wendkeep 0.72.1 → 0.74.0

package/src/delivery.mjs

@@ -0,0 +1,303 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { basename, join, resolve } from 'node:path';
+import {
+  assertVaultPathSafe, mkdirVaultPath, writeVaultFileSync,
+} from '../hooks/vault-path-safety.mjs';
+import { resolveProjectVault } from './project-vault.mjs';
+import { createWorkRoute } from './work-kind.mjs';
+
+export const DELIVERY_HELP = `wendkeep delivery <subcommand>
+
+  start [id] --allow <capability> [--source-change <slug>] [--source-commit <sha>]
+  status [id]
+  finish [id] [--target <ref>] [--ci-url <url>] [--version <x.y.z>]
+              [--npm-integrity <sha512-...>] [--release-url <url>]
+  abandon [id] --reason <text>
+
+Common options: --project <path> --vault <path> --json
+Delivery authorizes operational risk and creates an append-only receipt. It never creates a change,
+spec, or ADR. If code/config must change, abandon or pause delivery and resume an implementation.
+`;
+
+export const DELIVERY_CAPABILITIES = Object.freeze([
+  'git:merge', 'git:pull', 'git:push', 'git:tag', 'publish',
+]);
+
+const VALUE_OPTIONS = new Set([
+  '--project', '--vault', '--allow', '--source-change', '--source-commit', '--target',
+  '--ci-url', '--version', '--npm-integrity', '--release-url', '--reason',
+]);
+
+function parseArgv(argv) {
+  const values = new Map();
+  const positionals = [];
+  let json = false;
+  for (let index = 0; index < argv.length; index += 1) {
+    const item = argv[index];
+    if (item === '--json') { json = true; continue; }
+    if (item.startsWith('--')) {
+      const eq = item.indexOf('=');
+      const name = eq > 0 ? item.slice(0, eq) : item;
+      if (!VALUE_OPTIONS.has(name)) throw new Error(`opção desconhecida: ${name}`);
+      const value = eq > 0 ? item.slice(eq + 1) : argv[++index];
+      if (!value || value.startsWith('--')) throw new Error(`${name} requer um valor`);
+      const list = values.get(name) || [];
+      list.push(value);
+      values.set(name, list);
+      continue;
+    }
+    positionals.push(item);
+  }
+  return {
+    json,
+    positionals,
+    value: (name) => values.get(name)?.at(-1) || '',
+    all: (name) => values.get(name) || [],
+  };
+}
+
+function git(projectRoot, args, optional = false) {
+  try {
+    return execFileSync('git', args, {
+      cwd: projectRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'],
+    }).trim();
+  } catch (error) {
+    if (optional) return '';
+    throw new Error(`git ${args.join(' ')} falhou: ${String(error.stderr || error.message).trim()}`);
+  }
+}
+
+function deliveryPaths(vaultBase, id = '') {
+  const runtime = join(vaultBase, '.brain', 'runtime');
+  const deliveries = join(runtime, 'deliveries');
+  return {
+    runtime,
+    deliveries,
+    pointer: join(runtime, 'CURRENT_DELIVERY'),
+    receipts: join(runtime, 'delivery-receipts.jsonl'),
+    state: id ? join(deliveries, `${id}.json`) : '',
+  };
+}
+
+function safeId(value) {
+  const id = String(value || '').trim();
+  if (!/^[a-z0-9][a-z0-9._-]{1,100}$/i.test(id)) throw new Error('id de delivery inválido');
+  return id;
+}
+
+function generatedId(now = new Date()) {
+  return `delivery-${now.toISOString().replace(/[-:]/g, '').replace(/\.\d{3}Z$/, 'Z').toLowerCase()}`;
+}
+
+function readPointer(vaultBase) {
+  const { pointer } = deliveryPaths(vaultBase);
+  try { return safeId(readFileSync(pointer, 'utf8').trim()); } catch { return ''; }
+}
+
+export function activeDelivery(vaultBase) {
+  const id = readPointer(vaultBase);
+  if (!id) return null;
+  try {
+    const state = readState(vaultBase, id);
+    return state.state === 'active' ? state : null;
+  } catch {
+    return null;
+  }
+}
+
+function readState(vaultBase, id) {
+  const path = deliveryPaths(vaultBase, id).state;
+  const checked = assertVaultPathSafe(vaultBase, path, {
+    allowMissing: false, expectedType: 'file', label: `delivery ${id}`,
+  });
+  return JSON.parse(readFileSync(checked.target, 'utf8'));
+}
+
+function writeState(vaultBase, state) {
+  const paths = deliveryPaths(vaultBase, state.id);
+  mkdirVaultPath(vaultBase, paths.runtime, { label: 'runtime de delivery' });
+  mkdirVaultPath(vaultBase, paths.deliveries, { label: 'estados de delivery' });
+  writeVaultFileSync(vaultBase, paths.state, `${JSON.stringify(state, null, 2)}\n`, 'utf8', {
+    label: `delivery ${state.id}`,
+  });
+}
+
+function setPointer(vaultBase, id = '') {
+  const paths = deliveryPaths(vaultBase);
+  mkdirVaultPath(vaultBase, paths.runtime, { label: 'runtime de delivery' });
+  writeVaultFileSync(vaultBase, paths.pointer, id ? `${id}\n` : '', 'utf8', {
+    label: 'ponteiro de delivery',
+  });
+}
+
+function appendReceipt(vaultBase, receipt) {
+  const paths = deliveryPaths(vaultBase);
+  mkdirVaultPath(vaultBase, paths.runtime, { label: 'runtime de delivery' });
+  let previous = '';
+  if (existsSync(paths.receipts)) {
+    const checked = assertVaultPathSafe(vaultBase, paths.receipts, {
+      allowMissing: false, expectedType: 'file', label: 'ledger de receipts de delivery',
+    });
+    previous = readFileSync(checked.target, 'utf8');
+  }
+  writeVaultFileSync(vaultBase, paths.receipts, `${previous}${JSON.stringify(receipt)}\n`, 'utf8', {
+    label: 'ledger de receipts de delivery',
+  });
+}
+
+function context(parsed) {
+  const projectRoot = resolve(parsed.value('--project') || process.cwd());
+  const resolved = resolveProjectVault({
+    startDir: projectRoot,
+    explicitVault: parsed.value('--vault'),
+  });
+  const repoRoot = git(projectRoot, ['rev-parse', '--show-toplevel']);
+  return { projectRoot, repoRoot, vaultBase: resolved.base };
+}
+
+function currentId(parsed, vaultBase) {
+  return safeId(parsed.positionals[1] || readPointer(vaultBase));
+}
+
+function ensureClean(repoRoot) {
+  const dirty = git(repoRoot, ['status', '--porcelain']);
+  if (dirty) {
+    const error = new Error('delivery requer working tree limpa; alterações de código/config exigem implementation.');
+    error.code = 'WENDKEEP_DELIVERY_IMPLEMENTATION_REQUIRED';
+    throw error;
+  }
+}
+
+export function startDelivery({ vaultBase, repoRoot, id, capabilities, sourceChange = '', sourceCommit = '', now = new Date() }) {
+  ensureClean(repoRoot);
+  const deliveryId = safeId(id || generatedId(now));
+  const paths = deliveryPaths(vaultBase, deliveryId);
+  if (existsSync(paths.state)) throw new Error(`delivery já existe: ${deliveryId}`);
+  const commit = sourceCommit || git(repoRoot, ['rev-parse', 'HEAD']);
+  git(repoRoot, ['cat-file', '-e', `${commit}^{commit}`]);
+  const requestedCapabilities = [...new Set((capabilities || []).map((item) => String(item).trim()).filter(Boolean))];
+  const invalidCapabilities = requestedCapabilities.filter((item) => !DELIVERY_CAPABILITIES.includes(item));
+  if (invalidCapabilities.length) {
+    throw new Error(`capability inválida: ${invalidCapabilities.join(', ')}. Use ${DELIVERY_CAPABILITIES.join(', ')}.`);
+  }
+  const route = createWorkRoute({
+    workKind: 'delivery', profile: 'ASSURE', contractImpact: 'none',
+    operationRisk: requestedCapabilities, sourceChange, sourceCommit: commit,
+  });
+  if (!route.operation_risk.length) throw new Error('delivery start requer ao menos um --allow <capability>');
+  const state = {
+    schema_version: 1,
+    id: deliveryId,
+    state: 'active',
+    route,
+    repository: repoRoot,
+    worktree: repoRoot,
+    branch: git(repoRoot, ['branch', '--show-current'], true),
+    source_commit: commit,
+    started_at: now.toISOString(),
+  };
+  writeState(vaultBase, state);
+  setPointer(vaultBase, deliveryId);
+  return state;
+}
+
+export function finishDelivery({ vaultBase, repoRoot, id, target = 'HEAD', evidence = {}, now = new Date() }) {
+  ensureClean(repoRoot);
+  const state = readState(vaultBase, safeId(id));
+  if (state.state !== 'active') throw new Error(`delivery ${id} não está ativa`);
+  const targetCommit = git(repoRoot, ['rev-parse', `${target}^{commit}`]);
+  git(repoRoot, ['merge-base', '--is-ancestor', state.source_commit, targetCommit]);
+  const capabilities = state.route?.operation_risk || [];
+  if (capabilities.includes('git:tag') || capabilities.includes('publish')) {
+    if (!evidence.version) throw new Error('delivery com tag/publicação requer --version');
+    const pkg = JSON.parse(readFileSync(join(repoRoot, 'package.json'), 'utf8'));
+    if (pkg.version !== evidence.version) throw new Error(`package.json ${pkg.version} diverge de ${evidence.version}`);
+    const tagCommit = git(repoRoot, ['rev-list', '-n', '1', `refs/tags/v${evidence.version}`]);
+    if (tagCommit !== targetCommit) throw new Error(`v${evidence.version} não aponta para o target comprovado`);
+  }
+  if (capabilities.includes('publish')) {
+    for (const [key, label] of [
+      ['ci_url', '--ci-url'], ['npm_integrity', '--npm-integrity'], ['release_url', '--release-url'],
+    ]) if (!evidence[key]) throw new Error(`delivery com publish requer ${label}`);
+  }
+  const receipt = {
+    schema_version: 1,
+    delivery_id: state.id,
+    outcome: 'completed',
+    work_kind: 'delivery',
+    source_change: state.route.source_change || '',
+    source_commit: state.source_commit,
+    target,
+    target_commit: targetCommit,
+    capabilities,
+    evidence,
+    finished_at: now.toISOString(),
+  };
+  appendReceipt(vaultBase, receipt);
+  writeState(vaultBase, { ...state, state: 'completed', target, target_commit: targetCommit, finished_at: receipt.finished_at, receipt });
+  if (readPointer(vaultBase) === state.id) setPointer(vaultBase);
+  return receipt;
+}
+
+export function abandonDelivery({ vaultBase, id, reason, now = new Date() }) {
+  const state = readState(vaultBase, safeId(id));
+  if (state.state !== 'active') throw new Error(`delivery ${id} não está ativa`);
+  if (!String(reason || '').trim()) throw new Error('delivery abandon requer --reason <text>');
+  const receipt = {
+    schema_version: 1, delivery_id: state.id, outcome: 'abandoned',
+    reason: String(reason).trim(), abandoned_at: now.toISOString(),
+  };
+  appendReceipt(vaultBase, receipt);
+  writeState(vaultBase, { ...state, state: 'abandoned', reason: receipt.reason, abandoned_at: receipt.abandoned_at });
+  if (readPointer(vaultBase) === state.id) setPointer(vaultBase);
+  return receipt;
+}
+
+function emit(payload, json) {
+  if (json) process.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);
+  else process.stdout.write(`${payload.id || payload.delivery_id}: ${payload.state || payload.outcome}\n`);
+}
+
+export function runDelivery(argv = []) {
+  try {
+    const parsed = parseArgv(argv);
+    const sub = parsed.positionals[0] || 'status';
+    const { repoRoot, vaultBase } = context(parsed);
+    if (sub === 'start') {
+      const state = startDelivery({
+        vaultBase, repoRoot, id: parsed.positionals[1], capabilities: parsed.all('--allow'),
+        sourceChange: parsed.value('--source-change'), sourceCommit: parsed.value('--source-commit'),
+      });
+      emit(state, parsed.json);
+      return 0;
+    }
+    if (sub === 'status') {
+      const state = readState(vaultBase, currentId(parsed, vaultBase));
+      emit(state, parsed.json);
+      return 0;
+    }
+    if (sub === 'finish') {
+      const receipt = finishDelivery({
+        vaultBase, repoRoot, id: currentId(parsed, vaultBase), target: parsed.value('--target') || 'HEAD',
+        evidence: {
+          ci_url: parsed.value('--ci-url'), version: parsed.value('--version'),
+          npm_integrity: parsed.value('--npm-integrity'), release_url: parsed.value('--release-url'),
+        },
+      });
+      emit(receipt, parsed.json);
+      return 0;
+    }
+    if (sub === 'abandon') {
+      const receipt = abandonDelivery({
+        vaultBase, id: currentId(parsed, vaultBase), reason: parsed.value('--reason'),
+      });
+      emit(receipt, parsed.json);
+      return 0;
+    }
+    throw new Error(`subcomando desconhecido: ${sub}`);
+  } catch (error) {
+    process.stderr.write(`wendkeep delivery: ${error.message}\n`);
+    return 2;
+  }
+}

package/src/doctor.mjs

@@ -7,7 +7,7 @@ import { checkSyncDefs } from './sync-defs.mjs';
 import { resolveProjectVault } from './project-vault.mjs';
 
 const healthStatusLabel = (status) => ({
-  healthy: 'saudável', warning: 'atenção', blocked: 'bloqueada', legacy: 'legado',
+  healthy: 'saudável', warning: 'atenção', degraded: 'degradada', blocked: 'bloqueada', legacy: 'legado',
 }[status] || status || 'desconhecido');
 
 const metricValue = (value) => value === null || value === undefined || value === '' ? 'n/a' : value;
@@ -55,6 +55,8 @@ export function runDoctor(argv) {
   let vault;
   let project;
   let session = '';
+  let scope = 'all';
+  let strict = false;
   for (let i = 0; i < argv.length; i += 1) {
     const a = argv[i];
     if (a === '--vault') vault = argv[++i];
@@ -63,6 +65,13 @@ export function runDoctor(argv) {
     else if (a.startsWith('--project=')) project = a.slice(10);
     else if (a === '--session') session = argv[++i] || '';
     else if (a.startsWith('--session=')) session = a.slice(10);
+    else if (a === '--scope') scope = argv[++i] || '';
+    else if (a.startsWith('--scope=')) scope = a.slice(8);
+    else if (a === '--strict') strict = true;
+  }
+  if (!['all', 'core', 'runtime'].includes(scope)) {
+    process.stderr.write('wendkeep doctor: --scope deve ser all, core ou runtime\n');
+    return 2;
   }
 
   const projectRoot = resolve(project || process.cwd());
@@ -97,18 +106,29 @@ export function runDoctor(argv) {
       memoryStatus: 'blocked',
     };
   }
-  process.stdout.write(`${renderVaultHealthLines(health).join('\n')}\n`);
+  if (scope !== 'runtime') process.stdout.write(`${renderVaultHealthLines(health).join('\n')}\n`);
   const healthStatus = health.ok ? 0 : 1;
 
+  if (scope === 'core') {
+    const strictDebt = strict && (
+      (health.warnings || []).length > 0
+      || !['healthy'].includes(health.memoryStatus)
+    );
+    process.stdout.write(`\n[core] ${healthStatus ? 'erro estrutural' : health.memoryStatus === 'degraded' ? 'saudável com memória degradada' : 'saudável'}\n`);
+    return healthStatus || strictDebt ? 1 : 0;
+  }
+
   // 2. Harness integrity (Wave B).
-  const { errors, warnings } = checkHarness(vaultBase, projectRoot);
+  const { errors, warnings, attention, repairable } = checkHarness(vaultBase, projectRoot);
   const defs = checkSyncDefs(vaultBase, projectRoot);
   if (!defs.ok) {
-    warnings.push(...defs.issues.map((issue) => `defs: ${issue}`));
-    warnings.push('defs stale — rode `wendkeep sync-defs --reseed` e reinicie Claude Code/Codex');
+    repairable.push(...defs.issues.map((issue) => `defs: ${issue}`));
+    repairable.push('defs stale — rode `wendkeep sync-defs --reseed` e reinicie Claude Code/Codex');
   }
-  process.stdout.write(`\n[harness] ${errors.length} erro(s), ${warnings.length} aviso(s)\n`);
+  process.stdout.write(`\n[runtime] ${errors.length} erro(s) estrutural(is), ${attention.length} atenção(ões), ${repairable.length} reparável(is), ${warnings.length} aviso(s)\n`);
   for (const e of errors) process.stdout.write(`  ✗ ${e}\n`);
+  for (const item of attention) process.stdout.write(`  ! ${item}\n`);
+  for (const item of repairable) process.stdout.write(`  → ${item}\n`);
   for (const w of warnings) process.stdout.write(`  ! ${w}\n`);
 
   // 3. Link/graph health — órfãos que o grafo do Obsidian mostraria, com o comando de reparo.
@@ -125,13 +145,16 @@ export function runDoctor(argv) {
   process.stdout.write(`\n${renderStackedFrontmatterLines(vaultBase, stacked).join('\n')}\n`);
 
   // 3c. Modelo fora de pricing.json fecha a sessão com custo zero, sem erro — só aparece aqui.
-  process.stdout.write(`\n${renderUnpricedModelLines(checkUnpricedModels(vaultBase)).join('\n')}\n`);
+  const unpriced = checkUnpricedModels(vaultBase);
+  process.stdout.write(`\n${renderUnpricedModelLines(unpriced).join('\n')}\n`);
 
   // 3d. Seções derivadas do corpo que ficaram para trás do Encerramento (notas pré-0.53.0).
-  process.stdout.write(`\n${renderStaleDerivedSectionLines(checkStaleDerivedSections(vaultBase)).join('\n')}\n`);
+  const staleDerived = checkStaleDerivedSections(vaultBase);
+  process.stdout.write(`\n${renderStaleDerivedSectionLines(staleDerived).join('\n')}\n`);
 
   // 3e. Observabilidade materializada: schema vigente não basta sem frontier + manifest frescos.
-  process.stdout.write(`\n${renderSessionObservabilityLines(checkSessionObservability(vaultBase)).join('\n')}\n`);
+  const observability = checkSessionObservability(vaultBase);
+  process.stdout.write(`\n${renderSessionObservabilityLines(observability).join('\n')}\n`);
 
   // 4. Sessão: não mente "inativa" quando há atividade recente (workflow/subagente em background).
   const act = checkSessionActivity(vaultBase);
@@ -146,5 +169,19 @@ export function runDoctor(argv) {
 
   // Devolve o código em vez de sair: `wendkeep sync` encadeia este comando, e um
   // process.exit aqui mataria a cadeia. Quem faz o exit é o bin.
-  return healthStatus !== 0 || errors.length ? 1 : 0;
+  const strictDebt = strict && (
+    (scope !== 'runtime' && (health.warnings || []).length)
+    || (scope !== 'runtime' && health.memoryStatus !== 'healthy')
+    || attention.length
+    || repairable.length
+    || warnings.length
+    || links.derivedOrphans
+    || links.artifactOrphans
+    || links.graphColors === false
+    || stacked.count
+    || (unpriced.models || unpriced.items || []).length
+    || (staleDerived.notes || staleDerived.items || []).length
+    || !observability.ok
+  );
+  return (scope !== 'runtime' && healthStatus !== 0) || errors.length || strictDebt ? 1 : 0;
 }

package/src/memory.mjs

@@ -20,6 +20,7 @@ import {
 } from './validate-memory.mjs';
 import { validateCore } from './validate-core.mjs';
 import { checkMemoryBundle } from '../hooks/vault-health.mjs';
+import { scopeForMemoryKey } from '../hooks/memory-scope.mjs';
 
 const BRAIN = '.brain';
 const LEDGER = 'MEMORY_EVENTS.jsonl';
@@ -229,6 +230,92 @@ export function migrateMemory(vault, {
   }
 }
 
+function rescopeEventId(sourceEventId, scope) {
+  return `mem-rescope-${hash(`${sourceEventId}\0${scope.type}\0${scope.id}`).slice(0, 24)}`;
+}
+
+/** Plan an append-only migration without choosing a winner for ambiguous keys. */
+export function planScopedMemoryMigration(vault) {
+  const ledger = readMemoryLedger(vault);
+  if (ledger.status !== 'ok') throw new Error('Ledger corrompido; execute memory repair antes do rescope.');
+  const projection = deriveMemoryProjection(vault, ledger.events);
+  const ambiguous = new Set(projection.candidates.map((candidate) => candidate.record_key || candidate.memory_key));
+  const existingIds = new Set(ledger.events.map((event) => event.event_id));
+  const planned = [];
+
+  for (const [recordKey, record] of Object.entries(projection.records)) {
+    if (ambiguous.has(recordKey) || record.source?.scope) continue;
+    const source = record.source;
+    const sameLegacyKey = ledger.events.filter((event) => (
+      !event.scope && event.memory_key === source.memory_key && !event.rescopes_event_id
+    ));
+    const scope = scopeForMemoryKey(source.memory_key, {
+      ...source,
+      projectId: source.project_id,
+      workSessionId: source.work_session_id,
+      branch: source.value?.branch || source.value?.branch_name,
+      worktreeId: source.value?.worktree_id,
+      repositoryId: source.value?.repository_id,
+    });
+    const eventId = rescopeEventId(source.event_id, scope);
+    if (existingIds.has(eventId)) continue;
+    planned.push({
+      v: 1,
+      event_id: eventId,
+      project_id: source.project_id,
+      memory_key: source.memory_key,
+      scope,
+      operation: 'assert',
+      value: record.value,
+      authority: source.authority,
+      canonical_session_id: source.canonical_session_id || 'memory-rescope',
+      activation_id: source.activation_id || 'memory-rescope',
+      activation_epoch: Number.isInteger(source.activation_epoch) ? source.activation_epoch : 0,
+      turn_sequence: Number.isInteger(source.turn_sequence) ? source.turn_sequence : 0,
+      source_turn_id: source.source_turn_id || 'memory-rescope',
+      observed_at: source.observed_at || new Date(0).toISOString(),
+      evidence: [...new Set([...(source.evidence || []), `memory-rescope:${source.event_id}`])],
+      rescopes_event_id: source.event_id,
+      rescopes_event_ids: sameLegacyKey.map((event) => event.event_id).sort(),
+    });
+  }
+
+  return {
+    status: 'dry-run',
+    ledger_events: ledger.events.length,
+    planned: planned.length,
+    ambiguous: projection.candidates.length,
+    events: planned,
+  };
+}
+
+export function rescopeMemoryEvents(vault, { apply = false } = {}) {
+  projectId(vault);
+  const plan = planScopedMemoryMigration(vault);
+  if (!apply) {
+    return {
+      status: 'dry-run',
+      ledger_events: plan.ledger_events,
+      planned: plan.planned,
+      ambiguous: plan.ambiguous,
+      scopes: plan.events.map((event) => ({
+        event_id: event.event_id, memory_key: event.memory_key, scope: event.scope,
+      })),
+    };
+  }
+  if (!plan.events.length) {
+    return { status: 'unchanged', migrated: 0, ambiguous: plan.ambiguous };
+  }
+  for (const event of plan.events) enqueueMemoryEvent(vault, event);
+  const projection = projectMemoryOutbox(vault);
+  return {
+    status: projection.status === 'projected' ? 'migrated' : projection.status,
+    migrated: plan.events.length,
+    ambiguous: plan.ambiguous,
+    checkpoint: projection.checkpoint || null,
+  };
+}
+
 function readCandidates(vault) {
   const path = brainPath(vault, CANDIDATES);
   const checked = checkedVaultFile(vault, path, 'MEMORY_CANDIDATES.jsonl');
@@ -266,6 +353,7 @@ function sanitizedCandidate(candidate, index) {
     reason: candidate.reason,
     status: candidate.status || 'active',
     memory_key: candidate.memory_key,
+    ...(candidate.scope ? { scope: candidate.scope } : {}),
     event_ids: [...eventIds].sort(lexicalCompare),
   };
 }
@@ -328,6 +416,7 @@ export function listMemoryCandidatesForCuration(vault) {
         reason: safe.reason,
         status: safe.status,
         memory_key: safe.memory_key,
+        ...(safe.scope ? { scope: safe.scope } : {}),
         events: safe.event_ids.map((eventId) => sanitizedCurationEvent(candidate, eventId, index)),
       };
     })
@@ -388,7 +477,7 @@ function promotedSupersedes(vault, candidate, selected) {
   const ledger = readMemoryLedger(vault);
   if (ledger.status !== 'ok') throw new Error('Ledger de memória inválido durante a promoção.');
   const projection = deriveMemoryProjection(vault, ledger.events);
-  const current = projection.records?.[candidate.memory_key]?.source;
+  const current = projection.records?.[candidate.record_key || candidate.memory_key]?.source;
   if (!current?.event_id) return [...memberIds].sort();
   if (memberIds.has(current.event_id)) {
     projection.superseded
@@ -572,6 +661,9 @@ export function decideMemoryCandidate(vault, {
     event_id: `cli-${action}-${hash(`${candidateId}\0${selected?.event_id || ''}`).slice(0, 20)}`,
     project_id: projectId(vault),
     memory_key: action === 'promote' ? candidate.memory_key : `candidate.decision.${candidateId}`,
+    scope: action === 'promote'
+      ? (candidate.scope || selected?.scope || { type: 'project', id: projectId(vault) })
+      : { type: 'project', id: projectId(vault) },
     operation: action === 'promote' && selected ? 'replace' : 'assert',
     value: action === 'promote' ? promotedMemoryValue(selectedValue) : 'rejected',
     authority: 'verified',
@@ -2087,6 +2179,7 @@ export function runMemory(argv) {
       result = listMemoryCandidates(vault, { activeOnly: candidatesArgs.activeOnly });
     }
     else if (sub === 'migrate') result = migrateMemory(vault, { apply: argv.includes('--apply') });
+    else if (sub === 'rescope') result = rescopeMemoryEvents(vault, { apply: argv.includes('--apply') });
     else if (sub === 'repair') result = repairMemory(vault);
     else if (sub === 'reconcile') {
       result = reconcileMemory(vault, {
@@ -2109,7 +2202,7 @@ export function runMemory(argv) {
         action: sub, candidateId: positional, ...(eventId ? { eventId } : {}),
       });
     }
-    else { process.stderr.write('wendkeep memory: use status | candidates [--active] | migrate [--apply] | repair | recover-attempt <session> [--apply] | reconcile <session> --by-session <session> --reason <text> [--apply] | promote <candidate> [--event <event-id>] | reject <candidate>.\n'); process.exitCode = 2; return; }
+    else { process.stderr.write('wendkeep memory: use status | candidates [--active] | curate | migrate [--apply] | rescope [--apply] | repair | recover-attempt <session> [--apply] | reconcile <session> --by-session <session> --reason <text> [--apply] | promote <candidate> [--event <event-id>] | reject <candidate>.\n'); process.exitCode = 2; return; }
     process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
     if (sub === 'status' && argv.includes('--gate')) process.exitCode = result.status === 'blocked' ? 1 : 0;
     else if (sub === 'reconcile' && reconcileArgs.apply) process.exitCode = result.health?.status === 'blocked' ? 1 : 0;