wendkeep 0.67.3 → 0.68.1

package/CHANGELOG.md

@@ -4,6 +4,39 @@ All notable changes to **wendkeep** are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.68.1] — 2026-08-08
+
+### Fixed
+
+- **A contenção de locks do Vault deixa de expor `VAULT_PATH_UNSAFE` no Windows.** A revalidação de
+  uma falha transiente de resolução do lock público passa a decidir por um walk fresco do
+  componente, e não pelo `errno` reportado pela plataforma. O Windows devolve `UNKNOWN`, `EBADF` ou
+  `EPERM` onde o Linux devolve `ENOENT`, então a guarda de retry nunca disparava lá e promoções FLOW
+  concorrentes falhavam de forma intermitente com o código de fronteira física em vez do conflito de
+  promoção. Sufixo ausente ou diretório canônico estabilizado autorizam o retry; junction, symlink,
+  reparse point, componente redirecionado ou estado irresolvível persistente continuam falhando
+  fechado, e o orçamento de retry permanece único e limitado por aquisição.
+- **Falha de lock nos caminhos FLOW reporta o código do domínio.** `withFlowPromotionLock` e o store
+  de sessão passam a propagar `FLOW_VAULT_BOUNDARY` para a fronteira física, alinhando a superfície
+  de erro ao resto da saga de promoção.
+
+## [0.68.0] — 2026-08-02
+
+### Added
+
+- **Curadoria de memória agora tem um assistente interativo para pessoas.** O novo
+  `memory curate --vault <vault>` agrupa conflitos por nomes amigáveis, exibe somente previews
+  sanitizados e guia promoção, rejeição, pulo ou saída com confirmação negativa por padrão. O
+  trabalho restante pode ser retomado em outra execução; ambientes não-TTY recebem o fallback
+  seguro `memory candidates --active` e nenhuma escrita implícita.
+
+### Changed
+
+- **O `doctor` apresenta integridade e conflitos de memória em formato humano.** A saída principal
+  usa seções e categorias amigáveis e recomenda primeiro o assistente guiado, enquanto o hook de
+  health preserva seu contrato JSON para automações. O diagnóstico continua somente leitura e
+  `memory repair` continua estritamente estrutural, sem escolher vencedores semânticos.
+
 ## [0.67.3] — 2026-08-02
 
 ### Fixed

package/README.en.md

@@ -369,8 +369,11 @@ backup/audit; divergent mirrors fail closed. A demonstrably superseded
 ambiguity uses `memory reconcile <session> --by-session <successor>
 --reason <reason>` as a dry run and requires `--apply`; the decision is backed up and audited
 without rewriting ledger, CORE, or notes. Run `status --gate` again afterwards. Conflicts require
-explicit, durable curation: `memory candidates --active --vault <vault>` lists only safe IDs and
-metadata in read-only mode — it does not expose memory values or content. After human review,
+explicit, durable curation. Start with `memory curate --vault <vault>`: the menu groups conflicts
+under friendly names, shows sanitized previews, and confirms every write with default `no`. Skip
+or quit and run it again to resume. In a non-TTY environment, use
+`memory candidates --active --vault <vault>` to list only safe IDs and metadata in read-only mode —
+it does not expose memory values or content. After human review,
 `memory promote <id> --event <event-id>` selects one event from the candidate, while
 `memory reject <id>` keeps the current value. `memory repair` does not choose a winner. The decision is idempotent, and a
 new promotion accepts a later Stop from the same session/activation without recreating a conflict.
@@ -381,7 +384,10 @@ superseded. Repair migrates the checkpoint and mirror only when it proves the ex
 replay, attempt identity, and absence of a real conflict; it creates a backup and audit without
 appending or rewriting events. Ambiguity stays queued for explicit curation. Do not publish or
 install 0.66.2; use 0.66.3 or later. Decisions survive repair/replay;
-`blocked_by_core` cannot override CORE. Doctor only diagnoses. When status/doctor reports projected
+`blocked_by_core` cannot override CORE. Doctor only diagnoses, now with human-readable output and
+the guided next action; its health hook preserves JSON for automation. A missing Vault or unsafe
+boundary/registry also yields blocked memory, a safe command with the resolved path, and structured
+JSON—never a false “intact bundle” or a stack trace. When status/doctor reports projected
 acknowledgement pending on 0.66.4 or later, first run the targeted dry run
 `memory recover-attempt <session> --vault <vault>`, then authorize `--apply`; it changes only
 registry/checkpoint. See syntax, preconditions, and fail-closed behavior in

package/README.md

@@ -369,8 +369,11 @@ backup/audit; divergent mirrors fail closed. A demonstrably superseded
 ambiguity uses `memory reconcile <session> --by-session <successor>
 --reason <reason>` as a dry run and requires `--apply`; the decision is backed up and audited
 without rewriting ledger, CORE, or notes. Run `status --gate` again afterwards. Conflicts require
-explicit, durable curation: `memory candidates --active --vault <vault>` lists only safe IDs and
-metadata in read-only mode — it does not expose memory values or content. After human review,
+explicit, durable curation. Start with `memory curate --vault <vault>`: the menu groups conflicts
+under friendly names, shows sanitized previews, and confirms every write with default `no`. Skip
+or quit and run it again to resume. In a non-TTY environment, use
+`memory candidates --active --vault <vault>` to list only safe IDs and metadata in read-only mode —
+it does not expose memory values or content. After human review,
 `memory promote <id> --event <event-id>` selects one event from the candidate, while
 `memory reject <id>` keeps the current value. `memory repair` does not choose a winner. The decision is idempotent, and a
 new promotion accepts a later Stop from the same session/activation without recreating a conflict.
@@ -381,7 +384,10 @@ superseded. Repair migrates the checkpoint and mirror only when it proves the ex
 replay, attempt identity, and absence of a real conflict; it creates a backup and audit without
 appending or rewriting events. Ambiguity stays queued for explicit curation. Do not publish or
 install 0.66.2; use 0.66.3 or later. Decisions survive repair/replay;
-`blocked_by_core` cannot override CORE. Doctor only diagnoses. When status/doctor reports projected
+`blocked_by_core` cannot override CORE. Doctor only diagnoses, now with human-readable output and
+the guided next action; its health hook preserves JSON for automation. A missing Vault or unsafe
+boundary/registry also yields blocked memory, a safe command with the resolved path, and structured
+JSON—never a false “intact bundle” or a stack trace. When status/doctor reports projected
 acknowledgement pending on 0.66.4 or later, first run the targeted dry run
 `memory recover-attempt <session> --vault <vault>`, then authorize `--apply`; it changes only
 registry/checkpoint. See syntax, preconditions, and fail-closed behavior in

package/docs/en/commands/maintenance-and-diagnostics.md

@@ -24,6 +24,7 @@ Run from the project root or provide `--project` and `--vault` explicitly.
 
 ```bash
 npx --no-install wendkeep doctor [--vault <vault>]
+npx --no-install wendkeep memory curate --vault <vault>
 npx --no-install wendkeep sync-defs [--check|--reseed] --vault <vault> --project <root>
 npx --no-install wendkeep theme sync --vault <vault>
 npx --no-install wendkeep --version
@@ -33,6 +34,12 @@ npx --no-install wendkeep --help
 ## Options and exit codes
 
 - `doctor` is read-only; exit `0` accepts recoverable warnings, while non-zero means failure.
+- `doctor` uses human-readable output with `[integrity]` and `[memory]` sections, friendly
+  categories, and a copyable next action. The `vault-health.mjs` hook remains the JSON surface for
+  automation; neither surface applies curation.
+- Even with a missing Vault, unsafe physical boundary, or unsafe registry, `doctor` marks memory as
+  blocked and shows `memory status --gate` with the resolved path; the hook preserves structured
+  JSON instead of replacing the result with stderr or a stack trace.
 - In v2, `doctor`/`memory status --gate` correlate `last_memory_attempt` (mode, disposition, event
   IDs, and checkpoint) with outbox, ledger, and SHARED; they do not infer health from revision alone.
 - `revision: 0` after a valid migration, with no v2 attempt, is healthy. A `degraded` attempt whose
@@ -57,6 +64,7 @@ npx --no-install wendkeep --version
 npx --no-install wendkeep sync-defs --check --vault .MyApp-vault --project .
 npx --no-install wendkeep doctor --vault .MyApp-vault
 npx --no-install wendkeep memory status --gate --vault .MyApp-vault
+npx --no-install wendkeep memory curate --vault .MyApp-vault
 npx --no-install wendkeep memory candidates --active --vault .MyApp-vault
 npx --no-install wendkeep cost rebuild --session <id> --json --vault .MyApp-vault
 npx --no-install wendkeep cost rebuild --session <id> --json --vault .MyApp-vault --apply
@@ -83,7 +91,9 @@ dry-run path before any write.
   outbox, and SHARED so `last_memory_attempt` can be correlated before repair.
 - Corrupt bundle: preserve evidence and run `memory status --gate` before `memory repair`.
 - An active semantic conflict requires a human decision: `memory repair` does not choose a winner.
-  List safe IDs with `memory candidates --active --vault <vault>`, review the evidence, and then use
+  Start with the guided menu `memory curate --vault <vault>`. For advanced inspection or a
+  non-interactive terminal, list safe IDs with `memory candidates --active --vault <vault>`, review
+  the evidence, and then use
   `memory promote <candidate-id> --event <event-id> --vault <vault>` to select an event or
   `memory reject <candidate-id> --vault <vault>` to keep the current operational value.
 - `legacy`/`degraded`/`stale`/`manifest-unproven` observability: run

package/docs/en/commands/memory.md

@@ -24,12 +24,13 @@ Pass the vault explicitly in automation. Preserve backups and evidence before re
 
 ```bash
 npx wendkeep memory status [--gate] --vault <vault>
+npx wendkeep memory curate --vault <vault>
 npx wendkeep memory candidates [--active] --vault <vault>
 npx wendkeep memory repair --vault <vault>
 npx wendkeep memory recover-attempt <session> [--apply] --vault <vault>
 npx wendkeep memory reconcile <ambiguous-session> --by-session <successor-session> --reason <reason> [--apply] --vault <vault>
-npx wendkeep memory promote <candidate> [--event <event-id>] --vault <vault>
-npx wendkeep memory reject <candidate> --vault <vault>
+npx wendkeep memory promote <candidate-id> [--event <event-id>] --vault <vault>
+npx wendkeep memory reject <candidate-id> --vault <vault>
 npx wendkeep validate-memory [CORE-path]
 npx wendkeep validate-memory --vault <v2-vault>
 ```
@@ -37,6 +38,14 @@ npx wendkeep validate-memory --vault <v2-vault>
 ## Options and exit codes
 
 - `memory status` is read-only; `--gate` exits `1` only for blocking state.
+- `memory curate` is the recommended human path: in an interactive terminal it groups each
+  conflict under a friendly name, shows sanitized previews only, and offers numbered choices,
+  `P` to skip, `R` to reject, `D` for technical details, and `Q` to quit. Every promotion or
+  rejection asks for confirmation with default `no`: Enter or `N` does not write. Skip or quit
+  leaves the remaining work pending; running the command again resumes the active conflicts.
+- The assistant accepts only `--vault`: there is no `--yes`, `--apply`, or batch mode. In a
+  non-TTY environment it exits `2` without changing bytes and recommends the advanced fallback
+  `memory candidates --active`.
 - `memory candidates` is read-only and prints deterministic JSON containing only `candidate_id`,
   `reason`, `status`, `memory_key`, and `event_ids`; it does not expose memory values or content and
   does not create a lock or mutate the bundle. `--active` omits terminal candidates (`resolved`,
@@ -89,8 +98,9 @@ npx wendkeep validate-memory --vault <v2-vault>
   the lease they acquired.
 - `promote`/`reject` append an auditable, idempotent decision to the ledger. Replay and repair
   preserve that decision and do not recreate the resolved candidate. For a `conflict` candidate,
-  `promote` requires an `--event <event-id>` that belongs to the candidate; date or random ID
-  never picks an implicit winner. `reject` preserves the current operational value. A
+  use `memory promote <candidate-id> --event <event-id>` with an event that belongs to the
+  candidate; date or random ID never picks an implicit winner. `reject` preserves the current
+  operational value. A
   `blocked_by_core` candidate can only be rejected: promotion first requires canonical CORE
   curation. If the selected event still belongs to the matching latest `projected` attempt,
   promotion also refreshes its checkpoint and mirror causally; JSON reports
@@ -113,6 +123,7 @@ npx wendkeep validate-memory --vault <v2-vault>
 
 ```bash
 npx wendkeep memory status --gate --vault .MyApp-vault
+npx wendkeep memory curate --vault .MyApp-vault
 npx wendkeep memory candidates --active --vault .MyApp-vault
 npx wendkeep memory recover-attempt session-123 --vault .MyApp-vault
 npx wendkeep memory recover-attempt session-123 --apply --vault .MyApp-vault

package/docs/pt-BR/commands/maintenance-and-diagnostics.md

@@ -24,6 +24,7 @@ Execute na raiz do projeto ou informe `--project`/`--vault` explicitamente.
 
 ```bash
 npx --no-install wendkeep doctor [--vault <cofre>]
+npx --no-install wendkeep memory curate --vault <cofre>
 npx --no-install wendkeep sync-defs [--check|--reseed] --vault <cofre> --project <raiz>
 npx --no-install wendkeep theme sync --vault <cofre>
 npx --no-install wendkeep --version
@@ -33,6 +34,12 @@ npx --no-install wendkeep --help
 ## Opções e códigos de saída
 
 - `doctor` é read-only; exit `0` aceita warnings recuperáveis e exit não zero indica falha.
+- O `doctor` usa saída em formato humano, com blocos `[integridade]` e `[memória]`, categorias
+  amigáveis e uma próxima ação copiável. O hook `vault-health.mjs` continua sendo a superfície JSON
+  para automações; nenhum dos dois aplica curadoria.
+- Mesmo com Vault ausente, boundary física insegura ou registry inseguro, o `doctor` marca a memória
+  como bloqueada e mostra `memory status --gate` com o caminho resolvido; o hook preserva JSON
+  estruturado em vez de substituir o resultado por stderr ou stack trace.
 - Em v2, `doctor`/`memory status --gate` correlacionam `last_memory_attempt` (mode, disposition,
   event IDs e checkpoint) com outbox, ledger e SHARED; não inferem saúde só pela revision atual.
 - `revision: 0` após migração válida, sem attempt v2, é saudável. Attempt `degraded` cujos eventos
@@ -57,6 +64,7 @@ npx --no-install wendkeep --version
 npx --no-install wendkeep sync-defs --check --vault .MeuApp-vault --project .
 npx --no-install wendkeep doctor --vault .MeuApp-vault
 npx --no-install wendkeep memory status --gate --vault .MeuApp-vault
+npx --no-install wendkeep memory curate --vault .MeuApp-vault
 npx --no-install wendkeep memory candidates --active --vault .MeuApp-vault
 npx --no-install wendkeep cost rebuild --session <id> --json --vault .MeuApp-vault
 npx --no-install wendkeep cost rebuild --session <id> --json --vault .MeuApp-vault --apply
@@ -82,8 +90,9 @@ ou sem manifest comprovado e oferece um caminho dry-run antes de qualquer escrit
 - `ambiguous`, publicação perdida ou checkpoint divergente: bloqueante; preserve registry, ledger,
   outbox e SHARED para correlacionar `last_memory_attempt` antes de reparar.
 - Bundle corrompido: preserve a evidência e use `memory status --gate` antes de `memory repair`.
-- Conflito semântico ativo exige decisão humana: `memory repair` não escolhe vencedor. Liste os IDs
-  seguros com `memory candidates --active --vault <cofre>`, revise a evidência e então use
+- Conflito semântico ativo exige decisão humana: `memory repair` não escolhe vencedor. Comece pelo
+  menu guiado `memory curate --vault <cofre>`. Para inspeção avançada ou terminal não interativo,
+  liste os IDs seguros com `memory candidates --active --vault <cofre>`, revise a evidência e use
   `memory promote <candidate-id> --event <event-id> --vault <cofre>` para selecionar um evento ou
   `memory reject <candidate-id> --vault <cofre>` para manter o valor operacional atual.
 - Observabilidade `legacy`/`degraded`/`stale`/`manifest-unproven`: rode

package/docs/pt-BR/commands/memory.md

@@ -24,12 +24,13 @@ Informe o vault explicitamente em automações. Preserve backups e evidências a
 
 ```bash
 npx wendkeep memory status [--gate] --vault <cofre>
+npx wendkeep memory curate --vault <cofre>
 npx wendkeep memory candidates [--active] --vault <cofre>
 npx wendkeep memory repair --vault <cofre>
 npx wendkeep memory recover-attempt <sessão> [--apply] --vault <cofre>
 npx wendkeep memory reconcile <sessão-ambígua> --by-session <sessão-sucessora> --reason <motivo> [--apply] --vault <cofre>
-npx wendkeep memory promote <candidate> [--event <event-id>] --vault <cofre>
-npx wendkeep memory reject <candidate> --vault <cofre>
+npx wendkeep memory promote <candidate-id> [--event <event-id>] --vault <cofre>
+npx wendkeep memory reject <candidate-id> --vault <cofre>
 npx wendkeep validate-memory [caminho-do-CORE]
 npx wendkeep validate-memory --vault <cofre-v2>
 ```
@@ -37,6 +38,14 @@ npx wendkeep validate-memory --vault <cofre-v2>
 ## Opções e códigos de saída
 
 - `memory status` é read-only; `--gate` retorna exit `1` apenas para estado bloqueante.
+- `memory curate` é o caminho recomendado para pessoas: em um terminal interativo, agrupa cada
+  conflito por nome amigável, mostra somente previews sanitizados e oferece escolhas numeradas,
+  `P` para pular, `R` para rejeitar, `D` para detalhes técnicos e `Q` para sair. Cada promoção ou
+  rejeição pede confirmação com padrão negativo: Enter ou `N` não grava. Pular ou sair deixa o
+  restante pendente; uma nova execução retoma os conflitos ainda ativos.
+- O assistente aceita somente `--vault`: não há `--yes`, `--apply` ou modo em lote. Em ambiente
+  não-TTY/terminal não interativo, ele retorna exit `2` sem alterar bytes e orienta usar o fallback
+  avançado `memory candidates --active`.
 - `memory candidates` é read-only e imprime JSON determinístico com somente `candidate_id`,
   `reason`, `status`, `memory_key` e `event_ids`; não expõe valores nem conteúdo da memória e não
   cria lock nem altera o bundle. `--active` omite candidates terminais (`resolved`, `rejected` e
@@ -87,8 +96,9 @@ npx wendkeep validate-memory --vault <cofre-v2>
   symlink, reparse point ou hardlink falham fechados sem tocar bytes externos. Locks publicam owner
   e lease atomicamente, não colhem PID vivo apenas por idade e só liberam a lease adquirida.
 - `promote`/`reject` acrescentam uma decisão auditável e idempotente ao ledger. Replay e repair
-  preservam a decisão e não recriam o candidate resolvido. Para candidate `conflict`, `promote`
-  exige `--event <event-id>` pertencente ao candidate; não há vencedor implícito por data ou ID.
+  preservam a decisão e não recriam o candidate resolvido. Para candidate `conflict`, use
+  `memory promote <candidate-id> --event <event-id>` com um evento pertencente ao candidate; não há
+  vencedor implícito por data ou ID.
   `reject` preserva o valor operacional atual. Candidate `blocked_by_core` só pode ser rejeitado:
   promover exige antes alterar CORE pela curadoria canônica. Se o evento escolhido ainda pertence
   ao último attempt `projected` correspondente, a promoção também atualiza causalmente checkpoint
@@ -111,6 +121,7 @@ npx wendkeep validate-memory --vault <cofre-v2>
 
 ```bash
 npx wendkeep memory status --gate --vault .MeuApp-vault
+npx wendkeep memory curate --vault .MeuApp-vault
 npx wendkeep memory candidates --active --vault .MeuApp-vault
 npx wendkeep memory recover-attempt sessao-123 --vault .MeuApp-vault
 npx wendkeep memory recover-attempt sessao-123 --apply --vault .MeuApp-vault

package/hooks/vault-health.mjs

@@ -112,13 +112,29 @@ const memoryMigrateCommand = (vaultBase) => (
 const memoryCandidatesCommand = (vaultBase) => (
   `${WENDKEEP_COMMAND} memory candidates --active --vault ${quoteCommandArgument(vaultBase)}`
 );
-const memoryPromoteCommand = (vaultBase) => (
-  `${WENDKEEP_COMMAND} memory promote <candidate-id> --event <event-id> --vault ${quoteCommandArgument(vaultBase)}`
-);
-const memoryRejectCommand = (vaultBase) => (
-  `${WENDKEEP_COMMAND} memory reject <candidate-id> --vault ${quoteCommandArgument(vaultBase)}`
+const memoryCurateCommand = (vaultBase) => (
+  `${WENDKEEP_COMMAND} memory curate --vault ${quoteCommandArgument(vaultBase)}`
 );
 
+const MEMORY_KEY_PURPOSES = new Map([
+  ['handoff.latest', 'próximo handoff'],
+  ['quality.latest-sensors', 'sensores de qualidade'],
+  ['quality.latest-verdict', 'veredito de qualidade'],
+  ['git.local-head', 'commit local conhecido'],
+]);
+
+function groupConflictPurposes(conflicts) {
+  const counts = new Map();
+  for (const conflict of conflicts) {
+    const key = String(conflict?.memory_key || '').trim();
+    const label = MEMORY_KEY_PURPOSES.get(key) || (key ? `outras memórias (${key})` : 'outras memórias');
+    counts.set(label, (counts.get(label) || 0) + 1);
+  }
+  return [...counts.entries()]
+    .sort(([left], [right]) => left.localeCompare(right))
+    .map(([label, count]) => `${label}: ${count}`);
+}
+
 function readJsonLines(vaultBase, path, label) {
   let checked;
   try {
@@ -218,11 +234,11 @@ function memoryMetrics() {
   };
 }
 
-function blockedMemoryBoundary(error) {
+function blockedMemoryBoundary(error, vaultBase) {
   return {
     ok: false,
     status: 'blocked',
-    failures: [`Boundary física da memória insegura: ${error?.message || error}`],
+    failures: [`Boundary física da memória insegura: ${error?.message || error}. Inspecione com: ${memoryStatusCommand(vaultBase)}.`],
     warnings: [],
     metrics: memoryMetrics(),
   };
@@ -393,17 +409,17 @@ export function checkMemoryBundle(vaultBase, { registry } = {}) {
     return {
       ok: false,
       status: 'blocked',
-      failures: [`Vault not found: ${vaultBase}`],
+      failures: [`Vault not found: ${vaultBase}. Inspecione com: ${memoryStatusCommand(vaultBase)}.`],
       warnings: [],
       metrics: memoryMetrics(),
     };
   }
   try { preflightMemoryBundle(vaultBase); }
-  catch (error) { return blockedMemoryBoundary(error); }
+  catch (error) { return blockedMemoryBoundary(error, vaultBase); }
   const brain = join(vaultBase, '.brain');
   let mode;
   try { mode = detectMemoryMode(vaultBase); }
-  catch (error) { return blockedMemoryBoundary(error); }
+  catch (error) { return blockedMemoryBoundary(error, vaultBase); }
   if (mode.mode === 'legacy') {
     return {
       ok: true,
@@ -463,7 +479,7 @@ export function checkMemoryBundle(vaultBase, { registry } = {}) {
   let effectiveRegistry = registry;
   if (!effectiveRegistry) {
     try { effectiveRegistry = readSessionRegistry(vaultBase); }
-    catch (error) { failures.push(`SESSION_REGISTRY.json inseguro ou ilegível: ${error?.message || error}.`); }
+    catch (error) { failures.push(`SESSION_REGISTRY.json inseguro ou ilegível: ${error?.message || error}. Inspecione com: ${memoryStatusCommand(vaultBase)}.`); }
   }
   const lifecycle = checkMemoryAttempts(effectiveRegistry || { version: 2, sessions: {} }, {
     vaultBase,
@@ -478,12 +494,11 @@ export function checkMemoryBundle(vaultBase, { registry } = {}) {
   const activeConflicts = unresolved.filter((item) => item?.reason === 'conflict');
   const ordinaryCandidates = unresolved.filter((item) => item?.reason !== 'conflict');
   if (activeConflicts.length) {
-    const keys = [...new Set(activeConflicts.map((item) => item.memory_key || item.candidate_id))]
-      .sort((left, right) => String(left).localeCompare(String(right)));
     const label = activeConflicts.length === 1
       ? '1 conflito ativo'
       : `${activeConflicts.length} conflitos ativos`;
-    failures.push(`${label} em chave operacional (${keys.join(', ')}). Conflito semântico exige curadoria humana; memory repair não escolhe vencedor. Liste IDs seguros com: ${memoryCandidatesCommand(vaultBase)}. Depois da revisão, use ${memoryPromoteCommand(vaultBase)} ou ${memoryRejectCommand(vaultBase)}.`);
+    const purposes = groupConflictPurposes(activeConflicts).join('; ');
+    failures.push(`${label} (${purposes}). Existem versões concorrentes e nenhum dado foi escolhido automaticamente. Conflito semântico exige curadoria humana; memory repair não escolhe vencedor. Próximo passo: ${memoryCurateCommand(vaultBase)}. Inventário avançado: ${memoryCandidatesCommand(vaultBase)}.`);
   }
   if (outbox.count) warnings.push(`${outbox.count} evento(s) pendente(s) na outbox; execute o projector quando seguro.`);
   if (ordinaryCandidates.length) warnings.push(`${ordinaryCandidates.length} candidate(s) aguardando curadoria humana.`);
@@ -562,8 +577,49 @@ function checkSession({ vaultBase, sessionRel, control, registry }) {
 }
 
 export function runVaultHealth({ vaultBase, session = '' }) {
-  const control = readControl(vaultBase);
-  const registry = readSessionRegistry(vaultBase);
+  const memoryMarkers = [
+    join(vaultBase, '.brain', 'SHARED_MEMORY.md'),
+    join(vaultBase, '.brain', 'MEMORY_EVENTS.jsonl'),
+    join(vaultBase, '.brain', 'MEMORY_CANDIDATES.jsonl'),
+    join(vaultBase, '.brain', 'memory-outbox'),
+  ];
+  const memory = !existsSync(vaultBase) || memoryMarkers.some((path) => existsSync(path))
+    ? checkMemoryBundle(vaultBase)
+    : {
+      ok: true,
+      status: 'legacy',
+      failures: [],
+      warnings: [`Bundle de memória v2 ausente (vault legado); inspecione com: ${memoryStatusCommand(vaultBase)}.`],
+      metrics: {},
+    };
+
+  let control = {};
+  let registry = { version: 2, sessions: {} };
+  const contextErrors = [];
+  try { control = readControl(vaultBase); }
+  catch (error) { contextErrors.push(error?.message || String(error)); }
+  try { registry = readSessionRegistry(vaultBase); }
+  catch (error) { contextErrors.push(error?.message || String(error)); }
+
+  if (contextErrors.length) {
+    const failures = [
+      `Validação de sessão e artefatos indisponível com segurança: ${contextErrors.join('; ')}. Inspecione com: ${memoryStatusCommand(vaultBase)}.`,
+      ...memory.failures.map((item) => `Memória: ${item}`),
+    ];
+    return {
+      ok: false,
+      session,
+      failures,
+      warnings: memory.warnings.map((item) => `Memória: ${item}`),
+      metrics: {
+        registrySessions: 0,
+        derivedNotes: 0,
+        memory: memory.metrics,
+      },
+      memoryStatus: memory.status,
+    };
+  }
+
   const sessionRel = session || control.session_file || control.last_session_file || '';
   const failures = [];
   const warnings = [];
@@ -596,20 +652,8 @@ export function runVaultHealth({ vaultBase, session = '' }) {
     return total + (existsSync(dir) ? listMarkdownFiles(dir).length : 0);
   }, 0);
 
-  const memoryMarkers = [
-    join(vaultBase, '.brain', 'SHARED_MEMORY.md'),
-    join(vaultBase, '.brain', 'MEMORY_EVENTS.jsonl'),
-    join(vaultBase, '.brain', 'MEMORY_CANDIDATES.jsonl'),
-    join(vaultBase, '.brain', 'memory-outbox'),
-  ];
-  let memory = { status: 'legacy', metrics: {} };
-  if (memoryMarkers.some((path) => existsSync(path))) {
-    memory = checkMemoryBundle(vaultBase, { registry });
-    failures.push(...memory.failures.map((item) => `Memória: ${item}`));
-    warnings.push(...memory.warnings.map((item) => `Memória: ${item}`));
-  } else {
-    warnings.push(`Bundle de memória v2 ausente (vault legado); inspecione com: ${memoryStatusCommand(vaultBase)}.`);
-  }
+  failures.push(...memory.failures.map((item) => `Memória: ${item}`));
+  warnings.push(...memory.warnings.map((item) => `Memória: ${item}`));
 
   return {
     ok: failures.length === 0,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wendkeep",
-  "version": "0.67.3",
+  "version": "0.68.1",
   "description": "Vault-first persistent memory for AI coding agents, with an optional profile-aware governance runtime: OFF, FLOW, GUIDE, GOVERN, or ASSURE. Local-first and agent-agnostic (Claude Code, Codex, Cursor…).",
   "type": "module",
   "workspaces": [
@@ -70,6 +70,6 @@
   },
   "devDependencies": {
     "acorn": "^8.18.0",
-    "wendkeep": "^0.67.2"
+    "wendkeep": "^0.68.0"
   }
 }

package/packages/cli/src/index.mjs

@@ -99,7 +99,9 @@ Usage:
                            in session notes from the linked derived notes — the body used to lag
                            behind the closing block. Dry-run by default · --apply · --json.
   wendkeep lesson add "t" "l"   Record a project-local lesson (injected at SessionStart).
-  wendkeep memory <sub>          Shared memory v2: status | candidates [--active] | migrate [--apply] | repair |
+  wendkeep memory curate         Guide one semantic conflict at a time in an interactive terminal.
+                           Every promote/reject requires confirmation; --vault P.
+  wendkeep memory <sub>          Shared memory v2: status | candidates [--active] | curate | migrate [--apply] | repair |
                            recover-attempt <session> [--apply] |
                            reconcile <session> --by-session <session> --reason <text> [--apply] |
                            promote <candidate> [--event <event-id>] | reject <candidate>. --vault P.
@@ -230,8 +232,13 @@ async function main(argv) {
       break;
     }
     case 'memory': {
-      const { runMemory } = await import('../../../src/memory.mjs');
-      runMemory(rest);
+      if (rest[0] === 'curate') {
+        const { runMemoryCurateCli } = await import('../../../src/memory-curate.mjs');
+        process.exitCode = await runMemoryCurateCli(rest.slice(1));
+      } else {
+        const { runMemory } = await import('../../../src/memory.mjs');
+        runMemory(rest);
+      }
       break;
     }
     case 'sync-defs': {

package/packages/harness/src/flow-store.mjs

@@ -84,10 +84,16 @@ function immutableJson(vaultBase, path, value) {
   return { created: true, path };
 }
 
+// Lock failures on the FLOW paths surface with the domain boundary code, like every other
+// Vault write in the promotion saga — not with the physical-boundary default.
 function underSessionLock(vaultBase, sessionId, fn) {
   const root = sessionRoot(vaultBase, sessionId);
-  mkdirVaultPath(vaultBase, root, { label: 'raiz runtime da sessão FLOW' });
-  const outcome = withVaultPathLock(vaultBase, join(root, '.state'), fn, { timeoutMs: 5000 });
+  mkdirVaultPath(vaultBase, root, {
+    label: 'raiz runtime da sessão FLOW', code: 'FLOW_VAULT_BOUNDARY',
+  });
+  const outcome = withVaultPathLock(vaultBase, join(root, '.state'), fn, {
+    timeoutMs: 5000, code: 'FLOW_VAULT_BOUNDARY',
+  });
   if (typeof outcome === 'symbol') {
     const error = new Error(`store FLOW ocupado para sessão ${sessionId}`);
     error.code = 'FLOW_STORE_BUSY';
@@ -107,10 +113,13 @@ export function withFlowPromotionLock(vaultBase, changeSlug, fn, {
 } = {}) {
   const slug = safeId(changeSlug, 'change_slug');
   const root = join(vaultBase, '.brain', 'runtime', 'flow-promotion-locks');
-  mkdirVaultPath(vaultBase, root, { label: 'raiz de locks de promoção FLOW' });
+  mkdirVaultPath(vaultBase, root, {
+    label: 'raiz de locks de promoção FLOW', code: 'FLOW_VAULT_BOUNDARY',
+  });
   const outcome = withVaultPathLock(vaultBase, join(root, slug), fn, {
     timeoutMs,
     staleMs: ownerGraceMs,
+    code: 'FLOW_VAULT_BOUNDARY',
   });
   if (outcome === VAULT_LOCK_BUSY) {
     const busy = new Error(`promoção FLOW ocupada para a change ${slug}`);

package/packages/vault/src/vault-path-safety.mjs

@@ -335,19 +335,36 @@ function waitBriefly(ms) {
   Atomics.wait(signal, 0, 0, ms);
 }
 
-// A public lock may legitimately disappear while another owner releases it. Only ENOENT
-// observed by an operation explicitly scoped to that canonical lock receives bounded
-// backoff; private .pending paths and every unsafe topology fail closed.
-function retryablePublicLockError(lock, error, code, { allowRaw = true } = {}) {
+// A public lock may legitimately disappear while another owner releases it. Structural shape
+// only: which errno a concurrent removal produces is a platform detail — Windows reports
+// UNKNOWN, EBADF or EPERM where Linux reports ENOENT — so the code is merely the trigger to go
+// re-observe, never the answer. Private .pending paths are siblings, not descendants, of the
+// canonical lock and are excluded by the containment check.
+function publicLockRetryCandidate(lock, error, code, { allowRaw = true } = {}) {
   const failure = error?.[VAULT_PATH_FAILURE];
+  // A raw error carries no component to re-observe, so it stays on the narrow ENOENT path.
   if (!failure) return allowRaw && error?.code === 'ENOENT' && !error?.cause;
-  const causeCode = error?.cause?.code || failure.causeCode;
-  return causeCode === 'ENOENT'
-    && (error?.code === code || error?.code === 'VAULT_PATH_UNSAFE')
+  return (error?.code === code || error?.code === 'VAULT_PATH_UNSAFE')
     && ['component-realpath', 'component-missing'].includes(failure.kind)
     && containedBy(resolve(lock), resolve(failure.component));
 }
 
+// The decision itself. Only a fresh walk that settles as a missing suffix or the canonical
+// entry authorizes a retry; junction, symlink, reparse, a redirected component or a state that
+// is still unresolvable keeps failing closed, exactly as a first-time validation would.
+function publicLockComponentSettled(vaultBase, error, code) {
+  const component = error?.[VAULT_PATH_FAILURE]?.component;
+  if (typeof component !== 'string' || !component) return false;
+  try {
+    assertVaultPathSafe(vaultBase, component, {
+      label: 'revalidação do lock de escrita do Vault', code,
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 function vaultLockRenameCollision(error, pending, lock) {
   const acceptedCodes = process.platform === 'win32'
     ? ['EEXIST', 'ENOTEMPTY', 'EPERM']
@@ -374,17 +391,22 @@ function vaultLockRetryDeadlineError() {
   return error;
 }
 
-function withPublicLockRetry(lock, code, retryState, operation, initialError = null) {
+function withPublicLockRetry(vaultBase, lock, code, retryState, operation, initialError = null) {
   let error = initialError;
   while (true) {
     if (error) {
-      if (!retryablePublicLockError(lock, error, code)
+      if (!publicLockRetryCandidate(lock, error, code)
         || retryState.remaining <= 0) throw error;
       const remainingMs = retryState.deadline - Date.now();
       if (remainingMs <= 0) throw vaultLockRetryDeadlineError();
       retryState.remaining -= 1;
       waitBriefly(Math.min(VAULT_LOCK_TOPOLOGY_RETRY_MS, remainingMs));
       if (Date.now() >= retryState.deadline) throw vaultLockRetryDeadlineError();
+      // Reclassify only after the backoff, and only while the deadline still allows a retry:
+      // "settled" means observed once the concurrent owner had a chance to finish releasing.
+      // A raw error carries no component and already passed the narrow ENOENT filter above.
+      if (error[VAULT_PATH_FAILURE]
+        && !publicLockComponentSettled(vaultBase, error, code)) throw error;
     }
     try {
       return operation();
@@ -395,9 +417,11 @@ function withPublicLockRetry(lock, code, retryState, operation, initialError = n
 }
 
 function inspectVaultLock(vaultBase, lock, code, retryState, initialError = null) {
-  return withPublicLockRetry(lock, code, retryState, () => assertVaultPathSafe(vaultBase, lock, {
-    expectedType: 'directory', label: 'lock de escrita do Vault', code,
-  }), initialError);
+  return withPublicLockRetry(vaultBase, lock, code, retryState, () => assertVaultPathSafe(
+    vaultBase, lock, {
+      expectedType: 'directory', label: 'lock de escrita do Vault', code,
+    },
+  ), initialError);
 }
 
 function processIsAlive(pid) {
@@ -447,7 +471,7 @@ function vaultLockOwner(vaultBase, lock, code, retryState = null) {
     }
   };
   return retryState
-    ? withPublicLockRetry(lock, code, retryState, inspect)
+    ? withPublicLockRetry(vaultBase, lock, code, retryState, inspect)
     : inspect();
 }
 
@@ -492,7 +516,7 @@ function releaseOwnedVaultLock(vaultBase, lock, {
   // The token-specific lease is the filesystem CAS. An old finally/reaper can only
   // remove the directory after successfully unlinking the lease it originally saw;
   // a replacement lock never contains that unguessable path.
-  const leaseRemoved = withPublicLockRetry(lock, code, retryState, () => unlinkVaultFile(
+  const leaseRemoved = withPublicLockRetry(vaultBase, lock, code, retryState, () => unlinkVaultFile(
     vaultBase, vaultLockLease(lock, token), {
       label: 'lease do lock de escrita do Vault', code,
     },
@@ -503,12 +527,12 @@ function releaseOwnedVaultLock(vaultBase, lock, {
   const current = currentState.owner;
   if (current?.pid !== pid || current?.token !== token) return false;
   const ownerPath = join(lock, VAULT_LOCK_OWNER_FILE);
-  if (!withPublicLockRetry(lock, code, retryState, () => unlinkVaultFile(
+  if (!withPublicLockRetry(vaultBase, lock, code, retryState, () => unlinkVaultFile(
     vaultBase, ownerPath, {
       label: 'owner do lock de escrita do Vault', code,
     },
   ))) return false;
-  return withPublicLockRetry(lock, code, retryState, () => removeVaultLockDirectory(
+  return withPublicLockRetry(vaultBase, lock, code, retryState, () => removeVaultLockDirectory(
     vaultBase, lock, {
       missingOk: false, label: 'lock de escrita do Vault', code,
     },
@@ -516,7 +540,7 @@ function releaseOwnedVaultLock(vaultBase, lock, {
 }
 
 function reapDeadVaultLock(vaultBase, lock, staleMs, code, retryState) {
-  const initial = withPublicLockRetry(lock, code, retryState, () => {
+  const initial = withPublicLockRetry(vaultBase, lock, code, retryState, () => {
     const checked = assertVaultPathSafe(vaultBase, lock, {
       expectedType: 'directory', label: 'lock de escrita do Vault', code,
     });
@@ -530,7 +554,7 @@ function reapDeadVaultLock(vaultBase, lock, staleMs, code, retryState) {
   if (!observed.lockExists) return true;
   if (observed.owner) {
     if (processIsAlive(observed.owner.pid)) return false;
-    const lease = withPublicLockRetry(lock, code, retryState, () => {
+    const lease = withPublicLockRetry(vaultBase, lock, code, retryState, () => {
       const current = assertVaultPathSafe(vaultBase, lock, {
         expectedType: 'directory', label: 'lock de escrita do Vault', code,
       });
@@ -548,7 +572,7 @@ function reapDeadVaultLock(vaultBase, lock, staleMs, code, retryState) {
     // Compatibility with owner-aware locks from 0.58.x, which predate token leases.
     // A dead PID plus byte-identical owner and directory identity is sufficient here;
     // a live legacy owner was returned above and is never reaped by age.
-    const legacy = withPublicLockRetry(lock, code, retryState, () => {
+    const legacy = withPublicLockRetry(vaultBase, lock, code, retryState, () => {
       const current = assertVaultPathSafe(vaultBase, lock, {
         expectedType: 'directory', label: 'lock legado de escrita do Vault', code,
       });
@@ -565,12 +589,12 @@ function reapDeadVaultLock(vaultBase, lock, staleMs, code, retryState) {
     if (currentStat.birthtimeMs !== before.birthtimeMs
       || currentStat.mtimeMs !== before.mtimeMs
       || currentOwner.raw !== observed.raw) return false;
-    if (!withPublicLockRetry(lock, code, retryState, () => unlinkVaultFile(
+    if (!withPublicLockRetry(vaultBase, lock, code, retryState, () => unlinkVaultFile(
       vaultBase, currentOwner.path, {
         label: 'owner legado morto do lock de escrita do Vault', code,
       },
     ))) return false;
-    return withPublicLockRetry(lock, code, retryState, () => removeVaultLockDirectory(
+    return withPublicLockRetry(vaultBase, lock, code, retryState, () => removeVaultLockDirectory(
       vaultBase, checked.target, {
         missingOk: false, label: 'lock legado de escrita do Vault', code,
       },
@@ -580,7 +604,7 @@ function reapDeadVaultLock(vaultBase, lock, staleMs, code, retryState) {
   // Locks are published by atomic directory rename only after owner + lease exist.
   // Thus an old empty/partial directory is legacy or crash residue, never an in-flight
   // live acquisition. Unknown children remain fail-closed.
-  const partial = withPublicLockRetry(lock, code, retryState, () => {
+  const partial = withPublicLockRetry(vaultBase, lock, code, retryState, () => {
     const current = assertVaultPathSafe(vaultBase, lock, {
       expectedType: 'directory', label: 'lock de escrita do Vault', code,
     });
@@ -604,12 +628,12 @@ function reapDeadVaultLock(vaultBase, lock, staleMs, code, retryState) {
     || currentStat.mtimeMs !== before.mtimeMs
     || currentOwner.raw !== observed.raw) return false;
   if (entries.includes(VAULT_LOCK_OWNER_FILE)
-    && !withPublicLockRetry(lock, code, retryState, () => unlinkVaultFile(
+    && !withPublicLockRetry(vaultBase, lock, code, retryState, () => unlinkVaultFile(
       vaultBase, currentOwner.path, {
         label: 'owner parcial do lock de escrita do Vault', code,
       },
     ))) return false;
-  return withPublicLockRetry(lock, code, retryState, () => removeVaultLockDirectory(
+  return withPublicLockRetry(vaultBase, lock, code, retryState, () => removeVaultLockDirectory(
     vaultBase, checked.target, {
       missingOk: false, label: 'lock de escrita do Vault', code,
     },
@@ -672,7 +696,8 @@ export function withVaultPathLock(vaultBase, path, fn, {
             });
             break;
           } catch (error) {
-            const retryableRenameRace = retryablePublicLockError(lock, error, code, {
+            // Shape check only; inspectVaultLock below re-observes through the full retry path.
+            const retryableRenameRace = publicLockRetryCandidate(lock, error, code, {
               allowRaw: false,
             });
             const nativeRenameCollision = vaultLockRenameCollision(error, pending, lock);

package/src/doctor.mjs

@@ -1,27 +1,64 @@
 // `wendkeep doctor` — vault/session integrity (hooks/vault-health.mjs) PLUS the a2
 // harness integrity check (hooks/harness-doctor.mjs). Exits 1 on any error.
-import { spawnSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { resolve } from 'node:path';
 import { checkHarness, checkVaultLinks, checkSessionActivity, checkStackedFrontmatter, renderStackedFrontmatterLines, checkUnpricedModels, renderUnpricedModelLines, checkStaleDerivedSections, renderStaleDerivedSectionLines, checkSessionObservability, renderSessionObservabilityLines } from '../hooks/harness-doctor.mjs';
+import { runVaultHealth } from '../hooks/vault-health.mjs';
 import { checkSyncDefs } from './sync-defs.mjs';
 import { resolveProjectVault } from './project-vault.mjs';
 
-export function runDoctor(argv) {
-  const here = dirname(fileURLToPath(import.meta.url));
-  const hookFile = join(here, '..', 'hooks', 'vault-health.mjs');
+const healthStatusLabel = (status) => ({
+  healthy: 'saudável', warning: 'atenção', blocked: 'bloqueada', legacy: 'legado',
+}[status] || status || 'desconhecido');
+
+const metricValue = (value) => value === null || value === undefined || value === '' ? 'n/a' : value;
+
+export function renderVaultHealthLines(result) {
+  const memoryFailures = [];
+  const memoryWarnings = [];
+  const integrityFailures = [];
+  const integrityWarnings = [];
+  for (const failure of result.failures || []) {
+    const match = String(failure).match(/^Memória:\s*(.*)$/s);
+    (match ? memoryFailures : integrityFailures).push(match ? match[1] : failure);
+  }
+  for (const warning of result.warnings || []) {
+    const match = String(warning).match(/^Memória:\s*(.*)$/s);
+    (match ? memoryWarnings : integrityWarnings).push(match ? match[1] : warning);
+  }
+
+  const lines = [
+    `[integridade] ${integrityFailures.length ? 'bloqueada' : integrityWarnings.length ? 'atenção' : 'saudável'} — ${integrityFailures.length} falha(s), ${integrityWarnings.length} aviso(s)`,
+  ];
+  for (const failure of integrityFailures) lines.push(`  ✗ ${failure}`);
+  for (const warning of integrityWarnings) lines.push(`  ! ${warning}`);
+  if (!integrityFailures.length && !integrityWarnings.length) lines.push('  ✓ sessão e artefatos íntegros');
+  lines.push(`  sessão: ${result.session || 'nenhuma'} · registros: ${metricValue(result.metrics?.registrySessions)} · notas derivadas: ${metricValue(result.metrics?.derivedNotes)}`);
 
+  const memory = result.metrics?.memory || {};
+  lines.push(
+    `[memória] ${healthStatusLabel(result.memoryStatus)} — schema: ${metricValue(memory.schemaVersion)} · revisão: ${metricValue(memory.revision)} · cursor: ${metricValue(memory.eventCursor)} · hash: ${metricValue(memory.stateHash)}`,
+  );
+  lines.push(`  ledger: ${metricValue(memory.ledgerEvents)} evento(s) · outbox: ${metricValue(memory.pendingOutbox)} · candidates: ${metricValue(memory.candidates)} · conflitos: ${metricValue(memory.activeConflicts)}`);
+  for (const failure of memoryFailures) lines.push(`  ✗ ${failure}`);
+  for (const warning of memoryWarnings) lines.push(`  ! ${warning}`);
+  if (result.memoryStatus === 'healthy' && !memoryFailures.length && !memoryWarnings.length) {
+    lines.push('  ✓ bundle de memória íntegro');
+  }
+  return lines;
+}
+
+export function runDoctor(argv) {
   let vault;
   let project;
-  const passthrough = [];
+  let session = '';
   for (let i = 0; i < argv.length; i += 1) {
     const a = argv[i];
     if (a === '--vault') vault = argv[++i];
     else if (a.startsWith('--vault=')) vault = a.slice(8);
     else if (a === '--project') project = argv[++i];
     else if (a.startsWith('--project=')) project = a.slice(10);
-    else passthrough.push(a);
+    else if (a === '--session') session = argv[++i] || '';
+    else if (a.startsWith('--session=')) session = a.slice(10);
   }
 
   const projectRoot = resolve(project || process.cwd());
@@ -42,12 +79,22 @@ export function runDoctor(argv) {
     process.stdout.write('  ! migração pendente: rode `wendkeep init --project . --vault "<vault>" --yes` para criar .wendkeep.json\n');
   }
 
-  // 1. Session/vault integrity (existing check).
-  let healthStatus = 0;
-  if (existsSync(hookFile)) {
-    const r = spawnSync(process.execPath, [hookFile, ...passthrough, '--vault', vaultBase], { stdio: 'inherit' });
-    healthStatus = r.status ?? 0;
+  // 1. Session/vault integrity. The standalone hook remains JSON; doctor renders it for humans.
+  let health;
+  try {
+    health = runVaultHealth({ vaultBase, session });
+  } catch (error) {
+    health = {
+      ok: false,
+      session,
+      failures: [`Vault health falhou: ${error?.message || error}`],
+      warnings: [],
+      metrics: { memory: {} },
+      memoryStatus: 'blocked',
+    };
   }
+  process.stdout.write(`${renderVaultHealthLines(health).join('\n')}\n`);
+  const healthStatus = health.ok ? 0 : 1;
 
   // 2. Harness integrity (Wave B).
   const { errors, warnings } = checkHarness(vaultBase, projectRoot);

package/src/memory-curate.mjs

@@ -0,0 +1,328 @@
+import { existsSync } from 'node:fs';
+import { createInterface } from 'node:readline/promises';
+
+import { getLocale } from '../hooks/locale.mjs';
+import {
+  decideMemoryCandidate,
+  listMemoryCandidatesForCuration,
+} from './memory.mjs';
+
+const TEXT = {
+  'pt-BR': {
+    title: 'Curadoria guiada de memória',
+    intro: (count) => `${count} conflito(s) aguardam uma decisão humana. Nada será escolhido automaticamente.`,
+    categories: 'Categorias pendentes:',
+    progress: (index, total, label) => `Conflito ${index} de ${total} — ${label}`,
+    source: 'origem',
+    sourceKinds: {
+      session: 'sessão capturada', turn: 'turno capturado',
+      activation: 'ativação capturada', unknown: 'não identificada',
+    },
+    observed: 'registrado em',
+    newer: 'mais recente',
+    actions: '[1-N] Manter uma versão · [P] Pular · [R] Encerrar sem vencedor · [D] Detalhes · [Q] Sair',
+    choose: '> ',
+    confirmPromote: (number) => `Manter a versão ${number}? Essa decisão será gravada agora. [s/N] `,
+    confirmReject: 'Encerrar este conflito sem escolher uma versão? Essa decisão será gravada agora. [s/N] ',
+    invalid: 'Opção inválida. Escolha um número exibido, P, R, D ou Q.',
+    declined: 'Decisão não confirmada; nenhum byte foi alterado.',
+    promoted: 'Versão promovida e decisão auditada.',
+    rejected: 'Conflito encerrado sem promover uma versão.',
+    details: 'Detalhes técnicos',
+    paused: (decisions, skipped) => `Sessão encerrada: ${decisions} decisão(ões) gravada(s), ${skipped} conflito(s) pulado(s).`,
+    complete: (decisions) => `Curadoria concluída: ${decisions} decisão(ões) gravada(s); nenhum conflito semântico ativo restante.`,
+    blocked: 'O estado da memória mudou ou está ocupado. Nada mais foi aplicado; execute memory curate novamente.',
+    noConflicts: 'Nenhum conflito semântico ativo precisa de curadoria.',
+  },
+  en: {
+    title: 'Guided memory curation',
+    intro: (count) => `${count} conflict(s) require a human decision. Nothing will be selected automatically.`,
+    categories: 'Pending categories:',
+    progress: (index, total, label) => `Conflict ${index} of ${total} — ${label}`,
+    source: 'source',
+    sourceKinds: {
+      session: 'captured session', turn: 'captured turn',
+      activation: 'captured activation', unknown: 'unidentified',
+    },
+    observed: 'recorded at',
+    newer: 'newest timestamp',
+    actions: '[1-N] Keep one version · [P] Skip · [R] Close without a winner · [D] Details · [Q] Quit',
+    choose: '> ',
+    confirmPromote: (number) => `Keep version ${number}? This decision will be written now. [y/N] `,
+    confirmReject: 'Close this conflict without choosing a version? This decision will be written now. [y/N] ',
+    invalid: 'Invalid option. Choose a displayed number, P, R, D, or Q.',
+    declined: 'Decision not confirmed; no bytes were changed.',
+    promoted: 'Version promoted and decision audited.',
+    rejected: 'Conflict closed without promoting a version.',
+    details: 'Technical details',
+    paused: (decisions, skipped) => `Session ended: ${decisions} decision(s) written, ${skipped} conflict(s) skipped.`,
+    complete: (decisions) => `Curation complete: ${decisions} decision(s) written; no active semantic conflicts remain.`,
+    blocked: 'Memory state changed or is busy. Nothing else was applied; run memory curate again.',
+    noConflicts: 'No active semantic conflict requires curation.',
+  },
+};
+
+const KEY_TEXT = {
+  'handoff.latest': {
+    'pt-BR': ['Próximo handoff', 'Resumo que será apresentado à próxima sessão.'],
+    en: ['Next handoff', 'Summary that will be presented to the next session.'],
+  },
+  'quality.latest-sensors': {
+    'pt-BR': ['Sensores de qualidade', 'Conjunto de testes e sensores considerado mais recente.'],
+    en: ['Quality sensors', 'Test and sensor set considered the latest.'],
+  },
+  'quality.latest-verdict': {
+    'pt-BR': ['Veredito de qualidade', 'Resultado de verificação apresentado como vigente.'],
+    en: ['Quality verdict', 'Verification result presented as current.'],
+  },
+  'git.local-head': {
+    'pt-BR': ['Commit local conhecido', 'Commit que o WendKeep considera o último estado local.'],
+    en: ['Known local commit', 'Commit WendKeep considers the latest local state.'],
+  },
+};
+
+function localeId(value) {
+  return value === 'en' ? 'en' : 'pt-BR';
+}
+
+function keyText(memoryKey, locale) {
+  return KEY_TEXT[memoryKey]?.[locale]
+    || (locale === 'en'
+      ? [memoryKey, 'Operational memory value with competing versions.']
+      : [memoryKey, 'Valor operacional com versões concorrentes.']);
+}
+
+function isAffirmative(answer) {
+  return ['s', 'sim', 'y', 'yes'].includes(String(answer || '').trim().toLowerCase());
+}
+
+function groupLines(candidates, locale) {
+  const counts = new Map();
+  for (const candidate of candidates) {
+    counts.set(candidate.memory_key, (counts.get(candidate.memory_key) || 0) + 1);
+  }
+  return [...counts.entries()]
+    .sort(([left], [right]) => left.localeCompare(right))
+    .map(([key, count]) => `  • ${keyText(key, locale)[0]}: ${count}`);
+}
+
+function newestEventId(events) {
+  return [...events]
+    .filter((event) => !Number.isNaN(Date.parse(event.observed_at || '')))
+    .sort((left, right) => Date.parse(right.observed_at) - Date.parse(left.observed_at))[0]?.event_id;
+}
+
+export function renderMemoryConflict(candidate, {
+  locale = 'pt-BR', index = 1, total = 1, details = false,
+} = {}) {
+  const id = localeId(locale);
+  const text = TEXT[id];
+  const [label, description] = keyText(candidate.memory_key, id);
+  const newest = newestEventId(candidate.events);
+  const lines = ['', text.progress(index, total, label), description, ''];
+  candidate.events.forEach((event, eventIndex) => {
+    const recent = event.event_id === newest ? ` — ${text.newer}` : '';
+    const source = text.sourceKinds[event.source] || text.sourceKinds.unknown;
+    lines.push(`[${eventIndex + 1}] ${text.source}: ${source}${recent}`);
+    if (event.observed_at) lines.push(`    ${text.observed}: ${event.observed_at}`);
+    lines.push(`    ${event.preview}`);
+  });
+  if (details) {
+    lines.push('', `${text.details}:`, `  candidate: ${candidate.candidate_id}`);
+    candidate.events.forEach((event) => lines.push(`  event: ${event.event_id}`));
+  }
+  lines.push('', text.actions);
+  return `${lines.join('\n')}\n`;
+}
+
+export async function runGuidedMemoryCuration(vault, {
+  ask,
+  write,
+  loadCandidates = listMemoryCandidatesForCuration,
+  decide = decideMemoryCandidate,
+  locale = 'pt-BR',
+} = {}) {
+  if (typeof ask !== 'function' || typeof write !== 'function') {
+    throw new TypeError('runGuidedMemoryCuration requer ask e write.');
+  }
+  const id = localeId(locale);
+  const text = TEXT[id];
+  let decisions = 0;
+  let skipped = 0;
+  const skippedIds = new Set();
+  const decidedIds = new Set();
+  let first = true;
+  let sessionTotal = 0;
+
+  while (true) {
+    let loaded;
+    try {
+      loaded = loadCandidates(vault);
+      if (!Array.isArray(loaded)) throw new TypeError('candidate inventory must be an array');
+    } catch {
+      write(`${text.blocked}\n`);
+      return { status: 'blocked', decisions, skipped };
+    }
+    const candidates = loaded.filter((candidate) => !skippedIds.has(candidate.candidate_id));
+    if (first) {
+      sessionTotal = loaded.length;
+      write(`${text.title}\n${text.intro(loaded.length)}\n`);
+      if (loaded.length) write(`${text.categories}\n${groupLines(loaded, id).join('\n')}\n`);
+      first = false;
+    }
+    if (!loaded.length) {
+      write(`${decisions ? text.complete(decisions) : text.noConflicts}\n`);
+      return { status: 'complete', decisions, skipped };
+    }
+    if (!candidates.length) {
+      write(`${text.paused(decisions, skipped)}\n`);
+      return { status: 'paused', decisions, skipped };
+    }
+
+    const candidate = candidates[0];
+    if (decidedIds.has(candidate.candidate_id)) {
+      write(`${text.blocked}\n`);
+      return { status: 'blocked', decisions, skipped };
+    }
+    const completed = decisions + skipped;
+    const progressTotal = Math.max(sessionTotal, completed + candidates.length);
+    const progressIndex = completed + 1;
+    write(renderMemoryConflict(candidate, {
+      locale: id, index: progressIndex, total: progressTotal,
+    }));
+    const answer = String(await ask(text.choose)).trim().toLowerCase();
+
+    if (answer === 'q') {
+      write(`${text.paused(decisions, skipped)}\n`);
+      return { status: 'quit', decisions, skipped };
+    }
+    if (answer === 'p') {
+      skippedIds.add(candidate.candidate_id);
+      skipped += 1;
+      continue;
+    }
+    if (answer === 'd') {
+      write(renderMemoryConflict(candidate, {
+        locale: id, index: progressIndex, total: progressTotal, details: true,
+      }));
+      continue;
+    }
+
+    let decision;
+    let confirmation;
+    if (answer === 'r') {
+      decision = { action: 'reject', candidateId: candidate.candidate_id };
+      confirmation = await ask(text.confirmReject);
+    } else if (/^\d+$/.test(answer)) {
+      const eventIndex = Number(answer) - 1;
+      const selected = candidate.events[eventIndex];
+      if (!selected) {
+        write(`${text.invalid}\n`);
+        continue;
+      }
+      decision = {
+        action: 'promote', candidateId: candidate.candidate_id, eventId: selected.event_id,
+      };
+      confirmation = await ask(text.confirmPromote(eventIndex + 1));
+    } else {
+      write(`${text.invalid}\n`);
+      continue;
+    }
+
+    if (!isAffirmative(confirmation)) {
+      write(`${text.declined}\n`);
+      continue;
+    }
+
+    let result;
+    try {
+      result = decide(vault, decision);
+    } catch {
+      write(`${text.blocked}\n`);
+      return { status: 'blocked', decisions, skipped };
+    }
+    if (!result || !['promoted', 'rejected'].includes(result.status)) {
+      write(`${text.blocked}\n`);
+      return { status: 'blocked', decisions, skipped };
+    }
+    decisions += 1;
+    decidedIds.add(candidate.candidate_id);
+    write(`${result.status === 'promoted' ? text.promoted : text.rejected}\n`);
+  }
+}
+
+function usageError(message) {
+  const error = new Error(message);
+  error.code = 'WENDKEEP_MEMORY_CURATE_USAGE';
+  return error;
+}
+
+export function parseMemoryCurateArgs(argv) {
+  let vault = '';
+  let seenVault = false;
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (!token.startsWith('--')) throw usageError(`argumento posicional inesperado: ${token}.`);
+    const equalAt = token.indexOf('=');
+    const name = equalAt >= 0 ? token.slice(0, equalAt) : token;
+    if (name !== '--vault') throw usageError(`opção desconhecida: ${name}.`);
+    if (seenVault) throw usageError('--vault duplicado.');
+    const value = equalAt >= 0 ? token.slice(equalAt + 1) : argv[index + 1];
+    if (!value || !value.trim() || value.startsWith('--')) {
+      throw usageError('--vault requer valor não vazio que não comece com --.');
+    }
+    vault = value;
+    seenVault = true;
+    if (equalAt < 0) index += 1;
+  }
+  return { vault };
+}
+
+export async function runMemoryCurateCli(argv, {
+  input = process.stdin,
+  output = process.stdout,
+  error = process.stderr,
+  env = process.env,
+} = {}) {
+  let args;
+  try {
+    args = parseMemoryCurateArgs(argv);
+  } catch {
+    error.write(
+      'wendkeep memory curate: não foi possível abrir a curadoria com segurança. '
+      + 'Inspecione o estado com memory candidates --active e tente novamente.\n',
+    );
+    return 2;
+  }
+  const vault = args.vault || env.OBSIDIAN_VAULT_PATH;
+  if (!vault) {
+    error.write('wendkeep memory curate: passe --vault <path>.\n');
+    return 2;
+  }
+  if (!existsSync(vault)) {
+    error.write(`wendkeep memory curate: not found: ${vault}\n`);
+    return 2;
+  }
+  if (!input?.isTTY || !output?.isTTY) {
+    error.write(
+      `wendkeep memory curate requer terminal interativo (TTY). Inspecione sem alterar com: `
+      + `npx --no-install wendkeep memory candidates --active --vault "${vault}"\n`,
+    );
+    return 2;
+  }
+
+  const rl = createInterface({ input, output });
+  try {
+    const result = await runGuidedMemoryCuration(vault, {
+      locale: getLocale(vault).id,
+      ask: (question) => rl.question(question),
+      write: (value) => output.write(String(value)),
+    });
+    return result.status === 'blocked' ? 1 : 0;
+  } catch (cause) {
+    error.write(`wendkeep memory curate: ${cause.message}\n`);
+    return 1;
+  } finally {
+    rl.close();
+  }
+}

package/src/memory.mjs

@@ -279,6 +279,62 @@ export function listMemoryCandidates(vault, { activeOnly = false } = {}) {
   return { status: 'ok', candidates };
 }
 
+const CURATION_PREVIEW_CHARS = 160;
+
+function curationPreview(value) {
+  const normalized = sanitizeMemoryText(value).replace(/\s+/g, ' ').trim();
+  const visible = normalized || '(sem conteúdo)';
+  return visible.length <= CURATION_PREVIEW_CHARS
+    ? visible
+    : `${visible.slice(0, CURATION_PREVIEW_CHARS - 1).trimEnd()}…`;
+}
+
+function sanitizedCurationEvent(candidate, eventId, candidateIndex) {
+  const events = Array.isArray(candidate.events) ? candidate.events : [];
+  const event = events.find((item) => item?.event_id === eventId);
+  if (!event || typeof event !== 'object' || Array.isArray(event)) {
+    throw new Error(
+      `MEMORY_CANDIDATES.jsonl: candidate ${candidateIndex + 1} sem evento elegível.`,
+    );
+  }
+  const source = event.canonical_session_id
+    ? 'session'
+    : event.source_turn_id
+      ? 'turn'
+      : event.activation_id
+        ? 'activation'
+        : 'unknown';
+  return {
+    event_id: eventId,
+    observed_at: sanitizeMemoryText(event.observed_at || event.effective_at || ''),
+    source: sanitizeMemoryText(source),
+    preview: curationPreview(event.value),
+  };
+}
+
+export function listMemoryCandidatesForCuration(vault) {
+  return readCandidates(vault)
+    .map((candidate, index) => ({ candidate, index, safe: sanitizedCandidate(candidate, index) }))
+    .filter(({ safe }) => safe.reason === 'conflict'
+      && !TERMINAL_CANDIDATE_STATUSES.has(safe.status))
+    .map(({ candidate, index, safe }) => {
+      if (!safe.event_ids.length) {
+        throw new Error(
+          `MEMORY_CANDIDATES.jsonl: candidate ${index + 1} sem eventos elegíveis.`,
+        );
+      }
+      return {
+        candidate_id: safe.candidate_id,
+        reason: safe.reason,
+        status: safe.status,
+        memory_key: safe.memory_key,
+        events: safe.event_ids.map((eventId) => sanitizedCurationEvent(candidate, eventId, index)),
+      };
+    })
+    .sort((left, right) => lexicalCompare(left.memory_key, right.memory_key)
+      || lexicalCompare(left.candidate_id, right.candidate_id));
+}
+
 function priorCandidateDecision(vault, candidateId) {
   return readMemoryLedger(vault).events.find(
     (event) => event.candidate_decision?.candidate_id === candidateId,