wendkeep 0.67.2 → 0.68.0

package/CHANGELOG.md

@@ -4,6 +4,35 @@ All notable changes to **wendkeep** are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.68.0] — 2026-08-02
+
+### Added
+
+- **Curadoria de memória agora tem um assistente interativo para pessoas.** O novo
+  `memory curate --vault <vault>` agrupa conflitos por nomes amigáveis, exibe somente previews
+  sanitizados e guia promoção, rejeição, pulo ou saída com confirmação negativa por padrão. O
+  trabalho restante pode ser retomado em outra execução; ambientes não-TTY recebem o fallback
+  seguro `memory candidates --active` e nenhuma escrita implícita.
+
+### Changed
+
+- **O `doctor` apresenta integridade e conflitos de memória em formato humano.** A saída principal
+  usa seções e categorias amigáveis e recomenda primeiro o assistente guiado, enquanto o hook de
+  health preserva seu contrato JSON para automações. O diagnóstico continua somente leitura e
+  `memory repair` continua estritamente estrutural, sem escolher vencedores semânticos.
+
+## [0.67.3] — 2026-08-02
+
+### Fixed
+
+- **Conflitos semânticos agora levam a uma curadoria humana executável.** O doctor diferencia
+  candidates em conflito de corrupção estrutural, explica que `memory repair` não escolhe um
+  vencedor e mostra `memory candidates --active --vault <vault>` com o Vault resolvido, seguido
+  pelos modelos explícitos para promover ou rejeitar a decisão.
+- **A inspeção de candidates deixa de exigir leitura direta do sidecar.** O novo comando read-only
+  `memory candidates [--active]` devolve somente `candidate_id`, `reason`, `status`, `memory_key` e
+  `event_ids`, sem valores ou conteúdo, em ordem determinística e sem alterar o bundle de memória.
+
 ## [0.67.2] — 2026-08-02
 
 ### Fixed

package/README.en.md

@@ -369,8 +369,13 @@ backup/audit; divergent mirrors fail closed. A demonstrably superseded
 ambiguity uses `memory reconcile <session> --by-session <successor>
 --reason <reason>` as a dry run and requires `--apply`; the decision is backed up and audited
 without rewriting ledger, CORE, or notes. Run `status --gate` again afterwards. Conflicts require
-explicit, durable curation: `memory promote <id> --event <event-id>` selects one event from the
-candidate, while `memory reject <id>` keeps the current value. The decision is idempotent, and a
+explicit, durable curation. Start with `memory curate --vault <vault>`: the menu groups conflicts
+under friendly names, shows sanitized previews, and confirms every write with default `no`. Skip
+or quit and run it again to resume. In a non-TTY environment, use
+`memory candidates --active --vault <vault>` to list only safe IDs and metadata in read-only mode —
+it does not expose memory values or content. After human review,
+`memory promote <id> --event <event-id>` selects one event from the candidate, while
+`memory reject <id>` keeps the current value. `memory repair` does not choose a winner. The decision is idempotent, and a
 new promotion accepts a later Stop from the same session/activation without recreating a conflict.
 A promotion written by 0.66.1 remains historical: if the next Stop forms a new candidate, update
 to 0.66.3 and run `memory repair`. During replay, a transient candidate is re-evaluated against the
@@ -379,7 +384,10 @@ superseded. Repair migrates the checkpoint and mirror only when it proves the ex
 replay, attempt identity, and absence of a real conflict; it creates a backup and audit without
 appending or rewriting events. Ambiguity stays queued for explicit curation. Do not publish or
 install 0.66.2; use 0.66.3 or later. Decisions survive repair/replay;
-`blocked_by_core` cannot override CORE. Doctor only diagnoses. When status/doctor reports projected
+`blocked_by_core` cannot override CORE. Doctor only diagnoses, now with human-readable output and
+the guided next action; its health hook preserves JSON for automation. A missing Vault or unsafe
+boundary/registry also yields blocked memory, a safe command with the resolved path, and structured
+JSON—never a false “intact bundle” or a stack trace. When status/doctor reports projected
 acknowledgement pending on 0.66.4 or later, first run the targeted dry run
 `memory recover-attempt <session> --vault <vault>`, then authorize `--apply`; it changes only
 registry/checkpoint. See syntax, preconditions, and fail-closed behavior in

package/README.md

@@ -369,8 +369,13 @@ backup/audit; divergent mirrors fail closed. A demonstrably superseded
 ambiguity uses `memory reconcile <session> --by-session <successor>
 --reason <reason>` as a dry run and requires `--apply`; the decision is backed up and audited
 without rewriting ledger, CORE, or notes. Run `status --gate` again afterwards. Conflicts require
-explicit, durable curation: `memory promote <id> --event <event-id>` selects one event from the
-candidate, while `memory reject <id>` keeps the current value. The decision is idempotent, and a
+explicit, durable curation. Start with `memory curate --vault <vault>`: the menu groups conflicts
+under friendly names, shows sanitized previews, and confirms every write with default `no`. Skip
+or quit and run it again to resume. In a non-TTY environment, use
+`memory candidates --active --vault <vault>` to list only safe IDs and metadata in read-only mode —
+it does not expose memory values or content. After human review,
+`memory promote <id> --event <event-id>` selects one event from the candidate, while
+`memory reject <id>` keeps the current value. `memory repair` does not choose a winner. The decision is idempotent, and a
 new promotion accepts a later Stop from the same session/activation without recreating a conflict.
 A promotion written by 0.66.1 remains historical: if the next Stop forms a new candidate, update
 to 0.66.3 and run `memory repair`. During replay, a transient candidate is re-evaluated against the
@@ -379,7 +384,10 @@ superseded. Repair migrates the checkpoint and mirror only when it proves the ex
 replay, attempt identity, and absence of a real conflict; it creates a backup and audit without
 appending or rewriting events. Ambiguity stays queued for explicit curation. Do not publish or
 install 0.66.2; use 0.66.3 or later. Decisions survive repair/replay;
-`blocked_by_core` cannot override CORE. Doctor only diagnoses. When status/doctor reports projected
+`blocked_by_core` cannot override CORE. Doctor only diagnoses, now with human-readable output and
+the guided next action; its health hook preserves JSON for automation. A missing Vault or unsafe
+boundary/registry also yields blocked memory, a safe command with the resolved path, and structured
+JSON—never a false “intact bundle” or a stack trace. When status/doctor reports projected
 acknowledgement pending on 0.66.4 or later, first run the targeted dry run
 `memory recover-attempt <session> --vault <vault>`, then authorize `--apply`; it changes only
 registry/checkpoint. See syntax, preconditions, and fail-closed behavior in

package/docs/en/commands/maintenance-and-diagnostics.md

@@ -24,6 +24,7 @@ Run from the project root or provide `--project` and `--vault` explicitly.
 
 ```bash
 npx --no-install wendkeep doctor [--vault <vault>]
+npx --no-install wendkeep memory curate --vault <vault>
 npx --no-install wendkeep sync-defs [--check|--reseed] --vault <vault> --project <root>
 npx --no-install wendkeep theme sync --vault <vault>
 npx --no-install wendkeep --version
@@ -33,6 +34,12 @@ npx --no-install wendkeep --help
 ## Options and exit codes
 
 - `doctor` is read-only; exit `0` accepts recoverable warnings, while non-zero means failure.
+- `doctor` uses human-readable output with `[integrity]` and `[memory]` sections, friendly
+  categories, and a copyable next action. The `vault-health.mjs` hook remains the JSON surface for
+  automation; neither surface applies curation.
+- Even with a missing Vault, unsafe physical boundary, or unsafe registry, `doctor` marks memory as
+  blocked and shows `memory status --gate` with the resolved path; the hook preserves structured
+  JSON instead of replacing the result with stderr or a stack trace.
 - In v2, `doctor`/`memory status --gate` correlate `last_memory_attempt` (mode, disposition, event
   IDs, and checkpoint) with outbox, ledger, and SHARED; they do not infer health from revision alone.
 - `revision: 0` after a valid migration, with no v2 attempt, is healthy. A `degraded` attempt whose
@@ -57,6 +64,8 @@ npx --no-install wendkeep --version
 npx --no-install wendkeep sync-defs --check --vault .MyApp-vault --project .
 npx --no-install wendkeep doctor --vault .MyApp-vault
 npx --no-install wendkeep memory status --gate --vault .MyApp-vault
+npx --no-install wendkeep memory curate --vault .MyApp-vault
+npx --no-install wendkeep memory candidates --active --vault .MyApp-vault
 npx --no-install wendkeep cost rebuild --session <id> --json --vault .MyApp-vault
 npx --no-install wendkeep cost rebuild --session <id> --json --vault .MyApp-vault --apply
 ```
@@ -74,11 +83,19 @@ dry-run path before any write.
 
 - `no vault`: run from the bound root or pass `--vault`.
 - `defs stale`: confirm the version and run `sync-defs --reseed`.
-- Legacy vault: this is a non-blocking warning; plan `memory migrate --apply` separately.
+- Legacy vault: this is a non-blocking warning; doctor shows
+  `npx --no-install wendkeep memory migrate --apply --vault <vault>` with the resolved Vault, but
+  migration remains opt-in and must be planned separately.
 - `degraded` plus an intact outbox: warning; preserve the outbox and allow idempotent replay.
 - `ambiguous`, lost publication, or a mismatched checkpoint: blocking; preserve registry, ledger,
   outbox, and SHARED so `last_memory_attempt` can be correlated before repair.
 - Corrupt bundle: preserve evidence and run `memory status --gate` before `memory repair`.
+- An active semantic conflict requires a human decision: `memory repair` does not choose a winner.
+  Start with the guided menu `memory curate --vault <vault>`. For advanced inspection or a
+  non-interactive terminal, list safe IDs with `memory candidates --active --vault <vault>`, review
+  the evidence, and then use
+  `memory promote <candidate-id> --event <event-id> --vault <vault>` to select an event or
+  `memory reject <candidate-id> --vault <vault>` to keep the current operational value.
 - `legacy`/`degraded`/`stale`/`manifest-unproven` observability: run
   `npx --no-install wendkeep cost rebuild --session <id> --json --vault <vault>`, review diagnostics,
   and only then authorize the second variant with `--apply`.

package/docs/en/commands/memory.md

@@ -24,11 +24,13 @@ Pass the vault explicitly in automation. Preserve backups and evidence before re
 
 ```bash
 npx wendkeep memory status [--gate] --vault <vault>
+npx wendkeep memory curate --vault <vault>
+npx wendkeep memory candidates [--active] --vault <vault>
 npx wendkeep memory repair --vault <vault>
 npx wendkeep memory recover-attempt <session> [--apply] --vault <vault>
 npx wendkeep memory reconcile <ambiguous-session> --by-session <successor-session> --reason <reason> [--apply] --vault <vault>
-npx wendkeep memory promote <candidate> [--event <event-id>] --vault <vault>
-npx wendkeep memory reject <candidate> --vault <vault>
+npx wendkeep memory promote <candidate-id> [--event <event-id>] --vault <vault>
+npx wendkeep memory reject <candidate-id> --vault <vault>
 npx wendkeep validate-memory [CORE-path]
 npx wendkeep validate-memory --vault <v2-vault>
 ```
@@ -36,6 +38,21 @@ npx wendkeep validate-memory --vault <v2-vault>
 ## Options and exit codes
 
 - `memory status` is read-only; `--gate` exits `1` only for blocking state.
+- `memory curate` is the recommended human path: in an interactive terminal it groups each
+  conflict under a friendly name, shows sanitized previews only, and offers numbered choices,
+  `P` to skip, `R` to reject, `D` for technical details, and `Q` to quit. Every promotion or
+  rejection asks for confirmation with default `no`: Enter or `N` does not write. Skip or quit
+  leaves the remaining work pending; running the command again resumes the active conflicts.
+- The assistant accepts only `--vault`: there is no `--yes`, `--apply`, or batch mode. In a
+  non-TTY environment it exits `2` without changing bytes and recommends the advanced fallback
+  `memory candidates --active`.
+- `memory candidates` is read-only and prints deterministic JSON containing only `candidate_id`,
+  `reason`, `status`, `memory_key`, and `event_ids`; it does not expose memory values or content and
+  does not create a lock or mutate the bundle. `--active` omits terminal candidates (`resolved`,
+  `rejected`, and `superseded`). A missing status is normalized to `active`.
+- For `memory candidates`, exit `0` means a valid inventory (including empty or conflicted), exit
+  `1` means an invalid sidecar/unsafe topology, and exit `2` means a missing `--vault`, unknown or
+  duplicate option, extra argument, or an invalid value passed to `--active`.
 - `Stop` writes events to the outbox before acknowledging `last_memory_attempt: enqueued`, then the
   projector runs outside the registry lock. Retrying the same attempt reuses its frozen event IDs
   and can project them at most once.
@@ -81,8 +98,9 @@ npx wendkeep validate-memory --vault <v2-vault>
   the lease they acquired.
 - `promote`/`reject` append an auditable, idempotent decision to the ledger. Replay and repair
   preserve that decision and do not recreate the resolved candidate. For a `conflict` candidate,
-  `promote` requires an `--event <event-id>` that belongs to the candidate; date or random ID
-  never picks an implicit winner. `reject` preserves the current operational value. A
+  use `memory promote <candidate-id> --event <event-id>` with an event that belongs to the
+  candidate; date or random ID never picks an implicit winner. `reject` preserves the current
+  operational value. A
   `blocked_by_core` candidate can only be rejected: promotion first requires canonical CORE
   curation. If the selected event still belongs to the matching latest `projected` attempt,
   promotion also refreshes its checkpoint and mirror causally; JSON reports
@@ -105,6 +123,8 @@ npx wendkeep validate-memory --vault <v2-vault>
 
 ```bash
 npx wendkeep memory status --gate --vault .MyApp-vault
+npx wendkeep memory curate --vault .MyApp-vault
+npx wendkeep memory candidates --active --vault .MyApp-vault
 npx wendkeep memory recover-attempt session-123 --vault .MyApp-vault
 npx wendkeep memory recover-attempt session-123 --apply --vault .MyApp-vault
 npx wendkeep memory reconcile old --by-session current --reason "delivery continued" --vault .MyApp-vault
@@ -121,6 +141,9 @@ state of the last attempt. CORE stays hand-curated and canonical; SHARED stays a
 operational projection. After successful projection, an attempt checkpoint may be a valid prefix
 of a global projection that has already advanced with concurrent events.
 
+`memory candidates` returns `status: "ok"` and the sanitized candidate list in stable order; with
+`--active`, the list contains only decisions still open for human curation.
+
 ## Common errors and diagnosis
 
 - `legacy`: follow the migration guide; this is not corruption.

package/docs/pt-BR/commands/maintenance-and-diagnostics.md

@@ -24,6 +24,7 @@ Execute na raiz do projeto ou informe `--project`/`--vault` explicitamente.
 
 ```bash
 npx --no-install wendkeep doctor [--vault <cofre>]
+npx --no-install wendkeep memory curate --vault <cofre>
 npx --no-install wendkeep sync-defs [--check|--reseed] --vault <cofre> --project <raiz>
 npx --no-install wendkeep theme sync --vault <cofre>
 npx --no-install wendkeep --version
@@ -33,6 +34,12 @@ npx --no-install wendkeep --help
 ## Opções e códigos de saída
 
 - `doctor` é read-only; exit `0` aceita warnings recuperáveis e exit não zero indica falha.
+- O `doctor` usa saída em formato humano, com blocos `[integridade]` e `[memória]`, categorias
+  amigáveis e uma próxima ação copiável. O hook `vault-health.mjs` continua sendo a superfície JSON
+  para automações; nenhum dos dois aplica curadoria.
+- Mesmo com Vault ausente, boundary física insegura ou registry inseguro, o `doctor` marca a memória
+  como bloqueada e mostra `memory status --gate` com o caminho resolvido; o hook preserva JSON
+  estruturado em vez de substituir o resultado por stderr ou stack trace.
 - Em v2, `doctor`/`memory status --gate` correlacionam `last_memory_attempt` (mode, disposition,
   event IDs e checkpoint) com outbox, ledger e SHARED; não inferem saúde só pela revision atual.
 - `revision: 0` após migração válida, sem attempt v2, é saudável. Attempt `degraded` cujos eventos
@@ -57,6 +64,8 @@ npx --no-install wendkeep --version
 npx --no-install wendkeep sync-defs --check --vault .MeuApp-vault --project .
 npx --no-install wendkeep doctor --vault .MeuApp-vault
 npx --no-install wendkeep memory status --gate --vault .MeuApp-vault
+npx --no-install wendkeep memory curate --vault .MeuApp-vault
+npx --no-install wendkeep memory candidates --active --vault .MeuApp-vault
 npx --no-install wendkeep cost rebuild --session <id> --json --vault .MeuApp-vault
 npx --no-install wendkeep cost rebuild --session <id> --json --vault .MeuApp-vault --apply
 ```
@@ -74,11 +83,18 @@ ou sem manifest comprovado e oferece um caminho dry-run antes de qualquer escrit
 
 - `no vault`: execute da raiz vinculada ou passe `--vault`.
 - `defs stale`: confirme a versão e rode `sync-defs --reseed`.
-- Vault legado: é warning não bloqueante; planeje `memory migrate --apply` separadamente.
+- Vault legado: é warning não bloqueante; o doctor mostra
+  `npx --no-install wendkeep memory migrate --apply --vault <cofre>` com o Vault resolvido, mas a
+  migração continua sendo opt-in e deve ser planejada separadamente.
 - `degraded` + outbox íntegra: warning; preserve a outbox e permita replay idempotente.
 - `ambiguous`, publicação perdida ou checkpoint divergente: bloqueante; preserve registry, ledger,
   outbox e SHARED para correlacionar `last_memory_attempt` antes de reparar.
 - Bundle corrompido: preserve a evidência e use `memory status --gate` antes de `memory repair`.
+- Conflito semântico ativo exige decisão humana: `memory repair` não escolhe vencedor. Comece pelo
+  menu guiado `memory curate --vault <cofre>`. Para inspeção avançada ou terminal não interativo,
+  liste os IDs seguros com `memory candidates --active --vault <cofre>`, revise a evidência e use
+  `memory promote <candidate-id> --event <event-id> --vault <cofre>` para selecionar um evento ou
+  `memory reject <candidate-id> --vault <cofre>` para manter o valor operacional atual.
 - Observabilidade `legacy`/`degraded`/`stale`/`manifest-unproven`: rode
   `npx --no-install wendkeep cost rebuild --session <id> --json --vault <cofre>`, revise diagnostics
   e só então autorize a segunda variante com `--apply`.

package/docs/pt-BR/commands/memory.md

@@ -24,11 +24,13 @@ Informe o vault explicitamente em automações. Preserve backups e evidências a
 
 ```bash
 npx wendkeep memory status [--gate] --vault <cofre>
+npx wendkeep memory curate --vault <cofre>
+npx wendkeep memory candidates [--active] --vault <cofre>
 npx wendkeep memory repair --vault <cofre>
 npx wendkeep memory recover-attempt <sessão> [--apply] --vault <cofre>
 npx wendkeep memory reconcile <sessão-ambígua> --by-session <sessão-sucessora> --reason <motivo> [--apply] --vault <cofre>
-npx wendkeep memory promote <candidate> [--event <event-id>] --vault <cofre>
-npx wendkeep memory reject <candidate> --vault <cofre>
+npx wendkeep memory promote <candidate-id> [--event <event-id>] --vault <cofre>
+npx wendkeep memory reject <candidate-id> --vault <cofre>
 npx wendkeep validate-memory [caminho-do-CORE]
 npx wendkeep validate-memory --vault <cofre-v2>
 ```
@@ -36,6 +38,21 @@ npx wendkeep validate-memory --vault <cofre-v2>
 ## Opções e códigos de saída
 
 - `memory status` é read-only; `--gate` retorna exit `1` apenas para estado bloqueante.
+- `memory curate` é o caminho recomendado para pessoas: em um terminal interativo, agrupa cada
+  conflito por nome amigável, mostra somente previews sanitizados e oferece escolhas numeradas,
+  `P` para pular, `R` para rejeitar, `D` para detalhes técnicos e `Q` para sair. Cada promoção ou
+  rejeição pede confirmação com padrão negativo: Enter ou `N` não grava. Pular ou sair deixa o
+  restante pendente; uma nova execução retoma os conflitos ainda ativos.
+- O assistente aceita somente `--vault`: não há `--yes`, `--apply` ou modo em lote. Em ambiente
+  não-TTY/terminal não interativo, ele retorna exit `2` sem alterar bytes e orienta usar o fallback
+  avançado `memory candidates --active`.
+- `memory candidates` é read-only e imprime JSON determinístico com somente `candidate_id`,
+  `reason`, `status`, `memory_key` e `event_ids`; não expõe valores nem conteúdo da memória e não
+  cria lock nem altera o bundle. `--active` omite candidates terminais (`resolved`, `rejected` e
+  `superseded`). Status ausente é normalizado para `active`.
+- Em `memory candidates`, exit `0` indica inventário válido (inclusive vazio ou com conflitos),
+  exit `1` indica sidecar inválido/topologia insegura e exit `2` indica `--vault` ausente, opção
+  desconhecida/duplicada, argumento extra ou valor indevido em `--active`.
 - O `Stop` grava os eventos na outbox antes de reconhecer `last_memory_attempt: enqueued`; depois o
   projector roda fora do lock do registry. Retry do mesmo attempt reutiliza os event IDs congelados
   e pode projetá-los no máximo uma vez.
@@ -79,8 +96,9 @@ npx wendkeep validate-memory --vault <cofre-v2>
   symlink, reparse point ou hardlink falham fechados sem tocar bytes externos. Locks publicam owner
   e lease atomicamente, não colhem PID vivo apenas por idade e só liberam a lease adquirida.
 - `promote`/`reject` acrescentam uma decisão auditável e idempotente ao ledger. Replay e repair
-  preservam a decisão e não recriam o candidate resolvido. Para candidate `conflict`, `promote`
-  exige `--event <event-id>` pertencente ao candidate; não há vencedor implícito por data ou ID.
+  preservam a decisão e não recriam o candidate resolvido. Para candidate `conflict`, use
+  `memory promote <candidate-id> --event <event-id>` com um evento pertencente ao candidate; não há
+  vencedor implícito por data ou ID.
   `reject` preserva o valor operacional atual. Candidate `blocked_by_core` só pode ser rejeitado:
   promover exige antes alterar CORE pela curadoria canônica. Se o evento escolhido ainda pertence
   ao último attempt `projected` correspondente, a promoção também atualiza causalmente checkpoint
@@ -103,6 +121,8 @@ npx wendkeep validate-memory --vault <cofre-v2>
 
 ```bash
 npx wendkeep memory status --gate --vault .MeuApp-vault
+npx wendkeep memory curate --vault .MeuApp-vault
+npx wendkeep memory candidates --active --vault .MeuApp-vault
 npx wendkeep memory recover-attempt sessao-123 --vault .MeuApp-vault
 npx wendkeep memory recover-attempt sessao-123 --apply --vault .MeuApp-vault
 npx wendkeep memory reconcile antiga --by-session atual --reason "entrega continuada" --vault .MeuApp-vault
@@ -119,6 +139,9 @@ causal do último attempt. CORE permanece canônico e curado à mão; SHARED per
 operacional verificável. Depois de uma projeção bem-sucedida, o checkpoint do attempt pode ser um
 prefixo válido de uma projeção global que já avançou com eventos concorrentes.
 
+`memory candidates` retorna `status: "ok"` e a lista sanitizada de candidates em ordem estável;
+com `--active`, a lista contém somente decisões ainda abertas para curadoria humana.
+
 ## Erros comuns e diagnóstico
 
 - `legacy`: siga o guia de migração; não é corrupção.

package/hooks/vault-health.mjs

@@ -106,6 +106,34 @@ const memoryStatusCommand = (vaultBase) => (
 const memoryRepairCommand = (vaultBase) => (
   `${WENDKEEP_COMMAND} memory repair --vault ${quoteCommandArgument(vaultBase)}`
 );
+const memoryMigrateCommand = (vaultBase) => (
+  `${WENDKEEP_COMMAND} memory migrate --apply --vault ${quoteCommandArgument(vaultBase)}`
+);
+const memoryCandidatesCommand = (vaultBase) => (
+  `${WENDKEEP_COMMAND} memory candidates --active --vault ${quoteCommandArgument(vaultBase)}`
+);
+const memoryCurateCommand = (vaultBase) => (
+  `${WENDKEEP_COMMAND} memory curate --vault ${quoteCommandArgument(vaultBase)}`
+);
+
+const MEMORY_KEY_PURPOSES = new Map([
+  ['handoff.latest', 'próximo handoff'],
+  ['quality.latest-sensors', 'sensores de qualidade'],
+  ['quality.latest-verdict', 'veredito de qualidade'],
+  ['git.local-head', 'commit local conhecido'],
+]);
+
+function groupConflictPurposes(conflicts) {
+  const counts = new Map();
+  for (const conflict of conflicts) {
+    const key = String(conflict?.memory_key || '').trim();
+    const label = MEMORY_KEY_PURPOSES.get(key) || (key ? `outras memórias (${key})` : 'outras memórias');
+    counts.set(label, (counts.get(label) || 0) + 1);
+  }
+  return [...counts.entries()]
+    .sort(([left], [right]) => left.localeCompare(right))
+    .map(([label, count]) => `${label}: ${count}`);
+}
 
 function readJsonLines(vaultBase, path, label) {
   let checked;
@@ -206,11 +234,11 @@ function memoryMetrics() {
   };
 }
 
-function blockedMemoryBoundary(error) {
+function blockedMemoryBoundary(error, vaultBase) {
   return {
     ok: false,
     status: 'blocked',
-    failures: [`Boundary física da memória insegura: ${error?.message || error}`],
+    failures: [`Boundary física da memória insegura: ${error?.message || error}. Inspecione com: ${memoryStatusCommand(vaultBase)}.`],
     warnings: [],
     metrics: memoryMetrics(),
   };
@@ -381,23 +409,23 @@ export function checkMemoryBundle(vaultBase, { registry } = {}) {
     return {
       ok: false,
       status: 'blocked',
-      failures: [`Vault not found: ${vaultBase}`],
+      failures: [`Vault not found: ${vaultBase}. Inspecione com: ${memoryStatusCommand(vaultBase)}.`],
       warnings: [],
       metrics: memoryMetrics(),
     };
   }
   try { preflightMemoryBundle(vaultBase); }
-  catch (error) { return blockedMemoryBoundary(error); }
+  catch (error) { return blockedMemoryBoundary(error, vaultBase); }
   const brain = join(vaultBase, '.brain');
   let mode;
   try { mode = detectMemoryMode(vaultBase); }
-  catch (error) { return blockedMemoryBoundary(error); }
+  catch (error) { return blockedMemoryBoundary(error, vaultBase); }
   if (mode.mode === 'legacy') {
     return {
       ok: true,
       status: 'legacy',
       failures: [],
-      warnings: [LEGACY_MEMORY_WARNING],
+      warnings: [`${LEGACY_MEMORY_WARNING} Comando com Vault resolvido: ${memoryMigrateCommand(vaultBase)}.`],
       metrics: memoryMetrics(),
     };
   }
@@ -451,7 +479,7 @@ export function checkMemoryBundle(vaultBase, { registry } = {}) {
   let effectiveRegistry = registry;
   if (!effectiveRegistry) {
     try { effectiveRegistry = readSessionRegistry(vaultBase); }
-    catch (error) { failures.push(`SESSION_REGISTRY.json inseguro ou ilegível: ${error?.message || error}.`); }
+    catch (error) { failures.push(`SESSION_REGISTRY.json inseguro ou ilegível: ${error?.message || error}. Inspecione com: ${memoryStatusCommand(vaultBase)}.`); }
   }
   const lifecycle = checkMemoryAttempts(effectiveRegistry || { version: 2, sessions: {} }, {
     vaultBase,
@@ -466,7 +494,11 @@ export function checkMemoryBundle(vaultBase, { registry } = {}) {
   const activeConflicts = unresolved.filter((item) => item?.reason === 'conflict');
   const ordinaryCandidates = unresolved.filter((item) => item?.reason !== 'conflict');
   if (activeConflicts.length) {
-    failures.push(`${activeConflicts.length} conflito ativo em chave operacional (${activeConflicts.map((item) => item.memory_key || item.candidate_id).join(', ')}). Inspecione com: ${memoryStatusCommand(vaultBase)}.`);
+    const label = activeConflicts.length === 1
+      ? '1 conflito ativo'
+      : `${activeConflicts.length} conflitos ativos`;
+    const purposes = groupConflictPurposes(activeConflicts).join('; ');
+    failures.push(`${label} (${purposes}). Existem versões concorrentes e nenhum dado foi escolhido automaticamente. Conflito semântico exige curadoria humana; memory repair não escolhe vencedor. Próximo passo: ${memoryCurateCommand(vaultBase)}. Inventário avançado: ${memoryCandidatesCommand(vaultBase)}.`);
   }
   if (outbox.count) warnings.push(`${outbox.count} evento(s) pendente(s) na outbox; execute o projector quando seguro.`);
   if (ordinaryCandidates.length) warnings.push(`${ordinaryCandidates.length} candidate(s) aguardando curadoria humana.`);
@@ -545,8 +577,49 @@ function checkSession({ vaultBase, sessionRel, control, registry }) {
 }
 
 export function runVaultHealth({ vaultBase, session = '' }) {
-  const control = readControl(vaultBase);
-  const registry = readSessionRegistry(vaultBase);
+  const memoryMarkers = [
+    join(vaultBase, '.brain', 'SHARED_MEMORY.md'),
+    join(vaultBase, '.brain', 'MEMORY_EVENTS.jsonl'),
+    join(vaultBase, '.brain', 'MEMORY_CANDIDATES.jsonl'),
+    join(vaultBase, '.brain', 'memory-outbox'),
+  ];
+  const memory = !existsSync(vaultBase) || memoryMarkers.some((path) => existsSync(path))
+    ? checkMemoryBundle(vaultBase)
+    : {
+      ok: true,
+      status: 'legacy',
+      failures: [],
+      warnings: [`Bundle de memória v2 ausente (vault legado); inspecione com: ${memoryStatusCommand(vaultBase)}.`],
+      metrics: {},
+    };
+
+  let control = {};
+  let registry = { version: 2, sessions: {} };
+  const contextErrors = [];
+  try { control = readControl(vaultBase); }
+  catch (error) { contextErrors.push(error?.message || String(error)); }
+  try { registry = readSessionRegistry(vaultBase); }
+  catch (error) { contextErrors.push(error?.message || String(error)); }
+
+  if (contextErrors.length) {
+    const failures = [
+      `Validação de sessão e artefatos indisponível com segurança: ${contextErrors.join('; ')}. Inspecione com: ${memoryStatusCommand(vaultBase)}.`,
+      ...memory.failures.map((item) => `Memória: ${item}`),
+    ];
+    return {
+      ok: false,
+      session,
+      failures,
+      warnings: memory.warnings.map((item) => `Memória: ${item}`),
+      metrics: {
+        registrySessions: 0,
+        derivedNotes: 0,
+        memory: memory.metrics,
+      },
+      memoryStatus: memory.status,
+    };
+  }
+
   const sessionRel = session || control.session_file || control.last_session_file || '';
   const failures = [];
   const warnings = [];
@@ -579,20 +652,8 @@ export function runVaultHealth({ vaultBase, session = '' }) {
     return total + (existsSync(dir) ? listMarkdownFiles(dir).length : 0);
   }, 0);
 
-  const memoryMarkers = [
-    join(vaultBase, '.brain', 'SHARED_MEMORY.md'),
-    join(vaultBase, '.brain', 'MEMORY_EVENTS.jsonl'),
-    join(vaultBase, '.brain', 'MEMORY_CANDIDATES.jsonl'),
-    join(vaultBase, '.brain', 'memory-outbox'),
-  ];
-  let memory = { status: 'legacy', metrics: {} };
-  if (memoryMarkers.some((path) => existsSync(path))) {
-    memory = checkMemoryBundle(vaultBase, { registry });
-    failures.push(...memory.failures.map((item) => `Memória: ${item}`));
-    warnings.push(...memory.warnings.map((item) => `Memória: ${item}`));
-  } else {
-    warnings.push(`Bundle de memória v2 ausente (vault legado); inspecione com: ${memoryStatusCommand(vaultBase)}.`);
-  }
+  failures.push(...memory.failures.map((item) => `Memória: ${item}`));
+  warnings.push(...memory.warnings.map((item) => `Memória: ${item}`));
 
   return {
     ok: failures.length === 0,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wendkeep",
-  "version": "0.67.2",
+  "version": "0.68.0",
   "description": "Vault-first persistent memory for AI coding agents, with an optional profile-aware governance runtime: OFF, FLOW, GUIDE, GOVERN, or ASSURE. Local-first and agent-agnostic (Claude Code, Codex, Cursor…).",
   "type": "module",
   "workspaces": [

package/packages/cli/src/index.mjs

@@ -99,7 +99,9 @@ Usage:
                            in session notes from the linked derived notes — the body used to lag
                            behind the closing block. Dry-run by default · --apply · --json.
   wendkeep lesson add "t" "l"   Record a project-local lesson (injected at SessionStart).
-  wendkeep memory <sub>          Shared memory v2: status | migrate [--apply] | repair |
+  wendkeep memory curate         Guide one semantic conflict at a time in an interactive terminal.
+                           Every promote/reject requires confirmation; --vault P.
+  wendkeep memory <sub>          Shared memory v2: status | candidates [--active] | curate | migrate [--apply] | repair |
                            recover-attempt <session> [--apply] |
                            reconcile <session> --by-session <session> --reason <text> [--apply] |
                            promote <candidate> [--event <event-id>] | reject <candidate>. --vault P.
@@ -230,8 +232,13 @@ async function main(argv) {
       break;
     }
     case 'memory': {
-      const { runMemory } = await import('../../../src/memory.mjs');
-      runMemory(rest);
+      if (rest[0] === 'curate') {
+        const { runMemoryCurateCli } = await import('../../../src/memory-curate.mjs');
+        process.exitCode = await runMemoryCurateCli(rest.slice(1));
+      } else {
+        const { runMemory } = await import('../../../src/memory.mjs');
+        runMemory(rest);
+      }
       break;
     }
     case 'sync-defs': {

package/src/doctor.mjs

@@ -1,27 +1,64 @@
 // `wendkeep doctor` — vault/session integrity (hooks/vault-health.mjs) PLUS the a2
 // harness integrity check (hooks/harness-doctor.mjs). Exits 1 on any error.
-import { spawnSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { resolve } from 'node:path';
 import { checkHarness, checkVaultLinks, checkSessionActivity, checkStackedFrontmatter, renderStackedFrontmatterLines, checkUnpricedModels, renderUnpricedModelLines, checkStaleDerivedSections, renderStaleDerivedSectionLines, checkSessionObservability, renderSessionObservabilityLines } from '../hooks/harness-doctor.mjs';
+import { runVaultHealth } from '../hooks/vault-health.mjs';
 import { checkSyncDefs } from './sync-defs.mjs';
 import { resolveProjectVault } from './project-vault.mjs';
 
-export function runDoctor(argv) {
-  const here = dirname(fileURLToPath(import.meta.url));
-  const hookFile = join(here, '..', 'hooks', 'vault-health.mjs');
+const healthStatusLabel = (status) => ({
+  healthy: 'saudável', warning: 'atenção', blocked: 'bloqueada', legacy: 'legado',
+}[status] || status || 'desconhecido');
+
+const metricValue = (value) => value === null || value === undefined || value === '' ? 'n/a' : value;
+
+export function renderVaultHealthLines(result) {
+  const memoryFailures = [];
+  const memoryWarnings = [];
+  const integrityFailures = [];
+  const integrityWarnings = [];
+  for (const failure of result.failures || []) {
+    const match = String(failure).match(/^Memória:\s*(.*)$/s);
+    (match ? memoryFailures : integrityFailures).push(match ? match[1] : failure);
+  }
+  for (const warning of result.warnings || []) {
+    const match = String(warning).match(/^Memória:\s*(.*)$/s);
+    (match ? memoryWarnings : integrityWarnings).push(match ? match[1] : warning);
+  }
+
+  const lines = [
+    `[integridade] ${integrityFailures.length ? 'bloqueada' : integrityWarnings.length ? 'atenção' : 'saudável'} — ${integrityFailures.length} falha(s), ${integrityWarnings.length} aviso(s)`,
+  ];
+  for (const failure of integrityFailures) lines.push(`  ✗ ${failure}`);
+  for (const warning of integrityWarnings) lines.push(`  ! ${warning}`);
+  if (!integrityFailures.length && !integrityWarnings.length) lines.push('  ✓ sessão e artefatos íntegros');
+  lines.push(`  sessão: ${result.session || 'nenhuma'} · registros: ${metricValue(result.metrics?.registrySessions)} · notas derivadas: ${metricValue(result.metrics?.derivedNotes)}`);
 
+  const memory = result.metrics?.memory || {};
+  lines.push(
+    `[memória] ${healthStatusLabel(result.memoryStatus)} — schema: ${metricValue(memory.schemaVersion)} · revisão: ${metricValue(memory.revision)} · cursor: ${metricValue(memory.eventCursor)} · hash: ${metricValue(memory.stateHash)}`,
+  );
+  lines.push(`  ledger: ${metricValue(memory.ledgerEvents)} evento(s) · outbox: ${metricValue(memory.pendingOutbox)} · candidates: ${metricValue(memory.candidates)} · conflitos: ${metricValue(memory.activeConflicts)}`);
+  for (const failure of memoryFailures) lines.push(`  ✗ ${failure}`);
+  for (const warning of memoryWarnings) lines.push(`  ! ${warning}`);
+  if (result.memoryStatus === 'healthy' && !memoryFailures.length && !memoryWarnings.length) {
+    lines.push('  ✓ bundle de memória íntegro');
+  }
+  return lines;
+}
+
+export function runDoctor(argv) {
   let vault;
   let project;
-  const passthrough = [];
+  let session = '';
   for (let i = 0; i < argv.length; i += 1) {
     const a = argv[i];
     if (a === '--vault') vault = argv[++i];
     else if (a.startsWith('--vault=')) vault = a.slice(8);
     else if (a === '--project') project = argv[++i];
     else if (a.startsWith('--project=')) project = a.slice(10);
-    else passthrough.push(a);
+    else if (a === '--session') session = argv[++i] || '';
+    else if (a.startsWith('--session=')) session = a.slice(10);
   }
 
   const projectRoot = resolve(project || process.cwd());
@@ -42,12 +79,22 @@ export function runDoctor(argv) {
     process.stdout.write('  ! migração pendente: rode `wendkeep init --project . --vault "<vault>" --yes` para criar .wendkeep.json\n');
   }
 
-  // 1. Session/vault integrity (existing check).
-  let healthStatus = 0;
-  if (existsSync(hookFile)) {
-    const r = spawnSync(process.execPath, [hookFile, ...passthrough, '--vault', vaultBase], { stdio: 'inherit' });
-    healthStatus = r.status ?? 0;
+  // 1. Session/vault integrity. The standalone hook remains JSON; doctor renders it for humans.
+  let health;
+  try {
+    health = runVaultHealth({ vaultBase, session });
+  } catch (error) {
+    health = {
+      ok: false,
+      session,
+      failures: [`Vault health falhou: ${error?.message || error}`],
+      warnings: [],
+      metrics: { memory: {} },
+      memoryStatus: 'blocked',
+    };
   }
+  process.stdout.write(`${renderVaultHealthLines(health).join('\n')}\n`);
+  const healthStatus = health.ok ? 0 : 1;
 
   // 2. Harness integrity (Wave B).
   const { errors, warnings } = checkHarness(vaultBase, projectRoot);

package/src/memory-curate.mjs

@@ -0,0 +1,328 @@
+import { existsSync } from 'node:fs';
+import { createInterface } from 'node:readline/promises';
+
+import { getLocale } from '../hooks/locale.mjs';
+import {
+  decideMemoryCandidate,
+  listMemoryCandidatesForCuration,
+} from './memory.mjs';
+
+const TEXT = {
+  'pt-BR': {
+    title: 'Curadoria guiada de memória',
+    intro: (count) => `${count} conflito(s) aguardam uma decisão humana. Nada será escolhido automaticamente.`,
+    categories: 'Categorias pendentes:',
+    progress: (index, total, label) => `Conflito ${index} de ${total} — ${label}`,
+    source: 'origem',
+    sourceKinds: {
+      session: 'sessão capturada', turn: 'turno capturado',
+      activation: 'ativação capturada', unknown: 'não identificada',
+    },
+    observed: 'registrado em',
+    newer: 'mais recente',
+    actions: '[1-N] Manter uma versão · [P] Pular · [R] Encerrar sem vencedor · [D] Detalhes · [Q] Sair',
+    choose: '> ',
+    confirmPromote: (number) => `Manter a versão ${number}? Essa decisão será gravada agora. [s/N] `,
+    confirmReject: 'Encerrar este conflito sem escolher uma versão? Essa decisão será gravada agora. [s/N] ',
+    invalid: 'Opção inválida. Escolha um número exibido, P, R, D ou Q.',
+    declined: 'Decisão não confirmada; nenhum byte foi alterado.',
+    promoted: 'Versão promovida e decisão auditada.',
+    rejected: 'Conflito encerrado sem promover uma versão.',
+    details: 'Detalhes técnicos',
+    paused: (decisions, skipped) => `Sessão encerrada: ${decisions} decisão(ões) gravada(s), ${skipped} conflito(s) pulado(s).`,
+    complete: (decisions) => `Curadoria concluída: ${decisions} decisão(ões) gravada(s); nenhum conflito semântico ativo restante.`,
+    blocked: 'O estado da memória mudou ou está ocupado. Nada mais foi aplicado; execute memory curate novamente.',
+    noConflicts: 'Nenhum conflito semântico ativo precisa de curadoria.',
+  },
+  en: {
+    title: 'Guided memory curation',
+    intro: (count) => `${count} conflict(s) require a human decision. Nothing will be selected automatically.`,
+    categories: 'Pending categories:',
+    progress: (index, total, label) => `Conflict ${index} of ${total} — ${label}`,
+    source: 'source',
+    sourceKinds: {
+      session: 'captured session', turn: 'captured turn',
+      activation: 'captured activation', unknown: 'unidentified',
+    },
+    observed: 'recorded at',
+    newer: 'newest timestamp',
+    actions: '[1-N] Keep one version · [P] Skip · [R] Close without a winner · [D] Details · [Q] Quit',
+    choose: '> ',
+    confirmPromote: (number) => `Keep version ${number}? This decision will be written now. [y/N] `,
+    confirmReject: 'Close this conflict without choosing a version? This decision will be written now. [y/N] ',
+    invalid: 'Invalid option. Choose a displayed number, P, R, D, or Q.',
+    declined: 'Decision not confirmed; no bytes were changed.',
+    promoted: 'Version promoted and decision audited.',
+    rejected: 'Conflict closed without promoting a version.',
+    details: 'Technical details',
+    paused: (decisions, skipped) => `Session ended: ${decisions} decision(s) written, ${skipped} conflict(s) skipped.`,
+    complete: (decisions) => `Curation complete: ${decisions} decision(s) written; no active semantic conflicts remain.`,
+    blocked: 'Memory state changed or is busy. Nothing else was applied; run memory curate again.',
+    noConflicts: 'No active semantic conflict requires curation.',
+  },
+};
+
+const KEY_TEXT = {
+  'handoff.latest': {
+    'pt-BR': ['Próximo handoff', 'Resumo que será apresentado à próxima sessão.'],
+    en: ['Next handoff', 'Summary that will be presented to the next session.'],
+  },
+  'quality.latest-sensors': {
+    'pt-BR': ['Sensores de qualidade', 'Conjunto de testes e sensores considerado mais recente.'],
+    en: ['Quality sensors', 'Test and sensor set considered the latest.'],
+  },
+  'quality.latest-verdict': {
+    'pt-BR': ['Veredito de qualidade', 'Resultado de verificação apresentado como vigente.'],
+    en: ['Quality verdict', 'Verification result presented as current.'],
+  },
+  'git.local-head': {
+    'pt-BR': ['Commit local conhecido', 'Commit que o WendKeep considera o último estado local.'],
+    en: ['Known local commit', 'Commit WendKeep considers the latest local state.'],
+  },
+};
+
+function localeId(value) {
+  return value === 'en' ? 'en' : 'pt-BR';
+}
+
+function keyText(memoryKey, locale) {
+  return KEY_TEXT[memoryKey]?.[locale]
+    || (locale === 'en'
+      ? [memoryKey, 'Operational memory value with competing versions.']
+      : [memoryKey, 'Valor operacional com versões concorrentes.']);
+}
+
+function isAffirmative(answer) {
+  return ['s', 'sim', 'y', 'yes'].includes(String(answer || '').trim().toLowerCase());
+}
+
+function groupLines(candidates, locale) {
+  const counts = new Map();
+  for (const candidate of candidates) {
+    counts.set(candidate.memory_key, (counts.get(candidate.memory_key) || 0) + 1);
+  }
+  return [...counts.entries()]
+    .sort(([left], [right]) => left.localeCompare(right))
+    .map(([key, count]) => `  • ${keyText(key, locale)[0]}: ${count}`);
+}
+
+function newestEventId(events) {
+  return [...events]
+    .filter((event) => !Number.isNaN(Date.parse(event.observed_at || '')))
+    .sort((left, right) => Date.parse(right.observed_at) - Date.parse(left.observed_at))[0]?.event_id;
+}
+
+export function renderMemoryConflict(candidate, {
+  locale = 'pt-BR', index = 1, total = 1, details = false,
+} = {}) {
+  const id = localeId(locale);
+  const text = TEXT[id];
+  const [label, description] = keyText(candidate.memory_key, id);
+  const newest = newestEventId(candidate.events);
+  const lines = ['', text.progress(index, total, label), description, ''];
+  candidate.events.forEach((event, eventIndex) => {
+    const recent = event.event_id === newest ? ` — ${text.newer}` : '';
+    const source = text.sourceKinds[event.source] || text.sourceKinds.unknown;
+    lines.push(`[${eventIndex + 1}] ${text.source}: ${source}${recent}`);
+    if (event.observed_at) lines.push(`    ${text.observed}: ${event.observed_at}`);
+    lines.push(`    ${event.preview}`);
+  });
+  if (details) {
+    lines.push('', `${text.details}:`, `  candidate: ${candidate.candidate_id}`);
+    candidate.events.forEach((event) => lines.push(`  event: ${event.event_id}`));
+  }
+  lines.push('', text.actions);
+  return `${lines.join('\n')}\n`;
+}
+
+export async function runGuidedMemoryCuration(vault, {
+  ask,
+  write,
+  loadCandidates = listMemoryCandidatesForCuration,
+  decide = decideMemoryCandidate,
+  locale = 'pt-BR',
+} = {}) {
+  if (typeof ask !== 'function' || typeof write !== 'function') {
+    throw new TypeError('runGuidedMemoryCuration requer ask e write.');
+  }
+  const id = localeId(locale);
+  const text = TEXT[id];
+  let decisions = 0;
+  let skipped = 0;
+  const skippedIds = new Set();
+  const decidedIds = new Set();
+  let first = true;
+  let sessionTotal = 0;
+
+  while (true) {
+    let loaded;
+    try {
+      loaded = loadCandidates(vault);
+      if (!Array.isArray(loaded)) throw new TypeError('candidate inventory must be an array');
+    } catch {
+      write(`${text.blocked}\n`);
+      return { status: 'blocked', decisions, skipped };
+    }
+    const candidates = loaded.filter((candidate) => !skippedIds.has(candidate.candidate_id));
+    if (first) {
+      sessionTotal = loaded.length;
+      write(`${text.title}\n${text.intro(loaded.length)}\n`);
+      if (loaded.length) write(`${text.categories}\n${groupLines(loaded, id).join('\n')}\n`);
+      first = false;
+    }
+    if (!loaded.length) {
+      write(`${decisions ? text.complete(decisions) : text.noConflicts}\n`);
+      return { status: 'complete', decisions, skipped };
+    }
+    if (!candidates.length) {
+      write(`${text.paused(decisions, skipped)}\n`);
+      return { status: 'paused', decisions, skipped };
+    }
+
+    const candidate = candidates[0];
+    if (decidedIds.has(candidate.candidate_id)) {
+      write(`${text.blocked}\n`);
+      return { status: 'blocked', decisions, skipped };
+    }
+    const completed = decisions + skipped;
+    const progressTotal = Math.max(sessionTotal, completed + candidates.length);
+    const progressIndex = completed + 1;
+    write(renderMemoryConflict(candidate, {
+      locale: id, index: progressIndex, total: progressTotal,
+    }));
+    const answer = String(await ask(text.choose)).trim().toLowerCase();
+
+    if (answer === 'q') {
+      write(`${text.paused(decisions, skipped)}\n`);
+      return { status: 'quit', decisions, skipped };
+    }
+    if (answer === 'p') {
+      skippedIds.add(candidate.candidate_id);
+      skipped += 1;
+      continue;
+    }
+    if (answer === 'd') {
+      write(renderMemoryConflict(candidate, {
+        locale: id, index: progressIndex, total: progressTotal, details: true,
+      }));
+      continue;
+    }
+
+    let decision;
+    let confirmation;
+    if (answer === 'r') {
+      decision = { action: 'reject', candidateId: candidate.candidate_id };
+      confirmation = await ask(text.confirmReject);
+    } else if (/^\d+$/.test(answer)) {
+      const eventIndex = Number(answer) - 1;
+      const selected = candidate.events[eventIndex];
+      if (!selected) {
+        write(`${text.invalid}\n`);
+        continue;
+      }
+      decision = {
+        action: 'promote', candidateId: candidate.candidate_id, eventId: selected.event_id,
+      };
+      confirmation = await ask(text.confirmPromote(eventIndex + 1));
+    } else {
+      write(`${text.invalid}\n`);
+      continue;
+    }
+
+    if (!isAffirmative(confirmation)) {
+      write(`${text.declined}\n`);
+      continue;
+    }
+
+    let result;
+    try {
+      result = decide(vault, decision);
+    } catch {
+      write(`${text.blocked}\n`);
+      return { status: 'blocked', decisions, skipped };
+    }
+    if (!result || !['promoted', 'rejected'].includes(result.status)) {
+      write(`${text.blocked}\n`);
+      return { status: 'blocked', decisions, skipped };
+    }
+    decisions += 1;
+    decidedIds.add(candidate.candidate_id);
+    write(`${result.status === 'promoted' ? text.promoted : text.rejected}\n`);
+  }
+}
+
+function usageError(message) {
+  const error = new Error(message);
+  error.code = 'WENDKEEP_MEMORY_CURATE_USAGE';
+  return error;
+}
+
+export function parseMemoryCurateArgs(argv) {
+  let vault = '';
+  let seenVault = false;
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (!token.startsWith('--')) throw usageError(`argumento posicional inesperado: ${token}.`);
+    const equalAt = token.indexOf('=');
+    const name = equalAt >= 0 ? token.slice(0, equalAt) : token;
+    if (name !== '--vault') throw usageError(`opção desconhecida: ${name}.`);
+    if (seenVault) throw usageError('--vault duplicado.');
+    const value = equalAt >= 0 ? token.slice(equalAt + 1) : argv[index + 1];
+    if (!value || !value.trim() || value.startsWith('--')) {
+      throw usageError('--vault requer valor não vazio que não comece com --.');
+    }
+    vault = value;
+    seenVault = true;
+    if (equalAt < 0) index += 1;
+  }
+  return { vault };
+}
+
+export async function runMemoryCurateCli(argv, {
+  input = process.stdin,
+  output = process.stdout,
+  error = process.stderr,
+  env = process.env,
+} = {}) {
+  let args;
+  try {
+    args = parseMemoryCurateArgs(argv);
+  } catch {
+    error.write(
+      'wendkeep memory curate: não foi possível abrir a curadoria com segurança. '
+      + 'Inspecione o estado com memory candidates --active e tente novamente.\n',
+    );
+    return 2;
+  }
+  const vault = args.vault || env.OBSIDIAN_VAULT_PATH;
+  if (!vault) {
+    error.write('wendkeep memory curate: passe --vault <path>.\n');
+    return 2;
+  }
+  if (!existsSync(vault)) {
+    error.write(`wendkeep memory curate: not found: ${vault}\n`);
+    return 2;
+  }
+  if (!input?.isTTY || !output?.isTTY) {
+    error.write(
+      `wendkeep memory curate requer terminal interativo (TTY). Inspecione sem alterar com: `
+      + `npx --no-install wendkeep memory candidates --active --vault "${vault}"\n`,
+    );
+    return 2;
+  }
+
+  const rl = createInterface({ input, output });
+  try {
+    const result = await runGuidedMemoryCuration(vault, {
+      locale: getLocale(vault).id,
+      ask: (question) => rl.question(question),
+      write: (value) => output.write(String(value)),
+    });
+    return result.status === 'blocked' ? 1 : 0;
+  } catch (cause) {
+    error.write(`wendkeep memory curate: ${cause.message}\n`);
+    return 1;
+  } finally {
+    rl.close();
+  }
+}

package/src/memory.mjs

@@ -237,6 +237,104 @@ function readCandidates(vault) {
     .split('\n').filter(Boolean).map((line) => JSON.parse(line));
 }
 
+const TERMINAL_CANDIDATE_STATUSES = new Set(['resolved', 'rejected', 'superseded']);
+
+function lexicalCompare(left, right) {
+  if (left < right) return -1;
+  if (left > right) return 1;
+  return 0;
+}
+
+function sanitizedCandidate(candidate, index) {
+  if (!candidate || typeof candidate !== 'object' || Array.isArray(candidate)) {
+    throw new Error(`MEMORY_CANDIDATES.jsonl: candidate ${index + 1} inválido.`);
+  }
+  const required = ['candidate_id', 'reason', 'memory_key'];
+  const missing = required.filter((field) => typeof candidate[field] !== 'string' || !candidate[field]);
+  if (missing.length) {
+    throw new Error(`MEMORY_CANDIDATES.jsonl: candidate ${index + 1} sem ${missing.join(', ')}.`);
+  }
+  if (candidate.status !== undefined && (typeof candidate.status !== 'string' || !candidate.status)) {
+    throw new Error(`MEMORY_CANDIDATES.jsonl: candidate ${index + 1} possui status inválido.`);
+  }
+  const eventIds = candidate.event_ids ?? [];
+  if (!Array.isArray(eventIds) || eventIds.some((eventId) => typeof eventId !== 'string' || !eventId)) {
+    throw new Error(`MEMORY_CANDIDATES.jsonl: candidate ${index + 1} possui event_ids inválidos.`);
+  }
+  return {
+    candidate_id: candidate.candidate_id,
+    reason: candidate.reason,
+    status: candidate.status || 'active',
+    memory_key: candidate.memory_key,
+    event_ids: [...eventIds].sort(lexicalCompare),
+  };
+}
+
+export function listMemoryCandidates(vault, { activeOnly = false } = {}) {
+  const candidates = readCandidates(vault)
+    .map(sanitizedCandidate)
+    .filter((candidate) => !activeOnly || !TERMINAL_CANDIDATE_STATUSES.has(candidate.status))
+    .sort((left, right) => lexicalCompare(left.memory_key, right.memory_key)
+      || lexicalCompare(left.candidate_id, right.candidate_id));
+  return { status: 'ok', candidates };
+}
+
+const CURATION_PREVIEW_CHARS = 160;
+
+function curationPreview(value) {
+  const normalized = sanitizeMemoryText(value).replace(/\s+/g, ' ').trim();
+  const visible = normalized || '(sem conteúdo)';
+  return visible.length <= CURATION_PREVIEW_CHARS
+    ? visible
+    : `${visible.slice(0, CURATION_PREVIEW_CHARS - 1).trimEnd()}…`;
+}
+
+function sanitizedCurationEvent(candidate, eventId, candidateIndex) {
+  const events = Array.isArray(candidate.events) ? candidate.events : [];
+  const event = events.find((item) => item?.event_id === eventId);
+  if (!event || typeof event !== 'object' || Array.isArray(event)) {
+    throw new Error(
+      `MEMORY_CANDIDATES.jsonl: candidate ${candidateIndex + 1} sem evento elegível.`,
+    );
+  }
+  const source = event.canonical_session_id
+    ? 'session'
+    : event.source_turn_id
+      ? 'turn'
+      : event.activation_id
+        ? 'activation'
+        : 'unknown';
+  return {
+    event_id: eventId,
+    observed_at: sanitizeMemoryText(event.observed_at || event.effective_at || ''),
+    source: sanitizeMemoryText(source),
+    preview: curationPreview(event.value),
+  };
+}
+
+export function listMemoryCandidatesForCuration(vault) {
+  return readCandidates(vault)
+    .map((candidate, index) => ({ candidate, index, safe: sanitizedCandidate(candidate, index) }))
+    .filter(({ safe }) => safe.reason === 'conflict'
+      && !TERMINAL_CANDIDATE_STATUSES.has(safe.status))
+    .map(({ candidate, index, safe }) => {
+      if (!safe.event_ids.length) {
+        throw new Error(
+          `MEMORY_CANDIDATES.jsonl: candidate ${index + 1} sem eventos elegíveis.`,
+        );
+      }
+      return {
+        candidate_id: safe.candidate_id,
+        reason: safe.reason,
+        status: safe.status,
+        memory_key: safe.memory_key,
+        events: safe.event_ids.map((eventId) => sanitizedCurationEvent(candidate, eventId, index)),
+      };
+    })
+    .sort((left, right) => lexicalCompare(left.memory_key, right.memory_key)
+      || lexicalCompare(left.candidate_id, right.candidate_id));
+}
+
 function priorCandidateDecision(vault, candidateId) {
   return readMemoryLedger(vault).events.find(
     (event) => event.candidate_decision?.candidate_id === candidateId,
@@ -1897,10 +1995,49 @@ function parseRecoverAttemptArgs(argv) {
   };
 }
 
+function parseCandidatesArgs(argv) {
+  const seen = new Set();
+  let activeOnly = false;
+  let vault = '';
+
+  for (let index = 1; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (!token.startsWith('--')) {
+      throw memoryUsageError(`memory candidates recebeu argumento posicional extra: ${token}.`);
+    }
+
+    const equalAt = token.indexOf('=');
+    const name = equalAt >= 0 ? token.slice(0, equalAt) : token;
+    if (name !== '--active' && name !== '--vault') {
+      throw memoryUsageError(`memory candidates recebeu opção desconhecida: ${name}.`);
+    }
+    if (seen.has(name)) {
+      throw memoryUsageError(`memory candidates recebeu opção duplicada: ${name}.`);
+    }
+    seen.add(name);
+
+    if (name === '--active') {
+      if (equalAt >= 0) throw memoryUsageError('--active não aceita valor.');
+      activeOnly = true;
+      continue;
+    }
+
+    const value = equalAt >= 0 ? token.slice(equalAt + 1) : argv[index + 1];
+    if (!value || !value.trim() || value.startsWith('--')) {
+      throw memoryUsageError('--vault requer valor não vazio que não comece com --.');
+    }
+    vault = value;
+    if (equalAt < 0) index += 1;
+  }
+
+  return { activeOnly, vault };
+}
+
 export function runMemory(argv) {
   const [sub, positional] = argv;
   let reconcileArgs = null;
   let recoverAttemptArgs = null;
+  let candidatesArgs = null;
   if (sub === 'reconcile') {
     try {
       reconcileArgs = parseReconcileArgs(argv);
@@ -1919,14 +2056,26 @@ export function runMemory(argv) {
       return;
     }
   }
+  if (sub === 'candidates') {
+    try {
+      candidatesArgs = parseCandidatesArgs(argv);
+    } catch (error) {
+      process.stderr.write(`wendkeep memory: ${error.message}\n`);
+      process.exitCode = error.code === 'WENDKEEP_MEMORY_USAGE' ? 2 : 1;
+      return;
+    }
+  }
   const vault = (
-    recoverAttemptArgs?.vault || reconcileArgs?.vault || option(argv, '--vault')
+    recoverAttemptArgs?.vault || reconcileArgs?.vault || candidatesArgs?.vault || option(argv, '--vault')
   ) || process.env.OBSIDIAN_VAULT_PATH;
   if (!vault) { process.stderr.write('wendkeep memory: passe --vault <path>.\n'); process.exitCode = 2; return; }
   if (!existsSync(vault)) { process.stderr.write(`wendkeep memory: not found: ${vault}\n`); process.exitCode = 2; return; }
   try {
     let result;
     if (sub === 'status') result = memoryStatus(vault);
+    else if (sub === 'candidates') {
+      result = listMemoryCandidates(vault, { activeOnly: candidatesArgs.activeOnly });
+    }
     else if (sub === 'migrate') result = migrateMemory(vault, { apply: argv.includes('--apply') });
     else if (sub === 'repair') result = repairMemory(vault);
     else if (sub === 'reconcile') {
@@ -1950,7 +2099,7 @@ export function runMemory(argv) {
         action: sub, candidateId: positional, ...(eventId ? { eventId } : {}),
       });
     }
-    else { process.stderr.write('wendkeep memory: use status | migrate [--apply] | repair | recover-attempt <session> [--apply] | reconcile <session> --by-session <session> --reason <text> [--apply] | promote <candidate> [--event <event-id>] | reject <candidate>.\n'); process.exitCode = 2; return; }
+    else { process.stderr.write('wendkeep memory: use status | candidates [--active] | migrate [--apply] | repair | recover-attempt <session> [--apply] | reconcile <session> --by-session <session> --reason <text> [--apply] | promote <candidate> [--event <event-id>] | reject <candidate>.\n'); process.exitCode = 2; return; }
     process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
     if (sub === 'status' && argv.includes('--gate')) process.exitCode = result.status === 'blocked' ? 1 : 0;
     else if (sub === 'reconcile' && reconcileArgs.apply) process.exitCode = result.health?.status === 'blocked' ? 1 : 0;