wendkeep 0.66.1 → 0.66.4

package/CHANGELOG.md

@@ -4,6 +4,42 @@ All notable changes to **wendkeep** are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.66.4] — 2026-07-30
+
+### Fixed
+
+- **`memory repair` fecha o acknowledgement apenas para a outbox que a própria execução
+  consumiu integralmente.** O receipt do projetor preserva idempotência e impede que attempts
+  históricos, parciais, causalmente divergentes ou concorrentes sejam reclassificados.
+- **`memory recover-attempt <session>` recupera com segurança o estado já projetado pela
+  0.66.3.** O dry-run é padrão e `--apply` altera somente o registry/checkpoint sob prova física,
+  lock e CAS; A→B→A, ledger/sidecars divergentes, outbox pendente e links inseguros falham sem
+  escrita. O diagnóstico agora orienta esse comando quando o acknowledgement ficou pendente.
+
+## [0.66.3] — 2026-07-30
+
+### Fixed
+
+- **O replay reavalia candidates transitórios contra a fonte moderna final.** Um Stop da mesma
+  sessão/activation/epoch e turno maior agora avança depois que a correção causal já presente se
+  torna ativa; turno menor fica superseded e divergências reais continuam para curadoria.
+- **`memory repair` migra o checkpoint antigo somente com prova e CAS.** O repair compara a
+  semântica anterior e a atual, faz backup, atualiza attempt e espelho e registra auditoria sem
+  reordenar, reescrever ou acrescentar evento ao ledger. Prova incompleta continua bloqueada. A
+  0.66.2 não deve ser publicada no npm; publique e instale a 0.66.3.
+
+## [0.66.2] — 2026-07-29
+
+### Fixed
+
+- **Promoção preserva valor e identidade causal do evento escolhido.** `memory promote` não
+  converte mais objetos/arrays JSON em texto e mantém sessão, activation/epoch, turno de origem e
+  sequência; o próximo `SessionStop` da mesma cadeia avança o handoff sem recriar candidate.
+- **A recuperação 0.66.1 cobre inversão física/temporal sem ampliar autoridade.** Quando uma
+  promoção legada projetada fica fora do candidate por `observed_at`, `memory promote` só a inclui
+  em `supersedes` sob prova de ancestralidade e mesma linhagem; fonte moderna ou alheia falha antes
+  de anexar. O E2E percorre o dispatcher público e prova Stop posterior e duplicado idempotentes.
+
 ## [0.66.1] — 2026-07-29
 
 ### Fixed

package/README.en.md

@@ -256,7 +256,7 @@ Hot memory now separates human authorship, operational state, and evidence:
 - **`CORE.md` is canonical.** It is the short, hand-curated nucleus for durable preferences, active patterns, and open issues; no projector may infer or overwrite it.
 - **`SHARED_MEMORY.md` is generated operational state.** The `Stop` hook turns the session handoff into sanitized events; the projector deterministically reduces the ledger and publishes a verifiable revision, cursor, and hash. Facts are `verified` only with local evidence; unsupported reports remain `reported`, and disagreements become candidates for human judgment.
 - **`MEMORY_EVENTS.jsonl` is the append-only authority.** `Stop` makes events durable in the outbox before acknowledging the attempt; the projector runs outside the registry lock and retries reuse the same IDs. Repeating an identical `event_id`/payload is a no-op; reusing the ID with different bytes is observable corruption.
-- **`MEMORY_CANDIDATES.jsonl` is the curation queue.** Conflicts and legacy content are never silently promoted. `promote` and `reject` record the decision as a new event.
+- **`MEMORY_CANDIDATES.jsonl` is the curation queue.** Conflicts and legacy content are never silently promoted. `promote` and `reject` record the decision as a new event; promotion preserves the selected event's JSON type, session, activation/epoch, and source turn.
 
 Artifacts stay under `.brain/` only. Sanitization strips secrets, tokens, local paths, transcripts, and harness payloads both before persistence and before injection. Events carry a `project_id`, and one vault never accepts another project's events.
 
@@ -287,16 +287,29 @@ lost publication, or mismatched checkpoint blocks. See [migration](docs/en/comma
 and [diagnostics](docs/en/commands/maintenance-and-diagnostics.md).
 
 If status blocks, preserve the evidence and run `wendkeep memory repair --vault <vault>` to back up
-the corrupt ledger, retain valid lines, and re-project. Repair never reclassifies attempts. Valid
-pre-0.59 causal checkpoints and exactly re-derived assert-only historical prefixes are
+the corrupt ledger, retain valid lines, and re-project. Repair remains structural: its only narrow
+acknowledgement exception covers attempts entirely represented by the outbox consumed by that same
+run; it does not scan or reclassify historical attempts. Valid pre-0.59 causal checkpoints and
+exactly re-derived assert-only historical prefixes are
 CAS-migrated on both the attempt and `memory_checkpoint` to the correct physical boundary with
 backup/audit; divergent mirrors fail closed. A demonstrably superseded
 ambiguity uses `memory reconcile <session> --by-session <successor>
 --reason <reason>` as a dry run and requires `--apply`; the decision is backed up and audited
 without rewriting ledger, CORE, or notes. Run `status --gate` again afterwards. Conflicts require
 explicit, durable curation: `memory promote <id> --event <event-id>` selects one event from the
-candidate, while `memory reject <id>` keeps the current value. Decisions are idempotent and
-survive repair/replay; `blocked_by_core` cannot override CORE. Doctor only diagnoses. See
+candidate, while `memory reject <id>` keeps the current value. The decision is idempotent, and a
+new promotion accepts a later Stop from the same session/activation without recreating a conflict.
+A promotion written by 0.66.1 remains historical: if the next Stop forms a new candidate, update
+to 0.66.3 and run `memory repair`. During replay, a transient candidate is re-evaluated against the
+final modern source: the same session/activation/epoch and a higher turn advances; a lower turn is
+superseded. Repair migrates the checkpoint and mirror only when it proves the exact previous
+replay, attempt identity, and absence of a real conflict; it creates a backup and audit without
+appending or rewriting events. Ambiguity stays queued for explicit curation. Do not publish or
+install 0.66.2; use 0.66.3 or later. Decisions survive repair/replay;
+`blocked_by_core` cannot override CORE. Doctor only diagnoses. When status/doctor reports projected
+acknowledgement pending on 0.66.4 or later, first run the targeted dry run
+`memory recover-attempt <session> --vault <vault>`, then authorize `--apply`; it changes only
+registry/checkpoint. See syntax, preconditions, and fail-closed behavior in
 [memory and curation](docs/en/commands/memory.md).
 
 Session notes use one live `## Agentes, tokens e custos` snapshot. Main-agent and subagent hooks recompose it atomically, with costs, token dimensions, reasoning tokens and effort per model/source. Every hook that rewrites a session note takes a per-file lock and writes through a temp file + rename, so the `SubagentStop` fan-out (one hook run per subagent) can never leave a note half-written; a note whose frontmatter reads back damaged is left untouched rather than patched.

package/README.md

@@ -256,7 +256,7 @@ Hot memory now separates human authorship, operational state, and evidence:
 - **`CORE.md` is canonical.** It is the short, hand-curated nucleus for durable preferences, active patterns, and open issues; no projector may infer or overwrite it.
 - **`SHARED_MEMORY.md` is generated operational state.** The `Stop` hook turns the session handoff into sanitized events; the projector deterministically reduces the ledger and publishes a verifiable revision, cursor, and hash. Facts are `verified` only with local evidence; unsupported reports remain `reported`, and disagreements become candidates for human judgment.
 - **`MEMORY_EVENTS.jsonl` is the append-only authority.** `Stop` makes events durable in the outbox before acknowledging the attempt; the projector runs outside the registry lock and retries reuse the same IDs. Repeating an identical `event_id`/payload is a no-op; reusing the ID with different bytes is observable corruption.
-- **`MEMORY_CANDIDATES.jsonl` is the curation queue.** Conflicts and legacy content are never silently promoted. `promote` and `reject` record the decision as a new event.
+- **`MEMORY_CANDIDATES.jsonl` is the curation queue.** Conflicts and legacy content are never silently promoted. `promote` and `reject` record the decision as a new event; promotion preserves the selected event's JSON type, session, activation/epoch, and source turn.
 
 Artifacts stay under `.brain/` only. Sanitization strips secrets, tokens, local paths, transcripts, and harness payloads both before persistence and before injection. Events carry a `project_id`, and one vault never accepts another project's events.
 
@@ -287,16 +287,29 @@ lost publication, or mismatched checkpoint blocks. See [migration](docs/en/comma
 and [diagnostics](docs/en/commands/maintenance-and-diagnostics.md).
 
 If status blocks, preserve the evidence and run `wendkeep memory repair --vault <vault>` to back up
-the corrupt ledger, retain valid lines, and re-project. Repair never reclassifies attempts. Valid
-pre-0.59 causal checkpoints and exactly re-derived assert-only historical prefixes are
+the corrupt ledger, retain valid lines, and re-project. Repair remains structural: its only narrow
+acknowledgement exception covers attempts entirely represented by the outbox consumed by that same
+run; it does not scan or reclassify historical attempts. Valid pre-0.59 causal checkpoints and
+exactly re-derived assert-only historical prefixes are
 CAS-migrated on both the attempt and `memory_checkpoint` to the correct physical boundary with
 backup/audit; divergent mirrors fail closed. A demonstrably superseded
 ambiguity uses `memory reconcile <session> --by-session <successor>
 --reason <reason>` as a dry run and requires `--apply`; the decision is backed up and audited
 without rewriting ledger, CORE, or notes. Run `status --gate` again afterwards. Conflicts require
 explicit, durable curation: `memory promote <id> --event <event-id>` selects one event from the
-candidate, while `memory reject <id>` keeps the current value. Decisions are idempotent and
-survive repair/replay; `blocked_by_core` cannot override CORE. Doctor only diagnoses. See
+candidate, while `memory reject <id>` keeps the current value. The decision is idempotent, and a
+new promotion accepts a later Stop from the same session/activation without recreating a conflict.
+A promotion written by 0.66.1 remains historical: if the next Stop forms a new candidate, update
+to 0.66.3 and run `memory repair`. During replay, a transient candidate is re-evaluated against the
+final modern source: the same session/activation/epoch and a higher turn advances; a lower turn is
+superseded. Repair migrates the checkpoint and mirror only when it proves the exact previous
+replay, attempt identity, and absence of a real conflict; it creates a backup and audit without
+appending or rewriting events. Ambiguity stays queued for explicit curation. Do not publish or
+install 0.66.2; use 0.66.3 or later. Decisions survive repair/replay;
+`blocked_by_core` cannot override CORE. Doctor only diagnoses. When status/doctor reports projected
+acknowledgement pending on 0.66.4 or later, first run the targeted dry run
+`memory recover-attempt <session> --vault <vault>`, then authorize `--apply`; it changes only
+registry/checkpoint. See syntax, preconditions, and fail-closed behavior in
 [memory and curation](docs/en/commands/memory.md).
 
 Session notes use one live `## Agentes, tokens e custos` snapshot. Main-agent and subagent hooks recompose it atomically, with costs, token dimensions, reasoning tokens and effort per model/source. Every hook that rewrites a session note takes a per-file lock and writes through a temp file + rename, so the `SubagentStop` fan-out (one hook run per subagent) can never leave a note half-written; a note whose frontmatter reads back damaged is left untouched rather than patched.

package/docs/en/commands/memory.md

@@ -25,6 +25,7 @@ Pass the vault explicitly in automation. Preserve backups and evidence before re
 ```bash
 npx wendkeep memory status [--gate] --vault <vault>
 npx wendkeep memory repair --vault <vault>
+npx wendkeep memory recover-attempt <session> [--apply] --vault <vault>
 npx wendkeep memory reconcile <ambiguous-session> --by-session <successor-session> --reason <reason> [--apply] --vault <vault>
 npx wendkeep memory promote <candidate> [--event <event-id>] --vault <vault>
 npx wendkeep memory reject <candidate> --vault <vault>
@@ -51,8 +52,23 @@ npx wendkeep validate-memory --vault <v2-vault>
   historical prefix only when revision, cursor, hash, identity, turns, and the
   `memory_checkpoint` mirror exactly reproduce the old semantics; the target is the current replay
   of that prefix, without absorbing later events. Both paths CAS-check the attempt and mirror and
-  record backup/audit. Repair never reclassifies registry attempts or accepts a tuple, operation,
-  or mirror that cannot be fully re-derived.
+  record backup/audit. The only narrow acknowledgement exception covers `enqueued`/`degraded`
+  attempts whose outbox was frozen and whose event IDs that same repair run consumed in full;
+  partial coverage does not change the attempt. Repair does not scan or reclassify historical
+  attempts and does not accept a tuple, operation, or mirror that cannot be fully re-derived.
+- As of 0.66.4, `memory recover-attempt` targets one session and is a dry run by default. The
+  session must exist in the registry and its latest attempt must be `v2`, `applied`, and `enqueued`
+  or `degraded`, with non-empty, unique `event_ids`. Every event must be present in the ledger and
+  belong to the attempt's project/session/activation/epoch/turn; no later event from that session
+  or target event still in the outbox may exist, and SHARED/candidates must byte-for-byte reproduce
+  the full ledger projection. An already `projected` attempt is accepted only with a valid
+  checkpoint and returns `unchanged`.
+- With `--apply`, `memory recover-attempt` changes only `SESSION_REGISTRY`: it marks
+  `last_memory_attempt`/`memory_status` as `projected` and stores the same checkpoint in the
+  attempt and `memory_checkpoint`. Ledger, CORE, SHARED, candidates, outbox, and notes remain
+  byte-identical. The command validates all authority again under `MEMORY.lock`, CAS-checks the
+  attempt, activation, epoch, turn, and checkpoint, and fails closed if any byte/context changes.
+  A busy lock is not reaped; retry after application returns `unchanged` without writing.
 - `memory reconcile` is a dry run by default. `--apply` requires two named sessions plus a reason,
   CAS-checks the exact attempt, backs up the registry, and limits mutation to the ambiguous attempt
   and its successor. Replay is CORE-aware, checkpoints use the physical ledger cursor, and the
@@ -70,14 +86,27 @@ npx wendkeep validate-memory --vault <v2-vault>
   `blocked_by_core` candidate can only be rejected: promotion first requires canonical CORE
   curation. If the selected event still belongs to the matching latest `projected` attempt,
   promotion also refreshes its checkpoint and mirror causally; JSON reports
-  `checkpointRefreshed`, and a newer concurrent attempt remains untouched.
+  `checkpointRefreshed`, and a newer concurrent attempt remains untouched. The decision keeps
+  the already validated JSON value without string coercion and copies the selected event's
+  `canonical_session_id`, activation/epoch, `source_turn_id`, and `turn_sequence`. A later Stop
+  from the same session/activation therefore advances the value instead of opening another candidate.
+  During replay, a transient candidate is re-evaluated against the final modern source. The same
+  session/activation/epoch and a higher turn applies the Stop; a lower turn is superseded. A
+  different, incomplete, or ambiguous identity keeps the candidate queued for curation. `memory
+  repair` compares the old and current replay and migrates checkpoint+mirror only with exact
+  identity, backup, audit, and CAS; it does not reorder, rewrite, or append a ledger event.
 - `validate-memory <CORE.md>` checks the 25-line cap, required sections, and secrets.
 - `validate-memory --vault` requires a complete v2 bundle and is not the legacy-vault gate.
+- For `recover-attempt`, exit `0` means a valid dry run/apply, including `unchanged`; exit `1`
+  means a precondition, authority, CAS, topology, or lock check failed; exit `2` means a missing
+  session/`--vault`, unknown or duplicate option, extra argument, or invalid value.
 
 ## Examples
 
 ```bash
 npx wendkeep memory status --gate --vault .MyApp-vault
+npx wendkeep memory recover-attempt session-123 --vault .MyApp-vault
+npx wendkeep memory recover-attempt session-123 --apply --vault .MyApp-vault
 npx wendkeep memory reconcile old --by-session current --reason "delivery continued" --vault .MyApp-vault
 npx wendkeep memory reconcile old --by-session current --reason "delivery continued" --apply --vault .MyApp-vault
 npx wendkeep validate-memory .MyApp-vault/.brain/CORE.md
@@ -99,6 +128,14 @@ of a global projection that has already advanced with concurrent events.
   repair merely to manufacture the first event.
 - `degraded` with every event ID present in either the ledger or an intact outbox is recoverable;
   let idempotent replay finish. An event ID absent from both locations means lost publication.
+- Status/doctor reports `projected acknowledgement pending` and suggests
+  `memory recover-attempt <session>`: preserve the artifacts, inspect the dry-run JSON first, and
+  use `--apply` only when `eligible: true`. `dry-run` confirms eligibility; `applied` updates
+  registry/checkpoint; `unchanged` means the recovery was already applied idempotently.
+- `recover-attempt` rejects a missing/divergent event, a target still in the outbox, stale
+  SHARED/candidates, a historical attempt, mismatched session/causal context, invalid checkpoint,
+  or busy lock. Do not bypass the gate by editing files: rerun `memory status --gate`, preserve
+  evidence, and resolve the divergent authority.
 - An `ambiguous` attempt, an `applied` attempt without event IDs, a `projected` event found only in
   the outbox, or a mismatched checkpoint is blocking: preserve the artifacts and investigate
   before repair. If the ambiguity is demonstrably superseded by a successor session, inspect the
@@ -108,6 +145,12 @@ of a global projection that has already advanced with concurrent events.
 - `promote` reports that `--event` is required: inspect the candidate `event_ids`, compare their
   provenance/value, and name the winner explicitly. An ID outside the candidate fails without
   mutating the ledger or projections.
+- A promotion made by 0.66.1 followed by a transient candidate: update to 0.66.3, preserve a backup,
+  and run `memory repair`. Do not publish or install 0.66.2. Repair migrates the checkpoint only
+  when the old replay, attempt identity, and new event match exactly; a real conflict stays blocked
+  for a human `promote`/`reject` choice.
+- `promote` says that the candidate no longer matches the causal projection: no event was appended.
+  Run `memory status`, inspect the current candidate again, and do not force a different lineage.
 - Missing `event_cursor` or mismatched v2 hash: preserve the bundle and assess `memory repair`.
 - `validate-memory --vault` fails on legacy: validate CORE only or migrate first.
 

package/docs/pt-BR/commands/memory.md

@@ -25,6 +25,7 @@ Informe o vault explicitamente em automações. Preserve backups e evidências a
 ```bash
 npx wendkeep memory status [--gate] --vault <cofre>
 npx wendkeep memory repair --vault <cofre>
+npx wendkeep memory recover-attempt <sessão> [--apply] --vault <cofre>
 npx wendkeep memory reconcile <sessão-ambígua> --by-session <sessão-sucessora> --reason <motivo> [--apply] --vault <cofre>
 npx wendkeep memory promote <candidate> [--event <event-id>] --vault <cofre>
 npx wendkeep memory reject <candidate> --vault <cofre>
@@ -51,8 +52,24 @@ npx wendkeep validate-memory --vault <cofre-v2>
   assert-only somente quando revision, cursor, hash, identidade, turns e o espelho
   `memory_checkpoint` reproduzem exatamente a semântica antiga; o alvo é o replay atual daquele
   prefixo, sem absorver eventos posteriores. Ambos os casos fazem CAS do attempt e do espelho e
-  registram backup/auditoria. O repair nunca reclassifica attempts do registry nem aceita tuple,
-  operação ou espelho que não seja rederivado integralmente.
+  registram backup/auditoria. A única exceção estreita de acknowledgement cobre attempts
+  `enqueued`/`degraded` cuja outbox foi congelada e cujos event IDs a mesma execução do repair
+  consumiu integralmente; cobertura parcial não altera o attempt. O repair não varre nem
+  reclassifica attempts históricos e não aceita tuple, operação ou espelho que não seja
+  rederivado integralmente.
+- Desde a 0.66.4, `memory recover-attempt` é dirigido a uma única sessão e faz dry-run por padrão.
+  A sessão deve existir no registry e possuir o último attempt `v2`, `applied`, em `enqueued` ou
+  `degraded`, com `event_ids` não vazios e únicos. Todos os eventos devem estar integralmente no
+  ledger, pertencer ao mesmo projeto/sessão/activation/epoch/turn do attempt, não pode haver evento
+  posterior da mesma sessão nem evento alvo restante na outbox, e SHARED/candidates devem
+  reproduzir byte a byte a projeção integral do ledger. Um attempt já `projected` só é aceito com
+  checkpoint válido e retorna `unchanged`.
+- Com `--apply`, `memory recover-attempt` altera somente `SESSION_REGISTRY`: marca
+  `last_memory_attempt`/`memory_status` como `projected` e grava o checkpoint idêntico no attempt e
+  em `memory_checkpoint`. Ledger, CORE, SHARED, candidates, outbox e notas permanecem byte-intactos.
+  O comando valida novamente toda a autoridade sob `MEMORY.lock`, faz CAS do attempt, activation,
+  epoch, turno e checkpoint e falha fechado se qualquer byte/contexto mudar. Lock ocupado não é
+  colhido; retry após aplicação retorna `unchanged` sem escrita.
 - `memory reconcile` é dry-run por padrão. `--apply` exige duas sessões nomeadas e motivo, faz CAS
   do attempt exato, salva backup do registry e limita a mutação ao attempt ambíguo e à sucessora.
   O replay é CORE-aware, usa cursor físico do ledger no checkpoint e não reescreve ledger, CORE ou
@@ -68,13 +85,26 @@ npx wendkeep validate-memory --vault <cofre-v2>
   promover exige antes alterar CORE pela curadoria canônica. Se o evento escolhido ainda pertence
   ao último attempt `projected` correspondente, a promoção também atualiza causalmente checkpoint
   e espelho; o JSON retorna `checkpointRefreshed`, e um attempt concorrente mais novo não é tocado.
+  A decisão conserva, sem coerção para string, o valor JSON já validado e copia do evento escolhido
+  `canonical_session_id`, activation/epoch, `source_turn_id` e `turn_sequence`. Por isso, um Stop
+  posterior da mesma sessão/activation avança o valor em vez de abrir outro candidate. Durante o
+  replay, um candidate transitório é reavaliado contra a fonte moderna final. Mesma
+  sessão/activation/epoch e turno maior aplica o Stop; turno menor fica superseded. Identidade
+  divergente, incompleta ou ambígua mantém o candidate para curadoria. `memory repair` compara o
+  replay anterior e o atual e só migra checkpoint+espelho com identidade exata, backup, audit e
+  CAS; ele não reordena, reescreve nem acrescenta evento ao ledger.
 - `validate-memory <CORE.md>` valida cap de 25 linhas, seções e segredos.
 - `validate-memory --vault` exige bundle v2 completo; não é o gate correto para vault legado.
+- Para `recover-attempt`, exit `0` indica dry-run/apply válido, inclusive `unchanged`; exit `1`
+  indica falha de pré-condição, autoridade, CAS, topologia ou lock; exit `2` indica
+  sessão/`--vault` ausente, opção desconhecida/duplicada, argumento extra ou valor inválido.
 
 ## Exemplos
 
 ```bash
 npx wendkeep memory status --gate --vault .MeuApp-vault
+npx wendkeep memory recover-attempt sessao-123 --vault .MeuApp-vault
+npx wendkeep memory recover-attempt sessao-123 --apply --vault .MeuApp-vault
 npx wendkeep memory reconcile antiga --by-session atual --reason "entrega continuada" --vault .MeuApp-vault
 npx wendkeep memory reconcile antiga --by-session atual --reason "entrega continuada" --apply --vault .MeuApp-vault
 npx wendkeep validate-memory .MeuApp-vault/.brain/CORE.md
@@ -96,6 +126,14 @@ prefixo válido de uma projeção global que já avançou com eventos concorrent
   fabricar o primeiro evento.
 - `degraded` com todos os event IDs presentes no ledger ou na outbox íntegra é recuperável; deixe o
   replay idempotente concluir. Event ID ausente nos dois lugares indica publicação perdida.
+- Status/doctor informa `acknowledgement projetado pendente` e sugere
+  `memory recover-attempt <sessão>`: preserve os artefatos, revise primeiro o JSON do dry-run e só
+  use `--apply` se `eligible: true`. `dry-run` confirma elegibilidade; `applied` atualiza
+  registry/checkpoint; `unchanged` indica que a recuperação já foi aplicada de forma idempotente.
+- `recover-attempt` recusa evento ausente/divergente, outbox alvo ainda presente, SHARED/candidates
+  stale, attempt histórico, sessão/contexto causal divergente, checkpoint inválido ou lock ocupado.
+  Não tente contornar o gate com edição manual: rode novamente `memory status --gate`, preserve a
+  evidência e resolva a autoridade divergente.
 - Attempt `ambiguous`, attempt `applied` sem event IDs, evento `projected` apenas na outbox ou
   checkpoint divergente são bloqueantes: preserve os artefatos e investigue antes de repair. Se a
   ambiguidade for comprovadamente substituída por uma sessão sucessora, revise o dry-run de
@@ -104,6 +142,12 @@ prefixo válido de uma projeção global que já avançou com eventos concorrent
 - `promote` informa que `--event` é obrigatório: leia os `event_ids` do candidate, compare a
   proveniência/valor e indique explicitamente o vencedor. ID que não pertence ao candidate falha
   sem mutar ledger ou projeções.
+- Promoção feita pela 0.66.1 seguida de candidate transitório: atualize para a 0.66.3, preserve um
+  backup e rode `memory repair`. Não publique nem instale a 0.66.2. O repair só migra o checkpoint
+  quando o replay anterior, a identidade do attempt e o evento novo coincidem exatamente; conflito
+  real continua bloqueado para escolha humana com `promote`/`reject`.
+- `promote` informa que o candidate não corresponde mais à projeção causal: nenhum evento foi
+  anexado. Rode `memory status`, releia o candidate atual e não force uma linhagem diferente.
 - `event_cursor` ausente ou hash divergente em v2: preserve o bundle e avalie `memory repair`.
 - `validate-memory --vault` falha no legado: valide apenas CORE ou migre primeiro.
 

package/hooks/vault-health.mjs

@@ -338,6 +338,12 @@ function checkMemoryAttempts(registry, {
       const missing = eventIds.filter((eventId) => !ledgerEventIds.has(eventId) && !outboxEventIds.has(eventId));
       if (missing.length) {
         failures.push(`Attempt v2 perdeu ${missing.length} evento(s): ausentes do ledger e da outbox. Inspecione com: ${MEMORY_STATUS_COMMAND}.`);
+      } else if (
+        state === 'enqueued'
+        && eventIds.every((eventId) => ledgerEventIds.has(eventId))
+        && eventIds.every((eventId) => !outboxEventIds.has(eventId))
+      ) {
+        warnings.push(`Attempt de memória v2 possui acknowledgement projetado pendente. Recupere com: wendkeep memory recover-attempt ${sessionId}.`);
       } else {
         warnings.push(`Attempt de memória v2 ${state} permanece recuperável: ${eventIds.length} evento(s) durável(is) no ledger e/ou outbox.`);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wendkeep",
-  "version": "0.66.1",
+  "version": "0.66.4",
   "description": "Vault-first persistent memory for AI coding agents, with an optional profile-aware governance runtime: OFF, FLOW, GUIDE, GOVERN, or ASSURE. Local-first and agent-agnostic (Claude Code, Codex, Cursor…).",
   "type": "module",
   "workspaces": [

package/packages/cli/src/index.mjs

@@ -100,6 +100,7 @@ Usage:
                            behind the closing block. Dry-run by default · --apply · --json.
   wendkeep lesson add "t" "l"   Record a project-local lesson (injected at SessionStart).
   wendkeep memory <sub>          Shared memory v2: status | migrate [--apply] | repair |
+                           recover-attempt <session> [--apply] |
                            reconcile <session> --by-session <session> --reason <text> [--apply] |
                            promote <candidate> [--event <event-id>] | reject <candidate>. --vault P.
                            Reconcile is dry-run by default; the original attempt remains audited.

package/packages/vault/src/memory-store.mjs

@@ -313,6 +313,8 @@ export function readMemoryLedger(vaultBase) {
     if (eventIds.has(parsed.event_id)) {
       if (eventPayloads.get(parsed.event_id) !== payload) {
         errors.push(ledgerError(lineNumber, `event_id collision: ${parsed.event_id}`, partial));
+      } else {
+        errors.push(ledgerError(lineNumber, `duplicate event_id: ${parsed.event_id}`, partial));
       }
       return;
     }
@@ -344,6 +346,22 @@ function sameCausalActivation(left, right) {
     && left.activation_id === right?.activation_id;
 }
 
+function hasCompleteCausalIdentity(event) {
+  return Boolean(event?.canonical_session_id)
+    && Boolean(event?.activation_id)
+    && Boolean(event?.source_turn_id)
+    && Number.isInteger(event?.activation_epoch)
+    && Number.isInteger(event?.turn_sequence);
+}
+
+function sameCompleteCausalLineage(left, right) {
+  return hasCompleteCausalIdentity(left)
+    && hasCompleteCausalIdentity(right)
+    && left.canonical_session_id === right.canonical_session_id
+    && left.activation_id === right.activation_id
+    && left.activation_epoch === right.activation_epoch;
+}
+
 function comparable(left, right) {
   if (sameCausalActivation(left, right)) return true;
   const leftSupersedes = left.supersedes_event_id || left.supersedes;
@@ -447,7 +465,9 @@ function isCausallyOlder(event, current) {
  * Pure deterministic reducer. It pre-detects incomparable scalar siblings so replay order
  * never turns one concurrent writer into an accidental winner.
  */
-export function reduceMemoryEvents(inputEvents = [], { coreInvariants = new Map() } = {}) {
+export function reduceMemoryEvents(inputEvents = [], {
+  coreInvariants = new Map(), resolveDeferredAsserts = true,
+} = {}) {
   const protectedValues = coreInvariants instanceof Map
     ? coreInvariants
     : new Map(Object.entries(coreInvariants || {}));
@@ -495,6 +515,8 @@ export function reduceMemoryEvents(inputEvents = [], { coreInvariants = new Map(
   const records = new Map();
   const tombstones = new Map();
   const candidates = [];
+  const pendingAssertConflicts = [];
+  const resolvedCandidateIds = new Set();
   const emittedGroups = new Set();
   const appliedEventIds = [];
   const superseded = [];
@@ -543,7 +565,9 @@ export function reduceMemoryEvents(inputEvents = [], { coreInvariants = new Map(
           appliedEventIds.push(item.event_id);
           continue;
         }
-        candidates.push(conflictCandidate(item.memory_key, [currentEventFromRecord(current), item]));
+        const candidate = conflictCandidate(item.memory_key, [currentEventFromRecord(current), item]);
+        candidates.push(candidate);
+        pendingAssertConflicts.push({ candidate, event: item });
         continue;
       }
       if (!current) {
@@ -616,6 +640,46 @@ export function reduceMemoryEvents(inputEvents = [], { coreInvariants = new Map(
     appliedEventIds.push(item.event_id);
   }
 
+  if (resolveDeferredAsserts) {
+    // A physically late assert can sort before a corrective promotion because effective time
+    // precedes CLI decision time. Revisit only scalar assert conflicts left without an explicit
+    // decision, against the final complete causal source; the ledger and global ordering stay put.
+    const deferredAsserts = pendingAssertConflicts
+      .filter((pending) => !candidateDecisions.has(pending.candidate.candidate_id))
+      .sort((left, right) => String(left.event.memory_key).localeCompare(String(right.event.memory_key))
+        || String(left.event.canonical_session_id || '').localeCompare(String(right.event.canonical_session_id || ''))
+        || String(left.event.activation_id || '').localeCompare(String(right.event.activation_id || ''))
+        || Number(left.event.activation_epoch ?? -1) - Number(right.event.activation_epoch ?? -1)
+        || Number(left.event.turn_sequence ?? -1) - Number(right.event.turn_sequence ?? -1)
+        || eventOrder(left.event, right.event));
+    let advanced = true;
+    while (advanced) {
+      advanced = false;
+      for (const pending of deferredAsserts) {
+        if (resolvedCandidateIds.has(pending.candidate.candidate_id)) continue;
+        const current = records.get(pending.event.memory_key);
+        const currentSource = current?.source;
+        if (!sameCompleteCausalLineage(pending.event, currentSource)) continue;
+        if (pending.event.turn_sequence > currentSource.turn_sequence) {
+          records.set(pending.event.memory_key, {
+            value: pending.event.value,
+            revision: current.revision + 1,
+            source: pending.event,
+          });
+          tombstones.delete(pending.event.memory_key);
+          superseded.push({ event_id: currentSource.event_id, by_event_id: pending.event.event_id });
+          revision += 1;
+          appliedEventIds.push(pending.event.event_id);
+          resolvedCandidateIds.add(pending.candidate.candidate_id);
+          advanced = true;
+        } else if (pending.event.turn_sequence < currentSource.turn_sequence) {
+          superseded.push({ event_id: pending.event.event_id, by_event_id: currentSource.event_id });
+          resolvedCandidateIds.add(pending.candidate.candidate_id);
+        }
+      }
+    }
+  }
+
   const stateEntries = [...records].map(([key, record]) => [key, record.value]);
   const recordEntries = [...records].map(([key, record]) => [key, record]);
   const tombstoneEntries = [...tombstones];
@@ -623,7 +687,8 @@ export function reduceMemoryEvents(inputEvents = [], { coreInvariants = new Map(
   const recordObject = sortedObject(recordEntries);
   const tombstoneObject = sortedObject(tombstoneEntries);
   const unresolvedCandidates = candidates
-    .filter((item) => !candidateDecisions.has(item.candidate_id));
+    .filter((item) => !candidateDecisions.has(item.candidate_id)
+      && !resolvedCandidateIds.has(item.candidate_id));
   unresolvedCandidates.sort((left, right) => left.candidate_id.localeCompare(right.candidate_id));
   superseded.sort((left, right) => left.event_id.localeCompare(right.event_id));
   const activeEvents = Object.entries(recordObject).map(([memoryKey, record]) => ({
@@ -655,8 +720,12 @@ export function reduceMemoryEvents(inputEvents = [], { coreInvariants = new Map(
  * `eventCursor` is the reducer's deterministic causal cursor; `ledgerCursor` is the
  * physical prefix boundary used by durable checkpoints.
  */
-export function deriveMemoryProjection(vaultBase, inputEvents = []) {
-  const reduced = reduceMemoryEvents(inputEvents, { coreInvariants: readCoreInvariants(vaultBase) });
+export function deriveMemoryProjection(vaultBase, inputEvents = [], {
+  resolveDeferredAsserts = true,
+} = {}) {
+  const reduced = reduceMemoryEvents(inputEvents, {
+    coreInvariants: readCoreInvariants(vaultBase), resolveDeferredAsserts,
+  });
   const ledgerCursor = inputEvents.at(-1)?.event_id || 'none';
   const checkpoint = {
     revision: reduced.revision,
@@ -844,15 +913,18 @@ function projectLocked(vaultBase, { faultAt } = {}) {
   const projection = publishMemoryProjection(vaultBase, prepared);
   injectFault(faultAt, 'after-projection');
 
+  const consumedEventIds = [];
   for (const entry of outbox) {
     unlinkVaultFile(vaultBase, entry.path, {
       missingOk: false, label: 'evento consumido do outbox de memória',
     });
+    consumedEventIds.push(entry.event.event_id);
   }
   return {
     status: 'projected',
     appended: newEvents.length,
     consumed: outbox.length,
+    consumedEventIds,
     pending: 0,
     ...projection,
   };