wendkeep 0.74.0 → 0.75.0

package/CHANGELOG.md

@@ -4,6 +4,41 @@ All notable changes to **wendkeep** are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.75.0] — 2026-08-20
+
+### Added
+
+- **Identidades SQL escopadas por projeto.** Sessões, agentes, rollups, chamadas e transcripts
+  mantêm chaves internas derivadas de `project_id` + identificador externo, constraints compostas
+  e foreign keys que carregam o projeto. Colisões deliberadas entre projetos ficam isoladas.
+- **Migrações comprováveis.** Cada arquivo de schema recebe checksum; uma migração estrutural de
+  base existente cria backup consistente antes da transação e pode ser retomada com segurança.
+- **Reconciliação explícita.** `observer reconcile` reserva a varredura integral para bootstrap,
+  reparo e comprovação de paridade por hash, localmente ou contra o serviço.
+- **Outbox observável.** `doctor` informa lotes, eventos, bytes e idade; uma lease admite apenas um
+  publisher e batches do mesmo escopo são coalescidos.
+
+### Changed
+
+- **Publicação incremental nos hooks.** `SessionStart` apenas drena, `Stop` lê uma sessão e
+  `SubagentStop` somente o transcript afetado. `note new` e `change archive` enfileiram diretamente
+  os documentos que escreveram. O file store antigo deixa de receber publicação viva e permanece
+  apenas como fonte de migração.
+- **Schema SQL 5.** O mesmo `session_id`, `agent_id`, `call_id`, `transcript_id` ou `rollup_key`
+  pode existir em projetos diferentes sem disputar uma linha global.
+
+### Fixed
+
+- **Ingest atômico por evento.** Cada evento usa `SAVEPOINT ingest_one`; qualquer falha reverte o
+  registro de ingestão e todas as projeções antes de o batch continuar. Retry permanece idempotente.
+- **Chamadas incrementais estáveis.** Turnos concluídos usam identidade causal estável, evitando
+  duplicação quando um transcript cresce após a primeira publicação.
+
+### Performance
+
+- O caminho de hook não varre mais o Vault. A fixture de publicação incremental comprova
+  `p95 < 200 ms`, uma sessão lida por `Stop` e zero documentos lidos por `SessionStart`.
+
 ## [0.74.0] — 2026-08-20
 
 ### Added

package/README.en.md

@@ -88,7 +88,7 @@ Decisions, dead ends, the reason you chose X over Y — gone next session. The p
 | **Cost** — what it all cost | Per‑model, cache‑aware token pricing per session — plus `cost --trend` with a run‑rate projection across the whole vault; research previews without a final rate remain unestimated. |
 | **Multi‑agent** — one vault, both agents | `init` wires the session hooks into `.claude/settings.json` *and* `.codex/hooks.json`, and every note is tagged with the agent that wrote it: Claude Code is detected from its environment, anything else is recorded as Codex. One shared graph, whichever agent you are in. |
 | **Local‑first** — no cloud, no account | Everything is plain Markdown on your disk. An optional MCP server (`@bitbonsai/mcpvault`) lets the agent read/write the vault. |
-| **Local Observer** — many projects, one view | `wendkeep observer` keeps documents, FTS5 chunks, sessions, agents, tokens, costs, calls, and transcripts in SQLite; search returns the matching passage with provenance and falls back to the local lexical ranker when FTS5 is unavailable. |
+| **Local Observer** — many projects, one view | `wendkeep observer` keeps documents, FTS5 chunks, sessions, agents, tokens, costs, calls, and transcripts in SQLite. Identities and foreign keys are project-scoped; each event is atomic. Hooks publish only what changed, while `observer reconcile` reserves full scans for explicit recovery. |
 
 During historical migration, the Observer preserves differences between frontmatter totals and the
 ledger as explicit reconciliation rows, and disambiguates duplicate `session_id` values per file
@@ -115,7 +115,7 @@ npx wendkeep init
 
 1. Create the vault folder taxonomy and a templated `README.md` (default vault: `<project>/.<project-name>-vault`, e.g. `.MyApp-vault`; override with `--vault`).
 2. Write a provider-neutral **`.wendkeep.json`** binding at the project root and a matching `.brain/PROJECT.json` marker in the vault, then merge the session hooks into **`.claude/settings.json`**. The binding is provider-neutral by design: any agent resolves the same vault from its session `cwd`, with no machine-global environment variable. Older registrations already in `.claude/settings.json` are adopted automatically.
-3. Wire the Codex hooks in **`.codex/hooks.json`** — twelve compatible entries: `brain-inject` + `session-start` + `observer-publish` on `SessionStart`, `session-ensure` + `evidence-context` + `change-context` on `UserPromptSubmit`, `session-stop` + `observer-publish` + `change-nag` on `Stop`, `subagent-stop` + `observer-publish` on `SubagentStop`, and `change-guard` on `PreToolUse` for `Bash`, `exec_command`, `apply_patch`, and mutable MCP tools, always in the `npx wendkeep hook <name>` form. `observer-publish` keeps the sanitized index projection and also sends the local SQL authority with documents, consumption, and transcripts; it does not replace the local lifecycle. The guard accepts object, raw-string, and argv Codex payloads; before a mutation it compares the session with the project, Git root, remote, branch, and worktree, denying missing or divergent targets. The other four stay out because Codex offers no equivalent payload, tool, or event: `change-warn` (no reliable `tool_input.file_path`), `plan-capture` (no `ExitPlanMode`), `decision-capture` (`AskUserQuestion` is Claude-only), and `task-log` (`TaskCompleted` is not in Codex's event enum). Codex scope blocks use `permissionDecision: "deny"`; `ask` is never emitted in `PreToolUse`. The merge remains non-destructive, preserves third-party hooks, and migrates legacy `timeout` to `timeoutSec`. **Codex enumerates every hook as untrusted and runs none until you approve the “Hooks need review” prompt at startup — `init` cannot pre-approve them**.
+3. Wire the Codex hooks in **`.codex/hooks.json`** — twelve compatible entries: `brain-inject` + `session-start` + `observer-publish` on `SessionStart`, `session-ensure` + `evidence-context` + `change-context` on `UserPromptSubmit`, `session-stop` + `observer-publish` + `change-nag` on `Stop`, `subagent-stop` + `observer-publish` on `SubagentStop`, and `change-guard` on `PreToolUse` for `Bash`, `exec_command`, `apply_patch`, and mutable MCP tools, always in the `npx wendkeep hook <name>` form. For the Observer, `SessionStart` only drains the outbox, `Stop` enqueues the changed session, and `SubagentStop` enqueues only the affected transcript; full scanning is explicit through `observer reconcile`. The guard accepts object, raw-string, and argv Codex payloads; before a mutation it compares the session with the project, Git root, remote, branch, and worktree, denying missing or divergent targets. The other four stay out because Codex offers no equivalent payload, tool, or event: `change-warn` (no reliable `tool_input.file_path`), `plan-capture` (no `ExitPlanMode`), `decision-capture` (`AskUserQuestion` is Claude-only), and `task-log` (`TaskCompleted` is not in Codex's event enum). Codex scope blocks use `permissionDecision: "deny"`; `ask` is never emitted in `PreToolUse`. The merge remains non-destructive, preserves third-party hooks, and migrates legacy `timeout` to `timeoutSec`. **Codex enumerates every hook as untrusted and runs none until you approve the “Hooks need review” prompt at startup — `init` cannot pre-approve them**.
 4. Add the **`wendkeep-vault`** MCP server to `.mcp.json` so the agent can read/write the vault. Skip with `--no-mcp` — e.g. when the agent already has a vault MCP. (`--no-mcp` skips *only wendkeep's own* MCP; companion MCPs still follow `--companions`.)
 5. Offer to pin **companion** plugins/MCP (multi-choice; **none** pre-checked — wendkeep is a neutral harness and presumes no third-party plugin). Each is wired the most agent-agnostic way it supports:
    - **`context-mode`** — context optimizer + FTS5 memory, wired as a Claude Code plugin. It ships its own MCP server, so wendkeep deliberately adds no `.mcp.json` entry (registering both cold-started two servers at once). On non-Claude agents, add the MCP by hand: `npx -y context-mode`.
@@ -240,7 +240,7 @@ The README is the map; the guides provide syntax, options, exit codes, examples,
 | **Notes and knowledge** | BUG/APR/ADR, repairs, renumbering, lessons, and dashboard | [Notes and knowledge](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/notes-and-knowledge.md) |
 | **Costs and observability** | safe dry-run, tri-state, aggregation, trends, and historical rebuild | [Costs and observability](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/costs-and-observability.md) |
 | **Maintenance and diagnostics** | doctor, frontier/manifest freshness, drift, version, and help | [Maintenance and diagnostics](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/maintenance-and-diagnostics.md) |
-| **Local Observer** | `observer serve`, registration, snapshots, outbox, and multi-project index | [Local Observer](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/observer.md) |
+| **Local Observer** | `observer serve`, registration, incremental publication, `reconcile`, outbox, and multi-project index | [Local Observer](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/observer.md) |
 
 Operations that deserve step-by-step guidance: [verify and exits 0/1/2](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/verify.md),
 [legacy-memory migration](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/memory-migration.md), and

package/README.md

@@ -88,7 +88,7 @@ Decisions, dead ends, the reason you chose X over Y — gone next session. The p
 | **Cost** — what it all cost | Per‑model, cache‑aware token pricing per session — plus `cost --trend` with a run‑rate projection across the whole vault; research previews without a final rate remain unestimated. |
 | **Multi‑agent** — one vault, both agents | `init` wires the session hooks into `.claude/settings.json` *and* `.codex/hooks.json`, and every note is tagged with the agent that wrote it: Claude Code is detected from its environment, anything else is recorded as Codex. One shared graph, whichever agent you are in. |
 | **Local‑first** — no cloud, no account | Everything is plain Markdown on your disk. An optional MCP server (`@bitbonsai/mcpvault`) lets the agent read/write the vault. |
-| **Local Observer** — many projects, one view | `wendkeep observer` keeps documents, FTS5 chunks, sessions, agents, tokens, costs, calls, and transcripts in SQLite; search returns the matching passage with provenance and falls back to the local lexical ranker when FTS5 is unavailable. |
+| **Local Observer** — many projects, one view | `wendkeep observer` keeps documents, FTS5 chunks, sessions, agents, tokens, costs, calls, and transcripts in SQLite. Identities and foreign keys are project-scoped; each event is atomic. Hooks publish only what changed, while `observer reconcile` reserves full scans for explicit recovery. |
 
 During historical migration, the Observer preserves differences between frontmatter totals and the
 ledger as explicit reconciliation rows, and disambiguates duplicate `session_id` values per file
@@ -115,7 +115,7 @@ npx wendkeep init
 
 1. Create the vault folder taxonomy and a templated `README.md` (default vault: `<project>/.<project-name>-vault`, e.g. `.MyApp-vault`; override with `--vault`).
 2. Write a provider-neutral **`.wendkeep.json`** binding at the project root and a matching `.brain/PROJECT.json` marker in the vault, then merge the session hooks into **`.claude/settings.json`**. The binding is provider-neutral by design: any agent resolves the same vault from its session `cwd`, with no machine-global environment variable. Older registrations already in `.claude/settings.json` are adopted automatically.
-3. Wire the Codex hooks in **`.codex/hooks.json`** — twelve compatible entries: `brain-inject` + `session-start` + `observer-publish` on `SessionStart`, `session-ensure` + `evidence-context` + `change-context` on `UserPromptSubmit`, `session-stop` + `observer-publish` + `change-nag` on `Stop`, `subagent-stop` + `observer-publish` on `SubagentStop`, and `change-guard` on `PreToolUse` for `Bash`, `exec_command`, `apply_patch`, and mutable MCP tools, always in the `npx wendkeep hook <name>` form. `observer-publish` keeps the sanitized index projection and also sends the local SQL authority with documents, consumption, and transcripts; it does not replace the local lifecycle. The guard accepts object, raw-string, and argv Codex payloads; before a mutation it compares the session with the project, Git root, remote, branch, and worktree, denying missing or divergent targets. The other four stay out because Codex offers no equivalent payload, tool, or event: `change-warn` (no reliable `tool_input.file_path`), `plan-capture` (no `ExitPlanMode`), `decision-capture` (`AskUserQuestion` is Claude-only), and `task-log` (`TaskCompleted` is not in Codex's event enum). Codex scope blocks use `permissionDecision: "deny"`; `ask` is never emitted in `PreToolUse`. The merge remains non-destructive, preserves third-party hooks, and migrates legacy `timeout` to `timeoutSec`. **Codex enumerates every hook as untrusted and runs none until you approve the “Hooks need review” prompt at startup — `init` cannot pre-approve them**.
+3. Wire the Codex hooks in **`.codex/hooks.json`** — twelve compatible entries: `brain-inject` + `session-start` + `observer-publish` on `SessionStart`, `session-ensure` + `evidence-context` + `change-context` on `UserPromptSubmit`, `session-stop` + `observer-publish` + `change-nag` on `Stop`, `subagent-stop` + `observer-publish` on `SubagentStop`, and `change-guard` on `PreToolUse` for `Bash`, `exec_command`, `apply_patch`, and mutable MCP tools, always in the `npx wendkeep hook <name>` form. For the Observer, `SessionStart` only drains the outbox, `Stop` enqueues the changed session, and `SubagentStop` enqueues only the affected transcript; full scanning is explicit through `observer reconcile`. The guard accepts object, raw-string, and argv Codex payloads; before a mutation it compares the session with the project, Git root, remote, branch, and worktree, denying missing or divergent targets. The other four stay out because Codex offers no equivalent payload, tool, or event: `change-warn` (no reliable `tool_input.file_path`), `plan-capture` (no `ExitPlanMode`), `decision-capture` (`AskUserQuestion` is Claude-only), and `task-log` (`TaskCompleted` is not in Codex's event enum). Codex scope blocks use `permissionDecision: "deny"`; `ask` is never emitted in `PreToolUse`. The merge remains non-destructive, preserves third-party hooks, and migrates legacy `timeout` to `timeoutSec`. **Codex enumerates every hook as untrusted and runs none until you approve the “Hooks need review” prompt at startup — `init` cannot pre-approve them**.
 4. Add the **`wendkeep-vault`** MCP server to `.mcp.json` so the agent can read/write the vault. Skip with `--no-mcp` — e.g. when the agent already has a vault MCP. (`--no-mcp` skips *only wendkeep's own* MCP; companion MCPs still follow `--companions`.)
 5. Offer to pin **companion** plugins/MCP (multi-choice; **none** pre-checked — wendkeep is a neutral harness and presumes no third-party plugin). Each is wired the most agent-agnostic way it supports:
    - **`context-mode`** — context optimizer + FTS5 memory, wired as a Claude Code plugin. It ships its own MCP server, so wendkeep deliberately adds no `.mcp.json` entry (registering both cold-started two servers at once). On non-Claude agents, add the MCP by hand: `npx -y context-mode`.
@@ -240,7 +240,7 @@ The README is the map; the guides provide syntax, options, exit codes, examples,
 | **Notes and knowledge** | BUG/APR/ADR, repairs, renumbering, lessons, and dashboard | [Notes and knowledge](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/notes-and-knowledge.md) |
 | **Costs and observability** | safe dry-run, tri-state, aggregation, trends, and historical rebuild | [Costs and observability](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/costs-and-observability.md) |
 | **Maintenance and diagnostics** | doctor, frontier/manifest freshness, drift, version, and help | [Maintenance and diagnostics](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/maintenance-and-diagnostics.md) |
-| **Local Observer** | `observer serve`, registration, snapshots, outbox, and multi-project index | [Local Observer](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/observer.md) |
+| **Local Observer** | `observer serve`, registration, incremental publication, `reconcile`, outbox, and multi-project index | [Local Observer](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/observer.md) |
 
 Operations that deserve step-by-step guidance: [verify and exits 0/1/2](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/verify.md),
 [legacy-memory migration](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/memory-migration.md), and

package/docs/en/commands/observer.md

@@ -34,6 +34,7 @@ loopback reads remain open, while every mutation requires a Bearer token.
 npx wendkeep observer status --data-dir <directory> --json
 npx wendkeep observer register --project <project> --vault <vault> --data-dir <directory>
 npx wendkeep observer publish --project <project> --vault <vault> --data-dir <directory>
+npx wendkeep observer reconcile --project <project> --vault <vault> --data-dir <directory> [--url http://127.0.0.1:8787]
 npx wendkeep observer memory import --project <project> --vault <vault> --url http://127.0.0.1:8787 --token <token> --json
 npx wendkeep observer serve --host 127.0.0.1 --port 8787 --data-dir <directory> --token <token>
 ```
@@ -42,7 +43,7 @@ npx wendkeep observer serve --host 127.0.0.1 --port 8787 --data-dir <directory>
 
 - `--data-dir` selects the local event and index directory; the default is
   `WENDKEEP_OBSERVER_DATA_DIR` or `~/.wendkeep-observer`.
-- `--project` and `--vault` identify a project for `register`, `publish`, and `memory import`.
+- `--project` and `--vault` identify a project for `register`, `publish`, `reconcile`, and `memory import`.
 - `--host` accepts only `127.0.0.1`, `localhost`, or `::1`; other hosts are rejected before
   listening.
 - `--token` or `WENDKEEP_OBSERVER_TOKEN` authenticates mutations; `--allow-non-loopback` fails without one.
@@ -84,8 +85,8 @@ If the browser shows the shell but the list fails, check the service health at
 
 ## Expected result
 
-`register` stores `project_id`, name, version, and registration time. `publish` reads the local
-vault, produces the snapshot, and sends idempotent events to SQLite containing the complete content
+`register` stores `project_id`, name, version, and registration time. `publish` and `reconcile`
+perform an explicit full-vault scan and send idempotent events to SQLite containing the complete content
 of sessions, decisions, bugs, learnings, specs, changes, CORE, DIGEST, SHARED_MEMORY, brain state,
 agent sessions, cost rollups, and calls. Messages and transcripts are only sent by capture levels
 that explicitly enable them. The container stores everything in
@@ -96,16 +97,26 @@ cost/token total recorded in frontmatter is preserved through an explicit reconc
 the detailed ledger does not add up; that row does not invent calls. Historical sessions sharing
 one `session_id` receive a canonical per-file identity so one rollup cannot overwrite the other.
 
-In schema 4, each ingested document is also projected into chunks carrying path, heading,
+In schema 5, sessions, agents, rollups, calls, and transcripts use internal identities derived from
+`project_id` plus the external identifier, with project-scoped constraints and foreign keys. The
+same `session_id`, `agent_id`, `call_id`, or `rollup_key` can exist in separate projects without a
+collision. Every event runs inside its own savepoint; an intermediate failure rolls back the ingest
+row and all projections before the batch continues. Migrations are checksummed and an existing
+database receives a consistent backup before every structural migration.
+
+Each ingested document is also projected into chunks carrying path, heading,
 authority, time, and validity. The Observer feature-probes FTS5 and uses the index when the
 extension is available; otherwise it preserves the same semantics through a lexical fallback.
 Search returns the passage containing the match and its provenance rather than only the beginning
 of the document.
 
 `init` projects `observer-publish` into `SessionStart`, `Stop`, and `SubagentStop` after the primary
-hooks. When the server is unavailable, it writes snapshots to `.brain/observer-outbox/` and SQL
-events to `.brain/observer-sql-outbox/` without blocking the session; a later run retries the
-batches. SQL batches use gzip so complete transcripts larger than 64 MB as plain JSON remain within
+hooks. `SessionStart` only drains the queue; `Stop` reads the changed session alone, and
+`SubagentStop` reads only the affected subagent transcript. `note new` and `change archive` enqueue
+the documents they wrote. Events are coalesced by scope and one lease admits a single publisher.
+When the server is unavailable, `.brain/observer-sql-outbox/` remains durable without blocking the
+session; full-vault scanning is reserved for `observer reconcile`. `doctor` reports queue batches,
+events, bytes, and age. SQL batches use gzip so complete transcripts larger than 64 MB as plain JSON remain within
 the transport limit; the Observer decompresses and validates the body before ingesting it. The
 outbox is temporary transport, not authority.
 
@@ -113,12 +124,12 @@ outbox is temporary transport, not authority.
 
 - `project_not_registered`: run `observer register` before publishing.
 - `host loopback`: replace `0.0.0.0` or a LAN address with `127.0.0.1`.
-- Pending outbox: the service was unavailable; preserve `.brain/observer-outbox/` and
-  `.brain/observer-sql-outbox/`, then rerun the publisher. Also ignore
-  `.brain/observer-sql-state.json` and `.brain/observer-sql-outbox/` in a versioned vault. Do not delete events manually.
+- Pending outbox: the service was unavailable; preserve `.brain/observer-sql-outbox/` and let a
+  later hook drain it or run `observer reconcile`. Also ignore
+  `.brain/observer-sql-state.json`, `.brain/observer-sql-outbox/`, and `.brain/observer-sql-publisher.lock` in a versioned vault. Do not delete events manually.
 - `WENDKEEP_OBSERVER_NODE_UNSUPPORTED`: run the Observer on Node.js 22.13 or newer.
 - If memory or usage is incomplete, check the Sync screen, preserve the outbox, and run
-  `observer memory import` to rebuild the load from the vault.
+  `observer reconcile` to rebuild the load and prove hash parity.
 
 ## Next steps
 

package/docs/pt-BR/commands/observer.md

@@ -34,6 +34,7 @@ continuam compatíveis com Node.js 18 ou mais recente. Registre explicitamente c
 npx wendkeep observer status --data-dir <diretório> --json
 npx wendkeep observer register --project <projeto> --vault <vault> --data-dir <diretório>
 npx wendkeep observer publish --project <projeto> --vault <vault> --data-dir <diretório>
+npx wendkeep observer reconcile --project <projeto> --vault <vault> --data-dir <diretório> [--url http://127.0.0.1:8787]
 npx wendkeep observer memory import --project <projeto> --vault <vault> --url http://127.0.0.1:8787 --token <token> --json
 npx wendkeep observer serve --host 127.0.0.1 --port 8787 --data-dir <diretório> --token <token>
 ```
@@ -42,7 +43,7 @@ npx wendkeep observer serve --host 127.0.0.1 --port 8787 --data-dir <diretório>
 
 - `--data-dir` escolhe o diretório local de eventos e índice; o padrão é
   `WENDKEEP_OBSERVER_DATA_DIR` ou `~/.wendkeep-observer`.
-- `--project` e `--vault` identificam o projeto nos comandos `register`, `publish` e `memory import`.
+- `--project` e `--vault` identificam o projeto nos comandos `register`, `publish`, `reconcile` e `memory import`.
 - `--host` aceita somente `127.0.0.1`, `localhost` ou `::1`; outros hosts são recusados antes do
   listen.
 - `--token` ou `WENDKEEP_OBSERVER_TOKEN` autentica mutações; `--allow-non-loopback` falha sem token.
@@ -85,8 +86,8 @@ Se o navegador mostrar a tela mas a lista falhar, confirme a saúde em
 
 ## Resultado esperado
 
-`register` grava `project_id`, nome, versão e data de registro. `publish` lê o vault local,
-produz o snapshot e envia eventos idempotentes para o SQLite com o conteúdo integral das sessões,
+`register` grava `project_id`, nome, versão e data de registro. `publish` e `reconcile` fazem a
+varredura integral explícita do vault e enviam eventos idempotentes para o SQLite com o conteúdo integral das sessões,
 decisões, bugs, aprendizados, specs, changes, CORE, DIGEST, SHARED_MEMORY, estado do brain,
 sessões de agentes, rollups de custo e chamadas. Mensagens e transcripts só são enviados nos
 níveis de captura que os habilitam. O container grava tudo em
@@ -98,15 +99,25 @@ reconciliação quando o ledger detalhado não fecha com ele; essa linha não in
 Sessões históricas com o mesmo `session_id` recebem uma identidade canônica por arquivo para
 evitar que um rollup sobrescreva o outro.
 
-No schema 4, cada documento ingerido também é projetado em chunks com caminho, heading,
+No schema 5, sessões, agentes, rollups, chamadas e transcripts usam identidades internas derivadas
+de `project_id` + identificador externo, com constraints e foreign keys escopadas. O mesmo
+`session_id`, `agent_id`, `call_id` ou `rollup_key` pode existir em projetos diferentes sem colisão.
+Cada evento é aplicado em um savepoint próprio; falha intermediária reverte ingest e todas as
+projeções antes de o batch continuar. Migrações têm checksum e toda migração estrutural de uma base
+existente cria backup consistente antes da transação.
+
+Cada documento ingerido também é projetado em chunks com caminho, heading,
 autoridade, data e validade. O Observer faz um feature probe de FTS5 e usa o índice quando a
 extensão está disponível; caso contrário, mantém a mesma semântica por fallback lexical. A busca
 retorna o trecho em que houve o match e sua proveniência, não apenas o começo do documento.
 
 O `init` projeta `observer-publish` para `SessionStart`, `Stop` e `SubagentStop` depois dos hooks
-principais. Sem servidor disponível, ele grava snapshots em `.brain/observer-outbox/` e eventos
-SQL em `.brain/observer-sql-outbox/`, sem bloquear a sessão; uma execução posterior tenta
-reenviar os lotes. Os lotes SQL são enviados com gzip para que transcripts completos maiores que
+principais. `SessionStart` apenas drena a fila; `Stop` lê somente a sessão alterada e
+`SubagentStop` somente o transcript do subagente afetado. `note new` e `change archive` enfileiram
+diretamente os documentos que escreveram. Os eventos são coalescidos por escopo e uma lease garante
+um único publisher. Sem servidor disponível, a outbox `.brain/observer-sql-outbox/` é preservada
+sem bloquear a sessão; a varredura integral fica reservada a `observer reconcile`. O `doctor`
+mostra lotes, eventos, bytes e idade da fila. Os lotes SQL são enviados com gzip para que transcripts completos maiores que
 64 MB em JSON puro continuem dentro do limite do transporte; o Observer descomprime e valida o
 corpo antes de ingerir. O outbox é transporte temporário, não autoridade.
 
@@ -114,12 +125,12 @@ corpo antes de ingerir. O outbox é transporte temporário, não autoridade.
 
 - `project_not_registered`: rode `observer register` antes de publicar.
 - `host loopback`: troque `0.0.0.0` ou endereço LAN por `127.0.0.1`.
-- Outbox pendente: o serviço estava indisponível; preserve `.brain/observer-outbox/` e
-  `.brain/observer-sql-outbox/` e repita o publisher. Adicione também
-  `.brain/observer-sql-state.json` e `.brain/observer-sql-outbox/` ao ignore do Vault. Não apague eventos manualmente.
+- Outbox pendente: o serviço estava indisponível; preserve `.brain/observer-sql-outbox/` e deixe
+  um hook posterior drená-la ou rode `observer reconcile`. Adicione também
+  `.brain/observer-sql-state.json`, `.brain/observer-sql-outbox/` e `.brain/observer-sql-publisher.lock` ao ignore do Vault. Não apague eventos manualmente.
 - `WENDKEEP_OBSERVER_NODE_UNSUPPORTED`: execute o Observer em Node.js 22.13 ou mais recente.
 - Se a memória ou o consumo ficarem incompletos, verifique a tela Sincronização, preserve o
-  outbox e rode `observer memory import` para reconstruir a carga a partir do vault.
+  outbox e rode `observer reconcile` para reconstruir e comprovar paridade por hash.
 
 ## Próximos passos
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wendkeep",
-  "version": "0.74.0",
+  "version": "0.75.0",
   "description": "Vault-first persistent memory for AI coding agents, with an optional profile-aware governance runtime: OFF, FLOW, GUIDE, GOVERN, or ASSURE. Local-first and agent-agnostic (Claude Code, Codex, Cursor…).",
   "type": "module",
   "workspaces": [

package/packages/cli/src/index.mjs

@@ -49,7 +49,7 @@ Usage:
                            cannot replace itself. · --vault P · --profile <name> · --yes.
 
   wendkeep doctor [--vault P]  Health check. --scope core|runtime · --strict for CI/release.
-  wendkeep observer <sub>     Local multi-project Observer: serve | register | publish | status.
+  wendkeep observer <sub>     Local multi-project Observer: serve | register | publish | reconcile | status.
   wendkeep change <sub>        Change lifecycle: new [--simple|--guide] | use | bind <slug> --session <id> | continue | list | show |
                            status | done <id> | undone <id> | diff | archive [--force] | abandon | relink | backlink.
                            archive exige verdict (rode verify --deep); abandon descarta sem ADR.

package/schema/observer/005-project-scoped-identities.sql

@@ -0,0 +1,217 @@
+-- wendkeep:structural
+-- Rebuild the operational identity tables so external identifiers are scoped by project.
+-- Internal primary keys remain deterministic and opaque to the public API.
+
+PRAGMA defer_foreign_keys = ON;
+
+CREATE TABLE sessions_v5 (
+  session_pk TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+  session_id TEXT NOT NULL,
+  provider TEXT NOT NULL DEFAULT '',
+  status TEXT NOT NULL DEFAULT 'unknown',
+  summary TEXT NOT NULL DEFAULT '',
+  change_slug TEXT NOT NULL DEFAULT '',
+  started_at TEXT,
+  ended_at TEXT,
+  updated_at TEXT NOT NULL,
+  metadata_json TEXT NOT NULL DEFAULT '{}',
+  UNIQUE(project_id, session_id)
+);
+
+INSERT INTO sessions_v5
+SELECT project_id || char(31) || session_id, project_id, session_id, provider, status,
+       summary, change_slug, started_at, ended_at, updated_at, metadata_json
+FROM sessions;
+
+INSERT OR IGNORE INTO sessions_v5(session_pk, project_id, session_id, updated_at)
+SELECT project_id || char(31) || session_id, project_id, session_id,
+       COALESCE(MAX(occurred_at), CURRENT_TIMESTAMP)
+FROM (
+  SELECT project_id, session_id, occurred_at FROM usage_rollups
+  UNION ALL SELECT project_id, session_id, occurred_at FROM llm_calls
+  UNION ALL SELECT project_id, session_id, occurred_at FROM transcripts
+) GROUP BY project_id, session_id;
+
+INSERT OR IGNORE INTO sessions_v5(session_pk, project_id, session_id, updated_at)
+SELECT project_id || char(31) || session_id, project_id, session_id, CURRENT_TIMESTAMP
+FROM agent_runs;
+
+CREATE TABLE agent_runs_v5 (
+  agent_pk TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+  agent_id TEXT NOT NULL,
+  session_id TEXT NOT NULL,
+  parent_agent_id TEXT,
+  role TEXT NOT NULL DEFAULT 'main',
+  agent_name TEXT NOT NULL DEFAULT '',
+  agent_type TEXT NOT NULL DEFAULT '',
+  workflow TEXT NOT NULL DEFAULT '',
+  status TEXT NOT NULL DEFAULT 'unknown',
+  model TEXT NOT NULL DEFAULT '',
+  effort TEXT NOT NULL DEFAULT '',
+  started_at TEXT,
+  ended_at TEXT,
+  metadata_json TEXT NOT NULL DEFAULT '{}',
+  UNIQUE(project_id, agent_id),
+  FOREIGN KEY(project_id, session_id) REFERENCES sessions_v5(project_id, session_id) ON DELETE CASCADE,
+  FOREIGN KEY(project_id, parent_agent_id) REFERENCES agent_runs_v5(project_id, agent_id) ON DELETE SET NULL
+);
+
+INSERT INTO agent_runs_v5
+SELECT a.project_id || char(31) || a.agent_id, a.project_id, a.agent_id, a.session_id,
+       CASE WHEN EXISTS (
+         SELECT 1 FROM agent_runs parent
+         WHERE parent.project_id = a.project_id AND parent.agent_id = a.parent_agent_id
+       ) THEN a.parent_agent_id ELSE NULL END,
+       a.role, a.agent_name, a.agent_type, a.workflow, a.status, a.model, a.effort,
+       a.started_at, a.ended_at, a.metadata_json
+FROM agent_runs a;
+
+INSERT OR IGNORE INTO agent_runs_v5(
+  agent_pk, project_id, agent_id, session_id, role, status
+)
+SELECT project_id || char(31) || agent_id, project_id, agent_id, session_id, role, 'unknown'
+FROM (
+  SELECT project_id, agent_id, session_id, role FROM usage_rollups
+  UNION ALL SELECT project_id, agent_id, session_id, role FROM llm_calls
+  UNION ALL SELECT project_id, agent_id, session_id, 'main' AS role FROM transcripts
+);
+
+CREATE TABLE usage_rollups_v5 (
+  rollup_pk TEXT PRIMARY KEY,
+  rollup_key TEXT NOT NULL,
+  project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+  session_id TEXT NOT NULL,
+  agent_id TEXT NOT NULL,
+  role TEXT NOT NULL DEFAULT 'main',
+  provider TEXT NOT NULL DEFAULT '',
+  model_provider TEXT NOT NULL DEFAULT '',
+  model TEXT NOT NULL DEFAULT '',
+  effort TEXT NOT NULL DEFAULT '',
+  calls INTEGER NOT NULL DEFAULT 0,
+  tokens_input INTEGER NOT NULL DEFAULT 0,
+  tokens_cache_write INTEGER NOT NULL DEFAULT 0,
+  tokens_cache_read INTEGER NOT NULL DEFAULT 0,
+  tokens_output INTEGER NOT NULL DEFAULT 0,
+  tokens_reasoning INTEGER NOT NULL DEFAULT 0,
+  tokens_total INTEGER NOT NULL DEFAULT 0,
+  cost_usd REAL NOT NULL DEFAULT 0,
+  cost_status TEXT NOT NULL DEFAULT 'unknown',
+  pricing_source TEXT NOT NULL DEFAULT '',
+  pricing_version TEXT NOT NULL DEFAULT '',
+  wasted_usd REAL NOT NULL DEFAULT 0,
+  revision INTEGER NOT NULL DEFAULT 1,
+  occurred_at TEXT NOT NULL,
+  source_event_id TEXT NOT NULL REFERENCES ingest_events(event_id) ON DELETE CASCADE,
+  metadata_json TEXT NOT NULL DEFAULT '{}',
+  UNIQUE(project_id, rollup_key),
+  FOREIGN KEY(project_id, session_id) REFERENCES sessions_v5(project_id, session_id) ON DELETE CASCADE,
+  FOREIGN KEY(project_id, agent_id) REFERENCES agent_runs_v5(project_id, agent_id) ON DELETE CASCADE
+);
+
+INSERT INTO usage_rollups_v5
+SELECT project_id || char(31) || rollup_key, rollup_key, project_id, session_id,
+       agent_id, role, provider, model_provider, model, effort, calls, tokens_input,
+       tokens_cache_write, tokens_cache_read, tokens_output, tokens_reasoning,
+       tokens_total, cost_usd, cost_status, pricing_source, pricing_version,
+       wasted_usd, revision, occurred_at, source_event_id, metadata_json
+FROM usage_rollups;
+
+CREATE TABLE llm_calls_v5 (
+  call_pk TEXT PRIMARY KEY,
+  call_id TEXT NOT NULL,
+  project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+  session_id TEXT NOT NULL,
+  agent_id TEXT NOT NULL,
+  role TEXT NOT NULL DEFAULT 'main',
+  provider TEXT NOT NULL DEFAULT '',
+  model_provider TEXT NOT NULL DEFAULT '',
+  model TEXT NOT NULL DEFAULT '',
+  effort TEXT NOT NULL DEFAULT '',
+  sequence INTEGER NOT NULL DEFAULT 0,
+  occurred_at TEXT NOT NULL,
+  tokens_input INTEGER NOT NULL DEFAULT 0,
+  tokens_cache_write INTEGER NOT NULL DEFAULT 0,
+  tokens_cache_read INTEGER NOT NULL DEFAULT 0,
+  tokens_output INTEGER NOT NULL DEFAULT 0,
+  tokens_reasoning INTEGER NOT NULL DEFAULT 0,
+  tokens_total INTEGER NOT NULL DEFAULT 0,
+  cost_usd REAL NOT NULL DEFAULT 0,
+  cost_status TEXT NOT NULL DEFAULT 'unknown',
+  transcript_id TEXT,
+  prompt_text TEXT NOT NULL DEFAULT '',
+  response_text TEXT NOT NULL DEFAULT '',
+  status TEXT NOT NULL DEFAULT 'complete',
+  metadata_json TEXT NOT NULL DEFAULT '{}',
+  UNIQUE(project_id, call_id),
+  FOREIGN KEY(project_id, session_id) REFERENCES sessions_v5(project_id, session_id) ON DELETE CASCADE,
+  FOREIGN KEY(project_id, agent_id) REFERENCES agent_runs_v5(project_id, agent_id) ON DELETE CASCADE
+);
+
+INSERT INTO llm_calls_v5
+SELECT project_id || char(31) || call_id, call_id, project_id, session_id, agent_id,
+       role, provider, model_provider, model, effort, sequence, occurred_at,
+       tokens_input, tokens_cache_write, tokens_cache_read, tokens_output,
+       tokens_reasoning, tokens_total, cost_usd, cost_status, transcript_id,
+       prompt_text, response_text, status, metadata_json
+FROM llm_calls;
+
+CREATE TABLE transcripts_v5 (
+  transcript_pk TEXT PRIMARY KEY,
+  transcript_id TEXT NOT NULL,
+  project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+  session_id TEXT NOT NULL,
+  agent_id TEXT NOT NULL,
+  coverage TEXT NOT NULL DEFAULT 'summary_only',
+  codec TEXT NOT NULL DEFAULT 'gzip',
+  content_gzip BLOB NOT NULL,
+  content_sha256 TEXT NOT NULL,
+  original_bytes INTEGER NOT NULL,
+  compressed_bytes INTEGER NOT NULL,
+  source TEXT NOT NULL DEFAULT '',
+  occurred_at TEXT NOT NULL,
+  metadata_json TEXT NOT NULL DEFAULT '{}',
+  UNIQUE(project_id, transcript_id),
+  FOREIGN KEY(project_id, session_id) REFERENCES sessions_v5(project_id, session_id) ON DELETE CASCADE,
+  FOREIGN KEY(project_id, agent_id) REFERENCES agent_runs_v5(project_id, agent_id) ON DELETE CASCADE
+);
+
+INSERT INTO transcripts_v5
+SELECT project_id || char(31) || transcript_id, transcript_id, project_id, session_id,
+       agent_id, coverage, codec, content_gzip, content_sha256, original_bytes,
+       compressed_bytes, source, occurred_at, metadata_json
+FROM transcripts;
+
+DROP TABLE llm_calls;
+DROP TABLE transcripts;
+DROP TABLE usage_rollups;
+DROP TABLE agent_runs;
+DROP TABLE sessions;
+
+ALTER TABLE sessions_v5 RENAME TO sessions;
+ALTER TABLE agent_runs_v5 RENAME TO agent_runs;
+ALTER TABLE usage_rollups_v5 RENAME TO usage_rollups;
+ALTER TABLE llm_calls_v5 RENAME TO llm_calls;
+ALTER TABLE transcripts_v5 RENAME TO transcripts;
+
+CREATE INDEX idx_sessions_project_time ON sessions(project_id, started_at, ended_at);
+CREATE INDEX idx_agent_runs_project_session ON agent_runs(project_id, session_id, role);
+CREATE INDEX idx_usage_rollups_project_time ON usage_rollups(project_id, occurred_at);
+CREATE INDEX idx_usage_rollups_project_agent ON usage_rollups(project_id, agent_id, role);
+CREATE INDEX idx_usage_rollups_project_model ON usage_rollups(project_id, model_provider, model);
+CREATE INDEX idx_llm_calls_project_time ON llm_calls(project_id, occurred_at);
+CREATE INDEX idx_llm_calls_project_agent ON llm_calls(project_id, agent_id, sequence);
+CREATE INDEX idx_llm_calls_project_model ON llm_calls(project_id, model_provider, model);
+CREATE INDEX idx_transcripts_project_session ON transcripts(project_id, session_id, occurred_at);
+CREATE INDEX idx_transcripts_project_coverage ON transcripts(project_id, coverage);
+
+CREATE TABLE project_snapshots (
+  project_id TEXT PRIMARY KEY REFERENCES projects(project_id) ON DELETE CASCADE,
+  event_id TEXT NOT NULL,
+  captured_at TEXT NOT NULL,
+  snapshot_json TEXT NOT NULL,
+  UNIQUE(project_id, event_id)
+);
+
+CREATE INDEX idx_project_snapshots_captured ON project_snapshots(captured_at);

package/src/change.mjs

@@ -1,5 +1,5 @@
 // `wendkeep change <sub>` — native change lifecycle CLI (Pilar B).
-import { readFileSync } from 'node:fs';
+import { readFileSync, readdirSync } from 'node:fs';
 import { isAbsolute, join, resolve } from 'node:path';
 import {
   newChange,
@@ -22,6 +22,22 @@ import { evaluateGate, requiredSensors } from '../hooks/sensors-core.mjs';
 import { buildEffectiveRequirementPackage, evaluateVerdict, formatOrphanReqs, tasksHashOf, parseSpecsList, parseDelta, parseRequirements, applyDelta, validateSpecImpact } from '../hooks/spec-core.mjs';
 import { getNextAdrNumber, readControl, readSessionRegistry, upsertSessionRegistry } from '../hooks/obsidian-common.mjs';
 import { getLocale } from '../hooks/locale.mjs';
+import { enqueueObserverDocumentChange } from './observer-sql-publish.mjs';
+import { readProjectForValidation } from '../packages/vault/src/validate-memory.mjs';
+
+function observerMarkdownUnder(vaultBase, relativeRoot) {
+  const output = [];
+  const walk = (absolute, relative) => {
+    for (const entry of readdirSync(absolute, { withFileTypes: true })) {
+      const nextAbsolute = join(absolute, entry.name);
+      const nextRelative = join(relative, entry.name);
+      if (entry.isDirectory()) walk(nextAbsolute, nextRelative);
+      else if (entry.isFile() && entry.name.endsWith('.md')) output.push(nextRelative);
+    }
+  };
+  try { walk(join(vaultBase, relativeRoot), relativeRoot); } catch { /* reconcile recupera */ }
+  return output;
+}
 
 function resolveVault(argv) {
   let vault;
@@ -299,6 +315,30 @@ export function runChange(argv) {
       process.stderr.write(`change archive BLOCKED (gate): ${r.failing.join('; ')}\n`);
       process.exit(1);
     }
+    try {
+      const project = readProjectForValidation(vaultBase);
+      if (project.ok && project.projectId) {
+        const loc = getLocale(vaultBase);
+        for (const archivedPath of observerMarkdownUnder(vaultBase, r.archivedRel)) {
+          enqueueObserverDocumentChange({ vaultBase, projectId: project.projectId, logicalPath: archivedPath });
+          const suffix = archivedPath.slice(String(r.archivedRel).length).replace(/^[\\/]+/, '');
+          enqueueObserverDocumentChange({
+            vaultBase,
+            projectId: project.projectId,
+            logicalPath: join(loc.folders.changes, slug, suffix),
+            deleted: true,
+          });
+        }
+        if (r.adrRel) enqueueObserverDocumentChange({ vaultBase, projectId: project.projectId, logicalPath: r.adrRel });
+        for (const capability of r.promoted || []) {
+          enqueueObserverDocumentChange({
+            vaultBase,
+            projectId: project.projectId,
+            logicalPath: join(loc.folders.specs, capability, 'spec.md'),
+          });
+        }
+      }
+    } catch { /* Observer é fail-open; reconcile recupera qualquer enqueue perdido. */ }
     process.stdout.write(`archived: ${r.archivedRel}${r.adrRel ? `; ADR: ${r.adrRel}` : '; GUIDE compacta: sem ADR'}\n`);
     if (r.promoted && r.promoted.length) process.stdout.write(`specs promovidas: ${r.promoted.join(', ')}\n`);
     if (r.specWarnings && r.specWarnings.length) for (const w of r.specWarnings) process.stderr.write(`  aviso spec: ${w}\n`);

package/src/doctor.mjs

@@ -5,6 +5,7 @@ import { checkHarness, checkVaultLinks, checkSessionActivity, checkStackedFrontm
 import { runVaultHealth } from '../hooks/vault-health.mjs';
 import { checkSyncDefs } from './sync-defs.mjs';
 import { resolveProjectVault } from './project-vault.mjs';
+import { inspectObserverSqlOutbox } from './observer-sql-publish.mjs';
 
 const healthStatusLabel = (status) => ({
   healthy: 'saudável', warning: 'atenção', degraded: 'degradada', blocked: 'bloqueada', legacy: 'legado',
@@ -155,6 +156,10 @@ export function runDoctor(argv) {
   // 3e. Observabilidade materializada: schema vigente não basta sem frontier + manifest frescos.
   const observability = checkSessionObservability(vaultBase);
   process.stdout.write(`\n${renderSessionObservabilityLines(observability).join('\n')}\n`);
+  const observerOutbox = inspectObserverSqlOutbox(vaultBase);
+  const oldestSeconds = Math.round(observerOutbox.oldest_age_ms / 1000);
+  process.stdout.write(`[observer] outbox SQL: ${observerOutbox.batches} lote(s) · ${observerOutbox.events} evento(s) · ${observerOutbox.bytes} bytes${observerOutbox.batches ? ` · mais antigo: ${oldestSeconds}s` : ''}\n`);
+  if (observerOutbox.batches) process.stdout.write('  → wendkeep observer reconcile --project . (ou inicie o servidor para o hook drenar a fila)\n');
 
   // 4. Sessão: não mente "inativa" quando há atividade recente (workflow/subagente em background).
   const act = checkSessionActivity(vaultBase);

package/src/init.mjs

@@ -323,7 +323,7 @@ const MESSAGES = {
     mcpSkipped: '  [4/5] .mcp.json ignorado (--no-mcp, sem companions MCP)',
     colorsSkipped: '  [5/5] cores ignoradas (--no-colors)',
     colors: (r) => `  [5/5] cores: ${r}`,
-    runtimeIgnore: '  [!] ignore runtimes locais do wendkeep no Git quando o vault for versionado: .brain/.change-* .brain/runtime/flows/ .brain/observer-sql-state.json .brain/observer-sql-outbox/',
+    runtimeIgnore: '  [!] ignore runtimes locais do wendkeep no Git quando o vault for versionado: .brain/.change-* .brain/runtime/flows/ .brain/observer-sql-state.json .brain/observer-sql-outbox/ .brain/observer-sql-publisher.lock',
     merged: 'mesclado', created: 'criado', bakSaved: ', .bak salvo',
     nextSteps: '\nPróximos passos:',
     step1: (v) => `  1. Abra o vault no Obsidian: "Abrir pasta como cofre" -> ${v}`,
@@ -352,7 +352,7 @@ const MESSAGES = {
     mcpSkipped: '  [4/5] .mcp.json skipped (--no-mcp, no MCP companions)',
     colorsSkipped: '  [5/5] colors skipped (--no-colors)',
     colors: (r) => `  [5/5] colors: ${r}`,
-    runtimeIgnore: '  [!] keep local wendkeep runtimes out of Git when the vault is versioned: .brain/.change-* .brain/runtime/flows/ .brain/observer-sql-state.json .brain/observer-sql-outbox/',
+    runtimeIgnore: '  [!] keep local wendkeep runtimes out of Git when the vault is versioned: .brain/.change-* .brain/runtime/flows/ .brain/observer-sql-state.json .brain/observer-sql-outbox/ .brain/observer-sql-publisher.lock',
     merged: 'merged', created: 'created', bakSaved: ', .bak saved',
     nextSteps: '\nNext steps:',
     step1: (v) => `  1. Open the vault in Obsidian: "Open folder as vault" -> ${v}`,

package/src/note.mjs

@@ -17,6 +17,8 @@ import { getLocale } from '../hooks/locale.mjs';
 import { buildManualBugNote, buildManualLearningNote, relinkDerivedNotes } from '../hooks/linked-notes.mjs';
 import { repairStackedFrontmatter } from '../hooks/frontmatter-repair.mjs';
 import { repairDerivedSections } from '../hooks/derived-sections.mjs';
+import { enqueueObserverDocumentChange } from './observer-sql-publish.mjs';
+import { readProjectForValidation } from '../packages/vault/src/validate-memory.mjs';
 
 const TYPES = {
   bug: { folderKey: 'bugs', prefix: 'BUG', build: buildManualBugNote },
@@ -120,6 +122,11 @@ export function runNote(argv) {
   } catch { /* sem sessão ativa — nota nasce sem backlink */ }
 
   writeFileSync(filePath, kind.build(title.trim(), { num, dateStr, sessionRel, localeId: loc.id }), 'utf8');
-  process.stdout.write(`${toVaultRelative(vaultBase, filePath)}\n`);
+  const logicalPath = toVaultRelative(vaultBase, filePath);
+  try {
+    const project = readProjectForValidation(vaultBase);
+    if (project.ok && project.projectId) enqueueObserverDocumentChange({ vaultBase, projectId: project.projectId, logicalPath });
+  } catch { /* Observer é fail-open; reconcile recupera qualquer enqueue perdido. */ }
+  process.stdout.write(`${logicalPath}\n`);
   process.exit(0);
 }