wendkeep 0.66.0 → 0.66.3

package/CHANGELOG.md

@@ -4,6 +4,42 @@ All notable changes to **wendkeep** are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.66.3] — 2026-07-30
+
+### Fixed
+
+- **O replay reavalia candidates transitórios contra a fonte moderna final.** Um Stop da mesma
+  sessão/activation/epoch e turno maior agora avança depois que a correção causal já presente se
+  torna ativa; turno menor fica superseded e divergências reais continuam para curadoria.
+- **`memory repair` migra o checkpoint antigo somente com prova e CAS.** O repair compara a
+  semântica anterior e a atual, faz backup, atualiza attempt e espelho e registra auditoria sem
+  reordenar, reescrever ou acrescentar evento ao ledger. Prova incompleta continua bloqueada. A
+  0.66.2 não deve ser publicada no npm; publique e instale a 0.66.3.
+
+## [0.66.2] — 2026-07-29
+
+### Fixed
+
+- **Promoção preserva valor e identidade causal do evento escolhido.** `memory promote` não
+  converte mais objetos/arrays JSON em texto e mantém sessão, activation/epoch, turno de origem e
+  sequência; o próximo `SessionStop` da mesma cadeia avança o handoff sem recriar candidate.
+- **A recuperação 0.66.1 cobre inversão física/temporal sem ampliar autoridade.** Quando uma
+  promoção legada projetada fica fora do candidate por `observed_at`, `memory promote` só a inclui
+  em `supersedes` sob prova de ancestralidade e mesma linhagem; fonte moderna ou alheia falha antes
+  de anexar. O E2E percorre o dispatcher público e prova Stop posterior e duplicado idempotentes.
+
+## [0.66.1] — 2026-07-29
+
+### Fixed
+
+- **A curadoria de candidates agora é durável e idempotente.** `memory promote` e
+  `memory reject` registram decisões causais no ledger; repair/replay não recriam o conflito
+  resolvido, retries não duplicam eventos, candidates sobrepostos permanecem isolados e a
+  promoção recupera o checkpoint divergente do attempt correspondente sem tocar attempt novo.
+- **Promoção de conflito exige escolha explícita.** `memory promote <candidate> --event
+  <event-id>` publica exatamente o evento escolhido, rejeita IDs externos ao candidate e não
+  permite que `blocked_by_core` sobrescreva a autoridade canônica de CORE.
+
 ## [0.66.0] — 2026-07-29
 
 ### Added

package/README.en.md

@@ -256,7 +256,7 @@ Hot memory now separates human authorship, operational state, and evidence:
 - **`CORE.md` is canonical.** It is the short, hand-curated nucleus for durable preferences, active patterns, and open issues; no projector may infer or overwrite it.
 - **`SHARED_MEMORY.md` is generated operational state.** The `Stop` hook turns the session handoff into sanitized events; the projector deterministically reduces the ledger and publishes a verifiable revision, cursor, and hash. Facts are `verified` only with local evidence; unsupported reports remain `reported`, and disagreements become candidates for human judgment.
 - **`MEMORY_EVENTS.jsonl` is the append-only authority.** `Stop` makes events durable in the outbox before acknowledging the attempt; the projector runs outside the registry lock and retries reuse the same IDs. Repeating an identical `event_id`/payload is a no-op; reusing the ID with different bytes is observable corruption.
-- **`MEMORY_CANDIDATES.jsonl` is the curation queue.** Conflicts and legacy content are never silently promoted. `promote` and `reject` record the decision as a new event.
+- **`MEMORY_CANDIDATES.jsonl` is the curation queue.** Conflicts and legacy content are never silently promoted. `promote` and `reject` record the decision as a new event; promotion preserves the selected event's JSON type, session, activation/epoch, and source turn.
 
 Artifacts stay under `.brain/` only. Sanitization strips secrets, tokens, local paths, transcripts, and harness payloads both before persistence and before injection. Events carry a `project_id`, and one vault never accepts another project's events.
 
@@ -294,7 +294,18 @@ backup/audit; divergent mirrors fail closed. A demonstrably superseded
 ambiguity uses `memory reconcile <session> --by-session <successor>
 --reason <reason>` as a dry run and requires `--apply`; the decision is backed up and audited
 without rewriting ledger, CORE, or notes. Run `status --gate` again afterwards. Conflicts require
-explicit curation with `memory promote <id>` or `memory reject <id>`; doctor only diagnoses.
+explicit, durable curation: `memory promote <id> --event <event-id>` selects one event from the
+candidate, while `memory reject <id>` keeps the current value. The decision is idempotent, and a
+new promotion accepts a later Stop from the same session/activation without recreating a conflict.
+A promotion written by 0.66.1 remains historical: if the next Stop forms a new candidate, update
+to 0.66.3 and run `memory repair`. During replay, a transient candidate is re-evaluated against the
+final modern source: the same session/activation/epoch and a higher turn advances; a lower turn is
+superseded. Repair migrates the checkpoint and mirror only when it proves the exact previous
+replay, attempt identity, and absence of a real conflict; it creates a backup and audit without
+appending or rewriting events. Ambiguity stays queued for explicit curation. Do not publish or
+install 0.66.2; use 0.66.3. Decisions survive repair/replay;
+`blocked_by_core` cannot override CORE. Doctor only
+diagnoses. See [memory and curation](docs/en/commands/memory.md).
 
 Session notes use one live `## Agentes, tokens e custos` snapshot. Main-agent and subagent hooks recompose it atomically, with costs, token dimensions, reasoning tokens and effort per model/source. Every hook that rewrites a session note takes a per-file lock and writes through a temp file + rename, so the `SubagentStop` fan-out (one hook run per subagent) can never leave a note half-written; a note whose frontmatter reads back damaged is left untouched rather than patched.
 

package/README.md

@@ -256,7 +256,7 @@ Hot memory now separates human authorship, operational state, and evidence:
 - **`CORE.md` is canonical.** It is the short, hand-curated nucleus for durable preferences, active patterns, and open issues; no projector may infer or overwrite it.
 - **`SHARED_MEMORY.md` is generated operational state.** The `Stop` hook turns the session handoff into sanitized events; the projector deterministically reduces the ledger and publishes a verifiable revision, cursor, and hash. Facts are `verified` only with local evidence; unsupported reports remain `reported`, and disagreements become candidates for human judgment.
 - **`MEMORY_EVENTS.jsonl` is the append-only authority.** `Stop` makes events durable in the outbox before acknowledging the attempt; the projector runs outside the registry lock and retries reuse the same IDs. Repeating an identical `event_id`/payload is a no-op; reusing the ID with different bytes is observable corruption.
-- **`MEMORY_CANDIDATES.jsonl` is the curation queue.** Conflicts and legacy content are never silently promoted. `promote` and `reject` record the decision as a new event.
+- **`MEMORY_CANDIDATES.jsonl` is the curation queue.** Conflicts and legacy content are never silently promoted. `promote` and `reject` record the decision as a new event; promotion preserves the selected event's JSON type, session, activation/epoch, and source turn.
 
 Artifacts stay under `.brain/` only. Sanitization strips secrets, tokens, local paths, transcripts, and harness payloads both before persistence and before injection. Events carry a `project_id`, and one vault never accepts another project's events.
 
@@ -294,7 +294,18 @@ backup/audit; divergent mirrors fail closed. A demonstrably superseded
 ambiguity uses `memory reconcile <session> --by-session <successor>
 --reason <reason>` as a dry run and requires `--apply`; the decision is backed up and audited
 without rewriting ledger, CORE, or notes. Run `status --gate` again afterwards. Conflicts require
-explicit curation with `memory promote <id>` or `memory reject <id>`; doctor only diagnoses.
+explicit, durable curation: `memory promote <id> --event <event-id>` selects one event from the
+candidate, while `memory reject <id>` keeps the current value. The decision is idempotent, and a
+new promotion accepts a later Stop from the same session/activation without recreating a conflict.
+A promotion written by 0.66.1 remains historical: if the next Stop forms a new candidate, update
+to 0.66.3 and run `memory repair`. During replay, a transient candidate is re-evaluated against the
+final modern source: the same session/activation/epoch and a higher turn advances; a lower turn is
+superseded. Repair migrates the checkpoint and mirror only when it proves the exact previous
+replay, attempt identity, and absence of a real conflict; it creates a backup and audit without
+appending or rewriting events. Ambiguity stays queued for explicit curation. Do not publish or
+install 0.66.2; use 0.66.3. Decisions survive repair/replay;
+`blocked_by_core` cannot override CORE. Doctor only
+diagnoses. See [memory and curation](docs/en/commands/memory.md).
 
 Session notes use one live `## Agentes, tokens e custos` snapshot. Main-agent and subagent hooks recompose it atomically, with costs, token dimensions, reasoning tokens and effort per model/source. Every hook that rewrites a session note takes a per-file lock and writes through a temp file + rename, so the `SubagentStop` fan-out (one hook run per subagent) can never leave a note half-written; a note whose frontmatter reads back damaged is left untouched rather than patched.
 

package/docs/en/commands/memory-migration.md

@@ -64,7 +64,8 @@ to revision 1. Replaying that prompt or Stop does not duplicate the event/revisi
 - Partial/corrupt v2 bundle: use status and repair; migration is not a corruption tool.
 - First post-migration Stop is `ambiguous`: verify that its `turn_id` belongs to the transcript and
   that `UserPromptSubmit` opened/advanced the recovery activation.
-- Many candidates: curate gradually with `memory promote`/`memory reject`.
+- Many candidates: curate gradually with `memory promote`/`memory reject`; conflicts require
+  `memory promote <candidate> --event <event-id>` to choose the winner explicitly.
 - Legacy warning remains after apply: verify the selected vault and project binding.
 
 ## Next steps

package/docs/en/commands/memory.md

@@ -26,7 +26,7 @@ Pass the vault explicitly in automation. Preserve backups and evidence before re
 npx wendkeep memory status [--gate] --vault <vault>
 npx wendkeep memory repair --vault <vault>
 npx wendkeep memory reconcile <ambiguous-session> --by-session <successor-session> --reason <reason> [--apply] --vault <vault>
-npx wendkeep memory promote <candidate> --vault <vault>
+npx wendkeep memory promote <candidate> [--event <event-id>] --vault <vault>
 npx wendkeep memory reject <candidate> --vault <vault>
 npx wendkeep validate-memory [CORE-path]
 npx wendkeep validate-memory --vault <v2-vault>
@@ -63,7 +63,22 @@ npx wendkeep validate-memory --vault <v2-vault>
   Junctions, symlinks, reparse points, or hardlinks fail closed without touching external bytes.
   Locks publish owner and lease atomically, never reap a live PID by age alone, and release only
   the lease they acquired.
-- `promote`/`reject` append auditable decisions and never rewrite the ledger in place.
+- `promote`/`reject` append an auditable, idempotent decision to the ledger. Replay and repair
+  preserve that decision and do not recreate the resolved candidate. For a `conflict` candidate,
+  `promote` requires an `--event <event-id>` that belongs to the candidate; date or random ID
+  never picks an implicit winner. `reject` preserves the current operational value. A
+  `blocked_by_core` candidate can only be rejected: promotion first requires canonical CORE
+  curation. If the selected event still belongs to the matching latest `projected` attempt,
+  promotion also refreshes its checkpoint and mirror causally; JSON reports
+  `checkpointRefreshed`, and a newer concurrent attempt remains untouched. The decision keeps
+  the already validated JSON value without string coercion and copies the selected event's
+  `canonical_session_id`, activation/epoch, `source_turn_id`, and `turn_sequence`. A later Stop
+  from the same session/activation therefore advances the value instead of opening another candidate.
+  During replay, a transient candidate is re-evaluated against the final modern source. The same
+  session/activation/epoch and a higher turn applies the Stop; a lower turn is superseded. A
+  different, incomplete, or ambiguous identity keeps the candidate queued for curation. `memory
+  repair` compares the old and current replay and migrates checkpoint+mirror only with exact
+  identity, backup, audit, and CAS; it does not reorder, rewrite, or append a ledger event.
 - `validate-memory <CORE.md>` checks the 25-line cap, required sections, and secrets.
 - `validate-memory --vault` requires a complete v2 bundle and is not the legacy-vault gate.
 
@@ -74,7 +89,8 @@ npx wendkeep memory status --gate --vault .MyApp-vault
 npx wendkeep memory reconcile old --by-session current --reason "delivery continued" --vault .MyApp-vault
 npx wendkeep memory reconcile old --by-session current --reason "delivery continued" --apply --vault .MyApp-vault
 npx wendkeep validate-memory .MyApp-vault/.brain/CORE.md
-npx wendkeep memory promote candidate-123 --vault .MyApp-vault
+npx wendkeep memory promote candidate-123 --event mem-selected --vault .MyApp-vault
+npx wendkeep memory reject candidate-456 --vault .MyApp-vault
 ```
 
 ## Expected result
@@ -97,6 +113,15 @@ of a global projection that has already advanced with concurrent events.
   `memory reconcile` dry run before authorizing `--apply`; the command fails when the ambiguous
   attempt already contains event IDs.
 - Ordinary pending candidate: recoverable warning, requiring human choice when appropriate.
+- `promote` reports that `--event` is required: inspect the candidate `event_ids`, compare their
+  provenance/value, and name the winner explicitly. An ID outside the candidate fails without
+  mutating the ledger or projections.
+- A promotion made by 0.66.1 followed by a transient candidate: update to 0.66.3, preserve a backup,
+  and run `memory repair`. Do not publish or install 0.66.2. Repair migrates the checkpoint only
+  when the old replay, attempt identity, and new event match exactly; a real conflict stays blocked
+  for a human `promote`/`reject` choice.
+- `promote` says that the candidate no longer matches the causal projection: no event was appended.
+  Run `memory status`, inspect the current candidate again, and do not force a different lineage.
 - Missing `event_cursor` or mismatched v2 hash: preserve the bundle and assess `memory repair`.
 - `validate-memory --vault` fails on legacy: validate CORE only or migrate first.
 

package/docs/pt-BR/commands/memory-migration.md

@@ -64,7 +64,8 @@ revision 1. Repetir esse prompt ou Stop não duplica evento/revision.
 - Bundle v2 parcial/corrompido: use status e repair; migração não é ferramenta de corrupção.
 - Primeiro Stop pós-migração fica `ambiguous`: confirme que o `turn_id` pertence ao transcript e
   que `UserPromptSubmit` abriu/avançou a activation de recuperação.
-- Candidates numerosos: curate gradualmente com `memory promote`/`memory reject`.
+- Candidates numerosos: curate gradualmente com `memory promote`/`memory reject`; conflitos
+  exigem `memory promote <candidate> --event <event-id>` para escolher o vencedor explicitamente.
 - Warning legado após apply: confirme o vault efetivamente selecionado e o vínculo do projeto.
 
 ## Próximos passos

package/docs/pt-BR/commands/memory.md

@@ -26,7 +26,7 @@ Informe o vault explicitamente em automações. Preserve backups e evidências a
 npx wendkeep memory status [--gate] --vault <cofre>
 npx wendkeep memory repair --vault <cofre>
 npx wendkeep memory reconcile <sessão-ambígua> --by-session <sessão-sucessora> --reason <motivo> [--apply] --vault <cofre>
-npx wendkeep memory promote <candidate> --vault <cofre>
+npx wendkeep memory promote <candidate> [--event <event-id>] --vault <cofre>
 npx wendkeep memory reject <candidate> --vault <cofre>
 npx wendkeep validate-memory [caminho-do-CORE]
 npx wendkeep validate-memory --vault <cofre-v2>
@@ -61,7 +61,21 @@ npx wendkeep validate-memory --vault <cofre-v2>
   candidates, registry, notas, backups, temporários e sidecars antes de ler ou escrever. Junction,
   symlink, reparse point ou hardlink falham fechados sem tocar bytes externos. Locks publicam owner
   e lease atomicamente, não colhem PID vivo apenas por idade e só liberam a lease adquirida.
-- `promote`/`reject` acrescentam decisão auditável; nunca reescrevem o ledger no lugar.
+- `promote`/`reject` acrescentam uma decisão auditável e idempotente ao ledger. Replay e repair
+  preservam a decisão e não recriam o candidate resolvido. Para candidate `conflict`, `promote`
+  exige `--event <event-id>` pertencente ao candidate; não há vencedor implícito por data ou ID.
+  `reject` preserva o valor operacional atual. Candidate `blocked_by_core` só pode ser rejeitado:
+  promover exige antes alterar CORE pela curadoria canônica. Se o evento escolhido ainda pertence
+  ao último attempt `projected` correspondente, a promoção também atualiza causalmente checkpoint
+  e espelho; o JSON retorna `checkpointRefreshed`, e um attempt concorrente mais novo não é tocado.
+  A decisão conserva, sem coerção para string, o valor JSON já validado e copia do evento escolhido
+  `canonical_session_id`, activation/epoch, `source_turn_id` e `turn_sequence`. Por isso, um Stop
+  posterior da mesma sessão/activation avança o valor em vez de abrir outro candidate. Durante o
+  replay, um candidate transitório é reavaliado contra a fonte moderna final. Mesma
+  sessão/activation/epoch e turno maior aplica o Stop; turno menor fica superseded. Identidade
+  divergente, incompleta ou ambígua mantém o candidate para curadoria. `memory repair` compara o
+  replay anterior e o atual e só migra checkpoint+espelho com identidade exata, backup, audit e
+  CAS; ele não reordena, reescreve nem acrescenta evento ao ledger.
 - `validate-memory <CORE.md>` valida cap de 25 linhas, seções e segredos.
 - `validate-memory --vault` exige bundle v2 completo; não é o gate correto para vault legado.
 
@@ -72,7 +86,8 @@ npx wendkeep memory status --gate --vault .MeuApp-vault
 npx wendkeep memory reconcile antiga --by-session atual --reason "entrega continuada" --vault .MeuApp-vault
 npx wendkeep memory reconcile antiga --by-session atual --reason "entrega continuada" --apply --vault .MeuApp-vault
 npx wendkeep validate-memory .MeuApp-vault/.brain/CORE.md
-npx wendkeep memory promote candidate-123 --vault .MeuApp-vault
+npx wendkeep memory promote candidate-123 --event mem-escolhido --vault .MeuApp-vault
+npx wendkeep memory reject candidate-456 --vault .MeuApp-vault
 ```
 
 ## Resultado esperado
@@ -94,6 +109,15 @@ prefixo válido de uma projeção global que já avançou com eventos concorrent
   ambiguidade for comprovadamente substituída por uma sessão sucessora, revise o dry-run de
   `memory reconcile` antes de autorizar `--apply`; o comando falha se o attempt ambíguo tiver IDs.
 - Candidate pendente comum: warning recuperável, exige decisão humana quando apropriado.
+- `promote` informa que `--event` é obrigatório: leia os `event_ids` do candidate, compare a
+  proveniência/valor e indique explicitamente o vencedor. ID que não pertence ao candidate falha
+  sem mutar ledger ou projeções.
+- Promoção feita pela 0.66.1 seguida de candidate transitório: atualize para a 0.66.3, preserve um
+  backup e rode `memory repair`. Não publique nem instale a 0.66.2. O repair só migra o checkpoint
+  quando o replay anterior, a identidade do attempt e o evento novo coincidem exatamente; conflito
+  real continua bloqueado para escolha humana com `promote`/`reject`.
+- `promote` informa que o candidate não corresponde mais à projeção causal: nenhum evento foi
+  anexado. Rode `memory status`, releia o candidate atual e não force uma linhagem diferente.
 - `event_cursor` ausente ou hash divergente em v2: preserve o bundle e avalie `memory repair`.
 - `validate-memory --vault` falha no legado: valide apenas CORE ou migre primeiro.
 

package/hooks/brain-core.mjs

@@ -1,159 +1,159 @@
-// .agent/hooks/brain-core.mjs
-// Camada fria do brain: indexa o frontmatter das notas de sessão (0 token LLM).
-import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { basename, join } from 'node:path';
-import { ensureDir, stripYamlQuotes, toVaultRelative } from './obsidian-common.mjs';
-import { getLocale } from './locale.mjs';
-
-export function brainDir(vaultBase) {
-  return join(vaultBase, '.brain');
-}
-
-// Frontmatter YAML simples: escalares `k: v` + listas `k:` seguido de `  - item`.
-export function parseFrontmatter(content) {
-  const m = content.match(/^---\n([\s\S]*?)\n---/);
-  if (!m) return {};
-  const data = {};
-  const lines = m[1].split('\n');
-  for (let i = 0; i < lines.length; i++) {
-    const kv = lines[i].match(/^([\w-]+):\s*(.*)$/);
-    if (!kv) continue;
-    const key = kv[1];
-    const val = kv[2];
-    if (val === '') {
-      const list = [];
-      while (i + 1 < lines.length && /^\s+-\s+/.test(lines[i + 1])) {
-        list.push(stripYamlQuotes(lines[++i].replace(/^\s+-\s+/, '').trim()));
-      }
-      data[key] = list.length ? list : '';
-    } else {
-      data[key] = stripYamlQuotes(val.trim());
-    }
-  }
-  return data;
-}
-
-function walkMd(dir) {
-  const out = [];
-  let entries;
-  try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return out; }
-  for (const e of entries) {
-    const fp = join(dir, e.name);
-    if (e.isDirectory()) out.push(...walkMd(fp));
-    else if (e.name.endsWith('.md')) out.push(fp);
-  }
-  return out;
-}
-
-const DERIVED_RE = /\[\[(0[456]-[^\]|]+?)(?:\|[^\]]*)?\]\]/g;
-function derivedLinks(content) {
-  const dec = new Set(), bug = new Set(), lea = new Set();
-  let m;
-  while ((m = DERIVED_RE.exec(content))) {
-    const t = m[1];
-    if (t.startsWith('04-')) dec.add(t);
-    else if (t.startsWith('05-')) bug.add(t);
-    else if (t.startsWith('06-')) lea.add(t);
-  }
-  return { decisions: [...dec], bugs: [...bug], learnings: [...lea] };
-}
-
-// Varre 02-Sessões/** e regrava .brain/index.jsonl inteiro. Provider-agnóstico.
-export function buildBrainIndex(vaultBase) {
-  const rows = [];
-  for (const fp of walkMd(join(vaultBase, getLocale(vaultBase).folders.sessions))) {
-    let content;
-    try { content = readFileSync(fp, 'utf8'); } catch { continue; }
-    const fm = parseFrontmatter(content);
-    if (fm.type && fm.type !== 'session') continue;
-    const der = derivedLinks(content);
-    rows.push({
-      session_id: fm.session_id || '',
-      date: fm.date || '',
-      provider: fm.provider || '',
-      status: fm.status || '',
-      summary: fm.summary || '',
-      file: toVaultRelative(vaultBase, fp),
-      tags: Array.isArray(fm.tags) ? fm.tags : (fm.tags ? [fm.tags] : []),
-      decisions: der.decisions,
-      bugs: der.bugs,
-      learnings: der.learnings,
-    });
-  }
-  rows.sort((a, b) => (a.date + a.file).localeCompare(b.date + b.file));
-  ensureDir(brainDir(vaultBase));
-  const out = rows.map((r) => JSON.stringify(r)).join('\n') + (rows.length ? '\n' : '');
-  writeFileSync(join(brainDir(vaultBase), 'index.jsonl'), out, 'utf8');
-  return rows;
-}
-
-// Lê o índice gravado (linhas JSONL). Usado pelo recall e pelo digest.
-export function loadIndex(vaultBase) {
-  try {
-    return readFileSync(join(brainDir(vaultBase), 'index.jsonl'), 'utf8')
-      .split('\n').filter(Boolean).map((l) => JSON.parse(l));
-  } catch {
-    return [];
-  }
-}
-
-const DIGEST_CAPS = { decisions: 5, sessions: 4, bugs: 2, learnings: 2 };
-
-function adrNumber(path) {
-  const m = path.match(/ADR-(\d+)/);
-  return m ? Number(m[1]) : -1;
-}
-
-// Destila index.jsonl em .brain/DIGEST.md (camada quente, determinístico, 0 token LLM).
-// Cap por construção: 1 header + 13 itens (5/4/2/2) + 1 pointer = máx 15 linhas.
-export function buildBrainDigest(vaultBase, rows = null) {
-  const data = rows ?? loadIndex(vaultBase);
-  const byDateDesc = [...data].sort((a, b) =>
-    String(b.date || '').localeCompare(String(a.date || '')) || String(b.file || '').localeCompare(String(a.file || '')));
-
-  const seen = new Set();
-  const pick = (kind, max) => {
-    const out = [];
-    for (const r of byDateDesc) {
-      for (const p of r[kind] || []) {
-        if (out.length >= max) return out;
-        if (!seen.has(p)) { seen.add(p); out.push(p); }
-      }
-    }
-    return out;
-  };
-
-  // The digest is INJECTED into every session, so a dead wikilink is dead weight in the model's
-  // context. Keep only targets that resolve to a real note (by vault-relative path or basename)
-  // and drop placeholder paths (a truncated `…` from a summary line). `pick` collects extra so
-  // caps still fill after filtering.
-  const known = new Set();
-  for (const r of data) {
-    const rel = String(r.file || '').replace(/\.md$/i, '');
-    if (rel) { known.add(rel); known.add(basename(rel)); }
-  }
-  const resolves = (p) => {
-    const t = String(p || '').replace(/\.md$/i, '').trim();
-    if (!t || t.includes('...') || t.includes('…')) return false;
-    return known.has(t) || known.has(basename(t)) || existsSync(join(vaultBase, `${t}.md`));
-  };
-  const pickLive = (kind, max) => pick(kind, max * 4).filter(resolves).slice(0, max);
-
-  const decisions = pickLive('decisions', DIGEST_CAPS.decisions).sort((a, b) => adrNumber(b) - adrNumber(a));
-  const sessions = byDateDesc.slice(0, DIGEST_CAPS.sessions);
-  const bugs = pickLive('bugs', DIGEST_CAPS.bugs);
-  const learnings = pickLive('learnings', DIGEST_CAPS.learnings);
-
-  const lines = ['<!-- AUTO-GERADO por brain-core.mjs (0 token LLM). NÃO editar. Rebuild: node .agent/hooks/brain-reindex.mjs -->'];
-  for (const d of decisions) lines.push(`- Decisão: [[${d}]]`);
-  for (const s of sessions) lines.push(`- Sessão ${s.date} (${s.provider || '?'}): ${s.summary || s.file} → [[${String(s.file || '').replace(/\.md$/, '')}]]`);
-  for (const b of bugs) lines.push(`- Bug: [[${b}]]`);
-  for (const l of learnings) lines.push(`- Aprendizado: [[${l}]]`);
-
-  const shown = sessions.length;
-  if (data.length > shown) lines.push(`- +${data.length - shown} mais no índice — use /brain-recall <tópico>`);
-
-  ensureDir(brainDir(vaultBase));
-  writeFileSync(join(brainDir(vaultBase), 'DIGEST.md'), lines.join('\n') + '\n', 'utf8');
-  return lines;
-}
+// .agent/hooks/brain-core.mjs
+// Camada fria do brain: indexa o frontmatter das notas de sessão (0 token LLM).
+import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { basename, join } from 'node:path';
+import { ensureDir, stripYamlQuotes, toVaultRelative } from './obsidian-common.mjs';
+import { getLocale } from './locale.mjs';
+
+export function brainDir(vaultBase) {
+  return join(vaultBase, '.brain');
+}
+
+// Frontmatter YAML simples: escalares `k: v` + listas `k:` seguido de `  - item`.
+export function parseFrontmatter(content) {
+  const m = content.match(/^---\n([\s\S]*?)\n---/);
+  if (!m) return {};
+  const data = {};
+  const lines = m[1].split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    const kv = lines[i].match(/^([\w-]+):\s*(.*)$/);
+    if (!kv) continue;
+    const key = kv[1];
+    const val = kv[2];
+    if (val === '') {
+      const list = [];
+      while (i + 1 < lines.length && /^\s+-\s+/.test(lines[i + 1])) {
+        list.push(stripYamlQuotes(lines[++i].replace(/^\s+-\s+/, '').trim()));
+      }
+      data[key] = list.length ? list : '';
+    } else {
+      data[key] = stripYamlQuotes(val.trim());
+    }
+  }
+  return data;
+}
+
+function walkMd(dir) {
+  const out = [];
+  let entries;
+  try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return out; }
+  for (const e of entries) {
+    const fp = join(dir, e.name);
+    if (e.isDirectory()) out.push(...walkMd(fp));
+    else if (e.name.endsWith('.md')) out.push(fp);
+  }
+  return out;
+}
+
+const DERIVED_RE = /\[\[(0[456]-[^\]|]+?)(?:\|[^\]]*)?\]\]/g;
+function derivedLinks(content) {
+  const dec = new Set(), bug = new Set(), lea = new Set();
+  let m;
+  while ((m = DERIVED_RE.exec(content))) {
+    const t = m[1];
+    if (t.startsWith('04-')) dec.add(t);
+    else if (t.startsWith('05-')) bug.add(t);
+    else if (t.startsWith('06-')) lea.add(t);
+  }
+  return { decisions: [...dec], bugs: [...bug], learnings: [...lea] };
+}
+
+// Varre 02-Sessões/** e regrava .brain/index.jsonl inteiro. Provider-agnóstico.
+export function buildBrainIndex(vaultBase) {
+  const rows = [];
+  for (const fp of walkMd(join(vaultBase, getLocale(vaultBase).folders.sessions))) {
+    let content;
+    try { content = readFileSync(fp, 'utf8'); } catch { continue; }
+    const fm = parseFrontmatter(content);
+    if (fm.type && fm.type !== 'session') continue;
+    const der = derivedLinks(content);
+    rows.push({
+      session_id: fm.session_id || '',
+      date: fm.date || '',
+      provider: fm.provider || '',
+      status: fm.status || '',
+      summary: fm.summary || '',
+      file: toVaultRelative(vaultBase, fp),
+      tags: Array.isArray(fm.tags) ? fm.tags : (fm.tags ? [fm.tags] : []),
+      decisions: der.decisions,
+      bugs: der.bugs,
+      learnings: der.learnings,
+    });
+  }
+  rows.sort((a, b) => (a.date + a.file).localeCompare(b.date + b.file));
+  ensureDir(brainDir(vaultBase));
+  const out = rows.map((r) => JSON.stringify(r)).join('\n') + (rows.length ? '\n' : '');
+  writeFileSync(join(brainDir(vaultBase), 'index.jsonl'), out, 'utf8');
+  return rows;
+}
+
+// Lê o índice gravado (linhas JSONL). Usado pelo recall e pelo digest.
+export function loadIndex(vaultBase) {
+  try {
+    return readFileSync(join(brainDir(vaultBase), 'index.jsonl'), 'utf8')
+      .split('\n').filter(Boolean).map((l) => JSON.parse(l));
+  } catch {
+    return [];
+  }
+}
+
+const DIGEST_CAPS = { decisions: 5, sessions: 4, bugs: 2, learnings: 2 };
+
+function adrNumber(path) {
+  const m = path.match(/ADR-(\d+)/);
+  return m ? Number(m[1]) : -1;
+}
+
+// Destila index.jsonl em .brain/DIGEST.md (camada quente, determinístico, 0 token LLM).
+// Cap por construção: 1 header + 13 itens (5/4/2/2) + 1 pointer = máx 15 linhas.
+export function buildBrainDigest(vaultBase, rows = null) {
+  const data = rows ?? loadIndex(vaultBase);
+  const byDateDesc = [...data].sort((a, b) =>
+    String(b.date || '').localeCompare(String(a.date || '')) || String(b.file || '').localeCompare(String(a.file || '')));
+
+  const seen = new Set();
+  const pick = (kind, max) => {
+    const out = [];
+    for (const r of byDateDesc) {
+      for (const p of r[kind] || []) {
+        if (out.length >= max) return out;
+        if (!seen.has(p)) { seen.add(p); out.push(p); }
+      }
+    }
+    return out;
+  };
+
+  // The digest is INJECTED into every session, so a dead wikilink is dead weight in the model's
+  // context. Keep only targets that resolve to a real note (by vault-relative path or basename)
+  // and drop placeholder paths (a truncated `…` from a summary line). `pick` collects extra so
+  // caps still fill after filtering.
+  const known = new Set();
+  for (const r of data) {
+    const rel = String(r.file || '').replace(/\.md$/i, '');
+    if (rel) { known.add(rel); known.add(basename(rel)); }
+  }
+  const resolves = (p) => {
+    const t = String(p || '').replace(/\.md$/i, '').trim();
+    if (!t || t.includes('...') || t.includes('…')) return false;
+    return known.has(t) || known.has(basename(t)) || existsSync(join(vaultBase, `${t}.md`));
+  };
+  const pickLive = (kind, max) => pick(kind, max * 4).filter(resolves).slice(0, max);
+
+  const decisions = pickLive('decisions', DIGEST_CAPS.decisions).sort((a, b) => adrNumber(b) - adrNumber(a));
+  const sessions = byDateDesc.slice(0, DIGEST_CAPS.sessions);
+  const bugs = pickLive('bugs', DIGEST_CAPS.bugs);
+  const learnings = pickLive('learnings', DIGEST_CAPS.learnings);
+
+  const lines = ['<!-- AUTO-GERADO por brain-core.mjs (0 token LLM). NÃO editar. Rebuild: node .agent/hooks/brain-reindex.mjs -->'];
+  for (const d of decisions) lines.push(`- Decisão: [[${d}]]`);
+  for (const s of sessions) lines.push(`- Sessão ${s.date} (${s.provider || '?'}): ${s.summary || s.file} → [[${String(s.file || '').replace(/\.md$/, '')}]]`);
+  for (const b of bugs) lines.push(`- Bug: [[${b}]]`);
+  for (const l of learnings) lines.push(`- Aprendizado: [[${l}]]`);
+
+  const shown = sessions.length;
+  if (data.length > shown) lines.push(`- +${data.length - shown} mais no índice — use /brain-recall <tópico>`);
+
+  ensureDir(brainDir(vaultBase));
+  writeFileSync(join(brainDir(vaultBase), 'DIGEST.md'), lines.join('\n') + '\n', 'utf8');
+  return lines;
+}

package/hooks/brain-recall.mjs

@@ -1,32 +1,32 @@
-// .agent/hooks/brain-recall.mjs
-// Query engine read-only: pontua o índice por tópico. Token só no resultado.
-// Uso: node .agent/hooks/brain-recall.mjs <termos da busca>
-import { pathToFileURL } from 'node:url';
-import { getVaultBase } from './obsidian-common.mjs';
-import { loadIndex } from './brain-core.mjs';
-
-export { loadIndex };
-
-export function scoreRows(rows, query, topK = 5) {
-  const terms = String(query).toLowerCase().split(/\s+/).filter(Boolean);
-  if (!terms.length) return [];
-  return rows
-    .map((r) => {
-      // Inclui slug do file + paths das derivadas (ADR/bug/aprendizado) no haystack:
-      // os títulos das sessões e tags são genéricos; o sinal tópico vem dos slugs.
-      const hay = `${r.summary || ''} ${(r.tags || []).join(' ')} ${r.file || ''} ${(r.decisions || []).join(' ')} ${(r.bugs || []).join(' ')} ${(r.learnings || []).join(' ')}`.toLowerCase();
-      let score = 0;
-      for (const t of terms) if (hay.includes(t)) score++;
-      return { row: r, score };
-    })
-    .filter((s) => s.score > 0)
-    .sort((a, b) => b.score - a.score || String(b.row.date || '').localeCompare(String(a.row.date || '')))
-    .slice(0, topK)
-    .map((s) => s.row);
-}
-
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
-  const vaultBase = getVaultBase();
-  const hits = scoreRows(loadIndex(vaultBase), process.argv.slice(2).join(' '));
-  process.stdout.write(JSON.stringify(hits, null, 2) + '\n');
-}
+// .agent/hooks/brain-recall.mjs
+// Query engine read-only: pontua o índice por tópico. Token só no resultado.
+// Uso: node .agent/hooks/brain-recall.mjs <termos da busca>
+import { pathToFileURL } from 'node:url';
+import { getVaultBase } from './obsidian-common.mjs';
+import { loadIndex } from './brain-core.mjs';
+
+export { loadIndex };
+
+export function scoreRows(rows, query, topK = 5) {
+  const terms = String(query).toLowerCase().split(/\s+/).filter(Boolean);
+  if (!terms.length) return [];
+  return rows
+    .map((r) => {
+      // Inclui slug do file + paths das derivadas (ADR/bug/aprendizado) no haystack:
+      // os títulos das sessões e tags são genéricos; o sinal tópico vem dos slugs.
+      const hay = `${r.summary || ''} ${(r.tags || []).join(' ')} ${r.file || ''} ${(r.decisions || []).join(' ')} ${(r.bugs || []).join(' ')} ${(r.learnings || []).join(' ')}`.toLowerCase();
+      let score = 0;
+      for (const t of terms) if (hay.includes(t)) score++;
+      return { row: r, score };
+    })
+    .filter((s) => s.score > 0)
+    .sort((a, b) => b.score - a.score || String(b.row.date || '').localeCompare(String(a.row.date || '')))
+    .slice(0, topK)
+    .map((s) => s.row);
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const vaultBase = getVaultBase();
+  const hits = scoreRows(loadIndex(vaultBase), process.argv.slice(2).join(' '));
+  process.stdout.write(JSON.stringify(hits, null, 2) + '\n');
+}