wendkeep 0.76.6 → 0.76.7

package/CHANGELOG.md

@@ -4,6 +4,21 @@ All notable changes to **wendkeep** are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.76.7] — 2026-08-22
+
+### Fixed
+
+- **Handoff causal no Stop.** Com `active_contexts` inicializado, work session, repository,
+  worktree, branch e change vêm do contexto chamador; payload divergente falha antes de CAS,
+  nota, outbox ou ledger e não publica estado parcial.
+- **Evidência da change correta.** O lifecycle coleta verdict, sensores e ADR apenas da change do
+  active context causal, sem reutilizar `change_slug` legado ou link global de uma sessão irmã.
+- **Recall automático escopado.** `UserPromptSubmit` permanece somente leitura, sem migrar pointer
+  ou registry; exclui evidência de sessão/change irmã ativa e preserva material global/histórico.
+  `/brain-recall` explícito segue global.
+- **Compatibilidade conservadora.** O comportamento anterior permanece somente quando o registry
+  ainda não possui nenhum campo do store contextual, inclusive quando `active_contexts` está vazio.
+
 ## [0.76.6] — 2026-08-22
 
 ### Fixed

package/README.en.md

@@ -386,8 +386,8 @@ Hot memory now separates human authorship, operational state, and evidence:
 - **`SHARED_MEMORY.md` is bounded generated operational state.** The `Stop` hook turns the session handoff into sanitized events; the projector deterministically reduces the ledger and publishes a verifiable revision, cursor, and hash. Admission prioritizes critical operational state and never publishes beyond 48 lines/6 KiB; omitted events remain in the append-only authority and surface only as verifiable counts. Facts are `verified` only with local evidence; unsupported reports remain `reported`, and disagreements become candidates for human judgment.
 - **`MEMORY_EVENTS.jsonl` is the append-only authority.** `Stop` makes events durable in the outbox before acknowledging the attempt; the projector runs outside the registry lock and retries reuse the same IDs. Repeating an identical `event_id`/payload is a no-op; reusing the ID with different bytes is observable corruption.
 - **`MEMORY_CANDIDATES.jsonl` is the curation queue.** Conflicts and legacy content are never silently promoted. `promote` and `reject` record the decision as a new event; promotion preserves the selected event's JSON type, session, activation/epoch, and source turn.
-- **Registers are scoped.** `git.local-head`, handoffs, verdicts, and change status carry project, work-session, change, branch, or worktree scope. Two branches do not create a global conflict; only events in the same scope and causal lineage may advance automatically.
-- **`EVIDENCE_INDEX.jsonl` is local recall.** Markdown is chunked by headings and blocks without requiring the Observer. Ranking combines BM25, exact phrases, field weights, authority, validity, bounded recency, and source diversity; `UserPromptSubmit` injects only relevant passages with provenance.
+- **Registers are scoped.** `git.local-head`, handoffs, verdicts, and change status carry project, work-session, change, branch, or worktree scope. Two branches do not create a global conflict; only events in the same scope and causal lineage may advance automatically. Once `active_contexts` is initialized, `Stop` derives `work_session_id`, `repository_id`, `worktree_id`, branch, and change from the causal active context; a divergent handoff fails before CAS, note, outbox, or ledger mutation. Legacy compatibility exists only without the contextual store.
+- **`EVIDENCE_INDEX.jsonl` is local recall.** Markdown is chunked by headings and blocks without requiring the Observer. Ranking combines BM25, exact phrases, field weights, authority, validity, bounded recency, and source diversity. The automatic `UserPromptSubmit` hook is read-only: it never migrates `CURRENT_CHANGE.md` or mutates the registry; it excludes passages owned by an active sibling session or change while preserving global and historical evidence. Explicit `/brain-recall` remains global.
 
 Artifacts stay under `.brain/` only. Sanitization strips secrets, tokens, local paths, transcripts, and harness payloads both before persistence and before injection. Events carry a `project_id`, and one vault never accepts another project's events.
 

package/README.md

@@ -386,8 +386,8 @@ Hot memory now separates human authorship, operational state, and evidence:
 - **`SHARED_MEMORY.md` is bounded generated operational state.** The `Stop` hook turns the session handoff into sanitized events; the projector deterministically reduces the ledger and publishes a verifiable revision, cursor, and hash. Admission prioritizes critical operational state and never publishes beyond 48 lines/6 KiB; omitted events remain in the append-only authority and surface only as verifiable counts. Facts are `verified` only with local evidence; unsupported reports remain `reported`, and disagreements become candidates for human judgment.
 - **`MEMORY_EVENTS.jsonl` is the append-only authority.** `Stop` makes events durable in the outbox before acknowledging the attempt; the projector runs outside the registry lock and retries reuse the same IDs. Repeating an identical `event_id`/payload is a no-op; reusing the ID with different bytes is observable corruption.
 - **`MEMORY_CANDIDATES.jsonl` is the curation queue.** Conflicts and legacy content are never silently promoted. `promote` and `reject` record the decision as a new event; promotion preserves the selected event's JSON type, session, activation/epoch, and source turn.
-- **Registers are scoped.** `git.local-head`, handoffs, verdicts, and change status carry project, work-session, change, branch, or worktree scope. Two branches do not create a global conflict; only events in the same scope and causal lineage may advance automatically.
-- **`EVIDENCE_INDEX.jsonl` is local recall.** Markdown is chunked by headings and blocks without requiring the Observer. Ranking combines BM25, exact phrases, field weights, authority, validity, bounded recency, and source diversity; `UserPromptSubmit` injects only relevant passages with provenance.
+- **Registers are scoped.** `git.local-head`, handoffs, verdicts, and change status carry project, work-session, change, branch, or worktree scope. Two branches do not create a global conflict; only events in the same scope and causal lineage may advance automatically. Once `active_contexts` is initialized, `Stop` derives `work_session_id`, `repository_id`, `worktree_id`, branch, and change from the causal active context; a divergent handoff fails before CAS, note, outbox, or ledger mutation. Legacy compatibility exists only without the contextual store.
+- **`EVIDENCE_INDEX.jsonl` is local recall.** Markdown is chunked by headings and blocks without requiring the Observer. Ranking combines BM25, exact phrases, field weights, authority, validity, bounded recency, and source diversity. The automatic `UserPromptSubmit` hook is read-only: it never migrates `CURRENT_CHANGE.md` or mutates the registry; it excludes passages owned by an active sibling session or change while preserving global and historical evidence. Explicit `/brain-recall` remains global.
 
 Artifacts stay under `.brain/` only. Sanitization strips secrets, tokens, local paths, transcripts, and harness payloads both before persistence and before injection. Events carry a `project_id`, and one vault never accepts another project's events.
 

package/docs/en/commands/memory.md

@@ -115,10 +115,17 @@ npx wendkeep validate-memory --vault <v2-vault>
   `change.<slug>.status` compete only inside the same scope. Automatic resolution still requires
   the same project and causal lineage; incompatible decisions, constraints, and blockers remain
   human-curated. An ambiguous key is omitted from SHARED without removing CORE or independent keys.
+  Once `active_contexts` is initialized, `Stop` derives `work_session_id`, `repository_id`,
+  `worktree_id`, branch, and `change_slug` from the causal active context. A divergent handoff
+  identity fails before CAS, note, outbox, or ledger mutation; legacy fallback exists only without
+  the contextual store.
 - `.brain/EVIDENCE_INDEX.jsonl` chunks documents by heading and block and records file, heading,
   type, change, session, work session, authority, date, validity, and hash. `/brain-recall` and the
   `UserPromptSubmit` hook use BM25, exact phrase, field weights, authority, validity, bounded
-  recency, and diversity to return the matching passage with provenance.
+  recency, and diversity to return the matching passage with provenance. Automatic recall is
+  read-only: it never migrates `CURRENT_CHANGE.md` or mutates the registry; it excludes rows owned
+  by an active sibling session or change while preserving global or historical rows with no active
+  owner. Explicit `/brain-recall` remains global.
 - Every memory path validates the physical topology of `.brain`, ledger, outbox, CORE, SHARED,
   candidates, registry, notes, backups, temporary files, and sidecars before reading or writing.
   Junctions, symlinks, reparse points, or hardlinks fail closed without touching external bytes.

package/docs/pt-BR/commands/memory.md

@@ -114,11 +114,17 @@ npx wendkeep validate-memory --vault <cofre-v2>
 - Registradores como `git.local-head`, `handoff.latest`, `quality.latest-*` e
   `change.<slug>.status` só competem dentro do mesmo escopo. Resolução automática ainda exige o
   mesmo projeto e linhagem causal; decisões, constraints e blockers incompatíveis permanecem sob
-  curadoria. Uma chave ambígua é omitida de SHARED sem remover CORE ou chaves independentes.
+  curadoria. Uma chave ambígua é omitida de SHARED sem remover CORE ou chaves independentes. Com
+  `active_contexts` inicializado, o `Stop` deriva `work_session_id`, `repository_id`, `worktree_id`,
+  branch e `change_slug` do active context causal. Identidade divergente no handoff falha antes de
+  CAS, nota, outbox ou ledger; o fallback legado só existe sem o store contextual.
 - `.brain/EVIDENCE_INDEX.jsonl` divide documentos por headings e blocos e registra arquivo,
   heading, tipo, change, sessão, work session, autoridade, data, validade e hash. `/brain-recall`
   e o hook `UserPromptSubmit` usam BM25, frase exata, pesos por campo, autoridade, validade,
-  recência limitada e diversidade para retornar o trecho do match com proveniência.
+  recência limitada e diversidade para retornar o trecho do match com proveniência. No recall
+  automático, o hook é somente leitura: não migra `CURRENT_CHANGE.md` nem altera o registry;
+  exclui linhas pertencentes a sessão ou change irmã ativa e preserva linhas globais ou históricas
+  sem owner ativo. `/brain-recall` explícito permanece global.
 - Toda rota de memória valida a topologia física de `.brain`, ledger, outbox, CORE, SHARED,
   candidates, registry, notas, backups, temporários e sidecars antes de ler ou escrever. Junction,
   symlink, reparse point ou hardlink falham fechados sem tocar bytes externos. Locks publicam owner

package/hooks/active-context-handoff-evidence.mjs

@@ -0,0 +1,196 @@
+import { readSessionRegistry } from './obsidian-common.mjs';
+import { resolveActiveContext } from './active-context-store.mjs';
+import { resolveRuntimeActiveContext } from '../src/active-context-runtime.mjs';
+
+const IDENTITY_FIELDS = Object.freeze([
+  ['work_session_id', 'workSessionId'],
+  ['repository_id', 'repositoryId'],
+  ['worktree_id', 'worktreeId'],
+  ['branch', 'branch'],
+  ['change_slug', 'changeSlug'],
+]);
+
+function contextError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function text(value) {
+  return String(value ?? '').trim();
+}
+
+function contextsOf(registry) {
+  return registry?.active_contexts && typeof registry.active_contexts === 'object'
+    && !Array.isArray(registry.active_contexts)
+    ? registry.active_contexts : {};
+}
+
+export function activeContextRegistryInitialized(registry = {}) {
+  return Object.hasOwn(registry, 'active_contexts')
+    || Object.hasOwn(registry, 'active_contexts_schema')
+    || Object.hasOwn(registry, 'active_contexts_revision');
+}
+
+function assertAuthority(identity, context) {
+  if (!identity || !context || context.state !== 'active') {
+    throw contextError(
+      'WENDKEEP_ACTIVE_CONTEXT_NOT_FOUND',
+      'active context causal não foi resolvido antes do Stop',
+    );
+  }
+  for (const [contextField, identityField] of [
+    ['project_id', 'projectId'],
+    ['repository_id', 'repositoryId'],
+    ['worktree_id', 'worktreeId'],
+    ['work_session_id', 'workSessionId'],
+  ]) {
+    if (!text(context[contextField]) || text(context[contextField]) !== text(identity[identityField])) {
+      throw contextError(
+        'WENDKEEP_ACTIVE_CONTEXT_IDENTITY_MISMATCH',
+        `${contextField} do active context não corresponde à sessão causal`,
+      );
+    }
+  }
+  if (!text(context.branch) || text(context.branch) !== text(identity.branch)) {
+    throw contextError(
+      'WENDKEEP_ACTIVE_CONTEXT_IDENTITY_MISMATCH',
+      'branch do active context não corresponde à sessão causal',
+    );
+  }
+}
+
+export function resolveHandoffEvidenceAuthority(vaultBase, {
+  input = {},
+  sessionId = '',
+  projectRoot = input.cwd || process.cwd(),
+  registry = readSessionRegistry(vaultBase),
+  resolveCommand = resolveRuntimeActiveContext,
+  resolveContext = resolveActiveContext,
+} = {}) {
+  if (!activeContextRegistryInitialized(registry)) {
+    return { mode: 'legacy', identity: null, context: null };
+  }
+  const identity = resolveCommand({
+    vaultBase,
+    projectRoot,
+    sessionId,
+  });
+  if (!identity) {
+    throw contextError(
+      'WENDKEEP_ACTIVE_CONTEXT_NOT_FOUND',
+      'registry contextual inicializado sem identidade causal para o Stop',
+    );
+  }
+  const context = resolveContext(vaultBase, { ...identity, sessionId });
+  assertAuthority(identity, context);
+  return { mode: 'contextual', identity, context };
+}
+
+export function resolveReadOnlyEvidenceActiveContext({
+  vaultBase,
+  projectRoot = process.cwd(),
+  sessionId = '',
+} = {}) {
+  const authority = resolveHandoffEvidenceAuthority(vaultBase, {
+    input: { cwd: projectRoot },
+    projectRoot,
+    sessionId,
+  });
+  return authority.mode === 'contextual' ? authority.identity : null;
+}
+
+function suppliedShared(input) {
+  const supplied = input?.shared || input?.handoff?.shared;
+  return supplied && typeof supplied === 'object' && !Array.isArray(supplied)
+    ? { ...supplied }
+    : {};
+}
+
+function suppliedIdentityValues(input, shared, snake, camel) {
+  const direct = input?.shared && typeof input.shared === 'object' && !Array.isArray(input.shared)
+    ? input.shared : {};
+  const nested = input?.handoff?.shared && typeof input.handoff.shared === 'object'
+    && !Array.isArray(input.handoff.shared)
+    ? input.handoff.shared : {};
+  return [
+    shared[snake], shared[camel],
+    direct[snake], direct[camel],
+    nested[snake], nested[camel],
+    input?.[snake], input?.[camel],
+  ]
+    .map(text)
+    .filter(Boolean);
+}
+
+export function buildCausalSharedHandoff({ input = {}, entry = {}, authority } = {}) {
+  const shared = suppliedShared(input);
+  if (authority?.mode !== 'contextual') {
+    const workSessionId = text(
+      shared.work_session_id
+      || shared.workSessionId
+      || input.work_session_id
+      || input.workSessionId
+      || entry?.work_session_id,
+    );
+    if (!shared.work_session_id && workSessionId) shared.work_session_id = workSessionId;
+    return Object.keys(shared).length ? shared : null;
+  }
+
+  assertAuthority(authority.identity, authority.context);
+  const expected = {
+    workSessionId: text(authority.identity.workSessionId),
+    repositoryId: text(authority.identity.repositoryId),
+    worktreeId: text(authority.identity.worktreeId),
+    branch: text(authority.identity.branch || authority.context.branch),
+    changeSlug: text(authority.context.change_slug),
+  };
+  for (const [snake, camel] of IDENTITY_FIELDS) {
+    const suppliedValues = suppliedIdentityValues(input, shared, snake, camel);
+    if (suppliedValues.some((supplied) => supplied !== expected[camel])) {
+      throw contextError(
+        'WENDKEEP_HANDOFF_CONTEXT_MISMATCH',
+        `${snake} do handoff não corresponde ao active context causal`,
+      );
+    }
+    delete shared[camel];
+    if (expected[camel]) shared[snake] = expected[camel];
+    else delete shared[snake];
+  }
+  return Object.keys(shared).length ? shared : null;
+}
+
+export function causalChangeSlug(entry = {}, authority = {}) {
+  return authority?.mode === 'contextual'
+    ? text(authority.context?.change_slug)
+    : text(entry?.change_slug);
+}
+
+export function scopeEvidenceRows(rows, { activeContext = null, registry = {} } = {}) {
+  if (!Array.isArray(rows) || !activeContextRegistryInitialized(registry)) return rows;
+
+  const callerWorkSession = text(activeContext?.workSessionId ?? activeContext?.work_session_id);
+  const sessions = registry.sessions || {};
+  const activeContexts = Object.values(contextsOf(registry))
+    .filter((context) => context?.state === 'active');
+  const activeChangeOwners = new Map();
+  for (const context of activeContexts) {
+    const slug = text(context.change_slug);
+    if (slug) activeChangeOwners.set(slug, text(context.work_session_id));
+  }
+
+  return rows.filter((row) => {
+    const sessionId = text(row?.session_id);
+    const rowWorkSession = text(row?.work_session_id)
+      || text(sessionId && sessions[sessionId]?.work_session_id);
+    if (sessionId && !rowWorkSession) return false;
+    if (rowWorkSession && rowWorkSession !== callerWorkSession) return false;
+    if (rowWorkSession && !callerWorkSession) return false;
+
+    const changeSlug = text(row?.change_slug);
+    const owner = activeChangeOwners.get(changeSlug) || '';
+    if (owner && owner !== callerWorkSession) return false;
+    if (owner && !callerWorkSession) return false;
+    return true;
+  });
+}

package/hooks/evidence-context.mjs

@@ -1,21 +1,29 @@
 #!/usr/bin/env node
 // UserPromptSubmit: bounded, read-only retrieval from the local evidence index.
 import { pathToFileURL } from 'node:url';
-import { readHookInput, writeHookOutput } from './obsidian-common.mjs';
+import { readHookInput, readSessionRegistry, writeHookOutput } from './obsidian-common.mjs';
 import { loadEvidenceIndex, recallEvidence, renderEvidenceContext } from './evidence-recall.mjs';
 import { sanitizeMemoryText } from './memory-schema.mjs';
 import { resolveHookOperatingProfile } from './operating-profile-runtime.mjs';
+import {
+  resolveReadOnlyEvidenceActiveContext,
+  scopeEvidenceRows,
+} from './active-context-handoff-evidence.mjs';
 import { isBootstrapPrompt } from '../packages/integrations/src/prompt-content.mjs';
 
 export function buildPromptEvidenceContext(vaultBase, prompt, {
-  topK = 3, maxBytes = 3072, rows = null,
+  topK = 3, maxBytes = 3072, rows = null, activeContext = null, registry = null,
 } = {}) {
   const query = sanitizeMemoryText(String(prompt || '')).trim();
   if (!query || isBootstrapPrompt(query)) return '';
   const evidence = rows || loadEvidenceIndex(vaultBase);
-  if (!evidence.length) return '';
+  const scoped = scopeEvidenceRows(evidence, {
+    activeContext,
+    registry: registry || readSessionRegistry(vaultBase),
+  });
+  if (!scoped.length) return '';
   return sanitizeMemoryText(renderEvidenceContext(
-    recallEvidence(evidence, query, { topK }),
+    recallEvidence(scoped, query, { topK }),
     { maxBytes },
   ));
 }
@@ -23,13 +31,20 @@ export function buildPromptEvidenceContext(vaultBase, prompt, {
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
   try {
     const input = readHookInput();
-    const runtime = resolveHookOperatingProfile({ input });
+    const runtime = resolveHookOperatingProfile({
+      input,
+      activeContextResolver: resolveReadOnlyEvidenceActiveContext,
+    });
     if (runtime.bindingError) {
       writeHookOutput({});
     } else {
       const context = buildPromptEvidenceContext(
         runtime.vaultBase,
         input.prompt || input.user_prompt || '',
+        {
+          activeContext: runtime.activeContext,
+          registry: readSessionRegistry(runtime.vaultBase),
+        },
       );
       writeHookOutput(context ? {
         hookSpecificOutput: { hookEventName: 'UserPromptSubmit', additionalContext: context },

package/hooks/operating-profile-runtime.mjs

@@ -133,6 +133,7 @@ export function resolveHookOperatingProfile({
   resolution = null,
   config = null,
   provider,
+  activeContextResolver = resolveCommandActiveContext,
 } = {}) {
   const initialResolution = resolution || resolveProjectVault({ input });
   const matched = matchingProjectBinding(initialResolution, input);
@@ -158,7 +159,7 @@ export function resolveHookOperatingProfile({
   let contextError = null;
   if (!bindingError && identity.state === 'resolved') {
     try {
-      activeContext = resolveCommandActiveContext({
+      activeContext = activeContextResolver({
         vaultBase: vaultResolution.base,
         projectRoot: input?.cwd || vaultResolution.projectRoot || process.cwd(),
         sessionId: identity.canonicalConversationId,

package/hooks/session-stop.mjs

@@ -19,6 +19,11 @@ import { mutateSessionNote } from './session-note-io.mjs';
 import { appendIterationOutcome } from './session-iteration-outcome.mjs';
 import { applyDerivedSections, provenanceSessions } from './derived-sections.mjs';
 import { buildSessionMemoryEvents, collectLifecycleEvidence } from './memory-handoff.mjs';
+import {
+  buildCausalSharedHandoff,
+  causalChangeSlug,
+  resolveHandoffEvidenceAuthority,
+} from './active-context-handoff-evidence.mjs';
 import { enqueueMemoryEvent, projectMemoryOutbox } from './memory-store.mjs';
 import { detectMemoryMode } from './memory-mode.mjs';
 import { sanitizeMemoryText } from './memory-schema.mjs';
@@ -521,21 +526,6 @@ function shouldFinalizeSession() {
   return process.env.OBSIDIAN_NO_AUTO_FINALIZE !== '1';
 }
 
-function sharedHandoffFromInput(input = {}, entry = {}) {
-  const supplied = input.shared || input.handoff?.shared;
-  const shared = supplied && typeof supplied === 'object' && !Array.isArray(supplied)
-    ? { ...supplied }
-    : {};
-  const workSessionId = shared.work_session_id
-    || shared.workSessionId
-    || input.work_session_id
-    || input.workSessionId
-    || entry?.work_session_id
-    || '';
-  if (!shared.work_session_id && workSessionId) shared.work_session_id = workSessionId;
-  return Object.keys(shared).length ? shared : null;
-}
-
 export function commitSessionMemory(vaultBase, handoff, { projectOptions = {} } = {}) {
   if (detectMemoryMode(vaultBase).mode === 'legacy') {
     return { status: 'legacy', eventCount: 0, eventIds: [], checkpoint: null };
@@ -1277,6 +1267,29 @@ export async function main({
   const tx = parseTranscript(identity.transcriptPath || input.transcript_path || input.transcriptPath);
   const requestedTurnId = String(input.turn_id || input.turnId || '');
   const sessionId = identity.canonicalConversationId;
+  let handoffEvidenceAuthority;
+  let sharedHandoff;
+  let activeContextChangeSlug;
+  try {
+    handoffEvidenceAuthority = resolveHandoffEvidenceAuthority(vaultBase, {
+      input,
+      sessionId,
+      projectRoot: input.cwd || process.cwd(),
+    });
+    sharedHandoff = buildCausalSharedHandoff({
+      input,
+      entry,
+      authority: handoffEvidenceAuthority,
+    });
+    activeContextChangeSlug = causalChangeSlug(entry, handoffEvidenceAuthority);
+  } catch (error) {
+    const detail = String(error?.message || 'active context causal indisponível');
+    process.stderr.write(`[wendkeep] Stop causal bloqueado: ${detail}\n`);
+    writeHookOutput({
+      systemMessage: `wendkeep: Stop bloqueado antes de publicar handoff/evidência: ${detail}`,
+    });
+    return;
+  }
   const finalizing = shouldFinalizeSession();
   const turnIdentity = resolveTurnIdentity(tx, requestedTurnId);
   if (!turnIdentity) {
@@ -1389,11 +1402,10 @@ export async function main({
     }
     const finalSummary = sessionFinalSummary(tx);
     const memoryEvidence = collectLifecycleEvidence(vaultBase, {
-      changeSlug: entry.change_slug,
+      changeSlug: activeContextChangeSlug,
       summary: finalSummary,
       noteRel: sessionRel,
     });
-    const sharedHandoff = sharedHandoffFromInput(input, entry);
     memoryHandoff = {
       projectId,
       identity,
@@ -1531,9 +1543,11 @@ export async function main({
   // grafo quando a change fechava antes do turno seguinte. Aqui sobrevive ao reopen e acumula toda
   // change que passou pela sessão (upsertListSection deduplica). Fail-quiet: nunca derruba o Stop.
   try {
-    const chgLink = entry.change_slug
-      ? `Change ativa: [[${getLocale(vaultBase).folders.changes}/${entry.change_slug}/proposta]]`
-      : activeChangeLink(vaultBase);
+    const chgLink = activeContextChangeSlug
+      ? `Change ativa: [[${getLocale(vaultBase).folders.changes}/${activeContextChangeSlug}/proposta]]`
+      : handoffEvidenceAuthority.mode === 'legacy'
+        ? activeChangeLink(vaultBase)
+        : '';
     const wl = (chgLink.match(/\[\[[^\]]+\]\]/) || [])[0];
     if (wl) {
       mutateSessionNote(sessionPath, (cur) => (

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wendkeep",
-  "version": "0.76.6",
+  "version": "0.76.7",
   "description": "Vault-first persistent memory for AI coding agents, with an optional profile-aware governance runtime: OFF, FLOW, GUIDE, GOVERN, or ASSURE. Local-first and agent-agnostic (Claude Code, Codex, Cursor…).",
   "type": "module",
   "workspaces": [
@@ -42,7 +42,7 @@
   },
   "scripts": {
     "precheck": "node --check src/worktree.mjs && node --check src/context.mjs && node --check packages/vault/src/worktree-metadata.mjs",
-    "check": "node --check scripts/release.mjs && node --check scripts/release-plan.mjs && node --check scripts/release-provenance.mjs && node --check scripts/run-scope.mjs && node --check src/release-provenance.mjs && node --check bin/wendkeep.mjs && node --check packages/cli/src/index.mjs && node --check src/init.mjs && node --check src/doctor.mjs && node --check src/project-vault.mjs && node --check src/observer-auth.mjs && node --check src/observer-privacy.mjs && node --check src/observer-snapshot.mjs && node --check src/observer-store.mjs && node --check src/observer-memory.mjs && node --check src/observer-memory-publish.mjs && node --check src/observer-sql-store.mjs && node --check src/observer-sql-migrate.mjs && node --check src/observer-sql-publish.mjs && node --check src/observer-transcript-store.mjs && node --check src/observer-server.mjs && node --check src/observer.mjs && node --check src/observer-publish.mjs && node --check src/operating-profile.mjs && node --check src/profile.mjs && node --check src/flow.mjs && node --check src/work-kind.mjs && node --check src/delivery.mjs && node --check web/observer/app.mjs && node --check hooks/observer-publish.mjs && node --check hooks/evidence-context.mjs && node --check hooks/evidence-recall.mjs && node --check hooks/memory-scope.mjs && node --check hooks/operating-profile-runtime.mjs && node --check hooks/operating-profile-task-store.mjs && node --check hooks/flow-core.mjs && node --check hooks/flow-protected-policy.mjs && node --check hooks/git-snapshot.mjs && node --check hooks/vault-path-safety.mjs && node --check hooks/vault-runtime-store.mjs && node --check packages/harness/src/index.mjs && node --check packages/harness/src/flow-store.mjs && node --check packages/harness/src/operating-profile.mjs && node --check packages/harness/src/sensors-core.mjs && node --check packages/integrations/src/host-hooks.mjs && node --check packages/integrations/src/hook-envelope.mjs && node --check packages/integrations/src/prompt-content.mjs && node --check packages/integrations/src/transcript-usage.mjs && node --check packages/integrations/src/transcripts.mjs && node --check packages/integrations/src/session-identity.mjs && node --check packages/integrations/src/index.mjs && node --check packages/mcp/src/config.mjs && node --check packages/mcp/src/index.mjs && node --check packages/vault/src/index.mjs && node --check packages/vault/src/project-vault.mjs && node --check packages/vault/src/vault-path-safety.mjs && node --check packages/vault/src/locale.mjs && node --check packages/vault/src/memory-schema.mjs && node --check packages/vault/src/memory-mode.mjs && node --check packages/vault/src/memory-scope.mjs && node --check packages/vault/src/memory-candidate-policy.mjs && node --check packages/vault/src/evidence-recall.mjs && node --check packages/vault/src/memory-handoff.mjs && node --check packages/vault/src/memory-store.mjs && node --check packages/vault/src/validate-core.mjs && node --check packages/vault/src/validate-memory.mjs",
+    "check": "node --check scripts/release.mjs && node --check scripts/release-plan.mjs && node --check scripts/release-provenance.mjs && node --check scripts/run-scope.mjs && node --check src/release-provenance.mjs && node --check bin/wendkeep.mjs && node --check packages/cli/src/index.mjs && node --check src/init.mjs && node --check src/doctor.mjs && node --check src/project-vault.mjs && node --check src/observer-auth.mjs && node --check src/observer-privacy.mjs && node --check src/observer-snapshot.mjs && node --check src/observer-store.mjs && node --check src/observer-memory.mjs && node --check src/observer-memory-publish.mjs && node --check src/observer-sql-store.mjs && node --check src/observer-sql-migrate.mjs && node --check src/observer-sql-publish.mjs && node --check src/observer-transcript-store.mjs && node --check src/observer-server.mjs && node --check src/observer.mjs && node --check src/observer-publish.mjs && node --check src/operating-profile.mjs && node --check src/profile.mjs && node --check src/flow.mjs && node --check src/work-kind.mjs && node --check src/delivery.mjs && node --check web/observer/app.mjs && node --check hooks/observer-publish.mjs && node --check hooks/evidence-context.mjs && node --check hooks/active-context-handoff-evidence.mjs && node --check hooks/evidence-recall.mjs && node --check hooks/memory-scope.mjs && node --check hooks/operating-profile-runtime.mjs && node --check hooks/operating-profile-task-store.mjs && node --check hooks/flow-core.mjs && node --check hooks/flow-protected-policy.mjs && node --check hooks/git-snapshot.mjs && node --check hooks/vault-path-safety.mjs && node --check hooks/vault-runtime-store.mjs && node --check packages/harness/src/index.mjs && node --check packages/harness/src/flow-store.mjs && node --check packages/harness/src/operating-profile.mjs && node --check packages/harness/src/sensors-core.mjs && node --check packages/integrations/src/host-hooks.mjs && node --check packages/integrations/src/hook-envelope.mjs && node --check packages/integrations/src/prompt-content.mjs && node --check packages/integrations/src/transcript-usage.mjs && node --check packages/integrations/src/transcripts.mjs && node --check packages/integrations/src/session-identity.mjs && node --check packages/integrations/src/index.mjs && node --check packages/mcp/src/config.mjs && node --check packages/mcp/src/index.mjs && node --check packages/vault/src/index.mjs && node --check packages/vault/src/project-vault.mjs && node --check packages/vault/src/vault-path-safety.mjs && node --check packages/vault/src/locale.mjs && node --check packages/vault/src/memory-schema.mjs && node --check packages/vault/src/memory-mode.mjs && node --check packages/vault/src/memory-scope.mjs && node --check packages/vault/src/memory-candidate-policy.mjs && node --check packages/vault/src/evidence-recall.mjs && node --check packages/vault/src/memory-handoff.mjs && node --check packages/vault/src/memory-store.mjs && node --check packages/vault/src/validate-core.mjs && node --check packages/vault/src/validate-memory.mjs",
     "test": "node --test --test-concurrency=2",
     "test:core": "node scripts/run-scope.mjs core",
     "release": "node scripts/release.mjs",