wendkeep 0.66.4 → 0.67.0

package/CHANGELOG.md

@@ -4,6 +4,56 @@ All notable changes to **wendkeep** are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.67.0] — 2026-08-01
+
+### Added
+
+- **O harness da LLM pode selecionar uma rota Wend temporária por solicitação.**
+  `profile route <FLOW|GUIDE|GOVERN|ASSURE> --session <id> --reason <texto>` grava uma lease
+  auditável ligada ao prompt atual, sem alterar o perfil persistente do projeto ou da sessão.
+  `OFF` permanece exclusivamente humano e é rejeitado na seleção adaptativa. Contexto sem prompt
+  causal completo e coincidente no registry falha antes de mutar, e `profile status --session`
+  mostra perfil-base e estado da lease também na saída humana.
+- **A lease expira causalmente sem interromper implementações longas.** Um Stop aceito a consome
+  por CAS; bloqueio/retry a preserva, e o próximo prompt restaura o perfil-base mesmo depois de
+  crash ou hook ausente. Skills e AGENTS gerados ensinam a matriz FLOW/GUIDE/GOVERN/ASSURE.
+
+### Fixed
+
+- **Sessões Obsidian não renderizam envelopes internos do assistente como HTML.** A captura remove
+  metadata completa ou truncada de citação somente das respostas do assistente e escapa tags
+  XML-like nas linhas geradas, preservando relatos do usuário e autolinks HTTP(S). Reimport e
+  `SessionStop` convergem no mesmo normalizador idempotente, e o encerramento migra somente campos
+  gerados reconhecíveis de notas antigas sem reescrever prosa autoral.
+- **README e guias bilíngues explicam as letras `P/R/E/V/C` e a duração das escolhas.** A
+  documentação distingue `profile use` persistente de `profile route` por solicitação e deixa
+  explícito que a classificação semântica pertence ao harness, não a heurísticas do runtime.
+- **Sensores vermelhos deixam diagnóstico acionável sem persistir logs verdes.** O runner captura
+  stdout/stderr com limite, redige segredos e grava no máximo 2.000 caracteres apenas na entrada
+  vermelha de `evidencia.json`, em vez de descartar a causa da falha.
+
+## [0.66.5] — 2026-08-01
+
+### Fixed
+
+- **A observabilidade Codex passa a registrar o grafo completo de subagentes.** Metadata é
+  lida incrementalmente mesmo em rollouts grandes; descendentes em dias posteriores ou níveis
+  aninhados são atribuídos uma única vez, enquanto transcripts top-level permanecem no bucket
+  principal e sinais duplicados ou atrasados não regridem o snapshot publicado.
+- **SessionStop e SubagentStop convergem sob frontier causal e estado explícito.** O schema 2
+  distingue `complete`, `none` e `degraded`, coalesce rajadas com lease, preserva o último
+  snapshot íntegro diante de fonte incompleta e mantém cache/runtime reconstruíveis sem publicar
+  zero silencioso.
+- **Rebuild, import e doctor agora reconciliam a observabilidade persistida.** Preview permanece
+  sem escrita, apply rejeita resultado parcial, import atualiza notas completas porém stale e o
+  doctor correlaciona checkpoint, manifest e dirty para expor degradação real.
+
+### Security
+
+- **Diagnostics e provas públicas aplicam uma fronteira de privacidade estável.** Somente pares
+  allowlisted `{code,count}` podem ser persistidos; paths, identificadores, prompts e exceções
+  brutas ficam fora de fixtures, evidências e notas de release.
+
 ## [0.66.4] — 2026-07-30
 
 ### Fixed

package/README.en.md

@@ -15,6 +15,10 @@
 
 **Persistent memory for AI coding agents, built on your Obsidian vault.** Every Claude Code **and Codex** session is captured turn by turn into local Markdown — `init` wires both (Codex asks you to approve its hooks once; `import` backfills past sessions either way) — with token/cost tracking and automatically extracted decisions, bugs, and learnings. That always-on plane is **Keep Core**. On top of it, **Wend Runtime** provides a native, zero-dependency lifecycle (spec → change → TDD → sensor-gated archive), selected through the `OFF`, `FLOW`, `GUIDE`, `GOVERN`, and `ASSURE` Operating Profiles. 100% local, open-core.
 
+When projecting sessions, trailing internal metadata is removed only from assistant responses;
+user reports remain intact. XML-like tags are written as escaped text so Obsidian Reading view
+does not interpret them as HTML.
+
 The runtime is being separated into six physical boundaries — `cli`, `harness`, `vault`, `mcp`,
 `integrations`, and `pi` — without fragmenting installation. The private `cli`, `harness`,
 `vault`, `mcp`, and `integrations` workspaces now canonically own the executable runtime,
@@ -211,10 +215,10 @@ The README is the map; the guides provide syntax, options, exit codes, examples,
 | **Operating profiles** | `profile`, `flow`, always-on Keep Core, and Wend Runtime governance | [Operating profiles](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/operating-profiles.md) |
 | **Changes and verification** | `change`, specs, sensors, TDD, evidence, and archive | [Changes and verification](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/changes-and-verification.md) |
 | **Shared memory** | CORE, SHARED, status, validation, repair, and curation | [Memory](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/memory.md) |
-| **Sessions and import** | hooks, registry, session focus, and Claude/Codex backfill | [Sessions and import](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/sessions-and-import.md) |
+| **Sessions and import** | causal hooks, observability reconciliation, and Claude/Codex backfill | [Sessions and import](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/sessions-and-import.md) |
 | **Notes and knowledge** | BUG/APR/ADR, repairs, renumbering, lessons, and dashboard | [Notes and knowledge](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/notes-and-knowledge.md) |
-| **Costs and observability** | stats, aggregation, trends, and historical rebuild | [Costs and observability](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/costs-and-observability.md) |
-| **Maintenance and diagnostics** | doctor, definition drift, theme, version, and help | [Maintenance and diagnostics](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/maintenance-and-diagnostics.md) |
+| **Costs and observability** | safe dry-run, tri-state, aggregation, trends, and historical rebuild | [Costs and observability](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/costs-and-observability.md) |
+| **Maintenance and diagnostics** | doctor, frontier/manifest freshness, drift, version, and help | [Maintenance and diagnostics](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/maintenance-and-diagnostics.md) |
 
 Operations that deserve step-by-step guidance: [verify and exits 0/1/2](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/verify.md),
 [legacy-memory migration](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/memory-migration.md), and
@@ -235,13 +239,82 @@ deliberate opt-in and runs that command's own validations:
 | `GOVERN` | P → R → E → V | Current a2 loop and compatible fallback. |
 | `ASSURE` | P → R → E → V → C | Governance with confirmation and handoff. |
 
+A route is a sequence of work stages, not a list of command names:
+
+- `P` = **Plan/Propose** — understand the request, bound the scope, and record the approach when a change is needed.
+- `R` = **Review** — inspect the proposal/design before execution; this is the formal a2-loop review.
+- `E` = **Execute** — edit the permitted code or artifacts.
+- `V` = **Validate** — run tests, sensors, and checks and record evidence.
+- `C` = **Confirm/hand off** — obtain explicit confirmation and complete the handoff.
+
+Thus, `P → R → E → V` means “plan/propose, review, execute, and validate”. `FLOW` starts at the
+execution/validation microcontract; `OFF` applies no automatic Wend route and returns process
+ownership to the native LLM harness.
+
+### Who selects the profile, and for how long?
+
+The LLM harness (Codex, Claude, or another agent) **classifies the current implementation** and can
+record a temporary choice with `wendkeep profile route`. Wend Runtime does not interpret prompt
+text or use diff size, heuristics, or environment variables: it validates the choice, applies the
+route in hooks, and expires the lease when the request ends. With no recorded route, the configured
+base profile remains effective.
+
+Resolution follows this order:
+
+1. a valid lease for the current request in `SESSION_REGISTRY.json`;
+2. a persistent session override in that registry;
+3. `harness.profile` in the project's `.wendkeep.json`;
+4. `GOVERN` when no valid setting exists.
+
+Without `--session`, `profile use` changes the **project default** for conversations/hooks that do
+not have a session override. With `--session <id>`, it changes only that session and leaves the
+project default untouched. Therefore, `profile use OFF` without `--session` is not an isolated
+test: it writes the project binding and can be shared if `.wendkeep.json` is committed.
+
+`profile route` is different: it requires `--session` and `--reason`, accepts only `FLOW`, `GUIDE`,
+`GOVERN`, or `ASSURE`, does not rewrite the project/persistent override, and applies only to the
+current causal prompt. An accepted `Stop` consumes the lease; if the process dies first, the next
+prompt advances the sequence and makes the old lease ineffective. `OFF` is never selected
+automatically.
+
+```bash
+npx wendkeep profile status
+npx wendkeep profile use GUIDE                 # project default
+npx wendkeep profile use FLOW --session <id>   # one session only
+npx wendkeep profile route FLOW --session <id> --reason "local fix"  # current request
+npx wendkeep profile status --session <id>     # session-effective profile
+```
+
+In human `status --session` output, `base=<profile>/<source>` and `lease=<state>` accompany the
+effective profile; `--json` exposes the same data as `base_profile`, `base_source`, and
+`task_lease`. `profile route` only accepts a session after `UserPromptSubmit` has recorded a
+positive causal turn and sequence that agree in the registry.
+
+### Which profile fits a simple request?
+
+“Small” describes size, not risk. The harness uses this matrix to choose and record a temporary
+route; semantic inference remains in the agent, not Wend Runtime:
+
+| Situation | Suggested profile |
+|---|---|
+| Question, inspection, or diagnosis with no mutation | No profile transition |
+| Local, reversible fix with an allowlist and no contract/spec change | `FLOW` (`E → V`) |
+| Small behavior change that needs a change but not formal Wend Runtime review | `GUIDE` (`P → E → V`) |
+| Normal, ambiguous, public-contract, security, dependency, CI/release, or policy change | `GOVERN` (`P → R → E → V`) |
+| Work requiring explicit confirmation and handoff | `ASSURE` (`P → R → E → V → C`) |
+
+If the harness does not record a lease, a small fix remains under the configured profile —
+`GOVERN` by default. `OFF` does not mean “simple task”: it is a persistent human choice that hands
+governance to the native harness. The LLM may temporarily elevate an `OFF` base to a Wend route,
+but it can never select `OFF` on its own.
+
 A corrupt binding never selects `OFF`: with one unambiguous explicit or legacy Vault, Keep Core
 remains active under `GOVERN`, the error stays visible, and mutation guards fail closed. Additional
 roots that FLOW must protect can be declared as project-relative paths under
 `harness.flow.protectedRoots` in `.wendkeep.json`; any change below them requires promotion.
 Invalid local config, marker, or identity never silently falls back to a parent/global Vault.
 
-`wendkeep profile status/use` makes the choice observable; `wendkeep flow
+`wendkeep profile status/use/route` makes the choice observable; `wendkeep flow
 start/finish/promote` handles local adjustments without manufacturing an ADR and fails closed on
 physical escapes, Git metadata/hidden flags, mutating sensors, protected surfaces, or incomplete
 session projection. Bounded no-follow discovery sees empty/ignored protected aliases; Vault writes
@@ -379,7 +452,7 @@ explore → propose → apply (TDD) → verify → archive
 
 - **Propose** — `wendkeep change new <slug>` scaffolds `08-Mudanças/<slug>/` (`proposta.md`, `design.md`, `tarefas.md`; `--simple` skips the design). It becomes the global *current* change. When the change declares `spec_impact: required`, you author the delta yourself at `specs/<capability>/spec.md` — there is no placeholder to delete. Multiple changes may remain open: `change list`/`status` and the hooks show every pending one, while commands without `--change` act on the current one alone. `change use <slug>` changes focus and `change continue <archived> <new>` creates an auditable continuation.
 - **Apply** — implement each `tarefas.md` task. Mark machine proof with one or more `[sensor:<id>]` tags on the same task: every distinct ID enters the gate once, in declaration order. Also mark satisfied requirements with one or more `[req:<ID>]` tags.
-- **Verify** — `wendkeep verify` runs the sensors your tasks declared (from `wendkeep.sensors.json` at the project root) and writes `evidencia.json`. A red `critical` fails the gate; a red `warning` is advisory. `verify --deep` builds a self-contained package with complete effective requirements (living contract + this change's delta), so the independent verifier never needs to reconstruct unarchived requirements from `07-Specs`. Every change needs a `verdict.json` to archive; `verify --deep` writes a trivial one automatically when the change declares no `[req:]`.
+- **Verify** — `wendkeep verify` runs the sensors your tasks declared (from `wendkeep.sensors.json` at the project root) and writes `evidencia.json`. A red `critical` fails the gate; a red `warning` is advisory. Failures retain only a bounded, sanitized diagnostic; green output is not persisted. `verify --deep` builds a self-contained package with complete effective requirements (living contract + this change's delta), so the independent verifier never needs to reconstruct unarchived requirements from `07-Specs`. Every change needs a `verdict.json` to archive; `verify --deep` writes a trivial one automatically when the change declares no `[req:]`.
 - **Archive** — `wendkeep change archive <slug>` **gates** on the evidence (blocks unless every declared critical sensor is green), promotes each capability's spec delta (`ADDED`/`MODIFIED`/`REMOVED`) into the living `07-Specs/<capability>.md`, moves the change to `_arquivo/`, and mints an ADR in `04-Decisões/`.
 
 > The gate blocks unless the scaffold is filled, no task is open, evidence is fresh, and every declared requirement is covered. **`--force` waives exactly one of those — the open-task check — and is the human's call, never the agent's.** An unfilled scaffold, a red critical sensor, stale evidence, an orphan requirement or a missing verdict block regardless.

package/README.md

@@ -15,6 +15,10 @@
 
 **Persistent memory for AI coding agents, built on your Obsidian vault.** Every Claude Code **and Codex** session is captured turn by turn into local Markdown — `init` wires both (Codex asks you to approve its hooks once; `import` backfills past sessions either way) — with token/cost tracking and automatically extracted decisions, bugs, and learnings. That always-on plane is **Keep Core**. On top of it, **Wend Runtime** provides a native, zero-dependency lifecycle (spec → change → TDD → sensor-gated archive), selected through the `OFF`, `FLOW`, `GUIDE`, `GOVERN`, and `ASSURE` Operating Profiles. 100% local, open-core.
 
+When projecting sessions, trailing internal metadata is removed only from assistant responses;
+user reports remain intact. XML-like tags are written as escaped text so Obsidian Reading view
+does not interpret them as HTML.
+
 The runtime is being separated into six physical boundaries — `cli`, `harness`, `vault`, `mcp`,
 `integrations`, and `pi` — without fragmenting installation. The private `cli`, `harness`,
 `vault`, `mcp`, and `integrations` workspaces now canonically own the executable runtime,
@@ -211,10 +215,10 @@ The README is the map; the guides provide syntax, options, exit codes, examples,
 | **Operating profiles** | `profile`, `flow`, always-on Keep Core, and Wend Runtime governance | [Operating profiles](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/operating-profiles.md) |
 | **Changes and verification** | `change`, specs, sensors, TDD, evidence, and archive | [Changes and verification](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/changes-and-verification.md) |
 | **Shared memory** | CORE, SHARED, status, validation, repair, and curation | [Memory](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/memory.md) |
-| **Sessions and import** | hooks, registry, session focus, and Claude/Codex backfill | [Sessions and import](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/sessions-and-import.md) |
+| **Sessions and import** | causal hooks, observability reconciliation, and Claude/Codex backfill | [Sessions and import](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/sessions-and-import.md) |
 | **Notes and knowledge** | BUG/APR/ADR, repairs, renumbering, lessons, and dashboard | [Notes and knowledge](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/notes-and-knowledge.md) |
-| **Costs and observability** | stats, aggregation, trends, and historical rebuild | [Costs and observability](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/costs-and-observability.md) |
-| **Maintenance and diagnostics** | doctor, definition drift, theme, version, and help | [Maintenance and diagnostics](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/maintenance-and-diagnostics.md) |
+| **Costs and observability** | safe dry-run, tri-state, aggregation, trends, and historical rebuild | [Costs and observability](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/costs-and-observability.md) |
+| **Maintenance and diagnostics** | doctor, frontier/manifest freshness, drift, version, and help | [Maintenance and diagnostics](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/maintenance-and-diagnostics.md) |
 
 Operations that deserve step-by-step guidance: [verify and exits 0/1/2](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/verify.md),
 [legacy-memory migration](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/memory-migration.md), and
@@ -235,13 +239,82 @@ deliberate opt-in and runs that command's own validations:
 | `GOVERN` | P → R → E → V | Current a2 loop and compatible fallback. |
 | `ASSURE` | P → R → E → V → C | Governance with confirmation and handoff. |
 
+A route is a sequence of work stages, not a list of command names:
+
+- `P` = **Plan/Propose** — understand the request, bound the scope, and record the approach when a change is needed.
+- `R` = **Review** — inspect the proposal/design before execution; this is the formal a2-loop review.
+- `E` = **Execute** — edit the permitted code or artifacts.
+- `V` = **Validate** — run tests, sensors, and checks and record evidence.
+- `C` = **Confirm/hand off** — obtain explicit confirmation and complete the handoff.
+
+Thus, `P → R → E → V` means “plan/propose, review, execute, and validate”. `FLOW` starts at the
+execution/validation microcontract; `OFF` applies no automatic Wend route and returns process
+ownership to the native LLM harness.
+
+### Who selects the profile, and for how long?
+
+The LLM harness (Codex, Claude, or another agent) **classifies the current implementation** and can
+record a temporary choice with `wendkeep profile route`. Wend Runtime does not interpret prompt
+text or use diff size, heuristics, or environment variables: it validates the choice, applies the
+route in hooks, and expires the lease when the request ends. With no recorded route, the configured
+base profile remains effective.
+
+Resolution follows this order:
+
+1. a valid lease for the current request in `SESSION_REGISTRY.json`;
+2. a persistent session override in that registry;
+3. `harness.profile` in the project's `.wendkeep.json`;
+4. `GOVERN` when no valid setting exists.
+
+Without `--session`, `profile use` changes the **project default** for conversations/hooks that do
+not have a session override. With `--session <id>`, it changes only that session and leaves the
+project default untouched. Therefore, `profile use OFF` without `--session` is not an isolated
+test: it writes the project binding and can be shared if `.wendkeep.json` is committed.
+
+`profile route` is different: it requires `--session` and `--reason`, accepts only `FLOW`, `GUIDE`,
+`GOVERN`, or `ASSURE`, does not rewrite the project/persistent override, and applies only to the
+current causal prompt. An accepted `Stop` consumes the lease; if the process dies first, the next
+prompt advances the sequence and makes the old lease ineffective. `OFF` is never selected
+automatically.
+
+```bash
+npx wendkeep profile status
+npx wendkeep profile use GUIDE                 # project default
+npx wendkeep profile use FLOW --session <id>   # one session only
+npx wendkeep profile route FLOW --session <id> --reason "local fix"  # current request
+npx wendkeep profile status --session <id>     # session-effective profile
+```
+
+In human `status --session` output, `base=<profile>/<source>` and `lease=<state>` accompany the
+effective profile; `--json` exposes the same data as `base_profile`, `base_source`, and
+`task_lease`. `profile route` only accepts a session after `UserPromptSubmit` has recorded a
+positive causal turn and sequence that agree in the registry.
+
+### Which profile fits a simple request?
+
+“Small” describes size, not risk. The harness uses this matrix to choose and record a temporary
+route; semantic inference remains in the agent, not Wend Runtime:
+
+| Situation | Suggested profile |
+|---|---|
+| Question, inspection, or diagnosis with no mutation | No profile transition |
+| Local, reversible fix with an allowlist and no contract/spec change | `FLOW` (`E → V`) |
+| Small behavior change that needs a change but not formal Wend Runtime review | `GUIDE` (`P → E → V`) |
+| Normal, ambiguous, public-contract, security, dependency, CI/release, or policy change | `GOVERN` (`P → R → E → V`) |
+| Work requiring explicit confirmation and handoff | `ASSURE` (`P → R → E → V → C`) |
+
+If the harness does not record a lease, a small fix remains under the configured profile —
+`GOVERN` by default. `OFF` does not mean “simple task”: it is a persistent human choice that hands
+governance to the native harness. The LLM may temporarily elevate an `OFF` base to a Wend route,
+but it can never select `OFF` on its own.
+
 A corrupt binding never selects `OFF`: with one unambiguous explicit or legacy Vault, Keep Core
 remains active under `GOVERN`, the error stays visible, and mutation guards fail closed. Additional
 roots that FLOW must protect can be declared as project-relative paths under
 `harness.flow.protectedRoots` in `.wendkeep.json`; any change below them requires promotion.
 Invalid local config, marker, or identity never silently falls back to a parent/global Vault.
 
-`wendkeep profile status/use` makes the choice observable; `wendkeep flow
+`wendkeep profile status/use/route` makes the choice observable; `wendkeep flow
 start/finish/promote` handles local adjustments without manufacturing an ADR and fails closed on
 physical escapes, Git metadata/hidden flags, mutating sensors, protected surfaces, or incomplete
 session projection. Bounded no-follow discovery sees empty/ignored protected aliases; Vault writes
@@ -379,7 +452,7 @@ explore → propose → apply (TDD) → verify → archive
 
 - **Propose** — `wendkeep change new <slug>` scaffolds `08-Mudanças/<slug>/` (`proposta.md`, `design.md`, `tarefas.md`; `--simple` skips the design). It becomes the global *current* change. When the change declares `spec_impact: required`, you author the delta yourself at `specs/<capability>/spec.md` — there is no placeholder to delete. Multiple changes may remain open: `change list`/`status` and the hooks show every pending one, while commands without `--change` act on the current one alone. `change use <slug>` changes focus and `change continue <archived> <new>` creates an auditable continuation.
 - **Apply** — implement each `tarefas.md` task. Mark machine proof with one or more `[sensor:<id>]` tags on the same task: every distinct ID enters the gate once, in declaration order. Also mark satisfied requirements with one or more `[req:<ID>]` tags.
-- **Verify** — `wendkeep verify` runs the sensors your tasks declared (from `wendkeep.sensors.json` at the project root) and writes `evidencia.json`. A red `critical` fails the gate; a red `warning` is advisory. `verify --deep` builds a self-contained package with complete effective requirements (living contract + this change's delta), so the independent verifier never needs to reconstruct unarchived requirements from `07-Specs`. Every change needs a `verdict.json` to archive; `verify --deep` writes a trivial one automatically when the change declares no `[req:]`.
+- **Verify** — `wendkeep verify` runs the sensors your tasks declared (from `wendkeep.sensors.json` at the project root) and writes `evidencia.json`. A red `critical` fails the gate; a red `warning` is advisory. Failures retain only a bounded, sanitized diagnostic; green output is not persisted. `verify --deep` builds a self-contained package with complete effective requirements (living contract + this change's delta), so the independent verifier never needs to reconstruct unarchived requirements from `07-Specs`. Every change needs a `verdict.json` to archive; `verify --deep` writes a trivial one automatically when the change declares no `[req:]`.
 - **Archive** — `wendkeep change archive <slug>` **gates** on the evidence (blocks unless every declared critical sensor is green), promotes each capability's spec delta (`ADDED`/`MODIFIED`/`REMOVED`) into the living `07-Specs/<capability>.md`, moves the change to `_arquivo/`, and mints an ADR in `04-Decisões/`.
 
 > The gate blocks unless the scaffold is filled, no task is open, evidence is fresh, and every declared requirement is covered. **`--force` waives exactly one of those — the open-task check — and is the human's call, never the agent's.** An unfilled scaffold, a red critical sensor, stale evidence, an orphan requirement or a missing verdict block regardless.

package/docs/en/commands/costs-and-observability.md

@@ -26,7 +26,7 @@ A consistent registry, complete price table, and transcript access for rebuilt s
 ```bash
 npx wendkeep stats [--vault <vault>] [--json]
 npx wendkeep cost [--since <date>] [--top [N]] [--trend day|week|month] [--write] [--json]
-npx wendkeep cost rebuild [--session <id|file>] [--limit N] [--apply] [--json]
+npx wendkeep cost rebuild [--session <id|file>] [--limit N] [--max-graph-nodes N] [--max-fallback-days N] [--max-fallback-candidates N] [--apply] [--json]
 ```
 
 ## Options and exit codes
@@ -34,10 +34,18 @@ npx wendkeep cost rebuild [--session <id|file>] [--limit N] [--apply] [--json]
 - `wendkeep stats` emits one shareable line or JSON.
 - `wendkeep cost` aggregates total/model/day; `--trend` adds projection and `--write` refreshes
   `00-Custo.md`.
-- `wendkeep cost rebuild` is dry-run by default; `--apply` writes notes and
-  `.brain/COST_REBUILD.json`.
-- Exit `0` means a consistent calculation; non-zero reports insufficient registry, price,
-  transcript, or parsing state.
+- `wendkeep cost rebuild` is dry-run by default and performs **zero writes**: it acquires no write
+  lock, changes no note, registry, or runtime state, and does not create `.brain/COST_REBUILD.json`.
+- `--apply` publishes only `complete` or `none` candidates. The `none` state clears the section
+  only after a stable offline scan proves that no subagent was started.
+- A `degraded` or `stale` candidate returns exit `1` and preserves the note without changes; the
+  batch continues so other safe sessions can be processed and the report can expose sanitized
+  diagnostic codes.
+- The `--max-graph-nodes`, `--max-fallback-days`, and `--max-fallback-candidates` overrides are
+  exclusively for a targeted rebuild with `--session`. Using them without `--session` is invalid
+  usage and returns exit `2`; hooks, import, and bulk rebuild retain the default limits.
+- Exit `0` means a consistent preview/apply; exit `1` means a partial `degraded`/`stale` result;
+  exit `2` means invalid syntax or context.
 
 ## Examples
 
@@ -45,12 +53,16 @@ npx wendkeep cost rebuild [--session <id|file>] [--limit N] [--apply] [--json]
 npx wendkeep stats --vault .MyApp-vault
 npx wendkeep cost --since 2026-07-01 --top 10 --trend week
 npx wendkeep cost rebuild --session 019abc --json
+npx wendkeep cost rebuild --session 019abc --max-graph-nodes 8192 --json
+npx wendkeep cost rebuild --session 019abc --apply
 ```
 
 ## Expected result
 
-Totals retain input/output/cache/reasoning dimensions by model and period. Rebuild shows a preview
-before changing notes and leaves a reproducible report when applied.
+Totals retain input/output/cache/reasoning dimensions by model and period. Tri-state composition
+returns `complete`, `none`, or `degraded`, plus a frontier, manifest, and sanitized diagnostics.
+Run and review the dry-run before repeating the same command with `--apply`; a semantically
+identical second apply preserves the note, checkpoint, report, and mtime.
 
 ## Common errors and diagnosis
 
@@ -58,6 +70,8 @@ before changing notes and leaves a reproducible report when applied.
 - Wrong-provider costs: validate the session identity chain.
 - Missing transcript: do not estimate silently; keep the gap visible.
 - Duplicated parent/subagent/fork totals: verify registry relationships and deduplication.
+- `degraded`/`stale`: preserve the note and inspect diagnostics/frontier before authorizing apply.
+- Rejected override: add `--session <id|file>` or remove the three targeted limits.
 
 ## Next steps
 

package/docs/en/commands/maintenance-and-diagnostics.md

@@ -39,6 +39,11 @@ npx wendkeep --help
   events remain durable in the outbox/ledger is a recoverable warning.
 - An ambiguous attempt, a lost event ID (absent from ledger and outbox), `projected` state found
   only in the outbox, or a mismatched checkpoint is blocking.
+- For session observability, `legacy`, `degraded`, `stale`, and `manifest-unproven` require
+  reconciliation or more evidence. Only fresh `none` and fresh `complete` are healthy: frontier,
+  checkpoint, root stat, and source manifest must agree.
+- `doctor` remains read-only. It recommends the targeted dry-run first and only advises repeating
+  the command with `--apply` after human review.
 - `sync-defs --check` detects drift without writes; `--reseed` restores packaged `wk-*` skills.
 - `theme sync` reapplies the CSS snippet and graph groups without recreating the vault.
 - `wendkeep --version` prints the running version; `wendkeep --help` lists the public interface.
@@ -52,6 +57,8 @@ npx wendkeep --version
 npx wendkeep sync-defs --check --vault .MyApp-vault --project .
 npx wendkeep doctor --vault .MyApp-vault
 npx wendkeep memory status --gate --vault .MyApp-vault
+npx wendkeep cost rebuild --session <id> --json
+npx wendkeep cost rebuild --session <id> --apply
 ```
 
 ## Expected result
@@ -59,7 +66,9 @@ npx wendkeep memory status --gate --vault .MyApp-vault
 Doctor names sessions, registry, links, notes, prices, derived sections, and memory as healthy or
 provides a specific diagnostic/repair command. For memory, it distinguishes a valid initial empty
 state, recoverable pending replay, and lost/divergent lifecycle state. It never repairs implicitly
-or echoes private projector-error content into its report.
+or echoes private projector-error content into its report. For session observability, it separates
+fresh `none`/`complete` from legacy, degraded, stale, or manifest-unproven state and gives a
+dry-run path before any write.
 
 ## Common errors and diagnosis
 
@@ -70,6 +79,9 @@ or echoes private projector-error content into its report.
 - `ambiguous`, lost publication, or a mismatched checkpoint: blocking; preserve registry, ledger,
   outbox, and SHARED so `last_memory_attempt` can be correlated before repair.
 - Corrupt bundle: preserve evidence and run `memory status --gate` before `memory repair`.
+- `legacy`/`degraded`/`stale`/`manifest-unproven` observability: run
+  `wendkeep cost rebuild --session <id> --json`, review diagnostics, and only then authorize
+  `--apply`.
 
 ## Next steps
 

package/docs/en/commands/operating-profiles.md

@@ -14,9 +14,9 @@ opt-in and runs that command's own validations and gates.
 
 ## When to use
 
-Use `profile` to inspect or explicitly select an Operating Profile. Use `FLOW` for local,
-reversible `spec_impact:none` maintenance that fits an Execute → Validate microcontract without a
-change.
+Use `profile use` for a persistent human selection and `profile route` for the harness to record
+the temporary route for the current implementation. Use `FLOW` for local, reversible
+`spec_impact:none` maintenance that fits an Execute → Validate microcontract without a change.
 
 ## When not to use
 
@@ -28,7 +28,8 @@ change.
 ## Prerequisites
 
 - An initialized project whose `.wendkeep.json` is bound to the correct Vault.
-- For a session override, one unambiguous session in `SESSION_REGISTRY.json`.
+- For an override or temporary route, one unambiguous session in `SESSION_REGISTRY.json`; `route`
+  also requires the current prompt to have a recorded causal frontier.
 - For FLOW, a Git repository, a path allowlist, a reason, and at least one existing sensor in
   `wendkeep.sensors.json`.
 
@@ -37,6 +38,7 @@ change.
 ```bash
 npx wendkeep profile status [--project <path>] [--vault <path>] [--session <id>] [--json]
 npx wendkeep profile use <profile> [--project <path>] [--vault <path>] [--session <id>] [--json]
+npx wendkeep profile route <FLOW|GUIDE|GOVERN|ASSURE> --session <id> --reason <text> [--project <path>] [--vault <path>] [--json]
 npx wendkeep flow start <slug> --allow <path> [--allow <path>...] --sensor <id> [--sensor <id>...] --reason <text> [--session <id>]
 npx wendkeep flow status [<id>]
 npx wendkeep flow show <id> [--session <id>]
@@ -75,15 +77,42 @@ Harness. The workspaces remain private and are not published as independent npm
 | `GOVERN` | P → R → E → V | Current a2 loop and conservative fallback. |
 | `ASSURE` | P → R → E → V → C | Governance plus confirmation and handoff. |
 
-- Resolution is explicit session override → project `harness.profile` → `GOVERN`. Heuristics,
-  diff size, prompt text, environment variables, or read failures never select `OFF`.
-- `profile status` prints the effective profile and source; `--json` emits structured output. When
-  an explicit Vault preserves the selection despite a corrupt binding, output includes
+### Route legend
+
+The letters are work stages, not individual commands:
+
+- `P` = **Plan/Propose** — understand the request, bound the scope, and record the approach.
+- `R` = **Review** — inspect the proposal/design before execution; this is the formal a2-loop review.
+- `E` = **Execute** — edit the permitted paths and artifacts.
+- `V` = **Validate** — run tests, sensors, and checks and record evidence.
+- `C` = **Confirm/hand off** — obtain explicit confirmation and complete the handoff.
+
+So, `P → R → E → V` means “plan/propose, review, execute, and validate”. `FLOW` starts at the
+execution/validation microcontract; `OFF` imposes no automatic Wend route and returns process
+ownership to the native LLM harness.
+
+- The LLM harness semantically classifies the request and records `profile route`; Wend Runtime
+  does not classify text, diff size, heuristics, or environment variables. It validates and applies
+  the deterministic lease.
+- For a local, reversible fix with no contract/spec change, choose `FLOW`. For a compact behavior
+  change that needs a change but no formal review, choose `GUIDE`. For uncertainty, risk, security,
+  public contracts, dependencies, CI/release, or policy, choose `GOVERN`. Use `ASSURE` when
+  confirmation and handoff are part of the contract.
+- `OFF` can never be an adaptive route; only a human persists it explicitly through
+  `profile use OFF`. An `OFF` base may still receive a temporary elevation to a Wend route.
+
+- Resolution is active prompt lease → persistent session override → project
+  `harness.profile` → `GOVERN`. Invalid/expired leases and read failures never select `OFF`.
+- `profile status` prints the effective profile and source. With `--session`, human output adds
+  `base=<profile>/<source>` and `lease=<state>`; `--json` emits the same data structurally. When an
+  explicit Vault preserves the selection despite a corrupt binding, output includes
   `binding_error` and the diagnostic is also written to stderr.
 - `profile use` validates names and flags strictly; a duplicate/incomplete singleton option or a
   value beginning with `--` fails before I/O. Without `--session`, it atomically changes the
   project binding; with `--session`, it records override, source, and timestamp without changing
   session identity.
+- `profile route` requires `--session` and `--reason`, accepts only the four adaptive profiles,
+  and records lease id, reason, turn/sequence, and timestamp without touching persistent profiles.
 - `.wendkeep.json` stays on `schemaVersion: 1`; the additive field is, for example,
   `"harness": { "profile": "GOVERN" }`. A legacy binding without it also resolves to `GOVERN`.
 - A corrupt binding never means `OFF`. When the payload or legacy integration identifies one
@@ -127,13 +156,39 @@ Harness. The workspaces remain private and are not published as independent npm
 - Exit `0` means a successful query or transition; exit `1` means a policy/red-sensor block; exit
   `2` means invalid profile, session, flow, or arguments, with no partial mutation.
 
+### Selection scope
+
+Without `--session`, `profile use` writes `harness.profile` to `.wendkeep.json` and changes the
+project default for conversations/hooks that have no session override. With `--session <id>`, it
+writes an override only to that session's `SESSION_REGISTRY.json` and leaves the project default
+unchanged. Therefore, `profile use OFF` without `--session` is not an isolated test; if
+`.wendkeep.json` is committed, that choice is shared with other checkouts as well.
+
+`profile route` creates a lease only for the current request. An accepted `Stop` consumes it by
+CAS; if cleanup does not run, the next `UserPromptSubmit` advances the sequence and the lease is no
+longer effective. A blocked Stop preserves it for a retry of the same request. There is no
+wall-clock TTL that can interrupt long work. A session with no causal prompt recorded yet (missing
+turn, zero sequence, or missing/mismatched causal map entry) is rejected before any mutation.
+`status --session` includes the base profile and lease state in both human and `--json` output; in
+JSON the fields are `base_profile`, `base_source`, and `task_lease.state` (`active`, `consumed`,
+`expired`, `invalid`, or `absent`).
+
+```bash
+npx wendkeep profile status                       # project default
+npx wendkeep profile use GUIDE                   # change the project default
+npx wendkeep profile use FLOW --session <id>     # one session only
+npx wendkeep profile route FLOW --session <id> --reason "local adjustment"  # current request
+npx wendkeep profile status --session <id>       # session-effective profile
+```
+
 ## Examples
 
-Inspect the effective default and apply an override only to the current session:
+Inspect the effective default and route only the current implementation:
 
 ```bash
 npx wendkeep profile status
-npx wendkeep profile use OFF --session 019abc-session-id --json
+npx wendkeep profile route FLOW --session 019abc-session-id --reason "fix local typo" --json
+npx wendkeep profile status --session 019abc-session-id --json
 ```
 
 Run FLOW maintenance while capturing the `flow_id` returned by `start`:

package/docs/en/commands/sessions-and-import.md

@@ -46,6 +46,14 @@ npx wendkeep import [options]
 - `Stop` accepts only a transcript-proven turn from the compatible active activation. Duplicates
   are no-ops; stale/superseded Stops neither publish memory nor overwrite a newer epoch's
   checkpoint.
+- `Stop` receives an absolute **45 s** deadline from hook entry. Reads check the clock between
+  rollouts and on every chunk; reaching the limit returns `degraded` before the host timeout.
+- `SubagentStop` receives an absolute **15 s** deadline. Signals arriving within the **250 ms**
+  window are coalesced: only the highest sequence recomposes/publishes, without losing the last
+  child.
+- Observability is tri-state: `complete` publishes the full snapshot; `none` means zero proven by
+  a causal Stop or stable offline scan; `degraded` preserves the previous snapshot and allowlisted
+  diagnostics. An isolated `SubagentStop` never publishes `none`.
 - When compacting conversations into `## Iterações`, the hook escapes code delimiters cut by the
   size limit; inline backticks and fences never remain open and consume the following line.
 - `session list` reads `SESSION_REGISTRY`; `show` displays one session and `use` only changes human
@@ -53,6 +61,9 @@ npx wendkeep import [options]
 - `import --source all|claude|codex`, `--since`, `--limit`, `--from`, and `--codex-from` bound scope.
 - `--dry-run`/`--json` support audit before writes; `--stamp-ids` and `--rescan-decisions` address
   specific historical gaps.
+- `import` reconciles observability even when no `wk-turn` is missing: a legacy schema, stale
+  frontier, or unproven manifest triggers recomposition without duplicating iterations. A fresh
+  checkpoint remains byte-identical; `degraded` is reported and does not change the note.
 - Exit `0` means consistent processing; non-zero reports invalid source/config/write instead of
   presenting silent partial success.
 
@@ -70,7 +81,15 @@ Each canonical session points to the matching provider, transcript, note file, a
 registry keeps one `SessionStart` epoch per activation plus the latest native turn; multiple
 `Stop` events may acknowledge turns in that epoch without closing it. Repeated imports of the
 same `session_id` deduplicate; human focus does not close or re-identify live hooks. Every
-automatic iteration remains valid Markdown even when a message must be truncated.
+automatic iteration remains valid Markdown even when a message must be truncated. Complete or
+truncated trailing internal metadata is removed only from assistant messages; a reproduction
+written by the user remains in the transcript. In the note, XML-like tags are encoded as visible
+text — including placeholders such as `<session>` — without changing `<https://...>` autolinks.
+Reimport and `SessionStop` share the same idempotent normalizer; when an older note is finalized,
+only recognized generated fields under `Iterações` and `Encerramento` are migrated, without rewriting
+authored prose.
+Duplicate/stale hooks converge on the same frontier, and imports may refresh only observability
+without creating a new turn block.
 
 ## Common errors and diagnosis
 
@@ -82,6 +101,8 @@ automatic iteration remains valid Markdown even when a message must be truncated
 - Fork duplicates: bound source/date and inspect `forked_from_id`/`source.subagent`.
 - Codex does not capture: approve hooks and start a new session after `sync`.
 - Contaminated cost: validate `session_id → session_file → transcript_path → provider`.
+- `degraded` observability: preserve the note and run a targeted rebuild dry-run; never force a
+  partial snapshot over the last `complete` one.
 
 ## Next steps
 

package/docs/en/commands/verify.md

@@ -73,15 +73,17 @@ npx wendkeep memory status --gate --vault .MyApp-vault
 ## Expected result
 
 `evidencia.json` contains sensor results and a seal binds proof to the current `tarefas.md` hash.
-Deep mode packages requirements, tasks, and evidence for read-only review; the verdict covers every
-`[req:]` before archive.
+When a sensor is red, its entry receives only a local, sanitized diagnostic bounded to 2,000
+characters; stdout/stderr from green sensors is not persisted. Deep mode packages requirements,
+tasks, and evidence for read-only review; the verdict covers every `[req:]` before archive.
 
 ## Common errors and diagnosis
 
 - `no change`: this is exit 2 and a valid idle state; create/use a change or skip verify.
 - Zero/missing sensors: inspect every same-line tag and `sensors list`; multiple tags on one task
   are valid and all of them enter the gate.
-- Red gate: fix the cause and rerun; never choose `archive --force` on your own.
+- Red gate: inspect the bounded `note` field on the `evidencia.json` entry, fix the cause, and
+  rerun; never choose `archive --force` on your own.
 - Missing/stale verdict: regenerate `--deep` and request a fresh independent pass.
 - Surviving mutants: strengthen the discriminating test; after three rounds, review manually.