wendkeep 0.66.1 → 0.66.3

package/CHANGELOG.md

@@ -4,6 +4,30 @@ All notable changes to **wendkeep** are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.66.3] — 2026-07-30
+
+### Fixed
+
+- **O replay reavalia candidates transitórios contra a fonte moderna final.** Um Stop da mesma
+  sessão/activation/epoch e turno maior agora avança depois que a correção causal já presente se
+  torna ativa; turno menor fica superseded e divergências reais continuam para curadoria.
+- **`memory repair` migra o checkpoint antigo somente com prova e CAS.** O repair compara a
+  semântica anterior e a atual, faz backup, atualiza attempt e espelho e registra auditoria sem
+  reordenar, reescrever ou acrescentar evento ao ledger. Prova incompleta continua bloqueada. A
+  0.66.2 não deve ser publicada no npm; publique e instale a 0.66.3.
+
+## [0.66.2] — 2026-07-29
+
+### Fixed
+
+- **Promoção preserva valor e identidade causal do evento escolhido.** `memory promote` não
+  converte mais objetos/arrays JSON em texto e mantém sessão, activation/epoch, turno de origem e
+  sequência; o próximo `SessionStop` da mesma cadeia avança o handoff sem recriar candidate.
+- **A recuperação 0.66.1 cobre inversão física/temporal sem ampliar autoridade.** Quando uma
+  promoção legada projetada fica fora do candidate por `observed_at`, `memory promote` só a inclui
+  em `supersedes` sob prova de ancestralidade e mesma linhagem; fonte moderna ou alheia falha antes
+  de anexar. O E2E percorre o dispatcher público e prova Stop posterior e duplicado idempotentes.
+
 ## [0.66.1] — 2026-07-29
 
 ### Fixed

package/README.en.md

@@ -256,7 +256,7 @@ Hot memory now separates human authorship, operational state, and evidence:
 - **`CORE.md` is canonical.** It is the short, hand-curated nucleus for durable preferences, active patterns, and open issues; no projector may infer or overwrite it.
 - **`SHARED_MEMORY.md` is generated operational state.** The `Stop` hook turns the session handoff into sanitized events; the projector deterministically reduces the ledger and publishes a verifiable revision, cursor, and hash. Facts are `verified` only with local evidence; unsupported reports remain `reported`, and disagreements become candidates for human judgment.
 - **`MEMORY_EVENTS.jsonl` is the append-only authority.** `Stop` makes events durable in the outbox before acknowledging the attempt; the projector runs outside the registry lock and retries reuse the same IDs. Repeating an identical `event_id`/payload is a no-op; reusing the ID with different bytes is observable corruption.
-- **`MEMORY_CANDIDATES.jsonl` is the curation queue.** Conflicts and legacy content are never silently promoted. `promote` and `reject` record the decision as a new event.
+- **`MEMORY_CANDIDATES.jsonl` is the curation queue.** Conflicts and legacy content are never silently promoted. `promote` and `reject` record the decision as a new event; promotion preserves the selected event's JSON type, session, activation/epoch, and source turn.
 
 Artifacts stay under `.brain/` only. Sanitization strips secrets, tokens, local paths, transcripts, and harness payloads both before persistence and before injection. Events carry a `project_id`, and one vault never accepts another project's events.
 
@@ -295,9 +295,17 @@ ambiguity uses `memory reconcile <session> --by-session <successor>
 --reason <reason>` as a dry run and requires `--apply`; the decision is backed up and audited
 without rewriting ledger, CORE, or notes. Run `status --gate` again afterwards. Conflicts require
 explicit, durable curation: `memory promote <id> --event <event-id>` selects one event from the
-candidate, while `memory reject <id>` keeps the current value. Decisions are idempotent and
-survive repair/replay; `blocked_by_core` cannot override CORE. Doctor only diagnoses. See
-[memory and curation](docs/en/commands/memory.md).
+candidate, while `memory reject <id>` keeps the current value. The decision is idempotent, and a
+new promotion accepts a later Stop from the same session/activation without recreating a conflict.
+A promotion written by 0.66.1 remains historical: if the next Stop forms a new candidate, update
+to 0.66.3 and run `memory repair`. During replay, a transient candidate is re-evaluated against the
+final modern source: the same session/activation/epoch and a higher turn advances; a lower turn is
+superseded. Repair migrates the checkpoint and mirror only when it proves the exact previous
+replay, attempt identity, and absence of a real conflict; it creates a backup and audit without
+appending or rewriting events. Ambiguity stays queued for explicit curation. Do not publish or
+install 0.66.2; use 0.66.3. Decisions survive repair/replay;
+`blocked_by_core` cannot override CORE. Doctor only
+diagnoses. See [memory and curation](docs/en/commands/memory.md).
 
 Session notes use one live `## Agentes, tokens e custos` snapshot. Main-agent and subagent hooks recompose it atomically, with costs, token dimensions, reasoning tokens and effort per model/source. Every hook that rewrites a session note takes a per-file lock and writes through a temp file + rename, so the `SubagentStop` fan-out (one hook run per subagent) can never leave a note half-written; a note whose frontmatter reads back damaged is left untouched rather than patched.
 

package/README.md

@@ -256,7 +256,7 @@ Hot memory now separates human authorship, operational state, and evidence:
 - **`CORE.md` is canonical.** It is the short, hand-curated nucleus for durable preferences, active patterns, and open issues; no projector may infer or overwrite it.
 - **`SHARED_MEMORY.md` is generated operational state.** The `Stop` hook turns the session handoff into sanitized events; the projector deterministically reduces the ledger and publishes a verifiable revision, cursor, and hash. Facts are `verified` only with local evidence; unsupported reports remain `reported`, and disagreements become candidates for human judgment.
 - **`MEMORY_EVENTS.jsonl` is the append-only authority.** `Stop` makes events durable in the outbox before acknowledging the attempt; the projector runs outside the registry lock and retries reuse the same IDs. Repeating an identical `event_id`/payload is a no-op; reusing the ID with different bytes is observable corruption.
-- **`MEMORY_CANDIDATES.jsonl` is the curation queue.** Conflicts and legacy content are never silently promoted. `promote` and `reject` record the decision as a new event.
+- **`MEMORY_CANDIDATES.jsonl` is the curation queue.** Conflicts and legacy content are never silently promoted. `promote` and `reject` record the decision as a new event; promotion preserves the selected event's JSON type, session, activation/epoch, and source turn.
 
 Artifacts stay under `.brain/` only. Sanitization strips secrets, tokens, local paths, transcripts, and harness payloads both before persistence and before injection. Events carry a `project_id`, and one vault never accepts another project's events.
 
@@ -295,9 +295,17 @@ ambiguity uses `memory reconcile <session> --by-session <successor>
 --reason <reason>` as a dry run and requires `--apply`; the decision is backed up and audited
 without rewriting ledger, CORE, or notes. Run `status --gate` again afterwards. Conflicts require
 explicit, durable curation: `memory promote <id> --event <event-id>` selects one event from the
-candidate, while `memory reject <id>` keeps the current value. Decisions are idempotent and
-survive repair/replay; `blocked_by_core` cannot override CORE. Doctor only diagnoses. See
-[memory and curation](docs/en/commands/memory.md).
+candidate, while `memory reject <id>` keeps the current value. The decision is idempotent, and a
+new promotion accepts a later Stop from the same session/activation without recreating a conflict.
+A promotion written by 0.66.1 remains historical: if the next Stop forms a new candidate, update
+to 0.66.3 and run `memory repair`. During replay, a transient candidate is re-evaluated against the
+final modern source: the same session/activation/epoch and a higher turn advances; a lower turn is
+superseded. Repair migrates the checkpoint and mirror only when it proves the exact previous
+replay, attempt identity, and absence of a real conflict; it creates a backup and audit without
+appending or rewriting events. Ambiguity stays queued for explicit curation. Do not publish or
+install 0.66.2; use 0.66.3. Decisions survive repair/replay;
+`blocked_by_core` cannot override CORE. Doctor only
+diagnoses. See [memory and curation](docs/en/commands/memory.md).
 
 Session notes use one live `## Agentes, tokens e custos` snapshot. Main-agent and subagent hooks recompose it atomically, with costs, token dimensions, reasoning tokens and effort per model/source. Every hook that rewrites a session note takes a per-file lock and writes through a temp file + rename, so the `SubagentStop` fan-out (one hook run per subagent) can never leave a note half-written; a note whose frontmatter reads back damaged is left untouched rather than patched.
 

package/docs/en/commands/memory.md

@@ -70,7 +70,15 @@ npx wendkeep validate-memory --vault <v2-vault>
   `blocked_by_core` candidate can only be rejected: promotion first requires canonical CORE
   curation. If the selected event still belongs to the matching latest `projected` attempt,
   promotion also refreshes its checkpoint and mirror causally; JSON reports
-  `checkpointRefreshed`, and a newer concurrent attempt remains untouched.
+  `checkpointRefreshed`, and a newer concurrent attempt remains untouched. The decision keeps
+  the already validated JSON value without string coercion and copies the selected event's
+  `canonical_session_id`, activation/epoch, `source_turn_id`, and `turn_sequence`. A later Stop
+  from the same session/activation therefore advances the value instead of opening another candidate.
+  During replay, a transient candidate is re-evaluated against the final modern source. The same
+  session/activation/epoch and a higher turn applies the Stop; a lower turn is superseded. A
+  different, incomplete, or ambiguous identity keeps the candidate queued for curation. `memory
+  repair` compares the old and current replay and migrates checkpoint+mirror only with exact
+  identity, backup, audit, and CAS; it does not reorder, rewrite, or append a ledger event.
 - `validate-memory <CORE.md>` checks the 25-line cap, required sections, and secrets.
 - `validate-memory --vault` requires a complete v2 bundle and is not the legacy-vault gate.
 
@@ -108,6 +116,12 @@ of a global projection that has already advanced with concurrent events.
 - `promote` reports that `--event` is required: inspect the candidate `event_ids`, compare their
   provenance/value, and name the winner explicitly. An ID outside the candidate fails without
   mutating the ledger or projections.
+- A promotion made by 0.66.1 followed by a transient candidate: update to 0.66.3, preserve a backup,
+  and run `memory repair`. Do not publish or install 0.66.2. Repair migrates the checkpoint only
+  when the old replay, attempt identity, and new event match exactly; a real conflict stays blocked
+  for a human `promote`/`reject` choice.
+- `promote` says that the candidate no longer matches the causal projection: no event was appended.
+  Run `memory status`, inspect the current candidate again, and do not force a different lineage.
 - Missing `event_cursor` or mismatched v2 hash: preserve the bundle and assess `memory repair`.
 - `validate-memory --vault` fails on legacy: validate CORE only or migrate first.
 

package/docs/pt-BR/commands/memory.md

@@ -68,6 +68,14 @@ npx wendkeep validate-memory --vault <cofre-v2>
   promover exige antes alterar CORE pela curadoria canônica. Se o evento escolhido ainda pertence
   ao último attempt `projected` correspondente, a promoção também atualiza causalmente checkpoint
   e espelho; o JSON retorna `checkpointRefreshed`, e um attempt concorrente mais novo não é tocado.
+  A decisão conserva, sem coerção para string, o valor JSON já validado e copia do evento escolhido
+  `canonical_session_id`, activation/epoch, `source_turn_id` e `turn_sequence`. Por isso, um Stop
+  posterior da mesma sessão/activation avança o valor em vez de abrir outro candidate. Durante o
+  replay, um candidate transitório é reavaliado contra a fonte moderna final. Mesma
+  sessão/activation/epoch e turno maior aplica o Stop; turno menor fica superseded. Identidade
+  divergente, incompleta ou ambígua mantém o candidate para curadoria. `memory repair` compara o
+  replay anterior e o atual e só migra checkpoint+espelho com identidade exata, backup, audit e
+  CAS; ele não reordena, reescreve nem acrescenta evento ao ledger.
 - `validate-memory <CORE.md>` valida cap de 25 linhas, seções e segredos.
 - `validate-memory --vault` exige bundle v2 completo; não é o gate correto para vault legado.
 
@@ -104,6 +112,12 @@ prefixo válido de uma projeção global que já avançou com eventos concorrent
 - `promote` informa que `--event` é obrigatório: leia os `event_ids` do candidate, compare a
   proveniência/valor e indique explicitamente o vencedor. ID que não pertence ao candidate falha
   sem mutar ledger ou projeções.
+- Promoção feita pela 0.66.1 seguida de candidate transitório: atualize para a 0.66.3, preserve um
+  backup e rode `memory repair`. Não publique nem instale a 0.66.2. O repair só migra o checkpoint
+  quando o replay anterior, a identidade do attempt e o evento novo coincidem exatamente; conflito
+  real continua bloqueado para escolha humana com `promote`/`reject`.
+- `promote` informa que o candidate não corresponde mais à projeção causal: nenhum evento foi
+  anexado. Rode `memory status`, releia o candidate atual e não force uma linhagem diferente.
 - `event_cursor` ausente ou hash divergente em v2: preserve o bundle e avalie `memory repair`.
 - `validate-memory --vault` falha no legado: valide apenas CORE ou migre primeiro.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wendkeep",
-  "version": "0.66.1",
+  "version": "0.66.3",
   "description": "Vault-first persistent memory for AI coding agents, with an optional profile-aware governance runtime: OFF, FLOW, GUIDE, GOVERN, or ASSURE. Local-first and agent-agnostic (Claude Code, Codex, Cursor…).",
   "type": "module",
   "workspaces": [

package/packages/vault/src/memory-store.mjs

@@ -344,6 +344,22 @@ function sameCausalActivation(left, right) {
     && left.activation_id === right?.activation_id;
 }
 
+function hasCompleteCausalIdentity(event) {
+  return Boolean(event?.canonical_session_id)
+    && Boolean(event?.activation_id)
+    && Boolean(event?.source_turn_id)
+    && Number.isInteger(event?.activation_epoch)
+    && Number.isInteger(event?.turn_sequence);
+}
+
+function sameCompleteCausalLineage(left, right) {
+  return hasCompleteCausalIdentity(left)
+    && hasCompleteCausalIdentity(right)
+    && left.canonical_session_id === right.canonical_session_id
+    && left.activation_id === right.activation_id
+    && left.activation_epoch === right.activation_epoch;
+}
+
 function comparable(left, right) {
   if (sameCausalActivation(left, right)) return true;
   const leftSupersedes = left.supersedes_event_id || left.supersedes;
@@ -447,7 +463,9 @@ function isCausallyOlder(event, current) {
  * Pure deterministic reducer. It pre-detects incomparable scalar siblings so replay order
  * never turns one concurrent writer into an accidental winner.
  */
-export function reduceMemoryEvents(inputEvents = [], { coreInvariants = new Map() } = {}) {
+export function reduceMemoryEvents(inputEvents = [], {
+  coreInvariants = new Map(), resolveDeferredAsserts = true,
+} = {}) {
   const protectedValues = coreInvariants instanceof Map
     ? coreInvariants
     : new Map(Object.entries(coreInvariants || {}));
@@ -495,6 +513,8 @@ export function reduceMemoryEvents(inputEvents = [], { coreInvariants = new Map(
   const records = new Map();
   const tombstones = new Map();
   const candidates = [];
+  const pendingAssertConflicts = [];
+  const resolvedCandidateIds = new Set();
   const emittedGroups = new Set();
   const appliedEventIds = [];
   const superseded = [];
@@ -543,7 +563,9 @@ export function reduceMemoryEvents(inputEvents = [], { coreInvariants = new Map(
           appliedEventIds.push(item.event_id);
           continue;
         }
-        candidates.push(conflictCandidate(item.memory_key, [currentEventFromRecord(current), item]));
+        const candidate = conflictCandidate(item.memory_key, [currentEventFromRecord(current), item]);
+        candidates.push(candidate);
+        pendingAssertConflicts.push({ candidate, event: item });
         continue;
       }
       if (!current) {
@@ -616,6 +638,46 @@ export function reduceMemoryEvents(inputEvents = [], { coreInvariants = new Map(
     appliedEventIds.push(item.event_id);
   }
 
+  if (resolveDeferredAsserts) {
+    // A physically late assert can sort before a corrective promotion because effective time
+    // precedes CLI decision time. Revisit only scalar assert conflicts left without an explicit
+    // decision, against the final complete causal source; the ledger and global ordering stay put.
+    const deferredAsserts = pendingAssertConflicts
+      .filter((pending) => !candidateDecisions.has(pending.candidate.candidate_id))
+      .sort((left, right) => String(left.event.memory_key).localeCompare(String(right.event.memory_key))
+        || String(left.event.canonical_session_id || '').localeCompare(String(right.event.canonical_session_id || ''))
+        || String(left.event.activation_id || '').localeCompare(String(right.event.activation_id || ''))
+        || Number(left.event.activation_epoch ?? -1) - Number(right.event.activation_epoch ?? -1)
+        || Number(left.event.turn_sequence ?? -1) - Number(right.event.turn_sequence ?? -1)
+        || eventOrder(left.event, right.event));
+    let advanced = true;
+    while (advanced) {
+      advanced = false;
+      for (const pending of deferredAsserts) {
+        if (resolvedCandidateIds.has(pending.candidate.candidate_id)) continue;
+        const current = records.get(pending.event.memory_key);
+        const currentSource = current?.source;
+        if (!sameCompleteCausalLineage(pending.event, currentSource)) continue;
+        if (pending.event.turn_sequence > currentSource.turn_sequence) {
+          records.set(pending.event.memory_key, {
+            value: pending.event.value,
+            revision: current.revision + 1,
+            source: pending.event,
+          });
+          tombstones.delete(pending.event.memory_key);
+          superseded.push({ event_id: currentSource.event_id, by_event_id: pending.event.event_id });
+          revision += 1;
+          appliedEventIds.push(pending.event.event_id);
+          resolvedCandidateIds.add(pending.candidate.candidate_id);
+          advanced = true;
+        } else if (pending.event.turn_sequence < currentSource.turn_sequence) {
+          superseded.push({ event_id: pending.event.event_id, by_event_id: currentSource.event_id });
+          resolvedCandidateIds.add(pending.candidate.candidate_id);
+        }
+      }
+    }
+  }
+
   const stateEntries = [...records].map(([key, record]) => [key, record.value]);
   const recordEntries = [...records].map(([key, record]) => [key, record]);
   const tombstoneEntries = [...tombstones];
@@ -623,7 +685,8 @@ export function reduceMemoryEvents(inputEvents = [], { coreInvariants = new Map(
   const recordObject = sortedObject(recordEntries);
   const tombstoneObject = sortedObject(tombstoneEntries);
   const unresolvedCandidates = candidates
-    .filter((item) => !candidateDecisions.has(item.candidate_id));
+    .filter((item) => !candidateDecisions.has(item.candidate_id)
+      && !resolvedCandidateIds.has(item.candidate_id));
   unresolvedCandidates.sort((left, right) => left.candidate_id.localeCompare(right.candidate_id));
   superseded.sort((left, right) => left.event_id.localeCompare(right.event_id));
   const activeEvents = Object.entries(recordObject).map(([memoryKey, record]) => ({
@@ -655,8 +718,12 @@ export function reduceMemoryEvents(inputEvents = [], { coreInvariants = new Map(
  * `eventCursor` is the reducer's deterministic causal cursor; `ledgerCursor` is the
  * physical prefix boundary used by durable checkpoints.
  */
-export function deriveMemoryProjection(vaultBase, inputEvents = []) {
-  const reduced = reduceMemoryEvents(inputEvents, { coreInvariants: readCoreInvariants(vaultBase) });
+export function deriveMemoryProjection(vaultBase, inputEvents = [], {
+  resolveDeferredAsserts = true,
+} = {}) {
+  const reduced = reduceMemoryEvents(inputEvents, {
+    coreInvariants: readCoreInvariants(vaultBase), resolveDeferredAsserts,
+  });
   const ledgerCursor = inputEvents.at(-1)?.event_id || 'none';
   const checkpoint = {
     revision: reduced.revision,

package/src/memory.mjs

@@ -263,6 +263,80 @@ function assertCompatibleDecision(prior, { action, eventId }) {
   }
 }
 
+function promotedMemoryValue(value) {
+  return typeof value === 'string' ? sanitizeMemoryText(value) : cloneJson(value);
+}
+
+function eventSupersedes(event) {
+  if (Array.isArray(event?.supersedes)) return event.supersedes;
+  return event?.supersedes_event_id ? [event.supersedes_event_id] : [];
+}
+
+function hasCompleteCausalIdentity(event) {
+  return Boolean(event?.canonical_session_id && event?.activation_id && event?.source_turn_id)
+    && Number.isInteger(event.activation_epoch)
+    && Number.isInteger(event.turn_sequence);
+}
+
+function sameCausalLineage(left, right) {
+  return hasCompleteCausalIdentity(left) && hasCompleteCausalIdentity(right)
+    && left.canonical_session_id === right.canonical_session_id
+    && left.activation_id === right.activation_id
+    && left.activation_epoch === right.activation_epoch;
+}
+
+function promotedSupersedes(vault, candidate, selected) {
+  const memberIds = new Set(Array.isArray(candidate.event_ids) ? candidate.event_ids : []);
+  const ledger = readMemoryLedger(vault);
+  if (ledger.status !== 'ok') throw new Error('Ledger de memória inválido durante a promoção.');
+  const current = deriveMemoryProjection(vault, ledger.events)
+    .records?.[candidate.memory_key]?.source;
+  if (!current?.event_id || memberIds.has(current.event_id)) return [...memberIds].sort();
+
+  const currentSelectedId = current.candidate_decision?.selected_event_id;
+  const currentSelected = currentSelectedId
+    ? ledger.events.find((event) => event.event_id === currentSelectedId)
+    : null;
+  const selectedLedger = ledger.events.find((event) => event.event_id === selected.event_id);
+  const currentAncestors = eventSupersedes(current);
+  const decisionMembers = Array.isArray(current.candidate_decision?.event_ids)
+    ? current.candidate_decision.event_ids
+    : [];
+  const canonicalAncestors = [...new Set(currentAncestors)].sort();
+  const canonicalDecisionMembers = [...new Set(decisionMembers)].sort();
+  const currentObserved = String(current.effective_at || current.observed_at || '');
+  const selectedObserved = String(selectedLedger?.effective_at || selectedLedger?.observed_at || '');
+  const currentPhysicalIndex = ledger.events.findIndex((event) => event.event_id === current.event_id);
+  const selectedPhysicalIndex = ledger.events.findIndex((event) => event.event_id === selected.event_id);
+  const bridgeChecks = {
+    legacyShape: current.operation === 'replace' && current.authority === 'verified'
+      && !current.canonical_session_id && !current.source_turn_id,
+    promotion: current.candidate_decision?.action === 'promote',
+    selectedPresent: Boolean(currentSelected),
+    selectedPersisted: Boolean(selectedLedger),
+    exactDecisionMembers: canonicalAncestors.length === currentAncestors.length
+      && canonicalDecisionMembers.length === decisionMembers.length
+      && canonicalAncestors.length === canonicalDecisionMembers.length
+      && canonicalAncestors.every((eventId, index) => eventId === canonicalDecisionMembers[index]),
+    selectedSuperseded: currentAncestors.includes(currentSelectedId)
+      && decisionMembers.includes(currentSelectedId),
+    candidateAncestor: currentAncestors.some((eventId) => memberIds.has(eventId)),
+    sameLineage: sameCausalLineage(currentSelected, selectedLedger),
+    laterTurn: selectedLedger?.turn_sequence > currentSelected?.turn_sequence,
+    appendedAfterCurrent: selectedPhysicalIndex > currentPhysicalIndex && currentPhysicalIndex >= 0,
+    observedBeforeCurrent: selectedObserved < currentObserved,
+  };
+  const bridgesObservedOrder = Object.values(bridgeChecks).every(Boolean);
+  if (!bridgesObservedOrder) {
+    throw new Error(
+      `Candidate ${candidate.candidate_id} não corresponde mais à projeção causal atual; `
+      + 'recarregue os candidates antes de promover.',
+    );
+  }
+  memberIds.add(current.event_id);
+  return [...memberIds].sort();
+}
+
 function matchesPromotedAttempt(attempt, selected) {
   if (attempt?.memory_mode !== 'v2' || attempt.state !== 'projected'
       || !Array.isArray(attempt.event_ids) || !attempt.event_ids.includes(selected.event_id)) return false;
@@ -378,6 +452,9 @@ export function decideMemoryCandidate(vault, {
   if (action === 'promote' && selectedValue === undefined) {
     throw new Error(`Candidate ${candidateId} não contém valor promovível.`);
   }
+  const supersedes = action === 'promote' && selected
+    ? promotedSupersedes(vault, candidate, selected)
+    : [];
   const now = new Date().toISOString();
   const decision = {
     candidate_id: candidateId,
@@ -391,15 +468,19 @@ export function decideMemoryCandidate(vault, {
     project_id: projectId(vault),
     memory_key: action === 'promote' ? candidate.memory_key : `candidate.decision.${candidateId}`,
     operation: action === 'promote' && selected ? 'replace' : 'assert',
-    value: sanitizeMemoryText(action === 'promote' ? selectedValue : 'rejected'),
+    value: action === 'promote' ? promotedMemoryValue(selectedValue) : 'rejected',
     authority: 'verified',
+    ...(selected?.canonical_session_id
+      ? { canonical_session_id: selected.canonical_session_id }
+      : {}),
     activation_id: selected?.activation_id || 'wendkeep-memory-cli',
     ...(Number.isInteger(selected?.activation_epoch) ? { activation_epoch: selected.activation_epoch } : {}),
     turn_sequence: selected?.turn_sequence ?? 0,
+    ...(selected?.source_turn_id ? { source_turn_id: selected.source_turn_id } : {}),
     observed_at: now,
     evidence: [`candidate:${candidateId}`],
     candidate_decision: decision,
-    ...(selected ? { supersedes: decision.event_ids } : {}),
+    ...(selected ? { supersedes } : {}),
   };
   enqueueMemoryEvent(vault, event);
   const projection = projectMemoryOutbox(vault);
@@ -932,6 +1013,67 @@ function historicalAssertOnlyCheckpoint(vault, attempt, authority, checkpoint) {
   return currentPrefix.checkpoint;
 }
 
+function deferredAssertReplayCheckpointMigration(
+  sessionId, entry, authority, legacyReplay, fullReplay,
+) {
+  const attempt = entry?.last_memory_attempt;
+  const checkpoint = attempt?.checkpoint;
+  if (attempt?.memory_mode !== 'v2' || attempt?.state !== 'projected'
+      || attempt?.disposition !== 'applied' || !checkpointShape(checkpoint)) return null;
+  if (!Object.prototype.hasOwnProperty.call(entry, 'memory_checkpoint')
+      || !sameCheckpoint(entry.memory_checkpoint, checkpoint)
+      || !sameCheckpoint(checkpoint, legacyReplay.checkpoint)
+      || sameCheckpoint(checkpoint, fullReplay.checkpoint)) return null;
+
+  const requiredEventIds = Array.isArray(attempt.event_ids) ? [...attempt.event_ids] : [];
+  if (!requiredEventIds.length || new Set(requiredEventIds).size !== requiredEventIds.length) return null;
+  const current = fullReplay.records?.['handoff.latest']?.source;
+  if (!current?.event_id || !requiredEventIds.includes(current.event_id)) return null;
+  const relevantLegacyCandidate = legacyReplay.candidates.some(
+    (candidate) => candidate.memory_key === 'handoff.latest'
+      && candidate.event_ids.includes(current.event_id),
+  );
+  const relevantCandidateStillReal = fullReplay.candidates.some(
+    (candidate) => candidate.memory_key === 'handoff.latest',
+  );
+  if (!relevantLegacyCandidate || relevantCandidateStillReal) return null;
+
+  const currentIdentity = {
+    canonical_session_id: current.canonical_session_id,
+    activation_id: current.activation_id,
+    activation_epoch: current.activation_epoch,
+    source_turn_id: current.source_turn_id,
+    turn_sequence: current.turn_sequence,
+  };
+  if (currentIdentity.canonical_session_id !== sessionId
+      || attempt.canonical_session_id !== currentIdentity.canonical_session_id
+      || attempt.activation_id !== currentIdentity.activation_id
+      || attempt.activation_epoch !== currentIdentity.activation_epoch
+      || attempt.turn_id !== currentIdentity.source_turn_id
+      || attempt.turn_sequence !== currentIdentity.turn_sequence) return null;
+
+  const newerAttemptEvent = authority.ledgerEvents.some((event) => (
+    event.canonical_session_id === currentIdentity.canonical_session_id
+      && event.activation_id === currentIdentity.activation_id
+      && event.activation_epoch === currentIdentity.activation_epoch
+      && Number.isInteger(event.turn_sequence)
+      && event.turn_sequence > currentIdentity.turn_sequence
+  ));
+  if (newerAttemptEvent) return null;
+
+  const proof = validateSuccessorProof({ bySessionId: sessionId }, attempt, authority);
+  return {
+    sessionId,
+    expectedFingerprint: attemptFingerprint(attempt),
+    expectedMemoryCheckpointFingerprint: memoryCheckpointFingerprint(entry),
+    originalCheckpoint: cloneJson(checkpoint),
+    checkpoint: cloneJson(fullReplay.checkpoint),
+    proof,
+    migrationType: 'deferred_assert_replay_migrated',
+    eventIds: requiredEventIds,
+  };
+}
+
 function legacyCheckpointMigration(vault, sessionId, entry, authority, fullReplay) {
   const attempt = entry?.last_memory_attempt;
   const checkpoint = attempt?.checkpoint;
@@ -961,6 +1103,8 @@ function legacyCheckpointMigration(vault, sessionId, entry, authority, fullRepla
     originalCheckpoint: cloneJson(checkpoint),
     checkpoint: cloneJson(nextCheckpoint),
     proof,
+    migrationType: 'legacy_causal_checkpoint_migrated',
+    eventIds: requiredEventIds,
   };
 }
 
@@ -972,11 +1116,14 @@ export function migrateLegacyMemoryCheckpoints(vault, {
     const authority = readMemoryAuthority(vault);
     assertAuthorityMatches(expectedAuthority, authority);
     const inspected = readSessionRegistry(vault);
+    const legacyReplay = deriveMemoryProjection(vault, authority.ledgerEvents, {
+      resolveDeferredAsserts: false,
+    });
     const fullReplay = deriveMemoryProjection(vault, authority.ledgerEvents);
     const plans = Object.entries(inspected.sessions || {})
-      .map(([sessionId, entry]) => legacyCheckpointMigration(
-        vault, sessionId, entry, authority, fullReplay,
-      ))
+      .map(([sessionId, entry]) => deferredAssertReplayCheckpointMigration(
+        sessionId, entry, authority, legacyReplay, fullReplay,
+      ) || legacyCheckpointMigration(vault, sessionId, entry, authority, fullReplay))
       .filter(Boolean);
     assertAuthorityMatches(expectedAuthority, readMemoryAuthority(vault));
     if (!plans.length) return {
@@ -1015,14 +1162,20 @@ export function migrateLegacyMemoryCheckpoints(vault, {
 
         for (const plan of plans) {
           const entry = registry.sessions[plan.sessionId];
-          const reconciliationId = `memcp-${hash(`${plan.sessionId}\0${plan.expectedFingerprint}\0${plan.expectedMemoryCheckpointFingerprint}\0${canonicalMemoryJson(plan.checkpoint)}`).slice(0, 20)}`;
+          const reconciliationSeed = plan.migrationType === 'legacy_causal_checkpoint_migrated'
+            ? `${plan.sessionId}\0${plan.expectedFingerprint}\0${plan.expectedMemoryCheckpointFingerprint}\0${canonicalMemoryJson(plan.checkpoint)}`
+            : `${plan.migrationType}\0${plan.sessionId}\0${plan.expectedFingerprint}\0${plan.expectedMemoryCheckpointFingerprint}\0${canonicalMemoryJson(plan.checkpoint)}`;
+          const reconciliationId = `memcp-${hash(reconciliationSeed).slice(0, 20)}`;
           entry.memory_reconciliations = [
             ...(Array.isArray(entry.memory_reconciliations) ? entry.memory_reconciliations : []),
             {
               v: 1,
               reconciliation_id: reconciliationId,
-              type: 'legacy_causal_checkpoint_migrated',
+              type: plan.migrationType,
               reconciled_at: now,
+              ...(plan.migrationType === 'deferred_assert_replay_migrated'
+                ? { event_ids: [...plan.eventIds] }
+                : {}),
               causal_proof: cloneJson(plan.proof),
               original_checkpoint: cloneJson(plan.originalCheckpoint),
               checkpoint: cloneJson(plan.checkpoint),