wendkeep 0.76.6 → 0.76.8

package/CHANGELOG.md

@@ -4,6 +4,34 @@ All notable changes to **wendkeep** are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.76.8] — 2026-08-22
+
+### Added
+
+- **Doctor de active contexts.** A seção `[active-contexts]` cruza store, sessões e topologia Git
+  read-only para classificar sessão órfã, worktree removida e lease `request-stop` expirada; uma
+  topologia não provada permanece diagnóstico não acionável, nunca falso positivo de remoção.
+- **Reparo explícito com CAS.** `context repair` exige key, revision, sessão ator e motivo, revalida
+  sob o lock e falha sem writes quando o alvo ficou saudável, stale ou não pode ser provado.
+- **Preservação histórica.** Orphan/removed muda para `closed` sem apagar o contexto; lease vencida
+  isolada muda para `expired` sem fechar contexto saudável. Receipt append-only e projeções legadas
+  são atualizados sem tocar ledger, evidência, notas ou memória histórica.
+
+## [0.76.7] — 2026-08-22
+
+### Fixed
+
+- **Handoff causal no Stop.** Com `active_contexts` inicializado, work session, repository,
+  worktree, branch e change vêm do contexto chamador; payload divergente falha antes de CAS,
+  nota, outbox ou ledger e não publica estado parcial.
+- **Evidência da change correta.** O lifecycle coleta verdict, sensores e ADR apenas da change do
+  active context causal, sem reutilizar `change_slug` legado ou link global de uma sessão irmã.
+- **Recall automático escopado.** `UserPromptSubmit` permanece somente leitura, sem migrar pointer
+  ou registry; exclui evidência de sessão/change irmã ativa e preserva material global/histórico.
+  `/brain-recall` explícito segue global.
+- **Compatibilidade conservadora.** O comportamento anterior permanece somente quando o registry
+  ainda não possui nenhum campo do store contextual, inclusive quando `active_contexts` está vazio.
+
 ## [0.76.6] — 2026-08-22
 
 ### Fixed

package/README.en.md

@@ -115,7 +115,7 @@ npx wendkeep init
 
 1. Create the vault folder taxonomy and a templated `README.md` (default vault: `<project>/.<project-name>-vault`, e.g. `.MyApp-vault`; override with `--vault`).
 2. Write a provider-neutral **`.wendkeep.json`** binding at the project root and a matching `.brain/PROJECT.json` marker in the vault, then merge the session hooks into **`.claude/settings.json`**. The binding is provider-neutral by design: any agent resolves the same vault from its session `cwd`, with no machine-global environment variable. Older registrations already in `.claude/settings.json` are adopted automatically.
-3. Wire the Codex hooks in **`.codex/hooks.json`** — twelve compatible entries: `brain-inject` + `session-start` + `observer-publish` on `SessionStart`, `session-ensure` + `evidence-context` + `change-context` on `UserPromptSubmit`, `session-stop` + `observer-publish` + `change-nag` on `Stop`, `subagent-stop` + `observer-publish` on `SubagentStop`, and `change-guard` on `PreToolUse` for `Bash`, `exec_command`, `apply_patch`, and mutable MCP tools, always in the `npx wendkeep hook <name>` form. For the Observer, `SessionStart` only drains the outbox, `Stop` enqueues the changed session, and `SubagentStop` enqueues only the affected transcript; full scanning is explicit through `observer reconcile`. The guard accepts object, raw-string, and argv Codex payloads; before a mutation it compares the session with the project, Git root, remote, branch, and worktree, denying missing or divergent targets. A raw `git checkout/switch` branch transition is denied before it can strand the session; use `wendkeep context switch <branch> [--create]`, which moves Git and the causal scope together in the same worktree with an audited revision and rollback. If a divergence is already quarantined, `context status --session <id>` inventories sanitized `reserved`/`observed` candidates; `context recover --session <id> --select <reserved|observed> --revision <n> --reason <text>` requires an explicit choice, CAS, and current-checkout proof, failing closed before clearing the conflict if revalidation changes. The change lifecycle uses `active_contexts`, identified by `repository_id` + `worktree_id` + `work_session_id`; two matching sessions fail with ambiguity instead of selecting silently, `CURRENT_CHANGE.md` is only a derived projection for one unambiguous context, and migration never invents a worktree or session identity. The other four stay out because Codex offers no equivalent payload, tool, or event: `change-warn` (no reliable `tool_input.file_path`), `plan-capture` (no `ExitPlanMode`), `decision-capture` (`AskUserQuestion` is Claude-only), and `task-log` (`TaskCompleted` is not in Codex's event enum). Codex scope blocks use `permissionDecision: "deny"`; `ask` is never emitted in `PreToolUse`. The merge remains non-destructive, preserves third-party hooks, and migrates legacy `timeout` to `timeoutSec`. **Codex enumerates every hook as untrusted and runs none until you approve the “Hooks need review” prompt at startup — `init` cannot pre-approve them**.
+3. Wire the Codex hooks in **`.codex/hooks.json`** — twelve compatible entries: `brain-inject` + `session-start` + `observer-publish` on `SessionStart`, `session-ensure` + `evidence-context` + `change-context` on `UserPromptSubmit`, `session-stop` + `observer-publish` + `change-nag` on `Stop`, `subagent-stop` + `observer-publish` on `SubagentStop`, and `change-guard` on `PreToolUse` for `Bash`, `exec_command`, `apply_patch`, and mutable MCP tools, always in the `npx wendkeep hook <name>` form. For the Observer, `SessionStart` only drains the outbox, `Stop` enqueues the changed session, and `SubagentStop` enqueues only the affected transcript; full scanning is explicit through `observer reconcile`. The guard accepts object, raw-string, and argv Codex payloads; before a mutation it compares the session with the project, Git root, remote, branch, and worktree, denying missing or divergent targets. A raw `git checkout/switch` branch transition is denied before it can strand the session; use `wendkeep context switch <branch> [--create]`, which moves Git and the causal scope together in the same worktree with an audited revision and rollback. If a divergence is already quarantined, `context status --session <id>` inventories sanitized `reserved`/`observed` candidates; `context recover --session <id> --select <reserved|observed> --revision <n> --reason <text>` requires an explicit choice, CAS, and current-checkout proof, failing closed before clearing the conflict if revalidation changes. `doctor` diagnoses orphaned active contexts, removed worktrees, and expired `request-stop` leases without writing; `context repair --key <key> --revision <n> --reason <text> --session <id>` revalidates under lock, closes only the ownerless/removed context or expires only its lease, while preserving the record and all historical memory. The change lifecycle uses `active_contexts`, identified by `repository_id` + `worktree_id` + `work_session_id`; two matching sessions fail with ambiguity instead of selecting silently, `CURRENT_CHANGE.md` is only a derived projection for one unambiguous context, and migration never invents a worktree or session identity. The other four stay out because Codex offers no equivalent payload, tool, or event: `change-warn` (no reliable `tool_input.file_path`), `plan-capture` (no `ExitPlanMode`), `decision-capture` (`AskUserQuestion` is Claude-only), and `task-log` (`TaskCompleted` is not in Codex's event enum). Codex scope blocks use `permissionDecision: "deny"`; `ask` is never emitted in `PreToolUse`. The merge remains non-destructive, preserves third-party hooks, and migrates legacy `timeout` to `timeoutSec`. **Codex enumerates every hook as untrusted and runs none until you approve the “Hooks need review” prompt at startup — `init` cannot pre-approve them**.
 4. Add the **`wendkeep-vault`** MCP server to `.mcp.json` so the agent can read/write the vault. Skip with `--no-mcp` — e.g. when the agent already has a vault MCP. (`--no-mcp` skips *only wendkeep's own* MCP; companion MCPs still follow `--companions`.)
 5. Offer to pin **companion** plugins/MCP (multi-choice; **none** pre-checked — wendkeep is a neutral harness and presumes no third-party plugin). Each is wired the most agent-agnostic way it supports:
    - **`context-mode`** — context optimizer + FTS5 memory, wired as a Claude Code plugin. It ships its own MCP server, so wendkeep deliberately adds no `.mcp.json` entry (registering both cold-started two servers at once). On non-Claude agents, add the MCP by hand: `npx -y context-mode`.
@@ -386,8 +386,8 @@ Hot memory now separates human authorship, operational state, and evidence:
 - **`SHARED_MEMORY.md` is bounded generated operational state.** The `Stop` hook turns the session handoff into sanitized events; the projector deterministically reduces the ledger and publishes a verifiable revision, cursor, and hash. Admission prioritizes critical operational state and never publishes beyond 48 lines/6 KiB; omitted events remain in the append-only authority and surface only as verifiable counts. Facts are `verified` only with local evidence; unsupported reports remain `reported`, and disagreements become candidates for human judgment.
 - **`MEMORY_EVENTS.jsonl` is the append-only authority.** `Stop` makes events durable in the outbox before acknowledging the attempt; the projector runs outside the registry lock and retries reuse the same IDs. Repeating an identical `event_id`/payload is a no-op; reusing the ID with different bytes is observable corruption.
 - **`MEMORY_CANDIDATES.jsonl` is the curation queue.** Conflicts and legacy content are never silently promoted. `promote` and `reject` record the decision as a new event; promotion preserves the selected event's JSON type, session, activation/epoch, and source turn.
-- **Registers are scoped.** `git.local-head`, handoffs, verdicts, and change status carry project, work-session, change, branch, or worktree scope. Two branches do not create a global conflict; only events in the same scope and causal lineage may advance automatically.
-- **`EVIDENCE_INDEX.jsonl` is local recall.** Markdown is chunked by headings and blocks without requiring the Observer. Ranking combines BM25, exact phrases, field weights, authority, validity, bounded recency, and source diversity; `UserPromptSubmit` injects only relevant passages with provenance.
+- **Registers are scoped.** `git.local-head`, handoffs, verdicts, and change status carry project, work-session, change, branch, or worktree scope. Two branches do not create a global conflict; only events in the same scope and causal lineage may advance automatically. Once `active_contexts` is initialized, `Stop` derives `work_session_id`, `repository_id`, `worktree_id`, branch, and change from the causal active context; a divergent handoff fails before CAS, note, outbox, or ledger mutation. Legacy compatibility exists only without the contextual store.
+- **`EVIDENCE_INDEX.jsonl` is local recall.** Markdown is chunked by headings and blocks without requiring the Observer. Ranking combines BM25, exact phrases, field weights, authority, validity, bounded recency, and source diversity. The automatic `UserPromptSubmit` hook is read-only: it never migrates `CURRENT_CHANGE.md` or mutates the registry; it excludes passages owned by an active sibling session or change while preserving global and historical evidence. Explicit `/brain-recall` remains global.
 
 Artifacts stay under `.brain/` only. Sanitization strips secrets, tokens, local paths, transcripts, and harness payloads both before persistence and before injection. Events carry a `project_id`, and one vault never accepts another project's events.
 

package/README.md

@@ -115,7 +115,7 @@ npx wendkeep init
 
 1. Create the vault folder taxonomy and a templated `README.md` (default vault: `<project>/.<project-name>-vault`, e.g. `.MyApp-vault`; override with `--vault`).
 2. Write a provider-neutral **`.wendkeep.json`** binding at the project root and a matching `.brain/PROJECT.json` marker in the vault, then merge the session hooks into **`.claude/settings.json`**. The binding is provider-neutral by design: any agent resolves the same vault from its session `cwd`, with no machine-global environment variable. Older registrations already in `.claude/settings.json` are adopted automatically.
-3. Wire the Codex hooks in **`.codex/hooks.json`** — twelve compatible entries: `brain-inject` + `session-start` + `observer-publish` on `SessionStart`, `session-ensure` + `evidence-context` + `change-context` on `UserPromptSubmit`, `session-stop` + `observer-publish` + `change-nag` on `Stop`, `subagent-stop` + `observer-publish` on `SubagentStop`, and `change-guard` on `PreToolUse` for `Bash`, `exec_command`, `apply_patch`, and mutable MCP tools, always in the `npx wendkeep hook <name>` form. For the Observer, `SessionStart` only drains the outbox, `Stop` enqueues the changed session, and `SubagentStop` enqueues only the affected transcript; full scanning is explicit through `observer reconcile`. The guard accepts object, raw-string, and argv Codex payloads; before a mutation it compares the session with the project, Git root, remote, branch, and worktree, denying missing or divergent targets. A raw `git checkout/switch` branch transition is denied before it can strand the session; use `wendkeep context switch <branch> [--create]`, which moves Git and the causal scope together in the same worktree with an audited revision and rollback. If a divergence is already quarantined, `context status --session <id>` inventories sanitized `reserved`/`observed` candidates; `context recover --session <id> --select <reserved|observed> --revision <n> --reason <text>` requires an explicit choice, CAS, and current-checkout proof, failing closed before clearing the conflict if revalidation changes. The change lifecycle uses `active_contexts`, identified by `repository_id` + `worktree_id` + `work_session_id`; two matching sessions fail with ambiguity instead of selecting silently, `CURRENT_CHANGE.md` is only a derived projection for one unambiguous context, and migration never invents a worktree or session identity. The other four stay out because Codex offers no equivalent payload, tool, or event: `change-warn` (no reliable `tool_input.file_path`), `plan-capture` (no `ExitPlanMode`), `decision-capture` (`AskUserQuestion` is Claude-only), and `task-log` (`TaskCompleted` is not in Codex's event enum). Codex scope blocks use `permissionDecision: "deny"`; `ask` is never emitted in `PreToolUse`. The merge remains non-destructive, preserves third-party hooks, and migrates legacy `timeout` to `timeoutSec`. **Codex enumerates every hook as untrusted and runs none until you approve the “Hooks need review” prompt at startup — `init` cannot pre-approve them**.
+3. Wire the Codex hooks in **`.codex/hooks.json`** — twelve compatible entries: `brain-inject` + `session-start` + `observer-publish` on `SessionStart`, `session-ensure` + `evidence-context` + `change-context` on `UserPromptSubmit`, `session-stop` + `observer-publish` + `change-nag` on `Stop`, `subagent-stop` + `observer-publish` on `SubagentStop`, and `change-guard` on `PreToolUse` for `Bash`, `exec_command`, `apply_patch`, and mutable MCP tools, always in the `npx wendkeep hook <name>` form. For the Observer, `SessionStart` only drains the outbox, `Stop` enqueues the changed session, and `SubagentStop` enqueues only the affected transcript; full scanning is explicit through `observer reconcile`. The guard accepts object, raw-string, and argv Codex payloads; before a mutation it compares the session with the project, Git root, remote, branch, and worktree, denying missing or divergent targets. A raw `git checkout/switch` branch transition is denied before it can strand the session; use `wendkeep context switch <branch> [--create]`, which moves Git and the causal scope together in the same worktree with an audited revision and rollback. If a divergence is already quarantined, `context status --session <id>` inventories sanitized `reserved`/`observed` candidates; `context recover --session <id> --select <reserved|observed> --revision <n> --reason <text>` requires an explicit choice, CAS, and current-checkout proof, failing closed before clearing the conflict if revalidation changes. `doctor` diagnoses orphaned active contexts, removed worktrees, and expired `request-stop` leases without writing; `context repair --key <key> --revision <n> --reason <text> --session <id>` revalidates under lock, closes only the ownerless/removed context or expires only its lease, while preserving the record and all historical memory. The change lifecycle uses `active_contexts`, identified by `repository_id` + `worktree_id` + `work_session_id`; two matching sessions fail with ambiguity instead of selecting silently, `CURRENT_CHANGE.md` is only a derived projection for one unambiguous context, and migration never invents a worktree or session identity. The other four stay out because Codex offers no equivalent payload, tool, or event: `change-warn` (no reliable `tool_input.file_path`), `plan-capture` (no `ExitPlanMode`), `decision-capture` (`AskUserQuestion` is Claude-only), and `task-log` (`TaskCompleted` is not in Codex's event enum). Codex scope blocks use `permissionDecision: "deny"`; `ask` is never emitted in `PreToolUse`. The merge remains non-destructive, preserves third-party hooks, and migrates legacy `timeout` to `timeoutSec`. **Codex enumerates every hook as untrusted and runs none until you approve the “Hooks need review” prompt at startup — `init` cannot pre-approve them**.
 4. Add the **`wendkeep-vault`** MCP server to `.mcp.json` so the agent can read/write the vault. Skip with `--no-mcp` — e.g. when the agent already has a vault MCP. (`--no-mcp` skips *only wendkeep's own* MCP; companion MCPs still follow `--companions`.)
 5. Offer to pin **companion** plugins/MCP (multi-choice; **none** pre-checked — wendkeep is a neutral harness and presumes no third-party plugin). Each is wired the most agent-agnostic way it supports:
    - **`context-mode`** — context optimizer + FTS5 memory, wired as a Claude Code plugin. It ships its own MCP server, so wendkeep deliberately adds no `.mcp.json` entry (registering both cold-started two servers at once). On non-Claude agents, add the MCP by hand: `npx -y context-mode`.
@@ -386,8 +386,8 @@ Hot memory now separates human authorship, operational state, and evidence:
 - **`SHARED_MEMORY.md` is bounded generated operational state.** The `Stop` hook turns the session handoff into sanitized events; the projector deterministically reduces the ledger and publishes a verifiable revision, cursor, and hash. Admission prioritizes critical operational state and never publishes beyond 48 lines/6 KiB; omitted events remain in the append-only authority and surface only as verifiable counts. Facts are `verified` only with local evidence; unsupported reports remain `reported`, and disagreements become candidates for human judgment.
 - **`MEMORY_EVENTS.jsonl` is the append-only authority.** `Stop` makes events durable in the outbox before acknowledging the attempt; the projector runs outside the registry lock and retries reuse the same IDs. Repeating an identical `event_id`/payload is a no-op; reusing the ID with different bytes is observable corruption.
 - **`MEMORY_CANDIDATES.jsonl` is the curation queue.** Conflicts and legacy content are never silently promoted. `promote` and `reject` record the decision as a new event; promotion preserves the selected event's JSON type, session, activation/epoch, and source turn.
-- **Registers are scoped.** `git.local-head`, handoffs, verdicts, and change status carry project, work-session, change, branch, or worktree scope. Two branches do not create a global conflict; only events in the same scope and causal lineage may advance automatically.
-- **`EVIDENCE_INDEX.jsonl` is local recall.** Markdown is chunked by headings and blocks without requiring the Observer. Ranking combines BM25, exact phrases, field weights, authority, validity, bounded recency, and source diversity; `UserPromptSubmit` injects only relevant passages with provenance.
+- **Registers are scoped.** `git.local-head`, handoffs, verdicts, and change status carry project, work-session, change, branch, or worktree scope. Two branches do not create a global conflict; only events in the same scope and causal lineage may advance automatically. Once `active_contexts` is initialized, `Stop` derives `work_session_id`, `repository_id`, `worktree_id`, branch, and change from the causal active context; a divergent handoff fails before CAS, note, outbox, or ledger mutation. Legacy compatibility exists only without the contextual store.
+- **`EVIDENCE_INDEX.jsonl` is local recall.** Markdown is chunked by headings and blocks without requiring the Observer. Ranking combines BM25, exact phrases, field weights, authority, validity, bounded recency, and source diversity. The automatic `UserPromptSubmit` hook is read-only: it never migrates `CURRENT_CHANGE.md` or mutates the registry; it excludes passages owned by an active sibling session or change while preserving global and historical evidence. Explicit `/brain-recall` remains global.
 
 Artifacts stay under `.brain/` only. Sanitization strips secrets, tokens, local paths, transcripts, and harness payloads both before persistence and before injection. Events carry a `project_id`, and one vault never accepts another project's events.
 

package/docs/en/commands/context.md

@@ -4,19 +4,23 @@
 
 ## Purpose
 
-Inspect and move the same session's causal scope with proof of the current checkout: during a
-normal branch transition or when explicitly recovering a divergence already under quarantine.
+Inspect and move the same session's causal scope with proof of the current checkout, recover a
+quarantined divergence, or explicitly repair operational authority that `doctor` proved orphaned,
+bound to a removed worktree, or carrying an expired lease.
 
 ## When to use
 
 Use `context switch` to create or select another branch in the same worktree. If the registry
 already records `project_scope_conflict`, use `context status` to inventory `reserved` and
 `observed` without local paths; recover only through `context recover` and an explicit human choice.
+Use `doctor` to obtain the key/revision for `active_contexts` debt; run `context repair` only after
+reviewing that diagnosis and providing an active actor session and explicit reason.
 
 ## When not to use
 
 Do not use it to move to another worktree, hand-edit the registry, or replace `worktree create`.
 Recovery never selects a candidate automatically or accepts a scope that no longer matches HEAD.
+`context repair` is not a healthy-context close command, an age-based cleanup, or history deletion.
 
 ## Prerequisites
 
@@ -30,6 +34,7 @@ Recovery never selects a candidate automatically or accepts a scope that no long
 npx --no-install wendkeep context switch <branch> [--create] [--session <id>] [--project <root>] [--vault <vault>] [--json]
 npx --no-install wendkeep context status --session <id> [--project <root>] [--vault <vault>] [--json]
 npx --no-install wendkeep context recover --session <id> --select <reserved|observed> --revision <n> --reason <text> [--project <root>] [--vault <vault>] [--json]
+npx --no-install wendkeep context repair --key <repository:worktree:work-session> --revision <n> --reason <text> --session <id> [--project <root>] [--vault <vault>] [--json]
 ```
 
 Without `--session`, exactly one active session must fully match the current scope. `--create`
@@ -38,9 +43,11 @@ uses `git switch -c`; without it, the command follows `git switch` semantics.
 ## Options and exit codes
 
 - `--create`: create the branch from the current HEAD.
-- `--session <id>`: select the causal session explicitly; recommended whenever selection is unclear.
+- `--session <id>`: select the causal session or, for repair, the active auditable actor session.
+- `--key <repository:worktree:work-session>`: select exactly the diagnosed active context.
 - `--select <reserved|observed>`: select exactly one quarantined candidate; required for recovery.
-- `--revision <n>`: CAS against the revision returned by `context status`; required for recovery.
+- `--revision <n>`: CAS against the revision returned by `context status` or `doctor`; required for
+  recovery and repair.
 - `--reason <text>`: auditable reason, sanitized and limited to 240 characters.
 - `--project <root>` and `--vault <vault>`: select the binding and paths for manual use.
 - `--json`: emit status, session id, branch, HEAD, revision, and event without exposing the Vault.
@@ -57,6 +64,7 @@ npx --no-install wendkeep context switch main --session 019abc-session-id
 npx --no-install wendkeep context switch wk/auth --session 019abc-session-id --json
 npx --no-install wendkeep context status --session 019abc-session-id --json
 npx --no-install wendkeep context recover --session 019abc-session-id --select observed --revision 7 --reason "checkout confirmed"
+npx --no-install wendkeep context repair --key "repo:tree:work" --revision 4 --reason "worktree removed after merge" --session 019abc-session-id
 ```
 
 Do not replace it with the raw command below while the harness is active:
@@ -85,6 +93,14 @@ preserves the change/lease/authorizations, clears only the quarantine, and appen
 receipt to `context_recoveries`. Any failure leaves the registry and quarantine byte-identical.
 This is fail-closed: no candidate, receipt, or partial scope is published after a failed check.
 
+For repair, the command rereads the target under lock, validates revision and actor session, proves
+the Git topology again, and reapplies the diagnosis. A context without an active session or with a
+removed worktree becomes `state=closed`, while its record and historical bindings remain; an
+isolated expired lease becomes `expired` and the context stays active. The append-only
+`active_context_repairs` receipt records actor, reason, diagnostics, and effect. Only after the
+authoritative write are `CURRENT_CHANGE.md` and `CURRENT_DELIVERY` reprojected; the ledger,
+evidence index, notes, and historical memory remain unchanged.
+
 ### Multi-context change registry
 
 `SESSION_REGISTRY.json` keeps `active_contexts` with its own schema and revision. Each entry is
@@ -116,6 +132,13 @@ when one active session, a complete scope, and worktree metadata prove one ident
 - `WENDKEEP_CONTEXT_ROLLBACK_FAILED`: preserve Git and registry state and diagnose manually before
   any new mutation.
 - `WENDKEEP_CONTEXT_SWITCH_REQUIRED`: replace the raw Git command with `wendkeep context switch`.
+- `WENDKEEP_ACTIVE_CONTEXT_CAS_MISMATCH`: the target revision changed; rerun `doctor`.
+- `WENDKEEP_ACTIVE_CONTEXT_HEALTHY`: the condition disappeared or was never repairable; do not force it.
+- `WENDKEEP_ACTIVE_CONTEXT_TOPOLOGY_UNPROVEN`: Git/registry could not prove worktrees; repair the
+  topology before any context repair.
+- `WENDKEEP_ACTIVE_CONTEXT_ACTOR_MISMATCH`: the actor session does not belong to the target's proven project.
+- `WENDKEEP_ACTIVE_CONTEXT_SESSION_ORPHAN`, `WENDKEEP_ACTIVE_CONTEXT_WORKTREE_REMOVED`, and
+  `WENDKEEP_ACTIVE_CONTEXT_LEASE_EXPIRED`: read-only diagnostics emitted by `doctor`.
 
 ## Next steps
 

package/docs/en/commands/memory.md

@@ -115,10 +115,17 @@ npx wendkeep validate-memory --vault <v2-vault>
   `change.<slug>.status` compete only inside the same scope. Automatic resolution still requires
   the same project and causal lineage; incompatible decisions, constraints, and blockers remain
   human-curated. An ambiguous key is omitted from SHARED without removing CORE or independent keys.
+  Once `active_contexts` is initialized, `Stop` derives `work_session_id`, `repository_id`,
+  `worktree_id`, branch, and `change_slug` from the causal active context. A divergent handoff
+  identity fails before CAS, note, outbox, or ledger mutation; legacy fallback exists only without
+  the contextual store.
 - `.brain/EVIDENCE_INDEX.jsonl` chunks documents by heading and block and records file, heading,
   type, change, session, work session, authority, date, validity, and hash. `/brain-recall` and the
   `UserPromptSubmit` hook use BM25, exact phrase, field weights, authority, validity, bounded
-  recency, and diversity to return the matching passage with provenance.
+  recency, and diversity to return the matching passage with provenance. Automatic recall is
+  read-only: it never migrates `CURRENT_CHANGE.md` or mutates the registry; it excludes rows owned
+  by an active sibling session or change while preserving global or historical rows with no active
+  owner. Explicit `/brain-recall` remains global.
 - Every memory path validates the physical topology of `.brain`, ledger, outbox, CORE, SHARED,
   candidates, registry, notes, backups, temporary files, and sidecars before reading or writing.
   Junctions, symlinks, reparse points, or hardlinks fail closed without touching external bytes.

package/docs/pt-BR/commands/context.md

@@ -4,19 +4,23 @@
 
 ## Objetivo
 
-Inspecionar e mover a scope causal da mesma sessão com prova do checkout atual: durante uma troca
-de branch normal ou ao recuperar explicitamente uma divergência já colocada em quarentena.
+Inspecionar e mover a scope causal da mesma sessão com prova do checkout atual, recuperar uma
+divergência em quarentena ou reparar explicitamente autoridade operacional que o `doctor` provou
+estar órfã, ligada a worktree removida ou com lease expirada.
 
 ## Quando usar
 
 Use `context switch` para criar ou selecionar outra branch na mesma worktree. Se o registry já
 registrou `project_scope_conflict`, use `context status` para inventariar `reserved` e `observed`
 sem paths locais; recupere somente com `context recover` e uma seleção humana explícita.
+Use `doctor` para obter key/revision de dívida em `active_contexts`; execute `context repair` somente
+depois de revisar o diagnóstico e fornecer sessão ator e motivo explícitos.
 
 ## Quando não usar
 
 Não use para mudar de worktree, editar o registry à mão ou substituir `worktree create`. Recovery
 não escolhe a candidata automaticamente e não aceita uma scope que deixou de corresponder ao HEAD.
+`context repair` não serve para encerrar contexto saudável, limpar por idade ou apagar histórico.
 
 ## Pré-requisitos
 
@@ -30,6 +34,7 @@ não escolhe a candidata automaticamente e não aceita uma scope que deixou de c
 npx --no-install wendkeep context switch <branch> [--create] [--session <id>] [--project <raiz>] [--vault <cofre>] [--json]
 npx --no-install wendkeep context status --session <id> [--project <raiz>] [--vault <cofre>] [--json]
 npx --no-install wendkeep context recover --session <id> --select <reserved|observed> --revision <n> --reason <texto> [--project <raiz>] [--vault <cofre>] [--json]
+npx --no-install wendkeep context repair --key <repository:worktree:work-session> --revision <n> --reason <texto> --session <id> [--project <raiz>] [--vault <cofre>] [--json]
 ```
 
 Sem `--session`, exatamente uma sessão ativa deve corresponder integralmente à scope atual. Use
@@ -38,9 +43,11 @@ Sem `--session`, exatamente uma sessão ativa deve corresponder integralmente à
 ## Opções e códigos de saída
 
 - `--create`: cria a branch a partir do HEAD atual.
-- `--session <id>`: seleciona explicitamente a sessão causal; recomendado quando houver dúvida.
+- `--session <id>`: seleciona a sessão causal ou, no repair, a sessão ator ativa e auditável.
+- `--key <repository:worktree:work-session>`: seleciona exatamente o active context diagnosticado.
 - `--select <reserved|observed>`: escolhe exatamente uma candidata da quarentena; obrigatório no recovery.
-- `--revision <n>`: CAS contra a revisão exibida por `context status`; obrigatório no recovery.
+- `--revision <n>`: CAS contra a revisão exibida por `context status` ou pelo `doctor`; obrigatório
+  em recovery e repair.
 - `--reason <texto>`: justificativa auditável, sanitizada e limitada a 240 caracteres.
 - `--project <raiz>` e `--vault <cofre>`: selecionam binding e paths para uso manual.
 - `--json`: emite status, session id, branch, HEAD, revisão e evento sem expor o Vault.
@@ -56,6 +63,7 @@ npx --no-install wendkeep context switch main --session 019abc-session-id
 npx --no-install wendkeep context switch wk/auth --session 019abc-session-id --json
 npx --no-install wendkeep context status --session 019abc-session-id --json
 npx --no-install wendkeep context recover --session 019abc-session-id --select observed --revision 7 --reason "checkout confirmado"
+npx --no-install wendkeep context repair --key "repo:tree:work" --revision 4 --reason "worktree removida após merge" --session 019abc-session-id
 ```
 
 Não substitua pelo comando cru abaixo quando o harness estiver ativo:
@@ -82,6 +90,14 @@ atuais. Sob o lock do registry, o comando revalida a revisão, incrementa `conte
 change/lease/autorizações, limpa somente a quarentena e anexa um receipt sanitizado em
 `context_recoveries`. Qualquer falha deixa registry e quarentena byte a byte intactos.
 
+No repair, o comando relê o alvo sob o lock, valida revision e sessão ator, prova novamente a
+topologia Git e reaplica o diagnóstico. Contexto sem sessão ativa ou com worktree removida muda
+para `state=closed`, mas seu registro e bindings históricos continuam presentes; uma lease vencida
+isolada muda para `expired` e o contexto segue ativo. O receipt append-only em
+`active_context_repairs` registra ator, motivo, diagnósticos e efeito. Só depois da escrita
+autoritativa `CURRENT_CHANGE.md` e `CURRENT_DELIVERY` são reprojetados; ledger, evidence index,
+notas e memória histórica não são alterados.
+
 ### Registry multi-contexto de changes
 
 O `SESSION_REGISTRY.json` mantém `active_contexts` com schema e revisão próprios. Cada entrada é
@@ -113,6 +129,13 @@ ativa, scope completa e metadados da worktree provam uma única identidade.
 - `WENDKEEP_CONTEXT_ROLLBACK_FAILED`: preserve Git e registry e faça diagnóstico manual antes de
   qualquer nova mutação.
 - `WENDKEEP_CONTEXT_SWITCH_REQUIRED`: troque o comando Git cru por `wendkeep context switch`.
+- `WENDKEEP_ACTIVE_CONTEXT_CAS_MISMATCH`: a revision do alvo mudou; rode o `doctor` novamente.
+- `WENDKEEP_ACTIVE_CONTEXT_HEALTHY`: a condição desapareceu ou o alvo nunca foi reparável; não force.
+- `WENDKEEP_ACTIVE_CONTEXT_TOPOLOGY_UNPROVEN`: o Git/registry não provou as worktrees; corrija a
+  topologia antes de qualquer repair.
+- `WENDKEEP_ACTIVE_CONTEXT_ACTOR_MISMATCH`: a sessão ator não pertence ao projeto provado do alvo.
+- `WENDKEEP_ACTIVE_CONTEXT_SESSION_ORPHAN`, `WENDKEEP_ACTIVE_CONTEXT_WORKTREE_REMOVED` e
+  `WENDKEEP_ACTIVE_CONTEXT_LEASE_EXPIRED`: diagnósticos read-only emitidos pelo `doctor`.
 
 ## Próximos passos
 

package/docs/pt-BR/commands/memory.md

@@ -114,11 +114,17 @@ npx wendkeep validate-memory --vault <cofre-v2>
 - Registradores como `git.local-head`, `handoff.latest`, `quality.latest-*` e
   `change.<slug>.status` só competem dentro do mesmo escopo. Resolução automática ainda exige o
   mesmo projeto e linhagem causal; decisões, constraints e blockers incompatíveis permanecem sob
-  curadoria. Uma chave ambígua é omitida de SHARED sem remover CORE ou chaves independentes.
+  curadoria. Uma chave ambígua é omitida de SHARED sem remover CORE ou chaves independentes. Com
+  `active_contexts` inicializado, o `Stop` deriva `work_session_id`, `repository_id`, `worktree_id`,
+  branch e `change_slug` do active context causal. Identidade divergente no handoff falha antes de
+  CAS, nota, outbox ou ledger; o fallback legado só existe sem o store contextual.
 - `.brain/EVIDENCE_INDEX.jsonl` divide documentos por headings e blocos e registra arquivo,
   heading, tipo, change, sessão, work session, autoridade, data, validade e hash. `/brain-recall`
   e o hook `UserPromptSubmit` usam BM25, frase exata, pesos por campo, autoridade, validade,
-  recência limitada e diversidade para retornar o trecho do match com proveniência.
+  recência limitada e diversidade para retornar o trecho do match com proveniência. No recall
+  automático, o hook é somente leitura: não migra `CURRENT_CHANGE.md` nem altera o registry;
+  exclui linhas pertencentes a sessão ou change irmã ativa e preserva linhas globais ou históricas
+  sem owner ativo. `/brain-recall` explícito permanece global.
 - Toda rota de memória valida a topologia física de `.brain`, ledger, outbox, CORE, SHARED,
   candidates, registry, notas, backups, temporários e sidecars antes de ler ou escrever. Junction,
   symlink, reparse point ou hardlink falham fechados sem tocar bytes externos. Locks publicam owner

package/hooks/active-context-handoff-evidence.mjs

@@ -0,0 +1,196 @@
+import { readSessionRegistry } from './obsidian-common.mjs';
+import { resolveActiveContext } from './active-context-store.mjs';
+import { resolveRuntimeActiveContext } from '../src/active-context-runtime.mjs';
+
+const IDENTITY_FIELDS = Object.freeze([
+  ['work_session_id', 'workSessionId'],
+  ['repository_id', 'repositoryId'],
+  ['worktree_id', 'worktreeId'],
+  ['branch', 'branch'],
+  ['change_slug', 'changeSlug'],
+]);
+
+function contextError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function text(value) {
+  return String(value ?? '').trim();
+}
+
+function contextsOf(registry) {
+  return registry?.active_contexts && typeof registry.active_contexts === 'object'
+    && !Array.isArray(registry.active_contexts)
+    ? registry.active_contexts : {};
+}
+
+export function activeContextRegistryInitialized(registry = {}) {
+  return Object.hasOwn(registry, 'active_contexts')
+    || Object.hasOwn(registry, 'active_contexts_schema')
+    || Object.hasOwn(registry, 'active_contexts_revision');
+}
+
+function assertAuthority(identity, context) {
+  if (!identity || !context || context.state !== 'active') {
+    throw contextError(
+      'WENDKEEP_ACTIVE_CONTEXT_NOT_FOUND',
+      'active context causal não foi resolvido antes do Stop',
+    );
+  }
+  for (const [contextField, identityField] of [
+    ['project_id', 'projectId'],
+    ['repository_id', 'repositoryId'],
+    ['worktree_id', 'worktreeId'],
+    ['work_session_id', 'workSessionId'],
+  ]) {
+    if (!text(context[contextField]) || text(context[contextField]) !== text(identity[identityField])) {
+      throw contextError(
+        'WENDKEEP_ACTIVE_CONTEXT_IDENTITY_MISMATCH',
+        `${contextField} do active context não corresponde à sessão causal`,
+      );
+    }
+  }
+  if (!text(context.branch) || text(context.branch) !== text(identity.branch)) {
+    throw contextError(
+      'WENDKEEP_ACTIVE_CONTEXT_IDENTITY_MISMATCH',
+      'branch do active context não corresponde à sessão causal',
+    );
+  }
+}
+
+export function resolveHandoffEvidenceAuthority(vaultBase, {
+  input = {},
+  sessionId = '',
+  projectRoot = input.cwd || process.cwd(),
+  registry = readSessionRegistry(vaultBase),
+  resolveCommand = resolveRuntimeActiveContext,
+  resolveContext = resolveActiveContext,
+} = {}) {
+  if (!activeContextRegistryInitialized(registry)) {
+    return { mode: 'legacy', identity: null, context: null };
+  }
+  const identity = resolveCommand({
+    vaultBase,
+    projectRoot,
+    sessionId,
+  });
+  if (!identity) {
+    throw contextError(
+      'WENDKEEP_ACTIVE_CONTEXT_NOT_FOUND',
+      'registry contextual inicializado sem identidade causal para o Stop',
+    );
+  }
+  const context = resolveContext(vaultBase, { ...identity, sessionId });
+  assertAuthority(identity, context);
+  return { mode: 'contextual', identity, context };
+}
+
+export function resolveReadOnlyEvidenceActiveContext({
+  vaultBase,
+  projectRoot = process.cwd(),
+  sessionId = '',
+} = {}) {
+  const authority = resolveHandoffEvidenceAuthority(vaultBase, {
+    input: { cwd: projectRoot },
+    projectRoot,
+    sessionId,
+  });
+  return authority.mode === 'contextual' ? authority.identity : null;
+}
+
+function suppliedShared(input) {
+  const supplied = input?.shared || input?.handoff?.shared;
+  return supplied && typeof supplied === 'object' && !Array.isArray(supplied)
+    ? { ...supplied }
+    : {};
+}
+
+function suppliedIdentityValues(input, shared, snake, camel) {
+  const direct = input?.shared && typeof input.shared === 'object' && !Array.isArray(input.shared)
+    ? input.shared : {};
+  const nested = input?.handoff?.shared && typeof input.handoff.shared === 'object'
+    && !Array.isArray(input.handoff.shared)
+    ? input.handoff.shared : {};
+  return [
+    shared[snake], shared[camel],
+    direct[snake], direct[camel],
+    nested[snake], nested[camel],
+    input?.[snake], input?.[camel],
+  ]
+    .map(text)
+    .filter(Boolean);
+}
+
+export function buildCausalSharedHandoff({ input = {}, entry = {}, authority } = {}) {
+  const shared = suppliedShared(input);
+  if (authority?.mode !== 'contextual') {
+    const workSessionId = text(
+      shared.work_session_id
+      || shared.workSessionId
+      || input.work_session_id
+      || input.workSessionId
+      || entry?.work_session_id,
+    );
+    if (!shared.work_session_id && workSessionId) shared.work_session_id = workSessionId;
+    return Object.keys(shared).length ? shared : null;
+  }
+
+  assertAuthority(authority.identity, authority.context);
+  const expected = {
+    workSessionId: text(authority.identity.workSessionId),
+    repositoryId: text(authority.identity.repositoryId),
+    worktreeId: text(authority.identity.worktreeId),
+    branch: text(authority.identity.branch || authority.context.branch),
+    changeSlug: text(authority.context.change_slug),
+  };
+  for (const [snake, camel] of IDENTITY_FIELDS) {
+    const suppliedValues = suppliedIdentityValues(input, shared, snake, camel);
+    if (suppliedValues.some((supplied) => supplied !== expected[camel])) {
+      throw contextError(
+        'WENDKEEP_HANDOFF_CONTEXT_MISMATCH',
+        `${snake} do handoff não corresponde ao active context causal`,
+      );
+    }
+    delete shared[camel];
+    if (expected[camel]) shared[snake] = expected[camel];
+    else delete shared[snake];
+  }
+  return Object.keys(shared).length ? shared : null;
+}
+
+export function causalChangeSlug(entry = {}, authority = {}) {
+  return authority?.mode === 'contextual'
+    ? text(authority.context?.change_slug)
+    : text(entry?.change_slug);
+}
+
+export function scopeEvidenceRows(rows, { activeContext = null, registry = {} } = {}) {
+  if (!Array.isArray(rows) || !activeContextRegistryInitialized(registry)) return rows;
+
+  const callerWorkSession = text(activeContext?.workSessionId ?? activeContext?.work_session_id);
+  const sessions = registry.sessions || {};
+  const activeContexts = Object.values(contextsOf(registry))
+    .filter((context) => context?.state === 'active');
+  const activeChangeOwners = new Map();
+  for (const context of activeContexts) {
+    const slug = text(context.change_slug);
+    if (slug) activeChangeOwners.set(slug, text(context.work_session_id));
+  }
+
+  return rows.filter((row) => {
+    const sessionId = text(row?.session_id);
+    const rowWorkSession = text(row?.work_session_id)
+      || text(sessionId && sessions[sessionId]?.work_session_id);
+    if (sessionId && !rowWorkSession) return false;
+    if (rowWorkSession && rowWorkSession !== callerWorkSession) return false;
+    if (rowWorkSession && !callerWorkSession) return false;
+
+    const changeSlug = text(row?.change_slug);
+    const owner = activeChangeOwners.get(changeSlug) || '';
+    if (owner && owner !== callerWorkSession) return false;
+    if (owner && !callerWorkSession) return false;
+    return true;
+  });
+}

package/hooks/evidence-context.mjs

@@ -1,21 +1,29 @@
 #!/usr/bin/env node
 // UserPromptSubmit: bounded, read-only retrieval from the local evidence index.
 import { pathToFileURL } from 'node:url';
-import { readHookInput, writeHookOutput } from './obsidian-common.mjs';
+import { readHookInput, readSessionRegistry, writeHookOutput } from './obsidian-common.mjs';
 import { loadEvidenceIndex, recallEvidence, renderEvidenceContext } from './evidence-recall.mjs';
 import { sanitizeMemoryText } from './memory-schema.mjs';
 import { resolveHookOperatingProfile } from './operating-profile-runtime.mjs';
+import {
+  resolveReadOnlyEvidenceActiveContext,
+  scopeEvidenceRows,
+} from './active-context-handoff-evidence.mjs';
 import { isBootstrapPrompt } from '../packages/integrations/src/prompt-content.mjs';
 
 export function buildPromptEvidenceContext(vaultBase, prompt, {
-  topK = 3, maxBytes = 3072, rows = null,
+  topK = 3, maxBytes = 3072, rows = null, activeContext = null, registry = null,
 } = {}) {
   const query = sanitizeMemoryText(String(prompt || '')).trim();
   if (!query || isBootstrapPrompt(query)) return '';
   const evidence = rows || loadEvidenceIndex(vaultBase);
-  if (!evidence.length) return '';
+  const scoped = scopeEvidenceRows(evidence, {
+    activeContext,
+    registry: registry || readSessionRegistry(vaultBase),
+  });
+  if (!scoped.length) return '';
   return sanitizeMemoryText(renderEvidenceContext(
-    recallEvidence(evidence, query, { topK }),
+    recallEvidence(scoped, query, { topK }),
     { maxBytes },
   ));
 }
@@ -23,13 +31,20 @@ export function buildPromptEvidenceContext(vaultBase, prompt, {
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
   try {
     const input = readHookInput();
-    const runtime = resolveHookOperatingProfile({ input });
+    const runtime = resolveHookOperatingProfile({
+      input,
+      activeContextResolver: resolveReadOnlyEvidenceActiveContext,
+    });
     if (runtime.bindingError) {
       writeHookOutput({});
     } else {
       const context = buildPromptEvidenceContext(
         runtime.vaultBase,
         input.prompt || input.user_prompt || '',
+        {
+          activeContext: runtime.activeContext,
+          registry: readSessionRegistry(runtime.vaultBase),
+        },
       );
       writeHookOutput(context ? {
         hookSpecificOutput: { hookEventName: 'UserPromptSubmit', additionalContext: context },

package/hooks/operating-profile-runtime.mjs

@@ -133,6 +133,7 @@ export function resolveHookOperatingProfile({
   resolution = null,
   config = null,
   provider,
+  activeContextResolver = resolveCommandActiveContext,
 } = {}) {
   const initialResolution = resolution || resolveProjectVault({ input });
   const matched = matchingProjectBinding(initialResolution, input);
@@ -158,7 +159,7 @@ export function resolveHookOperatingProfile({
   let contextError = null;
   if (!bindingError && identity.state === 'resolved') {
     try {
-      activeContext = resolveCommandActiveContext({
+      activeContext = activeContextResolver({
         vaultBase: vaultResolution.base,
         projectRoot: input?.cwd || vaultResolution.projectRoot || process.cwd(),
         sessionId: identity.canonicalConversationId,

package/hooks/session-stop.mjs

@@ -19,6 +19,11 @@ import { mutateSessionNote } from './session-note-io.mjs';
 import { appendIterationOutcome } from './session-iteration-outcome.mjs';
 import { applyDerivedSections, provenanceSessions } from './derived-sections.mjs';
 import { buildSessionMemoryEvents, collectLifecycleEvidence } from './memory-handoff.mjs';
+import {
+  buildCausalSharedHandoff,
+  causalChangeSlug,
+  resolveHandoffEvidenceAuthority,
+} from './active-context-handoff-evidence.mjs';
 import { enqueueMemoryEvent, projectMemoryOutbox } from './memory-store.mjs';
 import { detectMemoryMode } from './memory-mode.mjs';
 import { sanitizeMemoryText } from './memory-schema.mjs';
@@ -521,21 +526,6 @@ function shouldFinalizeSession() {
   return process.env.OBSIDIAN_NO_AUTO_FINALIZE !== '1';
 }
 
-function sharedHandoffFromInput(input = {}, entry = {}) {
-  const supplied = input.shared || input.handoff?.shared;
-  const shared = supplied && typeof supplied === 'object' && !Array.isArray(supplied)
-    ? { ...supplied }
-    : {};
-  const workSessionId = shared.work_session_id
-    || shared.workSessionId
-    || input.work_session_id
-    || input.workSessionId
-    || entry?.work_session_id
-    || '';
-  if (!shared.work_session_id && workSessionId) shared.work_session_id = workSessionId;
-  return Object.keys(shared).length ? shared : null;
-}
-
 export function commitSessionMemory(vaultBase, handoff, { projectOptions = {} } = {}) {
   if (detectMemoryMode(vaultBase).mode === 'legacy') {
     return { status: 'legacy', eventCount: 0, eventIds: [], checkpoint: null };
@@ -1277,6 +1267,29 @@ export async function main({
   const tx = parseTranscript(identity.transcriptPath || input.transcript_path || input.transcriptPath);
   const requestedTurnId = String(input.turn_id || input.turnId || '');
   const sessionId = identity.canonicalConversationId;
+  let handoffEvidenceAuthority;
+  let sharedHandoff;
+  let activeContextChangeSlug;
+  try {
+    handoffEvidenceAuthority = resolveHandoffEvidenceAuthority(vaultBase, {
+      input,
+      sessionId,
+      projectRoot: input.cwd || process.cwd(),
+    });
+    sharedHandoff = buildCausalSharedHandoff({
+      input,
+      entry,
+      authority: handoffEvidenceAuthority,
+    });
+    activeContextChangeSlug = causalChangeSlug(entry, handoffEvidenceAuthority);
+  } catch (error) {
+    const detail = String(error?.message || 'active context causal indisponível');
+    process.stderr.write(`[wendkeep] Stop causal bloqueado: ${detail}\n`);
+    writeHookOutput({
+      systemMessage: `wendkeep: Stop bloqueado antes de publicar handoff/evidência: ${detail}`,
+    });
+    return;
+  }
   const finalizing = shouldFinalizeSession();
   const turnIdentity = resolveTurnIdentity(tx, requestedTurnId);
   if (!turnIdentity) {
@@ -1389,11 +1402,10 @@ export async function main({
     }
     const finalSummary = sessionFinalSummary(tx);
     const memoryEvidence = collectLifecycleEvidence(vaultBase, {
-      changeSlug: entry.change_slug,
+      changeSlug: activeContextChangeSlug,
       summary: finalSummary,
       noteRel: sessionRel,
     });
-    const sharedHandoff = sharedHandoffFromInput(input, entry);
     memoryHandoff = {
       projectId,
       identity,
@@ -1531,9 +1543,11 @@ export async function main({
   // grafo quando a change fechava antes do turno seguinte. Aqui sobrevive ao reopen e acumula toda
   // change que passou pela sessão (upsertListSection deduplica). Fail-quiet: nunca derruba o Stop.
   try {
-    const chgLink = entry.change_slug
-      ? `Change ativa: [[${getLocale(vaultBase).folders.changes}/${entry.change_slug}/proposta]]`
-      : activeChangeLink(vaultBase);
+    const chgLink = activeContextChangeSlug
+      ? `Change ativa: [[${getLocale(vaultBase).folders.changes}/${activeContextChangeSlug}/proposta]]`
+      : handoffEvidenceAuthority.mode === 'legacy'
+        ? activeChangeLink(vaultBase)
+        : '';
     const wl = (chgLink.match(/\[\[[^\]]+\]\]/) || [])[0];
     if (wl) {
       mutateSessionNote(sessionPath, (cur) => (

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wendkeep",
-  "version": "0.76.6",
+  "version": "0.76.8",
   "description": "Vault-first persistent memory for AI coding agents, with an optional profile-aware governance runtime: OFF, FLOW, GUIDE, GOVERN, or ASSURE. Local-first and agent-agnostic (Claude Code, Codex, Cursor…).",
   "type": "module",
   "workspaces": [
@@ -41,8 +41,8 @@
     "node": ">=18"
   },
   "scripts": {
-    "precheck": "node --check src/worktree.mjs && node --check src/context.mjs && node --check packages/vault/src/worktree-metadata.mjs",
-    "check": "node --check scripts/release.mjs && node --check scripts/release-plan.mjs && node --check scripts/release-provenance.mjs && node --check scripts/run-scope.mjs && node --check src/release-provenance.mjs && node --check bin/wendkeep.mjs && node --check packages/cli/src/index.mjs && node --check src/init.mjs && node --check src/doctor.mjs && node --check src/project-vault.mjs && node --check src/observer-auth.mjs && node --check src/observer-privacy.mjs && node --check src/observer-snapshot.mjs && node --check src/observer-store.mjs && node --check src/observer-memory.mjs && node --check src/observer-memory-publish.mjs && node --check src/observer-sql-store.mjs && node --check src/observer-sql-migrate.mjs && node --check src/observer-sql-publish.mjs && node --check src/observer-transcript-store.mjs && node --check src/observer-server.mjs && node --check src/observer.mjs && node --check src/observer-publish.mjs && node --check src/operating-profile.mjs && node --check src/profile.mjs && node --check src/flow.mjs && node --check src/work-kind.mjs && node --check src/delivery.mjs && node --check web/observer/app.mjs && node --check hooks/observer-publish.mjs && node --check hooks/evidence-context.mjs && node --check hooks/evidence-recall.mjs && node --check hooks/memory-scope.mjs && node --check hooks/operating-profile-runtime.mjs && node --check hooks/operating-profile-task-store.mjs && node --check hooks/flow-core.mjs && node --check hooks/flow-protected-policy.mjs && node --check hooks/git-snapshot.mjs && node --check hooks/vault-path-safety.mjs && node --check hooks/vault-runtime-store.mjs && node --check packages/harness/src/index.mjs && node --check packages/harness/src/flow-store.mjs && node --check packages/harness/src/operating-profile.mjs && node --check packages/harness/src/sensors-core.mjs && node --check packages/integrations/src/host-hooks.mjs && node --check packages/integrations/src/hook-envelope.mjs && node --check packages/integrations/src/prompt-content.mjs && node --check packages/integrations/src/transcript-usage.mjs && node --check packages/integrations/src/transcripts.mjs && node --check packages/integrations/src/session-identity.mjs && node --check packages/integrations/src/index.mjs && node --check packages/mcp/src/config.mjs && node --check packages/mcp/src/index.mjs && node --check packages/vault/src/index.mjs && node --check packages/vault/src/project-vault.mjs && node --check packages/vault/src/vault-path-safety.mjs && node --check packages/vault/src/locale.mjs && node --check packages/vault/src/memory-schema.mjs && node --check packages/vault/src/memory-mode.mjs && node --check packages/vault/src/memory-scope.mjs && node --check packages/vault/src/memory-candidate-policy.mjs && node --check packages/vault/src/evidence-recall.mjs && node --check packages/vault/src/memory-handoff.mjs && node --check packages/vault/src/memory-store.mjs && node --check packages/vault/src/validate-core.mjs && node --check packages/vault/src/validate-memory.mjs",
+    "precheck": "node --check src/worktree.mjs && node --check src/context.mjs && node --check src/active-context-health.mjs && node --check packages/vault/src/worktree-metadata.mjs",
+    "check": "node --check scripts/release.mjs && node --check scripts/release-plan.mjs && node --check scripts/release-provenance.mjs && node --check scripts/run-scope.mjs && node --check src/release-provenance.mjs && node --check bin/wendkeep.mjs && node --check packages/cli/src/index.mjs && node --check src/init.mjs && node --check src/doctor.mjs && node --check src/active-context-health.mjs && node --check src/project-vault.mjs && node --check src/observer-auth.mjs && node --check src/observer-privacy.mjs && node --check src/observer-snapshot.mjs && node --check src/observer-store.mjs && node --check src/observer-memory.mjs && node --check src/observer-memory-publish.mjs && node --check src/observer-sql-store.mjs && node --check src/observer-sql-migrate.mjs && node --check src/observer-sql-publish.mjs && node --check src/observer-transcript-store.mjs && node --check src/observer-server.mjs && node --check src/observer.mjs && node --check src/observer-publish.mjs && node --check src/operating-profile.mjs && node --check src/profile.mjs && node --check src/flow.mjs && node --check src/work-kind.mjs && node --check src/delivery.mjs && node --check web/observer/app.mjs && node --check hooks/observer-publish.mjs && node --check hooks/evidence-context.mjs && node --check hooks/active-context-handoff-evidence.mjs && node --check hooks/evidence-recall.mjs && node --check hooks/memory-scope.mjs && node --check hooks/operating-profile-runtime.mjs && node --check hooks/operating-profile-task-store.mjs && node --check hooks/flow-core.mjs && node --check hooks/flow-protected-policy.mjs && node --check hooks/git-snapshot.mjs && node --check hooks/vault-path-safety.mjs && node --check hooks/vault-runtime-store.mjs && node --check packages/harness/src/index.mjs && node --check packages/harness/src/flow-store.mjs && node --check packages/harness/src/operating-profile.mjs && node --check packages/harness/src/sensors-core.mjs && node --check packages/integrations/src/host-hooks.mjs && node --check packages/integrations/src/hook-envelope.mjs && node --check packages/integrations/src/prompt-content.mjs && node --check packages/integrations/src/transcript-usage.mjs && node --check packages/integrations/src/transcripts.mjs && node --check packages/integrations/src/session-identity.mjs && node --check packages/integrations/src/index.mjs && node --check packages/mcp/src/config.mjs && node --check packages/mcp/src/index.mjs && node --check packages/vault/src/index.mjs && node --check packages/vault/src/project-vault.mjs && node --check packages/vault/src/vault-path-safety.mjs && node --check packages/vault/src/locale.mjs && node --check packages/vault/src/memory-schema.mjs && node --check packages/vault/src/memory-mode.mjs && node --check packages/vault/src/memory-scope.mjs && node --check packages/vault/src/memory-candidate-policy.mjs && node --check packages/vault/src/evidence-recall.mjs && node --check packages/vault/src/memory-handoff.mjs && node --check packages/vault/src/memory-store.mjs && node --check packages/vault/src/validate-core.mjs && node --check packages/vault/src/validate-memory.mjs",
     "test": "node --test --test-concurrency=2",
     "test:core": "node scripts/run-scope.mjs core",
     "release": "node scripts/release.mjs",

package/packages/cli/src/index.mjs

@@ -61,7 +61,9 @@ Usage:
                            Switch Git branch and the causal session scope in the same worktree.
   wendkeep context status --session <id> [--json]
   wendkeep context recover --session <id> --select reserved|observed --revision <n> --reason <text> [--json]
+  wendkeep context repair --key <repository:worktree:work-session> --revision <n> --reason <text> --session <id> [--json]
                            Inspect or explicitly recover a quarantined causal scope conflict.
+                           Repair revalidates orphan/removed contexts or expired request leases without deleting history.
   wendkeep change <sub>        Change lifecycle: new [--simple|--guide] | use | bind <slug> --session <id> | continue | list | show |
                            status | done <id> | undone <id> | diff | archive [--force] | abandon | relink | backlink.
                            --session <id> selects the causal active_context for implicit change operations.

package/src/active-context-health.mjs

@@ -0,0 +1,355 @@
+import { spawnSync } from 'node:child_process';
+
+import {
+  mutateSessionRegistry,
+  readSessionRegistry,
+} from '../hooks/obsidian-common.mjs';
+import {
+  projectLegacyActiveChange,
+  projectLegacyActiveDelivery,
+} from '../hooks/active-context-store.mjs';
+import {
+  discoverWorktreeRepository,
+  readWorktreeRegistry,
+  worktreeIdentity,
+} from '../packages/vault/src/worktree-metadata.mjs';
+import { sanitizeMemoryText } from '../packages/vault/src/memory-schema.mjs';
+
+export const ACTIVE_CONTEXT_DIAGNOSTICS = Object.freeze({
+  SESSION_ORPHAN: 'WENDKEEP_ACTIVE_CONTEXT_SESSION_ORPHAN',
+  WORKTREE_REMOVED: 'WENDKEEP_ACTIVE_CONTEXT_WORKTREE_REMOVED',
+  LEASE_EXPIRED: 'WENDKEEP_ACTIVE_CONTEXT_LEASE_EXPIRED',
+  TOPOLOGY_UNPROVEN: 'WENDKEEP_ACTIVE_CONTEXT_TOPOLOGY_UNPROVEN',
+  IDENTITY_MISMATCH: 'WENDKEEP_ACTIVE_CONTEXT_IDENTITY_MISMATCH',
+});
+
+const ACTIONABLE_CODES = new Set([
+  ACTIVE_CONTEXT_DIAGNOSTICS.SESSION_ORPHAN,
+  ACTIVE_CONTEXT_DIAGNOSTICS.WORKTREE_REMOVED,
+  ACTIVE_CONTEXT_DIAGNOSTICS.LEASE_EXPIRED,
+]);
+
+function healthError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function contextualRegistryInitialized(registry) {
+  return Boolean(registry && (
+    Object.hasOwn(registry, 'active_contexts')
+    || Object.hasOwn(registry, 'active_contexts_schema')
+    || Object.hasOwn(registry, 'active_contexts_revision')
+  ));
+}
+
+function contextsOf(registry) {
+  return registry?.active_contexts && typeof registry.active_contexts === 'object'
+    && !Array.isArray(registry.active_contexts)
+    ? registry.active_contexts : {};
+}
+
+function nonNegativeInteger(value, fallback = 0) {
+  const parsed = Number(value);
+  return Number.isSafeInteger(parsed) && parsed >= 0 ? parsed : fallback;
+}
+
+function activeOwnerSessions(registry, context) {
+  return Object.entries(registry.sessions || {}).filter(([, entry]) => (
+    entry?.status === 'active'
+    && entry?.project_scope?.complete === true
+    && String(entry.project_scope.projectId || '') === String(context.project_id || '')
+    && String(entry.work_session_id || '') === String(context.work_session_id || '')
+  ));
+}
+
+function leaseExpired(registry, lease, context) {
+  if (!lease || lease.state !== 'active' || lease.expires_on !== 'request-stop') return false;
+  const owner = registry.sessions?.[String(lease.session_id || '')];
+  if (!owner || owner.status !== 'active'
+    || owner?.project_scope?.complete !== true
+    || String(owner.project_scope.projectId || '') !== String(context.project_id || '')) return true;
+  const requestedSequence = nonNegativeInteger(lease.request_turn_sequence, -1);
+  const stoppedSequence = nonNegativeInteger(owner.last_stop_turn_sequence, -1);
+  if (requestedSequence >= 0 && stoppedSequence >= requestedSequence) return true;
+  const requestedTurn = String(lease.request_turn_id || '');
+  return Boolean(requestedTurn && requestedTurn === String(owner.last_stop_turn_id || ''));
+}
+
+function issue(code, key, context, message, repairable = true) {
+  return {
+    code,
+    key,
+    revision: nonNegativeInteger(context?.revision),
+    repairable,
+    message,
+  };
+}
+
+export function inspectActiveContextTopology({
+  projectRoot = process.cwd(),
+  spawn = spawnSync,
+} = {}) {
+  try {
+    const repository = discoverWorktreeRepository({ startDir: projectRoot, spawn });
+    const metadata = readWorktreeRegistry(repository).registry;
+    if (!metadata) {
+      return {
+        proven: false,
+        errorCode: 'WENDKEEP_WORKTREE_REGISTRY_MISSING',
+        message: 'registry de worktrees ausente',
+      };
+    }
+    const ids = [];
+    for (const worktree of repository.worktrees) {
+      const discovered = discoverWorktreeRepository({ startDir: worktree.path, spawn });
+      if (discovered.commonDir !== repository.commonDir) {
+        throw healthError('WENDKEEP_WORKTREE_IDENTITY_MISMATCH', 'worktree pertence a outro Git common dir');
+      }
+      ids.push(worktreeIdentity(metadata.repositoryId, discovered.gitDir));
+    }
+    return {
+      proven: true,
+      projectId: metadata.projectId,
+      repositoryId: metadata.repositoryId,
+      worktreeIds: [...new Set(ids)].sort(),
+    };
+  } catch (error) {
+    return {
+      proven: false,
+      errorCode: error?.code || 'WENDKEEP_ACTIVE_CONTEXT_TOPOLOGY_FAILED',
+      message: String(error?.message || error),
+    };
+  }
+}
+
+export function diagnoseActiveContexts({ registry = {}, topology = {} } = {}) {
+  const initialized = contextualRegistryInitialized(registry);
+  if (!initialized) {
+    return { initialized: false, contexts: 0, healthy: 0, topology_proven: false, issues: [] };
+  }
+
+  const active = Object.entries(contextsOf(registry)).filter(([, context]) => context?.state === 'active');
+  const issues = [];
+  let healthy = 0;
+  for (const [key, context] of active) {
+    const contextIssues = [];
+    if (!activeOwnerSessions(registry, context).length) {
+      contextIssues.push(issue(
+        ACTIVE_CONTEXT_DIAGNOSTICS.SESSION_ORPHAN,
+        key,
+        context,
+        'nenhuma sessão ativa possui a work_session_id do contexto',
+      ));
+    }
+
+    if (!topology?.proven) {
+      contextIssues.push(issue(
+        ACTIVE_CONTEXT_DIAGNOSTICS.TOPOLOGY_UNPROVEN,
+        key,
+        context,
+        `topologia Git não provada${topology?.errorCode ? ` (${topology.errorCode})` : ''}`,
+        false,
+      ));
+    } else if (context.project_id !== topology.projectId || context.repository_id !== topology.repositoryId) {
+      contextIssues.push(issue(
+        ACTIVE_CONTEXT_DIAGNOSTICS.IDENTITY_MISMATCH,
+        key,
+        context,
+        'contexto não pertence ao projeto/repositório provado pelo checkout',
+        false,
+      ));
+    } else if (!(topology.worktreeIds || []).includes(context.worktree_id)) {
+      contextIssues.push(issue(
+        ACTIVE_CONTEXT_DIAGNOSTICS.WORKTREE_REMOVED,
+        key,
+        context,
+        'worktree_id não existe na topologia Git atual',
+      ));
+    }
+
+    if (leaseExpired(registry, context.operating_profile_task, context)) {
+      contextIssues.push(issue(
+        ACTIVE_CONTEXT_DIAGNOSTICS.LEASE_EXPIRED,
+        key,
+        context,
+        'lease request-stop permaneceu ativa depois do término de sua requisição',
+      ));
+    }
+    if (!contextIssues.length) healthy += 1;
+    issues.push(...contextIssues);
+  }
+  return {
+    initialized: true,
+    contexts: active.length,
+    healthy,
+    topology_proven: topology?.proven === true,
+    issues,
+  };
+}
+
+export function inspectActiveContextHealth({
+  vaultBase,
+  projectRoot = process.cwd(),
+  spawn = spawnSync,
+} = {}) {
+  const registry = readSessionRegistry(vaultBase);
+  const topology = inspectActiveContextTopology({ projectRoot, spawn });
+  return diagnoseActiveContexts({ registry, topology });
+}
+
+export function renderActiveContextHealthLines(result) {
+  if (!result.initialized) return ['[active-contexts] legado — store contextual não inicializado'];
+  const repairable = result.issues.filter((item) => item.repairable).length;
+  const lines = [
+    `[active-contexts] ${result.contexts} ativo(s) · ${result.healthy} saudável(is) · ${result.issues.length} diagnóstico(s) · ${repairable} reparável(is)`,
+  ];
+  for (const item of result.issues) {
+    lines.push(`  ${item.repairable ? '→' : '!'} ${item.code}: ${item.key} @ revision ${item.revision} — ${item.message}`);
+    if (item.repairable) {
+      lines.push(`    wendkeep context repair --key "${item.key}" --revision ${item.revision} --reason "<motivo>" --session <id>`);
+    }
+  }
+  if (!result.issues.length) lines.push('  active contexts íntegros ✓');
+  return lines;
+}
+
+function requiredKey(value) {
+  const key = String(value || '').trim();
+  if (!/^[A-Za-z0-9._-]+:[A-Za-z0-9._-]+:[A-Za-z0-9._-]+$/.test(key) || key.length > 482) {
+    throw healthError('WENDKEEP_CONTEXT_ARGS', 'repair requer --key <repository:worktree:work-session>');
+  }
+  return key;
+}
+
+function requiredRevision(value) {
+  const raw = String(value ?? '').trim();
+  const parsed = Number(raw);
+  if (!/^\d+$/.test(raw) || !Number.isSafeInteger(parsed)) {
+    throw healthError('WENDKEEP_CONTEXT_ARGS', 'repair requer --revision <inteiro não negativo>');
+  }
+  return parsed;
+}
+
+function requiredReason(value) {
+  const reason = sanitizeMemoryText(String(value || ''))
+    .replace(/[\u0000-\u001f\u007f]+/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim();
+  if (!reason) throw healthError('WENDKEEP_CONTEXT_ARGS', 'repair requer --reason <texto>');
+  if (reason.length > 240) throw healthError('WENDKEEP_CONTEXT_ARGS', '--reason excede 240 caracteres');
+  return reason;
+}
+
+function globalRevision(registry) {
+  return nonNegativeInteger(registry.active_contexts_revision);
+}
+
+export function repairActiveContext({
+  vaultBase,
+  projectRoot = process.cwd(),
+  key,
+  revision,
+  reason,
+  actorSessionId,
+  spawn = spawnSync,
+  topologyProvider = (options) => inspectActiveContextTopology(options),
+  mutateRegistry = mutateSessionRegistry,
+  projectChange = projectLegacyActiveChange,
+  projectDelivery = projectLegacyActiveDelivery,
+  now = () => new Date(),
+} = {}) {
+  const targetKey = requiredKey(key);
+  const expectedRevision = requiredRevision(revision);
+  const safeReason = requiredReason(reason);
+  const actorId = String(actorSessionId || '').trim();
+  if (!actorId) throw healthError('WENDKEEP_CONTEXT_SESSION', 'repair requer --session <id>');
+
+  const result = mutateRegistry(vaultBase, (registry) => {
+    if (!contextualRegistryInitialized(registry)) {
+      throw healthError('WENDKEEP_ACTIVE_CONTEXT_NOT_INITIALIZED', 'store contextual não inicializado');
+    }
+    const actor = registry.sessions?.[actorId];
+    if (!actor || actor.status !== 'active') {
+      throw healthError('WENDKEEP_CONTEXT_SESSION', `sessão ator ativa não encontrada: ${actorId}`);
+    }
+    const current = contextsOf(registry)[targetKey];
+    if (!current || current.state !== 'active') {
+      throw healthError('WENDKEEP_ACTIVE_CONTEXT_NOT_FOUND', `active context não encontrado: ${targetKey}`);
+    }
+    if (actor?.project_scope?.complete !== true
+      || String(actor.project_scope.projectId || '') !== String(current.project_id || '')) {
+      throw healthError(
+        'WENDKEEP_ACTIVE_CONTEXT_ACTOR_MISMATCH',
+        'sessão ator não pertence ao projeto do active context',
+      );
+    }
+    const currentRevision = nonNegativeInteger(current.revision);
+    if (currentRevision !== expectedRevision) {
+      throw healthError(
+        'WENDKEEP_ACTIVE_CONTEXT_CAS_MISMATCH',
+        `active context revision mudou de ${expectedRevision} para ${currentRevision}`,
+      );
+    }
+    const topology = topologyProvider({ projectRoot, spawn, registry: structuredClone(registry) });
+    const diagnosis = diagnoseActiveContexts({ registry, topology });
+    const targetIssues = diagnosis.issues.filter((item) => item.key === targetKey);
+    if (targetIssues.some((item) => item.code === ACTIVE_CONTEXT_DIAGNOSTICS.TOPOLOGY_UNPROVEN)) {
+      throw healthError('WENDKEEP_ACTIVE_CONTEXT_TOPOLOGY_UNPROVEN', 'topologia Git não pôde ser revalidada');
+    }
+    if (targetIssues.some((item) => !item.repairable)) {
+      throw healthError('WENDKEEP_ACTIVE_CONTEXT_IDENTITY_MISMATCH', 'identidade do contexto não corresponde ao checkout provado');
+    }
+    const actionable = targetIssues.filter((item) => ACTIONABLE_CODES.has(item.code));
+    if (!actionable.length) {
+      throw healthError('WENDKEEP_ACTIVE_CONTEXT_HEALTHY', 'active context não possui condição reparável vigente');
+    }
+
+    const codes = [...new Set(actionable.map((item) => item.code))].sort();
+    const closeContext = codes.includes(ACTIVE_CONTEXT_DIAGNOSTICS.SESSION_ORPHAN)
+      || codes.includes(ACTIVE_CONTEXT_DIAGNOSTICS.WORKTREE_REMOVED);
+    const at = now().toISOString();
+    const lease = current.operating_profile_task;
+    const expireLease = codes.includes(ACTIVE_CONTEXT_DIAGNOSTICS.LEASE_EXPIRED)
+      && lease?.state === 'active';
+    const next = {
+      ...current,
+      ...(expireLease ? {
+        operating_profile_task: { ...lease, state: 'expired', expired_at: at },
+      } : {}),
+      ...(closeContext ? { state: 'closed', closed_at: at } : {}),
+      revision: currentRevision + 1,
+      updated_at: at,
+    };
+    const effect = closeContext ? 'context-closed' : 'lease-expired';
+    const receipt = {
+      operation: 'repair',
+      key: targetKey,
+      from_revision: currentRevision,
+      to_revision: next.revision,
+      diagnostics: codes,
+      effect,
+      actor: { session_id: actorId, provider: String(actor.provider || '') },
+      reason: safeReason,
+      at,
+    };
+    registry.active_contexts = { ...contextsOf(registry), [targetKey]: next };
+    registry.active_contexts_schema = nonNegativeInteger(registry.active_contexts_schema, 1) || 1;
+    registry.active_contexts_revision = globalRevision(registry) + 1;
+    registry.active_context_repairs = [
+      ...(Array.isArray(registry.active_context_repairs) ? registry.active_context_repairs : []),
+      receipt,
+    ];
+    return {
+      status: 'repaired',
+      key: targetKey,
+      revision: next.revision,
+      effect,
+      diagnostics: codes,
+      receipt,
+    };
+  });
+  projectChange(vaultBase);
+  projectDelivery(vaultBase);
+  return result;
+}

package/src/context.mjs

@@ -12,6 +12,7 @@ import {
 } from '../hooks/project-scope.mjs';
 import { readVaultMarker } from './project-vault.mjs';
 import { sanitizeMemoryText } from '../packages/vault/src/memory-schema.mjs';
+import { repairActiveContext } from './active-context-health.mjs';
 
 export const CONTEXT_HELP = `wendkeep context <subcommand>
 
@@ -19,14 +20,17 @@ export const CONTEXT_HELP = `wendkeep context <subcommand>
   status --session <id> [--project <path>] [--vault <path>] [--json]
   recover --session <id> --select <reserved|observed> --revision <n> --reason <text>
     [--project <path>] [--vault <path>] [--json]
+  repair --key <repository:worktree:work-session> --revision <n> --reason <text> --session <id>
+    [--project <path>] [--vault <path>] [--json]
 
 Switches Git branch and the causal session scope together inside the same worktree.
 Without --session, exactly one active session must match the current scope.
 Status inventories reserved/observed recovery candidates without selecting one.
 Recover resolves a quarantined conflict only when the selected candidate still matches the checkout.
+Repair revalidates an orphan/removed context or expired request lease under CAS; it never deletes history.
 `;
 
-const VALUE_OPTIONS = new Set(['--project', '--vault', '--session', '--select', '--revision', '--reason']);
+const VALUE_OPTIONS = new Set(['--project', '--vault', '--session', '--select', '--revision', '--reason', '--key']);
 const FLAG_OPTIONS = new Set(['--create', '--json']);
 
 function contextError(code, message) {
@@ -525,6 +529,9 @@ function output(result, json) {
   else if (result.status === 'recovered') {
     process.stdout.write(`context recovered: ${result.selected} selected (session ${result.session_id}; revision ${result.revision})\n`);
   }
+  else if (result.status === 'repaired') {
+    process.stdout.write(`context repaired: ${result.key} (${result.effect}; revision ${result.revision})\n`);
+  }
   else process.stdout.write(`context ${result.status}: ${result.branch} (session ${result.session_id}; revision ${result.revision})\n`);
 }
 
@@ -553,6 +560,18 @@ export function runContext(argv = []) {
       output(result, argv.includes('--json'));
       return 0;
     }
+    if (sub === 'repair' && !branch && !extra.length) {
+      const result = repairActiveContext({
+        vaultBase: vaultOf(argv),
+        projectRoot: projectOf(argv),
+        key: optionValue(argv, '--key'),
+        revision: optionValue(argv, '--revision'),
+        reason: optionValue(argv, '--reason'),
+        actorSessionId: optionValue(argv, '--session'),
+      });
+      output(result, argv.includes('--json'));
+      return 0;
+    }
     if (sub !== 'switch' || !branch || extra.length) {
       throw contextError('WENDKEEP_CONTEXT_ARGS', 'use: wendkeep context switch <branch> [--create] [--session <id>]');
     }

package/src/doctor.mjs

@@ -7,6 +7,10 @@ import { runVaultHealth } from '../hooks/vault-health.mjs';
 import { checkSyncDefs } from './sync-defs.mjs';
 import { resolveProjectVault } from './project-vault.mjs';
 import { inspectObserverSqlOutbox } from './observer-sql-publish.mjs';
+import {
+  inspectActiveContextHealth,
+  renderActiveContextHealthLines,
+} from './active-context-health.mjs';
 
 const healthStatusLabel = (status) => ({
   healthy: 'saudável', warning: 'atenção', degraded: 'degradada', blocked: 'bloqueada', legacy: 'legado',
@@ -140,6 +144,9 @@ export function runDoctor(argv) {
     process.stdout.write(`  → ${issue.slug}: ${issue.errorCode} — ${issue.repair}\n`);
   }
 
+  const activeContexts = inspectActiveContextHealth({ vaultBase, projectRoot });
+  process.stdout.write(`\n${renderActiveContextHealthLines(activeContexts).join('\n')}\n`);
+
   // 3. Link/graph health — órfãos que o grafo do Obsidian mostraria, com o comando de reparo.
   const links = checkVaultLinks(vaultBase);
   const graphLabel = links.graphColors === true ? 'com cores' : links.graphColors === false ? 'sem cores' : 'sem graph.json';
@@ -189,6 +196,7 @@ export function runDoctor(argv) {
     || repairable.length
     || warnings.length
     || worktrees.issues.length
+    || activeContexts.issues.length
     || links.derivedOrphans
     || links.artifactOrphans
     || links.graphColors === false