@ npx wendkeep validate-memory --vault <v2-vault>
   Junctions, symlinks, reparse points, or hardlinks fail closed without touching external bytes.
   Locks publish owner and lease atomically, never reap a live PID by age alone, and release only
   the lease they acquired.
-- `promote`/`reject` append auditable decisions and never rewrite the ledger in place.
+- `promote`/`reject` append an auditable, idempotent decision to the ledger. Replay and repair
+  preserve that decision and do not recreate the resolved candidate. For a `conflict` candidate,
+  `promote` requires an `--event <event-id>` that belongs to the candidate; date or random ID
+  never picks an implicit winner. `reject` preserves the current operational value. A
+  `blocked_by_core` candidate can only be rejected: promotion first requires canonical CORE
+  curation. If the selected event still belongs to the matching latest `projected` attempt,
+  promotion also refreshes its checkpoint and mirror causally; JSON reports
+  `checkpointRefreshed`, and a newer concurrent attempt remains untouched.
 - `validate-memory <CORE.md>` checks the 25-line cap, required sections, and secrets.
 - `validate-memory --vault` requires a complete v2 bundle and is not the legacy-vault gate.
 
@@ -74,7 +81,8 @@ npx wendkeep memory status --gate --vault .MyApp-vault
 npx wendkeep memory reconcile old --by-session current --reason "delivery continued" --vault .MyApp-vault
 npx wendkeep memory reconcile old --by-session current --reason "delivery continued" --apply --vault .MyApp-vault
 npx wendkeep validate-memory .MyApp-vault/.brain/CORE.md
-npx wendkeep memory promote candidate-123 --vault .MyApp-vault
+npx wendkeep memory promote candidate-123 --event mem-selected --vault .MyApp-vault
+npx wendkeep memory reject candidate-456 --vault .MyApp-vault
 ```
 
 ## Expected result
@@ -97,6 +105,9 @@ of a global projection that has already advanced with concurrent events.
   `memory reconcile` dry run before authorizing `--apply`; the command fails when the ambiguous
   attempt already contains event IDs.
 - Ordinary pending candidate: recoverable warning, requiring human choice when appropriate.
+- `promote` reports that `--event` is required: inspect the candidate `event_ids`, compare their
+  provenance/value, and name the winner explicitly. An ID outside the candidate fails without
+  mutating the ledger or projections.
 - Missing `event_cursor` or mismatched v2 hash: preserve the bundle and assess `memory repair`.
 - `validate-memory --vault` fails on legacy: validate CORE only or migrate first.
 

package/docs/pt-BR/commands/memory-migration.md

@@ -64,7 +64,8 @@ revision 1. Repetir esse prompt ou Stop não duplica evento/revision.
 - Bundle v2 parcial/corrompido: use status e repair; migração não é ferramenta de corrupção.
 - Primeiro Stop pós-migração fica `ambiguous`: confirme que o `turn_id` pertence ao transcript e
   que `UserPromptSubmit` abriu/avançou a activation de recuperação.
-- Candidates numerosos: curate gradualmente com `memory promote`/`memory reject`.
+- Candidates numerosos: curate gradualmente com `memory promote`/`memory reject`; conflitos
+  exigem `memory promote <candidate> --event <event-id>` para escolher o vencedor explicitamente.
 - Warning legado após apply: confirme o vault efetivamente selecionado e o vínculo do projeto.
 
 ## Próximos passos

package/docs/pt-BR/commands/memory.md

@@ -26,7 +26,7 @@ Informe o vault explicitamente em automações. Preserve backups e evidências a
 npx wendkeep memory status [--gate] --vault <cofre>
 npx wendkeep memory repair --vault <cofre>
 npx wendkeep memory reconcile <sessão-ambígua> --by-session <sessão-sucessora> --reason <motivo> [--apply] --vault <cofre>
-npx wendkeep memory promote <candidate> --vault <cofre>
+npx wendkeep memory promote <candidate> [--event <event-id>] --vault <cofre>
 npx wendkeep memory reject <candidate> --vault <cofre>
 npx wendkeep validate-memory [caminho-do-CORE]
 npx wendkeep validate-memory --vault <cofre-v2>
@@ -61,7 +61,13 @@ npx wendkeep validate-memory --vault <cofre-v2>
   candidates, registry, notas, backups, temporários e sidecars antes de ler ou escrever. Junction,
   symlink, reparse point ou hardlink falham fechados sem tocar bytes externos. Locks publicam owner
   e lease atomicamente, não colhem PID vivo apenas por idade e só liberam a lease adquirida.
-- `promote`/`reject` acrescentam decisão auditável; nunca reescrevem o ledger no lugar.
+- `promote`/`reject` acrescentam uma decisão auditável e idempotente ao ledger. Replay e repair
+  preservam a decisão e não recriam o candidate resolvido. Para candidate `conflict`, `promote`
+  exige `--event <event-id>` pertencente ao candidate; não há vencedor implícito por data ou ID.
+  `reject` preserva o valor operacional atual. Candidate `blocked_by_core` só pode ser rejeitado:
+  promover exige antes alterar CORE pela curadoria canônica. Se o evento escolhido ainda pertence
+  ao último attempt `projected` correspondente, a promoção também atualiza causalmente checkpoint
+  e espelho; o JSON retorna `checkpointRefreshed`, e um attempt concorrente mais novo não é tocado.
 - `validate-memory <CORE.md>` valida cap de 25 linhas, seções e segredos.
 - `validate-memory --vault` exige bundle v2 completo; não é o gate correto para vault legado.
 
@@ -72,7 +78,8 @@ npx wendkeep memory status --gate --vault .MeuApp-vault
 npx wendkeep memory reconcile antiga --by-session atual --reason "entrega continuada" --vault .MeuApp-vault
 npx wendkeep memory reconcile antiga --by-session atual --reason "entrega continuada" --apply --vault .MeuApp-vault
 npx wendkeep validate-memory .MeuApp-vault/.brain/CORE.md
-npx wendkeep memory promote candidate-123 --vault .MeuApp-vault
+npx wendkeep memory promote candidate-123 --event mem-escolhido --vault .MeuApp-vault
+npx wendkeep memory reject candidate-456 --vault .MeuApp-vault
 ```
 
 ## Resultado esperado
@@ -94,6 +101,9 @@ prefixo válido de uma projeção global que já avançou com eventos concorrent
   ambiguidade for comprovadamente substituída por uma sessão sucessora, revise o dry-run de
   `memory reconcile` antes de autorizar `--apply`; o comando falha se o attempt ambíguo tiver IDs.
 - Candidate pendente comum: warning recuperável, exige decisão humana quando apropriado.
+- `promote` informa que `--event` é obrigatório: leia os `event_ids` do candidate, compare a
+  proveniência/valor e indique explicitamente o vencedor. ID que não pertence ao candidate falha
+  sem mutar ledger ou projeções.
 - `event_cursor` ausente ou hash divergente em v2: preserve o bundle e avalie `memory repair`.
 - `validate-memory --vault` falha no legado: valide apenas CORE ou migre primeiro.
 

package/hooks/brain-core.mjs

@@ -1,159 +1,159 @@
-// .agent/hooks/brain-core.mjs
-// Camada fria do brain: indexa o frontmatter das notas de sessão (0 token LLM).
-import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { basename, join } from 'node:path';
-import { ensureDir, stripYamlQuotes, toVaultRelative } from './obsidian-common.mjs';
-import { getLocale } from './locale.mjs';
-
-export function brainDir(vaultBase) {
-  return join(vaultBase, '.brain');
-}
-
-// Frontmatter YAML simples: escalares `k: v` + listas `k:` seguido de `  - item`.
-export function parseFrontmatter(content) {
-  const m = content.match(/^---\n([\s\S]*?)\n---/);
-  if (!m) return {};
-  const data = {};
-  const lines = m[1].split('\n');
-  for (let i = 0; i < lines.length; i++) {
-    const kv = lines[i].match(/^([\w-]+):\s*(.*)$/);
-    if (!kv) continue;
-    const key = kv[1];
-    const val = kv[2];
-    if (val === '') {
-      const list = [];
-      while (i + 1 < lines.length && /^\s+-\s+/.test(lines[i + 1])) {
-        list.push(stripYamlQuotes(lines[++i].replace(/^\s+-\s+/, '').trim()));
-      }
-      data[key] = list.length ? list : '';
-    } else {
-      data[key] = stripYamlQuotes(val.trim());
-    }
-  }
-  return data;
-}
-
-function walkMd(dir) {
-  const out = [];
-  let entries;
-  try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return out; }
-  for (const e of entries) {
-    const fp = join(dir, e.name);
-    if (e.isDirectory()) out.push(...walkMd(fp));
-    else if (e.name.endsWith('.md')) out.push(fp);
-  }
-  return out;
-}
-
-const DERIVED_RE = /\[\[(0[456]-[^\]|]+?)(?:\|[^\]]*)?\]\]/g;
-function derivedLinks(content) {
-  const dec = new Set(), bug = new Set(), lea = new Set();
-  let m;
-  while ((m = DERIVED_RE.exec(content))) {
-    const t = m[1];
-    if (t.startsWith('04-')) dec.add(t);
-    else if (t.startsWith('05-')) bug.add(t);
-    else if (t.startsWith('06-')) lea.add(t);
-  }
-  return { decisions: [...dec], bugs: [...bug], learnings: [...lea] };
-}
-
-// Varre 02-Sessões/** e regrava .brain/index.jsonl inteiro. Provider-agnóstico.
-export function buildBrainIndex(vaultBase) {
-  const rows = [];
-  for (const fp of walkMd(join(vaultBase, getLocale(vaultBase).folders.sessions))) {
-    let content;
-    try { content = readFileSync(fp, 'utf8'); } catch { continue; }
-    const fm = parseFrontmatter(content);
-    if (fm.type && fm.type !== 'session') continue;
-    const der = derivedLinks(content);
-    rows.push({
-      session_id: fm.session_id || '',
-      date: fm.date || '',
-      provider: fm.provider || '',
-      status: fm.status || '',
-      summary: fm.summary || '',
-      file: toVaultRelative(vaultBase, fp),
-      tags: Array.isArray(fm.tags) ? fm.tags : (fm.tags ? [fm.tags] : []),
-      decisions: der.decisions,
-      bugs: der.bugs,
-      learnings: der.learnings,
-    });
-  }
-  rows.sort((a, b) => (a.date + a.file).localeCompare(b.date + b.file));
-  ensureDir(brainDir(vaultBase));
-  const out = rows.map((r) => JSON.stringify(r)).join('\n') + (rows.length ? '\n' : '');
-  writeFileSync(join(brainDir(vaultBase), 'index.jsonl'), out, 'utf8');
-  return rows;
-}
-
-// Lê o índice gravado (linhas JSONL). Usado pelo recall e pelo digest.
-export function loadIndex(vaultBase) {
-  try {
-    return readFileSync(join(brainDir(vaultBase), 'index.jsonl'), 'utf8')
-      .split('\n').filter(Boolean).map((l) => JSON.parse(l));
-  } catch {
-    return [];
-  }
-}
-
-const DIGEST_CAPS = { decisions: 5, sessions: 4, bugs: 2, learnings: 2 };
-
-function adrNumber(path) {
-  const m = path.match(/ADR-(\d+)/);
-  return m ? Number(m[1]) : -1;
-}
-
-// Destila index.jsonl em .brain/DIGEST.md (camada quente, determinístico, 0 token LLM).
-// Cap por construção: 1 header + 13 itens (5/4/2/2) + 1 pointer = máx 15 linhas.
-export function buildBrainDigest(vaultBase, rows = null) {
-  const data = rows ?? loadIndex(vaultBase);
-  const byDateDesc = [...data].sort((a, b) =>
-    String(b.date || '').localeCompare(String(a.date || '')) || String(b.file || '').localeCompare(String(a.file || '')));
-
-  const seen = new Set();
-  const pick = (kind, max) => {
-    const out = [];
-    for (const r of byDateDesc) {
-      for (const p of r[kind] || []) {
-        if (out.length >= max) return out;
-        if (!seen.has(p)) { seen.add(p); out.push(p); }
-      }
-    }
-    return out;
-  };
-
-  // The digest is INJECTED into every session, so a dead wikilink is dead weight in the model's
-  // context. Keep only targets that resolve to a real note (by vault-relative path or basename)
-  // and drop placeholder paths (a truncated `…` from a summary line). `pick` collects extra so
-  // caps still fill after filtering.
-  const known = new Set();
-  for (const r of data) {
-    const rel = String(r.file || '').replace(/\.md$/i, '');
-    if (rel) { known.add(rel); known.add(basename(rel)); }
-  }
-  const resolves = (p) => {
-    const t = String(p || '').replace(/\.md$/i, '').trim();
-    if (!t || t.includes('...') || t.includes('…')) return false;
-    return known.has(t) || known.has(basename(t)) || existsSync(join(vaultBase, `${t}.md`));
-  };
-  const pickLive = (kind, max) => pick(kind, max * 4).filter(resolves).slice(0, max);
-
-  const decisions = pickLive('decisions', DIGEST_CAPS.decisions).sort((a, b) => adrNumber(b) - adrNumber(a));
-  const sessions = byDateDesc.slice(0, DIGEST_CAPS.sessions);
-  const bugs = pickLive('bugs', DIGEST_CAPS.bugs);
-  const learnings = pickLive('learnings', DIGEST_CAPS.learnings);
-
-  const lines = ['<!-- AUTO-GERADO por brain-core.mjs (0 token LLM). NÃO editar. Rebuild: node .agent/hooks/brain-reindex.mjs -->'];
-  for (const d of decisions) lines.push(`- Decisão: [[${d}]]`);
-  for (const s of sessions) lines.push(`- Sessão ${s.date} (${s.provider || '?'}): ${s.summary || s.file} → [[${String(s.file || '').replace(/\.md$/, '')}]]`);
-  for (const b of bugs) lines.push(`- Bug: [[${b}]]`);
-  for (const l of learnings) lines.push(`- Aprendizado: [[${l}]]`);
-
-  const shown = sessions.length;
-  if (data.length > shown) lines.push(`- +${data.length - shown} mais no índice — use /brain-recall <tópico>`);
-
-  ensureDir(brainDir(vaultBase));
-  writeFileSync(join(brainDir(vaultBase), 'DIGEST.md'), lines.join('\n') + '\n', 'utf8');
-  return lines;
-}
+// .agent/hooks/brain-core.mjs
+// Camada fria do brain: indexa o frontmatter das notas de sessão (0 token LLM).
+import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { basename, join } from 'node:path';
+import { ensureDir, stripYamlQuotes, toVaultRelative } from './obsidian-common.mjs';
+import { getLocale } from './locale.mjs';
+
+export function brainDir(vaultBase) {
+  return join(vaultBase, '.brain');
+}
+
+// Frontmatter YAML simples: escalares `k: v` + listas `k:` seguido de `  - item`.
+export function parseFrontmatter(content) {
+  const m = content.match(/^---\n([\s\S]*?)\n---/);
+  if (!m) return {};
+  const data = {};
+  const lines = m[1].split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    const kv = lines[i].match(/^([\w-]+):\s*(.*)$/);
+    if (!kv) continue;
+    const key = kv[1];
+    const val = kv[2];
+    if (val === '') {
+      const list = [];
+      while (i + 1 < lines.length && /^\s+-\s+/.test(lines[i + 1])) {
+        list.push(stripYamlQuotes(lines[++i].replace(/^\s+-\s+/, '').trim()));
+      }
+      data[key] = list.length ? list : '';
+    } else {
+      data[key] = stripYamlQuotes(val.trim());
+    }
+  }
+  return data;
+}
+
+function walkMd(dir) {
+  const out = [];
+  let entries;
+  try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return out; }
+  for (const e of entries) {
+    const fp = join(dir, e.name);
+    if (e.isDirectory()) out.push(...walkMd(fp));
+    else if (e.name.endsWith('.md')) out.push(fp);
+  }
+  return out;
+}
+
+const DERIVED_RE = /\[\[(0[456]-[^\]|]+?)(?:\|[^\]]*)?\]\]/g;
+function derivedLinks(content) {
+  const dec = new Set(), bug = new Set(), lea = new Set();
+  let m;
+  while ((m = DERIVED_RE.exec(content))) {
+    const t = m[1];
+    if (t.startsWith('04-')) dec.add(t);
+    else if (t.startsWith('05-')) bug.add(t);
+    else if (t.startsWith('06-')) lea.add(t);
+  }
+  return { decisions: [...dec], bugs: [...bug], learnings: [...lea] };
+}
+
+// Varre 02-Sessões/** e regrava .brain/index.jsonl inteiro. Provider-agnóstico.
+export function buildBrainIndex(vaultBase) {
+  const rows = [];
+  for (const fp of walkMd(join(vaultBase, getLocale(vaultBase).folders.sessions))) {
+    let content;
+    try { content = readFileSync(fp, 'utf8'); } catch { continue; }
+    const fm = parseFrontmatter(content);
+    if (fm.type && fm.type !== 'session') continue;
+    const der = derivedLinks(content);
+    rows.push({
+      session_id: fm.session_id || '',
+      date: fm.date || '',
+      provider: fm.provider || '',
+      status: fm.status || '',
+      summary: fm.summary || '',
+      file: toVaultRelative(vaultBase, fp),
+      tags: Array.isArray(fm.tags) ? fm.tags : (fm.tags ? [fm.tags] : []),
+      decisions: der.decisions,
+      bugs: der.bugs,
+      learnings: der.learnings,
+    });
+  }
+  rows.sort((a, b) => (a.date + a.file).localeCompare(b.date + b.file));
+  ensureDir(brainDir(vaultBase));
+  const out = rows.map((r) => JSON.stringify(r)).join('\n') + (rows.length ? '\n' : '');
+  writeFileSync(join(brainDir(vaultBase), 'index.jsonl'), out, 'utf8');
+  return rows;
+}
+
+// Lê o índice gravado (linhas JSONL). Usado pelo recall e pelo digest.
+export function loadIndex(vaultBase) {
+  try {
+    return readFileSync(join(brainDir(vaultBase), 'index.jsonl'), 'utf8')
+      .split('\n').filter(Boolean).map((l) => JSON.parse(l));
+  } catch {
+    return [];
+  }
+}
+
+const DIGEST_CAPS = { decisions: 5, sessions: 4, bugs: 2, learnings: 2 };
+
+function adrNumber(path) {
+  const m = path.match(/ADR-(\d+)/);
+  return m ? Number(m[1]) : -1;
+}
+
+// Destila index.jsonl em .brain/DIGEST.md (camada quente, determinístico, 0 token LLM).
+// Cap por construção: 1 header + 13 itens (5/4/2/2) + 1 pointer = máx 15 linhas.
+export function buildBrainDigest(vaultBase, rows = null) {
+  const data = rows ?? loadIndex(vaultBase);
+  const byDateDesc = [...data].sort((a, b) =>
+    String(b.date || '').localeCompare(String(a.date || '')) || String(b.file || '').localeCompare(String(a.file || '')));
+
+  const seen = new Set();
+  const pick = (kind, max) => {
+    const out = [];
+    for (const r of byDateDesc) {
+      for (const p of r[kind] || []) {
+        if (out.length >= max) return out;
+        if (!seen.has(p)) { seen.add(p); out.push(p); }
+      }
+    }
+    return out;
+  };
+
+  // The digest is INJECTED into every session, so a dead wikilink is dead weight in the model's
+  // context. Keep only targets that resolve to a real note (by vault-relative path or basename)
+  // and drop placeholder paths (a truncated `…` from a summary line). `pick` collects extra so
+  // caps still fill after filtering.
+  const known = new Set();
+  for (const r of data) {
+    const rel = String(r.file || '').replace(/\.md$/i, '');
+    if (rel) { known.add(rel); known.add(basename(rel)); }
+  }
+  const resolves = (p) => {
+    const t = String(p || '').replace(/\.md$/i, '').trim();
+    if (!t || t.includes('...') || t.includes('…')) return false;
+    return known.has(t) || known.has(basename(t)) || existsSync(join(vaultBase, `${t}.md`));
+  };
+  const pickLive = (kind, max) => pick(kind, max * 4).filter(resolves).slice(0, max);
+
+  const decisions = pickLive('decisions', DIGEST_CAPS.decisions).sort((a, b) => adrNumber(b) - adrNumber(a));
+  const sessions = byDateDesc.slice(0, DIGEST_CAPS.sessions);
+  const bugs = pickLive('bugs', DIGEST_CAPS.bugs);
+  const learnings = pickLive('learnings', DIGEST_CAPS.learnings);
+
+  const lines = ['<!-- AUTO-GERADO por brain-core.mjs (0 token LLM). NÃO editar. Rebuild: node .agent/hooks/brain-reindex.mjs -->'];
+  for (const d of decisions) lines.push(`- Decisão: [[${d}]]`);
+  for (const s of sessions) lines.push(`- Sessão ${s.date} (${s.provider || '?'}): ${s.summary || s.file} → [[${String(s.file || '').replace(/\.md$/, '')}]]`);
+  for (const b of bugs) lines.push(`- Bug: [[${b}]]`);
+  for (const l of learnings) lines.push(`- Aprendizado: [[${l}]]`);
+
+  const shown = sessions.length;
+  if (data.length > shown) lines.push(`- +${data.length - shown} mais no índice — use /brain-recall <tópico>`);
+
+  ensureDir(brainDir(vaultBase));
+  writeFileSync(join(brainDir(vaultBase), 'DIGEST.md'), lines.join('\n') + '\n', 'utf8');
+  return lines;
+}

package/hooks/brain-recall.mjs

@@ -1,32 +1,32 @@
-// .agent/hooks/brain-recall.mjs
-// Query engine read-only: pontua o índice por tópico. Token só no resultado.
-// Uso: node .agent/hooks/brain-recall.mjs <termos da busca>
-import { pathToFileURL } from 'node:url';
-import { getVaultBase } from './obsidian-common.mjs';
-import { loadIndex } from './brain-core.mjs';
-
-export { loadIndex };
-
-export function scoreRows(rows, query, topK = 5) {
-  const terms = String(query).toLowerCase().split(/\s+/).filter(Boolean);
-  if (!terms.length) return [];
-  return rows
-    .map((r) => {
-      // Inclui slug do file + paths das derivadas (ADR/bug/aprendizado) no haystack:
-      // os títulos das sessões e tags são genéricos; o sinal tópico vem dos slugs.
-      const hay = `${r.summary || ''} ${(r.tags || []).join(' ')} ${r.file || ''} ${(r.decisions || []).join(' ')} ${(r.bugs || []).join(' ')} ${(r.learnings || []).join(' ')}`.toLowerCase();
-      let score = 0;
-      for (const t of terms) if (hay.includes(t)) score++;
-      return { row: r, score };
-    })
-    .filter((s) => s.score > 0)
-    .sort((a, b) => b.score - a.score || String(b.row.date || '').localeCompare(String(a.row.date || '')))
-    .slice(0, topK)
-    .map((s) => s.row);
-}
-
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
-  const vaultBase = getVaultBase();
-  const hits = scoreRows(loadIndex(vaultBase), process.argv.slice(2).join(' '));
-  process.stdout.write(JSON.stringify(hits, null, 2) + '\n');
-}
+// .agent/hooks/brain-recall.mjs
+// Query engine read-only: pontua o índice por tópico. Token só no resultado.
+// Uso: node .agent/hooks/brain-recall.mjs <termos da busca>
+import { pathToFileURL } from 'node:url';
+import { getVaultBase } from './obsidian-common.mjs';
+import { loadIndex } from './brain-core.mjs';
+
+export { loadIndex };
+
+export function scoreRows(rows, query, topK = 5) {
+  const terms = String(query).toLowerCase().split(/\s+/).filter(Boolean);
+  if (!terms.length) return [];
+  return rows
+    .map((r) => {
+      // Inclui slug do file + paths das derivadas (ADR/bug/aprendizado) no haystack:
+      // os títulos das sessões e tags são genéricos; o sinal tópico vem dos slugs.
+      const hay = `${r.summary || ''} ${(r.tags || []).join(' ')} ${r.file || ''} ${(r.decisions || []).join(' ')} ${(r.bugs || []).join(' ')} ${(r.learnings || []).join(' ')}`.toLowerCase();
+      let score = 0;
+      for (const t of terms) if (hay.includes(t)) score++;
+      return { row: r, score };
+    })
+    .filter((s) => s.score > 0)
+    .sort((a, b) => b.score - a.score || String(b.row.date || '').localeCompare(String(a.row.date || '')))
+    .slice(0, topK)
+    .map((s) => s.row);
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const vaultBase = getVaultBase();
+  const hits = scoreRows(loadIndex(vaultBase), process.argv.slice(2).join(' '));
+  process.stdout.write(JSON.stringify(hits, null, 2) + '\n');
+}

package/hooks/brain-reindex.mjs

@@ -1,13 +1,13 @@
-// .agent/hooks/brain-reindex.mjs
-// Backfill manual: reconstrói .brain/index.jsonl + .brain/DIGEST.md varrendo todo 02-Sessões.
-// Uso: node .agent/hooks/brain-reindex.mjs [caminho-do-vault]
-import { pathToFileURL } from 'node:url';
-import { getVaultBase } from './obsidian-common.mjs';
-import { buildBrainDigest, buildBrainIndex, brainDir } from './brain-core.mjs';
-
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
-  const vaultBase = getVaultBase({ obsidian_vault_path: process.argv[2] });
-  const rows = buildBrainIndex(vaultBase);
-  const digest = buildBrainDigest(vaultBase, rows);
-  process.stdout.write(`[brain] index: ${rows.length} sessões; digest: ${digest.length} linhas → ${brainDir(vaultBase)}\n`);
-}
+// .agent/hooks/brain-reindex.mjs
+// Backfill manual: reconstrói .brain/index.jsonl + .brain/DIGEST.md varrendo todo 02-Sessões.
+// Uso: node .agent/hooks/brain-reindex.mjs [caminho-do-vault]
+import { pathToFileURL } from 'node:url';
+import { getVaultBase } from './obsidian-common.mjs';
+import { buildBrainDigest, buildBrainIndex, brainDir } from './brain-core.mjs';
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const vaultBase = getVaultBase({ obsidian_vault_path: process.argv[2] });
+  const rows = buildBrainIndex(vaultBase);
+  const digest = buildBrainDigest(vaultBase, rows);
+  process.stdout.write(`[brain] index: ${rows.length} sessões; digest: ${digest.length} linhas → ${brainDir(vaultBase)}\n`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wendkeep",
-  "version": "0.66.0",
+  "version": "0.66.1",
   "description": "Vault-first persistent memory for AI coding agents, with an optional profile-aware governance runtime: OFF, FLOW, GUIDE, GOVERN, or ASSURE. Local-first and agent-agnostic (Claude Code, Codex, Cursor…).",
   "type": "module",
   "workspaces": [

package/packages/cli/src/index.mjs

@@ -101,7 +101,7 @@ Usage:
   wendkeep lesson add "t" "l"   Record a project-local lesson (injected at SessionStart).
   wendkeep memory <sub>          Shared memory v2: status | migrate [--apply] | repair |
                            reconcile <session> --by-session <session> --reason <text> [--apply] |
-                           promote <candidate> | reject <candidate>. --vault P.
+                           promote <candidate> [--event <event-id>] | reject <candidate>. --vault P.
                            Reconcile is dry-run by default; the original attempt remains audited.
   wendkeep validate-memory [path]  Validate .brain/CORE.md against the compaction
                            protocol (cap 25, 3 sections, no secrets/PII).

package/packages/vault/src/memory-schema.mjs

@@ -108,6 +108,31 @@ export function validateMemoryEvent(event, { projectId } = {}) {
     errors.push(`project_id não pertence ao vault esperado (${projectId}).`);
   }
 
+  if (event.candidate_decision !== undefined) {
+    const decision = event.candidate_decision;
+    if (!decision || typeof decision !== 'object' || Array.isArray(decision)) {
+      errors.push('candidate_decision deve ser objeto.');
+    } else {
+      if (typeof decision.candidate_id !== 'string' || !decision.candidate_id) {
+        errors.push('candidate_decision.candidate_id deve ser string não vazia.');
+      }
+      if (!['promote', 'reject'].includes(decision.action)) {
+        errors.push('candidate_decision.action deve ser promote ou reject.');
+      }
+      if (!Array.isArray(decision.event_ids)
+          || decision.event_ids.some((item) => typeof item !== 'string' || !item)) {
+        errors.push('candidate_decision.event_ids deve ser array de strings não vazias.');
+      }
+      if (decision.action === 'promote' && decision.selected_event_id !== undefined
+          && (typeof decision.selected_event_id !== 'string' || !decision.selected_event_id)) {
+        errors.push('candidate_decision.selected_event_id deve ser string não vazia.');
+      }
+      if (decision.action === 'reject' && decision.selected_event_id !== undefined) {
+        errors.push('candidate_decision.selected_event_id não é permitido em reject.');
+      }
+    }
+  }
+
   for (const field of ['value', 'evidence']) sanitizedField(event, field, errors);
   return { ok: errors.length === 0, errors, warnings };
 }

package/packages/vault/src/memory-store.mjs

@@ -461,6 +461,19 @@ export function reduceMemoryEvents(inputEvents = [], { coreInvariants = new Map(
     if (!existing) unique.set(event.event_id, event);
   }
   const events = [...unique.values()].sort(eventOrder);
+  const candidateDecisions = new Map();
+  for (const item of events) {
+    const decision = item.candidate_decision;
+    if (!decision) continue;
+    const existing = candidateDecisions.get(decision.candidate_id);
+    if (existing && canonicalMemoryJson(existing.decision) !== canonicalMemoryJson(decision)) {
+      throw new MemoryEventCollision(
+        decision.candidate_id,
+        `Ledger contains incompatible decisions for candidate ${decision.candidate_id}`,
+      );
+    }
+    if (!existing) candidateDecisions.set(decision.candidate_id, { decision, event: item });
+  }
 
   const peerGroups = new Map();
   for (const item of events) {
@@ -488,6 +501,11 @@ export function reduceMemoryEvents(inputEvents = [], { coreInvariants = new Map(
   let revision = 0;
 
   for (const item of events) {
+    if (item.candidate_decision && item.candidate_decision.action === 'reject') {
+      appliedEventIds.push(item.event_id);
+      continue;
+    }
+
     if (protectedValues.has(item.memory_key)) {
       const coreValue = protectedValues.get(item.memory_key);
       const agreesWithCore = item.operation === 'assert'
@@ -604,7 +622,9 @@ export function reduceMemoryEvents(inputEvents = [], { coreInvariants = new Map(
   const state = sortedObject(stateEntries);
   const recordObject = sortedObject(recordEntries);
   const tombstoneObject = sortedObject(tombstoneEntries);
-  candidates.sort((left, right) => left.candidate_id.localeCompare(right.candidate_id));
+  const unresolvedCandidates = candidates
+    .filter((item) => !candidateDecisions.has(item.candidate_id));
+  unresolvedCandidates.sort((left, right) => left.candidate_id.localeCompare(right.candidate_id));
   superseded.sort((left, right) => left.event_id.localeCompare(right.event_id));
   const activeEvents = Object.entries(recordObject).map(([memoryKey, record]) => ({
     ...record.source,
@@ -618,7 +638,7 @@ export function reduceMemoryEvents(inputEvents = [], { coreInvariants = new Map(
   return {
     state,
     records: recordObject,
-    candidates,
+    candidates: unresolvedCandidates,
     tombstones: tombstoneObject,
     superseded,
     appliedEventIds,

package/src/memory.mjs

@@ -237,37 +237,191 @@ function readCandidates(vault) {
     .split('\n').filter(Boolean).map((line) => JSON.parse(line));
 }
 
-export function decideMemoryCandidate(vault, { action, candidateId, value } = {}) {
+function priorCandidateDecision(vault, candidateId) {
+  return readMemoryLedger(vault).events.find(
+    (event) => event.candidate_decision?.candidate_id === candidateId,
+  ) || null;
+}
+
+function candidateEvent(candidate, eventId) {
+  const events = Array.isArray(candidate.events) ? candidate.events : [];
+  if (candidate.reason === 'conflict' && !eventId) {
+    throw new Error('Candidate de conflito exige eventId (--event na CLI).');
+  }
+  if (!eventId) return events.length === 1 ? events[0] : null;
+  const selected = events.find((event) => event.event_id === eventId);
+  if (!selected) throw new Error(`event_id ${eventId} não pertence ao candidate ${candidate.candidate_id}.`);
+  return selected;
+}
+
+function assertCompatibleDecision(prior, { action, eventId }) {
+  const decision = prior.candidate_decision;
+  const sameSelection = action !== 'promote'
+    || (decision.selected_event_id || null) === (eventId || null);
+  if (decision.action !== action || !sameSelection) {
+    throw new Error(`Candidate ${decision.candidate_id} já possui decisão incompatível (${decision.action}).`);
+  }
+}
+
+function matchesPromotedAttempt(attempt, selected) {
+  if (attempt?.memory_mode !== 'v2' || attempt.state !== 'projected'
+      || !Array.isArray(attempt.event_ids) || !attempt.event_ids.includes(selected.event_id)) return false;
+  if (attempt.activation_id && selected.activation_id
+      && attempt.activation_id !== selected.activation_id) return false;
+  if (Number.isInteger(attempt.activation_epoch) && Number.isInteger(selected.activation_epoch)
+      && attempt.activation_epoch !== selected.activation_epoch) return false;
+  if (Number.isInteger(attempt.turn_sequence) && Number.isInteger(selected.turn_sequence)
+      && attempt.turn_sequence !== selected.turn_sequence) return false;
+  if (attempt.canonical_session_id && selected.canonical_session_id
+      && attempt.canonical_session_id !== selected.canonical_session_id) return false;
+  return true;
+}
+
+function snapshotPromotedAttemptCheckpoints(vault, selected) {
+  if (!selected) return new Map();
+  const registry = readSessionRegistry(vault);
+  return new Map(Object.entries(registry.sessions || {})
+    .filter(([, entry]) => matchesPromotedAttempt(entry?.last_memory_attempt, selected))
+    .map(([sessionId, entry]) => [sessionId, {
+      attempt: attemptFingerprint(entry.last_memory_attempt),
+      checkpoint: memoryCheckpointFingerprint(entry),
+    }]));
+}
+
+function refreshPromotedAttemptCheckpoint(vault, {
+  candidateId, decisionEventId, selected, checkpoint, decidedAt, expectedAttempts,
+}) {
+  if (!selected || !checkpoint || !expectedAttempts?.size) return 0;
+  return mutateSessionRegistry(vault, (registry) => {
+    let refreshed = 0;
+    for (const [sessionId, entry] of Object.entries(registry.sessions || {})) {
+      const expected = expectedAttempts.get(sessionId);
+      if (!expected) continue;
+      const attempt = entry?.last_memory_attempt;
+      if (attemptFingerprint(attempt) !== expected.attempt
+          || memoryCheckpointFingerprint(entry) !== expected.checkpoint) continue;
+
+      const alreadyAudited = (entry.memory_candidate_decisions || [])
+        .some((audit) => audit.decision_event_id === decisionEventId);
+      if (alreadyAudited && sameCheckpoint(attempt.checkpoint, checkpoint)
+          && sameCheckpoint(entry.memory_checkpoint, checkpoint)) continue;
+      const originalCheckpoint = cloneJson(attempt.checkpoint || entry.memory_checkpoint || null);
+      attempt.checkpoint = cloneJson(checkpoint);
+      entry.memory_checkpoint = cloneJson(checkpoint);
+      entry.memory_status = 'projected';
+      if (!alreadyAudited) {
+        entry.memory_candidate_decisions = [
+          ...(Array.isArray(entry.memory_candidate_decisions) ? entry.memory_candidate_decisions : []),
+          {
+            v: 1,
+            type: 'candidate_checkpoint_refreshed',
+            candidate_id: candidateId,
+            decision_event_id: decisionEventId,
+            selected_event_id: selected.event_id,
+            decided_at: decidedAt,
+            original_checkpoint: originalCheckpoint,
+            checkpoint: cloneJson(checkpoint),
+          },
+        ];
+      }
+      refreshed += 1;
+    }
+    return refreshed;
+  });
+}
+
+export function decideMemoryCandidate(vault, {
+  action, candidateId, value, eventId, beforeCheckpointRefresh,
+} = {}) {
   if (!['promote', 'reject'].includes(action)) throw new TypeError('action deve ser promote ou reject.');
   if (!candidateId) throw new TypeError('candidateId é obrigatório.');
+  const preflight = projectMemoryOutbox(vault);
+  if (preflight.status === 'busy') return { status: 'busy', candidateId };
+  const prior = priorCandidateDecision(vault, candidateId);
+  if (prior) {
+    assertCompatibleDecision(prior, { action, eventId });
+    const selected = action === 'promote' && prior.candidate_decision.selected_event_id
+      ? readMemoryLedger(vault).events.find(
+        (event) => event.event_id === prior.candidate_decision.selected_event_id,
+      )
+      : null;
+    const expectedAttempts = snapshotPromotedAttemptCheckpoints(vault, selected);
+    beforeCheckpointRefresh?.();
+    const checkpointRefreshed = action === 'promote'
+      ? refreshPromotedAttemptCheckpoint(vault, {
+        candidateId,
+        decisionEventId: prior.event_id,
+        selected,
+        checkpoint: preflight.checkpoint,
+        decidedAt: prior.observed_at,
+        expectedAttempts,
+      })
+      : 0;
+    return {
+      status: action === 'promote' ? 'promoted' : 'rejected',
+      candidateId,
+      eventId: prior.event_id,
+      alreadyApplied: true,
+      checkpointRefreshed,
+      projection: preflight,
+    };
+  }
   const candidates = readCandidates(vault);
   const candidate = candidates.find((item) => item.candidate_id === candidateId);
   if (!candidate) throw new Error(`Candidate não encontrado: ${candidateId}`);
+  if (action === 'promote' && candidate.reason === 'blocked_by_core') {
+    throw new Error(`Candidate ${candidateId} está blocked_by_core; edite CORE ou rejeite o candidate.`);
+  }
+  const selected = action === 'promote' ? candidateEvent(candidate, eventId) : null;
+  const expectedAttempts = snapshotPromotedAttemptCheckpoints(vault, selected);
+  const selectedValue = selected?.value ?? value ?? candidate.value ?? candidate.proposed_value;
+  if (action === 'promote' && selectedValue === undefined) {
+    throw new Error(`Candidate ${candidateId} não contém valor promovível.`);
+  }
   const now = new Date().toISOString();
+  const decision = {
+    candidate_id: candidateId,
+    action,
+    event_ids: Array.isArray(candidate.event_ids) ? [...candidate.event_ids].sort() : [],
+    ...(selected ? { selected_event_id: selected.event_id } : {}),
+  };
   const event = {
     v: 1,
-    event_id: `cli-${action}-${hash(candidateId).slice(0, 20)}`,
+    event_id: `cli-${action}-${hash(`${candidateId}\0${selected?.event_id || ''}`).slice(0, 20)}`,
     project_id: projectId(vault),
-    memory_key: action === 'promote' ? candidate.memory_key : `candidate.rejected.${candidateId}`,
-    operation: 'assert',
-    value: sanitizeMemoryText(action === 'promote' ? (value ?? candidate.value ?? candidate.values?.[0] ?? '') : 'rejected'),
+    memory_key: action === 'promote' ? candidate.memory_key : `candidate.decision.${candidateId}`,
+    operation: action === 'promote' && selected ? 'replace' : 'assert',
+    value: sanitizeMemoryText(action === 'promote' ? selectedValue : 'rejected'),
     authority: 'verified',
-    activation_id: 'wendkeep-memory-cli',
-    turn_sequence: 0,
+    activation_id: selected?.activation_id || 'wendkeep-memory-cli',
+    ...(Number.isInteger(selected?.activation_epoch) ? { activation_epoch: selected.activation_epoch } : {}),
+    turn_sequence: selected?.turn_sequence ?? 0,
     observed_at: now,
     evidence: [`candidate:${candidateId}`],
+    candidate_decision: decision,
+    ...(selected ? { supersedes: decision.event_ids } : {}),
   };
   enqueueMemoryEvent(vault, event);
   const projection = projectMemoryOutbox(vault);
   if (projection.status === 'busy') return { status: 'busy', candidateId };
-  const remaining = candidates.filter((item) => item.candidate_id !== candidateId);
-  const projected = readCandidates(vault);
-  const merged = new Map([...remaining, ...projected].map((item) => [item.candidate_id, item]));
-  writeVaultFileAtomic(
-    vault, brainPath(vault, CANDIDATES), candidateText([...merged.values()]), 'utf8',
-    { label: 'candidates após decisão humana' },
-  );
-  return { status: action === 'promote' ? 'promoted' : 'rejected', candidateId, eventId: event.event_id, projection };
+  beforeCheckpointRefresh?.();
+  const checkpointRefreshed = action === 'promote'
+    ? refreshPromotedAttemptCheckpoint(vault, {
+      candidateId,
+      decisionEventId: event.event_id,
+      selected,
+      checkpoint: projection.checkpoint,
+      decidedAt: now,
+      expectedAttempts,
+    })
+    : 0;
+  return {
+    status: action === 'promote' ? 'promoted' : 'rejected',
+    candidateId,
+    eventId: event.event_id,
+    checkpointRefreshed,
+    projection,
+  };
 }
 
 function cloneJson(value) {
@@ -1038,8 +1192,14 @@ export function runMemory(argv) {
         apply: reconcileArgs.apply,
       });
     }
-    else if (sub === 'promote' || sub === 'reject') result = decideMemoryCandidate(vault, { action: sub, candidateId: positional });
-    else { process.stderr.write('wendkeep memory: use status | migrate [--apply] | repair | reconcile <session> --by-session <session> --reason <text> [--apply] | promote <candidate> | reject <candidate>.\n'); process.exitCode = 2; return; }
+    else if (sub === 'promote' || sub === 'reject') {
+      const eventId = option(argv, '--event');
+      if (sub === 'reject' && eventId) throw memoryUsageError('--event é permitido somente em memory promote.');
+      result = decideMemoryCandidate(vault, {
+        action: sub, candidateId: positional, ...(eventId ? { eventId } : {}),
+      });
+    }
+    else { process.stderr.write('wendkeep memory: use status | migrate [--apply] | repair | reconcile <session> --by-session <session> --reason <text> [--apply] | promote <candidate> [--event <event-id>] | reject <candidate>.\n'); process.exitCode = 2; return; }
     process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
     if (sub === 'status' && argv.includes('--gate')) process.exitCode = result.status === 'blocked' ? 1 : 0;
     else if (sub === 'reconcile' && reconcileArgs.apply) process.exitCode = result.health?.status === 'blocked' ? 1 : 0;