wendkeep 0.66.3 → 0.66.5

package/CHANGELOG.md

@@ -4,6 +4,40 @@ All notable changes to **wendkeep** are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.66.5] — 2026-08-01
+
+### Fixed
+
+- **A observabilidade Codex passa a registrar o grafo completo de subagentes.** Metadata é
+  lida incrementalmente mesmo em rollouts grandes; descendentes em dias posteriores ou níveis
+  aninhados são atribuídos uma única vez, enquanto transcripts top-level permanecem no bucket
+  principal e sinais duplicados ou atrasados não regridem o snapshot publicado.
+- **SessionStop e SubagentStop convergem sob frontier causal e estado explícito.** O schema 2
+  distingue `complete`, `none` e `degraded`, coalesce rajadas com lease, preserva o último
+  snapshot íntegro diante de fonte incompleta e mantém cache/runtime reconstruíveis sem publicar
+  zero silencioso.
+- **Rebuild, import e doctor agora reconciliam a observabilidade persistida.** Preview permanece
+  sem escrita, apply rejeita resultado parcial, import atualiza notas completas porém stale e o
+  doctor correlaciona checkpoint, manifest e dirty para expor degradação real.
+
+### Security
+
+- **Diagnostics e provas públicas aplicam uma fronteira de privacidade estável.** Somente pares
+  allowlisted `{code,count}` podem ser persistidos; paths, identificadores, prompts e exceções
+  brutas ficam fora de fixtures, evidências e notas de release.
+
+## [0.66.4] — 2026-07-30
+
+### Fixed
+
+- **`memory repair` fecha o acknowledgement apenas para a outbox que a própria execução
+  consumiu integralmente.** O receipt do projetor preserva idempotência e impede que attempts
+  históricos, parciais, causalmente divergentes ou concorrentes sejam reclassificados.
+- **`memory recover-attempt <session>` recupera com segurança o estado já projetado pela
+  0.66.3.** O dry-run é padrão e `--apply` altera somente o registry/checkpoint sob prova física,
+  lock e CAS; A→B→A, ledger/sidecars divergentes, outbox pendente e links inseguros falham sem
+  escrita. O diagnóstico agora orienta esse comando quando o acknowledgement ficou pendente.
+
 ## [0.66.3] — 2026-07-30
 
 ### Fixed

package/README.en.md

@@ -211,10 +211,10 @@ The README is the map; the guides provide syntax, options, exit codes, examples,
 | **Operating profiles** | `profile`, `flow`, always-on Keep Core, and Wend Runtime governance | [Operating profiles](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/operating-profiles.md) |
 | **Changes and verification** | `change`, specs, sensors, TDD, evidence, and archive | [Changes and verification](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/changes-and-verification.md) |
 | **Shared memory** | CORE, SHARED, status, validation, repair, and curation | [Memory](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/memory.md) |
-| **Sessions and import** | hooks, registry, session focus, and Claude/Codex backfill | [Sessions and import](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/sessions-and-import.md) |
+| **Sessions and import** | causal hooks, observability reconciliation, and Claude/Codex backfill | [Sessions and import](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/sessions-and-import.md) |
 | **Notes and knowledge** | BUG/APR/ADR, repairs, renumbering, lessons, and dashboard | [Notes and knowledge](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/notes-and-knowledge.md) |
-| **Costs and observability** | stats, aggregation, trends, and historical rebuild | [Costs and observability](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/costs-and-observability.md) |
-| **Maintenance and diagnostics** | doctor, definition drift, theme, version, and help | [Maintenance and diagnostics](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/maintenance-and-diagnostics.md) |
+| **Costs and observability** | safe dry-run, tri-state, aggregation, trends, and historical rebuild | [Costs and observability](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/costs-and-observability.md) |
+| **Maintenance and diagnostics** | doctor, frontier/manifest freshness, drift, version, and help | [Maintenance and diagnostics](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/maintenance-and-diagnostics.md) |
 
 Operations that deserve step-by-step guidance: [verify and exits 0/1/2](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/verify.md),
 [legacy-memory migration](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/memory-migration.md), and
@@ -287,8 +287,10 @@ lost publication, or mismatched checkpoint blocks. See [migration](docs/en/comma
 and [diagnostics](docs/en/commands/maintenance-and-diagnostics.md).
 
 If status blocks, preserve the evidence and run `wendkeep memory repair --vault <vault>` to back up
-the corrupt ledger, retain valid lines, and re-project. Repair never reclassifies attempts. Valid
-pre-0.59 causal checkpoints and exactly re-derived assert-only historical prefixes are
+the corrupt ledger, retain valid lines, and re-project. Repair remains structural: its only narrow
+acknowledgement exception covers attempts entirely represented by the outbox consumed by that same
+run; it does not scan or reclassify historical attempts. Valid pre-0.59 causal checkpoints and
+exactly re-derived assert-only historical prefixes are
 CAS-migrated on both the attempt and `memory_checkpoint` to the correct physical boundary with
 backup/audit; divergent mirrors fail closed. A demonstrably superseded
 ambiguity uses `memory reconcile <session> --by-session <successor>
@@ -303,9 +305,12 @@ final modern source: the same session/activation/epoch and a higher turn advance
 superseded. Repair migrates the checkpoint and mirror only when it proves the exact previous
 replay, attempt identity, and absence of a real conflict; it creates a backup and audit without
 appending or rewriting events. Ambiguity stays queued for explicit curation. Do not publish or
-install 0.66.2; use 0.66.3. Decisions survive repair/replay;
-`blocked_by_core` cannot override CORE. Doctor only
-diagnoses. See [memory and curation](docs/en/commands/memory.md).
+install 0.66.2; use 0.66.3 or later. Decisions survive repair/replay;
+`blocked_by_core` cannot override CORE. Doctor only diagnoses. When status/doctor reports projected
+acknowledgement pending on 0.66.4 or later, first run the targeted dry run
+`memory recover-attempt <session> --vault <vault>`, then authorize `--apply`; it changes only
+registry/checkpoint. See syntax, preconditions, and fail-closed behavior in
+[memory and curation](docs/en/commands/memory.md).
 
 Session notes use one live `## Agentes, tokens e custos` snapshot. Main-agent and subagent hooks recompose it atomically, with costs, token dimensions, reasoning tokens and effort per model/source. Every hook that rewrites a session note takes a per-file lock and writes through a temp file + rename, so the `SubagentStop` fan-out (one hook run per subagent) can never leave a note half-written; a note whose frontmatter reads back damaged is left untouched rather than patched.
 

package/README.md

@@ -211,10 +211,10 @@ The README is the map; the guides provide syntax, options, exit codes, examples,
 | **Operating profiles** | `profile`, `flow`, always-on Keep Core, and Wend Runtime governance | [Operating profiles](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/operating-profiles.md) |
 | **Changes and verification** | `change`, specs, sensors, TDD, evidence, and archive | [Changes and verification](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/changes-and-verification.md) |
 | **Shared memory** | CORE, SHARED, status, validation, repair, and curation | [Memory](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/memory.md) |
-| **Sessions and import** | hooks, registry, session focus, and Claude/Codex backfill | [Sessions and import](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/sessions-and-import.md) |
+| **Sessions and import** | causal hooks, observability reconciliation, and Claude/Codex backfill | [Sessions and import](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/sessions-and-import.md) |
 | **Notes and knowledge** | BUG/APR/ADR, repairs, renumbering, lessons, and dashboard | [Notes and knowledge](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/notes-and-knowledge.md) |
-| **Costs and observability** | stats, aggregation, trends, and historical rebuild | [Costs and observability](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/costs-and-observability.md) |
-| **Maintenance and diagnostics** | doctor, definition drift, theme, version, and help | [Maintenance and diagnostics](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/maintenance-and-diagnostics.md) |
+| **Costs and observability** | safe dry-run, tri-state, aggregation, trends, and historical rebuild | [Costs and observability](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/costs-and-observability.md) |
+| **Maintenance and diagnostics** | doctor, frontier/manifest freshness, drift, version, and help | [Maintenance and diagnostics](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/maintenance-and-diagnostics.md) |
 
 Operations that deserve step-by-step guidance: [verify and exits 0/1/2](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/verify.md),
 [legacy-memory migration](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/memory-migration.md), and
@@ -287,8 +287,10 @@ lost publication, or mismatched checkpoint blocks. See [migration](docs/en/comma
 and [diagnostics](docs/en/commands/maintenance-and-diagnostics.md).
 
 If status blocks, preserve the evidence and run `wendkeep memory repair --vault <vault>` to back up
-the corrupt ledger, retain valid lines, and re-project. Repair never reclassifies attempts. Valid
-pre-0.59 causal checkpoints and exactly re-derived assert-only historical prefixes are
+the corrupt ledger, retain valid lines, and re-project. Repair remains structural: its only narrow
+acknowledgement exception covers attempts entirely represented by the outbox consumed by that same
+run; it does not scan or reclassify historical attempts. Valid pre-0.59 causal checkpoints and
+exactly re-derived assert-only historical prefixes are
 CAS-migrated on both the attempt and `memory_checkpoint` to the correct physical boundary with
 backup/audit; divergent mirrors fail closed. A demonstrably superseded
 ambiguity uses `memory reconcile <session> --by-session <successor>
@@ -303,9 +305,12 @@ final modern source: the same session/activation/epoch and a higher turn advance
 superseded. Repair migrates the checkpoint and mirror only when it proves the exact previous
 replay, attempt identity, and absence of a real conflict; it creates a backup and audit without
 appending or rewriting events. Ambiguity stays queued for explicit curation. Do not publish or
-install 0.66.2; use 0.66.3. Decisions survive repair/replay;
-`blocked_by_core` cannot override CORE. Doctor only
-diagnoses. See [memory and curation](docs/en/commands/memory.md).
+install 0.66.2; use 0.66.3 or later. Decisions survive repair/replay;
+`blocked_by_core` cannot override CORE. Doctor only diagnoses. When status/doctor reports projected
+acknowledgement pending on 0.66.4 or later, first run the targeted dry run
+`memory recover-attempt <session> --vault <vault>`, then authorize `--apply`; it changes only
+registry/checkpoint. See syntax, preconditions, and fail-closed behavior in
+[memory and curation](docs/en/commands/memory.md).
 
 Session notes use one live `## Agentes, tokens e custos` snapshot. Main-agent and subagent hooks recompose it atomically, with costs, token dimensions, reasoning tokens and effort per model/source. Every hook that rewrites a session note takes a per-file lock and writes through a temp file + rename, so the `SubagentStop` fan-out (one hook run per subagent) can never leave a note half-written; a note whose frontmatter reads back damaged is left untouched rather than patched.
 

package/docs/en/commands/costs-and-observability.md

@@ -26,7 +26,7 @@ A consistent registry, complete price table, and transcript access for rebuilt s
 ```bash
 npx wendkeep stats [--vault <vault>] [--json]
 npx wendkeep cost [--since <date>] [--top [N]] [--trend day|week|month] [--write] [--json]
-npx wendkeep cost rebuild [--session <id|file>] [--limit N] [--apply] [--json]
+npx wendkeep cost rebuild [--session <id|file>] [--limit N] [--max-graph-nodes N] [--max-fallback-days N] [--max-fallback-candidates N] [--apply] [--json]
 ```
 
 ## Options and exit codes
@@ -34,10 +34,18 @@ npx wendkeep cost rebuild [--session <id|file>] [--limit N] [--apply] [--json]
 - `wendkeep stats` emits one shareable line or JSON.
 - `wendkeep cost` aggregates total/model/day; `--trend` adds projection and `--write` refreshes
   `00-Custo.md`.
-- `wendkeep cost rebuild` is dry-run by default; `--apply` writes notes and
-  `.brain/COST_REBUILD.json`.
-- Exit `0` means a consistent calculation; non-zero reports insufficient registry, price,
-  transcript, or parsing state.
+- `wendkeep cost rebuild` is dry-run by default and performs **zero writes**: it acquires no write
+  lock, changes no note, registry, or runtime state, and does not create `.brain/COST_REBUILD.json`.
+- `--apply` publishes only `complete` or `none` candidates. The `none` state clears the section
+  only after a stable offline scan proves that no subagent was started.
+- A `degraded` or `stale` candidate returns exit `1` and preserves the note without changes; the
+  batch continues so other safe sessions can be processed and the report can expose sanitized
+  diagnostic codes.
+- The `--max-graph-nodes`, `--max-fallback-days`, and `--max-fallback-candidates` overrides are
+  exclusively for a targeted rebuild with `--session`. Using them without `--session` is invalid
+  usage and returns exit `2`; hooks, import, and bulk rebuild retain the default limits.
+- Exit `0` means a consistent preview/apply; exit `1` means a partial `degraded`/`stale` result;
+  exit `2` means invalid syntax or context.
 
 ## Examples
 
@@ -45,12 +53,16 @@ npx wendkeep cost rebuild [--session <id|file>] [--limit N] [--apply] [--json]
 npx wendkeep stats --vault .MyApp-vault
 npx wendkeep cost --since 2026-07-01 --top 10 --trend week
 npx wendkeep cost rebuild --session 019abc --json
+npx wendkeep cost rebuild --session 019abc --max-graph-nodes 8192 --json
+npx wendkeep cost rebuild --session 019abc --apply
 ```
 
 ## Expected result
 
-Totals retain input/output/cache/reasoning dimensions by model and period. Rebuild shows a preview
-before changing notes and leaves a reproducible report when applied.
+Totals retain input/output/cache/reasoning dimensions by model and period. Tri-state composition
+returns `complete`, `none`, or `degraded`, plus a frontier, manifest, and sanitized diagnostics.
+Run and review the dry-run before repeating the same command with `--apply`; a semantically
+identical second apply preserves the note, checkpoint, report, and mtime.
 
 ## Common errors and diagnosis
 
@@ -58,6 +70,8 @@ before changing notes and leaves a reproducible report when applied.
 - Wrong-provider costs: validate the session identity chain.
 - Missing transcript: do not estimate silently; keep the gap visible.
 - Duplicated parent/subagent/fork totals: verify registry relationships and deduplication.
+- `degraded`/`stale`: preserve the note and inspect diagnostics/frontier before authorizing apply.
+- Rejected override: add `--session <id|file>` or remove the three targeted limits.
 
 ## Next steps
 

package/docs/en/commands/maintenance-and-diagnostics.md

@@ -39,6 +39,11 @@ npx wendkeep --help
   events remain durable in the outbox/ledger is a recoverable warning.
 - An ambiguous attempt, a lost event ID (absent from ledger and outbox), `projected` state found
   only in the outbox, or a mismatched checkpoint is blocking.
+- For session observability, `legacy`, `degraded`, `stale`, and `manifest-unproven` require
+  reconciliation or more evidence. Only fresh `none` and fresh `complete` are healthy: frontier,
+  checkpoint, root stat, and source manifest must agree.
+- `doctor` remains read-only. It recommends the targeted dry-run first and only advises repeating
+  the command with `--apply` after human review.
 - `sync-defs --check` detects drift without writes; `--reseed` restores packaged `wk-*` skills.
 - `theme sync` reapplies the CSS snippet and graph groups without recreating the vault.
 - `wendkeep --version` prints the running version; `wendkeep --help` lists the public interface.
@@ -52,6 +57,8 @@ npx wendkeep --version
 npx wendkeep sync-defs --check --vault .MyApp-vault --project .
 npx wendkeep doctor --vault .MyApp-vault
 npx wendkeep memory status --gate --vault .MyApp-vault
+npx wendkeep cost rebuild --session <id> --json
+npx wendkeep cost rebuild --session <id> --apply
 ```
 
 ## Expected result
@@ -59,7 +66,9 @@ npx wendkeep memory status --gate --vault .MyApp-vault
 Doctor names sessions, registry, links, notes, prices, derived sections, and memory as healthy or
 provides a specific diagnostic/repair command. For memory, it distinguishes a valid initial empty
 state, recoverable pending replay, and lost/divergent lifecycle state. It never repairs implicitly
-or echoes private projector-error content into its report.
+or echoes private projector-error content into its report. For session observability, it separates
+fresh `none`/`complete` from legacy, degraded, stale, or manifest-unproven state and gives a
+dry-run path before any write.
 
 ## Common errors and diagnosis
 
@@ -70,6 +79,9 @@ or echoes private projector-error content into its report.
 - `ambiguous`, lost publication, or a mismatched checkpoint: blocking; preserve registry, ledger,
   outbox, and SHARED so `last_memory_attempt` can be correlated before repair.
 - Corrupt bundle: preserve evidence and run `memory status --gate` before `memory repair`.
+- `legacy`/`degraded`/`stale`/`manifest-unproven` observability: run
+  `wendkeep cost rebuild --session <id> --json`, review diagnostics, and only then authorize
+  `--apply`.
 
 ## Next steps
 

package/docs/en/commands/memory.md

@@ -25,6 +25,7 @@ Pass the vault explicitly in automation. Preserve backups and evidence before re
 ```bash
 npx wendkeep memory status [--gate] --vault <vault>
 npx wendkeep memory repair --vault <vault>
+npx wendkeep memory recover-attempt <session> [--apply] --vault <vault>
 npx wendkeep memory reconcile <ambiguous-session> --by-session <successor-session> --reason <reason> [--apply] --vault <vault>
 npx wendkeep memory promote <candidate> [--event <event-id>] --vault <vault>
 npx wendkeep memory reject <candidate> --vault <vault>
@@ -51,8 +52,23 @@ npx wendkeep validate-memory --vault <v2-vault>
   historical prefix only when revision, cursor, hash, identity, turns, and the
   `memory_checkpoint` mirror exactly reproduce the old semantics; the target is the current replay
   of that prefix, without absorbing later events. Both paths CAS-check the attempt and mirror and
-  record backup/audit. Repair never reclassifies registry attempts or accepts a tuple, operation,
-  or mirror that cannot be fully re-derived.
+  record backup/audit. The only narrow acknowledgement exception covers `enqueued`/`degraded`
+  attempts whose outbox was frozen and whose event IDs that same repair run consumed in full;
+  partial coverage does not change the attempt. Repair does not scan or reclassify historical
+  attempts and does not accept a tuple, operation, or mirror that cannot be fully re-derived.
+- As of 0.66.4, `memory recover-attempt` targets one session and is a dry run by default. The
+  session must exist in the registry and its latest attempt must be `v2`, `applied`, and `enqueued`
+  or `degraded`, with non-empty, unique `event_ids`. Every event must be present in the ledger and
+  belong to the attempt's project/session/activation/epoch/turn; no later event from that session
+  or target event still in the outbox may exist, and SHARED/candidates must byte-for-byte reproduce
+  the full ledger projection. An already `projected` attempt is accepted only with a valid
+  checkpoint and returns `unchanged`.
+- With `--apply`, `memory recover-attempt` changes only `SESSION_REGISTRY`: it marks
+  `last_memory_attempt`/`memory_status` as `projected` and stores the same checkpoint in the
+  attempt and `memory_checkpoint`. Ledger, CORE, SHARED, candidates, outbox, and notes remain
+  byte-identical. The command validates all authority again under `MEMORY.lock`, CAS-checks the
+  attempt, activation, epoch, turn, and checkpoint, and fails closed if any byte/context changes.
+  A busy lock is not reaped; retry after application returns `unchanged` without writing.
 - `memory reconcile` is a dry run by default. `--apply` requires two named sessions plus a reason,
   CAS-checks the exact attempt, backs up the registry, and limits mutation to the ambiguous attempt
   and its successor. Replay is CORE-aware, checkpoints use the physical ledger cursor, and the
@@ -81,11 +97,16 @@ npx wendkeep validate-memory --vault <v2-vault>
   identity, backup, audit, and CAS; it does not reorder, rewrite, or append a ledger event.
 - `validate-memory <CORE.md>` checks the 25-line cap, required sections, and secrets.
 - `validate-memory --vault` requires a complete v2 bundle and is not the legacy-vault gate.
+- For `recover-attempt`, exit `0` means a valid dry run/apply, including `unchanged`; exit `1`
+  means a precondition, authority, CAS, topology, or lock check failed; exit `2` means a missing
+  session/`--vault`, unknown or duplicate option, extra argument, or invalid value.
 
 ## Examples
 
 ```bash
 npx wendkeep memory status --gate --vault .MyApp-vault
+npx wendkeep memory recover-attempt session-123 --vault .MyApp-vault
+npx wendkeep memory recover-attempt session-123 --apply --vault .MyApp-vault
 npx wendkeep memory reconcile old --by-session current --reason "delivery continued" --vault .MyApp-vault
 npx wendkeep memory reconcile old --by-session current --reason "delivery continued" --apply --vault .MyApp-vault
 npx wendkeep validate-memory .MyApp-vault/.brain/CORE.md
@@ -107,6 +128,14 @@ of a global projection that has already advanced with concurrent events.
   repair merely to manufacture the first event.
 - `degraded` with every event ID present in either the ledger or an intact outbox is recoverable;
   let idempotent replay finish. An event ID absent from both locations means lost publication.
+- Status/doctor reports `projected acknowledgement pending` and suggests
+  `memory recover-attempt <session>`: preserve the artifacts, inspect the dry-run JSON first, and
+  use `--apply` only when `eligible: true`. `dry-run` confirms eligibility; `applied` updates
+  registry/checkpoint; `unchanged` means the recovery was already applied idempotently.
+- `recover-attempt` rejects a missing/divergent event, a target still in the outbox, stale
+  SHARED/candidates, a historical attempt, mismatched session/causal context, invalid checkpoint,
+  or busy lock. Do not bypass the gate by editing files: rerun `memory status --gate`, preserve
+  evidence, and resolve the divergent authority.
 - An `ambiguous` attempt, an `applied` attempt without event IDs, a `projected` event found only in
   the outbox, or a mismatched checkpoint is blocking: preserve the artifacts and investigate
   before repair. If the ambiguity is demonstrably superseded by a successor session, inspect the

package/docs/en/commands/sessions-and-import.md

@@ -46,6 +46,14 @@ npx wendkeep import [options]
 - `Stop` accepts only a transcript-proven turn from the compatible active activation. Duplicates
   are no-ops; stale/superseded Stops neither publish memory nor overwrite a newer epoch's
   checkpoint.
+- `Stop` receives an absolute **45 s** deadline from hook entry. Reads check the clock between
+  rollouts and on every chunk; reaching the limit returns `degraded` before the host timeout.
+- `SubagentStop` receives an absolute **15 s** deadline. Signals arriving within the **250 ms**
+  window are coalesced: only the highest sequence recomposes/publishes, without losing the last
+  child.
+- Observability is tri-state: `complete` publishes the full snapshot; `none` means zero proven by
+  a causal Stop or stable offline scan; `degraded` preserves the previous snapshot and allowlisted
+  diagnostics. An isolated `SubagentStop` never publishes `none`.
 - When compacting conversations into `## Iterações`, the hook escapes code delimiters cut by the
   size limit; inline backticks and fences never remain open and consume the following line.
 - `session list` reads `SESSION_REGISTRY`; `show` displays one session and `use` only changes human
@@ -53,6 +61,9 @@ npx wendkeep import [options]
 - `import --source all|claude|codex`, `--since`, `--limit`, `--from`, and `--codex-from` bound scope.
 - `--dry-run`/`--json` support audit before writes; `--stamp-ids` and `--rescan-decisions` address
   specific historical gaps.
+- `import` reconciles observability even when no `wk-turn` is missing: a legacy schema, stale
+  frontier, or unproven manifest triggers recomposition without duplicating iterations. A fresh
+  checkpoint remains byte-identical; `degraded` is reported and does not change the note.
 - Exit `0` means consistent processing; non-zero reports invalid source/config/write instead of
   presenting silent partial success.
 
@@ -71,6 +82,8 @@ registry keeps one `SessionStart` epoch per activation plus the latest native tu
 `Stop` events may acknowledge turns in that epoch without closing it. Repeated imports of the
 same `session_id` deduplicate; human focus does not close or re-identify live hooks. Every
 automatic iteration remains valid Markdown even when a message must be truncated.
+Duplicate/stale hooks converge on the same frontier, and imports may refresh only observability
+without creating a new turn block.
 
 ## Common errors and diagnosis
 
@@ -82,6 +95,8 @@ automatic iteration remains valid Markdown even when a message must be truncated
 - Fork duplicates: bound source/date and inspect `forked_from_id`/`source.subagent`.
 - Codex does not capture: approve hooks and start a new session after `sync`.
 - Contaminated cost: validate `session_id → session_file → transcript_path → provider`.
+- `degraded` observability: preserve the note and run a targeted rebuild dry-run; never force a
+  partial snapshot over the last `complete` one.
 
 ## Next steps
 

package/docs/pt-BR/commands/costs-and-observability.md

@@ -26,7 +26,7 @@ Registry consistente, tabela de preços completa e acesso aos transcripts das se
 ```bash
 npx wendkeep stats [--vault <cofre>] [--json]
 npx wendkeep cost [--since <data>] [--top [N]] [--trend day|week|month] [--write] [--json]
-npx wendkeep cost rebuild [--session <id|arquivo>] [--limit N] [--apply] [--json]
+npx wendkeep cost rebuild [--session <id|arquivo>] [--limit N] [--max-graph-nodes N] [--max-fallback-days N] [--max-fallback-candidates N] [--apply] [--json]
 ```
 
 ## Opções e códigos de saída
@@ -34,10 +34,18 @@ npx wendkeep cost rebuild [--session <id|arquivo>] [--limit N] [--apply] [--json
 - `wendkeep stats` gera uma linha compartilhável ou JSON.
 - `wendkeep cost` agrega total/modelo/dia; `--trend` inclui projeção e `--write` atualiza
   `00-Custo.md`.
-- `wendkeep cost rebuild` é dry-run por padrão; `--apply` grava notas e
-  `.brain/COST_REBUILD.json`.
-- Exit `0` indica cálculo consistente; não zero indica registry, preço, transcript ou parsing
-  insuficiente.
+- `wendkeep cost rebuild` é dry-run por padrão e tem **zero escrita**: não adquire lock de
+  gravação, não altera nota, registry ou runtime e não cria `.brain/COST_REBUILD.json`.
+- `--apply` publica somente candidatos `complete` ou `none`. O estado `none` só zera a seção
+  quando um scan offline estável comprovou que nenhum subagente foi iniciado.
+- Um candidato `degraded` ou `stale` produz exit `1` e preserva a nota sem alteração; o lote
+  continua para que outras sessões seguras possam ser processadas e o relatório exponha os
+  códigos sanitizados.
+- Os overrides `--max-graph-nodes`, `--max-fallback-days` e `--max-fallback-candidates` são
+  exclusivamente para rebuild direcionado com `--session`. Usá-los sem `--session` é uso inválido
+  e produz exit `2`; hooks, import e rebuild em lote mantêm os limites padrão.
+- Exit `0` significa preview/aplicação consistente; exit `1` indica resultado parcial
+  `degraded`/`stale`; exit `2` indica sintaxe ou contexto inválido.
 
 ## Exemplos
 
@@ -45,12 +53,16 @@ npx wendkeep cost rebuild [--session <id|arquivo>] [--limit N] [--apply] [--json
 npx wendkeep stats --vault .MeuApp-vault
 npx wendkeep cost --since 2026-07-01 --top 10 --trend week
 npx wendkeep cost rebuild --session 019abc --json
+npx wendkeep cost rebuild --session 019abc --max-graph-nodes 8192 --json
+npx wendkeep cost rebuild --session 019abc --apply
 ```
 
 ## Resultado esperado
 
-Totais preservam dimensões de input/output/cache/reasoning por modelo e período. Rebuild mostra a
-prévia antes de alterar notas e deixa um relatório reproduzível quando aplicado.
+Totais preservam dimensões de input/output/cache/reasoning por modelo e período. A composição
+tri-state devolve `complete`, `none` ou `degraded`, mais frontier, manifest e diagnostics
+sanitizados. Rode e revise o dry-run antes de repetir o mesmo comando com `--apply`; uma segunda
+aplicação semanticamente idêntica preserva nota, checkpoint, relatório e mtime.
 
 ## Erros comuns e diagnóstico
 
@@ -58,6 +70,8 @@ prévia antes de alterar notas e deixa um relatório reproduzível quando aplica
 - Custos de provider errado: valide a cadeia de identidade da sessão.
 - Transcript ausente: não estime silenciosamente; mantenha a lacuna visível.
 - Total duplicado por subagent/fork: confirme relação pai/subagent e deduplicação do registry.
+- `degraded`/`stale`: preserve a nota e investigue diagnostics/frontier antes de autorizar apply.
+- Override rejeitado: acrescente `--session <id|arquivo>` ou remova os três limites direcionados.
 
 ## Próximos passos
 

package/docs/pt-BR/commands/maintenance-and-diagnostics.md

@@ -39,6 +39,11 @@ npx wendkeep --help
   continuam duráveis na outbox/ledger é warning recuperável.
 - Attempt ambíguo, event ID perdido (ausente de ledger e outbox), estado `projected` apenas na
   outbox ou checkpoint divergente são falhas bloqueantes.
+- Para observabilidade de sessão, `legacy`, `degraded`, `stale` e `manifest-unproven` exigem
+  reconciliação ou evidência adicional. Somente `none` fresco e `complete` fresco são saudáveis:
+  frontier, checkpoint, root stat e source manifest precisam concordar.
+- O `doctor` permanece somente leitura/read-only. Ele recomenda primeiro o dry-run direcionado;
+  somente depois da revisão humana orienta repetir com `--apply`.
 - `sync-defs --check` detecta drift sem gravar; `--reseed` restaura skills `wk-*` do pacote.
 - `theme sync` reaplica snippet CSS e grupos do grafo sem recriar o cofre.
 - `wendkeep --version` imprime a versão executada; `wendkeep --help` lista a interface pública.
@@ -52,6 +57,8 @@ npx wendkeep --version
 npx wendkeep sync-defs --check --vault .MeuApp-vault --project .
 npx wendkeep doctor --vault .MeuApp-vault
 npx wendkeep memory status --gate --vault .MeuApp-vault
+npx wendkeep cost rebuild --session <id> --json
+npx wendkeep cost rebuild --session <id> --apply
 ```
 
 ## Resultado esperado
@@ -59,7 +66,9 @@ npx wendkeep memory status --gate --vault .MeuApp-vault
 O doctor nomeia sessões, registry, links, notas, preços, derivadas e memória como saudáveis ou
 fornece um comando específico de diagnóstico/reparo. Na memória, ele distingue vazio inicial
 válido, replay pendente recuperável e lifecycle perdido/divergente. Nenhum reparo é aplicado
-implicitamente nem o conteúdo privado do erro do projector é reproduzido no relatório.
+implicitamente nem o conteúdo privado do erro do projector é reproduzido no relatório. Na
+observabilidade de sessão, ele separa `none`/`complete` frescos de estado legado, degradado, stale
+ou sem manifest comprovado e oferece um caminho dry-run antes de qualquer escrita.
 
 ## Erros comuns e diagnóstico
 
@@ -70,6 +79,8 @@ implicitamente nem o conteúdo privado do erro do projector é reproduzido no re
 - `ambiguous`, publicação perdida ou checkpoint divergente: bloqueante; preserve registry, ledger,
   outbox e SHARED para correlacionar `last_memory_attempt` antes de reparar.
 - Bundle corrompido: preserve a evidência e use `memory status --gate` antes de `memory repair`.
+- Observabilidade `legacy`/`degraded`/`stale`/`manifest-unproven`: rode
+  `wendkeep cost rebuild --session <id> --json`, revise diagnostics e só então autorize `--apply`.
 
 ## Próximos passos
 

package/docs/pt-BR/commands/memory.md

@@ -25,6 +25,7 @@ Informe o vault explicitamente em automações. Preserve backups e evidências a
 ```bash
 npx wendkeep memory status [--gate] --vault <cofre>
 npx wendkeep memory repair --vault <cofre>
+npx wendkeep memory recover-attempt <sessão> [--apply] --vault <cofre>
 npx wendkeep memory reconcile <sessão-ambígua> --by-session <sessão-sucessora> --reason <motivo> [--apply] --vault <cofre>
 npx wendkeep memory promote <candidate> [--event <event-id>] --vault <cofre>
 npx wendkeep memory reject <candidate> --vault <cofre>
@@ -51,8 +52,24 @@ npx wendkeep validate-memory --vault <cofre-v2>
   assert-only somente quando revision, cursor, hash, identidade, turns e o espelho
   `memory_checkpoint` reproduzem exatamente a semântica antiga; o alvo é o replay atual daquele
   prefixo, sem absorver eventos posteriores. Ambos os casos fazem CAS do attempt e do espelho e
-  registram backup/auditoria. O repair nunca reclassifica attempts do registry nem aceita tuple,
-  operação ou espelho que não seja rederivado integralmente.
+  registram backup/auditoria. A única exceção estreita de acknowledgement cobre attempts
+  `enqueued`/`degraded` cuja outbox foi congelada e cujos event IDs a mesma execução do repair
+  consumiu integralmente; cobertura parcial não altera o attempt. O repair não varre nem
+  reclassifica attempts históricos e não aceita tuple, operação ou espelho que não seja
+  rederivado integralmente.
+- Desde a 0.66.4, `memory recover-attempt` é dirigido a uma única sessão e faz dry-run por padrão.
+  A sessão deve existir no registry e possuir o último attempt `v2`, `applied`, em `enqueued` ou
+  `degraded`, com `event_ids` não vazios e únicos. Todos os eventos devem estar integralmente no
+  ledger, pertencer ao mesmo projeto/sessão/activation/epoch/turn do attempt, não pode haver evento
+  posterior da mesma sessão nem evento alvo restante na outbox, e SHARED/candidates devem
+  reproduzir byte a byte a projeção integral do ledger. Um attempt já `projected` só é aceito com
+  checkpoint válido e retorna `unchanged`.
+- Com `--apply`, `memory recover-attempt` altera somente `SESSION_REGISTRY`: marca
+  `last_memory_attempt`/`memory_status` como `projected` e grava o checkpoint idêntico no attempt e
+  em `memory_checkpoint`. Ledger, CORE, SHARED, candidates, outbox e notas permanecem byte-intactos.
+  O comando valida novamente toda a autoridade sob `MEMORY.lock`, faz CAS do attempt, activation,
+  epoch, turno e checkpoint e falha fechado se qualquer byte/contexto mudar. Lock ocupado não é
+  colhido; retry após aplicação retorna `unchanged` sem escrita.
 - `memory reconcile` é dry-run por padrão. `--apply` exige duas sessões nomeadas e motivo, faz CAS
   do attempt exato, salva backup do registry e limita a mutação ao attempt ambíguo e à sucessora.
   O replay é CORE-aware, usa cursor físico do ledger no checkpoint e não reescreve ledger, CORE ou
@@ -78,11 +95,16 @@ npx wendkeep validate-memory --vault <cofre-v2>
   CAS; ele não reordena, reescreve nem acrescenta evento ao ledger.
 - `validate-memory <CORE.md>` valida cap de 25 linhas, seções e segredos.
 - `validate-memory --vault` exige bundle v2 completo; não é o gate correto para vault legado.
+- Para `recover-attempt`, exit `0` indica dry-run/apply válido, inclusive `unchanged`; exit `1`
+  indica falha de pré-condição, autoridade, CAS, topologia ou lock; exit `2` indica
+  sessão/`--vault` ausente, opção desconhecida/duplicada, argumento extra ou valor inválido.
 
 ## Exemplos
 
 ```bash
 npx wendkeep memory status --gate --vault .MeuApp-vault
+npx wendkeep memory recover-attempt sessao-123 --vault .MeuApp-vault
+npx wendkeep memory recover-attempt sessao-123 --apply --vault .MeuApp-vault
 npx wendkeep memory reconcile antiga --by-session atual --reason "entrega continuada" --vault .MeuApp-vault
 npx wendkeep memory reconcile antiga --by-session atual --reason "entrega continuada" --apply --vault .MeuApp-vault
 npx wendkeep validate-memory .MeuApp-vault/.brain/CORE.md
@@ -104,6 +126,14 @@ prefixo válido de uma projeção global que já avançou com eventos concorrent
   fabricar o primeiro evento.
 - `degraded` com todos os event IDs presentes no ledger ou na outbox íntegra é recuperável; deixe o
   replay idempotente concluir. Event ID ausente nos dois lugares indica publicação perdida.
+- Status/doctor informa `acknowledgement projetado pendente` e sugere
+  `memory recover-attempt <sessão>`: preserve os artefatos, revise primeiro o JSON do dry-run e só
+  use `--apply` se `eligible: true`. `dry-run` confirma elegibilidade; `applied` atualiza
+  registry/checkpoint; `unchanged` indica que a recuperação já foi aplicada de forma idempotente.
+- `recover-attempt` recusa evento ausente/divergente, outbox alvo ainda presente, SHARED/candidates
+  stale, attempt histórico, sessão/contexto causal divergente, checkpoint inválido ou lock ocupado.
+  Não tente contornar o gate com edição manual: rode novamente `memory status --gate`, preserve a
+  evidência e resolva a autoridade divergente.
 - Attempt `ambiguous`, attempt `applied` sem event IDs, evento `projected` apenas na outbox ou
   checkpoint divergente são bloqueantes: preserve os artefatos e investigue antes de repair. Se a
   ambiguidade for comprovadamente substituída por uma sessão sucessora, revise o dry-run de

package/docs/pt-BR/commands/sessions-and-import.md

@@ -46,6 +46,13 @@ npx wendkeep import [opções]
 - `Stop` aceita somente o turno comprovado pelo transcript e pela activation ativa compatível.
   Duplicatas são no-op; Stops stale/superseded não publicam memória nem sobrescrevem o checkpoint
   de um epoch mais novo.
+- `Stop` recebe deadline absoluto de **45 s** desde a entrada do hook. A leitura verifica o relógio
+  entre rollouts e a cada chunk; ao atingir o limite, devolve `degraded` antes do timeout do host.
+- `SubagentStop` recebe deadline absoluto de **15 s**. Sinais que chegam na janela de **250 ms**
+  são coalescidos: somente a maior sequência recompõe/publica, sem perder o último filho.
+- A observabilidade usa tri-state: `complete` publica o snapshot integral; `none` representa zero
+  comprovado por Stop causal ou scan offline estável; `degraded` preserva o snapshot anterior e
+  diagnostics allowlisted. `SubagentStop` isolado nunca publica `none`.
 - Ao compactar conversas em `## Iterações`, o hook escapa delimitadores de código cortados pelo
   limite de tamanho; backticks inline ou fences nunca ficam abertos para engolir a linha seguinte.
 - `session list` lê `SESSION_REGISTRY`; `show` exibe uma sessão e `use` muda apenas o foco humano
@@ -53,6 +60,9 @@ npx wendkeep import [opções]
 - `import --source all|claude|codex`, `--since`, `--limit`, `--from` e `--codex-from` limitam escopo.
 - `--dry-run`/`--json` permitem auditar antes de gravar; `--stamp-ids` e `--rescan-decisions`
   corrigem históricos específicos.
+- `import` reconcilia a observabilidade mesmo quando nenhum `wk-turn` está ausente: schema legado,
+  frontier stale ou manifest não comprovado disparam recomposição sem duplicar iterações. Um
+  checkpoint fresco permanece byte-idêntico; `degraded` é reportado e não altera a nota.
 - Exit `0` indica processamento consistente; exit não zero indica configuração, fonte ou escrita
   inválida sem transformar isso em sucesso parcial silencioso.
 
@@ -70,7 +80,9 @@ Cada sessão canônica aponta para provider, transcript, arquivo de nota e custo
 O registry mantém um epoch de `SessionStart` por activation e o turno nativo mais recente; vários
 `Stop` podem confirmar turnos do mesmo epoch sem fechá-lo. Importações repetidas do mesmo
 `session_id` são deduplicadas; o foco humano não encerra nem altera a identidade dos hooks. Cada
-iteração automática permanece Markdown válido mesmo quando uma fala precisa ser truncada.
+iteração automática permanece Markdown válido mesmo quando uma fala precisa ser truncada. Hooks
+duplicados/stale convergem no mesmo frontier, e importações podem atualizar só a observabilidade
+sem criar um novo bloco de turno.
 
 ## Erros comuns e diagnóstico
 
@@ -82,6 +94,8 @@ iteração automática permanece Markdown válido mesmo quando uma fala precisa
 - Duplicatas de forks: limite por fonte/data e revise `forked_from_id`/`source.subagent`.
 - Codex não captura: aprove os hooks e reinicie a sessão após `sync`.
 - Custo contaminado: valide `session_id → session_file → transcript_path → provider`.
+- Observabilidade `degraded`: preserve a nota e rode o rebuild direcionado em dry-run; não force
+  um snapshot parcial sobre o último `complete`.
 
 ## Próximos passos