wendkeep 0.68.6 → 0.69.0

package/CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes to **wendkeep** are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.69.0] — 2026-08-16
+
+### Added
+
+- **A Shared Project Memory v2 preserva handoffs estruturados entre providers.** Stop publica
+  objetivo, entrega, restrições, decisões, próximas ações, bloqueios e riscos com `work_session_id`;
+  CORE continua manual com cap 40/alerta 35, e status/validate-memory diagnosticam cobertura
+  semântica sem expor valores privados.
+
 ## [0.68.6] — 2026-08-16
 
 ### Fixed

package/README.en.md

@@ -357,7 +357,9 @@ Codex uses `session_id`/`turn_id` plus transcript order, with no artificial caus
 
 ### Injection and budgets
 
-`brain-inject` delivers the same revision/hash on `startup`, `/clear`, and `/compact` `SessionStart` events, always placing CORE and SHARED before change context. The full envelope is capped at 24 KiB; CORE reserves up to 4 KiB, SHARED up to 6 KiB, and each line is capped at 320 characters. Under pressure, lessons are removed first, then non-current changes. CORE and SHARED are never prefix-sliced: a missing, invalid, or over-budget layer becomes a visible, repairable `<wk_memory_error>`.
+`CORE.md` is the only manual layer: it accepts up to 40 lines, warns from 35, keeps a 4 KiB ceiling, and caps each line at 320 characters. `SHARED_MEMORY.md` is generated exclusively by the projector and ledger; never edit it to repair state. `brain-inject` delivers the same revision/hash on `startup`, `/clear`, and `/compact` `SessionStart` events, always placing CORE and SHARED before change context. The full envelope is capped at 24 KiB; SHARED reserves up to 6 KiB. Under pressure, lessons are removed first, then non-current changes. CORE and SHARED are never prefix-sliced: a missing, invalid, or over-budget layer becomes a visible, repairable `<wk_memory_error>`.
+
+`memory status --gate` and `validate-memory --vault` also check semantic coverage: they report a code, counts, and active/projected/missing keys. An empty v2 bundle is neutral; a missing projectable event, placeholders as the only content, or an unresolved decision link becomes an explicit degraded/blocking diagnosis without printing memory values.
 
 `DIGEST.md` is no longer the operational handoff: it remains the `/brain-recall` bridge and legacy-vault fallback. A vault without SHARED receives CORE+DIGEST with a deprecation warning; migrate during the compatibility window:
 

package/README.md

@@ -357,7 +357,9 @@ Codex uses `session_id`/`turn_id` plus transcript order, with no artificial caus
 
 ### Injection and budgets
 
-`brain-inject` delivers the same revision/hash on `startup`, `/clear`, and `/compact` `SessionStart` events, always placing CORE and SHARED before change context. The full envelope is capped at 24 KiB; CORE reserves up to 4 KiB, SHARED up to 6 KiB, and each line is capped at 320 characters. Under pressure, lessons are removed first, then non-current changes. CORE and SHARED are never prefix-sliced: a missing, invalid, or over-budget layer becomes a visible, repairable `<wk_memory_error>`.
+`CORE.md` is the only manual layer: it accepts up to 40 lines, warns from 35, keeps a 4 KiB ceiling, and caps each line at 320 characters. `SHARED_MEMORY.md` is generated exclusively by the projector and ledger; never edit it to repair state. `brain-inject` delivers the same revision/hash on `startup`, `/clear`, and `/compact` `SessionStart` events, always placing CORE and SHARED before change context. The full envelope is capped at 24 KiB; SHARED reserves up to 6 KiB. Under pressure, lessons are removed first, then non-current changes. CORE and SHARED are never prefix-sliced: a missing, invalid, or over-budget layer becomes a visible, repairable `<wk_memory_error>`.
+
+`memory status --gate` and `validate-memory --vault` also check semantic coverage: they report a code, counts, and active/projected/missing keys. An empty v2 bundle is neutral; a missing projectable event, placeholders as the only content, or an unresolved decision link becomes an explicit degraded/blocking diagnosis without printing memory values.
 
 `DIGEST.md` is no longer the operational handoff: it remains the `/brain-recall` bridge and legacy-vault fallback. A vault without SHARED receives CORE+DIGEST with a deprecation warning; migrate during the compatibility window:
 

package/docs/en/commands/memory.md

@@ -7,6 +7,10 @@
 Inspect and curate CORE, SHARED, ledger, outbox, attempts, and candidates without confusing
 canonical authorship with generated operational state.
 
+`CORE.md` is the only manual, canonical layer: it accepts up to 40 lines, warns from 35,
+keeps a 4 KiB ceiling, and caps each line at 320 characters. `SHARED_MEMORY.md` is generated
+from the ledger and must not be hand-edited.
+
 ## When to use
 
 Use in CI, before verify/archive, after doctor warnings, or when deciding candidates.
@@ -115,7 +119,12 @@ npx wendkeep validate-memory --vault <v2-vault>
   different, incomplete, or ambiguous identity keeps the candidate queued for curation. `memory
   repair` compares the old and current replay and migrates checkpoint+mirror only with exact
   identity, backup, audit, and CAS; it does not reorder, rewrite, or append a ledger event.
-- `validate-memory <CORE.md>` checks the 25-line cap, required sections, and secrets.
+- `validate-memory <CORE.md>` checks the hard 40-line cap, warns from 35, enforces 4 KiB and
+  320 characters per line, and checks required sections and secrets/PII.
+- `validate-memory --vault` also compares semantic ledger coverage with SHARED and prints a code,
+  counts, and active/projected/missing keys. An empty v2 bundle is neutral; a missing projectable
+  event, exclusive placeholders, or a dead decision link produces a degraded/blocking diagnosis
+  without exposing values.
 - `validate-memory --vault` requires a complete v2 bundle and is not the legacy-vault gate.
 - For `recover-attempt`, exit `0` means a valid dry run/apply, including `unchanged`; exit `1`
   means a precondition, authority, CAS, topology, or lock check failed; exit `2` means a missing

package/docs/pt-BR/commands/memory.md

@@ -7,6 +7,10 @@
 Inspecionar e curar CORE, SHARED, ledger, outbox, attempts e candidates sem confundir autoria
 canônica com estado operacional gerado.
 
+`CORE.md` é a única camada manual e canônica: aceita até 40 linhas, alerta a partir de 35,
+mantém o teto de 4 KiB e limita cada linha a 320 caracteres. `SHARED_MEMORY.md` é uma projeção
+gerada pelo ledger e não deve ser editado à mão.
+
 ## Quando usar
 
 Use no CI, antes de verify/archive, diante de avisos do doctor ou para decidir candidates.
@@ -113,7 +117,12 @@ npx wendkeep validate-memory --vault <cofre-v2>
   divergente, incompleta ou ambígua mantém o candidate para curadoria. `memory repair` compara o
   replay anterior e o atual e só migra checkpoint+espelho com identidade exata, backup, audit e
   CAS; ele não reordena, reescreve nem acrescenta evento ao ledger.
-- `validate-memory <CORE.md>` valida cap de 25 linhas, seções e segredos.
+- `validate-memory <CORE.md>` valida cap rígido de 40 linhas, alerta em 35, 4 KiB, 320 caracteres
+  por linha, seções e segredos/PII.
+- `validate-memory --vault` também compara a cobertura semântica do ledger com SHARED e imprime
+  código, contagens e chaves ativas/projetadas/ausentes. Bundle v2 vazio é neutro; evento
+  projetável ausente, placeholders exclusivos ou link de decisão morto geram diagnóstico
+  degradado/bloqueante sem expor valores.
 - `validate-memory --vault` exige bundle v2 completo; não é o gate correto para vault legado.
 - Para `recover-attempt`, exit `0` indica dry-run/apply válido, inclusive `unchanged`; exit `1`
   indica falha de pré-condição, autoridade, CAS, topologia ou lock; exit `2` indica

package/hooks/brain-core.mjs

@@ -4,6 +4,7 @@ import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { basename, join } from 'node:path';
 import { ensureDir, stripYamlQuotes, toVaultRelative } from './obsidian-common.mjs';
 import { getLocale } from './locale.mjs';
+import { sanitizeMemoryText } from './memory-schema.mjs';
 
 export function brainDir(vaultBase) {
   return join(vaultBase, '.brain');
@@ -104,6 +105,41 @@ function adrNumber(path) {
   return m ? Number(m[1]) : -1;
 }
 
+function decisionTitle(content, path) {
+  const frontmatter = parseFrontmatter(content);
+  const heading = content.match(/^#\s+(.+?)\s*$/m)?.[1] || '';
+  const raw = frontmatter.title || frontmatter.name || heading;
+  if (!raw) return '';
+  const title = sanitizeMemoryText(String(raw)
+    .replace(/^ADR-\d+\s*(?:[-:—]\s*)?/i, '')
+    .replace(/\s+/g, ' ')
+    .trim());
+  return title.slice(0, 180).trim();
+}
+
+function decisionNotes(vaultBase) {
+  const byPath = new Map();
+  const byBasename = new Map();
+  const decisionsDir = join(vaultBase, getLocale(vaultBase).folders.decisions);
+  for (const filePath of walkMd(decisionsDir)) {
+    let content;
+    try { content = readFileSync(filePath, 'utf8'); } catch { continue; }
+    const rel = toVaultRelative(vaultBase, filePath).replace(/\.md$/i, '');
+    const note = { path: rel, title: decisionTitle(content, rel) };
+    byPath.set(rel, note);
+    const key = basename(rel);
+    if (!byBasename.has(key)) byBasename.set(key, note);
+  }
+  return { byPath, byBasename };
+}
+
+function resolveDecisionTarget(target, notes) {
+  const normalized = String(target || '').replace(/\.md$/i, '').trim();
+  if (!normalized || normalized.includes('...') || normalized.includes('…')) return null;
+  const note = notes.byPath.get(normalized) || notes.byBasename.get(basename(normalized));
+  return note?.title ? note : null;
+}
+
 // Destila index.jsonl em .brain/DIGEST.md (camada quente, determinístico, 0 token LLM).
 // Cap por construção: 1 header + 13 itens (5/4/2/2) + 1 pointer = máx 15 linhas.
 export function buildBrainDigest(vaultBase, rows = null) {
@@ -139,13 +175,21 @@ export function buildBrainDigest(vaultBase, rows = null) {
   };
   const pickLive = (kind, max) => pick(kind, max * 4).filter(resolves).slice(0, max);
 
-  const decisions = pickLive('decisions', DIGEST_CAPS.decisions).sort((a, b) => adrNumber(b) - adrNumber(a));
+  const notes = decisionNotes(vaultBase);
+  const decisions = [];
+  for (const target of pick('decisions', DIGEST_CAPS.decisions * 4)) {
+    const resolved = resolveDecisionTarget(target, notes);
+    if (!resolved || decisions.some((item) => item.path === resolved.path)) continue;
+    decisions.push(resolved);
+    if (decisions.length >= DIGEST_CAPS.decisions) break;
+  }
+  decisions.sort((a, b) => adrNumber(b.path) - adrNumber(a.path));
   const sessions = byDateDesc.slice(0, DIGEST_CAPS.sessions);
   const bugs = pickLive('bugs', DIGEST_CAPS.bugs);
   const learnings = pickLive('learnings', DIGEST_CAPS.learnings);
 
   const lines = ['<!-- AUTO-GERADO por brain-core.mjs (0 token LLM). NÃO editar. Rebuild: node .agent/hooks/brain-reindex.mjs -->'];
-  for (const d of decisions) lines.push(`- Decisão: [[${d}]]`);
+  for (const d of decisions) lines.push(`- Decisão: [[${d.path}]] — ${d.title}`);
   for (const s of sessions) lines.push(`- Sessão ${s.date} (${s.provider || '?'}): ${s.summary || s.file} → [[${String(s.file || '').replace(/\.md$/, '')}]]`);
   for (const b of bugs) lines.push(`- Bug: [[${b}]]`);
   for (const l of learnings) lines.push(`- Aprendizado: [[${l}]]`);

package/hooks/brain-inject.mjs

@@ -19,7 +19,7 @@ import {
   resolveHookOperatingProfile,
 } from './operating-profile-runtime.mjs';
 import { assertVaultPathSafe } from './vault-path-safety.mjs';
-import { validateCore } from '../src/validate-core.mjs';
+import { CORE_LIMITS, validateCore } from '../src/validate-core.mjs';
 
 // The process ROUTER — the enforcement layer. The wk-* skills are passive files; without a
 // standing instruction the model plans in chat, leaves the change scaffold raw and forces the
@@ -52,8 +52,8 @@ function processRouter(localeId) {
 
 const INJECTION_LIMITS = Object.freeze({
   totalBytes: 24 * 1024,
-  lineChars: 320,
-  coreBytes: 4 * 1024,
+  lineChars: CORE_LIMITS.lineChars,
+  coreBytes: CORE_LIMITS.bytes,
   sharedBytes: 6 * 1024,
   attentionBytes: 1024,
   recallBytes: 512,

package/hooks/session-ensure.mjs

@@ -36,11 +36,29 @@ import { resolveSessionIdentity } from './session-identity.mjs';
 import { readCodexRolloutMeta } from './codex-rollout-meta.mjs';
 import { mutateSessionNote } from './session-note-io.mjs';
 import { captureProjectScope, projectScopePatch } from './project-scope.mjs';
+import { sanitizeMemoryText } from './memory-schema.mjs';
 
 function sessionIdFromInput(input) {
   return input.session_id || input.sessionId || input.codex_session_id || '';
 }
 
+function workSessionIdFromInput(input = {}) {
+  const shared = input.shared || input.handoff?.shared;
+  const value = input.work_session_id
+    || input.workSessionId
+    || shared?.work_session_id
+    || shared?.workSessionId
+    || input.handoff?.work_session_id
+    || input.handoff?.workSessionId
+    || '';
+  return sanitizeMemoryText(value).trim();
+}
+
+function workSessionPatch(input = {}) {
+  const workSessionId = workSessionIdFromInput(input);
+  return workSessionId ? { work_session_id: workSessionId } : {};
+}
+
 function turnSequenceFromInput(input = {}) {
   const value = input.turn_sequence ?? input.turnSequence;
   const parsed = Number(value);
@@ -290,6 +308,7 @@ function activateExistingSession({ vaultBase, relPath, startedAt, sessionId, inp
     transcript_path: identity.transcriptPath,
     transcript_id: identity.transcriptId,
     provider: identity.provider,
+    ...workSessionPatch(input),
     ...scopePatch,
     ...causalTurnPatch(input, now),
   });
@@ -318,6 +337,7 @@ function createSession({ vaultBase, sessionId, input, now, identity, scopePatch
     transcript_path: identity.transcriptPath,
     transcript_id: identity.transcriptId,
     provider: identity.provider,
+    ...workSessionPatch(input),
     ...scopePatch,
     ...causalTurnPatch(input, now),
   });
@@ -361,6 +381,7 @@ function main() {
       upsertSessionRegistry(vaultBase, sessionId, {
         transcript_paths: [identity.transcriptPath],
         provider: identity.provider,
+        ...workSessionPatch(input),
       });
     }
     writeHookOutput({});
@@ -398,6 +419,7 @@ function main() {
           transcript_path: identity.transcriptPath,
           transcript_id: identity.transcriptId,
           provider: identity.provider,
+          ...workSessionPatch(input),
           ...scopePatch,
           ...causalTurnPatch(input, now),
         });
@@ -443,6 +465,7 @@ function main() {
         transcript_path: identity.transcriptPath,
         transcript_id: identity.transcriptId,
         provider: identity.provider,
+        ...workSessionPatch(input),
         ...scopePatch,
         ...causalTurnPatch(input, now),
       });

package/hooks/session-identity.mjs

@@ -65,8 +65,10 @@ export function resolveSessionIdentity(vaultBase, input = {}, provider = detectP
 export function resolveSessionEntry(vaultBase, input = {}, provider = detectProvider()) {
   const identity = resolveSessionIdentity(vaultBase, input, provider);
   if (identity.state !== 'resolved') return { identity, entry: null };
+  const entry = readSessionRegistry(vaultBase).sessions?.[identity.canonicalConversationId] || null;
+  const workSessionId = entry?.work_session_id ? String(entry.work_session_id) : '';
   return {
-    identity,
-    entry: readSessionRegistry(vaultBase).sessions?.[identity.canonicalConversationId] || null,
+    identity: workSessionId ? { ...identity, work_session_id: workSessionId } : identity,
+    entry,
   };
 }

package/hooks/session-stop.mjs

@@ -521,6 +521,21 @@ function shouldFinalizeSession() {
   return process.env.OBSIDIAN_NO_AUTO_FINALIZE !== '1';
 }
 
+function sharedHandoffFromInput(input = {}, entry = {}) {
+  const supplied = input.shared || input.handoff?.shared;
+  const shared = supplied && typeof supplied === 'object' && !Array.isArray(supplied)
+    ? { ...supplied }
+    : {};
+  const workSessionId = shared.work_session_id
+    || shared.workSessionId
+    || input.work_session_id
+    || input.workSessionId
+    || entry?.work_session_id
+    || '';
+  if (!shared.work_session_id && workSessionId) shared.work_session_id = workSessionId;
+  return Object.keys(shared).length ? shared : null;
+}
+
 export function commitSessionMemory(vaultBase, handoff, { projectOptions = {} } = {}) {
   if (detectMemoryMode(vaultBase).mode === 'legacy') {
     return { status: 'legacy', eventCount: 0, eventIds: [], checkpoint: null };
@@ -1378,6 +1393,7 @@ export async function main({
       summary: finalSummary,
       noteRel: sessionRel,
     });
+    const sharedHandoff = sharedHandoffFromInput(input, entry);
     memoryHandoff = {
       projectId,
       identity,
@@ -1390,6 +1406,7 @@ export async function main({
       observedAt: turnIdentity.observedAt || new Date(0).toISOString(),
       summary: finalSummary,
       evidence: memoryEvidence,
+      ...(sharedHandoff ? { shared: sharedHandoff } : {}),
     };
     memoryAttempt = stageMemory(vaultBase, {
       handoff: memoryHandoff,

package/hooks/vault-health.mjs

@@ -231,6 +231,12 @@ function memoryMetrics() {
     pendingOutbox: 0,
     candidates: 0,
     activeConflicts: 0,
+    semanticStatus: null,
+    semanticCode: null,
+    semanticActiveKeys: [],
+    semanticProjectedKeys: [],
+    semanticMissingKeys: [],
+    semanticCounts: {},
   };
 }
 
@@ -505,6 +511,7 @@ export function checkMemoryBundle(vaultBase, { registry } = {}) {
   for (const warning of bundle.warnings || []) warnings.push(warning);
 
   const ok = failures.length === 0;
+  const semantic = bundle.semantic || {};
   return {
     ok,
     status: ok ? (warnings.length ? 'warning' : 'healthy') : 'blocked',
@@ -519,6 +526,12 @@ export function checkMemoryBundle(vaultBase, { registry } = {}) {
       pendingOutbox: outbox.count,
       candidates: candidates.items.length,
       activeConflicts: activeConflicts.length,
+      semanticStatus: semantic.status ?? null,
+      semanticCode: semantic.code ?? null,
+      semanticActiveKeys: semantic.activeKeys || [],
+      semanticProjectedKeys: semantic.projectedKeys || [],
+      semanticMissingKeys: semantic.missingKeys || [],
+      semanticCounts: semantic.counts || {},
     },
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wendkeep",
-  "version": "0.68.6",
+  "version": "0.69.0",
   "description": "Vault-first persistent memory for AI coding agents, with an optional profile-aware governance runtime: OFF, FLOW, GUIDE, GOVERN, or ASSURE. Local-first and agent-agnostic (Claude Code, Codex, Cursor…).",
   "type": "module",
   "workspaces": [
@@ -70,6 +70,6 @@
   },
   "devDependencies": {
     "acorn": "^8.18.0",
-    "wendkeep": "^0.68.0"
+    "wendkeep": "^0.68.6"
   }
 }

package/packages/cli/src/index.mjs

@@ -107,7 +107,7 @@ Usage:
                            promote <candidate> [--event <event-id>] | reject <candidate>. --vault P.
                            Reconcile is dry-run by default; the original attempt remains audited.
   wendkeep validate-memory [path]  Validate .brain/CORE.md against the compaction
-                           protocol (cap 25, 3 sections, no secrets/PII).
+                           protocol (cap 40, warning 35, 4 KiB, 320 chars/line, 3 sections, no secrets/PII).
                            --vault <path> validates the complete v2 bundle.
   wendkeep sync-defs [opts]    Copy versioned defs from the vault's .brain into the
                            project: .brain/agents/*.toml -> .codex/agents,

package/packages/vault/src/memory-handoff.mjs

@@ -4,12 +4,55 @@ import { basename, join, relative } from 'node:path';
 
 import { sanitizeMemoryText } from './memory-schema.mjs';
 
+const SHARED_HANDOFF_FIELDS = Object.freeze([
+  ['objective', 'objective.current'],
+  ['delivered', 'state.delivered'],
+  ['constraints', 'constraint.active'],
+  ['decisions', 'decision.active'],
+  ['next_actions', 'next.action'],
+  ['blockers', 'blocker.active'],
+  ['risks', 'risk.known'],
+]);
+
 function canonicalValue(value) {
   if (Array.isArray(value)) return value.map(canonicalValue);
   if (!value || typeof value !== 'object') return value;
   return Object.fromEntries(Object.keys(value).sort().map((key) => [key, canonicalValue(value[key])]));
 }
 
+function sanitizeValue(value) {
+  if (typeof value === 'string') return sanitizeMemoryText(value);
+  if (Array.isArray(value)) return value.map(sanitizeValue);
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(Object.keys(value).sort().map((key) => [key, sanitizeValue(value[key])]));
+  }
+  return value;
+}
+
+function hasMeaningfulValue(value) {
+  if (typeof value === 'string') return value.trim().length > 0;
+  if (Array.isArray(value)) return value.length > 0;
+  if (value && typeof value === 'object') return Object.keys(value).length > 0;
+  return value !== undefined && value !== null;
+}
+
+/** Normalize the portable operational handoff without inventing missing identity. */
+export function normalizeSharedHandoff(shared) {
+  if (!shared || typeof shared !== 'object' || Array.isArray(shared)) return null;
+
+  const normalized = {};
+  const workSessionId = sanitizeMemoryText(shared.work_session_id ?? shared.workSessionId ?? '').trim();
+  if (workSessionId) normalized.work_session_id = workSessionId;
+
+  for (const [field] of SHARED_HANDOFF_FIELDS) {
+    if (!Object.hasOwn(shared, field)) continue;
+    const value = sanitizeValue(shared[field]);
+    if (hasMeaningfulValue(value)) normalized[field] = value;
+  }
+
+  return Object.keys(normalized).length ? normalized : null;
+}
+
 function eventId(context, memoryKey, value) {
   const digest = createHash('sha256')
     .update(JSON.stringify([
@@ -26,8 +69,8 @@ function eventId(context, memoryKey, value) {
 }
 
 function makeEvent(context, { memoryKey, value, authority, evidence }) {
-  const cleanValue = typeof value === 'string' ? sanitizeMemoryText(value) : canonicalValue(value);
-  return {
+  const cleanValue = sanitizeValue(value);
+  const event = {
     v: 1,
     event_id: eventId(context, memoryKey, cleanValue),
     project_id: String(context.projectId || ''),
@@ -43,6 +86,8 @@ function makeEvent(context, { memoryKey, value, authority, evidence }) {
     observed_at: context.observedAt,
     evidence: (evidence || []).filter(Boolean).map((item) => sanitizeMemoryText(item)),
   };
+  if (context.workSessionId) event.work_session_id = context.workSessionId;
+  return event;
 }
 
 function readJson(path) {
@@ -133,14 +178,35 @@ export function buildSessionMemoryEvents({
   observedAt,
   summary,
   evidence = {},
+  shared,
 }) {
-  const context = { projectId, identity, activation, turn, observedAt };
-  const events = [makeEvent(context, {
-    memoryKey: 'handoff.latest',
-    value: sanitizeMemoryText(summary),
-    authority: 'reported',
-    evidence: [noteRel],
-  })];
+  const normalizedShared = normalizeSharedHandoff(shared);
+  const context = {
+    projectId, identity, activation, turn, observedAt,
+    workSessionId: normalizedShared?.work_session_id || '',
+  };
+  const events = [];
+
+  if (normalizedShared) {
+    for (const [field, memoryKey] of SHARED_HANDOFF_FIELDS) {
+      if (!Object.hasOwn(normalizedShared, field)) continue;
+      events.push(makeEvent(context, {
+        memoryKey,
+        value: normalizedShared[field],
+        authority: 'reported',
+        evidence: [noteRel],
+      }));
+    }
+  }
+
+  if (!events.length) {
+    events.push(makeEvent(context, {
+      memoryKey: 'handoff.latest',
+      value: sanitizeMemoryText(summary),
+      authority: 'reported',
+      evidence: [noteRel],
+    }));
+  }
 
   if (evidence.change?.slug && evidence.change?.status && evidence.change?.adr) {
     events.push(makeEvent(context, {

package/packages/vault/src/memory-store.mjs

@@ -437,6 +437,29 @@ function conflictCandidate(memoryKey, events, currentEvent = null) {
   };
 }
 
+function conflictReviewEvent(candidate, candidateCount = 1) {
+  const source = candidate.events?.[0] || {};
+  const memoryKey = sanitizeMemoryText(candidate.memory_key || 'unknown');
+  const eventCount = Array.isArray(candidate.event_ids) ? candidate.event_ids.length : 0;
+  return {
+    v: 1,
+    event_id: `mem-review-${candidate.candidate_id}`,
+    project_id: source.project_id || '',
+    memory_key: candidate.memory_key,
+    operation: 'assert',
+    value: `[revisão pendente: ${memoryKey}; candidates: ${candidateCount}; events: ${eventCount}]`,
+    authority: 'candidate',
+    canonical_session_id: source.canonical_session_id || 'memory-reducer',
+    activation_id: source.activation_id || 'memory-reducer',
+    activation_epoch: Number.isInteger(source.activation_epoch) ? source.activation_epoch : 0,
+    turn_sequence: 0,
+    source_turn_id: 'memory-review',
+    observed_at: source.observed_at || new Date(0).toISOString(),
+    evidence: ['MEMORY_CANDIDATES.jsonl'],
+    review_pending: true,
+  };
+}
+
 function sortedObject(entries) {
   return Object.fromEntries([...entries].sort(([left], [right]) => left.localeCompare(right)));
 }
@@ -753,14 +776,19 @@ export function reduceMemoryEvents(inputEvents = [], {
       && !resolvedCandidateIds.has(item.candidate_id));
   unresolvedCandidates.sort((left, right) => left.candidate_id.localeCompare(right.candidate_id));
   superseded.sort((left, right) => left.event_id.localeCompare(right.event_id));
-  const activeEvents = Object.entries(recordObject).map(([memoryKey, record]) => ({
-    ...record.source,
-    memory_key: memoryKey,
-    operation: 'assert',
-    value: record.value,
-  }));
   const eventCursor = events.at(-1)?.event_id || 'none';
   const stateHash = hashMemoryValue({ state, tombstones: tombstoneObject });
+  const activeEvents = [
+    ...Object.entries(recordObject).map(([memoryKey, record]) => ({
+      ...record.source,
+      memory_key: memoryKey,
+      operation: 'assert',
+      value: record.value,
+    })),
+    ...unresolvedCandidates.map((candidate) => (
+      conflictReviewEvent(candidate, unresolvedCandidates.length)
+    )),
+  ];
 
   return {
     state,

package/packages/vault/src/validate-core.mjs

@@ -1,6 +1,7 @@
 // Memory-compaction protocol for the curated .brain/CORE.md layer.
 // Ported from NutriGym-Vision's scripts/validate-brain-core.js to ESM:
-//   - cap 25 lines (hard), 22 (soft warning) — 1 durable item per line
+//   - cap 40 lines (hard), 35 (soft warning) — 1 durable item per line
+//   - 4 KiB and 320 characters per line
 //   - 3 required sections
 //   - no secrets / no real-provider PII emails
 // Plus the seeded skeleton and the protocol reference doc.
@@ -8,8 +9,12 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { isAbsolute, join, resolve } from 'node:path';
 
-const HARD_LIMIT = 25;
-const SOFT_LIMIT = 22;
+export const CORE_LIMITS = Object.freeze({
+  lines: 40,
+  warningLines: 35,
+  bytes: 4 * 1024,
+  lineChars: 320,
+});
 
 // Bilingual (0.8.0): a CORE is valid when it carries the COMPLETE section set of either
 // locale — pt-BR or en. Mixed/partial sets fail (the 3 sections are one contract).
@@ -40,16 +45,25 @@ const SECRET_PATTERNS = [
 
 const PII_EMAIL_REGEX = /\b[A-Za-z0-9._%+-]+@(?!example\.(?:com|org|net)\b)(?:gmail|hotmail|yahoo|outlook|live|icloud|protonmail)\.[A-Za-z]{2,}\b/i;
 
-// Validate CORE.md content. Returns { ok, errors, warnings, lineCount }.
+// Validate CORE.md content. Returns { ok, errors, warnings, lineCount, byteCount }.
 export function validateCore(content) {
   const text = String(content ?? '');
   const lines = text.split('\n');
   const lineCount = text.endsWith('\n') ? lines.length - 1 : lines.length;
+  const byteCount = Buffer.byteLength(text, 'utf8');
   const errors = [];
 
-  if (lineCount > HARD_LIMIT) {
-    errors.push(`Tamanho ${lineCount} > ${HARD_LIMIT} linhas (hard limit). Curar: remover itens resolvidos (detalhe vive no vault/git).`);
+  if (lineCount > CORE_LIMITS.lines) {
+    errors.push(`Tamanho ${lineCount} > ${CORE_LIMITS.lines} linhas (hard limit). Curar: remover itens resolvidos (detalhe vive no vault/git).`);
   }
+  if (byteCount > CORE_LIMITS.bytes) {
+    errors.push(`Tamanho ${byteCount} > ${CORE_LIMITS.bytes} bytes (budget do CORE). Curar: manter apenas estado durável.`);
+  }
+  lines.forEach((line, index) => {
+    if (line.length > CORE_LIMITS.lineChars) {
+      errors.push(`Linha ${index + 1} tem ${line.length} caracteres; limite ${CORE_LIMITS.lineChars}.`);
+    }
+  });
   // Pick the locale set that matches best; require it to be complete.
   const missingBySet = Object.values(SECTION_SETS).map((set) => set.filter(({ regex }) => !regex.test(text)));
   const best = missingBySet.reduce((a, b) => (b.length < a.length ? b : a));
@@ -62,11 +76,11 @@ export function validateCore(content) {
   if (em) errors.push(`Email real detectado: "${em[0]}" — usar user@example.com.`);
 
   const warnings = [];
-  if (lineCount >= SOFT_LIMIT && lineCount <= HARD_LIMIT) {
-    warnings.push(`Tamanho ${lineCount}/${HARD_LIMIT} linhas — perto do limite; remover itens resolvidos (≥${SOFT_LIMIT}).`);
+  if (lineCount >= CORE_LIMITS.warningLines && lineCount <= CORE_LIMITS.lines) {
+    warnings.push(`Tamanho ${lineCount}/${CORE_LIMITS.lines} linhas — perto do limite; remover itens resolvidos (≥${CORE_LIMITS.warningLines}).`);
   }
 
-  return { ok: errors.length === 0, errors, warnings, lineCount };
+  return { ok: errors.length === 0, errors, warnings, lineCount, byteCount };
 }
 
 // The seeded CORE.md (must pass validateCore). Bootstraps the 3 sections so the
@@ -75,7 +89,7 @@ export function renderCoreSkeleton(localeId = 'pt-BR') {
   if (localeId === 'en') {
     return `# CORE — curated memory core (.brain)
 
-> RULE #1 — the project's canonical memory. Hand-curated, 25-line cap (validate: \`wendkeep validate-memory\`). Volatile facts live in DIGEST.md (auto). Depth: /brain-recall <topic>.
+> RULE #1 — the project's canonical memory. Hand-curated, 40-line cap (validate: \`wendkeep validate-memory\`). Volatile facts live in DIGEST.md (auto). Depth: /brain-recall <topic>.
 
 ## User Preferences
 - (durable preferences: language, style, conventions)
@@ -89,7 +103,7 @@ export function renderCoreSkeleton(localeId = 'pt-BR') {
   }
   return `# CORE — núcleo curado da memória (.brain)
 
-> REGRA #1 — memória canônica do projeto. Curado à mão, cap 25 linhas (valide: \`wendkeep validate-memory\`). Volátil vive no DIGEST.md (auto). Profundidade: /brain-recall <tópico>.
+> REGRA #1 — memória canônica do projeto. Curado à mão, cap 40 linhas (valide: \`wendkeep validate-memory\`). Volátil vive no DIGEST.md (auto). Profundidade: /brain-recall <tópico>.
 
 ## Preferências do Usuário
 - (preferências duráveis: idioma, estilo, convenções)
@@ -110,8 +124,8 @@ export function renderCompactionProtocol() {
 
 ## 1. Duas camadas
 
-- **QUENTE** (auto-injetada por sessão, budget ~45 linhas):
-  - \`.brain/CORE.md\` — curado à mão, **≤25 linhas** (1 item/linha): preferências, padrões, pendências.
+- **QUENTE** (auto-injetada por sessão, com budgets por camada):
+  - \`.brain/CORE.md\` — curado à mão, **≤40 linhas** (alerta em 35; 4 KiB; 320 caracteres por linha): preferências, padrões, pendências.
   - \`.brain/DIGEST.md\` — auto-gerado (0 token LLM, ≤15 linhas): decisões/sessões/bugs/aprendizados recentes.
 - **FRIA** (sob demanda):
   - \`.brain/index.jsonl\` — índice de todas as sessões (1/linha, frontmatter).
@@ -120,7 +134,7 @@ export function renderCompactionProtocol() {
 ## 2. Compactação = regra de geração (sem trabalho manual)
 
 - **DIGEST se auto-compacta**: caps determinísticos (5 decisões, 4 sessões, 2 bugs, 2 aprendizados + \`+N mais\`). O velho cai do quente sozinho e permanece no índice/vault. **NUNCA editar** \`DIGEST.md\`/\`index.jsonl\`.
-- **CORE**: quando ≥22 linhas (soft warning), remover itens resolvidos/obsoletos — o detalhe já vive no vault e no histórico do git.
+- **CORE**: quando ≥35 linhas (soft warning), remover itens resolvidos/obsoletos — o detalhe já vive no vault e no histórico do git.
 
 ## 3. O que escrever no CORE
 
@@ -139,7 +153,7 @@ wendkeep validate-memory          # valida <vault>/.brain/CORE.md
 wendkeep validate-memory <path>   # valida outro arquivo
 \`\`\`
 
-Checa: cap 25 (soft 22), 3 seções, sem segredos/PII. Exit 0 = OK, 1 = falha.
+Checa: cap 40 (soft 35), 4 KiB, 320 caracteres por linha, 3 seções, sem segredos/PII. Exit 0 = OK, 1 = falha.
 `;
 }
 

package/packages/vault/src/validate-memory.mjs

@@ -1,6 +1,7 @@
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { validateMemoryEvent, validateSharedMemory } from './memory-schema.mjs';
+import { readdirSync, readFileSync } from 'node:fs';
+import { basename, join, relative } from 'node:path';
+import { sanitizeMemoryText, validateMemoryEvent, validateSharedMemory } from './memory-schema.mjs';
+import { deriveMemoryProjection } from './memory-store.mjs';
 import { assertVaultPathSafe } from './vault-path-safety.mjs';
 import { validateCore } from './validate-core.mjs';
 
@@ -104,8 +105,208 @@ function validateSharedArtifact(vaultBase, eventIds) {
   return { ...validateSharedMemory(read.content, { eventIds }), path, content: read.content };
 }
 
-export function combineMemoryResults({ project, core, ledger, shared }) {
-  const components = { project, core, ledger, shared };
+const TERMINAL_CANDIDATE_STATUSES = new Set(['resolved', 'rejected', 'superseded']);
+const DECISION_LINK_RE = /\[\[([^\]|#]+)(?:#[^\]|]*)?(?:\|[^\]]*)?\]\]/g;
+
+function readCandidateInventory(vaultBase) {
+  const path = join(vaultBase, '.brain', 'MEMORY_CANDIDATES.jsonl');
+  let checked;
+  try {
+    checked = assertVaultPathSafe(vaultBase, path, {
+      allowMissing: true, expectedType: 'file', label: 'MEMORY_CANDIDATES.jsonl',
+    });
+  } catch (error) {
+    return failedComponent(`MEMORY_CANDIDATES.jsonl inseguro: ${error?.message || error}`, {
+      count: 0, activeCount: 0, path,
+    });
+  }
+  if (!checked.exists) return { ok: true, errors: [], warnings: [], count: 0, activeCount: 0, path };
+
+  try {
+    checked = assertVaultPathSafe(vaultBase, checked.target, {
+      allowMissing: false, expectedType: 'file', label: 'MEMORY_CANDIDATES.jsonl',
+    });
+    const lines = readFileSync(checked.target, 'utf8').replace(/\r\n/g, '\n')
+      .split('\n').filter((line) => line.trim());
+    const errors = [];
+    let count = 0;
+    let activeCount = 0;
+    for (const [index, line] of lines.entries()) {
+      try {
+        const item = JSON.parse(line);
+        if (!item || typeof item !== 'object' || Array.isArray(item)) {
+          errors.push(`MEMORY_CANDIDATES.jsonl linha ${index + 1} deve conter um objeto.`);
+          continue;
+        }
+        count += 1;
+        if (!TERMINAL_CANDIDATE_STATUSES.has(item.status || 'active')) activeCount += 1;
+      } catch (error) {
+        errors.push(`MEMORY_CANDIDATES.jsonl linha ${index + 1} contém JSON inválido: ${error?.message || error}`);
+      }
+    }
+    return { ok: errors.length === 0, errors, warnings: [], count, activeCount, path };
+  } catch (error) {
+    return failedComponent(`MEMORY_CANDIDATES.jsonl ilegível: ${error?.message || error}`, {
+      count: 0, activeCount: 0, path,
+    });
+  }
+}
+
+function sharedEventIds(content) {
+  const ids = new Set();
+  for (const line of String(content || '').split('\n')) {
+    const match = line.match(/^\s*-\s+\[([^\]]+)\]/);
+    if (match?.[1]) ids.add(match[1]);
+  }
+  return ids;
+}
+
+function walkDecisionFiles(root, vaultBase, output = []) {
+  let entries;
+  try { entries = readdirSync(root, { withFileTypes: true }); } catch { return output; }
+  for (const entry of entries) {
+    const path = join(root, entry.name);
+    if (entry.isDirectory()) walkDecisionFiles(path, vaultBase, output);
+    else if (entry.isFile() && /^ADR-\d+.*\.md$/i.test(entry.name)) {
+      const rel = relative(vaultBase, path).replace(/\\/g, '/').replace(/\.md$/i, '');
+      output.push(rel);
+    }
+  }
+  return output;
+}
+
+function decisionInventory(vaultBase) {
+  const paths = [];
+  for (const folder of ['04-Decisões', '04-Decisions']) {
+    walkDecisionFiles(join(vaultBase, folder), vaultBase, paths);
+  }
+  const byPath = new Set(paths);
+  const byBasename = new Set(paths.map((path) => basename(path)));
+  return { byPath, byBasename };
+}
+
+function unresolvedDecisionLinks(vaultBase, content) {
+  const inventory = decisionInventory(vaultBase);
+  const unresolved = new Set();
+  DECISION_LINK_RE.lastIndex = 0;
+  let match;
+  while ((match = DECISION_LINK_RE.exec(String(content || '')))) {
+    const target = String(match[1] || '').trim().replace(/\\/g, '/').replace(/\.md$/i, '');
+    const targetBase = basename(target);
+    const isDecision = /^ADR-\d+/i.test(targetBase)
+      || /(^|\/)(?:04-Decis(?:õ|o)es|04-Decisions)(?:\/|$)/i.test(target);
+    if (!isDecision) continue;
+    if (!target || target.includes('...') || target.includes('…')
+        || (!inventory.byPath.has(target) && !inventory.byBasename.has(targetBase))) {
+      unresolved.add(sanitizeMemoryText(target).slice(0, 180));
+    }
+  }
+  return [...unresolved].sort();
+}
+
+function semanticMemoryHealth(vaultBase, { ledger, shared, candidates }) {
+  const base = {
+    ok: true,
+    status: 'unavailable',
+    code: 'MEMORY_SEMANTIC_STRUCTURAL_UNAVAILABLE',
+    errors: [],
+    warnings: [],
+    activeKeys: [],
+    projectedKeys: [],
+    missingKeys: [],
+    unresolvedDecisionLinks: [],
+    placeholderOnly: false,
+    counts: { activeKeys: 0, projectedKeys: 0, missingKeys: 0, candidates: candidates?.activeCount || 0, placeholderSections: 0, unresolvedDecisionLinks: 0 },
+  };
+  if (!ledger?.ok || !shared?.ok) return base;
+
+  let replay;
+  try { replay = deriveMemoryProjection(vaultBase, ledger.events); }
+  catch (error) {
+    return {
+      ...base,
+      ok: false,
+      status: 'degraded',
+      code: 'MEMORY_SEMANTIC_REPLAY_UNAVAILABLE',
+      errors: ['[MEMORY_SEMANTIC_REPLAY_UNAVAILABLE] não foi possível rederivar as chaves ativas do ledger.'],
+    };
+  }
+
+  const active = Object.entries(replay.records || {}).map(([memoryKey, record]) => ({
+    memoryKey: sanitizeMemoryText(memoryKey),
+    eventId: record?.source?.event_id,
+  }));
+  const activeKeys = active.map(({ memoryKey }) => memoryKey).sort();
+  const projectedIds = sharedEventIds(shared.content);
+  const projectedKeys = active
+    .filter(({ eventId }) => projectedIds.has(eventId))
+    .map(({ memoryKey }) => memoryKey)
+    .sort();
+  const missingKeys = active
+    .filter(({ eventId }) => !projectedIds.has(eventId))
+    .map(({ memoryKey }) => memoryKey)
+    .sort();
+  const sectionValues = [...(shared.sections?.values?.() || [])].flat();
+  const placeholderSections = sectionValues.filter((line) => /^-\s*\(vazio\)\s*$/i.test(line)).length;
+  const nonPlaceholderLines = sectionValues.filter((line) => !/^-\s*\(vazio\)\s*$/i.test(line));
+  const placeholderOnly = sectionValues.length > 0 && nonPlaceholderLines.length === 0;
+  const unresolvedLinks = unresolvedDecisionLinks(vaultBase, shared.content);
+  const candidateCount = Math.max(candidates?.activeCount || 0, replay.candidates?.length || 0);
+  const errors = [];
+  const warnings = [];
+  const codes = [];
+
+  if (missingKeys.length && placeholderOnly) {
+    codes.push('MEMORY_SEMANTIC_PLACEHOLDER_ONLY');
+    errors.push(`[MEMORY_SEMANTIC_PLACEHOLDER_ONLY] SHARED contém somente placeholders para ${activeKeys.length} chave(s) ativa(s); candidates=${candidateCount}.`);
+  } else if (missingKeys.length) {
+    codes.push('MEMORY_SEMANTIC_COVERAGE_MISSING');
+    errors.push(`[MEMORY_SEMANTIC_COVERAGE_MISSING] SHARED não cobre ${missingKeys.length} chave(s) ativa(s): ${missingKeys.join(', ')}.`);
+  }
+  if (unresolvedLinks.length) {
+    codes.push('MEMORY_SEMANTIC_DECISION_LINK_UNRESOLVED');
+    errors.push(`[MEMORY_SEMANTIC_DECISION_LINK_UNRESOLVED] ${unresolvedLinks.length} link(s) de decisão não resolvido(s).`);
+  }
+
+  let status = 'healthy';
+  let code = 'MEMORY_SEMANTIC_COVERAGE_OK';
+  if (!ledger.events.length && !candidateCount) {
+    status = 'neutral';
+    code = 'MEMORY_SEMANTIC_EMPTY_NEUTRAL';
+  } else if (!activeKeys.length && candidateCount) {
+    status = 'degraded';
+    code = 'MEMORY_SEMANTIC_CANDIDATES_PENDING';
+    warnings.push(`[MEMORY_SEMANTIC_CANDIDATES_PENDING] ${candidateCount} candidate(s) preservado(s); o estado não é memória vazia.`);
+  } else if (codes.length) {
+    status = 'degraded';
+    code = codes[0];
+  }
+
+  return {
+    ok: errors.length === 0,
+    status,
+    code,
+    codes,
+    errors,
+    warnings,
+    activeKeys,
+    projectedKeys,
+    missingKeys,
+    unresolvedDecisionLinks: unresolvedLinks,
+    placeholderOnly,
+    counts: {
+      activeKeys: activeKeys.length,
+      projectedKeys: projectedKeys.length,
+      missingKeys: missingKeys.length,
+      candidates: candidateCount,
+      placeholderSections,
+      unresolvedDecisionLinks: unresolvedLinks.length,
+    },
+  };
+}
+
+export function combineMemoryResults({ project, core, ledger, shared, candidates, semantic }) {
+  const components = { project, core, ledger, shared, candidates, semantic };
   const errors = [];
   const warnings = [];
   for (const [name, result] of Object.entries(components)) {
@@ -124,5 +325,7 @@ export function validateMemoryBundle(vaultBase) {
   const core = validateCoreArtifact(vaultBase);
   const ledger = readLedgerForValidation(vaultBase, { projectId: project.projectId });
   const shared = validateSharedArtifact(vaultBase, ledger.eventIds);
-  return combineMemoryResults({ project, core, ledger, shared });
+  const candidates = readCandidateInventory(vaultBase);
+  const semantic = semanticMemoryHealth(vaultBase, { ledger, shared, candidates });
+  return combineMemoryResults({ project, core, ledger, shared, candidates, semantic });
 }

package/src/doctor.mjs

@@ -39,6 +39,10 @@ export function renderVaultHealthLines(result) {
     `[memória] ${healthStatusLabel(result.memoryStatus)} — schema: ${metricValue(memory.schemaVersion)} · revisão: ${metricValue(memory.revision)} · cursor: ${metricValue(memory.eventCursor)} · hash: ${metricValue(memory.stateHash)}`,
   );
   lines.push(`  ledger: ${metricValue(memory.ledgerEvents)} evento(s) · outbox: ${metricValue(memory.pendingOutbox)} · candidates: ${metricValue(memory.candidates)} · conflitos: ${metricValue(memory.activeConflicts)}`);
+  const semanticKeys = memory.semanticActiveKeys || [];
+  const semanticProjected = memory.semanticProjectedKeys || [];
+  const semanticMissing = memory.semanticMissingKeys || [];
+  lines.push(`  semântica: ${metricValue(memory.semanticCode)} · ativas: ${semanticKeys.length} [${semanticKeys.join(', ')}] · projetadas: ${semanticProjected.length} · ausentes: ${semanticMissing.length}`);
   for (const failure of memoryFailures) lines.push(`  ✗ ${failure}`);
   for (const warning of memoryWarnings) lines.push(`  ! ${warning}`);
   if (result.memoryStatus === 'healthy' && !memoryFailures.length && !memoryWarnings.length) {

package/src/memory.mjs

@@ -1874,13 +1874,16 @@ export function runValidateMemoryBundle(argv) {
     return;
   }
   const result = validateMemoryBundle(vault);
+  const semantic = result.semantic || {};
+  const semanticSummary = `semântica ${semantic.code || 'n/a'} · ativas: ${semantic.counts?.activeKeys ?? 0} · projetadas: ${semantic.counts?.projectedKeys ?? 0} · ausentes: ${semantic.counts?.missingKeys ?? 0}`;
   if (!result.ok) {
     process.stderr.write(`❌  bundle de memória inválido (${result.errors.length} erro(s)):\n`);
+    process.stderr.write(`   ${semanticSummary}\n`);
     for (const error of result.errors) process.stderr.write(`   - ${error}\n`);
     process.exitCode = 1;
     return;
   }
-  process.stdout.write('✅  bundle de memória v2 OK (CORE + ledger + SHARED).\n');
+  process.stdout.write(`✅  bundle de memória v2 OK (CORE + ledger + SHARED; ${semanticSummary}).\n`);
   process.exitCode = 0;
 }