wendkeep 0.76.4 → 0.76.5

package/CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to **wendkeep** are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.76.5] — 2026-08-22
+
+### Added
+
+- **Delivery causal.** `delivery_id` passa a pertencer ao `active_contexts` da worktree/work session;
+  start, status, finish e abandon isolam deliveries concorrentes e rejeitam IDs de outro contexto.
+- **Hooks escopados.** `change-context` e `change-warn` só reconhecem a autorização de delivery do
+  chamador causal, sem herdar permissões de sessões irmãs.
+- **Compatibilidade conservadora.** `CURRENT_DELIVERY` vira projeção somente para um contexto
+  inequívoco; falha de bind remove o estado recém-criado sem publicar ponteiro parcial.
+
 ## [0.76.4] — 2026-08-22
 
 ### Added

package/README.en.md

@@ -338,10 +338,15 @@ Work kind, profile, contract impact, and operational risk are independent dimens
 spec, or ADR. If delivery requires a code/config edit, it pauses and work returns to
 `implementation`:
 
+In multi-context Vaults, `active_contexts[].delivery_id` is authoritative and `--session <id>`
+selects the caller explicitly. `CURRENT_DELIVERY` is only a derived projection when there is one
+single, unambiguous context; hooks consult only the causal delivery, and an ID from another context
+fails with `WENDKEEP_DELIVERY_CONTEXT_MISMATCH`.
+
 ```bash
-npx wendkeep delivery start release-0-74-0 --allow git:merge --allow git:push --allow publish --source-change <slug> --source-commit <sha>
-npx wendkeep delivery status release-0-74-0
-npx wendkeep delivery finish release-0-74-0 --target main --ci-url <url> --version 0.74.0 --npm-integrity <sha512> --release-url <url>
+npx wendkeep delivery start release-0-74-0 --allow git:merge --allow git:push --allow publish --source-change <slug> --source-commit <sha> --session <id>
+npx wendkeep delivery status release-0-74-0 --session <id>
+npx wendkeep delivery finish release-0-74-0 --target main --ci-url <url> --version 0.74.0 --npm-integrity <sha512> --release-url <url> --session <id>
 ```
 
 If the harness does not record a lease, a small fix remains under the configured profile —

package/README.md

@@ -338,10 +338,15 @@ Work kind, profile, contract impact, and operational risk are independent dimens
 spec, or ADR. If delivery requires a code/config edit, it pauses and work returns to
 `implementation`:
 
+In multi-context Vaults, `active_contexts[].delivery_id` is authoritative and `--session <id>`
+selects the caller explicitly. `CURRENT_DELIVERY` is only a derived projection when there is one
+single, unambiguous context; hooks consult only the causal delivery, and an ID from another context
+fails with `WENDKEEP_DELIVERY_CONTEXT_MISMATCH`.
+
 ```bash
-npx wendkeep delivery start release-0-74-0 --allow git:merge --allow git:push --allow publish --source-change <slug> --source-commit <sha>
-npx wendkeep delivery status release-0-74-0
-npx wendkeep delivery finish release-0-74-0 --target main --ci-url <url> --version 0.74.0 --npm-integrity <sha512> --release-url <url>
+npx wendkeep delivery start release-0-74-0 --allow git:merge --allow git:push --allow publish --source-change <slug> --source-commit <sha> --session <id>
+npx wendkeep delivery status release-0-74-0 --session <id>
+npx wendkeep delivery finish release-0-74-0 --target main --ci-url <url> --version 0.74.0 --npm-integrity <sha512> --release-url <url> --session <id>
 ```
 
 If the harness does not record a lease, a small fix remains under the configured profile —

package/docs/en/commands/operating-profiles.md

@@ -57,10 +57,10 @@ npx wendkeep flow status [<id>]
 npx wendkeep flow show <id> [--session <id>]
 npx wendkeep flow finish <id> [--session <id>]
 npx wendkeep flow promote <id> [--change-slug <slug>] [--session <id>]
-npx wendkeep delivery start [id] --allow <capability> [--source-change <slug>] [--source-commit <sha>]
-npx wendkeep delivery status [id]
-npx wendkeep delivery finish [id] [--target <ref>] [--ci-url <url>] [--version <x.y.z>] [--npm-integrity <sha512>] [--release-url <url>]
-npx wendkeep delivery abandon [id] --reason <text>
+npx wendkeep delivery start [id] --allow <capability> [--source-change <slug>] [--source-commit <sha>] [--session <id>]
+npx wendkeep delivery status [id] [--session <id>]
+npx wendkeep delivery finish [id] [--target <ref>] [--ci-url <url>] [--version <x.y.z>] [--npm-integrity <sha512>] [--release-url <url>] [--session <id>]
+npx wendkeep delivery abandon [id] --reason <text> [--session <id>]
 ```
 
 Every FLOW subcommand also accepts `--project <path>`, `--vault <path>`, and `--json`. When
@@ -178,6 +178,15 @@ ownership to the native LLM harness.
   and for `publish` requires CI, version, npm integrity, and GitHub Release evidence. Receipts are
   append-only in `.brain/runtime/delivery-receipts.jsonl`. If code/config must change, delivery
   stops with `WENDKEEP_DELIVERY_IMPLEMENTATION_REQUIRED` and work returns to implementation.
+- In a multi-context Vault, `active_contexts[].delivery_id` is authoritative. `--session <id>`
+  selects the work session explicitly; without it, only one unambiguous active context for the
+  worktree may be used. Implicit status, finish, and abandon resolve that binding, not a global pointer.
+- `CURRENT_DELIVERY` is only a derived projection: it contains the ID for one single, unambiguous
+  active context with delivery and stays empty with zero or multiple contexts.
+  `WENDKEEP_DELIVERY_CONTEXT_MISMATCH` means the explicit ID belongs to another context; neither
+  context is mutated.
+- The `change-context` and `change-warn` hooks consult only the caller's causal delivery; one
+  session's authorization is neither injected into nor allowed to suppress warnings in another.
 - Exit `0` means a successful query or transition; exit `1` means a policy/red-sensor block; exit
   `2` means invalid profile, session, flow, or arguments, with no partial mutation.
 

package/docs/pt-BR/commands/operating-profiles.md

@@ -57,10 +57,10 @@ npx wendkeep flow status [<id>]
 npx wendkeep flow show <id> [--session <id>]
 npx wendkeep flow finish <id> [--session <id>]
 npx wendkeep flow promote <id> [--change-slug <slug>] [--session <id>]
-npx wendkeep delivery start [id] --allow <capability> [--source-change <slug>] [--source-commit <sha>]
-npx wendkeep delivery status [id]
-npx wendkeep delivery finish [id] [--target <ref>] [--ci-url <url>] [--version <x.y.z>] [--npm-integrity <sha512>] [--release-url <url>]
-npx wendkeep delivery abandon [id] --reason <texto>
+npx wendkeep delivery start [id] --allow <capability> [--source-change <slug>] [--source-commit <sha>] [--session <id>]
+npx wendkeep delivery status [id] [--session <id>]
+npx wendkeep delivery finish [id] [--target <ref>] [--ci-url <url>] [--version <x.y.z>] [--npm-integrity <sha512>] [--release-url <url>] [--session <id>]
+npx wendkeep delivery abandon [id] --reason <texto> [--session <id>]
 ```
 
 Todos os subcomandos FLOW também aceitam `--project <path>`, `--vault <path>` e `--json`.
@@ -177,6 +177,15 @@ harness nativo da LLM.
   para capability `publish`, exige CI, versão, integridade npm e GitHub Release. O receipt é
   append-only em `.brain/runtime/delivery-receipts.jsonl`. Se código/config precisar mudar, a
   delivery para com `WENDKEEP_DELIVERY_IMPLEMENTATION_REQUIRED` e o trabalho volta a implementation.
+- Em Vault multi-contexto, `active_contexts[].delivery_id` é a autoridade. `--session <id>` escolhe
+  explicitamente a work session; sem ela, somente um active context inequívoco da worktree pode ser
+  usado. Status, finish e abandon implícitos consultam esse binding, não um ponteiro global.
+- `CURRENT_DELIVERY` é somente uma projeção derivada: contém o ID quando existe um único contexto
+  ativo inequívoco com delivery e fica vazio com zero ou múltiplos contextos.
+  `WENDKEEP_DELIVERY_CONTEXT_MISMATCH` indica que o ID explícito pertence a outro contexto; nenhum
+  dos dois é mutado.
+- Os hooks `change-context` e `change-warn` consultam somente o delivery causal do chamador; a
+  autorização de uma sessão não é injetada nem suprime aviso em outra.
 - Exit `0` indica consulta ou transição concluída; exit `1` indica política/sensor vermelho; exit
   `2` indica perfil, sessão, flow ou argumentos inválidos, sem mutação parcial.
 

package/hooks/active-context-store.mjs

@@ -6,8 +6,10 @@ import { mkdirVaultPath, writeVaultFileSync } from './vault-path-safety.mjs';
 
 export const ACTIVE_CONTEXTS_SCHEMA_VERSION = 1;
 const POINTER = '.brain/CURRENT_CHANGE.md';
+const DELIVERY_POINTER = '.brain/runtime/CURRENT_DELIVERY';
 const ID_PATTERN = /^[A-Za-z0-9._-]{1,160}$/;
 const SLUG_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,159}$/;
+const DELIVERY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{1,100}$/;
 
 function contextError(code, message) {
   const error = new Error(message);
@@ -86,6 +88,22 @@ export function projectLegacyActiveChange(vaultBase, registry = readSessionRegis
   return slug;
 }
 
+export function projectLegacyActiveDelivery(vaultBase, registry = readSessionRegistry(vaultBase)) {
+  const active = activeContexts(registry);
+  const id = active.length === 1 ? optionalText(active[0][1]?.delivery_id, 101) : '';
+  mkdirVaultPath(vaultBase, join(vaultBase, '.brain', 'runtime'), {
+    label: 'runtime da projeção legada de delivery',
+  });
+  writeVaultFileSync(
+    vaultBase,
+    join(vaultBase, DELIVERY_POINTER),
+    id ? `${id}\n` : '',
+    'utf8',
+    { label: 'projeção legada CURRENT_DELIVERY' },
+  );
+  return id;
+}
+
 export function resolveActiveContext(vaultBase, query = {}) {
   const normalized = normalizeIdentity(query, { requireWorkSession: false });
   const registry = readSessionRegistry(vaultBase);
@@ -174,6 +192,7 @@ export function mutateActiveContext(vaultBase, identity, updater, {
     return { key, context: structuredClone(next), registryRevision: registry.active_contexts_revision };
   });
   projectLegacyActiveChange(vaultBase);
+  projectLegacyActiveDelivery(vaultBase);
   return result;
 }
 
@@ -197,6 +216,26 @@ export function clearActiveContextChange(vaultBase, identity, options = {}) {
   }), options);
 }
 
+export function setActiveContextDelivery(vaultBase, identity, deliveryId, options = {}) {
+  const normalizedId = String(deliveryId || '').trim();
+  if (!DELIVERY_PATTERN.test(normalizedId)) {
+    throw contextError('WENDKEEP_ACTIVE_CONTEXT_DELIVERY_INVALID', 'delivery_id inválido ou ausente');
+  }
+  return mutateActiveContext(vaultBase, identity, (context) => ({
+    ...context,
+    delivery_id: normalizedId,
+    state: 'active',
+  }), options);
+}
+
+export function clearActiveContextDelivery(vaultBase, identity, options = {}) {
+  return mutateActiveContext(vaultBase, identity, (context) => ({
+    ...context,
+    delivery_id: '',
+    state: 'active',
+  }), options);
+}
+
 function legacyPointer(vaultBase) {
   try {
     return readFileSync(join(vaultBase, POINTER), 'utf8').match(/^change:\s*(.+)$/m)?.[1]?.trim() || '';

package/hooks/change-context.mjs

@@ -15,6 +15,7 @@ import {
   resolveHookOperatingProfile,
 } from './operating-profile-runtime.mjs';
 import { activeDelivery } from '../src/delivery.mjs';
+import { resolveCommandActiveContext } from '../src/active-context-runtime.mjs';
 
 // Conservador de propósito: verbos de tarefa comuns (pt+en) + tamanho mínimo. Falso-negativo
 // custa só o nudge; falso-positivo em pergunta curta viraria ruído.
@@ -26,11 +27,13 @@ export function looksLikeTask(prompt) {
 }
 
 // Retorna { context, hash? } quando há algo a injetar; null = silêncio.
-export function buildChangePing(vaultBase, sessionId, prompt = '', changeSlug = '', { profile = 'GOVERN' } = {}) {
+export function buildChangePing(vaultBase, sessionId, prompt = '', changeSlug = '', {
+  profile = 'GOVERN', context = null,
+} = {}) {
   const policy = hookProfilePolicy(profile);
   if (!policy.harness) return null;
   const sentinelId = profileSentinelId(sessionId, profile);
-  const delivery = activeDelivery(vaultBase);
+  const delivery = activeDelivery(vaultBase, { context });
   if (delivery) {
     const hash = `delivery:${delivery.id}`;
     if (readSentinel(vaultBase, 'ctx', sentinelId) === hash) return null;
@@ -68,10 +71,16 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
     const vaultBase = runtime.vaultBase;
     const { identity, entry } = runtime;
     const sid = identity.state === 'resolved' ? identity.canonicalConversationId : (input.session_id || input.sessionId || '');
+    const commandContext = runtime.bindingError ? null : resolveCommandActiveContext({
+      vaultBase,
+      projectRoot: input.cwd || process.cwd(),
+      sessionId: sid,
+    });
     const ping = runtime.bindingError
       ? { context: profileRuntimeError(runtime.bindingError) }
       : buildChangePing(vaultBase, sid, input.prompt || '', entry?.change_slug || '', {
         profile: runtime.profile,
+        context: commandContext,
       });
     if (!ping) { writeHookOutput({}); }
     else writeHookOutput({ hookSpecificOutput: { hookEventName: 'UserPromptSubmit', additionalContext: ping.context } });

package/hooks/change-warn.mjs

@@ -13,6 +13,7 @@ import {
   resolveHookOperatingProfile,
 } from './operating-profile-runtime.mjs';
 import { activeDelivery } from '../src/delivery.mjs';
+import { resolveCommandActiveContext } from '../src/active-context-runtime.mjs';
 
 const CODE_EXT = /\.(ts|tsx|js|jsx|mjs|cjs|py|prisma|sql|go|rs|java|cs)$/i;
 
@@ -28,12 +29,13 @@ export function warnDecision(filePath, {
   cwd = '.',
   sessionId = '',
   profile = 'GOVERN',
+  context = null,
 } = {}) {
   const policy = hookProfilePolicy(profile);
   if (!policy.requiresChange) return null;
   if (!filePath || !isCodeFile(filePath)) return null;
-  if (activeChange(vaultBase)) return null;
-  if (activeDelivery(vaultBase)) return null;
+  if (activeChange(vaultBase, { context })) return null;
+  if (activeDelivery(vaultBase, { context })) return null;
   const abs = norm(isAbsolute(filePath) ? filePath : resolve(cwd, filePath));
   // Dentro do vault (NTFS é case-insensitive) ou em dirs de config de agente: não é código do projeto.
   if (abs.toLowerCase().startsWith(`${norm(resolve(vaultBase)).toLowerCase()}/`)) return null;
@@ -52,13 +54,20 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
   try {
     const input = readHookInput();
     const runtime = resolveHookOperatingProfile({ input });
+    const sid = input.session_id || input.sessionId || '';
+    const commandContext = runtime.bindingError ? null : resolveCommandActiveContext({
+      vaultBase: runtime.vaultBase,
+      projectRoot: input.cwd || process.cwd(),
+      sessionId: sid,
+    });
     const warn = runtime.bindingError
       ? profileRuntimeError(runtime.bindingError)
       : warnDecision(input.tool_input?.file_path, {
         vaultBase: runtime.vaultBase,
         cwd: input.cwd || '.',
-        sessionId: input.session_id || input.sessionId || '',
+        sessionId: sid,
         profile: runtime.profile,
+        context: commandContext,
       });
     if (!warn) { writeHookOutput({}); }
     else writeHookOutput({ hookSpecificOutput: { hookEventName: 'PostToolUse', additionalContext: warn } });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wendkeep",
-  "version": "0.76.4",
+  "version": "0.76.5",
   "description": "Vault-first persistent memory for AI coding agents, with an optional profile-aware governance runtime: OFF, FLOW, GUIDE, GOVERN, or ASSURE. Local-first and agent-agnostic (Claude Code, Codex, Cursor…).",
   "type": "module",
   "workspaces": [

package/src/delivery.mjs

@@ -1,11 +1,18 @@
 import { execFileSync } from 'node:child_process';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, rmSync } from 'node:fs';
 import { basename, join, resolve } from 'node:path';
 import {
   assertVaultPathSafe, mkdirVaultPath, writeVaultFileSync,
 } from '../hooks/vault-path-safety.mjs';
 import { resolveProjectVault } from './project-vault.mjs';
 import { createWorkRoute } from './work-kind.mjs';
+import {
+  activeContextKey,
+  clearActiveContextDelivery,
+  resolveActiveContext,
+  setActiveContextDelivery,
+} from '../hooks/active-context-store.mjs';
+import { resolveCommandActiveContext } from './active-context-runtime.mjs';
 
 export const DELIVERY_HELP = `wendkeep delivery <subcommand>
 
@@ -15,7 +22,7 @@ export const DELIVERY_HELP = `wendkeep delivery <subcommand>
               [--npm-integrity <sha512-...>] [--release-url <url>]
   abandon [id] --reason <text>
 
-Common options: --project <path> --vault <path> --json
+Common options: --project <path> --vault <path> --session <id> --json
 Delivery authorizes operational risk and creates an append-only receipt. It never creates a change,
 spec, or ADR. If code/config must change, abandon or pause delivery and resume an implementation.
 `;
@@ -26,7 +33,7 @@ export const DELIVERY_CAPABILITIES = Object.freeze([
 
 const VALUE_OPTIONS = new Set([
   '--project', '--vault', '--allow', '--source-change', '--source-commit', '--target',
-  '--ci-url', '--version', '--npm-integrity', '--release-url', '--reason',
+  '--ci-url', '--version', '--npm-integrity', '--release-url', '--reason', '--session',
 ]);
 
 function parseArgv(argv) {
@@ -95,11 +102,49 @@ function readPointer(vaultBase) {
   try { return safeId(readFileSync(pointer, 'utf8').trim()); } catch { return ''; }
 }
 
-export function activeDelivery(vaultBase) {
-  const id = readPointer(vaultBase);
+function deliveryContextError(message) {
+  const error = new Error(message);
+  error.code = 'WENDKEEP_DELIVERY_CONTEXT_MISMATCH';
+  return error;
+}
+
+function deliveryContextBusy(id) {
+  const error = new Error(`active context já possui delivery ativo: ${id}`);
+  error.code = 'WENDKEEP_DELIVERY_CONTEXT_BUSY';
+  return error;
+}
+
+function contextualBinding(vaultBase, context, expectedId = '') {
+  const binding = resolveActiveContext(vaultBase, context);
+  const id = String(binding.delivery_id || '').trim();
+  if (expectedId && id !== expectedId) {
+    throw deliveryContextError(`delivery ${expectedId} não pertence ao active context chamador`);
+  }
+  return { binding, id, key: activeContextKey(context) };
+}
+
+function assertStateContext(state, binding) {
+  if (!binding) return;
+  if (state.context_key !== binding.key) {
+    throw deliveryContextError(`delivery ${state.id} pertence a outro active context`);
+  }
+}
+
+export function activeDelivery(vaultBase, { context = null } = {}) {
+  let binding = null;
+  let id = readPointer(vaultBase);
+  if (context) {
+    try { binding = contextualBinding(vaultBase, context); }
+    catch (error) {
+      if (error?.code === 'WENDKEEP_ACTIVE_CONTEXT_NOT_FOUND') return null;
+      throw error;
+    }
+    id = binding.id;
+  }
   if (!id) return null;
   try {
     const state = readState(vaultBase, id);
+    assertStateContext(state, binding);
     return state.state === 'active' ? state : null;
   } catch {
     return null;
@@ -156,8 +201,12 @@ function context(parsed) {
   return { projectRoot, repoRoot, vaultBase: resolved.base };
 }
 
-function currentId(parsed, vaultBase) {
-  return safeId(parsed.positionals[1] || readPointer(vaultBase));
+function currentId(parsed, vaultBase, commandContext = null) {
+  const explicit = parsed.positionals[1];
+  if (explicit) return safeId(explicit);
+  return safeId(commandContext
+    ? activeDelivery(vaultBase, { context: commandContext })?.id
+    : readPointer(vaultBase));
 }
 
 function ensureClean(repoRoot) {
@@ -169,11 +218,30 @@ function ensureClean(repoRoot) {
   }
 }
 
-export function startDelivery({ vaultBase, repoRoot, id, capabilities, sourceChange = '', sourceCommit = '', now = new Date() }) {
+export function startDelivery({
+  vaultBase,
+  repoRoot,
+  id,
+  capabilities,
+  sourceChange = '',
+  sourceCommit = '',
+  context = null,
+  bindDelivery = setActiveContextDelivery,
+  removeState = rmSync,
+  now = new Date(),
+}) {
   ensureClean(repoRoot);
   const deliveryId = safeId(id || generatedId(now));
   const paths = deliveryPaths(vaultBase, deliveryId);
   if (existsSync(paths.state)) throw new Error(`delivery já existe: ${deliveryId}`);
+  if (context) {
+    try {
+      const current = contextualBinding(vaultBase, context);
+      if (current.id) throw deliveryContextBusy(current.id);
+    } catch (error) {
+      if (error?.code !== 'WENDKEEP_ACTIVE_CONTEXT_NOT_FOUND') throw error;
+    }
+  }
   const commit = sourceCommit || git(repoRoot, ['rev-parse', 'HEAD']);
   git(repoRoot, ['cat-file', '-e', `${commit}^{commit}`]);
   const requestedCapabilities = [...new Set((capabilities || []).map((item) => String(item).trim()).filter(Boolean))];
@@ -195,16 +263,29 @@ export function startDelivery({ vaultBase, repoRoot, id, capabilities, sourceCha
     worktree: repoRoot,
     branch: git(repoRoot, ['branch', '--show-current'], true),
     source_commit: commit,
+    ...(context ? { context_key: activeContextKey(context) } : {}),
     started_at: now.toISOString(),
   };
   writeState(vaultBase, state);
-  setPointer(vaultBase, deliveryId);
+  if (context) {
+    try { bindDelivery(vaultBase, context, deliveryId); }
+    catch (error) {
+      try { removeState(paths.state, { force: true }); } catch { /* rollback best-effort */ }
+      throw error;
+    }
+  } else {
+    setPointer(vaultBase, deliveryId);
+  }
   return state;
 }
 
-export function finishDelivery({ vaultBase, repoRoot, id, target = 'HEAD', evidence = {}, now = new Date() }) {
+export function finishDelivery({
+  vaultBase, repoRoot, id, target = 'HEAD', evidence = {}, context = null, now = new Date(),
+}) {
   ensureClean(repoRoot);
   const state = readState(vaultBase, safeId(id));
+  const binding = context ? contextualBinding(vaultBase, context, state.id) : null;
+  assertStateContext(state, binding);
   if (state.state !== 'active') throw new Error(`delivery ${id} não está ativa`);
   const targetCommit = git(repoRoot, ['rev-parse', `${target}^{commit}`]);
   git(repoRoot, ['merge-base', '--is-ancestor', state.source_commit, targetCommit]);
@@ -228,29 +309,49 @@ export function finishDelivery({ vaultBase, repoRoot, id, target = 'HEAD', evide
     work_kind: 'delivery',
     source_change: state.route.source_change || '',
     source_commit: state.source_commit,
+    ...(state.context_key ? { context_key: state.context_key } : {}),
     target,
     target_commit: targetCommit,
     capabilities,
     evidence,
     finished_at: now.toISOString(),
   };
-  appendReceipt(vaultBase, receipt);
-  writeState(vaultBase, { ...state, state: 'completed', target, target_commit: targetCommit, finished_at: receipt.finished_at, receipt });
-  if (readPointer(vaultBase) === state.id) setPointer(vaultBase);
+  if (context) clearActiveContextDelivery(vaultBase, context, { expectedRevision: binding.binding.revision });
+  try {
+    appendReceipt(vaultBase, receipt);
+    writeState(vaultBase, { ...state, state: 'completed', target, target_commit: targetCommit, finished_at: receipt.finished_at, receipt });
+  } catch (error) {
+    if (context) {
+      try { setActiveContextDelivery(vaultBase, context, state.id); } catch { /* rollback best-effort */ }
+    }
+    throw error;
+  }
+  if (!context && readPointer(vaultBase) === state.id) setPointer(vaultBase);
   return receipt;
 }
 
-export function abandonDelivery({ vaultBase, id, reason, now = new Date() }) {
+export function abandonDelivery({ vaultBase, id, reason, context = null, now = new Date() }) {
   const state = readState(vaultBase, safeId(id));
+  const binding = context ? contextualBinding(vaultBase, context, state.id) : null;
+  assertStateContext(state, binding);
   if (state.state !== 'active') throw new Error(`delivery ${id} não está ativa`);
   if (!String(reason || '').trim()) throw new Error('delivery abandon requer --reason <text>');
   const receipt = {
     schema_version: 1, delivery_id: state.id, outcome: 'abandoned',
+    ...(state.context_key ? { context_key: state.context_key } : {}),
     reason: String(reason).trim(), abandoned_at: now.toISOString(),
   };
-  appendReceipt(vaultBase, receipt);
-  writeState(vaultBase, { ...state, state: 'abandoned', reason: receipt.reason, abandoned_at: receipt.abandoned_at });
-  if (readPointer(vaultBase) === state.id) setPointer(vaultBase);
+  if (context) clearActiveContextDelivery(vaultBase, context, { expectedRevision: binding.binding.revision });
+  try {
+    appendReceipt(vaultBase, receipt);
+    writeState(vaultBase, { ...state, state: 'abandoned', reason: receipt.reason, abandoned_at: receipt.abandoned_at });
+  } catch (error) {
+    if (context) {
+      try { setActiveContextDelivery(vaultBase, context, state.id); } catch { /* rollback best-effort */ }
+    }
+    throw error;
+  }
+  if (!context && readPointer(vaultBase) === state.id) setPointer(vaultBase);
   return receipt;
 }
 
@@ -263,23 +364,33 @@ export function runDelivery(argv = []) {
   try {
     const parsed = parseArgv(argv);
     const sub = parsed.positionals[0] || 'status';
-    const { repoRoot, vaultBase } = context(parsed);
+    const { projectRoot, repoRoot, vaultBase } = context(parsed);
+    const commandContext = resolveCommandActiveContext({
+      vaultBase,
+      projectRoot,
+      sessionId: parsed.value('--session') || process.env.CODEX_THREAD_ID || process.env.CLAUDE_SESSION_ID || '',
+    });
     if (sub === 'start') {
       const state = startDelivery({
         vaultBase, repoRoot, id: parsed.positionals[1], capabilities: parsed.all('--allow'),
         sourceChange: parsed.value('--source-change'), sourceCommit: parsed.value('--source-commit'),
+        context: commandContext,
       });
       emit(state, parsed.json);
       return 0;
     }
     if (sub === 'status') {
-      const state = readState(vaultBase, currentId(parsed, vaultBase));
+      const id = currentId(parsed, vaultBase, commandContext);
+      const binding = commandContext ? contextualBinding(vaultBase, commandContext, id) : null;
+      const state = readState(vaultBase, id);
+      assertStateContext(state, binding);
       emit(state, parsed.json);
       return 0;
     }
     if (sub === 'finish') {
       const receipt = finishDelivery({
-        vaultBase, repoRoot, id: currentId(parsed, vaultBase), target: parsed.value('--target') || 'HEAD',
+        vaultBase, repoRoot, id: currentId(parsed, vaultBase, commandContext), target: parsed.value('--target') || 'HEAD',
+        context: commandContext,
         evidence: {
           ci_url: parsed.value('--ci-url'), version: parsed.value('--version'),
           npm_integrity: parsed.value('--npm-integrity'), release_url: parsed.value('--release-url'),
@@ -290,14 +401,15 @@ export function runDelivery(argv = []) {
     }
     if (sub === 'abandon') {
       const receipt = abandonDelivery({
-        vaultBase, id: currentId(parsed, vaultBase), reason: parsed.value('--reason'),
+        vaultBase, id: currentId(parsed, vaultBase, commandContext), reason: parsed.value('--reason'),
+        context: commandContext,
       });
       emit(receipt, parsed.json);
       return 0;
     }
     throw new Error(`subcomando desconhecido: ${sub}`);
   } catch (error) {
-    process.stderr.write(`wendkeep delivery: ${error.message}\n`);
+    process.stderr.write(`wendkeep delivery: ${error.code ? `${error.code}: ` : ''}${error.message}\n`);
     return 2;
   }
 }