wendkeep 0.66.3 → 0.66.4

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to **wendkeep** are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.66.4] — 2026-07-30
+
+### Fixed
+
+- **`memory repair` fecha o acknowledgement apenas para a outbox que a própria execução
+  consumiu integralmente.** O receipt do projetor preserva idempotência e impede que attempts
+  históricos, parciais, causalmente divergentes ou concorrentes sejam reclassificados.
+- **`memory recover-attempt <session>` recupera com segurança o estado já projetado pela
+  0.66.3.** O dry-run é padrão e `--apply` altera somente o registry/checkpoint sob prova física,
+  lock e CAS; A→B→A, ledger/sidecars divergentes, outbox pendente e links inseguros falham sem
+  escrita. O diagnóstico agora orienta esse comando quando o acknowledgement ficou pendente.
+
 ## [0.66.3] — 2026-07-30
 
 ### Fixed

package/README.en.md

@@ -287,8 +287,10 @@ lost publication, or mismatched checkpoint blocks. See [migration](docs/en/comma
 and [diagnostics](docs/en/commands/maintenance-and-diagnostics.md).
 
 If status blocks, preserve the evidence and run `wendkeep memory repair --vault <vault>` to back up
-the corrupt ledger, retain valid lines, and re-project. Repair never reclassifies attempts. Valid
-pre-0.59 causal checkpoints and exactly re-derived assert-only historical prefixes are
+the corrupt ledger, retain valid lines, and re-project. Repair remains structural: its only narrow
+acknowledgement exception covers attempts entirely represented by the outbox consumed by that same
+run; it does not scan or reclassify historical attempts. Valid pre-0.59 causal checkpoints and
+exactly re-derived assert-only historical prefixes are
 CAS-migrated on both the attempt and `memory_checkpoint` to the correct physical boundary with
 backup/audit; divergent mirrors fail closed. A demonstrably superseded
 ambiguity uses `memory reconcile <session> --by-session <successor>
@@ -303,9 +305,12 @@ final modern source: the same session/activation/epoch and a higher turn advance
 superseded. Repair migrates the checkpoint and mirror only when it proves the exact previous
 replay, attempt identity, and absence of a real conflict; it creates a backup and audit without
 appending or rewriting events. Ambiguity stays queued for explicit curation. Do not publish or
-install 0.66.2; use 0.66.3. Decisions survive repair/replay;
-`blocked_by_core` cannot override CORE. Doctor only
-diagnoses. See [memory and curation](docs/en/commands/memory.md).
+install 0.66.2; use 0.66.3 or later. Decisions survive repair/replay;
+`blocked_by_core` cannot override CORE. Doctor only diagnoses. When status/doctor reports projected
+acknowledgement pending on 0.66.4 or later, first run the targeted dry run
+`memory recover-attempt <session> --vault <vault>`, then authorize `--apply`; it changes only
+registry/checkpoint. See syntax, preconditions, and fail-closed behavior in
+[memory and curation](docs/en/commands/memory.md).
 
 Session notes use one live `## Agentes, tokens e custos` snapshot. Main-agent and subagent hooks recompose it atomically, with costs, token dimensions, reasoning tokens and effort per model/source. Every hook that rewrites a session note takes a per-file lock and writes through a temp file + rename, so the `SubagentStop` fan-out (one hook run per subagent) can never leave a note half-written; a note whose frontmatter reads back damaged is left untouched rather than patched.
 

package/README.md

@@ -287,8 +287,10 @@ lost publication, or mismatched checkpoint blocks. See [migration](docs/en/comma
 and [diagnostics](docs/en/commands/maintenance-and-diagnostics.md).
 
 If status blocks, preserve the evidence and run `wendkeep memory repair --vault <vault>` to back up
-the corrupt ledger, retain valid lines, and re-project. Repair never reclassifies attempts. Valid
-pre-0.59 causal checkpoints and exactly re-derived assert-only historical prefixes are
+the corrupt ledger, retain valid lines, and re-project. Repair remains structural: its only narrow
+acknowledgement exception covers attempts entirely represented by the outbox consumed by that same
+run; it does not scan or reclassify historical attempts. Valid pre-0.59 causal checkpoints and
+exactly re-derived assert-only historical prefixes are
 CAS-migrated on both the attempt and `memory_checkpoint` to the correct physical boundary with
 backup/audit; divergent mirrors fail closed. A demonstrably superseded
 ambiguity uses `memory reconcile <session> --by-session <successor>
@@ -303,9 +305,12 @@ final modern source: the same session/activation/epoch and a higher turn advance
 superseded. Repair migrates the checkpoint and mirror only when it proves the exact previous
 replay, attempt identity, and absence of a real conflict; it creates a backup and audit without
 appending or rewriting events. Ambiguity stays queued for explicit curation. Do not publish or
-install 0.66.2; use 0.66.3. Decisions survive repair/replay;
-`blocked_by_core` cannot override CORE. Doctor only
-diagnoses. See [memory and curation](docs/en/commands/memory.md).
+install 0.66.2; use 0.66.3 or later. Decisions survive repair/replay;
+`blocked_by_core` cannot override CORE. Doctor only diagnoses. When status/doctor reports projected
+acknowledgement pending on 0.66.4 or later, first run the targeted dry run
+`memory recover-attempt <session> --vault <vault>`, then authorize `--apply`; it changes only
+registry/checkpoint. See syntax, preconditions, and fail-closed behavior in
+[memory and curation](docs/en/commands/memory.md).
 
 Session notes use one live `## Agentes, tokens e custos` snapshot. Main-agent and subagent hooks recompose it atomically, with costs, token dimensions, reasoning tokens and effort per model/source. Every hook that rewrites a session note takes a per-file lock and writes through a temp file + rename, so the `SubagentStop` fan-out (one hook run per subagent) can never leave a note half-written; a note whose frontmatter reads back damaged is left untouched rather than patched.
 

package/docs/en/commands/memory.md

@@ -25,6 +25,7 @@ Pass the vault explicitly in automation. Preserve backups and evidence before re
 ```bash
 npx wendkeep memory status [--gate] --vault <vault>
 npx wendkeep memory repair --vault <vault>
+npx wendkeep memory recover-attempt <session> [--apply] --vault <vault>
 npx wendkeep memory reconcile <ambiguous-session> --by-session <successor-session> --reason <reason> [--apply] --vault <vault>
 npx wendkeep memory promote <candidate> [--event <event-id>] --vault <vault>
 npx wendkeep memory reject <candidate> --vault <vault>
@@ -51,8 +52,23 @@ npx wendkeep validate-memory --vault <v2-vault>
   historical prefix only when revision, cursor, hash, identity, turns, and the
   `memory_checkpoint` mirror exactly reproduce the old semantics; the target is the current replay
   of that prefix, without absorbing later events. Both paths CAS-check the attempt and mirror and
-  record backup/audit. Repair never reclassifies registry attempts or accepts a tuple, operation,
-  or mirror that cannot be fully re-derived.
+  record backup/audit. The only narrow acknowledgement exception covers `enqueued`/`degraded`
+  attempts whose outbox was frozen and whose event IDs that same repair run consumed in full;
+  partial coverage does not change the attempt. Repair does not scan or reclassify historical
+  attempts and does not accept a tuple, operation, or mirror that cannot be fully re-derived.
+- As of 0.66.4, `memory recover-attempt` targets one session and is a dry run by default. The
+  session must exist in the registry and its latest attempt must be `v2`, `applied`, and `enqueued`
+  or `degraded`, with non-empty, unique `event_ids`. Every event must be present in the ledger and
+  belong to the attempt's project/session/activation/epoch/turn; no later event from that session
+  or target event still in the outbox may exist, and SHARED/candidates must byte-for-byte reproduce
+  the full ledger projection. An already `projected` attempt is accepted only with a valid
+  checkpoint and returns `unchanged`.
+- With `--apply`, `memory recover-attempt` changes only `SESSION_REGISTRY`: it marks
+  `last_memory_attempt`/`memory_status` as `projected` and stores the same checkpoint in the
+  attempt and `memory_checkpoint`. Ledger, CORE, SHARED, candidates, outbox, and notes remain
+  byte-identical. The command validates all authority again under `MEMORY.lock`, CAS-checks the
+  attempt, activation, epoch, turn, and checkpoint, and fails closed if any byte/context changes.
+  A busy lock is not reaped; retry after application returns `unchanged` without writing.
 - `memory reconcile` is a dry run by default. `--apply` requires two named sessions plus a reason,
   CAS-checks the exact attempt, backs up the registry, and limits mutation to the ambiguous attempt
   and its successor. Replay is CORE-aware, checkpoints use the physical ledger cursor, and the
@@ -81,11 +97,16 @@ npx wendkeep validate-memory --vault <v2-vault>
   identity, backup, audit, and CAS; it does not reorder, rewrite, or append a ledger event.
 - `validate-memory <CORE.md>` checks the 25-line cap, required sections, and secrets.
 - `validate-memory --vault` requires a complete v2 bundle and is not the legacy-vault gate.
+- For `recover-attempt`, exit `0` means a valid dry run/apply, including `unchanged`; exit `1`
+  means a precondition, authority, CAS, topology, or lock check failed; exit `2` means a missing
+  session/`--vault`, unknown or duplicate option, extra argument, or invalid value.
 
 ## Examples
 
 ```bash
 npx wendkeep memory status --gate --vault .MyApp-vault
+npx wendkeep memory recover-attempt session-123 --vault .MyApp-vault
+npx wendkeep memory recover-attempt session-123 --apply --vault .MyApp-vault
 npx wendkeep memory reconcile old --by-session current --reason "delivery continued" --vault .MyApp-vault
 npx wendkeep memory reconcile old --by-session current --reason "delivery continued" --apply --vault .MyApp-vault
 npx wendkeep validate-memory .MyApp-vault/.brain/CORE.md
@@ -107,6 +128,14 @@ of a global projection that has already advanced with concurrent events.
   repair merely to manufacture the first event.
 - `degraded` with every event ID present in either the ledger or an intact outbox is recoverable;
   let idempotent replay finish. An event ID absent from both locations means lost publication.
+- Status/doctor reports `projected acknowledgement pending` and suggests
+  `memory recover-attempt <session>`: preserve the artifacts, inspect the dry-run JSON first, and
+  use `--apply` only when `eligible: true`. `dry-run` confirms eligibility; `applied` updates
+  registry/checkpoint; `unchanged` means the recovery was already applied idempotently.
+- `recover-attempt` rejects a missing/divergent event, a target still in the outbox, stale
+  SHARED/candidates, a historical attempt, mismatched session/causal context, invalid checkpoint,
+  or busy lock. Do not bypass the gate by editing files: rerun `memory status --gate`, preserve
+  evidence, and resolve the divergent authority.
 - An `ambiguous` attempt, an `applied` attempt without event IDs, a `projected` event found only in
   the outbox, or a mismatched checkpoint is blocking: preserve the artifacts and investigate
   before repair. If the ambiguity is demonstrably superseded by a successor session, inspect the

package/docs/pt-BR/commands/memory.md

@@ -25,6 +25,7 @@ Informe o vault explicitamente em automações. Preserve backups e evidências a
 ```bash
 npx wendkeep memory status [--gate] --vault <cofre>
 npx wendkeep memory repair --vault <cofre>
+npx wendkeep memory recover-attempt <sessão> [--apply] --vault <cofre>
 npx wendkeep memory reconcile <sessão-ambígua> --by-session <sessão-sucessora> --reason <motivo> [--apply] --vault <cofre>
 npx wendkeep memory promote <candidate> [--event <event-id>] --vault <cofre>
 npx wendkeep memory reject <candidate> --vault <cofre>
@@ -51,8 +52,24 @@ npx wendkeep validate-memory --vault <cofre-v2>
   assert-only somente quando revision, cursor, hash, identidade, turns e o espelho
   `memory_checkpoint` reproduzem exatamente a semântica antiga; o alvo é o replay atual daquele
   prefixo, sem absorver eventos posteriores. Ambos os casos fazem CAS do attempt e do espelho e
-  registram backup/auditoria. O repair nunca reclassifica attempts do registry nem aceita tuple,
-  operação ou espelho que não seja rederivado integralmente.
+  registram backup/auditoria. A única exceção estreita de acknowledgement cobre attempts
+  `enqueued`/`degraded` cuja outbox foi congelada e cujos event IDs a mesma execução do repair
+  consumiu integralmente; cobertura parcial não altera o attempt. O repair não varre nem
+  reclassifica attempts históricos e não aceita tuple, operação ou espelho que não seja
+  rederivado integralmente.
+- Desde a 0.66.4, `memory recover-attempt` é dirigido a uma única sessão e faz dry-run por padrão.
+  A sessão deve existir no registry e possuir o último attempt `v2`, `applied`, em `enqueued` ou
+  `degraded`, com `event_ids` não vazios e únicos. Todos os eventos devem estar integralmente no
+  ledger, pertencer ao mesmo projeto/sessão/activation/epoch/turn do attempt, não pode haver evento
+  posterior da mesma sessão nem evento alvo restante na outbox, e SHARED/candidates devem
+  reproduzir byte a byte a projeção integral do ledger. Um attempt já `projected` só é aceito com
+  checkpoint válido e retorna `unchanged`.
+- Com `--apply`, `memory recover-attempt` altera somente `SESSION_REGISTRY`: marca
+  `last_memory_attempt`/`memory_status` como `projected` e grava o checkpoint idêntico no attempt e
+  em `memory_checkpoint`. Ledger, CORE, SHARED, candidates, outbox e notas permanecem byte-intactos.
+  O comando valida novamente toda a autoridade sob `MEMORY.lock`, faz CAS do attempt, activation,
+  epoch, turno e checkpoint e falha fechado se qualquer byte/contexto mudar. Lock ocupado não é
+  colhido; retry após aplicação retorna `unchanged` sem escrita.
 - `memory reconcile` é dry-run por padrão. `--apply` exige duas sessões nomeadas e motivo, faz CAS
   do attempt exato, salva backup do registry e limita a mutação ao attempt ambíguo e à sucessora.
   O replay é CORE-aware, usa cursor físico do ledger no checkpoint e não reescreve ledger, CORE ou
@@ -78,11 +95,16 @@ npx wendkeep validate-memory --vault <cofre-v2>
   CAS; ele não reordena, reescreve nem acrescenta evento ao ledger.
 - `validate-memory <CORE.md>` valida cap de 25 linhas, seções e segredos.
 - `validate-memory --vault` exige bundle v2 completo; não é o gate correto para vault legado.
+- Para `recover-attempt`, exit `0` indica dry-run/apply válido, inclusive `unchanged`; exit `1`
+  indica falha de pré-condição, autoridade, CAS, topologia ou lock; exit `2` indica
+  sessão/`--vault` ausente, opção desconhecida/duplicada, argumento extra ou valor inválido.
 
 ## Exemplos
 
 ```bash
 npx wendkeep memory status --gate --vault .MeuApp-vault
+npx wendkeep memory recover-attempt sessao-123 --vault .MeuApp-vault
+npx wendkeep memory recover-attempt sessao-123 --apply --vault .MeuApp-vault
 npx wendkeep memory reconcile antiga --by-session atual --reason "entrega continuada" --vault .MeuApp-vault
 npx wendkeep memory reconcile antiga --by-session atual --reason "entrega continuada" --apply --vault .MeuApp-vault
 npx wendkeep validate-memory .MeuApp-vault/.brain/CORE.md
@@ -104,6 +126,14 @@ prefixo válido de uma projeção global que já avançou com eventos concorrent
   fabricar o primeiro evento.
 - `degraded` com todos os event IDs presentes no ledger ou na outbox íntegra é recuperável; deixe o
   replay idempotente concluir. Event ID ausente nos dois lugares indica publicação perdida.
+- Status/doctor informa `acknowledgement projetado pendente` e sugere
+  `memory recover-attempt <sessão>`: preserve os artefatos, revise primeiro o JSON do dry-run e só
+  use `--apply` se `eligible: true`. `dry-run` confirma elegibilidade; `applied` atualiza
+  registry/checkpoint; `unchanged` indica que a recuperação já foi aplicada de forma idempotente.
+- `recover-attempt` recusa evento ausente/divergente, outbox alvo ainda presente, SHARED/candidates
+  stale, attempt histórico, sessão/contexto causal divergente, checkpoint inválido ou lock ocupado.
+  Não tente contornar o gate com edição manual: rode novamente `memory status --gate`, preserve a
+  evidência e resolva a autoridade divergente.
 - Attempt `ambiguous`, attempt `applied` sem event IDs, evento `projected` apenas na outbox ou
   checkpoint divergente são bloqueantes: preserve os artefatos e investigue antes de repair. Se a
   ambiguidade for comprovadamente substituída por uma sessão sucessora, revise o dry-run de

package/hooks/vault-health.mjs

@@ -338,6 +338,12 @@ function checkMemoryAttempts(registry, {
       const missing = eventIds.filter((eventId) => !ledgerEventIds.has(eventId) && !outboxEventIds.has(eventId));
       if (missing.length) {
         failures.push(`Attempt v2 perdeu ${missing.length} evento(s): ausentes do ledger e da outbox. Inspecione com: ${MEMORY_STATUS_COMMAND}.`);
+      } else if (
+        state === 'enqueued'
+        && eventIds.every((eventId) => ledgerEventIds.has(eventId))
+        && eventIds.every((eventId) => !outboxEventIds.has(eventId))
+      ) {
+        warnings.push(`Attempt de memória v2 possui acknowledgement projetado pendente. Recupere com: wendkeep memory recover-attempt ${sessionId}.`);
       } else {
         warnings.push(`Attempt de memória v2 ${state} permanece recuperável: ${eventIds.length} evento(s) durável(is) no ledger e/ou outbox.`);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wendkeep",
-  "version": "0.66.3",
+  "version": "0.66.4",
   "description": "Vault-first persistent memory for AI coding agents, with an optional profile-aware governance runtime: OFF, FLOW, GUIDE, GOVERN, or ASSURE. Local-first and agent-agnostic (Claude Code, Codex, Cursor…).",
   "type": "module",
   "workspaces": [

package/packages/cli/src/index.mjs

@@ -100,6 +100,7 @@ Usage:
                            behind the closing block. Dry-run by default · --apply · --json.
   wendkeep lesson add "t" "l"   Record a project-local lesson (injected at SessionStart).
   wendkeep memory <sub>          Shared memory v2: status | migrate [--apply] | repair |
+                           recover-attempt <session> [--apply] |
                            reconcile <session> --by-session <session> --reason <text> [--apply] |
                            promote <candidate> [--event <event-id>] | reject <candidate>. --vault P.
                            Reconcile is dry-run by default; the original attempt remains audited.

package/packages/vault/src/memory-store.mjs

@@ -313,6 +313,8 @@ export function readMemoryLedger(vaultBase) {
     if (eventIds.has(parsed.event_id)) {
       if (eventPayloads.get(parsed.event_id) !== payload) {
         errors.push(ledgerError(lineNumber, `event_id collision: ${parsed.event_id}`, partial));
+      } else {
+        errors.push(ledgerError(lineNumber, `duplicate event_id: ${parsed.event_id}`, partial));
       }
       return;
     }
@@ -911,15 +913,18 @@ function projectLocked(vaultBase, { faultAt } = {}) {
   const projection = publishMemoryProjection(vaultBase, prepared);
   injectFault(faultAt, 'after-projection');
 
+  const consumedEventIds = [];
   for (const entry of outbox) {
     unlinkVaultFile(vaultBase, entry.path, {
       missingOk: false, label: 'evento consumido do outbox de memória',
     });
+    consumedEventIds.push(entry.event.event_id);
   }
   return {
     status: 'projected',
     appended: newEvents.length,
     consumed: outbox.length,
+    consumedEventIds,
     pending: 0,
     ...projection,
   };

package/src/memory.mjs

@@ -1,7 +1,7 @@
 import { createHash } from 'node:crypto';
 import {
   constants as fsConstants, copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync,
-  rmSync, writeFileSync,
+  readdirSync, rmSync, statSync, writeFileSync,
 } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { sanitizeMemoryText, renderSharedMemory, validateSharedMemory } from '../hooks/memory-schema.mjs';
@@ -538,6 +538,520 @@ function memoryCheckpointFingerprint(entry) {
   }));
 }
 
+function fieldSnapshot(value, key) {
+  const present = Object.prototype.hasOwnProperty.call(value || {}, key);
+  return { present, value: present ? (value[key] ?? null) : null };
+}
+
+function attemptAuthorityFingerprint(entry, attempt) {
+  const activation = entry?.activations?.[attempt?.activation_id];
+  return hash(canonicalMemoryJson({
+    status: fieldSnapshot(entry, 'status'),
+    active_activation_id: fieldSnapshot(entry, 'active_activation_id'),
+    activation_epoch: fieldSnapshot(entry, 'activation_epoch'),
+    last_turn_id: fieldSnapshot(entry, 'last_turn_id'),
+    last_turn_sequence: fieldSnapshot(entry, 'last_turn_sequence'),
+    turn_sequence: fieldSnapshot(entry?.turn_sequences, attempt?.turn_id),
+    activation: {
+      status: fieldSnapshot(activation, 'status'),
+      epoch: fieldSnapshot(activation, 'epoch'),
+      last_stop_turn_id: fieldSnapshot(activation, 'last_stop_turn_id'),
+      last_stop_turn_sequence: fieldSnapshot(activation, 'last_stop_turn_sequence'),
+      last_turn_sequence: fieldSnapshot(activation, 'last_turn_sequence'),
+    },
+    memory_status: fieldSnapshot(entry, 'memory_status'),
+    memory_activation_id: fieldSnapshot(entry, 'memory_activation_id'),
+  }));
+}
+
+function ownsAttemptContext(entry, attempt) {
+  const activation = entry?.activations?.[attempt?.activation_id];
+  return entry?.status === 'active'
+    && entry.active_activation_id === attempt.activation_id
+    && entry.activation_epoch === attempt.activation_epoch
+    && activation?.status === 'active'
+    && activation.epoch === attempt.activation_epoch
+    && entry.last_turn_id === attempt.turn_id
+    && entry.last_turn_sequence === attempt.turn_sequence
+    && entry.turn_sequences?.[attempt.turn_id] === attempt.turn_sequence
+    && activation.last_stop_turn_id === attempt.turn_id
+    && activation.last_stop_turn_sequence === attempt.turn_sequence
+    && activation.last_turn_sequence === attempt.turn_sequence
+    && entry.memory_status === attempt.state
+    && entry.memory_activation_id === attempt.activation_id;
+}
+
+function attemptEventMatches(event, attempt, expectedProjectId) {
+  return event?.project_id === expectedProjectId
+    && event.canonical_session_id === attempt.canonical_session_id
+    && event.activation_id === attempt.activation_id
+    && event.activation_epoch === attempt.activation_epoch
+    && event.source_turn_id === attempt.turn_id
+    && event.turn_sequence === attempt.turn_sequence;
+}
+
+function readAttemptOutboxEvents(vault, eventIds) {
+  const events = [];
+  for (const eventId of eventIds) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(eventId)) return null;
+    const path = brainPath(vault, join('memory-outbox', `${eventId}.json`));
+    const checked = checkedVaultFile(vault, path, `outbox do attempt ${eventId}`);
+    if (!checked.exists) return null;
+    try {
+      const event = JSON.parse(readVaultFile(
+        vault, checked.target, 'utf8', `outbox do attempt ${eventId}`,
+      ));
+      if (event?.event_id !== eventId) return null;
+      events.push(event);
+    } catch (error) {
+      if (error?.code === 'VAULT_PATH_UNSAFE') throw error;
+      return null;
+    }
+  }
+  return events;
+}
+
+function targetOutboxIsAbsent(vault, eventIds) {
+  return eventIds.every((eventId) => {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(eventId)) return false;
+    const path = brainPath(vault, join('memory-outbox', `${eventId}.json`));
+    return !checkedVaultFile(vault, path, `outbox do attempt ${eventId}`).exists;
+  });
+}
+
+function freezeRepairAttemptAcknowledgements(vault, options = {}) {
+  const result = withMemoryLock(vault, () => {
+    const expectedProjectId = projectId(vault);
+    const registry = readSessionRegistry(vault);
+    const frozen = [];
+    let pending = false;
+    for (const [sessionId, entry] of Object.entries(registry.sessions || {})) {
+      const attempt = entry?.last_memory_attempt;
+      const eventIds = Array.isArray(attempt?.event_ids) ? [...attempt.event_ids] : [];
+      if (attempt?.memory_mode !== 'v2' || attempt.disposition !== 'applied'
+          || !['enqueued', 'degraded'].includes(attempt.state)) continue;
+      pending = true;
+      if (!eventIds.length || new Set(eventIds).size !== eventIds.length
+          || eventIds.some((eventId) => typeof eventId !== 'string' || !eventId)
+          || sessionId !== attempt.canonical_session_id
+          || !ownsAttemptContext(entry, attempt)) continue;
+      const outboxEvents = readAttemptOutboxEvents(vault, eventIds);
+      if (!outboxEvents
+          || outboxEvents.some((event) => !attemptEventMatches(event, attempt, expectedProjectId))) {
+        continue;
+      }
+      frozen.push({
+        sessionId,
+        projectId: expectedProjectId,
+        eventIds,
+        eventFingerprints: new Map(outboxEvents.map((event) => [
+          event.event_id, hash(canonicalMemoryJson(event)),
+        ])),
+        attemptFingerprint: attemptFingerprint(attempt),
+        checkpointFingerprint: memoryCheckpointFingerprint(entry),
+        authorityFingerprint: attemptAuthorityFingerprint(entry, attempt),
+      });
+    }
+    if (pending) {
+      const ledger = readLedgerForValidation(vault, { projectId: expectedProjectId });
+      if (!ledger.ok) {
+        throw new Error(`Ledger físico inválido para acknowledgement de repair: ${(ledger.errors || []).join(' ')}`);
+      }
+    }
+    return { attempts: frozen, pending };
+  }, options.memoryLock || {});
+  return result;
+}
+
+function publishedProjectionMatches(vault, events, projection) {
+  const prepared = prepareMemoryProjection(vault, events);
+  if (!sameCheckpoint(prepared.checkpoint, projection?.checkpoint)) return false;
+  const shared = readVaultFile(
+    vault, brainPath(vault, SHARED), 'utf8', 'projeção SHARED_MEMORY.md',
+  );
+  const candidates = readVaultFile(
+    vault, brainPath(vault, CANDIDATES), 'utf8', 'projeção MEMORY_CANDIDATES.jsonl',
+  );
+  return shared === prepared.sharedContent && candidates === prepared.candidatesContent;
+}
+
+function acknowledgeRepairAttempts(vault, frozen, projection, options = {}) {
+  const receipt = new Set(Array.isArray(projection?.consumedEventIds)
+    ? projection.consumedEventIds
+    : []);
+  const covered = frozen.filter((item) => item.eventIds.every((eventId) => receipt.has(eventId)));
+  if (!covered.length) {
+    return {
+      status: 'unchanged', eligible: frozen.length, acknowledged: 0, stale: frozen.length,
+    };
+  }
+
+  const outcome = withMemoryLock(vault, () => {
+    if (options.beforeAttemptAcknowledgement) options.beforeAttemptAcknowledgement();
+    const ledger = readMemoryLedger(vault);
+    if (ledger.status !== 'ok' || !publishedProjectionMatches(vault, ledger.events, projection)) {
+      return {
+        status: 'attention', eligible: frozen.length, acknowledged: 0, stale: frozen.length,
+      };
+    }
+    const byId = new Map(ledger.events.map((event) => [event.event_id, event]));
+    const valid = covered.filter((item) => {
+      if (projectId(vault) !== item.projectId || !targetOutboxIsAbsent(vault, item.eventIds)) {
+        return false;
+      }
+      return item.eventIds.every((eventId) => {
+        const event = byId.get(eventId);
+        return event
+          && item.eventFingerprints.get(eventId) === hash(canonicalMemoryJson(event));
+      });
+    });
+    if (!valid.length) {
+      return {
+        status: 'attention', eligible: frozen.length, acknowledged: 0, stale: frozen.length,
+      };
+    }
+
+    const acknowledged = mutateSessionRegistry(vault, (registry) => {
+      const sessionIds = [];
+      for (const item of valid) {
+        const entry = registry.sessions?.[item.sessionId];
+        const attempt = entry?.last_memory_attempt;
+        if (!attempt || attemptFingerprint(attempt) !== item.attemptFingerprint
+            || memoryCheckpointFingerprint(entry) !== item.checkpointFingerprint
+            || attemptAuthorityFingerprint(entry, attempt) !== item.authorityFingerprint
+            || !ownsAttemptContext(entry, attempt)
+            || item.eventIds.some((eventId) => !attemptEventMatches(
+              byId.get(eventId), attempt, item.projectId,
+            ))) continue;
+        attempt.state = 'projected';
+        attempt.checkpoint = cloneJson(projection.checkpoint);
+        entry.memory_status = 'projected';
+        entry.memory_checkpoint = cloneJson(projection.checkpoint);
+        sessionIds.push(item.sessionId);
+      }
+      return sessionIds;
+    });
+    return {
+      status: acknowledged.length === valid.length ? 'acknowledged' : 'attention',
+      eligible: frozen.length,
+      acknowledged: acknowledged.length,
+      stale: frozen.length - acknowledged.length,
+      sessionIds: acknowledged,
+    };
+  }, options.memoryLock || {});
+  return outcome === MEMORY_LOCK_BUSY
+    ? {
+      status: 'busy', eligible: frozen.length, acknowledged: 0, stale: frozen.length,
+    }
+    : outcome;
+}
+
+function normalizeProjectedAttemptRecoveryRequest({ sessionId } = {}) {
+  const normalizedSessionId = String(sessionId || '').trim();
+  if (!normalizedSessionId) {
+    throw new TypeError('sessionId é obrigatório para recuperar attempt projetado.');
+  }
+  return { sessionId: normalizedSessionId };
+}
+
+function readStrictSessionRegistry(vault) {
+  const path = registryPath(vault);
+  const checked = checkedVaultFile(vault, path, 'SESSION_REGISTRY da recuperação', {
+    allowMissing: false,
+  });
+  const generationBefore = filesystemGeneration(checked.target);
+  let bytes;
+  try {
+    bytes = readVaultFile(vault, checked.target, undefined, 'SESSION_REGISTRY da recuperação');
+  } catch (error) {
+    throw new Error(`SESSION_REGISTRY ausente ou ilegível para recuperação: ${error?.message || error}`);
+  }
+  const generationAfter = filesystemGeneration(checked.target);
+  if (canonicalMemoryJson(generationBefore) !== canonicalMemoryJson(generationAfter)) {
+    throw new Error('SESSION_REGISTRY mudou durante o preflight da recuperação targeted.');
+  }
+  let registry;
+  try {
+    registry = JSON.parse(bytes.toString('utf8'));
+  } catch (error) {
+    throw new Error(`SESSION_REGISTRY contém JSON inválido para recuperação: ${error?.message || error}`);
+  }
+  if (!registry || typeof registry !== 'object' || Array.isArray(registry)
+      || !Number.isInteger(registry.version) || registry.version < 2
+      || !registry.sessions || typeof registry.sessions !== 'object'
+      || Array.isArray(registry.sessions)) {
+    throw new Error('SESSION_REGISTRY inválido para recuperação targeted.');
+  }
+  return {
+    registry,
+    registryHash: hash(canonicalMemoryJson(registry)),
+    registryGeneration: generationAfter,
+  };
+}
+
+function filesystemGeneration(path) {
+  const stat = statSync(path, { bigint: true });
+  return {
+    dev: String(stat.dev),
+    ino: String(stat.ino),
+    size: String(stat.size),
+    mtimeNs: String(stat.mtimeNs),
+    ctimeNs: String(stat.ctimeNs),
+    birthtimeNs: String(stat.birthtimeNs),
+  };
+}
+
+function projectedRecoveryOutboxProof(vault) {
+  const path = brainPath(vault, 'memory-outbox');
+  const checked = assertVaultPathSafe(vault, path, {
+    allowMissing: true,
+    expectedType: 'directory',
+    label: 'diretório memory-outbox da recuperação',
+  });
+  if (!checked.exists) return { exists: false, entries: [] };
+
+  const namesBefore = readdirSync(checked.target).sort();
+  const entries = namesBefore.map((name) => {
+    const memberPath = join(checked.target, name);
+    const member = checkedVaultFile(
+      vault, memberPath, `membro ${name} da memory-outbox`, { allowMissing: false },
+    );
+    const bytes = readVaultFile(
+      vault, member.target, undefined, `membro ${name} da memory-outbox`,
+    );
+    let event;
+    try {
+      event = JSON.parse(bytes.toString('utf8'));
+    } catch (error) {
+      throw new Error(`Membro ${name} da memory-outbox contém JSON inválido: ${error?.message || error}`);
+    }
+    if (!event || typeof event !== 'object' || Array.isArray(event)
+        || typeof event.event_id !== 'string' || !event.event_id.trim()) {
+      throw new Error(`Membro ${name} da memory-outbox não contém event_id válido.`);
+    }
+    return {
+      name,
+      eventId: event.event_id,
+      generation: filesystemGeneration(member.target),
+      hash: byteHash(bytes),
+    };
+  });
+  const namesAfter = readdirSync(checked.target).sort();
+  if (canonicalMemoryJson(namesBefore) !== canonicalMemoryJson(namesAfter)) {
+    throw new Error('memory-outbox mudou durante o preflight da recuperação targeted.');
+  }
+  return {
+    exists: true,
+    generation: filesystemGeneration(checked.target),
+    entries,
+  };
+}
+
+function recoveryContextFingerprint(entry, attempt) {
+  return hash(canonicalMemoryJson({
+    status: fieldSnapshot(entry, 'status'),
+    session_id: fieldSnapshot(entry, 'session_id'),
+    activation_id: fieldSnapshot(entry, 'activation_id'),
+    active_activation_id: fieldSnapshot(entry, 'active_activation_id'),
+    activation_epoch: fieldSnapshot(entry, 'activation_epoch'),
+    last_turn_id: fieldSnapshot(entry, 'last_turn_id'),
+    last_turn_sequence: fieldSnapshot(entry, 'last_turn_sequence'),
+    turn_sequences: cloneJson(entry?.turn_sequences || null),
+    activation: cloneJson(entry?.activations?.[attempt?.activation_id] || null),
+    memory_status: fieldSnapshot(entry, 'memory_status'),
+    memory_activation_id: fieldSnapshot(entry, 'memory_activation_id'),
+  }));
+}
+
+function recoveryRegistryProof(entry, attempt) {
+  return {
+    attemptFingerprint: attemptFingerprint(attempt),
+    contextFingerprint: recoveryContextFingerprint(entry, attempt),
+    checkpointFingerprint: memoryCheckpointFingerprint(entry),
+  };
+}
+
+function validStoredProjectedCheckpoint(vault, authority, attempt, entry) {
+  if (!checkpointShape(attempt?.checkpoint)
+      || !sameCheckpoint(attempt.checkpoint, entry?.memory_checkpoint)) return false;
+  const cursorIndex = authority.ledgerEvents
+    .findIndex((event) => event.event_id === attempt.checkpoint.event_cursor);
+  if (cursorIndex < 0) return false;
+  const prefix = authority.ledgerEvents.slice(0, cursorIndex + 1);
+  const prefixIds = new Set(prefix.map((event) => event.event_id));
+  if (attempt.event_ids.some((eventId) => !prefixIds.has(eventId))) return false;
+  return sameCheckpoint(
+    attempt.checkpoint,
+    prepareMemoryProjection(vault, prefix).checkpoint,
+  );
+}
+
+function prepareProjectedAttemptRecovery(vault, rawRequest) {
+  const request = normalizeProjectedAttemptRecoveryRequest(rawRequest);
+  const authority = readMemoryAuthority(vault);
+  const registrySnapshot = readStrictSessionRegistry(vault);
+  const { registry } = registrySnapshot;
+  const outboxProof = projectedRecoveryOutboxProof(vault);
+  const entry = registry.sessions[request.sessionId];
+  if (!entry) throw new Error(`Sessão não encontrada para recuperação: ${request.sessionId}`);
+
+  const attempt = entry.last_memory_attempt;
+  const eventIds = Array.isArray(attempt?.event_ids) ? [...attempt.event_ids] : [];
+  if (attempt?.memory_mode !== 'v2' || attempt?.disposition !== 'applied'
+      || !['enqueued', 'degraded', 'projected'].includes(attempt?.state)) {
+    throw new Error(`Attempt da sessão ${request.sessionId} não é v2/applied recuperável.`);
+  }
+  if (!eventIds.length
+      || eventIds.some((eventId) => typeof eventId !== 'string' || !eventId.trim())
+      || new Set(eventIds).size !== eventIds.length) {
+    throw new Error('Attempt recuperável deve possuir event_ids não vazios e únicos.');
+  }
+  if (request.sessionId !== attempt.canonical_session_id
+      || (Object.prototype.hasOwnProperty.call(entry, 'session_id')
+        && entry.session_id !== request.sessionId)
+      || !ownsAttemptContext(entry, attempt)) {
+    throw new Error('Contexto causal do attempt não pertence mais à sessão ativa.');
+  }
+
+  const eventIndexes = eventIds.map((eventId) => (
+    authority.ledgerEvents.findIndex((event) => event.event_id === eventId)
+  ));
+  if (eventIndexes.some((index) => index < 0)) {
+    throw new Error('Attempt recuperável referencia event_ids ausentes do ledger.');
+  }
+  for (const eventId of eventIds) {
+    if (!attemptEventMatches(authority.ledgerById.get(eventId), attempt, authority.projectId)) {
+      throw new Error(`Identidade causal inválida no evento ${eventId}.`);
+    }
+  }
+  const lastAttemptEventIndex = Math.max(...eventIndexes);
+  if (authority.ledgerEvents.slice(lastAttemptEventIndex + 1)
+    .some((event) => event.canonical_session_id === request.sessionId)) {
+    throw new Error('Existe evento posterior da mesma sessão; attempt histórico não pode ser recuperado.');
+  }
+  if (!targetOutboxIsAbsent(vault, eventIds)
+      || outboxProof.entries.some((item) => eventIds.includes(item.eventId))) {
+    throw new Error('A outbox ainda contém evento alvo; recuperação targeted recusada.');
+  }
+
+  const projection = prepareMemoryProjection(vault, authority.ledgerEvents);
+  const sharedBytes = readVaultFile(
+    vault, brainPath(vault, SHARED), undefined, 'projeção SHARED_MEMORY.md',
+  );
+  const candidatesBytes = readVaultFile(
+    vault, brainPath(vault, CANDIDATES), undefined, 'projeção MEMORY_CANDIDATES.jsonl',
+  );
+  if (!sharedBytes.equals(Buffer.from(projection.sharedContent))
+      || !candidatesBytes.equals(Buffer.from(projection.candidatesContent))) {
+    throw new Error('SHARED/candidates divergem da autoridade integral do ledger.');
+  }
+  assertAuthorityMatches(authority, readMemoryAuthority(vault));
+
+  const alreadyProjected = attempt.state === 'projected';
+  if (alreadyProjected && !validStoredProjectedCheckpoint(vault, authority, attempt, entry)) {
+    throw new Error('Attempt projected não possui checkpoint armazenado válido.');
+  }
+
+  return {
+    request,
+    eligible: !alreadyProjected,
+    alreadyProjected,
+    checkpoint: cloneJson(alreadyProjected ? attempt.checkpoint : projection.checkpoint),
+    proof: {
+      projectId: authority.projectId,
+      projectHash: authority.projectHash,
+      coreHash: authority.coreHash,
+      ledgerHash: authority.ledgerHash,
+      sharedHash: byteHash(sharedBytes),
+      candidatesHash: byteHash(candidatesBytes),
+      outboxProof,
+      registryHash: registrySnapshot.registryHash,
+      registryGeneration: registrySnapshot.registryGeneration,
+      eventIds,
+      eventFingerprints: eventIds.map((eventId) => (
+        hash(canonicalMemoryJson(authority.ledgerById.get(eventId)))
+      )),
+      ...recoveryRegistryProof(entry, attempt),
+    },
+  };
+}
+
+function projectedAttemptRecoveryResult(prepared, status) {
+  return {
+    status,
+    eligible: prepared.eligible,
+    sessionId: prepared.request.sessionId,
+    checkpoint: cloneJson(prepared.checkpoint),
+  };
+}
+
+function assertProjectedAttemptRecoveryProof(expected, actual) {
+  if (canonicalMemoryJson(expected.proof) !== canonicalMemoryJson(actual.proof)
+      || expected.alreadyProjected !== actual.alreadyProjected
+      || !sameCheckpoint(expected.checkpoint, actual.checkpoint)) {
+    throw new Error('CAS perdido: autoridade, attempt, contexto causal ou checkpoint mudou.');
+  }
+}
+
+export function inspectProjectedAttemptRecovery(vault, { sessionId } = {}) {
+  const prepared = prepareProjectedAttemptRecovery(vault, { sessionId });
+  return projectedAttemptRecoveryResult(
+    prepared, prepared.alreadyProjected ? 'unchanged' : 'eligible',
+  );
+}
+
+export function recoverProjectedAttempt(vault, {
+  sessionId,
+  apply = false,
+  beforeRegistryMutation,
+  memoryLock = {},
+} = {}) {
+  const prepared = prepareProjectedAttemptRecovery(vault, { sessionId });
+  if (prepared.alreadyProjected) {
+    return projectedAttemptRecoveryResult(prepared, 'unchanged');
+  }
+  if (!apply) return projectedAttemptRecoveryResult(prepared, 'dry-run');
+
+  const outcome = withMemoryLock(vault, () => {
+    const locked = prepareProjectedAttemptRecovery(vault, prepared.request);
+    assertProjectedAttemptRecoveryProof(prepared, locked);
+    if (beforeRegistryMutation) beforeRegistryMutation();
+    const current = prepareProjectedAttemptRecovery(vault, prepared.request);
+    assertProjectedAttemptRecoveryProof(locked, current);
+
+    mutateSessionRegistry(vault, (registry) => {
+      const entry = registry.sessions?.[current.request.sessionId];
+      const attempt = entry?.last_memory_attempt;
+      const expectedRegistryProof = {
+        attemptFingerprint: current.proof.attemptFingerprint,
+        contextFingerprint: current.proof.contextFingerprint,
+        checkpointFingerprint: current.proof.checkpointFingerprint,
+      };
+      if (!entry || !attempt
+          || hash(canonicalMemoryJson(registry)) !== current.proof.registryHash
+          || canonicalMemoryJson(filesystemGeneration(registryPath(vault)))
+            !== canonicalMemoryJson(current.proof.registryGeneration)
+          || canonicalMemoryJson(recoveryRegistryProof(entry, attempt))
+            !== canonicalMemoryJson(expectedRegistryProof)) {
+        throw new Error('CAS perdido: registry mudou antes do acknowledgement targeted.');
+      }
+      attempt.state = 'projected';
+      attempt.checkpoint = cloneJson(current.checkpoint);
+      entry.memory_status = 'projected';
+      entry.memory_activation_id = attempt.activation_id;
+      entry.memory_checkpoint = cloneJson(current.checkpoint);
+    });
+    return projectedAttemptRecoveryResult(current, 'applied');
+  }, memoryLock);
+
+  if (outcome === MEMORY_LOCK_BUSY) {
+    const error = new Error('MEMORY.lock indisponível; recuperação targeted não foi aplicada.');
+    error.code = 'WENDKEEP_MEMORY_LOCK_BUSY';
+    throw error;
+  }
+  return outcome;
+}
+
 function matchingAppliedReconciliation(entry, request) {
   const attempt = entry?.last_memory_attempt;
   if (attempt?.memory_mode !== 'v2' || attempt?.state !== 'skipped' || attempt?.disposition !== 'superseded') return null;
@@ -1217,13 +1731,28 @@ export function migrateLegacyMemoryCheckpoints(vault, {
 }
 
 export function repairMemory(vault, options = {}) {
-  const repaired = repairMemoryLedger(vault);
+  if (options.beforeAttemptFreeze) options.beforeAttemptFreeze();
+  const acknowledgementPreflight = freezeRepairAttemptAcknowledgements(vault, options);
+  if (acknowledgementPreflight === MEMORY_LOCK_BUSY) {
+    return { status: 'busy', stage: 'attempt-freeze' };
+  }
+  const frozenAttempts = acknowledgementPreflight.attempts;
+  const repaired = acknowledgementPreflight.pending
+    ? { status: 'unchanged', repairedLines: 0, backupPath: null }
+    : repairMemoryLedger(vault);
   if (repaired.status === 'busy') return repaired;
   const projection = projectMemoryOutbox(vault);
   if (projection.status === 'busy') return { status: 'busy', repaired, projection };
+  const attemptAcknowledgements = acknowledgeRepairAttempts(
+    vault, frozenAttempts, projection, options,
+  );
   const checkpointMigration = migrateLegacyMemoryCheckpoints(vault, options);
   return {
-    status: 'repaired', repaired, projection, checkpointMigration,
+    status: 'repaired',
+    repaired,
+    projection,
+    attemptAcknowledgements,
+    checkpointMigration,
   };
 }
 
@@ -1317,9 +1846,61 @@ function parseReconcileArgs(argv) {
   };
 }
 
+function parseRecoverAttemptArgs(argv) {
+  const positionals = [];
+  const seen = new Set();
+  let apply = false;
+  let vault = '';
+
+  for (let index = 1; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (!token.startsWith('--')) {
+      positionals.push(token);
+      if (positionals.length > 1) {
+        throw memoryUsageError(`memory recover-attempt recebeu argumento posicional extra: ${token}.`);
+      }
+      continue;
+    }
+
+    const equalAt = token.indexOf('=');
+    const name = equalAt >= 0 ? token.slice(0, equalAt) : token;
+    if (name !== '--apply' && name !== '--vault') {
+      throw memoryUsageError(`memory recover-attempt recebeu opção desconhecida: ${name}.`);
+    }
+    if (seen.has(name)) {
+      throw memoryUsageError(`memory recover-attempt recebeu opção duplicada: ${name}.`);
+    }
+    seen.add(name);
+
+    if (name === '--apply') {
+      if (equalAt >= 0) throw memoryUsageError('--apply não aceita valor.');
+      apply = true;
+      continue;
+    }
+
+    const value = equalAt >= 0 ? token.slice(equalAt + 1) : argv[index + 1];
+    if (!value || !value.trim() || value.startsWith('--')) {
+      throw memoryUsageError('--vault requer valor não vazio que não comece com --.');
+    }
+    vault = value;
+    if (equalAt < 0) index += 1;
+  }
+
+  if (positionals.length !== 1) {
+    throw memoryUsageError('memory recover-attempt requer exatamente uma sessão obrigatória.');
+  }
+
+  return {
+    sessionId: positionals[0],
+    apply,
+    vault,
+  };
+}
+
 export function runMemory(argv) {
   const [sub, positional] = argv;
   let reconcileArgs = null;
+  let recoverAttemptArgs = null;
   if (sub === 'reconcile') {
     try {
       reconcileArgs = parseReconcileArgs(argv);
@@ -1329,7 +1910,18 @@ export function runMemory(argv) {
       return;
     }
   }
-  const vault = (reconcileArgs?.vault || option(argv, '--vault')) || process.env.OBSIDIAN_VAULT_PATH;
+  if (sub === 'recover-attempt') {
+    try {
+      recoverAttemptArgs = parseRecoverAttemptArgs(argv);
+    } catch (error) {
+      process.stderr.write(`wendkeep memory: ${error.message}\n`);
+      process.exitCode = error.code === 'WENDKEEP_MEMORY_USAGE' ? 2 : 1;
+      return;
+    }
+  }
+  const vault = (
+    recoverAttemptArgs?.vault || reconcileArgs?.vault || option(argv, '--vault')
+  ) || process.env.OBSIDIAN_VAULT_PATH;
   if (!vault) { process.stderr.write('wendkeep memory: passe --vault <path>.\n'); process.exitCode = 2; return; }
   if (!existsSync(vault)) { process.stderr.write(`wendkeep memory: not found: ${vault}\n`); process.exitCode = 2; return; }
   try {
@@ -1345,6 +1937,12 @@ export function runMemory(argv) {
         apply: reconcileArgs.apply,
       });
     }
+    else if (sub === 'recover-attempt') {
+      result = recoverProjectedAttempt(vault, {
+        sessionId: recoverAttemptArgs.sessionId,
+        apply: recoverAttemptArgs.apply,
+      });
+    }
     else if (sub === 'promote' || sub === 'reject') {
       const eventId = option(argv, '--event');
       if (sub === 'reject' && eventId) throw memoryUsageError('--event é permitido somente em memory promote.');
@@ -1352,7 +1950,7 @@ export function runMemory(argv) {
         action: sub, candidateId: positional, ...(eventId ? { eventId } : {}),
       });
     }
-    else { process.stderr.write('wendkeep memory: use status | migrate [--apply] | repair | reconcile <session> --by-session <session> --reason <text> [--apply] | promote <candidate> [--event <event-id>] | reject <candidate>.\n'); process.exitCode = 2; return; }
+    else { process.stderr.write('wendkeep memory: use status | migrate [--apply] | repair | recover-attempt <session> [--apply] | reconcile <session> --by-session <session> --reason <text> [--apply] | promote <candidate> [--event <event-id>] | reject <candidate>.\n'); process.exitCode = 2; return; }
     process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
     if (sub === 'status' && argv.includes('--gate')) process.exitCode = result.status === 'blocked' ? 1 : 0;
     else if (sub === 'reconcile' && reconcileArgs.apply) process.exitCode = result.health?.status === 'blocked' ? 1 : 0;