wendkeep 0.72.1 → 0.74.0

package/CHANGELOG.md

@@ -4,6 +4,67 @@ All notable changes to **wendkeep** are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.74.0] — 2026-08-20
+
+### Added
+
+- **Registradores de memória escopados.** Eventos novos declaram escopo de projeto, work session,
+  change, branch ou worktree. HEADs de branches paralelas coexistem, enquanto decisões,
+  constraints e blockers realmente incompatíveis continuam sob curadoria humana.
+- **Migração append-only de escopo.** `memory rescope` mostra uma prévia sem valores e
+  `memory rescope --apply` anexa eventos de reescopo sem reescrever o ledger histórico; retry é
+  idempotente e candidates ambíguos não recebem vencedor automático.
+- **Recall baseado em evidências.** O índice `.brain/EVIDENCE_INDEX.jsonl` divide Markdown por
+  headings, parágrafos, decisões, tarefas, requisitos e evidências, preservando origem, heading,
+  autoridade, validade, sessão, work session, change e hash.
+- **Context broker por prompt.** `UserPromptSubmit` consulta o índice local, aplica ranking lexical
+  BM25 com frase exata, peso por campo, autoridade, validade, recência limitada e diversidade, e
+  injeta somente os melhores trechos dentro de um budget explícito.
+- **FTS5 no Observer.** O schema SQL 4 mantém chunks por projeto, faz feature probe de FTS5 e usa o
+  mesmo ranking/proveniência do Keep Core com fallback lexical quando a extensão não está disponível.
+
+### Changed
+
+- **Ambiguidade fica isolada.** Uma chave conflitante é omitida da projeção operacional e recebe
+  marcador de revisão; CORE e registros independentes continuam disponíveis.
+- **`/brain-recall` retorna passagens.** Resultados agora apontam para o trecho do match e incluem
+  arquivo, heading, autoridade, data e validade, em vez de retornar somente nomes de sessões.
+
+### Performance
+
+- Documentos excepcionalmente grandes usam amostragem distribuída limitada a 4 MiB no índice de
+  chunks, preservando o transporte gzip e evitando trabalho proporcional a transcripts gigantes.
+
+## [0.73.0] — 2026-08-20
+
+### Added
+
+- **Work kind independente do perfil.** `inspection`, `maintenance`, `implementation`, `delivery`
+  e `recovery` passam a ser classificados separadamente de perfil, impacto de contrato e risco
+  operacional.
+- **Delivery com autorização e receipt.** `delivery start/status/finish/abandon` captura repositório,
+  branch/worktree, SHA, change de origem e capabilities; comprova target, CI, versão, tag,
+  integridade npm e GitHub Release quando aplicável, sem criar change, spec ou ADR.
+- **GUIDE realmente compacta.** `change new --guide` gera somente objetivo, critérios de aceite,
+  áreas afetadas, testes e resultado. Sem impacto de contrato, seu archive não fabrica design,
+  delta de spec ou ADR.
+
+### Changed
+
+- **Doctor proporcional.** O diagnóstico separa erro estrutural, atenção de workflow, dívida
+  reparável e ambiguidade semântica. `--scope core|runtime` isola as superfícies e `--strict`
+  promove pendências a falha para CI/release.
+- **Sync valida somente o Keep Core.** Trabalho em andamento no Wend Runtime deixa de transformar
+  uma instalação saudável em falha; a conclusão informa separadamente a saúde do Core.
+- **Conflitos semânticos degradam por chave.** Candidates ativos aguardam curadoria sem bloquear o
+  bundle inteiro; corrupção de ledger, boundary, identidade ou projeção continua falhando fechada.
+
+### Fixed
+
+- **Proveniência preserva lifecycle scripts.** A comparação de integridade executa `npm pack`
+  normalmente em uma cópia isolada, mantendo `prepack`/`postpack` e impedindo que a verificação
+  altere o working tree de origem.
+
 ## [0.72.1] — 2026-08-20
 
 ### Added

package/README.en.md

@@ -84,11 +84,11 @@ Decisions, dead ends, the reason you chose X over Y — gone next session. The p
 |---|---|
 | **Capture** — every turn, on disk | `SessionStart` / `Stop` hooks write each session to a dated Markdown note: prompts, iterations, files touched, wikilinks. |
 | **Derive** — decisions, bugs, learnings | Pulled from the transcript into their own notes, backlinked to the session. Your history becomes navigable, not archival. |
-| **Recall** — injected back | Canonical `CORE` + operational `SHARED_MEMORY`, with explicit budgets, are injected on `startup`, `/clear`, and `/compact`; `DIGEST` remains a deep-recall index and legacy fallback. |
+| **Recall** — injected back | Canonical `CORE` + operational `SHARED_MEMORY` enter on `startup`, `/clear`, and `/compact`; on every prompt, the local chunk index selects a few passages with source, authority, and validity under an explicit budget. |
 | **Cost** — what it all cost | Per‑model, cache‑aware token pricing per session — plus `cost --trend` with a run‑rate projection across the whole vault; research previews without a final rate remain unestimated. |
 | **Multi‑agent** — one vault, both agents | `init` wires the session hooks into `.claude/settings.json` *and* `.codex/hooks.json`, and every note is tagged with the agent that wrote it: Claude Code is detected from its environment, anything else is recorded as Codex. One shared graph, whichever agent you are in. |
 | **Local‑first** — no cloud, no account | Everything is plain Markdown on your disk. An optional MCP server (`@bitbonsai/mcpvault`) lets the agent read/write the vault. |
-| **Local Observer** — many projects, one view | `wendkeep observer` keeps documents, sessions, agents, tokens, costs, calls, and transcripts in the Docker volume SQLite database; every project gets a **Consumption** tab in the read-only dashboard at `http://127.0.0.1:8787/`, loopback has no token, and unavailable hooks use a gzip outbox without blocking the session, including large transcripts. |
+| **Local Observer** — many projects, one view | `wendkeep observer` keeps documents, FTS5 chunks, sessions, agents, tokens, costs, calls, and transcripts in SQLite; search returns the matching passage with provenance and falls back to the local lexical ranker when FTS5 is unavailable. |
 
 During historical migration, the Observer preserves differences between frontmatter totals and the
 ledger as explicit reconciliation rows, and disambiguates duplicate `session_id` values per file
@@ -100,7 +100,7 @@ The Codex scope guard treats `commit`, `push`, `pull`, `merge`, `publish`, and d
 operations as independent capabilities, including inside compound commands.
 
 - Node.js ≥ 18
-- An AI coding agent with hooks. `init` wires **Claude Code** and **Codex** automatically — Codex gets eight compatible hooks, including the scoped `PreToolUse` guard, and enumerates them untrusted, so approve its “Hooks need review” prompt once at startup (see [Notes & roadmap](#notes--roadmap))
+- An AI coding agent with hooks. `init` wires **Claude Code** and **Codex** automatically — Codex gets twelve compatible hooks, including per-prompt recall and the scoped `PreToolUse` guard, and enumerates them untrusted, so approve its “Hooks need review” prompt once at startup (see [Notes & roadmap](#notes--roadmap))
 - Obsidian (to view the graph) — optional but the point
 
 ## Install & set up
@@ -115,7 +115,7 @@ npx wendkeep init
 
 1. Create the vault folder taxonomy and a templated `README.md` (default vault: `<project>/.<project-name>-vault`, e.g. `.MyApp-vault`; override with `--vault`).
 2. Write a provider-neutral **`.wendkeep.json`** binding at the project root and a matching `.brain/PROJECT.json` marker in the vault, then merge the session hooks into **`.claude/settings.json`**. The binding is provider-neutral by design: any agent resolves the same vault from its session `cwd`, with no machine-global environment variable. Older registrations already in `.claude/settings.json` are adopted automatically.
-3. Wire the Codex hooks in **`.codex/hooks.json`** — eleven compatible entries: `brain-inject` + `session-start` + `observer-publish` on `SessionStart`, `session-ensure` + `change-context` on `UserPromptSubmit`, `session-stop` + `observer-publish` + `change-nag` on `Stop`, `subagent-stop` + `observer-publish` on `SubagentStop`, and `change-guard` on `PreToolUse` for `Bash`, `exec_command`, `apply_patch`, and mutable MCP tools, always in the `npx wendkeep hook <name>` form. `observer-publish` keeps the sanitized index projection and also sends the local SQL authority with documents, consumption, and transcripts; it does not replace the local lifecycle. The guard accepts object, raw-string, and argv Codex payloads; before a mutation it compares the session with the project, Git root, remote, branch, and worktree, denying missing or divergent targets. The other four stay out because Codex offers no equivalent payload, tool, or event: `change-warn` (no reliable `tool_input.file_path`), `plan-capture` (no `ExitPlanMode`), `decision-capture` (`AskUserQuestion` is Claude-only), and `task-log` (`TaskCompleted` is not in Codex's event enum). Codex scope blocks use `permissionDecision: "deny"`; `ask` is never emitted in `PreToolUse`. The merge remains non-destructive, preserves third-party hooks, and migrates legacy `timeout` to `timeoutSec`. **Codex enumerates every hook as untrusted and runs none until you approve the “Hooks need review” prompt at startup — `init` cannot pre-approve them**.
+3. Wire the Codex hooks in **`.codex/hooks.json`** — twelve compatible entries: `brain-inject` + `session-start` + `observer-publish` on `SessionStart`, `session-ensure` + `evidence-context` + `change-context` on `UserPromptSubmit`, `session-stop` + `observer-publish` + `change-nag` on `Stop`, `subagent-stop` + `observer-publish` on `SubagentStop`, and `change-guard` on `PreToolUse` for `Bash`, `exec_command`, `apply_patch`, and mutable MCP tools, always in the `npx wendkeep hook <name>` form. `observer-publish` keeps the sanitized index projection and also sends the local SQL authority with documents, consumption, and transcripts; it does not replace the local lifecycle. The guard accepts object, raw-string, and argv Codex payloads; before a mutation it compares the session with the project, Git root, remote, branch, and worktree, denying missing or divergent targets. The other four stay out because Codex offers no equivalent payload, tool, or event: `change-warn` (no reliable `tool_input.file_path`), `plan-capture` (no `ExitPlanMode`), `decision-capture` (`AskUserQuestion` is Claude-only), and `task-log` (`TaskCompleted` is not in Codex's event enum). Codex scope blocks use `permissionDecision: "deny"`; `ask` is never emitted in `PreToolUse`. The merge remains non-destructive, preserves third-party hooks, and migrates legacy `timeout` to `timeoutSec`. **Codex enumerates every hook as untrusted and runs none until you approve the “Hooks need review” prompt at startup — `init` cannot pre-approve them**.
 4. Add the **`wendkeep-vault`** MCP server to `.mcp.json` so the agent can read/write the vault. Skip with `--no-mcp` — e.g. when the agent already has a vault MCP. (`--no-mcp` skips *only wendkeep's own* MCP; companion MCPs still follow `--companions`.)
 5. Offer to pin **companion** plugins/MCP (multi-choice; **none** pre-checked — wendkeep is a neutral harness and presumes no third-party plugin). Each is wired the most agent-agnostic way it supports:
    - **`context-mode`** — context optimizer + FTS5 memory, wired as a Claude Code plugin. It ships its own MCP server, so wendkeep deliberately adds no `.mcp.json` entry (registering both cold-started two servers at once). On non-Claude agents, add the MCP by hand: `npx -y context-mode`.
@@ -125,9 +125,9 @@ npx wendkeep init
 
    Control with `--companions <csv>` or `--no-companions`. The Claude Code plugin layer (`extraKnownMarketplaces` + `enabledPlugins`) is wired as a bonus where the companion has one.
 6. Install a **color system** into the vault's `.obsidian/`: a CSS snippet that accents notes by type (session/decision/bug/learning, via the `cssclasses` the hooks emit) plus graph color groups by folder. Non-destructive merge into `appearance.json`/`graph.json`; skip with `--no-colors`. Re-apply it any time on an existing vault with `wendkeep theme sync` — Obsidian owns `graph.json` and can drop the color groups (a grey graph); the re-sync restores them without a full re-`init`.
-7. Seed **Shared Project Memory v2** without overwriting existing artifacts: `.brain/CORE.md` (hand-curated canonical truth), `.brain/SHARED_MEMORY.md` (generated operational state), `.brain/MEMORY_EVENTS.jsonl` (append-only ledger), `.brain/MEMORY_CANDIDATES.jsonl` (curation queue), and `.brain/COMPACTION_PROTOCOL.md`. The durable outbox appears under `.brain/memory-outbox/` when events exist; `DIGEST.md` and `index.jsonl` remain deep recall. Everything stays local to the vault.
+7. Seed **Shared Project Memory v2** without overwriting existing artifacts: `.brain/CORE.md`, `.brain/SHARED_MEMORY.md`, `.brain/MEMORY_EVENTS.jsonl`, `.brain/MEMORY_CANDIDATES.jsonl`, and `.brain/COMPACTION_PROTOCOL.md`. The durable outbox appears under `.brain/memory-outbox/`; `EVIDENCE_INDEX.jsonl` is rebuilt locally from chunks while `DIGEST.md`/`index.jsonl` remain compatible. Everything stays in the vault.
 8. Seed the **definitions + skills layer**: `.brain/agents/` + `.brain/skills/` (versioned source of truth), including the native process skills `wk-workflow` / `wk-tdd` / `wk-debugging` / `wk-brainstorming` / `wk-planning` / `wk-verify` (some ship templates — e.g. `wk-verify`'s `verdict-template.json` + reviewer prompt). `init` runs `wendkeep sync-defs` for you, delivering the skills to `.claude/skills/` and `.agents/skills/`, and the agent definitions (`.brain/agents/*.toml`) to `.codex/agents/`, plus a managed section in `AGENTS.md` that indexes the skills for Codex; `sync-defs --check` detects stale copies (re-run `sync-defs` after editing `.brain`).
-9. Seed the **change/spec lifecycle**: the `07-Specs/` + `08-Mudanças/` folders and a native `wendkeep.sensors.json` — critical memory validation/health sensors plus one for each of `typecheck` / `test` / `lint` / `build` found in your `package.json`. `memory-health` blocks delivery on corruption, projection divergence, or an active conflict; pending outbox events and ordinary candidates are warnings. Add sensors with `wendkeep sensors add`. Drives `wendkeep change` / `wendkeep verify` — see **Change lifecycle** below.
+9. Seed the **change/spec lifecycle**: the `07-Specs/` + `08-Mudanças/` folders and a native `wendkeep.sensors.json` — critical memory validation/health sensors plus one for each of `typecheck` / `test` / `lint` / `build` found in your `package.json`. `memory-health` blocks delivery on corruption or projection divergence; semantic conflicts degrade only the affected keys and await curation. Pending outbox events and ordinary candidates are warnings. Add sensors with `wendkeep sensors add`. Drives `wendkeep change` / `wendkeep verify` — see **Change lifecycle** below.
 
 ```bash
 npx wendkeep init --vault "~/vaults/work" --project . --yes   # non-interactive (no companions unless you ask)
@@ -257,7 +257,7 @@ deliberate opt-in and runs that command's own validations:
 |---|---|---|
 | `OFF` | LLM-native harness | No Wend router, skill gate, or gates; explicit selection only. |
 | `FLOW` | E → V | Microcontract with Git baseline, allowlist, sensor, and receipt, without a change. |
-| `GUIDE` | P → E → V | Compact guided change. |
+| `GUIDE` | P → E → V | Compact change; no automatic design/spec/ADR when contract impact is none. |
 | `GOVERN` | P → R → E → V | Current a2 loop and compatible fallback. |
 | `ASSURE` | P → R → E → V → C | Governance with confirmation and handoff. |
 
@@ -317,13 +317,25 @@ positive causal turn and sequence that agree in the registry.
 “Small” describes size, not risk. The harness uses this matrix to choose and record a temporary
 route; semantic inference remains in the agent, not Wend Runtime:
 
-| Situation | Suggested profile |
-|---|---|
-| Question, inspection, or diagnosis with no mutation | No profile transition |
-| Local, reversible fix with an allowlist and no contract/spec change | `FLOW` (`E → V`) |
-| Small behavior change that needs a change but not formal Wend Runtime review | `GUIDE` (`P → E → V`) |
-| Normal, ambiguous, public-contract, security, dependency, CI/release, or policy change | `GOVERN` (`P → R → E → V`) |
-| Work requiring explicit confirmation and handoff | `ASSURE` (`P → R → E → V → C`) |
+| Situation | Work kind | Suggested profile | New change |
+|---|---|---|---|
+| Question, inspection, or diagnosis with no mutation | `inspection` | No transition | No |
+| Local, reversible fix with an allowlist and no contract/spec change | `maintenance` | `FLOW` (`E → V`) | No |
+| Small behavior change without formal review | `implementation` | `GUIDE` (`P → E → V`) | Yes, compact |
+| Public contract, security, schema, dependency, CI/release workflow, or policy | `implementation` | `GOVERN`/`ASSURE` | Yes |
+| Merge, push, tag, or publication of approved behavior | `delivery` | `ASSURE` | No |
+| Operational recovery without code/config correction | `recovery` | `FLOW`/`ASSURE` | No |
+
+Work kind, profile, contract impact, and operational risk are independent dimensions. A
+`delivery` records authorized capabilities and an append-only receipt without creating a change,
+spec, or ADR. If delivery requires a code/config edit, it pauses and work returns to
+`implementation`:
+
+```bash
+npx wendkeep delivery start release-0-74-0 --allow git:merge --allow git:push --allow publish --source-change <slug> --source-commit <sha>
+npx wendkeep delivery status release-0-74-0
+npx wendkeep delivery finish release-0-74-0 --target main --ci-url <url> --version 0.74.0 --npm-integrity <sha512> --release-url <url>
+```
 
 If the harness does not record a lease, a small fix remains under the configured profile —
 `GOVERN` by default. `OFF` does not mean “simple task”: it is a persistent human choice that hands
@@ -344,6 +356,11 @@ and owner+lease locks validate physical topology. Concurrent promotion elects on
 retry through `--change-slug`. Read the complete
 [Operating profiles guide](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/operating-profiles.md).
 
+`wendkeep doctor` separates structural errors, workflow attention, repairable debt, and semantic
+ambiguity. Use `--scope core` for Keep Core health, `--scope runtime` for governance, and
+`--strict` in CI/release; `wendkeep sync` validates Core only so work in progress does not become
+an installation failure.
+
 ## Shared Project Memory v2
 
 Hot memory now separates human authorship, operational state, and evidence:
@@ -352,6 +369,8 @@ Hot memory now separates human authorship, operational state, and evidence:
 - **`SHARED_MEMORY.md` is generated operational state.** The `Stop` hook turns the session handoff into sanitized events; the projector deterministically reduces the ledger and publishes a verifiable revision, cursor, and hash. Facts are `verified` only with local evidence; unsupported reports remain `reported`, and disagreements become candidates for human judgment.
 - **`MEMORY_EVENTS.jsonl` is the append-only authority.** `Stop` makes events durable in the outbox before acknowledging the attempt; the projector runs outside the registry lock and retries reuse the same IDs. Repeating an identical `event_id`/payload is a no-op; reusing the ID with different bytes is observable corruption.
 - **`MEMORY_CANDIDATES.jsonl` is the curation queue.** Conflicts and legacy content are never silently promoted. `promote` and `reject` record the decision as a new event; promotion preserves the selected event's JSON type, session, activation/epoch, and source turn.
+- **Registers are scoped.** `git.local-head`, handoffs, verdicts, and change status carry project, work-session, change, branch, or worktree scope. Two branches do not create a global conflict; only events in the same scope and causal lineage may advance automatically.
+- **`EVIDENCE_INDEX.jsonl` is local recall.** Markdown is chunked by headings and blocks without requiring the Observer. Ranking combines BM25, exact phrases, field weights, authority, validity, bounded recency, and source diversity; `UserPromptSubmit` injects only relevant passages with provenance.
 
 Artifacts stay under `.brain/` only. Sanitization strips secrets, tokens, local paths, transcripts, and harness payloads both before persistence and before injection. Events carry a `project_id`, and one vault never accepts another project's events.
 
@@ -373,6 +392,8 @@ Codex uses `session_id`/`turn_id` plus transcript order, with no artificial caus
 npx --no-install wendkeep memory status --gate --vault .MyApp-vault
 npx --no-install wendkeep memory migrate --vault .MyApp-vault          # preview, zero writes
 npx --no-install wendkeep memory migrate --apply --vault .MyApp-vault  # backup + candidates + v2 bundle
+npx --no-install wendkeep memory rescope --vault .MyApp-vault          # preview without values
+npx --no-install wendkeep memory rescope --apply --vault .MyApp-vault  # append-only and idempotent
 ```
 
 ### Health and recovery
@@ -487,10 +508,10 @@ Beyond capturing sessions, wendkeep is a **harness**: a native, zero‑dependenc
 explore → propose → apply (TDD) → verify → archive
 ```
 
-- **Propose** — `wendkeep change new <slug>` scaffolds `08-Mudanças/<slug>/` (`proposta.md`, `design.md`, `tarefas.md`; `--simple` skips the design). It becomes the global *current* change. When the change declares `spec_impact: required`, you author the delta yourself at `specs/<capability>/spec.md` — there is no placeholder to delete. Multiple changes may remain open: `change list`/`status` and the hooks show every pending one, while commands without `--change` act on the current one alone. `change use <slug>` changes focus and `change continue <archived> <new>` creates an auditable continuation.
+- **Propose** — `wendkeep change new <slug>` scaffolds `08-Mudanças/<slug>/` (`proposta.md`, `design.md`, `tarefas.md`; `--simple` skips the design). `--guide` creates the compact GUIDE contract and omits automatic design/spec/ADR when `contract_impact:none`. It becomes the global *current* change. When the change declares `spec_impact: required`, you author the delta yourself at `specs/<capability>/spec.md` — there is no placeholder to delete. Multiple changes may remain open: `change list`/`status` and the hooks show every pending one, while commands without `--change` act on the current one alone. `change use <slug>` changes focus and `change continue <archived> <new>` creates an auditable continuation.
 - **Apply** — implement each `tarefas.md` task. Mark machine proof with one or more `[sensor:<id>]` tags on the same task: every distinct ID enters the gate once, in declaration order. Also mark satisfied requirements with one or more `[req:<ID>]` tags.
 - **Verify** — `wendkeep verify` runs the sensors your tasks declared (from `wendkeep.sensors.json` at the project root) and writes `evidencia.json`. A red `critical` fails the gate; a red `warning` is advisory. Failures retain only a bounded, sanitized diagnostic; green output is not persisted. `verify --deep` builds a self-contained package with complete effective requirements (living contract + this change's delta), so the independent verifier never needs to reconstruct unarchived requirements from `07-Specs`. Every change needs a `verdict.json` to archive; `verify --deep` writes a trivial one automatically when the change declares no `[req:]`.
-- **Archive** — `wendkeep change archive <slug>` **gates** on the evidence (blocks unless every declared critical sensor is green), promotes each capability's spec delta (`ADDED`/`MODIFIED`/`REMOVED`) into the living `07-Specs/<capability>.md`, moves the change to `_arquivo/`, and mints an ADR in `04-Decisões/`.
+- **Archive** — `wendkeep change archive <slug>` **gates** on the evidence (blocks unless every declared critical sensor is green), promotes each applicable spec delta (`ADDED`/`MODIFIED`/`REMOVED`) into the living `07-Specs/<capability>.md` and moves the change to `_arquivo/`. GOVERN/ASSURE mint an ADR in `04-Decisões/`; compact GUIDE with no contract impact does not mint one automatically.
 
 > The gate blocks unless the scaffold is filled, no task is open, evidence is fresh, and every declared requirement is covered. **`--force` waives exactly one of those — the open-task check — and is the human's call, never the agent's.** An unfilled scaffold, a red critical sensor, stale evidence, an orphan requirement or a missing verdict block regardless.
 

package/README.md

@@ -84,11 +84,11 @@ Decisions, dead ends, the reason you chose X over Y — gone next session. The p
 |---|---|
 | **Capture** — every turn, on disk | `SessionStart` / `Stop` hooks write each session to a dated Markdown note: prompts, iterations, files touched, wikilinks. |
 | **Derive** — decisions, bugs, learnings | Pulled from the transcript into their own notes, backlinked to the session. Your history becomes navigable, not archival. |
-| **Recall** — injected back | Canonical `CORE` + operational `SHARED_MEMORY`, with explicit budgets, are injected on `startup`, `/clear`, and `/compact`; `DIGEST` remains a deep-recall index and legacy fallback. |
+| **Recall** — injected back | Canonical `CORE` + operational `SHARED_MEMORY` enter on `startup`, `/clear`, and `/compact`; on every prompt, the local chunk index selects a few passages with source, authority, and validity under an explicit budget. |
 | **Cost** — what it all cost | Per‑model, cache‑aware token pricing per session — plus `cost --trend` with a run‑rate projection across the whole vault; research previews without a final rate remain unestimated. |
 | **Multi‑agent** — one vault, both agents | `init` wires the session hooks into `.claude/settings.json` *and* `.codex/hooks.json`, and every note is tagged with the agent that wrote it: Claude Code is detected from its environment, anything else is recorded as Codex. One shared graph, whichever agent you are in. |
 | **Local‑first** — no cloud, no account | Everything is plain Markdown on your disk. An optional MCP server (`@bitbonsai/mcpvault`) lets the agent read/write the vault. |
-| **Local Observer** — many projects, one view | `wendkeep observer` keeps documents, sessions, agents, tokens, costs, calls, and transcripts in the Docker volume SQLite database; every project gets a **Consumption** tab in the read-only dashboard at `http://127.0.0.1:8787/`, loopback has no token, and unavailable hooks use a gzip outbox without blocking the session, including large transcripts. |
+| **Local Observer** — many projects, one view | `wendkeep observer` keeps documents, FTS5 chunks, sessions, agents, tokens, costs, calls, and transcripts in SQLite; search returns the matching passage with provenance and falls back to the local lexical ranker when FTS5 is unavailable. |
 
 During historical migration, the Observer preserves differences between frontmatter totals and the
 ledger as explicit reconciliation rows, and disambiguates duplicate `session_id` values per file
@@ -100,7 +100,7 @@ The Codex scope guard treats `commit`, `push`, `pull`, `merge`, `publish`, and d
 operations as independent capabilities, including inside compound commands.
 
 - Node.js ≥ 18
-- An AI coding agent with hooks. `init` wires **Claude Code** and **Codex** automatically — Codex gets eight compatible hooks, including the scoped `PreToolUse` guard, and enumerates them untrusted, so approve its “Hooks need review” prompt once at startup (see [Notes & roadmap](#notes--roadmap))
+- An AI coding agent with hooks. `init` wires **Claude Code** and **Codex** automatically — Codex gets twelve compatible hooks, including per-prompt recall and the scoped `PreToolUse` guard, and enumerates them untrusted, so approve its “Hooks need review” prompt once at startup (see [Notes & roadmap](#notes--roadmap))
 - Obsidian (to view the graph) — optional but the point
 
 ## Install & set up
@@ -115,7 +115,7 @@ npx wendkeep init
 
 1. Create the vault folder taxonomy and a templated `README.md` (default vault: `<project>/.<project-name>-vault`, e.g. `.MyApp-vault`; override with `--vault`).
 2. Write a provider-neutral **`.wendkeep.json`** binding at the project root and a matching `.brain/PROJECT.json` marker in the vault, then merge the session hooks into **`.claude/settings.json`**. The binding is provider-neutral by design: any agent resolves the same vault from its session `cwd`, with no machine-global environment variable. Older registrations already in `.claude/settings.json` are adopted automatically.
-3. Wire the Codex hooks in **`.codex/hooks.json`** — eleven compatible entries: `brain-inject` + `session-start` + `observer-publish` on `SessionStart`, `session-ensure` + `change-context` on `UserPromptSubmit`, `session-stop` + `observer-publish` + `change-nag` on `Stop`, `subagent-stop` + `observer-publish` on `SubagentStop`, and `change-guard` on `PreToolUse` for `Bash`, `exec_command`, `apply_patch`, and mutable MCP tools, always in the `npx wendkeep hook <name>` form. `observer-publish` keeps the sanitized index projection and also sends the local SQL authority with documents, consumption, and transcripts; it does not replace the local lifecycle. The guard accepts object, raw-string, and argv Codex payloads; before a mutation it compares the session with the project, Git root, remote, branch, and worktree, denying missing or divergent targets. The other four stay out because Codex offers no equivalent payload, tool, or event: `change-warn` (no reliable `tool_input.file_path`), `plan-capture` (no `ExitPlanMode`), `decision-capture` (`AskUserQuestion` is Claude-only), and `task-log` (`TaskCompleted` is not in Codex's event enum). Codex scope blocks use `permissionDecision: "deny"`; `ask` is never emitted in `PreToolUse`. The merge remains non-destructive, preserves third-party hooks, and migrates legacy `timeout` to `timeoutSec`. **Codex enumerates every hook as untrusted and runs none until you approve the “Hooks need review” prompt at startup — `init` cannot pre-approve them**.
+3. Wire the Codex hooks in **`.codex/hooks.json`** — twelve compatible entries: `brain-inject` + `session-start` + `observer-publish` on `SessionStart`, `session-ensure` + `evidence-context` + `change-context` on `UserPromptSubmit`, `session-stop` + `observer-publish` + `change-nag` on `Stop`, `subagent-stop` + `observer-publish` on `SubagentStop`, and `change-guard` on `PreToolUse` for `Bash`, `exec_command`, `apply_patch`, and mutable MCP tools, always in the `npx wendkeep hook <name>` form. `observer-publish` keeps the sanitized index projection and also sends the local SQL authority with documents, consumption, and transcripts; it does not replace the local lifecycle. The guard accepts object, raw-string, and argv Codex payloads; before a mutation it compares the session with the project, Git root, remote, branch, and worktree, denying missing or divergent targets. The other four stay out because Codex offers no equivalent payload, tool, or event: `change-warn` (no reliable `tool_input.file_path`), `plan-capture` (no `ExitPlanMode`), `decision-capture` (`AskUserQuestion` is Claude-only), and `task-log` (`TaskCompleted` is not in Codex's event enum). Codex scope blocks use `permissionDecision: "deny"`; `ask` is never emitted in `PreToolUse`. The merge remains non-destructive, preserves third-party hooks, and migrates legacy `timeout` to `timeoutSec`. **Codex enumerates every hook as untrusted and runs none until you approve the “Hooks need review” prompt at startup — `init` cannot pre-approve them**.
 4. Add the **`wendkeep-vault`** MCP server to `.mcp.json` so the agent can read/write the vault. Skip with `--no-mcp` — e.g. when the agent already has a vault MCP. (`--no-mcp` skips *only wendkeep's own* MCP; companion MCPs still follow `--companions`.)
 5. Offer to pin **companion** plugins/MCP (multi-choice; **none** pre-checked — wendkeep is a neutral harness and presumes no third-party plugin). Each is wired the most agent-agnostic way it supports:
    - **`context-mode`** — context optimizer + FTS5 memory, wired as a Claude Code plugin. It ships its own MCP server, so wendkeep deliberately adds no `.mcp.json` entry (registering both cold-started two servers at once). On non-Claude agents, add the MCP by hand: `npx -y context-mode`.
@@ -125,9 +125,9 @@ npx wendkeep init
 
    Control with `--companions <csv>` or `--no-companions`. The Claude Code plugin layer (`extraKnownMarketplaces` + `enabledPlugins`) is wired as a bonus where the companion has one.
 6. Install a **color system** into the vault's `.obsidian/`: a CSS snippet that accents notes by type (session/decision/bug/learning, via the `cssclasses` the hooks emit) plus graph color groups by folder. Non-destructive merge into `appearance.json`/`graph.json`; skip with `--no-colors`. Re-apply it any time on an existing vault with `wendkeep theme sync` — Obsidian owns `graph.json` and can drop the color groups (a grey graph); the re-sync restores them without a full re-`init`.
-7. Seed **Shared Project Memory v2** without overwriting existing artifacts: `.brain/CORE.md` (hand-curated canonical truth), `.brain/SHARED_MEMORY.md` (generated operational state), `.brain/MEMORY_EVENTS.jsonl` (append-only ledger), `.brain/MEMORY_CANDIDATES.jsonl` (curation queue), and `.brain/COMPACTION_PROTOCOL.md`. The durable outbox appears under `.brain/memory-outbox/` when events exist; `DIGEST.md` and `index.jsonl` remain deep recall. Everything stays local to the vault.
+7. Seed **Shared Project Memory v2** without overwriting existing artifacts: `.brain/CORE.md`, `.brain/SHARED_MEMORY.md`, `.brain/MEMORY_EVENTS.jsonl`, `.brain/MEMORY_CANDIDATES.jsonl`, and `.brain/COMPACTION_PROTOCOL.md`. The durable outbox appears under `.brain/memory-outbox/`; `EVIDENCE_INDEX.jsonl` is rebuilt locally from chunks while `DIGEST.md`/`index.jsonl` remain compatible. Everything stays in the vault.
 8. Seed the **definitions + skills layer**: `.brain/agents/` + `.brain/skills/` (versioned source of truth), including the native process skills `wk-workflow` / `wk-tdd` / `wk-debugging` / `wk-brainstorming` / `wk-planning` / `wk-verify` (some ship templates — e.g. `wk-verify`'s `verdict-template.json` + reviewer prompt). `init` runs `wendkeep sync-defs` for you, delivering the skills to `.claude/skills/` and `.agents/skills/`, and the agent definitions (`.brain/agents/*.toml`) to `.codex/agents/`, plus a managed section in `AGENTS.md` that indexes the skills for Codex; `sync-defs --check` detects stale copies (re-run `sync-defs` after editing `.brain`).
-9. Seed the **change/spec lifecycle**: the `07-Specs/` + `08-Mudanças/` folders and a native `wendkeep.sensors.json` — critical memory validation/health sensors plus one for each of `typecheck` / `test` / `lint` / `build` found in your `package.json`. `memory-health` blocks delivery on corruption, projection divergence, or an active conflict; pending outbox events and ordinary candidates are warnings. Add sensors with `wendkeep sensors add`. Drives `wendkeep change` / `wendkeep verify` — see **Change lifecycle** below.
+9. Seed the **change/spec lifecycle**: the `07-Specs/` + `08-Mudanças/` folders and a native `wendkeep.sensors.json` — critical memory validation/health sensors plus one for each of `typecheck` / `test` / `lint` / `build` found in your `package.json`. `memory-health` blocks delivery on corruption or projection divergence; semantic conflicts degrade only the affected keys and await curation. Pending outbox events and ordinary candidates are warnings. Add sensors with `wendkeep sensors add`. Drives `wendkeep change` / `wendkeep verify` — see **Change lifecycle** below.
 
 ```bash
 npx wendkeep init --vault "~/vaults/work" --project . --yes   # non-interactive (no companions unless you ask)
@@ -257,7 +257,7 @@ deliberate opt-in and runs that command's own validations:
 |---|---|---|
 | `OFF` | LLM-native harness | No Wend router, skill gate, or gates; explicit selection only. |
 | `FLOW` | E → V | Microcontract with Git baseline, allowlist, sensor, and receipt, without a change. |
-| `GUIDE` | P → E → V | Compact guided change. |
+| `GUIDE` | P → E → V | Compact change; no automatic design/spec/ADR when contract impact is none. |
 | `GOVERN` | P → R → E → V | Current a2 loop and compatible fallback. |
 | `ASSURE` | P → R → E → V → C | Governance with confirmation and handoff. |
 
@@ -317,13 +317,25 @@ positive causal turn and sequence that agree in the registry.
 “Small” describes size, not risk. The harness uses this matrix to choose and record a temporary
 route; semantic inference remains in the agent, not Wend Runtime:
 
-| Situation | Suggested profile |
-|---|---|
-| Question, inspection, or diagnosis with no mutation | No profile transition |
-| Local, reversible fix with an allowlist and no contract/spec change | `FLOW` (`E → V`) |
-| Small behavior change that needs a change but not formal Wend Runtime review | `GUIDE` (`P → E → V`) |
-| Normal, ambiguous, public-contract, security, dependency, CI/release, or policy change | `GOVERN` (`P → R → E → V`) |
-| Work requiring explicit confirmation and handoff | `ASSURE` (`P → R → E → V → C`) |
+| Situation | Work kind | Suggested profile | New change |
+|---|---|---|---|
+| Question, inspection, or diagnosis with no mutation | `inspection` | No transition | No |
+| Local, reversible fix with an allowlist and no contract/spec change | `maintenance` | `FLOW` (`E → V`) | No |
+| Small behavior change without formal review | `implementation` | `GUIDE` (`P → E → V`) | Yes, compact |
+| Public contract, security, schema, dependency, CI/release workflow, or policy | `implementation` | `GOVERN`/`ASSURE` | Yes |
+| Merge, push, tag, or publication of approved behavior | `delivery` | `ASSURE` | No |
+| Operational recovery without code/config correction | `recovery` | `FLOW`/`ASSURE` | No |
+
+Work kind, profile, contract impact, and operational risk are independent dimensions. A
+`delivery` records authorized capabilities and an append-only receipt without creating a change,
+spec, or ADR. If delivery requires a code/config edit, it pauses and work returns to
+`implementation`:
+
+```bash
+npx wendkeep delivery start release-0-74-0 --allow git:merge --allow git:push --allow publish --source-change <slug> --source-commit <sha>
+npx wendkeep delivery status release-0-74-0
+npx wendkeep delivery finish release-0-74-0 --target main --ci-url <url> --version 0.74.0 --npm-integrity <sha512> --release-url <url>
+```
 
 If the harness does not record a lease, a small fix remains under the configured profile —
 `GOVERN` by default. `OFF` does not mean “simple task”: it is a persistent human choice that hands
@@ -344,6 +356,11 @@ and owner+lease locks validate physical topology. Concurrent promotion elects on
 retry through `--change-slug`. Read the complete
 [Operating profiles guide](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/operating-profiles.md).
 
+`wendkeep doctor` separates structural errors, workflow attention, repairable debt, and semantic
+ambiguity. Use `--scope core` for Keep Core health, `--scope runtime` for governance, and
+`--strict` in CI/release; `wendkeep sync` validates Core only so work in progress does not become
+an installation failure.
+
 ## Shared Project Memory v2
 
 Hot memory now separates human authorship, operational state, and evidence:
@@ -352,6 +369,8 @@ Hot memory now separates human authorship, operational state, and evidence:
 - **`SHARED_MEMORY.md` is generated operational state.** The `Stop` hook turns the session handoff into sanitized events; the projector deterministically reduces the ledger and publishes a verifiable revision, cursor, and hash. Facts are `verified` only with local evidence; unsupported reports remain `reported`, and disagreements become candidates for human judgment.
 - **`MEMORY_EVENTS.jsonl` is the append-only authority.** `Stop` makes events durable in the outbox before acknowledging the attempt; the projector runs outside the registry lock and retries reuse the same IDs. Repeating an identical `event_id`/payload is a no-op; reusing the ID with different bytes is observable corruption.
 - **`MEMORY_CANDIDATES.jsonl` is the curation queue.** Conflicts and legacy content are never silently promoted. `promote` and `reject` record the decision as a new event; promotion preserves the selected event's JSON type, session, activation/epoch, and source turn.
+- **Registers are scoped.** `git.local-head`, handoffs, verdicts, and change status carry project, work-session, change, branch, or worktree scope. Two branches do not create a global conflict; only events in the same scope and causal lineage may advance automatically.
+- **`EVIDENCE_INDEX.jsonl` is local recall.** Markdown is chunked by headings and blocks without requiring the Observer. Ranking combines BM25, exact phrases, field weights, authority, validity, bounded recency, and source diversity; `UserPromptSubmit` injects only relevant passages with provenance.
 
 Artifacts stay under `.brain/` only. Sanitization strips secrets, tokens, local paths, transcripts, and harness payloads both before persistence and before injection. Events carry a `project_id`, and one vault never accepts another project's events.
 
@@ -373,6 +392,8 @@ Codex uses `session_id`/`turn_id` plus transcript order, with no artificial caus
 npx --no-install wendkeep memory status --gate --vault .MyApp-vault
 npx --no-install wendkeep memory migrate --vault .MyApp-vault          # preview, zero writes
 npx --no-install wendkeep memory migrate --apply --vault .MyApp-vault  # backup + candidates + v2 bundle
+npx --no-install wendkeep memory rescope --vault .MyApp-vault          # preview without values
+npx --no-install wendkeep memory rescope --apply --vault .MyApp-vault  # append-only and idempotent
 ```
 
 ### Health and recovery
@@ -487,10 +508,10 @@ Beyond capturing sessions, wendkeep is a **harness**: a native, zero‑dependenc
 explore → propose → apply (TDD) → verify → archive
 ```
 
-- **Propose** — `wendkeep change new <slug>` scaffolds `08-Mudanças/<slug>/` (`proposta.md`, `design.md`, `tarefas.md`; `--simple` skips the design). It becomes the global *current* change. When the change declares `spec_impact: required`, you author the delta yourself at `specs/<capability>/spec.md` — there is no placeholder to delete. Multiple changes may remain open: `change list`/`status` and the hooks show every pending one, while commands without `--change` act on the current one alone. `change use <slug>` changes focus and `change continue <archived> <new>` creates an auditable continuation.
+- **Propose** — `wendkeep change new <slug>` scaffolds `08-Mudanças/<slug>/` (`proposta.md`, `design.md`, `tarefas.md`; `--simple` skips the design). `--guide` creates the compact GUIDE contract and omits automatic design/spec/ADR when `contract_impact:none`. It becomes the global *current* change. When the change declares `spec_impact: required`, you author the delta yourself at `specs/<capability>/spec.md` — there is no placeholder to delete. Multiple changes may remain open: `change list`/`status` and the hooks show every pending one, while commands without `--change` act on the current one alone. `change use <slug>` changes focus and `change continue <archived> <new>` creates an auditable continuation.
 - **Apply** — implement each `tarefas.md` task. Mark machine proof with one or more `[sensor:<id>]` tags on the same task: every distinct ID enters the gate once, in declaration order. Also mark satisfied requirements with one or more `[req:<ID>]` tags.
 - **Verify** — `wendkeep verify` runs the sensors your tasks declared (from `wendkeep.sensors.json` at the project root) and writes `evidencia.json`. A red `critical` fails the gate; a red `warning` is advisory. Failures retain only a bounded, sanitized diagnostic; green output is not persisted. `verify --deep` builds a self-contained package with complete effective requirements (living contract + this change's delta), so the independent verifier never needs to reconstruct unarchived requirements from `07-Specs`. Every change needs a `verdict.json` to archive; `verify --deep` writes a trivial one automatically when the change declares no `[req:]`.
-- **Archive** — `wendkeep change archive <slug>` **gates** on the evidence (blocks unless every declared critical sensor is green), promotes each capability's spec delta (`ADDED`/`MODIFIED`/`REMOVED`) into the living `07-Specs/<capability>.md`, moves the change to `_arquivo/`, and mints an ADR in `04-Decisões/`.
+- **Archive** — `wendkeep change archive <slug>` **gates** on the evidence (blocks unless every declared critical sensor is green), promotes each applicable spec delta (`ADDED`/`MODIFIED`/`REMOVED`) into the living `07-Specs/<capability>.md` and moves the change to `_arquivo/`. GOVERN/ASSURE mint an ADR in `04-Decisões/`; compact GUIDE with no contract impact does not mint one automatically.
 
 > The gate blocks unless the scaffold is filled, no task is open, evidence is fresh, and every declared requirement is covered. **`--force` waives exactly one of those — the open-task check — and is the human's call, never the agent's.** An unfilled scaffold, a red critical sensor, stale evidence, an orphan requirement or a missing verdict block regardless.
 

package/docs/en/commands/changes-and-verification.md

@@ -25,7 +25,7 @@ Initialize the project, keep the vault healthy, and provide a valid `wendkeep.se
 ## Syntax
 
 ```bash
-npx wendkeep change new <slug>
+npx wendkeep change new <slug> [--simple|--guide]
 npx wendkeep change status [slug]
 npx wendkeep spec effective --change <slug>
 npx wendkeep sensors list
@@ -35,8 +35,10 @@ npx wendkeep change archive <slug>
 
 ## Options and exit codes
 
-- `wendkeep change new <slug> [--simple]` creates a change; `--simple` only skips design, is not
-  `FLOW`, and preserves the legacy lifecycle/ADR contract.
+- `wendkeep change new <slug> [--simple|--guide]` creates a change. `--simple` only skips design,
+  is not `FLOW`, and preserves the legacy lifecycle/ADR contract. `--guide` creates the compact
+  GUIDE contract (objective, acceptance, areas, tests, and result), with no automatic
+  design/spec/ADR when `contract_impact:none`.
 - `change use`, `list`, `show`, `status`, `diff`, `done`, and `undone` inspect or update work
   without archiving it.
 - `change continue <archived> <new>` starts follow-up work without inheriting stale proof.
@@ -52,6 +54,7 @@ npx wendkeep change archive <slug>
 
 ```bash
 npx wendkeep change new tenant-login
+npx wendkeep change new internal-adjustment --guide
 npx wendkeep spec effective --change tenant-login
 npx wendkeep change done 1.1 --change tenant-login
 npx wendkeep verify --change tenant-login
@@ -67,8 +70,10 @@ npx wendkeep sensors add api-contracts "npm run test:contracts" --severity criti
 
 ## Expected result
 
-An archived change promotes its delta into the living spec, preserves proposal/design/tasks/proof,
-and mints an ADR. Archive passes only with closed tasks, green required sensors, and a fresh verdict.
+An archived change promotes its delta into the living spec when applicable and preserves proposal,
+tasks/proof, and design when present. GOVERN/ASSURE mint an ADR; compact GUIDE with no contract
+impact does not mint one automatically. Archive passes only with closed tasks, green required
+sensors, and a fresh verdict.
 
 ## Tool-scope fence
 

package/docs/en/commands/maintenance-and-diagnostics.md

@@ -23,7 +23,7 @@ Run from the project root or provide `--project` and `--vault` explicitly.
 ## Syntax
 
 ```bash
-npx --no-install wendkeep doctor [--vault <vault>]
+npx --no-install wendkeep doctor [--vault <vault>] [--scope all|core|runtime] [--strict]
 npx --no-install wendkeep memory curate --vault <vault>
 npx --no-install wendkeep sync-defs [--check|--reseed] --vault <vault> --project <root>
 npx --no-install wendkeep theme sync --vault <vault>
@@ -33,7 +33,10 @@ npx --no-install wendkeep --help
 
 ## Options and exit codes
 
-- `doctor` is read-only; exit `0` accepts recoverable warnings, while non-zero means failure.
+- `doctor` is read-only. By default only structural errors produce a non-zero exit; `--strict`
+  also fails on workflow attention, repairable debt, semantic degradation, and warnings.
+- `--scope core` checks the installation, binding, ledger, and Keep Core only. `--scope runtime`
+  checks changes, sensors, and governance only. The default `all` reports both surfaces.
 - `doctor` uses human-readable output with `[integrity]` and `[memory]` sections, friendly
   categories, and a copyable next action. The `vault-health.mjs` hook remains the JSON surface for
   automation; neither surface applies curation.
@@ -44,8 +47,9 @@ npx --no-install wendkeep --help
   IDs, and checkpoint) with outbox, ledger, and SHARED; they do not infer health from revision alone.
 - `revision: 0` after a valid migration, with no v2 attempt, is healthy. A `degraded` attempt whose
   events remain durable in the outbox/ledger is a recoverable warning.
-- An ambiguous attempt, a lost event ID (absent from ledger and outbox), `projected` state found
-  only in the outbox, or a mismatched checkpoint is blocking.
+- An ambiguous publication attempt, a lost event ID (absent from ledger and outbox), `projected`
+  state found only in the outbox, or a mismatched checkpoint is a structural block. Active
+  semantic candidates degrade memory by key and remain available for explicit curation.
 - For session observability, `legacy`, `degraded`, `stale`, and `manifest-unproven` require
   reconciliation or more evidence. Only fresh `none` and fresh `complete` are healthy: frontier,
   checkpoint, root stat, and source manifest must agree.
@@ -63,6 +67,8 @@ Post-update checklist:
 npx --no-install wendkeep --version
 npx --no-install wendkeep sync-defs --check --vault .MyApp-vault --project .
 npx --no-install wendkeep doctor --vault .MyApp-vault
+npx --no-install wendkeep doctor --scope core --vault .MyApp-vault
+npx --no-install wendkeep doctor --scope runtime --strict --vault .MyApp-vault
 npx --no-install wendkeep memory status --gate --vault .MyApp-vault
 npx --no-install wendkeep memory curate --vault .MyApp-vault
 npx --no-install wendkeep memory candidates --active --vault .MyApp-vault
@@ -72,10 +78,11 @@ npx --no-install wendkeep cost rebuild --session <id> --json --vault .MyApp-vaul
 
 ## Expected result
 
-Doctor names sessions, registry, links, notes, prices, derived sections, and memory as healthy or
+Doctor separates structural errors, workflow attention, repairable debt, and semantic ambiguity.
+It names sessions, registry, links, notes, prices, derived sections, and memory as healthy or
 provides a specific diagnostic/repair command. For memory, it distinguishes a valid initial empty
-state, recoverable pending replay, and lost/divergent lifecycle state. It never repairs implicitly
-or echoes private projector-error content into its report. For session observability, it separates
+state, recoverable pending replay, key-scoped conflicts, and lost/divergent lifecycle state. It
+never repairs implicitly or echoes private projector-error content into its report. For session observability, it separates
 fresh `none`/`complete` from legacy, degraded, stale, or manifest-unproven state and gives a
 dry-run path before any write.
 
@@ -87,10 +94,11 @@ dry-run path before any write.
   `npx --no-install wendkeep memory migrate --apply --vault <vault>` with the resolved Vault, but
   migration remains opt-in and must be planned separately.
 - `degraded` plus an intact outbox: warning; preserve the outbox and allow idempotent replay.
-- `ambiguous`, lost publication, or a mismatched checkpoint: blocking; preserve registry, ledger,
+- Ambiguous publication, lost publication, or a mismatched checkpoint: blocking; preserve registry, ledger,
   outbox, and SHARED so `last_memory_attempt` can be correlated before repair.
 - Corrupt bundle: preserve evidence and run `memory status --gate` before `memory repair`.
-- An active semantic conflict requires a human decision: `memory repair` does not choose a winner.
+- An active semantic conflict degrades only the affected memory key and requires a human decision:
+  `memory repair` does not choose a winner.
   Start with the guided menu `memory curate --vault <vault>`. For advanced inspection or a
   non-interactive terminal, list safe IDs with `memory candidates --active --vault <vault>`, review
   the evidence, and then use

package/docs/en/commands/memory.md

@@ -30,6 +30,7 @@ Pass the vault explicitly in automation. Preserve backups and evidence before re
 npx wendkeep memory status [--gate] --vault <vault>
 npx wendkeep memory curate --vault <vault>
 npx wendkeep memory candidates [--active] --vault <vault>
+npx wendkeep memory rescope [--apply] --vault <vault>
 npx wendkeep memory repair --vault <vault>
 npx wendkeep memory recover-attempt <session> [--apply] --vault <vault>
 npx wendkeep memory reconcile <ambiguous-session> --by-session <successor-session> --reason <reason> [--apply] --vault <vault>
@@ -51,7 +52,7 @@ npx wendkeep validate-memory --vault <v2-vault>
   non-TTY environment it exits `2` without changing bytes and recommends the advanced fallback
   `memory candidates --active`.
 - `memory candidates` is read-only and prints deterministic JSON containing only `candidate_id`,
-  `reason`, `status`, `memory_key`, and `event_ids`; it does not expose memory values or content and
+  `reason`, `status`, `memory_key`, scope when present, and `event_ids`; it does not expose memory values or content and
   does not create a lock or mutate the bundle. `--active` omits terminal candidates (`resolved`,
   `rejected`, and `superseded`). A missing status is normalized to `active`.
 - For `memory candidates`, exit `0` means a valid inventory (including empty or conflicted), exit
@@ -95,6 +96,18 @@ npx wendkeep validate-memory --vault <v2-vault>
   and its successor. Replay is CORE-aware, checkpoints use the physical ledger cursor, and the
   command neither rewrites ledger/CORE/notes nor consumes the outbox. Retrying the same applied
   decision is idempotent.
+- `memory rescope` is a dry run by default and lists only planned IDs, keys, and scopes. With
+  `--apply`, it appends explicit project, work-session, change, branch, or worktree events while
+  preserving historic bytes as the ledger prefix. Ambiguous candidates are neither migrated nor
+  assigned a winner; retry returns `unchanged`.
+- Registers such as `git.local-head`, `handoff.latest`, `quality.latest-*`, and
+  `change.<slug>.status` compete only inside the same scope. Automatic resolution still requires
+  the same project and causal lineage; incompatible decisions, constraints, and blockers remain
+  human-curated. An ambiguous key is omitted from SHARED without removing CORE or independent keys.
+- `.brain/EVIDENCE_INDEX.jsonl` chunks documents by heading and block and records file, heading,
+  type, change, session, work session, authority, date, validity, and hash. `/brain-recall` and the
+  `UserPromptSubmit` hook use BM25, exact phrase, field weights, authority, validity, bounded
+  recency, and diversity to return the matching passage with provenance.
 - Every memory path validates the physical topology of `.brain`, ledger, outbox, CORE, SHARED,
   candidates, registry, notes, backups, temporary files, and sidecars before reading or writing.
   Junctions, symlinks, reparse points, or hardlinks fail closed without touching external bytes.
@@ -136,6 +149,8 @@ npx wendkeep validate-memory --vault <v2-vault>
 npx wendkeep memory status --gate --vault .MyApp-vault
 npx wendkeep memory curate --vault .MyApp-vault
 npx wendkeep memory candidates --active --vault .MyApp-vault
+npx wendkeep memory rescope --vault .MyApp-vault
+npx wendkeep memory rescope --apply --vault .MyApp-vault
 npx wendkeep memory recover-attempt session-123 --vault .MyApp-vault
 npx wendkeep memory recover-attempt session-123 --apply --vault .MyApp-vault
 npx wendkeep memory reconcile old --by-session current --reason "delivery continued" --vault .MyApp-vault

package/docs/en/commands/observer.md

@@ -96,6 +96,12 @@ cost/token total recorded in frontmatter is preserved through an explicit reconc
 the detailed ledger does not add up; that row does not invent calls. Historical sessions sharing
 one `session_id` receive a canonical per-file identity so one rollup cannot overwrite the other.
 
+In schema 4, each ingested document is also projected into chunks carrying path, heading,
+authority, time, and validity. The Observer feature-probes FTS5 and uses the index when the
+extension is available; otherwise it preserves the same semantics through a lexical fallback.
+Search returns the passage containing the match and its provenance rather than only the beginning
+of the document.
+
 `init` projects `observer-publish` into `SessionStart`, `Stop`, and `SubagentStop` after the primary
 hooks. When the server is unavailable, it writes snapshots to `.brain/observer-outbox/` and SQL
 events to `.brain/observer-sql-outbox/` without blocking the session; a later run retries the
@@ -139,7 +145,8 @@ complete, archive, repair, or promote state.
   rollups, calls, and transcripts.
 - `GET /v1/projects/:project_id/memory/tree` — document tree and metadata.
 - `GET /v1/projects/:project_id/memory/document?path=...` — complete Markdown content.
-- `GET /v1/projects/:project_id/memory/search?q=...` — path and body search.
+- `GET /v1/projects/:project_id/memory/search?q=...` — ranked chunk search with matching passage
+  and provenance; uses a lexical fallback when FTS5 is unavailable.
 - `GET /v1/projects/:project_id/sync` — mode, counts, conflicts, and latest event.
 - `PUT /v1/projects/:project_id/sync` — compatibility configuration; SQL remains authoritative.
 - `GET /v1/projects/:project_id/memory/export` — read-only export with complete content.