Merge branch 'feat/deprecate-safety-critical'

chore(release): prepare v1.5.1
fix(retention): add UTC calendar-day diversity gate to reinforceMemory
2026-07-17 12:56:42 +02:00 · 2026-04-30 19:54:50 +08:00 · 2026-04-30 19:54:24 +08:00 · 2026-04-30 18:38:29 +08:00 · 2026-04-30 18:06:28 +08:00 · 2026-04-30 17:54:13 +08:00
21 changed files with 2855 additions and 376 deletions
@@ -5,13 +5,27 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

+## [1.5.1] - 2026-04-30
+
+### Added
+
+- Per-workspace evidence log for extraction, promotion, reinforcement, render, storage, and hook lifecycle events.
+- `memory-diag health --json` for machine-readable diagnostics.
+- `memory-diag explain` for per-memory render status, strength, reasons, and evidence event IDs.
+- `memory-diag trace --memory <id>` for memory lifecycle history.
+- UTC calendar-day reinforcement gate so repeated matches cannot inflate a memory multiple times in the same day.
+
+### Changed
+
+- Retention constants and calculations moved to `src/retention.ts`.
+- `safetyCritical` is now fully inert: no retention multiplier and no type-cap bypass, while remaining JSON-compatible.
+
 ## [1.5.0] - 2026-04-29

 ### Added

 - Strength-based workspace memory retention using exponential decay instead of additive priority scoring.
 - Per-type rendered caps for workspace memory candidates: feedback 10, decision 10, project 8, and reference 6.
- Safety-critical memory weighting and type-cap exemption so important entries survive type floods while still competing under the global rendered cap.
 - Dormant-workspace effective age: after 14 days without activity, additional dormant time counts at 0.25x for retention decay.
 - Reinforcement tracking for repeated memories, with same-session and one-hour guards to prevent accidental reinforcement spam.
 - Memory health diagnostics for stored vs rendered counts, type caps, global cap overflow, dormancy, retention monitoring, and strength-ranked top/weakest entries.
@@ -21,6 +35,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

 - Workspace memory rendering now ranks entries by retention strength, not the previous priority/penalty model.
 - Confidence is retained for compatibility but no longer affects retention scoring.
+- Deprecated `safetyCritical` is retained for JSON compatibility but no longer affects retention strength or type-cap behavior.
 - Old or stale-marked memories are no longer hard-pruned; they remain stored and only fall out of rendered context through strength and cap competition.
 - Existing duplicate promotion and dedupe paths now reinforce the surviving memory instead of only absorbing the duplicate.
 - Health output now separates stored active memories from rendered candidates to make cap behavior easier to understand.
@@ -1,12 +1,47 @@
 # Release Notes

+## 1.5.1 (2026-04-30)
+
+### Evidence Loop and Explainability
+
+This release adds an evidence-based audit trail for memory lifecycle events and user-facing diagnostics for understanding why memories are rendered, promoted, or rejected.
+
+> **Evidence before sublimation.** Every memory decision can be traced.
+
+### What Changed
+
+- **Evidence log**: extraction, promotion, reinforcement, render, and storage events are now recorded in a per-workspace `events.jsonl` with 90-day retention and 5000-event cap.
+- **User explainability**: `memory-diag explain` shows per-memory render status with strength, reasons, and evidence. `memory-diag trace --memory <id>` shows the full lifecycle history.
+- **Machine-readable diagnostics**: `memory-diag health --json` outputs structured `MemoryDiagJSON` for scripting.
+- **Calendar-day reinforcement gate**: reinforcement now requires distinct UTC calendar days, preventing repetitive-task gaming that could inflate a memory's strength within a single day.
+- **SafetyCritical deprecation complete**: the `safetyCritical` field no longer affects retention strength or type-cap bypass. All memories fade by the same rules.
+- **Retention module extraction**: retention constants and calculations moved to `src/retention.ts` for cleaner separation.
+
+### Privacy
+
+- Evidence text previews are credential-redacted. Memory content is stored as truncated hashes, never in full.
+- Diagnostics default to redacted output. `--raw` is available for maintainers.
+
+### Upgrade Notes
+
+- No configuration changes required.
+- Existing workspace memory files remain compatible.
+- Evidence logs are created automatically; no migration needed.
+
+### Validation
+
+- `npm run typecheck`
+- `npm test` — 271 tests passing
+
+---
+
 ## 1.5.0 (2026-04-29)

 ### Retention Decay Model

 This release changes workspace memory retention from hard stale pruning and additive priority scoring to a strength-based decay model.

-Think of it like a forgetting curve: memories fade over time, but important, reinforced, and safety-critical memories decay slower. Weak entries fall out of rendered prompt context by cap competition, not hard deletion.
+Think of it like a forgetting curve: memories fade over time, but important and reinforced memories decay slower. Weak entries fall out of rendered prompt context by cap competition, not hard deletion.

 > **Memory should fade, so the agent can keep learning.**
 > Important memories decay slower, but every memory must leave room for newer project reality and avoid long-term memory pollution.
@@ -27,10 +62,10 @@ Think of it like a forgetting curve: memories fade over time, but important, rei
 ### What Changed

 - **Strength-based retention**: workspace memory now uses exponential decay: initial strength × age decay.
- **Better initial strength**: type, source, user importance, and safety-critical status now determine how strong a memory starts.
+- **Better initial strength**: type, source, and user importance now determine how strong a memory starts.
 - **No confidence scoring**: confidence remains in stored data for compatibility, but it no longer affects retention ranking.
 - **Type caps**: rendered workspace memory now caps feedback, decisions, project facts, and references separately so one type cannot monopolize all 28 slots.
- **Safety-critical protection**: safety-critical entries get stronger retention and are exempt from per-type caps, while still competing under the global rendered cap.
+- **Deprecation:** `safetyCritical` field no longer affects retention strength or type-cap bypass. All system memories now fade according to the same rules. Safety rules belong in user-controlled `agent.md` files, not in system memory.
 - **Dormant-aware age**: after 14 inactive days, additional dormant workspace time counts at 0.25x so paused projects do not forget too aggressively.
 - **Reinforcement**: repeated matching memories reinforce the survivor and slow future decay, with same-session and one-hour guards to avoid accidental spam.
 - **No hard stale pruning**: old or stale-marked memories are no longer automatically dropped by age; they lose rendered space only through cap competition.
@@ -96,7 +131,7 @@ Retention monitoring:
 ### Validation

 - `npm run typecheck`
- `npm test` — 237 tests passing
+- `npm test` — 242 tests passing
 - `bun scripts/memory-diag.ts health`

 ---
@@ -109,14 +109,14 @@ Retention then decides which active memories are rendered into prompt context. I
 strength = initialStrength * 2 ** (-effectiveAgeDays / effectiveHalfLifeDays)
 ```

-Initial strength is based on memory type, source, optional user importance, and safety-critical status. Confidence remains stored for compatibility but is not part of retention scoring.
+Initial strength is based on memory type, source, and optional user importance. Confidence remains stored for compatibility but is not part of retention scoring.

 Rendered candidates are selected in this order:

 1. Exclude `status: "superseded"` entries.
 2. Compute current retention strength.
 3. Sort by strength descending.
-4. Apply per-type caps, with safety-critical entries exempt from type caps.
+4. Apply per-type caps.
 5. Keep the top 28 rendered entries under the workspace memory character budget.

 Default type caps:
@@ -132,6 +132,10 @@ The type-cap total is 34, intentionally above the global 28-entry cap. These are

 Dormant workspaces age more slowly: after 14 inactive days, additional dormant time counts at 0.25x for retention decay. Repeated duplicate memories reinforce the surviving entry and slow future decay, but same-session and under-one-hour repeats do not stack reinforcement.

+### Safety-Critical Deprecation
+
+The `safetyCritical` field on `LongTermMemoryEntry` is deprecated as of the retention v1.5.1 model update. It no longer affects retention strength or type-cap bypass. The field is preserved in the type definition for backward compatibility with existing workspace memory JSON files, but has no active behavior. Safety rules should be maintained in user-controlled files such as `agent.md` rather than in system memory.
+
 ### System Prompt Injection

 Workspace memory is injected at the top of every message:
@@ -343,6 +347,10 @@ canonical("Use npm cache for plugins") === "use npm cache for plugins"
 const workspaceKey = sha256(realpath(workspaceRoot)).slice(0, 16)
 ```

+### Storage Safety
+
+All read-modify-write updates go through `updateJSON()`, which combines an in-process promise queue with an on-disk `.lock` file. The lock file uses exclusive creation, heartbeat refreshes while held, stale-lock recovery after 30 seconds, and a 5 second wait timeout for live contention. Direct `readJSON()` is fallback-oriented and does not mutate data except when corrupt JSON is quarantined.
+
 ## Performance Considerations

 ### Memory Budgets
@@ -34,7 +34,7 @@ const WORKSPACE_DORMANT_AFTER_DAYS = 14;
 const DORMANT_DECAY_MULTIPLIER = 0.25;
 ```

-Initial strength uses type, source, user importance, and safety-critical factors. Confidence is stored for compatibility but is not used for retention scoring.
+Initial strength uses type, source, and user importance factors. Confidence is stored for compatibility but is not used for retention scoring.

 Rendered type caps prevent one type from filling all workspace memory slots:

@@ -45,7 +45,7 @@ Rendered type caps prevent one type from filling all workspace memory slots:
 | `project` | 8 |
 | `reference` | 6 |

-Safety-critical memories are exempt from type caps but still compete under the global `maxEntries` limit. Old or stale-marked memories are not hard-pruned by age; they lose rendered space through strength and cap competition.
+Old or stale-marked memories are not hard-pruned by age; they lose rendered space through strength and cap competition. The deprecated `safetyCritical` field is preserved for compatibility but no longer affects strength or type caps.

 ## Hot Session State Limits

@@ -1,6 +1,6 @@
 {
  "name": "opencode-working-memory",
-  "version": "1.5.0",
+  "version": "1.5.1",
  "description": "Three-layer memory architecture for OpenCode with workspace memory and hot session state",
  "type": "module",
  "main": "index.ts",
@@ -12,21 +12,79 @@ import { dataHome, extractionRejectionLogPath, migrationLogPath, workspaceKey, w
 import { assessMemoryQuality, HARD_QUALITY_REASONS } from "../src/memory-quality.ts";
 import { redactCredentials } from "../src/redaction.ts";
 import { scanWorkspaceResidues } from "../src/workspace-cleanup.ts";
-import { calculateRetentionStrength, renderWorkspaceMemory } from "../src/workspace-memory.ts";
+import { accountWorkspaceMemoryRender, renderWorkspaceMemory } from "../src/workspace-memory.ts";
+import {
+  DORMANT_DECAY_MULTIPLIER,
+  RETENTION_TYPE_MAX,
+  WORKSPACE_DORMANT_AFTER_DAYS,
+  calculateRetentionStrength,
+} from "../src/retention.ts";
 import type { LongTermMemoryEntry, LongTermSource, LongTermType, PendingMemoryJournalStore, WorkspaceMemoryStore } from "../src/types.ts";
 import { LONG_TERM_LIMITS, PROMOTION_RETRY_LIMITS } from "../src/types.ts";
+import {
+  queryEvidenceEvents,
+  summarizeMemoryEvidence,
+  traceMemoryLifecycle,
+  type EvidenceEventType,
+  type EvidenceEventV1,
+  type EvidenceOutcome,
+} from "../src/evidence-log.ts";

-type Command = "health" | "rejections" | "audit";
+export type MemoryRenderStatus =
+  | "rendered"
+  | "omitted_superseded"
+  | "omitted_type_cap"
+  | "omitted_global_cap"
+  | "omitted_char_budget"
+  | "omitted_absorbed_duplicate"
+  | "pending_retry"
+  | "pending_rejected_capacity"
+  | "quarantined_corrupt_store";
+
+export type MemoryDiagJSON = {
+  version: 1;
+  workspace: { rootHash: string; key: string };
+  generatedAt: string;
+  summary: {
+    storedActive: number;
+    rendered: number;
+    pending: number;
+    rejectedLast7Days: number;
+    corruptStoresQuarantinedLast30Days: number;
+  };
+  memories: Array<{
+    id: string;
+    type: "feedback" | "project" | "decision" | "reference";
+    source: "explicit" | "compaction" | "manual";
+    status: MemoryRenderStatus;
+    strength?: number;
+    reasonCodes: string[];
+    textPreview?: string;
+    evidenceEventIds: string[];
+  }>;
+  recentEvents: Array<{
+    eventId: string;
+    type: EvidenceEventType;
+    outcome: EvidenceOutcome;
+    createdAt: string;
+    memoryId?: string;
+    reasonCodes: string[];
+  }>;
+};
+
+type Command = "health" | "rejections" | "audit" | "explain" | "trace";
 type Origin = "explicit_trigger" | "compaction_candidate" | "manual" | "migration_check" | "unknown";

 type CliOptions = {
  raw: boolean;
+  json?: boolean;
  workspace?: string;
  all?: boolean;
  softOnly?: boolean;
  triggerOnly?: boolean;
  since?: string;
  migration?: string;
+  memory?: string;
 };

 type RejectionLogRecord = {
@@ -65,14 +123,6 @@ type MigrationLogRecord = {
 };

 const TYPES: LongTermType[] = ["feedback", "decision", "project", "reference"];
-const TYPE_MAX_FOR_DIAG: Record<LongTermType, number> = {
-  feedback: 10,
-  decision: 10,
-  project: 8,
-  reference: 6,
-};
-const WORKSPACE_DORMANT_AFTER_DAYS_FOR_DIAG = 14;
-const DORMANT_DECAY_MULTIPLIER_FOR_DIAG = 0.25;
 const SUSPICIOUS_REASONS = [
  "progress_snapshot",
  "active_file_snapshot",
@@ -91,7 +141,9 @@ const ALLOWED_ORIGINS = new Set<Origin>([

 function usage(): string {
  return `Usage:
-  bun scripts/memory-diag.ts health [--workspace <path>] [--all] [--raw]
+  bun scripts/memory-diag.ts health [--workspace <path>] [--all] [--raw] [--json]
+  bun scripts/memory-diag.ts explain [--workspace <path>] [--raw]
+  bun scripts/memory-diag.ts trace --memory <id> [--workspace <path>] [--raw]
  bun scripts/memory-diag.ts rejections [--soft-only] [--trigger-only] [--since 14d] [--raw]
  bun scripts/memory-diag.ts audit [--migration <id>] [--raw]
 `;
@@ -109,7 +161,7 @@ function parseArgs(argv: string[]): { command: Command; options: CliOptions } {
    console.log(usage());
    process.exit(0);
  }
-  if (command !== "health" && command !== "rejections" && command !== "audit") {
+  if (command !== "health" && command !== "rejections" && command !== "audit" && command !== "explain" && command !== "trace") {
    die(`Unknown subcommand: ${command}`);
  }

@@ -117,6 +169,7 @@ function parseArgs(argv: string[]): { command: Command; options: CliOptions } {
  for (let i = 0; i < rest.length; i += 1) {
    const arg = rest[i];
    if (arg === "--raw") options.raw = true;
+    else if (arg === "--json") options.json = true;
    else if (arg === "--all") options.all = true;
    else if (arg === "--soft-only") options.softOnly = true;
    else if (arg === "--trigger-only") options.triggerOnly = true;
@@ -132,6 +185,10 @@ function parseArgs(argv: string[]): { command: Command; options: CliOptions } {
      const value = rest[++i];
      if (!value) die("--migration requires an id");
      options.migration = value;
+    } else if (arg === "--memory") {
+      const value = rest[++i];
+      if (!value) die("--memory requires an id");
+      options.memory = value;
    } else {
      die(`Unknown option: ${arg}`);
    }
@@ -139,15 +196,25 @@ function parseArgs(argv: string[]): { command: Command; options: CliOptions } {

  if (command === "health") {
    if (options.all && options.workspace) die("Use either --all or --workspace, not both");
+    if (options.json && options.all) die("health --json does not support --all");
+  } else if (command === "explain" || command === "trace") {
+    if (options.all) die(`${command} does not accept --all`);
  } else {
    if (options.all || options.workspace) die(`${command} does not accept --all or --workspace`);
  }
+  if (command !== "health" && options.json) die(`${command} does not accept --json`);
  if (command !== "rejections" && (options.softOnly || options.triggerOnly || options.since)) {
    die(`${command} does not accept rejection filters`);
  }
  if (command !== "audit" && options.migration) {
    die(`${command} does not accept --migration`);
  }
+  if (command !== "trace" && options.memory) {
+    die(`${command} does not accept --memory`);
+  }
+  if (command === "trace" && !options.memory) {
+    die("--memory requires an id");
+  }

  return { command, options };
 }
@@ -279,15 +346,13 @@ function retentionCandidatesForDiag(store: WorkspaceMemoryStore): {
  const typeCounts: Partial<Record<LongTermType, number>> = {};

  for (const item of sorted) {
-    if (!isSafetyCriticalForDiag(item.entry)) {
-      const count = typeCounts[item.entry.type] ?? 0;
-      const max = TYPE_MAX_FOR_DIAG[item.entry.type] ?? Infinity;
-      if (count >= max) {
-        typeCapped.push(item);
-        continue;
-      }
-      typeCounts[item.entry.type] = count + 1;
+    const count = typeCounts[item.entry.type] ?? 0;
+    const max = RETENTION_TYPE_MAX[item.entry.type] ?? Infinity;
+    if (count >= max) {
+      typeCapped.push(item);
+      continue;
    }
+    typeCounts[item.entry.type] = count + 1;

    if (rendered.length < LONG_TERM_LIMITS.maxEntries) {
      rendered.push(item);
@@ -339,7 +404,186 @@ function normalizedJournal(journal: PendingMemoryJournalStore | null): PendingMe
  };
 }

+type WorkspaceDiagSnapshot = {
+  store: WorkspaceMemoryStore;
+  journal: PendingMemoryJournalStore;
+  retention: ReturnType<typeof retentionCandidatesForDiag>;
+  memories: MemoryDiagJSON["memories"];
+  recentEvents: MemoryDiagJSON["recentEvents"];
+  allEvents: EvidenceEventV1[];
+  summary: MemoryDiagJSON["summary"];
+};
+
+function uniqueStrings(values: string[]): string[] {
+  return [...new Set(values.filter(Boolean))];
+}
+
+function eventMemoryId(event: EvidenceEventV1): string | undefined {
+  return event.memory?.memoryId
+    ?? event.relations?.map(relation => relation.memory?.memoryId).find((id): id is string => Boolean(id));
+}
+
+function isWithinDays(iso: string, days: number): boolean {
+  const ms = new Date(iso).getTime();
+  return Number.isFinite(ms) && ms >= Date.now() - days * 86_400_000;
+}
+
+function renderStatusReason(status: MemoryRenderStatus, fallback?: string): string[] {
+  switch (status) {
+    case "rendered": return ["within_caps", "within_char_budget"];
+    case "omitted_superseded": return ["superseded"];
+    case "omitted_type_cap": return ["type_cap"];
+    case "omitted_global_cap": return ["global_cap"];
+    case "omitted_char_budget": return [fallback === "empty_render_budget" ? "empty_render_budget" : "char_budget"];
+    case "omitted_absorbed_duplicate": return ["absorbed_duplicate"];
+    case "pending_retry": return ["retryable_capacity_rejection"];
+    case "pending_rejected_capacity": return ["capacity_rejected", "max_attempts_reached"];
+    case "quarantined_corrupt_store": return ["invalid_json"];
+  }
+}
+
+function statusFromOmissionReason(reason: string | undefined): MemoryRenderStatus {
+  if (reason === "superseded") return "omitted_superseded";
+  if (reason === "type_cap") return "omitted_type_cap";
+  if (reason === "global_cap") return "omitted_global_cap";
+  return "omitted_char_budget";
+}
+
+function pendingStatus(entry: LongTermMemoryEntry): MemoryRenderStatus {
+  const attempts = entry.promotionAttempts ?? 0;
+  return attempts >= promotionLimit(entry.source) ? "pending_rejected_capacity" : "pending_retry";
+}
+
+function safeTextPreview(text: string): string {
+  return truncate(cleanText(text, false), 120);
+}
+
+async function buildWorkspaceDiagSnapshot(input: {
+  root: string;
+  key: string;
+  memoryPath: string;
+  pendingPath: string;
+}): Promise<WorkspaceDiagSnapshot> {
+  const rawStore = await readJSONFile<WorkspaceMemoryStore>(input.memoryPath);
+  const storeRoot = rawStore?.workspace?.root ?? input.root;
+  const storeKey = rawStore?.workspace?.key ?? input.key;
+  const store = normalizedStore(rawStore, storeRoot, storeKey);
+  const journal = normalizedJournal(await readJSONFile<PendingMemoryJournalStore>(input.pendingPath));
+  const retention = retentionCandidatesForDiag(store);
+  const renderAccounting = accountWorkspaceMemoryRender(store);
+  const renderedIds = new Set(renderAccounting.rendered.map(memory => memory.id));
+  const omittedById = new Map(renderAccounting.omitted.map(item => [item.memory.id, item.reason]));
+  const allEvents = await queryEvidenceEvents(input.root);
+  const recentEvidence = await queryEvidenceEvents(input.root, { newestFirst: true, limit: 50 });
+  const memoryRows: MemoryDiagJSON["memories"] = [];
+  const seenIds = new Set<string>();
+
+  for (const entry of store.entries) {
+    const omissionReason = omittedById.get(entry.id);
+    const status: MemoryRenderStatus = renderedIds.has(entry.id)
+      ? "rendered"
+      : statusFromOmissionReason(omissionReason ?? (entry.status === "superseded" ? "superseded" : undefined));
+    const summary = await summarizeMemoryEvidence(input.root, { memoryId: entry.id });
+    memoryRows.push({
+      id: entry.id,
+      type: entry.type,
+      source: entry.source,
+      status,
+      strength: calculateRetentionStrength(entry, Date.now(), store.lastActivityAt),
+      reasonCodes: uniqueStrings([...renderStatusReason(status, omissionReason), ...summary.reasonCodes]),
+      textPreview: safeTextPreview(entry.text),
+      evidenceEventIds: summary.eventIds,
+    });
+    seenIds.add(entry.id);
+  }
+
+  for (const entry of journal.entries) {
+    const status = pendingStatus(entry);
+    const summary = await summarizeMemoryEvidence(input.root, { memoryId: entry.id });
+    memoryRows.push({
+      id: entry.id,
+      type: entry.type,
+      source: entry.source,
+      status,
+      strength: calculateRetentionStrength(entry, Date.now(), store.lastActivityAt),
+      reasonCodes: uniqueStrings([...renderStatusReason(status), entry.lastPromotionFailureReason ?? "", ...summary.reasonCodes]),
+      textPreview: safeTextPreview(entry.text),
+      evidenceEventIds: summary.eventIds,
+    });
+    seenIds.add(entry.id);
+  }
+
+  for (const event of allEvents) {
+    if (event.outcome !== "absorbed") continue;
+    const memory = event.memory;
+    if (!memory?.memoryId || !memory.type || !memory.source || seenIds.has(memory.memoryId)) continue;
+    const summary = await summarizeMemoryEvidence(input.root, { memoryId: memory.memoryId });
+    memoryRows.push({
+      id: memory.memoryId,
+      type: memory.type,
+      source: memory.source,
+      status: "omitted_absorbed_duplicate",
+      reasonCodes: uniqueStrings([...renderStatusReason("omitted_absorbed_duplicate"), ...summary.reasonCodes]),
+      evidenceEventIds: summary.eventIds.length > 0 ? summary.eventIds : [event.eventId],
+    });
+    seenIds.add(memory.memoryId);
+  }
+
+  const recentEvents = recentEvidence.map(event => ({
+    eventId: event.eventId,
+    type: event.type,
+    outcome: event.outcome,
+    createdAt: event.createdAt,
+    memoryId: eventMemoryId(event),
+    reasonCodes: uniqueStrings([
+      ...event.reasonCodes,
+      ...(event.type === "storage_corrupt_json_quarantined" ? ["quarantined_corrupt_store"] : []),
+    ]),
+  }));
+
+  return {
+    store,
+    journal,
+    retention,
+    memories: memoryRows,
+    recentEvents,
+    allEvents,
+    summary: {
+      storedActive: store.entries.filter(entry => entry.status !== "superseded").length,
+      rendered: retention.rendered.length,
+      pending: journal.entries.length,
+      rejectedLast7Days: allEvents.filter(event => event.outcome === "rejected" && isWithinDays(event.createdAt, 7)).length,
+      corruptStoresQuarantinedLast30Days: allEvents.filter(event => event.type === "storage_corrupt_json_quarantined" && isWithinDays(event.createdAt, 30)).length,
+    },
+  };
+}
+
+async function buildMemoryDiagJSON(root: string): Promise<MemoryDiagJSON> {
+  const key = await workspaceKey(root);
+  const snapshot = await buildWorkspaceDiagSnapshot({
+    root,
+    key,
+    memoryPath: await workspaceMemoryPath(root),
+    pendingPath: await workspacePendingJournalPath(root),
+  });
+
+  return {
+    version: 1,
+    workspace: { rootHash: workspaceRootHash(snapshot.store.workspace.root || root), key: snapshot.store.workspace.key || key },
+    generatedAt: new Date().toISOString(),
+    summary: snapshot.summary,
+    memories: snapshot.memories,
+    recentEvents: snapshot.recentEvents,
+  };
+}
+
 async function runHealth(options: CliOptions): Promise<void> {
+  if (options.json) {
+    const root = options.workspace ?? process.cwd();
+    console.log(JSON.stringify(await buildMemoryDiagJSON(root), null, 2));
+    return;
+  }
+
  if (options.all) {
    const scan = await scanWorkspaceResidues({ includeOrphans: true, minAgeMs: 0 });
    console.log("Workspace memory health");
@@ -432,7 +676,7 @@ async function printWorkspaceHealth(input: {
    const storedCount = active.filter(entry => entry.type === type).length;
    const renderedCount = renderedEntries.filter(entry => entry.type === type).length;
    const supersededCount = superseded.filter(entry => entry.type === type).length;
-    console.log(`  ${type.padEnd(9)} stored=${String(storedCount).padEnd(3)} rendered=${String(renderedCount).padEnd(3)} typeCap=${TYPE_MAX_FOR_DIAG[type]} superseded=${supersededCount}`);
+    console.log(`  ${type.padEnd(9)} stored=${String(storedCount).padEnd(3)} rendered=${String(renderedCount).padEnd(3)} typeCap=${RETENTION_TYPE_MAX[type]} superseded=${supersededCount}`);
  }
  console.log("");

@@ -454,16 +698,16 @@ async function printWorkspaceHealth(input: {
  console.log("");

  const wallDaysSinceActivity = daysSinceIso(store.lastActivityAt);
-  const dormantDiscountActive = wallDaysSinceActivity !== null && wallDaysSinceActivity > WORKSPACE_DORMANT_AFTER_DAYS_FOR_DIAG;
+  const dormantDiscountActive = wallDaysSinceActivity !== null && wallDaysSinceActivity > WORKSPACE_DORMANT_AFTER_DAYS;
  const dormantDaysPastGrace = wallDaysSinceActivity === null
    ? 0
-    : Math.max(0, wallDaysSinceActivity - WORKSPACE_DORMANT_AFTER_DAYS_FOR_DIAG);
+    : Math.max(0, wallDaysSinceActivity - WORKSPACE_DORMANT_AFTER_DAYS);
  console.log("Dormancy:");
  console.log(`  lastActivityAt: ${store.lastActivityAt ?? "(missing)"}`);
  console.log(`  wall days since activity: ${wallDaysSinceActivity === null ? "unknown" : wallDaysSinceActivity.toFixed(1)}`);
  console.log(`  dormant discount active: ${dormantDiscountActive ? "yes" : "no"}`);
  console.log(`  dormant days past grace: ${dormantDaysPastGrace.toFixed(1)}`);
-  console.log(`  dormant multiplier: ${DORMANT_DECAY_MULTIPLIER_FOR_DIAG}`);
+  console.log(`  dormant multiplier: ${DORMANT_DECAY_MULTIPLIER}`);
  console.log("");

  const highImportanceCount = active.filter(entry => entry.userImportance === "high").length;
@@ -472,11 +716,11 @@ async function printWorkspaceHealth(input: {
  const highImportanceRatio = active.length === 0 ? 0 : highImportanceCount / active.length;
  const maxReinforcedRatio = active.length === 0 ? 0 : maxReinforcedCount / active.length;
  const highImportanceAlert = highImportanceRatio > 0.3;
-  const safetyCriticalAlert = safetyCriticalCount > 5;
+  const safetyCriticalWarning = safetyCriticalCount > 0;
  const maxReinforcedAlert = maxReinforcedRatio > 0.1;
  console.log("Retention monitoring:");
  console.log(`  high_importance_ratio: ${formatPercent(highImportanceRatio)} (alert > 30%)${highImportanceAlert ? " ALERT" : ""}`);
-  console.log(`  safety_critical_count: ${safetyCriticalCount} (alert > 5)${safetyCriticalAlert ? " ALERT" : ""}`);
+  console.log(`  safety_critical_count: ${safetyCriticalCount} (deprecated field)${safetyCriticalWarning ? " WARNING" : ""}`);
  console.log(`  max_reinforced_count: ${maxReinforcedAlert ? `${maxReinforcedCount} (${formatPercent(maxReinforcedRatio)}, alert > 10%) ALERT` : `${maxReinforcedCount} (alert > 10% active)`}`);
  console.log("");

@@ -711,8 +955,125 @@ async function runAudit(options: CliOptions): Promise<void> {
  }
 }

+async function snapshotForOptions(options: CliOptions): Promise<WorkspaceDiagSnapshot> {
+  const root = options.workspace ?? process.cwd();
+  const key = await workspaceKey(root);
+  return buildWorkspaceDiagSnapshot({
+    root,
+    key,
+    memoryPath: await workspaceMemoryPath(root),
+    pendingPath: await workspacePendingJournalPath(root),
+  });
+}
+
+function formatEvidenceRefs(eventIds: string[], allEvents: EvidenceEventV1[]): string {
+  if (eventIds.length === 0) return "(none)";
+  const byId = new Map(allEvents.map(event => [event.eventId, event]));
+  return eventIds
+    .map(id => {
+      const event = byId.get(id);
+      return event ? `${event.eventId} ${event.type}` : id;
+    })
+    .join(", ");
+}
+
+async function runExplain(options: CliOptions): Promise<void> {
+  const snapshot = await snapshotForOptions(options);
+  console.log("Workspace memory explainability");
+  console.log("");
+
+  if (snapshot.memories.length === 0) {
+    console.log("No memories found.");
+  }
+
+  for (const memory of snapshot.memories) {
+    console.log(`Memory ${memory.id}: ${memory.status}`);
+    const strength = typeof memory.strength === "number" ? formatStrength(memory.strength) : "n/a";
+    console.log(`- strength=${strength}, type=${memory.type}, source=${memory.source}`);
+    console.log(`- reasons: ${memory.reasonCodes.length > 0 ? memory.reasonCodes.join(", ") : "(none)"}`);
+    console.log(`- evidence: ${formatEvidenceRefs(memory.evidenceEventIds, snapshot.allEvents)}`);
+    console.log("");
+  }
+
+  const quarantines = snapshot.recentEvents.filter(event => event.type === "storage_corrupt_json_quarantined");
+  if (quarantines.length > 0) {
+    console.log("Quarantined stores:");
+    for (const event of quarantines) {
+      console.log(`- quarantined_corrupt_store: ${event.eventId} ${event.type}; reasons=${event.reasonCodes.join(",")}`);
+    }
+  }
+}
+
+function statusFromTraceEvent(event: EvidenceEventV1 | undefined): string {
+  if (!event) return "unknown";
+  if (event.type === "render_selected") return "rendered";
+  if (event.type === "render_omitted") return statusFromOmissionReason(event.reasonCodes[0]);
+  if (event.type === "promotion_absorbed_exact" || event.type === "promotion_absorbed_identity") return "omitted_absorbed_duplicate";
+  if (event.type === "promotion_retry_scheduled") return "pending_retry";
+  if (event.type === "promotion_rejected_capacity" || event.type === "promotion_retry_exhausted") return "pending_rejected_capacity";
+  if (event.type === "storage_corrupt_json_quarantined") return "quarantined_corrupt_store";
+  if (event.outcome === "superseded") return "omitted_superseded";
+  return event.outcome;
+}
+
+function formatTraceEvent(event: EvidenceEventV1): string {
+  const reasons = event.reasonCodes.length > 0 ? event.reasonCodes.join(",") : "none";
+  const relations = (event.relations ?? [])
+    .map(relation => relation.memory?.memoryId ? `${relation.role}=${relation.memory.memoryId}` : undefined)
+    .filter((value): value is string => Boolean(value));
+  const relationText = relations.length > 0 ? `; ${relations.join(", ")}` : "";
+  return `- ${event.eventId} ${event.type}: ${event.outcome}; reasons=${reasons}${relationText}`;
+}
+
+function relationMemoryIds(events: EvidenceEventV1[], role: string): string[] {
+  return uniqueStrings(events.flatMap(event => (event.relations ?? [])
+    .filter(relation => relation.role === role)
+    .map(relation => relation.memory?.memoryId ?? "")));
+}
+
+async function runTrace(options: CliOptions): Promise<void> {
+  const root = options.workspace ?? process.cwd();
+  const memoryId = options.memory;
+  if (!memoryId) die("--memory requires an id");
+
+  const [snapshot, trace] = await Promise.all([
+    snapshotForOptions(options),
+    traceMemoryLifecycle(root, { memoryId }),
+  ]);
+  const memoryRow = snapshot.memories.find(memory => memory.id === memoryId);
+  const status = memoryRow?.status ?? statusFromTraceEvent(trace.events.at(-1));
+
+  console.log(`Memory ${memoryId}: ${status}`);
+  console.log("");
+  console.log("Lifecycle:");
+  if (trace.events.length === 0) {
+    console.log("(none)");
+    return;
+  }
+
+  for (const event of trace.events) {
+    console.log(formatTraceEvent(event));
+  }
+
+  const supersededBy = relationMemoryIds(trace.events, "superseded_by");
+  if (supersededBy.length > 0) {
+    console.log("");
+    console.log("Superseded by:");
+    for (const id of supersededBy) console.log(`- ${id}`);
+  }
+
+  const reinforcedBy = relationMemoryIds(trace.events, "reinforced_by");
+  if (reinforcedBy.length > 0) {
+    console.log("");
+    console.log("Reinforced by:");
+    for (const id of reinforcedBy) console.log(`- ${id}`);
+  }
+}
+
 const { command, options } = parseArgs(process.argv.slice(2));

 if (command === "health") await runHealth(options);
 else if (command === "rejections") await runRejections(options);
-else await runAudit(options);
+else if (command === "audit") await runAudit(options);
+else if (command === "explain") await runExplain(options);
+else await runTrace(options);
@@ -0,0 +1,526 @@
+import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
+import { appendFile, mkdir, readFile, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { dataHome, workspaceEvidenceLogPath, workspaceKey } from "./paths.ts";
+import { redactCredentials } from "./redaction.ts";
+
+export type EvidenceEventType =
+  | "extraction_candidate_accepted"
+  | "extraction_candidate_rejected"
+  | "explicit_memory_detected"
+  | "explicit_memory_ignored"
+  | "pending_memory_appended"
+  | "pending_memory_cleared"
+  | "promotion_promoted"
+  | "promotion_absorbed_exact"
+  | "promotion_absorbed_identity"
+  | "promotion_superseded"
+  | "promotion_rejected_capacity"
+  | "promotion_retry_scheduled"
+  | "promotion_retry_exhausted"
+  | "memory_reinforced"
+  | "render_selected"
+  | "render_omitted"
+  | "storage_corrupt_json_quarantined"
+  | "storage_stale_lock_recovered"
+  | "storage_lock_timeout"
+  | "hook_failed";
+
+export type EvidencePhase =
+  | "extraction"
+  | "explicit"
+  | "pending_journal"
+  | "promotion"
+  | "reinforcement"
+  | "render"
+  | "storage"
+  | "hook";
+
+export type EvidenceOutcome =
+  | "accepted"
+  | "rejected"
+  | "promoted"
+  | "absorbed"
+  | "superseded"
+  | "rendered"
+  | "omitted"
+  | "retried"
+  | "exhausted"
+  | "reinforced"
+  | "quarantined"
+  | "failed"
+  | "recovered";
+
+export type MemoryEvidenceRef = {
+  memoryId?: string;
+  memoryKeyHash?: string;
+  identityKeyHash?: string;
+  type?: "feedback" | "project" | "decision" | "reference";
+  source?: "explicit" | "compaction" | "manual";
+  status?: "active" | "superseded";
+};
+
+export type EvidenceRelation = {
+  role:
+    | "candidate"
+    | "pending"
+    | "promoted"
+    | "retained"
+    | "absorbed"
+    | "superseded"
+    | "superseded_by"
+    | "reinforced"
+    | "reinforced_by"
+    | "rendered"
+    | "omitted";
+  memory?: MemoryEvidenceRef;
+};
+
+export type EvidenceDetailValue = string | number | boolean | null | string[] | number[];
+
+export type EvidenceEventV1 = {
+  version: 1;
+  eventId: string;
+  createdAt: string;
+  workspaceKey: string;
+  workspaceRootHash: string;
+  sessionHash?: string;
+  messageHash?: string;
+  type: EvidenceEventType;
+  phase: EvidencePhase;
+  outcome: EvidenceOutcome;
+  memory?: MemoryEvidenceRef;
+  relations?: EvidenceRelation[];
+  reasonCodes: string[];
+  details?: Record<string, EvidenceDetailValue>;
+  textPreview?: string;
+};
+
+export type EvidenceEventInput = Omit<
+  EvidenceEventV1,
+  "version" | "eventId" | "createdAt" | "workspaceKey" | "workspaceRootHash"
+>;
+
+export type EvidenceQuery = {
+  since?: string;
+  until?: string;
+  types?: EvidenceEventType[];
+  phases?: EvidencePhase[];
+  outcomes?: EvidenceOutcome[];
+  memoryId?: string;
+  memoryKeyHash?: string;
+  identityKeyHash?: string;
+  sessionHash?: string;
+  limit?: number;
+  newestFirst?: boolean;
+};
+
+export type MemoryEvidenceSummary = {
+  memoryId?: string;
+  memoryKeyHash?: string;
+  latestOutcome?: EvidenceOutcome;
+  latestRenderStatus?: "rendered" | "omitted";
+  reasonCodes: string[];
+  eventIds: string[];
+  lastEventAt?: string;
+};
+
+export type MemoryLifecycleTrace = {
+  memoryId?: string;
+  memoryKeyHash?: string;
+  identityKeyHash?: string;
+  events: EvidenceEventV1[];
+  createdBy?: EvidenceEventV1;
+  acceptedBy?: EvidenceEventV1;
+  promotedBy?: EvidenceEventV1;
+  absorbedBy?: EvidenceEventV1;
+  supersededBy?: EvidenceEventV1;
+  reinforcedBy: EvidenceEventV1[];
+  latestRender?: EvidenceEventV1;
+  currentStatus:
+    | "accepted"
+    | "pending"
+    | "promoted"
+    | "absorbed"
+    | "superseded"
+    | "rendered"
+    | "omitted"
+    | "rejected"
+    | "unknown";
+};
+
+export const EVIDENCE_LOG_LIMITS = {
+  maxAgeDays: 90,
+  maxEventsPerWorkspace: 5000,
+  maxBytesPerWorkspace: 2 * 1024 * 1024,
+  pruneEveryAppendCount: 100,
+} as const;
+
+const appendCounts = new Map<string, number>();
+const HASH_PATTERN = /^[a-f0-9]{16}$/i;
+const DAY_MS = 24 * 60 * 60 * 1000;
+const MAX_DETAIL_STRING_CHARS = 240;
+const MAX_DETAIL_ARRAY_ITEMS = 25;
+
+function evidenceHash(value: string): string {
+  return createHash("sha256").update(value).digest("hex").slice(0, 16);
+}
+
+function normalizeHashValue(value: string | undefined): string | undefined {
+  if (!value) return undefined;
+  return HASH_PATTERN.test(value) ? value.toLowerCase() : evidenceHash(value);
+}
+
+async function resolvedRoot(root: string): Promise<string> {
+  return realpath(root).catch(() => root);
+}
+
+function evidenceTextPreview(text: string, maxChars = 120): string {
+  return redactCredentials(text).replace(/\s+/g, " ").trim().slice(0, maxChars);
+}
+
+function sanitizeReasonCode(reason: string): string {
+  return reason.replace(/[^a-zA-Z0-9_.:-]/g, "_").slice(0, 120);
+}
+
+function sanitizeMemoryRef(memory: MemoryEvidenceRef | undefined): MemoryEvidenceRef | undefined {
+  if (!memory) return undefined;
+  const sanitized: MemoryEvidenceRef = {};
+  if (typeof memory.memoryId === "string" && memory.memoryId) sanitized.memoryId = memory.memoryId.slice(0, 160);
+  if (memory.memoryKeyHash) sanitized.memoryKeyHash = normalizeHashValue(memory.memoryKeyHash);
+  if (memory.identityKeyHash) sanitized.identityKeyHash = normalizeHashValue(memory.identityKeyHash);
+  if (memory.type) sanitized.type = memory.type;
+  if (memory.source) sanitized.source = memory.source;
+  if (memory.status) sanitized.status = memory.status;
+  return Object.keys(sanitized).length > 0 ? sanitized : undefined;
+}
+
+function sanitizeRelations(relations: EvidenceRelation[] | undefined): EvidenceRelation[] | undefined {
+  if (!relations) return undefined;
+  const sanitized = relations
+    .map(relation => ({
+      role: relation.role,
+      memory: sanitizeMemoryRef(relation.memory),
+    }))
+    .slice(0, 25);
+  return sanitized.length > 0 ? sanitized : undefined;
+}
+
+function sanitizeDetailString(value: string): string {
+  return evidenceTextPreview(value, MAX_DETAIL_STRING_CHARS);
+}
+
+function sanitizeDetails(details: EvidenceEventInput["details"]): EvidenceEventV1["details"] {
+  if (!details) return undefined;
+  const sanitized: Record<string, EvidenceDetailValue> = {};
+
+  for (const [rawKey, rawValue] of Object.entries(details).slice(0, 50)) {
+    const key = rawKey.replace(/[^a-zA-Z0-9_.:-]/g, "_").slice(0, 80);
+    if (!key) continue;
+
+    if (typeof rawValue === "string") {
+      sanitized[key] = sanitizeDetailString(rawValue);
+    } else if (typeof rawValue === "number") {
+      if (Number.isFinite(rawValue)) sanitized[key] = rawValue;
+    } else if (typeof rawValue === "boolean" || rawValue === null) {
+      sanitized[key] = rawValue;
+    } else if (Array.isArray(rawValue)) {
+      if (rawValue.every(item => typeof item === "string")) {
+        sanitized[key] = rawValue.slice(0, MAX_DETAIL_ARRAY_ITEMS).map(item => sanitizeDetailString(item));
+      } else if (rawValue.every(item => typeof item === "number" && Number.isFinite(item))) {
+        sanitized[key] = rawValue.slice(0, MAX_DETAIL_ARRAY_ITEMS) as number[];
+      }
+    }
+  }
+
+  return Object.keys(sanitized).length > 0 ? sanitized : undefined;
+}
+
+function buildEvidenceEvent(
+  input: EvidenceEventInput,
+  workspaceKeyValue: string,
+  workspaceRootHash: string,
+): EvidenceEventV1 {
+  const textPreviewMax = input.type === "extraction_candidate_rejected" ? 80 : 120;
+  const event: EvidenceEventV1 = {
+    version: 1,
+    eventId: `evt_${Date.now()}_${Math.random().toString(36).slice(2, 10).padEnd(8, "0")}`,
+    createdAt: new Date().toISOString(),
+    workspaceKey: workspaceKeyValue,
+    workspaceRootHash,
+    type: input.type,
+    phase: input.phase,
+    outcome: input.outcome,
+    reasonCodes: input.reasonCodes.map(sanitizeReasonCode).filter(Boolean).slice(0, 25),
+  };
+
+  const memory = sanitizeMemoryRef(input.memory);
+  const relations = sanitizeRelations(input.relations);
+  const details = sanitizeDetails(input.details);
+  if (input.sessionHash) event.sessionHash = normalizeHashValue(input.sessionHash);
+  if (input.messageHash) event.messageHash = normalizeHashValue(input.messageHash);
+  if (memory) event.memory = memory;
+  if (relations) event.relations = relations;
+  if (details) event.details = details;
+  if (input.textPreview) event.textPreview = evidenceTextPreview(input.textPreview, textPreviewMax);
+
+  return event;
+}
+
+async function safeAppendEvidenceLine(path: string, line: string): Promise<void> {
+  try {
+    await mkdir(dirname(path), { recursive: true });
+    await appendFile(path, `${line}\n`, "utf8");
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(`[memory] failed to write evidence event: ${message}`);
+  }
+}
+
+async function maybePruneEvidenceLog(path: string): Promise<void> {
+  const nextCount = (appendCounts.get(path) ?? 0) + 1;
+  appendCounts.set(path, nextCount);
+  if (nextCount % EVIDENCE_LOG_LIMITS.pruneEveryAppendCount !== 0) return;
+
+  try {
+    await pruneEvidenceLogPath(path);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(`[memory] failed to prune evidence log: ${message}`);
+  }
+}
+
+export async function appendEvidenceEvent(root: string, event: EvidenceEventInput): Promise<EvidenceEventV1> {
+  const records = await appendEvidenceEvents(root, [event]);
+  return records[0];
+}
+
+export async function appendEvidenceEvents(root: string, events: EvidenceEventInput[]): Promise<EvidenceEventV1[]> {
+  const path = await workspaceEvidenceLogPath(root);
+  const rootPath = await resolvedRoot(root);
+  const workspaceRootHash = evidenceHash(rootPath);
+  const workspaceKeyValue = await workspaceKey(root);
+  const records = events.map(event => buildEvidenceEvent(event, workspaceKeyValue, workspaceRootHash));
+
+  for (const record of records) {
+    await safeAppendEvidenceLine(path, JSON.stringify(record));
+    await maybePruneEvidenceLog(path);
+  }
+
+  return records;
+}
+
+export async function appendEvidenceEventForWorkspaceKey(
+  workspaceKeyValue: string,
+  event: EvidenceEventInput,
+): Promise<EvidenceEventV1> {
+  const path = join(dataHome(), "opencode-working-memory", "workspaces", workspaceKeyValue, "evidence", "events.jsonl");
+  const record = buildEvidenceEvent(event, workspaceKeyValue, workspaceKeyValue);
+  await safeAppendEvidenceLine(path, JSON.stringify(record));
+  await maybePruneEvidenceLog(path);
+  return record;
+}
+
+type ParsedEvidenceLine = {
+  event: EvidenceEventV1;
+  index: number;
+};
+
+function parseEvidenceLine(line: string): EvidenceEventV1 | null {
+  try {
+    const parsed = JSON.parse(line) as Partial<EvidenceEventV1>;
+    if (parsed.version !== 1 || !parsed.eventId || !parsed.createdAt || !parsed.type) return null;
+    return parsed as EvidenceEventV1;
+  } catch {
+    return null;
+  }
+}
+
+async function readEvidenceLines(path: string, warnInvalid: boolean): Promise<{ valid: ParsedEvidenceLine[]; invalid: string[] }> {
+  if (!existsSync(path)) return { valid: [], invalid: [] };
+  const raw = await readFile(path, "utf8");
+  const valid: ParsedEvidenceLine[] = [];
+  const invalid: string[] = [];
+
+  raw.split(/\n/).forEach((line, index) => {
+    if (!line.trim()) return;
+    const event = parseEvidenceLine(line);
+    if (event) {
+      valid.push({ event, index });
+    } else {
+      invalid.push(line);
+      if (warnInvalid) console.warn(`[memory] skipped invalid evidence log line ${index + 1}`);
+    }
+  });
+
+  return { valid, invalid };
+}
+
+function eventTimeMs(event: EvidenceEventV1): number {
+  const ms = new Date(event.createdAt).getTime();
+  return Number.isFinite(ms) ? ms : 0;
+}
+
+async function atomicWriteText(path: string, text: string): Promise<void> {
+  await mkdir(dirname(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 10)}.tmp`;
+  try {
+    await writeFile(tmp, text, { encoding: "utf8", mode: 0o600 });
+    await rename(tmp, path);
+  } catch (error) {
+    await rm(tmp, { force: true }).catch(() => undefined);
+    throw error;
+  }
+}
+
+function serializeEvents(events: EvidenceEventV1[]): string {
+  return events.map(event => JSON.stringify(event)).join("\n") + (events.length > 0 ? "\n" : "");
+}
+
+function trimEventsToByteLimit(events: EvidenceEventV1[]): EvidenceEventV1[] {
+  let kept = [...events];
+  while (kept.length > 0 && Buffer.byteLength(serializeEvents(kept), "utf8") > EVIDENCE_LOG_LIMITS.maxBytesPerWorkspace) {
+    kept = kept.slice(1);
+  }
+  return kept;
+}
+
+async function pruneEvidenceLogPath(path: string): Promise<void> {
+  if (!existsSync(path)) return;
+  const stats = await stat(path);
+  if (stats.isDirectory()) return;
+
+  const { valid, invalid } = await readEvidenceLines(path, false);
+  if (invalid.length > 0) {
+    const corruptPath = `${path}.corrupt-lines-${Date.now()}.jsonl`;
+    await writeFile(corruptPath, invalid.join("\n") + "\n", { encoding: "utf8", mode: 0o600 }).catch(error => {
+      const message = error instanceof Error ? error.message : String(error);
+      console.error(`[memory] failed to quarantine invalid evidence lines: ${message}`);
+    });
+  }
+
+  const cutoff = Date.now() - EVIDENCE_LOG_LIMITS.maxAgeDays * DAY_MS;
+  let events = valid
+    .filter(item => eventTimeMs(item.event) >= cutoff)
+    .sort((a, b) => eventTimeMs(a.event) - eventTimeMs(b.event) || a.index - b.index)
+    .map(item => item.event);
+
+  if (events.length > EVIDENCE_LOG_LIMITS.maxEventsPerWorkspace) {
+    events = events.slice(events.length - EVIDENCE_LOG_LIMITS.maxEventsPerWorkspace);
+  }
+
+  events = trimEventsToByteLimit(events);
+  await atomicWriteText(path, serializeEvents(events));
+}
+
+function memoryRefMatches(memory: MemoryEvidenceRef | undefined, query: Pick<EvidenceQuery, "memoryId" | "memoryKeyHash" | "identityKeyHash">): boolean {
+  if (!memory) return false;
+  const memoryKeyHash = normalizeHashValue(query.memoryKeyHash);
+  const identityKeyHash = normalizeHashValue(query.identityKeyHash);
+  if (query.memoryId && memory.memoryId === query.memoryId) return true;
+  if (memoryKeyHash && memory.memoryKeyHash === memoryKeyHash) return true;
+  if (identityKeyHash && memory.identityKeyHash === identityKeyHash) return true;
+  return false;
+}
+
+function eventMatchesMemory(event: EvidenceEventV1, query: Pick<EvidenceQuery, "memoryId" | "memoryKeyHash" | "identityKeyHash">): boolean {
+  if (!query.memoryId && !query.memoryKeyHash && !query.identityKeyHash) return true;
+  if (memoryRefMatches(event.memory, query)) return true;
+  return (event.relations ?? []).some(relation => memoryRefMatches(relation.memory, query));
+}
+
+export async function queryEvidenceEvents(
+  root: string,
+  query: EvidenceQuery = {},
+): Promise<EvidenceEventV1[]> {
+  const path = await workspaceEvidenceLogPath(root);
+  const { valid } = await readEvidenceLines(path, true);
+  const sinceMs = query.since ? new Date(query.since).getTime() : undefined;
+  const untilMs = query.until ? new Date(query.until).getTime() : undefined;
+  const sessionHash = normalizeHashValue(query.sessionHash);
+
+  let events = valid.map(item => item.event).filter(event => {
+    const createdAtMs = eventTimeMs(event);
+    if (Number.isFinite(sinceMs) && createdAtMs < sinceMs) return false;
+    if (Number.isFinite(untilMs) && createdAtMs > untilMs) return false;
+    if (query.types && !query.types.includes(event.type)) return false;
+    if (query.phases && !query.phases.includes(event.phase)) return false;
+    if (query.outcomes && !query.outcomes.includes(event.outcome)) return false;
+    if (sessionHash && event.sessionHash !== sessionHash) return false;
+    if (!eventMatchesMemory(event, query)) return false;
+    return true;
+  });
+
+  if (query.newestFirst) events = events.slice().reverse();
+  if (typeof query.limit === "number" && query.limit >= 0) events = events.slice(0, query.limit);
+  return events;
+}
+
+export async function summarizeMemoryEvidence(
+  root: string,
+  input: { memoryId?: string; memoryKeyHash?: string },
+): Promise<MemoryEvidenceSummary> {
+  const events = await queryEvidenceEvents(root, input);
+  const latest = events.at(-1);
+  const latestRender = events.filter(event => event.phase === "render").at(-1);
+  const reasonCodes = new Set<string>();
+  for (const event of events) {
+    for (const reason of event.reasonCodes) reasonCodes.add(reason);
+  }
+
+  return {
+    memoryId: input.memoryId,
+    memoryKeyHash: normalizeHashValue(input.memoryKeyHash),
+    latestOutcome: latest?.outcome,
+    latestRenderStatus: latestRender?.outcome === "rendered" || latestRender?.outcome === "omitted"
+      ? latestRender.outcome
+      : undefined,
+    reasonCodes: [...reasonCodes],
+    eventIds: events.map(event => event.eventId),
+    lastEventAt: latest?.createdAt,
+  };
+}
+
+function currentStatusFromEvent(event: EvidenceEventV1 | undefined): MemoryLifecycleTrace["currentStatus"] {
+  if (!event) return "unknown";
+  if (event.outcome === "accepted") return "accepted";
+  if (event.outcome === "promoted") return "promoted";
+  if (event.outcome === "absorbed") return "absorbed";
+  if (event.outcome === "superseded") return "superseded";
+  if (event.outcome === "rendered") return "rendered";
+  if (event.outcome === "omitted") return "omitted";
+  if (event.outcome === "rejected") return "rejected";
+  if (event.type === "pending_memory_appended") return "pending";
+  return "unknown";
+}
+
+export async function traceMemoryLifecycle(
+  root: string,
+  input: { memoryId?: string; memoryKeyHash?: string; identityKeyHash?: string },
+): Promise<MemoryLifecycleTrace> {
+  const events = await queryEvidenceEvents(root, input);
+  const createdBy = events.find(event => event.type === "explicit_memory_detected" || event.type === "pending_memory_appended");
+  const acceptedBy = events.find(event => event.type === "extraction_candidate_accepted" || event.type === "explicit_memory_detected");
+  const promotedBy = events.find(event => event.type === "promotion_promoted");
+  const absorbedBy = events.find(event => event.outcome === "absorbed");
+  const supersededBy = events.find(event => event.outcome === "superseded");
+  const reinforcedBy = events.filter(event => event.type === "memory_reinforced" || event.outcome === "reinforced");
+  const latestRender = events.filter(event => event.phase === "render").at(-1);
+  const latest = events.at(-1);
+
+  return {
+    memoryId: input.memoryId,
+    memoryKeyHash: normalizeHashValue(input.memoryKeyHash),
+    identityKeyHash: normalizeHashValue(input.identityKeyHash),
+    events,
+    createdBy,
+    acceptedBy,
+    promotedBy,
+    absorbedBy,
+    supersededBy,
+    reinforcedBy,
+    latestRender,
+    currentStatus: currentStatusFromEvent(latest),
+  };
+}
@@ -6,6 +6,7 @@ import { LONG_TERM_LIMITS } from "./types.ts";
 import { assessMemoryQuality } from "./memory-quality.ts";
 import { extractionRejectionLogPath } from "./paths.ts";
 import { redactCredentials } from "./redaction.ts";
+import type { EvidenceEventInput } from "./evidence-log.ts";

 function id(prefix: string): string {
  return `${prefix}_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
@@ -46,6 +47,34 @@ function isNegatedMemoryRequest(text: string, matchIndex: number): boolean {
 }

 export function extractExplicitMemories(text: string): LongTermMemoryEntry[] {
+  return extractExplicitMemoriesWithEvidence(text).entries;
+}
+
+export type WorkspaceMemoryParseResult = {
+  entries: LongTermMemoryEntry[];
+  evidence: EvidenceEventInput[];
+};
+
+function evidenceTextPreview(text: string, maxChars = 120): string {
+  return redactCredentials(text).replace(/\s+/g, " ").trim().slice(0, maxChars);
+}
+
+function memoryEvidence(memory: LongTermMemoryEntry): EvidenceEventInput["memory"] {
+  return {
+    memoryId: memory.id,
+    type: memory.type,
+    source: memory.source,
+    status: memory.status,
+  };
+}
+
+function extractionEvidence(
+  input: Pick<EvidenceEventInput, "type" | "phase" | "outcome" | "reasonCodes" | "textPreview" | "memory" | "details">,
+): EvidenceEventInput {
+  return input;
+}
+
+export function extractExplicitMemoriesWithEvidence(text: string): WorkspaceMemoryParseResult {
  // 注意：所有pattern必須有 g flag，因為使用 matchAll()
  // Pattern 必須在行首匹配，避免匹配到句子中間的非指令式用法
  const patterns = [
@@ -71,29 +100,74 @@ export function extractExplicitMemories(text: string): LongTermMemoryEntry[] {
  const nowMs = Date.now();
  const now = new Date(nowMs).toISOString();
  const entries: LongTermMemoryEntry[] = [];
+  const evidence: EvidenceEventInput[] = [];
  const seen = new Set<string>();
+  const negatedLinePattern = /(?:^|\n)\s*(?:(?:please\s+)?(?:do\s+not|don't|dont|never)\s+remember(?:\s+(?:this|that))?|不要\s*(?:記住|记住)|別\s*(?:記住|记住)|别\s*(?:記住|记住))[:：,，]?\s*(.+)$/gim;
+  for (const match of text.matchAll(negatedLinePattern)) {
+    evidence.push(extractionEvidence({
+      type: "explicit_memory_ignored",
+      phase: "explicit",
+      outcome: "rejected",
+      reasonCodes: ["negated_request"],
+      textPreview: evidenceTextPreview(match[1] ?? match[0], 80),
+    }));
+  }

  for (const pattern of patterns) {
    for (const match of text.matchAll(pattern)) {
      const body = match[1]?.trim();
-      if (!body || body.length < 8) continue;
+      if (body && /^(再说|再說|later|next time)$/i.test(body)) {
+        evidence.push(extractionEvidence({
+          type: "explicit_memory_ignored",
+          phase: "explicit",
+          outcome: "rejected",
+          reasonCodes: ["deferral"],
+          textPreview: evidenceTextPreview(body, 80),
+        }));
+        continue;
+      }
+      if (!body || body.length < 8) {
+        evidence.push(extractionEvidence({
+          type: "explicit_memory_ignored",
+          phase: "explicit",
+          outcome: "rejected",
+          reasonCodes: ["too_short"],
+          textPreview: evidenceTextPreview(body ?? match[0], 80),
+        }));
+        continue;
+      }
      
      // Calculate actual trigger position (after possible newline)
      const triggerIndex = match.index! + (match[0].match(/^[\s\n]*/)?.[0]?.length || 0);
      
      // Check if this is a negated request (e.g., "不要記住")
-      if (isNegatedMemoryRequest(text, triggerIndex)) continue;
+      if (isNegatedMemoryRequest(text, triggerIndex)) {
+        evidence.push(extractionEvidence({
+          type: "explicit_memory_ignored",
+          phase: "explicit",
+          outcome: "rejected",
+          reasonCodes: ["negated_request"],
+          textPreview: evidenceTextPreview(body, 80),
+        }));
+        continue;
+      }
      
-      // Check if it's a deferral (e.g., "later", "next time")
-      if (/^(再说|再說|later|next time)$/i.test(body)) continue;
-
      // Dedupe by canonical body
      const key = body.toLowerCase().replace(/\s+/g, " ").trim();
-      if (seen.has(key)) continue;
+      if (seen.has(key)) {
+        evidence.push(extractionEvidence({
+          type: "explicit_memory_ignored",
+          phase: "explicit",
+          outcome: "rejected",
+          reasonCodes: ["duplicate_in_message"],
+          textPreview: evidenceTextPreview(body, 80),
+        }));
+        continue;
+      }
      seen.add(key);

      const type = classifyExplicitMemory(body);
-      entries.push({
+      const memory: LongTermMemoryEntry = {
        id: id("mem"),
        type,
        text: body.slice(0, LONG_TERM_LIMITS.maxEntryTextChars),
@@ -104,11 +178,20 @@ export function extractExplicitMemories(text: string): LongTermMemoryEntry[] {
        updatedAt: now,
        retentionClock: nowMs,
        staleAfterDays: staleAfterDaysFor(type),
-      });
+      };
+      entries.push(memory);
+      evidence.push(extractionEvidence({
+        type: "explicit_memory_detected",
+        phase: "explicit",
+        outcome: "accepted",
+        reasonCodes: ["explicit_trigger_matched"],
+        memory: memoryEvidence(memory),
+        textPreview: evidenceTextPreview(memory.text),
+      }));
    }
  }

-  return entries;
+  return { entries, evidence };
 }

 function classifyExplicitMemory(text: string): LongTermType {
@@ -251,7 +334,7 @@ async function logExtractionRejection(entry: ExtractionRejectionLogEntry): Promi
  }
 }

-function shouldAcceptWorkspaceMemoryCandidate(
+function evaluateWorkspaceMemoryCandidate(
  entry: {
    type: LongTermType;
    text: string;
@@ -259,7 +342,7 @@ function shouldAcceptWorkspaceMemoryCandidate(
  options: {
    fromMemoryTrigger?: boolean;
  } = {},
-): boolean {
+): { accepted: boolean; reasons: string[] } {
  const text = entry.text.trim();
  const minLength = options.fromMemoryTrigger ? 6 : 20;

@@ -267,14 +350,14 @@ function shouldAcceptWorkspaceMemoryCandidate(
  if (entry.type === "reference" && /\b(?:admin\s+)?pin\s|scrypt|n=\d+|r=\d+|p=\d+/i.test(text)) {
    // Stable config values can be short — allow below generic min length
  } else if (text.length < minLength) {
-    return false;
+    return { accepted: false, reasons: ["too_short"] };
  }

  // Indirect Prompt Injection / Adversarial Instructions
  // Rejects attempts to overwrite system behavior or "ignore" rules.
  // comparative "instead of" is allowed.
-  if (/\b(ignore\s+all|ignore\s+previous|ignore\s+instruction|overwrite\s+system|overwrite\s+rules|forget\s+all|delete\s+root)\b/i.test(text)) return false;
-  if (/\b(ignore|instruction|overwrite)\b/i.test(text) && /\b(previous|all|rules|behavior|prompt|system)\b/i.test(text)) return false;
+  if (/\b(ignore\s+all|ignore\s+previous|ignore\s+instruction|overwrite\s+system|overwrite\s+rules|forget\s+all|delete\s+root)\b/i.test(text)) return { accepted: false, reasons: ["prompt_injection"] };
+  if (/\b(ignore|instruction|overwrite)\b/i.test(text) && /\b(previous|all|rules|behavior|prompt|system)\b/i.test(text)) return { accepted: false, reasons: ["prompt_injection"] };

  const quality = assessMemoryQuality({ type: entry.type, text, source: "compaction" });
  if (!quality.accepted) {
@@ -285,10 +368,22 @@ function shouldAcceptWorkspaceMemoryCandidate(
      reasons: quality.reasons,
      source: "compaction",
    });
-    return false;
+    return { accepted: false, reasons: quality.reasons };
  }

-  return true;
+  return { accepted: true, reasons: ["quality_gate_passed"] };
+}
+
+function shouldAcceptWorkspaceMemoryCandidate(
+  entry: {
+    type: LongTermType;
+    text: string;
+  },
+  options: {
+    fromMemoryTrigger?: boolean;
+  } = {},
+): boolean {
+  return evaluateWorkspaceMemoryCandidate(entry, options).accepted;
 }

 /**
@@ -316,12 +411,17 @@ function extractCandidateBlock(summary: string): string | null {
 }

 export function parseWorkspaceMemoryCandidates(summary: string): LongTermMemoryEntry[] {
+  return parseWorkspaceMemoryCandidatesWithEvidence(summary).entries;
+}
+
+export function parseWorkspaceMemoryCandidatesWithEvidence(summary: string): WorkspaceMemoryParseResult {
  const block = extractCandidateBlock(summary);
-  if (!block) return [];
+  if (!block) return { entries: [], evidence: [] };

  const nowMs = Date.now();
  const now = new Date(nowMs).toISOString();
  const entries: LongTermMemoryEntry[] = [];
+  const evidence: EvidenceEventInput[] = [];

  for (const line of block.split("\n")) {
    // Accept both "- [type] text" (bracketed) and "- type text" (bracketless)
@@ -331,18 +431,49 @@ export function parseWorkspaceMemoryCandidates(summary: string): LongTermMemoryE
    if (!item) continue;
    const type = (item[1] ?? item[2]).toLowerCase() as LongTermType;
    const normalizedBody = normalizeCandidateBody(item[3]);
-    if (!normalizedBody) continue;
+    if (!normalizedBody) {
+      evidence.push(extractionEvidence({
+        type: "extraction_candidate_rejected",
+        phase: "extraction",
+        outcome: "rejected",
+        reasonCodes: ["negated_request"],
+        memory: { type, source: "compaction" },
+        textPreview: evidenceTextPreview(item[3], 80),
+      }));
+      continue;
+    }

    const minLength = normalizedBody.hadTrigger ? 6 : 12;
-    if (normalizedBody.text.length < minLength) continue;
+    if (normalizedBody.text.length < minLength) {
+      evidence.push(extractionEvidence({
+        type: "extraction_candidate_rejected",
+        phase: "extraction",
+        outcome: "rejected",
+        reasonCodes: ["too_short"],
+        memory: { type, source: "compaction" },
+        textPreview: evidenceTextPreview(normalizedBody.text, 80),
+      }));
+      continue;
+    }

    // Apply quality gate
-    if (!shouldAcceptWorkspaceMemoryCandidate(
+    const quality = evaluateWorkspaceMemoryCandidate(
      { type, text: normalizedBody.text },
      { fromMemoryTrigger: normalizedBody.hadTrigger },
-    )) continue;
+    );
+    if (!quality.accepted) {
+      evidence.push(extractionEvidence({
+        type: "extraction_candidate_rejected",
+        phase: "extraction",
+        outcome: "rejected",
+        reasonCodes: quality.reasons,
+        memory: { type, source: "compaction" },
+        textPreview: evidenceTextPreview(normalizedBody.text, 80),
+      }));
+      continue;
+    }

-    entries.push({
+    const memory: LongTermMemoryEntry = {
      id: id("mem"),
      type,
      text: normalizedBody.text.slice(0, LONG_TERM_LIMITS.maxEntryTextChars),
@@ -353,8 +484,17 @@ export function parseWorkspaceMemoryCandidates(summary: string): LongTermMemoryE
      updatedAt: now,
      retentionClock: nowMs,
      staleAfterDays: staleAfterDaysFor(type),
-    });
+    };
+    entries.push(memory);
+    evidence.push(extractionEvidence({
+      type: "extraction_candidate_accepted",
+      phase: "extraction",
+      outcome: "accepted",
+      reasonCodes: ["quality_gate_passed", "valid_candidate_format"],
+      memory: memoryEvidence(memory),
+      textPreview: evidenceTextPreview(memory.text),
+    }));
  }

-  return entries;
+  return { entries, evidence };
 }
@@ -24,6 +24,10 @@ export async function workspacePendingJournalPath(root: string): Promise<string>
  return join(await memoryRoot(root), "workspace-pending-journal.json");
 }

+export async function workspaceEvidenceLogPath(root: string): Promise<string> {
+  return join(await memoryRoot(root), "evidence", "events.jsonl");
+}
+
 export async function sessionStatePath(root: string, sessionID: string): Promise<string> {
  const safeSessionID = createHash("sha256").update(sessionID).digest("hex").slice(0, 32);
  return join(await memoryRoot(root), "sessions", `${safeSessionID}.json`);
@@ -26,18 +26,19 @@
 import { rm } from "fs/promises";
 import type { Plugin } from "@opencode-ai/plugin";
 import {
-  extractExplicitMemories,
+  extractExplicitMemoriesWithEvidence,
  extractActiveFiles,
  extractErrorsFromBash,
-  parseWorkspaceMemoryCandidates,
+  parseWorkspaceMemoryCandidatesWithEvidence,
 } from "./extractors.ts";
 import {
  loadWorkspaceMemory,
  updateWorkspaceMemory,
  updateWorkspaceMemoryWithAccounting,
-  renderWorkspaceMemory,
-  reinforceMemory,
+  accountWorkspaceMemoryRender,
+  workspaceMemoryIdentityKey,
 } from "./workspace-memory.ts";
+import { reinforceMemory } from "./retention.ts";
 import {
  appendPendingMemories,
  clearPendingMemories,
@@ -62,8 +63,9 @@ import {
  latestCompactionSummary,
  pendingTodos,
 } from "./opencode.ts";
-import { accountPendingPromotions } from "./promotion-accounting.ts";
-import { WORKSPACE_MEMORY_CACHE_LIMITS } from "./types.ts";
+import { accountPendingPromotions, promotionAccountingEvidenceEvents } from "./promotion-accounting.ts";
+import { appendEvidenceEvent, appendEvidenceEvents, type EvidenceEventInput, type MemoryEvidenceRef } from "./evidence-log.ts";
+import { type LongTermMemoryEntry, WORKSPACE_MEMORY_CACHE_LIMITS } from "./types.ts";

 /**
 * Build the complete compaction prompt.
@@ -162,6 +164,25 @@ function renderTodosForCompaction(todos: Array<{ content: string; status: string
  return lines.join("\n");
 }

+function safeErrorMessage(error: unknown): string {
+  const message = error instanceof Error ? error.message : String(error);
+  return message.replace(/\s+/g, " ").slice(0, 240);
+}
+
+async function warnMemoryHook(scope: string, error: unknown, root?: string): Promise<void> {
+  const message = safeErrorMessage(error);
+  console.error(`[memory] ${scope} failed: ${message}`);
+  if (root) {
+    await appendEvidenceEvent(root, {
+      type: "hook_failed",
+      phase: "hook",
+      outcome: "failed",
+      reasonCodes: [scope],
+      details: { message },
+    }).catch(() => undefined);
+  }
+}
+
 export const MemoryV2Plugin: Plugin = async (input) => {
  const { directory, client } = input;

@@ -198,6 +219,29 @@ export const MemoryV2Plugin: Plugin = async (input) => {
  // Cache for processed user message IDs (to avoid duplicate processing)
  const processedUserMessages = new Map<string, Set<string>>();

+  function memoryEvidenceRef(memory: LongTermMemoryEntry): MemoryEvidenceRef {
+    return {
+      memoryId: memory.id,
+      memoryKeyHash: memoryKey(memory),
+      identityKeyHash: workspaceMemoryIdentityKey(memory),
+      type: memory.type,
+      source: memory.source,
+      status: memory.status,
+    };
+  }
+
+  function pendingAppendedEvidence(memory: LongTermMemoryEntry): EvidenceEventInput {
+    return {
+      type: "pending_memory_appended",
+      phase: "pending_journal",
+      outcome: "accepted",
+      memory: memoryEvidenceRef(memory),
+      relations: [{ role: "pending", memory: memoryEvidenceRef(memory) }],
+      reasonCodes: ["pending_journal_append"],
+      textPreview: memory.text,
+    };
+  }
+
  function pruneFrozenWorkspaceMemoryCache(now = Date.now()): void {
    for (const [sessionID, cached] of frozenWorkspaceMemoryCache) {
      if (now - cached.loadedAt > WORKSPACE_MEMORY_CACHE_LIMITS.frozenTtlMs) {
@@ -254,7 +298,14 @@ export const MemoryV2Plugin: Plugin = async (input) => {

    if (!latestMessage?.id || processedForSession.has(latestMessage.id)) return;

-    const memories = extractExplicitMemories(latestMessage.text).map(memory => ({
+    const extraction = extractExplicitMemoriesWithEvidence(latestMessage.text);
+    await appendEvidenceEvents(directory, extraction.evidence.map(event => ({
+      ...event,
+      sessionHash: sessionID,
+      messageHash: latestMessage.id,
+    })));
+
+    const memories = extraction.entries.map(memory => ({
      ...memory,
      pendingOwnerSessionID: sessionID,
      pendingMessageID: latestMessage.id,
@@ -267,6 +318,11 @@ export const MemoryV2Plugin: Plugin = async (input) => {
        return state;
      });
      await appendPendingMemories(directory, memories);
+      await appendEvidenceEvents(directory, memories.map(memory => ({
+        ...pendingAppendedEvidence(memory),
+        sessionHash: sessionID,
+        messageHash: latestMessage.id,
+      })));
    }

    if (decisions.length > 0) {
@@ -285,6 +341,22 @@ export const MemoryV2Plugin: Plugin = async (input) => {
    rememberProcessedUserMessage(sessionID, latestMessage.id, processedForSession);
  }

+  function dedupePendingPromotionMemories(
+    memories: LongTermMemoryEntry[],
+  ): LongTermMemoryEntry[] {
+    const seen = new Set<string>();
+    const deduped: LongTermMemoryEntry[] = [];
+
+    for (const memory of memories) {
+      const key = memoryKey(memory);
+      if (seen.has(key)) continue;
+      seen.add(key);
+      deduped.push(memory);
+    }
+
+    return deduped;
+  }
+
  async function promotePendingMemories(
    sessionID?: string,
    options: { includeUnownedJournal?: boolean; includeOwnedJournal?: boolean } = {},
@@ -302,10 +374,10 @@ export const MemoryV2Plugin: Plugin = async (input) => {
      return false;
    });

-    const pending = [
+    const pending = dedupePendingPromotionMemories([
      ...(sessionState?.pendingMemories ?? []),
      ...journalPending,
-    ];
+    ]);
    if (pending.length === 0) return;

    let beforeEntries: Awaited<ReturnType<typeof loadWorkspaceMemory>>["entries"] = [];
@@ -364,6 +436,20 @@ export const MemoryV2Plugin: Plugin = async (input) => {
      },
    );

+    await appendEvidenceEvents(directory, [
+      ...updateResult.evidence,
+      ...promotionAccountingEvidenceEvents({
+        pending,
+        after: updateResult.store.entries,
+        events: updateResult.events,
+        accounting,
+        exhaustedRejectedKeys,
+      }),
+    ].map(event => ({
+      ...event,
+      sessionHash: sessionID,
+    })));
+
    const sessionRemovalKeys = new Set([
      ...accounting.clearableKeys,
      ...exhaustedRejectedKeys,
@@ -438,7 +524,12 @@ export const MemoryV2Plugin: Plugin = async (input) => {
    }

    const store = await loadWorkspaceMemory(root);
-    const renderedPrompt = renderWorkspaceMemory(store);
+    const renderAccounting = accountWorkspaceMemoryRender(store);
+    const renderedPrompt = renderAccounting.prompt;
+    await appendEvidenceEvents(root, renderAccounting.evidence.map(event => ({
+      ...event,
+      sessionHash: sessionID,
+    })));
    frozenWorkspaceMemoryCache.set(sessionID, { store, renderedPrompt, loadedAt: now });
    pruneFrozenWorkspaceMemoryCache(now);
    return { store, renderedPrompt };
@@ -462,38 +553,42 @@ export const MemoryV2Plugin: Plugin = async (input) => {
      const { sessionID } = hookInput;
      if (!sessionID) return;

-      pruneFrozenWorkspaceMemoryCache();
-      pruneProcessedUserMessagesCache();
+      try {
+        pruneFrozenWorkspaceMemoryCache();
+        pruneProcessedUserMessagesCache();

-      // Sub-agents are short-lived - skip memory system
-      if (await isSubAgent(sessionID)) return;
+        // Sub-agents are short-lived - skip memory system
+        if (await isSubAgent(sessionID)) return;

-      // Process explicit user memory even on no-tool turns. Keep this after the
-      // sub-agent guard so child sessions never append to the parent journal.
-      await processLatestUserMessage(sessionID);
+        // Process explicit user memory even on no-tool turns. Keep this after the
+        // sub-agent guard so child sessions never append to the parent journal.
+        await processLatestUserMessage(sessionID);

-      // Before first snapshot in this session, promote durable unowned backlog from
-      // prior sessions. Current-turn owned explicit memory remains pending and only
-      // appears in hot state for this transform.
-      if (!frozenWorkspaceMemoryCache.has(sessionID) && await hasPendingJournalEntries(directory)) {
-        await promotePendingMemories(undefined, { includeUnownedJournal: true, includeOwnedJournal: false });
-      }
+        // Before first snapshot in this session, promote durable unowned backlog from
+        // prior sessions. Current-turn owned explicit memory remains pending and only
+        // appears in hot state for this transform.
+        if (!frozenWorkspaceMemoryCache.has(sessionID) && await hasPendingJournalEntries(directory)) {
+          await promotePendingMemories(undefined, { includeUnownedJournal: true, includeOwnedJournal: false });
+        }

-      // Get frozen workspace memory snapshot (loaded and rendered once per session)
-      const workspaceSnapshot = await getFrozenWorkspaceMemorySnapshot(directory, sessionID);
+        // Get frozen workspace memory snapshot (loaded and rendered once per session)
+        const workspaceSnapshot = await getFrozenWorkspaceMemorySnapshot(directory, sessionID);

-      // Get current hot session state
-      const sessionState = await loadSessionState(directory, sessionID);
+        // Get current hot session state
+        const sessionState = await loadSessionState(directory, sessionID);

-      // Inject frozen workspace memory snapshot
-      if (workspaceSnapshot.renderedPrompt) {
-        output.system.push(workspaceSnapshot.renderedPrompt);
-      }
+        // Inject frozen workspace memory snapshot
+        if (workspaceSnapshot.renderedPrompt) {
+          output.system.push(workspaceSnapshot.renderedPrompt);
+        }

-      // Render and inject hot session state
-      const hotPrompt = renderHotSessionState(sessionState, directory);
-      if (hotPrompt) {
-        output.system.push(hotPrompt);
+        // Render and inject hot session state
+        const hotPrompt = renderHotSessionState(sessionState, directory);
+        if (hotPrompt) {
+          output.system.push(hotPrompt);
+        }
+      } catch (error) {
+        await warnMemoryHook("chat.system.transform", error, directory);
      }
    },

@@ -506,50 +601,54 @@ export const MemoryV2Plugin: Plugin = async (input) => {
      // Sub-agents don't need memory tracking
      if (await isSubAgent(sessionID)) return;

-      await updateSessionState(directory, sessionID, state => {
-        // Track active files from tool usage
-        if (toolName === "read" || toolName === "edit" || toolName === "write" || toolName === "grep") {
-          const files = extractActiveFiles(
-            toolName,
-            args as Record<string, unknown>,
-            toolOutput ?? ""
-          );
-          for (const { path, action } of files) {
-            touchActiveFile(state, path, action);
-            if (action === "edit" || action === "write") {
-              markErrorsMaybeFixedForFile(state, path, directory);
+      try {
+        await updateSessionState(directory, sessionID, state => {
+          // Track active files from tool usage
+          if (toolName === "read" || toolName === "edit" || toolName === "write" || toolName === "grep") {
+            const files = extractActiveFiles(
+              toolName,
+              args as Record<string, unknown>,
+              toolOutput ?? ""
+            );
+            for (const { path, action } of files) {
+              touchActiveFile(state, path, action);
+              if (action === "edit" || action === "write") {
+                markErrorsMaybeFixedForFile(state, path, directory);
+              }
            }
          }
-        }

-        // Track errors from failed bash commands
-        if (toolName === "bash") {
-          const argsRecord = args as Record<string, unknown>;
-          const command: string = typeof argsRecord?.command === "string"
-            ? argsRecord.command
-            : "";
-          const outputText: string = toolOutput ?? "";
+          // Track errors from failed bash commands
+          if (toolName === "bash") {
+            const argsRecord = args as Record<string, unknown>;
+            const command: string = typeof argsRecord?.command === "string"
+              ? argsRecord.command
+              : "";
+            const outputText: string = toolOutput ?? "";

-          // Check if command succeeded - clear errors for that category
-          const exitCode = bashExitCode(hookOutput);
-          if (typeof exitCode !== "number") {
-            // Unknown exit status: do not extract and do not clear
-          } else if (exitCode === 0 && command) {
-            clearErrorsForSuccessfulCommand(state, command);
-          } else if (command) {
-            // Only extract errors for commands with explicit non-zero exit
-            const errors = extractErrorsFromBash(command, outputText);
-            for (const error of errors) {
-              upsertOpenError(state, error);
+            // Check if command succeeded - clear errors for that category
+            const exitCode = bashExitCode(hookOutput);
+            if (typeof exitCode !== "number") {
+              // Unknown exit status: do not extract and do not clear
+            } else if (exitCode === 0 && command) {
+              clearErrorsForSuccessfulCommand(state, command);
+            } else if (command) {
+              // Only extract errors for commands with explicit non-zero exit
+              const errors = extractErrorsFromBash(command, outputText);
+              for (const error of errors) {
+                upsertOpenError(state, error);
+              }
            }
          }
-        }
-        return state;
-      });
+          return state;
+        });

-      // Process explicit memory from latest user message
-      // Only process once per message ID
-      await processLatestUserMessage(sessionID);
+        // Process explicit memory from latest user message
+        // Only process once per message ID
+        await processLatestUserMessage(sessionID);
+      } catch (error) {
+        await warnMemoryHook("tool.execute.after", error, directory);
+      }
    },

    /**
@@ -567,95 +666,108 @@ export const MemoryV2Plugin: Plugin = async (input) => {
      const { sessionID } = hookInput;
      if (!sessionID) return;

-      // Sub-agents don't need compaction support
-      if (await isSubAgent(sessionID)) return;
+      try {
+        // Sub-agents don't need compaction support
+        if (await isSubAgent(sessionID)) return;

-      // Preserve context injected by other plugins that ran before us.
-      // Setting output.prompt bypasses the default prompt + context join,
-      // so we must explicitly carry forward any existing output.context.
-      const otherContext = output.context.filter(Boolean).join("\n\n");
+        // Preserve context injected by other plugins that ran before us.
+        // Setting output.prompt bypasses the default prompt + context join,
+        // so we must explicitly carry forward any existing output.context.
+        const otherContext = output.context.filter(Boolean).join("\n\n");

-      // Build our private context (workspace memory, hot state, todos)
-      const contextParts: string[] = [];
+        // Build our private context (workspace memory, hot state, todos)
+        const contextParts: string[] = [];

      // 1. Frozen workspace memory snapshot
-      const workspaceSnapshot = await getFrozenWorkspaceMemorySnapshot(directory, sessionID);
-      if (workspaceSnapshot.renderedPrompt) {
-        contextParts.push(workspaceSnapshot.renderedPrompt);
+        const workspaceSnapshot = await getFrozenWorkspaceMemorySnapshot(directory, sessionID);
+        if (workspaceSnapshot.renderedPrompt) {
+          contextParts.push(workspaceSnapshot.renderedPrompt);
+        }
+
+        // 2. Hot session state
+        const sessionState = await loadSessionState(directory, sessionID);
+        const hotPrompt = renderHotSessionState(sessionState, directory);
+        if (hotPrompt) {
+          contextParts.push(hotPrompt);
+        }
+
+        // 3. Pending todos from OpenCode
+        const todos = await pendingTodos(client, sessionID);
+        const todosPrompt = renderTodosForCompaction(todos);
+        if (todosPrompt) {
+          contextParts.push(todosPrompt);
+        }
+
+        // Combine: other plugins' context first, then our private context
+        const privateContext = [otherContext, ...contextParts]
+          .filter(Boolean)
+          .join("\n\n");
+
+        // Replace the default prompt entirely with our ---free template
+        output.prompt = buildCompactionPrompt(privateContext);
+
+        // Clear context array since we consumed it into output.prompt.
+        // Subsequent plugins that set output.prompt will also need to check
+        // output.context if they want to preserve other plugin contributions.
+        output.context.length = 0;
+      } catch (error) {
+        await warnMemoryHook("session.compacting", error, directory);
      }
-
-      // 2. Hot session state
-      const sessionState = await loadSessionState(directory, sessionID);
-      const hotPrompt = renderHotSessionState(sessionState, directory);
-      if (hotPrompt) {
-        contextParts.push(hotPrompt);
-      }
-
-      // 3. Pending todos from OpenCode
-      const todos = await pendingTodos(client, sessionID);
-      const todosPrompt = renderTodosForCompaction(todos);
-      if (todosPrompt) {
-        contextParts.push(todosPrompt);
-      }
-
-      // Combine: other plugins' context first, then our private context
-      const privateContext = [otherContext, ...contextParts]
-        .filter(Boolean)
-        .join("\n\n");
-
-      // Replace the default prompt entirely with our ---free template
-      output.prompt = buildCompactionPrompt(privateContext);
-
-      // Clear context array since we consumed it into output.prompt.
-      // Subsequent plugins that set output.prompt will also need to check
-      // output.context if they want to preserve other plugin contributions.
-      output.context.length = 0;
    },

    // Handle session events
    event: async ({ event }) => {
      if (event.type === "session.compacted") {
-        const sessionID = sessionIDFromEventProperties(event.properties);
-        if (!sessionID) return;
-
-        // Sub-agents don't need post-compaction processing
-        if (await isSubAgent(sessionID)) return;
-
-        // Parse latest compaction summary for memory candidates, stage them into
-        // durable pending journal, then promote pending memories.
-        const summary = await latestCompactionSummary(client, sessionID);
-        const candidates = summary ? parseWorkspaceMemoryCandidates(summary) : [];
-        if (candidates.length > 0) {
-          await appendPendingMemories(directory, candidates);
-        }
-
        try {
+          const sessionID = sessionIDFromEventProperties(event.properties);
+          if (!sessionID) return;
+
+          // Sub-agents don't need post-compaction processing
+          if (await isSubAgent(sessionID)) return;
+
+          // Parse latest compaction summary for memory candidates, stage them into
+          // durable pending journal, then promote pending memories.
+          const summary = await latestCompactionSummary(client, sessionID);
+          const parseResult = summary ? parseWorkspaceMemoryCandidatesWithEvidence(summary) : { entries: [], evidence: [] };
+          await appendEvidenceEvents(directory, parseResult.evidence.map(event => ({
+            ...event,
+            sessionHash: sessionID,
+          })));
+          const candidates = parseResult.entries;
+          if (candidates.length > 0) {
+            await appendPendingMemories(directory, candidates);
+            await appendEvidenceEvents(directory, candidates.map(memory => ({
+              ...pendingAppendedEvidence(memory),
+              sessionHash: sessionID,
+            })));
+          }
+
          await promotePendingMemories(sessionID, { includeUnownedJournal: true });
-        } catch {
+        } catch (error) {
          // Keep pending memories in session/journal for retry on next event/session.
+          await warnMemoryHook("event.session.compacted", error, directory);
        }
      }

      if (event.type === "session.deleted") {
-        const sessionID = sessionIDFromEventProperties(event.properties);
-        if (sessionID) {
+        try {
+          const sessionID = sessionIDFromEventProperties(event.properties);
+          if (sessionID) {
          // Promote pending memories before deleting per-session state.
          // If promotion fails, leave session state and journal intact.
-          let promoted = false;
-          try {
+            let promoted = false;
            await promotePendingMemories(sessionID, { includeOwnedJournal: true, includeUnownedJournal: false });
            promoted = true;
-          } catch {
-            return;
-          } finally {
            if (promoted) {
              frozenWorkspaceMemoryCache.delete(sessionID);
              processedUserMessages.delete(sessionID);
              sessionParentCache.delete(sessionID);
            }
-          }

-          await rm(await sessionStatePath(directory, sessionID), { force: true });
+            await rm(await sessionStatePath(directory, sessionID), { force: true });
+          }
+        } catch (error) {
+          await warnMemoryHook("event.session.deleted", error, directory);
        }
      }
    },
@@ -2,6 +2,7 @@ import type { LongTermMemoryEntry } from "./types.ts";
 import { memoryKey } from "./pending-journal.ts";
 import type { MemoryConsolidationEvent } from "./workspace-memory.ts";
 import { workspaceMemoryIdentityKey } from "./workspace-memory.ts";
+import type { EvidenceEventInput, MemoryEvidenceRef } from "./evidence-log.ts";

 export type PendingPromotionAccounting = {
  promotedKeys: Set<string>;
@@ -105,3 +106,118 @@ export function accountPendingPromotions(input: {
    clearableKeys,
  };
 }
+
+function memoryRef(memory: LongTermMemoryEntry | undefined): MemoryEvidenceRef | undefined {
+  if (!memory) return undefined;
+  return {
+    memoryId: memory.id,
+    memoryKeyHash: memoryKey(memory),
+    identityKeyHash: workspaceMemoryIdentityKey(memory),
+    type: memory.type,
+    source: memory.source,
+    status: memory.status,
+  };
+}
+
+function retainedMemoryFor(
+  pending: LongTermMemoryEntry,
+  event: MemoryConsolidationEvent | undefined,
+  after: LongTermMemoryEntry[],
+): LongTermMemoryEntry | undefined {
+  if (event?.retainedId) {
+    const byId = after.find(memory => memory.id === event.retainedId);
+    if (byId) return byId;
+  }
+
+  const exactKey = memoryKey(pending);
+  const identityKey = workspaceMemoryIdentityKey(pending);
+  return after.find(memory => memory.status !== "superseded" && (
+    memoryKey(memory) === exactKey || workspaceMemoryIdentityKey(memory) === identityKey
+  ));
+}
+
+function promotionEventBase(
+  type: EvidenceEventInput["type"],
+  outcome: EvidenceEventInput["outcome"],
+  memory: LongTermMemoryEntry,
+  reasonCodes: string[],
+): EvidenceEventInput {
+  return {
+    type,
+    phase: "promotion",
+    outcome,
+    memory: memoryRef(memory),
+    reasonCodes,
+    textPreview: memory.text,
+  };
+}
+
+export function promotionAccountingEvidenceEvents(input: {
+  pending: LongTermMemoryEntry[];
+  after: LongTermMemoryEntry[];
+  events?: MemoryConsolidationEvent[];
+  accounting: PendingPromotionAccounting;
+  exhaustedRejectedKeys?: Set<string>;
+}): EvidenceEventInput[] {
+  const terminalByKey = new Map((input.events ?? []).map(event => [event.memoryKey, event]));
+  const exhaustedRejectedKeys = input.exhaustedRejectedKeys ?? new Set<string>();
+  const evidence: EvidenceEventInput[] = [];
+
+  for (const pending of input.pending) {
+    const key = memoryKey(pending);
+    const terminal = terminalByKey.get(key);
+    const retained = retainedMemoryFor(pending, terminal, input.after);
+
+    if (input.accounting.promotedKeys.has(key)) {
+      evidence.push({
+        ...promotionEventBase("promotion_promoted", "promoted", pending, ["new_workspace_entry"]),
+        relations: [
+          { role: "promoted", memory: memoryRef(retained ?? pending) },
+        ],
+      });
+      continue;
+    }
+
+    if (input.accounting.absorbedKeys.has(key)) {
+      const exact = terminal?.reason !== "absorbed_identity";
+      evidence.push({
+        ...promotionEventBase(
+          exact ? "promotion_absorbed_exact" : "promotion_absorbed_identity",
+          "absorbed",
+          pending,
+          [exact ? "same_exact_key" : "same_identity_key"],
+        ),
+        relations: [
+          { role: "absorbed" as const, memory: memoryRef(pending) },
+          { role: "retained" as const, memory: memoryRef(retained) },
+        ].filter(relation => relation.memory),
+      });
+      continue;
+    }
+
+    if (input.accounting.supersededKeys.has(key)) {
+      evidence.push({
+        ...promotionEventBase("promotion_superseded", "superseded", pending, ["superseded_existing"]),
+        relations: [
+          { role: "superseded" as const, memory: memoryRef(pending) },
+          { role: "superseded_by" as const, memory: memoryRef(retained) },
+        ].filter(relation => relation.memory),
+      });
+      continue;
+    }
+
+    if (input.accounting.rejectedKeys.has(key)) {
+      evidence.push(promotionEventBase("promotion_rejected_capacity", "rejected", pending, ["capacity_rejected"]));
+      if (input.accounting.retryableRejectedKeys.has(key)) {
+        evidence.push(promotionEventBase(
+          exhaustedRejectedKeys.has(key) ? "promotion_retry_exhausted" : "promotion_retry_scheduled",
+          exhaustedRejectedKeys.has(key) ? "exhausted" : "retried",
+          pending,
+          [exhaustedRejectedKeys.has(key) ? "max_attempts_reached" : "retryable_capacity_rejection"],
+        ));
+      }
+    }
+  }
+
+  return evidence;
+}
@@ -0,0 +1,148 @@
+import type { LongTermMemoryEntry, WorkspaceMemoryStore } from "./types.ts";
+
+// Retention decay model constants (v1.5)
+export const BASE_HALF_LIFE_DAYS = 45;
+export const REINFORCEMENT_HALFLIFE_FACTOR = 0.85;
+export const REINFORCEMENT_MAX_COUNT = 6;
+export const REINFORCEMENT_MIN_INTERVAL_MS = 60 * 60 * 1000; // 1 hour
+export const WORKSPACE_DORMANT_AFTER_DAYS = 14;
+export const DORMANT_DECAY_MULTIPLIER = 0.25;
+export const DAY_MS = 24 * 60 * 60 * 1000;
+
+export const TYPE_FACTOR = {
+  reference: 1.0,
+  project: 1.25,
+  feedback: 2.25,
+  decision: 2.5,
+} as const;
+
+export const SOURCE_FACTOR = {
+  compaction: 1.0,
+  manual: 1.4,
+  explicit: 2.0,
+} as const;
+
+export const USER_IMPORTANCE_FACTOR = {
+  low: 0.7,
+  normal: 1.0,
+  high: 1.5,
+} as const;
+
+export const RETENTION_TYPE_MAX = {
+  feedback: 10,
+  decision: 10,
+  project: 8,
+  reference: 6,
+} as const;
+
+export function calculateInitialStrength(memory: LongTermMemoryEntry): number {
+  const typeFactor = TYPE_FACTOR[memory.type] ?? 1.0;
+  const sourceFactor = SOURCE_FACTOR[memory.source] ?? 1.0;
+  const importanceFactor = USER_IMPORTANCE_FACTOR[memory.userImportance ?? "normal"] ?? 1.0;
+
+  return typeFactor * sourceFactor * importanceFactor;
+}
+
+export function calculateEffectiveHalfLife(memory: LongTermMemoryEntry): number {
+  const reinforcementCount = Math.min(
+    memory.reinforcementCount ?? 0,
+    REINFORCEMENT_MAX_COUNT,
+  );
+  const factor = Math.pow(REINFORCEMENT_HALFLIFE_FACTOR, reinforcementCount);
+  return BASE_HALF_LIFE_DAYS / factor;
+}
+
+function timestampMs(value: unknown, fallback: number): number {
+  const ms = typeof value === "number" ? value : new Date(String(value)).getTime();
+  return Number.isFinite(ms) ? ms : fallback;
+}
+
+export function calculateRetentionStrength(
+  memory: LongTermMemoryEntry,
+  now: number,
+  lastActivityAt?: string,
+): number {
+  const initialStrength = calculateInitialStrength(memory);
+  const effectiveHalfLife = calculateEffectiveHalfLife(memory);
+
+  // Use retentionClock if available, fallback to updatedAt.
+  const retentionStart = Number.isFinite(memory.retentionClock)
+    ? memory.retentionClock
+    : memory.updatedAt ?? memory.createdAt;
+  const createdAtMs = timestampMs(retentionStart, now);
+  const effectiveAgeDays = calculateEffectiveAgeDays(createdAtMs, now, lastActivityAt);
+
+  // Calculate strength using exponential decay.
+  const strength = initialStrength * Math.pow(2, -effectiveAgeDays / effectiveHalfLife);
+
+  return Number.isFinite(strength) ? Math.max(0, strength) : 0;
+}
+
+export function calculateDormantDays(store: WorkspaceMemoryStore, now: number): number {
+  const lastActivity = store.lastActivityAt
+    ? new Date(store.lastActivityAt).getTime()
+    : now;
+  if (!Number.isFinite(lastActivity)) return 0;
+
+  const daysSinceActivity = (now - lastActivity) / DAY_MS;
+  return Math.max(0, daysSinceActivity);
+}
+
+export function calculateEffectiveAgeDays(
+  entryStartMs: number,
+  now: number,
+  lastActivityAt?: string,
+): number {
+  const wallAgeDays = Math.max(0, (now - entryStartMs) / DAY_MS);
+
+  if (!lastActivityAt) return wallAgeDays;
+
+  const lastActivityMs = new Date(lastActivityAt).getTime();
+  if (!Number.isFinite(lastActivityMs)) return wallAgeDays;
+
+  const dormantStartMs = lastActivityMs + WORKSPACE_DORMANT_AFTER_DAYS * DAY_MS;
+  const overlapStartMs = Math.max(entryStartMs, dormantStartMs);
+  const dormantOverlapDays = Math.max(0, (now - overlapStartMs) / DAY_MS);
+  const activeDays = wallAgeDays - dormantOverlapDays;
+
+  return activeDays + dormantOverlapDays * DORMANT_DECAY_MULTIPLIER;
+}
+
+function isSameUTCCalendarDay(ts1: number, ts2: number): boolean {
+  const d1 = new Date(ts1);
+  const d2 = new Date(ts2);
+  return d1.getUTCFullYear() === d2.getUTCFullYear()
+    && d1.getUTCMonth() === d2.getUTCMonth()
+    && d1.getUTCDate() === d2.getUTCDate();
+}
+
+export function reinforceMemory(
+  memory: LongTermMemoryEntry,
+  sessionId: string,
+  now: number,
+): LongTermMemoryEntry {
+  if (memory.lastReinforcedSessionID === sessionId) {
+    return memory;
+  }
+
+  // Calendar-day diversity gate (OQ-2): same UTC day = no reinforcement.
+  if (memory.lastReinforcedAt && isSameUTCCalendarDay(memory.lastReinforcedAt, now)) {
+    return memory;
+  }
+
+  if (memory.lastReinforcedAt && now - memory.lastReinforcedAt < REINFORCEMENT_MIN_INTERVAL_MS) {
+    return memory;
+  }
+
+  if ((memory.reinforcementCount ?? 0) >= REINFORCEMENT_MAX_COUNT) {
+    return memory;
+  }
+
+  return {
+    ...memory,
+    reinforcementCount: (memory.reinforcementCount ?? 0) + 1,
+    lastReinforcedAt: now,
+    lastReinforcedSessionID: sessionId,
+    retentionClock: now,
+  };
+}
@@ -3,17 +3,66 @@ import { randomUUID } from "crypto";
 import { mkdir, open, readFile, rename, rm, stat, writeFile } from "fs/promises";
 import type { FileHandle } from "fs/promises";
 import { dirname } from "path";
+import { appendEvidenceEventForWorkspaceKey } from "./evidence-log.ts";

 const fileLocks = new Map<string, Promise<unknown>>();
 const LOCK_WAIT_TIMEOUT_MS = 5000;
 const LOCK_STALE_MS = 30_000;
 const LOCK_HEARTBEAT_MS = 1_000;

+function workspaceKeyFromStorePath(path: string): string | undefined {
+  return path.match(/[\\/]opencode-working-memory[\\/]workspaces[\\/]([a-f0-9]{16})[\\/]/i)?.[1];
+}
+
+function storeKindFromPath(path: string): string {
+  if (path.endsWith("workspace-memory.json")) return "workspace_memory";
+  if (path.endsWith("workspace-pending-journal.json")) return "pending_journal";
+  if (path.includes(`${"/"}sessions${"/"}`) || path.includes(`${"\\"}sessions${"\\"}`)) return "session_state";
+  return "unknown";
+}
+
+async function emitStorageEvidence(path: string, event: Parameters<typeof appendEvidenceEventForWorkspaceKey>[1]): Promise<void> {
+  const key = workspaceKeyFromStorePath(path);
+  if (!key) return;
+  await appendEvidenceEventForWorkspaceKey(key, event).catch(() => undefined);
+}
+
+async function quarantineCorruptJSON(path: string): Promise<string | null> {
+  const quarantinePath = `${path}.corrupt-${Date.now()}-${process.pid}-${randomUUID()}`;
+
+  try {
+    await rename(path, quarantinePath);
+    return quarantinePath;
+  } catch {
+    return null;
+  }
+}
+
 export async function readJSON<T>(path: string, fallback: () => T): Promise<T> {
  if (!existsSync(path)) return fallback();
+
  try {
    return JSON.parse(await readFile(path, "utf8")) as T;
-  } catch {
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const quarantinePath = await quarantineCorruptJSON(path);
+
+    if (quarantinePath) {
+      console.error(`[memory] invalid JSON in ${path}; quarantined to ${quarantinePath}: ${message}`);
+      await emitStorageEvidence(path, {
+        type: "storage_corrupt_json_quarantined",
+        phase: "storage",
+        outcome: "quarantined",
+        reasonCodes: ["invalid_json"],
+        details: {
+          storeKind: storeKindFromPath(path),
+          quarantined: true,
+        },
+      });
+    } else {
+      console.error(`[memory] invalid JSON in ${path}; using fallback without quarantine: ${message}`);
+    }
+
    return fallback();
  }
 }
@@ -82,10 +131,30 @@ async function withFileLock<T>(path: string, fn: () => Promise<T>): Promise<T> {

      if (await isLockStale(lockPath)) {
        await rm(lockPath, { force: true });
+        await emitStorageEvidence(path, {
+          type: "storage_stale_lock_recovered",
+          phase: "storage",
+          outcome: "recovered",
+          reasonCodes: ["stale_lock"],
+          details: {
+            storeKind: storeKindFromPath(path),
+            waitMs: Date.now() - started,
+          },
+        });
        continue;
      }

      if (Date.now() - started > LOCK_WAIT_TIMEOUT_MS) {
+        await emitStorageEvidence(path, {
+          type: "storage_lock_timeout",
+          phase: "storage",
+          outcome: "failed",
+          reasonCodes: ["lock_wait_timeout"],
+          details: {
+            storeKind: storeKindFromPath(path),
+            waitMs: LOCK_WAIT_TIMEOUT_MS,
+          },
+        });
        throw new Error(`Timed out waiting for lock ${lockPath}`);
      }

@@ -6,149 +6,18 @@ import { migrationLogPath, workspaceKey, workspaceMemoryPath } from "./paths.ts"
 import { atomicWriteJSON, readJSON, updateJSON } from "./storage.ts";
 import { assessMemoryQuality, isHardQualityReason, isProgressSnapshotViolation } from "./memory-quality.ts";
 import { redactCredentials } from "./redaction.ts";
+import {
+  RETENTION_TYPE_MAX,
+  calculateRetentionStrength,
+  reinforceMemory,
+} from "./retention.ts";
+import type { EvidenceEventInput, MemoryEvidenceRef } from "./evidence-log.ts";

 // Minimum length for workspace_memory envelope: <workspace_memory>\n...\n</workspace_memory>
 const MIN_ENVELOPE_LENGTH = 80;
 const MIGRATION_ID = "2026-04-26-p0-cleanup";
 const QUALITY_CLEANUP_MIGRATION_ID = "2026-04-28-quality-cleanup";

-// Retention decay model constants (v1.5)
-const BASE_HALF_LIFE_DAYS = 45;
-const REINFORCEMENT_HALFLIFE_FACTOR = 0.85;
-const REINFORCEMENT_MAX_COUNT = 6;
-const REINFORCEMENT_MIN_INTERVAL_MS = 60 * 60 * 1000; // 1 hour
-const WORKSPACE_DORMANT_AFTER_DAYS = 14;
-const DORMANT_DECAY_MULTIPLIER = 0.25;
-const DAY_MS = 24 * 60 * 60 * 1000;
-
-const TYPE_FACTOR = {
-  reference: 1.0,
-  project: 1.25,
-  feedback: 2.25,
-  decision: 2.5,
-} as const;
-
-const SOURCE_FACTOR = {
-  compaction: 1.0,
-  manual: 1.4,
-  explicit: 2.0,
-} as const;
-
-const USER_IMPORTANCE_FACTOR = {
-  low: 0.7,
-  normal: 1.0,
-  high: 1.5,
-} as const;
-
-const SAFETY_CRITICAL_FACTOR = 6.0;
-
-const TYPE_MAX = {
-  feedback: 10,
-  decision: 10,
-  project: 8,
-  reference: 6,
-} as const;
-
-export function calculateInitialStrength(memory: LongTermMemoryEntry): number {
-  const typeFactor = TYPE_FACTOR[memory.type] ?? 1.0;
-  const sourceFactor = SOURCE_FACTOR[memory.source] ?? 1.0;
-  const importanceFactor = USER_IMPORTANCE_FACTOR[memory.userImportance ?? "normal"] ?? 1.0;
-  const safetyFactor = memory.safetyCritical ? SAFETY_CRITICAL_FACTOR : 1.0;
-
-  return typeFactor * sourceFactor * importanceFactor * safetyFactor;
-}
-
-export function calculateEffectiveHalfLife(memory: LongTermMemoryEntry): number {
-  const reinforcementCount = Math.min(
-    memory.reinforcementCount ?? 0,
-    REINFORCEMENT_MAX_COUNT,
-  );
-  const factor = Math.pow(REINFORCEMENT_HALFLIFE_FACTOR, reinforcementCount);
-  return BASE_HALF_LIFE_DAYS / factor;
-}
-
-function timestampMs(value: unknown, fallback: number): number {
-  const ms = typeof value === "number" ? value : new Date(String(value)).getTime();
-  return Number.isFinite(ms) ? ms : fallback;
-}
-
-export function calculateRetentionStrength(
-  memory: LongTermMemoryEntry,
-  now: number,
-  lastActivityAt?: string,
-): number {
-  const initialStrength = calculateInitialStrength(memory);
-  const effectiveHalfLife = calculateEffectiveHalfLife(memory);
-
-  // Use retentionClock if available, fallback to updatedAt.
-  const retentionStart = Number.isFinite(memory.retentionClock)
-    ? memory.retentionClock
-    : memory.updatedAt ?? memory.createdAt;
-  const createdAtMs = timestampMs(retentionStart, now);
-  const effectiveAgeDays = calculateEffectiveAgeDays(createdAtMs, now, lastActivityAt);
-
-  // Calculate strength using exponential decay.
-  const strength = initialStrength * Math.pow(2, -effectiveAgeDays / effectiveHalfLife);
-
-  return Number.isFinite(strength) ? Math.max(0, strength) : 0;
-}
-
-export function calculateDormantDays(store: WorkspaceMemoryStore, now: number): number {
-  const lastActivity = store.lastActivityAt
-    ? new Date(store.lastActivityAt).getTime()
-    : now;
-  if (!Number.isFinite(lastActivity)) return 0;
-
-  const daysSinceActivity = (now - lastActivity) / DAY_MS;
-  return Math.max(0, daysSinceActivity);
-}
-
-export function calculateEffectiveAgeDays(
-  entryStartMs: number,
-  now: number,
-  lastActivityAt?: string,
-): number {
-  const wallAgeDays = Math.max(0, (now - entryStartMs) / DAY_MS);
-
-  if (!lastActivityAt) return wallAgeDays;
-
-  const lastActivityMs = new Date(lastActivityAt).getTime();
-  if (!Number.isFinite(lastActivityMs)) return wallAgeDays;
-
-  const dormantStartMs = lastActivityMs + WORKSPACE_DORMANT_AFTER_DAYS * DAY_MS;
-  const overlapStartMs = Math.max(entryStartMs, dormantStartMs);
-  const dormantOverlapDays = Math.max(0, (now - overlapStartMs) / DAY_MS);
-  const activeDays = wallAgeDays - dormantOverlapDays;
-
-  return activeDays + dormantOverlapDays * DORMANT_DECAY_MULTIPLIER;
-}
-
-export function reinforceMemory(
-  memory: LongTermMemoryEntry,
-  sessionId: string,
-  now: number,
-): LongTermMemoryEntry {
-  if (memory.lastReinforcedSessionID === sessionId) {
-    return memory;
-  }
-
-  if (memory.lastReinforcedAt && now - memory.lastReinforcedAt < REINFORCEMENT_MIN_INTERVAL_MS) {
-    return memory;
-  }
-
-  if ((memory.reinforcementCount ?? 0) >= REINFORCEMENT_MAX_COUNT) {
-    return memory;
-  }
-
-  return {
-    ...memory,
-    reinforcementCount: (memory.reinforcementCount ?? 0) + 1,
-    lastReinforcedAt: now,
-    lastReinforcedSessionID: sessionId,
-    retentionClock: now,
-  };
-}
-
 export type MemoryConsolidationReason =
  | "promoted"
  | "absorbed_exact"
@@ -170,6 +39,7 @@ export type LongTermLimitResult = {
  dropped: MemoryConsolidationEvent[];
  absorbed: MemoryConsolidationEvent[];
  superseded: MemoryConsolidationEvent[];
+  evidence: EvidenceEventInput[];
 };

 export type WorkspaceMemoryNormalizationResult = LongTermLimitResult & {
@@ -177,6 +47,16 @@ export type WorkspaceMemoryNormalizationResult = LongTermLimitResult & {
  events: MemoryConsolidationEvent[];
 };

+export type WorkspaceMemoryRenderAccounting = {
+  rendered: LongTermMemoryEntry[];
+  omitted: Array<{
+    memory: LongTermMemoryEntry;
+    reason: "superseded" | "type_cap" | "global_cap" | "char_budget" | "empty_render_budget";
+  }>;
+  evidence: EvidenceEventInput[];
+  prompt: string;
+};
+
 export type QualityCleanupMigrationLogEntry = {
  migrationId: string;
  timestamp: string;
@@ -288,6 +168,7 @@ export async function updateWorkspaceMemoryWithAccounting(
    dropped: [],
    absorbed: [],
    superseded: [],
+    evidence: [],
    events: [],
  };
 }
@@ -376,6 +257,7 @@ export async function normalizeWorkspaceMemoryWithAccounting(
    dropped: accounting.dropped,
    absorbed: accounting.absorbed,
    superseded: accounting.superseded,
+    evidence: accounting.evidence,
    events: [...accounting.dropped, ...accounting.absorbed, ...accounting.superseded],
  };
 }
@@ -652,34 +534,39 @@ export function enforceLongTermLimitsWithAccounting(
    dropped: [...dedupeResult.dropped, ...capacityDropped],
    absorbed: dedupeResult.absorbed,
    superseded: dedupeResult.superseded,
+    evidence: dedupeResult.evidence,
  };
 }

 function applyTypeMaxCaps(entries: LongTermMemoryEntry[]): LongTermMemoryEntry[] {
+  return applyTypeMaxCapsWithOmissions(entries).kept;
+}
+
+function applyTypeMaxCapsWithOmissions(entries: LongTermMemoryEntry[]): { kept: LongTermMemoryEntry[]; omitted: LongTermMemoryEntry[] } {
  const capped: LongTermMemoryEntry[] = [];
+  const omitted: LongTermMemoryEntry[] = [];
  const typeCounts: Partial<Record<LongTermMemoryEntry["type"], number>> = {};

  for (const entry of entries) {
-    if (entry.safetyCritical) {
-      capped.push(entry);
+    const count = typeCounts[entry.type] ?? 0;
+    const max = RETENTION_TYPE_MAX[entry.type] ?? Infinity;
+    if (count >= max) {
+      omitted.push(entry);
      continue;
    }

-    const count = typeCounts[entry.type] ?? 0;
-    const max = TYPE_MAX[entry.type] ?? Infinity;
-    if (count >= max) continue;
-
    capped.push(entry);
    typeCounts[entry.type] = count + 1;
  }

-  return capped;
+  return { kept: capped, omitted };
 }

 export function dedupeLongTermEntriesWithAccounting(entries: LongTermMemoryEntry[]): LongTermLimitResult {
  const now = Date.now();
  const absorbed: MemoryConsolidationEvent[] = [];
  const superseded: MemoryConsolidationEvent[] = [];
+  const evidence: EvidenceEventInput[] = [];

  // For project/reference/feedback: dedupe by concrete identity or exact canonical text.
  const projectRefEntries = entries.filter(e => e.type === "project" || e.type === "reference" || e.type === "feedback");
@@ -703,6 +590,8 @@ export function dedupeLongTermEntriesWithAccounting(entries: LongTermMemoryEntry
        reinforcementSessionId(retained, dropped),
        now,
      );
+      const reinforcedEvent = reinforcementEvidence(retained, dropped, reinforced, reason);
+      if (reinforcedEvent) evidence.push(reinforcedEvent);

      absorbed.push(consolidationEvent(dropped, reason, reinforced));
      entityDeduped.set(key, reinforced);
@@ -729,6 +618,8 @@ export function dedupeLongTermEntriesWithAccounting(entries: LongTermMemoryEntry
        reinforcementSessionId(retained, dropped),
        now,
      );
+      const reinforcedEvent = reinforcementEvidence(retained, dropped, reinforced, reason);
+      if (reinforcedEvent) evidence.push(reinforcedEvent);

      if (reason === "superseded_existing") {
        superseded.push(consolidationEvent(dropped, reason, reinforced));
@@ -751,6 +642,40 @@ export function dedupeLongTermEntriesWithAccounting(entries: LongTermMemoryEntry
    dropped: [],
    absorbed,
    superseded,
+    evidence,
+  };
+}
+
+function memoryEvidenceRef(memory: LongTermMemoryEntry): MemoryEvidenceRef {
+  return {
+    memoryId: memory.id,
+    memoryKeyHash: workspaceMemoryExactKey(memory),
+    identityKeyHash: workspaceMemoryIdentityKey(memory),
+    type: memory.type,
+    source: memory.source,
+    status: memory.status,
+  };
+}
+
+function reinforcementEvidence(
+  retained: LongTermMemoryEntry,
+  dropped: LongTermMemoryEntry,
+  reinforced: LongTermMemoryEntry,
+  reason: "absorbed_exact" | "absorbed_identity" | "superseded_existing",
+): EvidenceEventInput | undefined {
+  if ((reinforced.reinforcementCount ?? 0) <= (retained.reinforcementCount ?? 0)) return undefined;
+  const duplicateReason = reason === "absorbed_identity" ? "duplicate_identity" : "duplicate_exact";
+  return {
+    type: "memory_reinforced",
+    phase: "reinforcement",
+    outcome: "reinforced",
+    memory: memoryEvidenceRef(reinforced),
+    relations: [
+      { role: "reinforced", memory: memoryEvidenceRef(reinforced) },
+      { role: "reinforced_by", memory: memoryEvidenceRef(dropped) },
+    ],
+    reasonCodes: [duplicateReason, "reinforcement_window_allowed"],
+    textPreview: reinforced.text,
  };
 }

@@ -785,20 +710,49 @@ function wouldFit(
 }

 export function renderWorkspaceMemory(store: WorkspaceMemoryStore): string {
-  const active = enforceLongTermLimitsWithAccounting(store.entries, store).kept;
-  if (active.length === 0) return "";
+  return accountWorkspaceMemoryRender(store).prompt;
+}

+export function accountWorkspaceMemoryRender(store: WorkspaceMemoryStore): WorkspaceMemoryRenderAccounting {
+  const now = Date.now();
  const maxChars = Math.min(
    store.limits.maxRenderedChars,
    LONG_TERM_LIMITS.maxRenderedChars
  );
+  const omitted: WorkspaceMemoryRenderAccounting["omitted"] = [];
+  const evidence: EvidenceEventInput[] = [];
+
+  for (const entry of store.entries) {
+    if (entry.status === "superseded") {
+      omitted.push({ memory: entry, reason: "superseded" });
+    }
+  }
+
+  const activeEntries = store.entries.filter(entry => entry.status !== "superseded");
+  const phase1 = activeEntries.map(entry => ({ ...entry, text: entry.text.slice(0, LONG_TERM_LIMITS.maxEntryTextChars) }));
+  const dedupeResult = dedupeLongTermEntriesWithAccounting(phase1);
+  const sorted = [...dedupeResult.kept].sort((a, b) => compareLongTermMemoryForRetention(a, b, now, store.lastActivityAt));
+  const typeCapResult = applyTypeMaxCapsWithOmissions(sorted);
+  for (const memory of typeCapResult.omitted) omitted.push({ memory, reason: "type_cap" });
+  const active = typeCapResult.kept.slice(0, LONG_TERM_LIMITS.maxEntries);
+  for (const memory of typeCapResult.kept.slice(LONG_TERM_LIMITS.maxEntries)) omitted.push({ memory, reason: "global_cap" });
+
+  if (active.length === 0) {
+    for (const item of omitted) evidence.push(renderEvidence(item.memory, "omitted", item.reason));
+    return { rendered: [], omitted, evidence, prompt: "" };
+  }

  // If maxChars smaller than minimum envelope, return empty string
-  if (maxChars < MIN_ENVELOPE_LENGTH) return "";
+  if (maxChars < MIN_ENVELOPE_LENGTH) {
+    for (const memory of active) omitted.push({ memory, reason: "empty_render_budget" });
+    for (const item of omitted) evidence.push(renderEvidence(item.memory, "omitted", item.reason));
+    return { rendered: [], omitted, evidence, prompt: "" };
+  }

  const lines: string[] = [
    "Workspace memory (cross-session, verify if stale):",
  ];
+  const rendered: LongTermMemoryEntry[] = [];

  for (const type of ["feedback", "project", "decision", "reference"] as const) {
    const items = active.filter(entry => entry.type === type);
@@ -810,6 +764,9 @@ export function renderWorkspaceMemory(store: WorkspaceMemoryStore): string {
      const line = `- ${renderEntry(item)}`;
      if ([...lines, ...sectionLines, line].join("\n").length <= maxChars) {
        sectionLines.push(line);
+        rendered.push(item);
+      } else {
+        omitted.push({ memory: item, reason: "char_budget" });
      }
    }

@@ -818,7 +775,26 @@ export function renderWorkspaceMemory(store: WorkspaceMemoryStore): string {
    }
  }

-  return lines.join("\n");
+  for (const memory of rendered) evidence.push(renderEvidence(memory, "rendered"));
+  for (const item of omitted) evidence.push(renderEvidence(item.memory, "omitted", item.reason));
+
+  return { rendered, omitted, evidence, prompt: lines.join("\n") };
+}
+
+function renderEvidence(
+  memory: LongTermMemoryEntry,
+  outcome: "rendered" | "omitted",
+  reason?: WorkspaceMemoryRenderAccounting["omitted"][number]["reason"],
+): EvidenceEventInput {
+  return {
+    type: outcome === "rendered" ? "render_selected" : "render_omitted",
+    phase: "render",
+    outcome,
+    memory: memoryEvidenceRef(memory),
+    relations: [{ role: outcome === "rendered" ? "rendered" : "omitted", memory: memoryEvidenceRef(memory) }],
+    reasonCodes: outcome === "rendered" ? ["within_caps", "within_char_budget"] : [reason ?? "char_budget"],
+    textPreview: memory.text,
+  };
 }

 function renderEntry(entry: LongTermMemoryEntry): string {
@@ -0,0 +1,245 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
+import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { realpath } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import {
+  EVIDENCE_LOG_LIMITS,
+  appendEvidenceEvent,
+  appendEvidenceEvents,
+  queryEvidenceEvents,
+  summarizeMemoryEvidence,
+  traceMemoryLifecycle,
+  type EvidenceEventInput,
+  type EvidenceEventV1,
+} from "../src/evidence-log.ts";
+import { workspaceEvidenceLogPath, workspaceKey } from "../src/paths.ts";
+
+async function tempRoot(): Promise<string> {
+  return mkdtemp(join(tmpdir(), "opencode-evidence-log-"));
+}
+
+function eventInput(overrides: Partial<EvidenceEventInput> = {}): EvidenceEventInput {
+  return {
+    type: "promotion_promoted",
+    phase: "promotion",
+    outcome: "promoted",
+    reasonCodes: ["new_workspace_entry"],
+    memory: { memoryId: "mem-a", type: "decision", source: "explicit", status: "active" },
+    textPreview: "Use npm test before release",
+    ...overrides,
+  };
+}
+
+async function readLog(root: string): Promise<string> {
+  return readFile(await workspaceEvidenceLogPath(root), "utf8");
+}
+
+function privacyHash(value: string): string {
+  return createHash("sha256").update(value).digest("hex").slice(0, 16);
+}
+
+async function workspaceRootHash(root: string): Promise<string> {
+  const resolved = await realpath(root).catch(() => root);
+  return privacyHash(resolved);
+}
+
+function manualEvent(rootKey: string, rootHash: string, id: string, createdAt: string): EvidenceEventV1 {
+  return {
+    version: 1,
+    eventId: id,
+    createdAt,
+    workspaceKey: rootKey,
+    workspaceRootHash: rootHash,
+    type: "render_selected",
+    phase: "render",
+    outcome: "rendered",
+    memory: { memoryId: id, type: "decision" },
+    reasonCodes: ["within_caps", "within_char_budget"],
+  };
+}
+
+test("appendEvidenceEvent writes versioned JSONL with workspace hashes", async () => {
+  const root = await tempRoot();
+  try {
+    const event = await appendEvidenceEvent(root, eventInput({ sessionHash: "session-1", messageHash: "message-1" }));
+    const raw = await readLog(root);
+    const stored = JSON.parse(raw.trim()) as EvidenceEventV1;
+
+    assert.equal(stored.version, 1);
+    assert.match(stored.eventId, /^evt_\d+_[a-z0-9]{8}$/);
+    assert.equal(stored.eventId, event.eventId);
+    assert.equal(stored.workspaceKey, await workspaceKey(root));
+    assert.equal(stored.workspaceRootHash, await workspaceRootHash(root));
+    assert.equal(stored.sessionHash, privacyHash("session-1"));
+    assert.equal(stored.messageHash, privacyHash("message-1"));
+    assert.equal(stored.type, "promotion_promoted");
+    assert.equal(stored.outcome, "promoted");
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("appendEvidenceEvent redacts text previews before writing", async () => {
+  const root = await tempRoot();
+  try {
+    await appendEvidenceEvent(root, eventInput({
+      type: "extraction_candidate_rejected",
+      phase: "extraction",
+      outcome: "rejected",
+      reasonCodes: ["raw_error"],
+      textPreview: "password: sushi\nAdmin PIN 是 456123\nBearer abc.def.ghi\nThis candidate is rejected and should be short",
+      details: {
+        note: "password: sushi Admin PIN 是 456123 Bearer abc.def.ghi",
+      },
+    }));
+
+    const raw = await readLog(root);
+    const stored = JSON.parse(raw.trim()) as EvidenceEventV1;
+    assert.ok(!raw.includes("sushi"));
+    assert.ok(!raw.includes("456123"));
+    assert.ok(!raw.includes("abc.def.ghi"));
+    assert.ok(stored.textPreview?.includes("[REDACTED]"));
+    assert.ok((stored.textPreview?.length ?? 0) <= 80);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("queryEvidenceEvents filters by type outcome and memory id", async () => {
+  const root = await tempRoot();
+  try {
+    await appendEvidenceEvents(root, [
+      eventInput({ type: "promotion_promoted", outcome: "promoted", memory: { memoryId: "mem-a" } }),
+      eventInput({ type: "render_omitted", phase: "render", outcome: "omitted", reasonCodes: ["type_cap"], memory: { memoryId: "mem-a" } }),
+      eventInput({ type: "render_omitted", phase: "render", outcome: "omitted", reasonCodes: ["global_cap"], memory: { memoryId: "mem-b" } }),
+    ]);
+
+    const result = await queryEvidenceEvents(root, {
+      types: ["render_omitted"],
+      outcomes: ["omitted"],
+      memoryId: "mem-a",
+    });
+
+    assert.equal(result.length, 1);
+    assert.equal(result[0].type, "render_omitted");
+    assert.equal(result[0].memory?.memoryId, "mem-a");
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("queryEvidenceEvents supports newestFirst and limit", async () => {
+  const root = await tempRoot();
+  try {
+    const events = await appendEvidenceEvents(root, [
+      eventInput({ memory: { memoryId: "oldest" } }),
+      eventInput({ memory: { memoryId: "middle" } }),
+      eventInput({ memory: { memoryId: "newest" } }),
+    ]);
+
+    const result = await queryEvidenceEvents(root, { newestFirst: true, limit: 2 });
+
+    assert.deepEqual(result.map(event => event.eventId), [events[2].eventId, events[1].eventId]);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("appendEvidenceEvent returns a record when appendFile fails", async () => {
+  const root = await tempRoot();
+  try {
+    const path = await workspaceEvidenceLogPath(root);
+    await mkdir(path, { recursive: true });
+
+    const event = await appendEvidenceEvent(root, eventInput());
+
+    assert.equal(event.version, 1);
+    assert.match(event.eventId, /^evt_\d+_[a-z0-9]{8}$/);
+    assert.equal(event.workspaceKey, await workspaceKey(root));
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("evidence log pruning drops old events, caps count, and quarantines invalid lines", async () => {
+  const root = await tempRoot();
+  try {
+    const path = await workspaceEvidenceLogPath(root);
+    await mkdir(dirname(path), { recursive: true });
+    const rootKey = await workspaceKey(root);
+    const rootHash = await workspaceRootHash(root);
+    const old = manualEvent(rootKey, rootHash, "old-event", new Date(Date.now() - 91 * 24 * 60 * 60 * 1000).toISOString());
+    const recentEvents = Array.from({ length: EVIDENCE_LOG_LIMITS.maxEventsPerWorkspace + 1 }, (_, i) =>
+      manualEvent(rootKey, rootHash, `recent-${i}`, new Date(Date.now() - (EVIDENCE_LOG_LIMITS.maxEventsPerWorkspace - i) * 1000).toISOString())
+    );
+    await writeFile(path, [
+      JSON.stringify(old),
+      "{not valid json",
+      ...recentEvents.map(event => JSON.stringify(event)),
+    ].join("\n") + "\n", "utf8");
+
+    const appended = await appendEvidenceEvents(root, Array.from({ length: EVIDENCE_LOG_LIMITS.pruneEveryAppendCount }, (_, i) =>
+      eventInput({ memory: { memoryId: `appended-${i}` }, reasonCodes: ["new_workspace_entry"] })
+    ));
+
+    const events = await queryEvidenceEvents(root);
+    const memoryIds = new Set(events.map(event => event.memory?.memoryId));
+    const files = await readdir(dirname(path));
+
+    assert.ok(events.length <= EVIDENCE_LOG_LIMITS.maxEventsPerWorkspace);
+    assert.equal(memoryIds.has("old-event"), false);
+    assert.equal(memoryIds.has("recent-0"), false, "oldest events over the count cap should be pruned");
+    assert.equal(memoryIds.has(appended.at(-1)?.memory?.memoryId), true);
+    assert.ok(files.some(file => file.startsWith("events.jsonl.corrupt-lines-")));
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("memory evidence summary and lifecycle trace derive latest status", async () => {
+  const root = await tempRoot();
+  try {
+    await appendEvidenceEvents(root, [
+      eventInput({ type: "extraction_candidate_accepted", phase: "extraction", outcome: "accepted", reasonCodes: ["quality_gate_passed"], memory: { memoryId: "mem-life", memoryKeyHash: "raw-key" } }),
+      eventInput({ type: "promotion_promoted", phase: "promotion", outcome: "promoted", reasonCodes: ["new_workspace_entry"], memory: { memoryId: "mem-life", memoryKeyHash: "raw-key" } }),
+      eventInput({ type: "memory_reinforced", phase: "reinforcement", outcome: "reinforced", reasonCodes: ["duplicate_exact"], relations: [{ role: "reinforced", memory: { memoryId: "mem-life", memoryKeyHash: "raw-key" } }] }),
+      eventInput({ type: "render_selected", phase: "render", outcome: "rendered", reasonCodes: ["within_caps", "within_char_budget"], memory: { memoryId: "mem-life", memoryKeyHash: "raw-key" } }),
+    ]);
+
+    const summary = await summarizeMemoryEvidence(root, { memoryId: "mem-life" });
+    const trace = await traceMemoryLifecycle(root, { memoryId: "mem-life" });
+
+    assert.equal(summary.latestOutcome, "rendered");
+    assert.equal(summary.latestRenderStatus, "rendered");
+    assert.ok(summary.reasonCodes.includes("duplicate_exact"));
+    assert.equal(trace.currentStatus, "rendered");
+    assert.ok(trace.acceptedBy);
+    assert.ok(trace.promotedBy);
+    assert.equal(trace.reinforcedBy.length, 1);
+    assert.equal(trace.latestRender?.type, "render_selected");
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("evidence relation roles reject sublimation placeholders at compile-time surface", () => {
+  const allowedRoles: Array<NonNullable<EvidenceEventInput["relations"]>[number]["role"]> = [
+    "candidate",
+    "pending",
+    "promoted",
+    "retained",
+    "absorbed",
+    "superseded",
+    "superseded_by",
+    "reinforced",
+    "reinforced_by",
+    "rendered",
+    "omitted",
+  ];
+
+  assert.equal(allowedRoles.includes("candidate"), true);
+});
@@ -3,7 +3,13 @@ import assert from "node:assert/strict";
 import { mkdtemp, readFile, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { extractErrorsFromBash, extractExplicitMemories, parseWorkspaceMemoryCandidates } from "../src/extractors.ts";
+import {
+  extractErrorsFromBash,
+  extractExplicitMemories,
+  extractExplicitMemoriesWithEvidence,
+  parseWorkspaceMemoryCandidates,
+  parseWorkspaceMemoryCandidatesWithEvidence,
+} from "../src/extractors.ts";

 async function waitForFile(path: string, attempts = 20): Promise<string> {
  let lastError: unknown;
@@ -145,6 +151,20 @@ test("extractExplicitMemories captures multiple memories in same message", () =>
  assert.equal(items.length, 2);
 });

+test("explicit memory extraction returns detected and ignored evidence", () => {
+  const result = extractExplicitMemoriesWithEvidence([
+    "remember this: Prefer deterministic tests.",
+    "don't remember this: temporary password: sushi",
+    "remember this: later",
+  ].join("\n"));
+
+  assert.equal(result.entries.length, 1);
+  assert.ok(result.evidence.some(event => event.type === "explicit_memory_detected"));
+  assert.ok(result.evidence.some(event => event.type === "explicit_memory_ignored" && event.reasonCodes.includes("negated_request")));
+  assert.ok(result.evidence.some(event => event.type === "explicit_memory_ignored" && event.reasonCodes.includes("deferral")));
+  assert.equal(JSON.stringify(result.evidence).includes("sushi"), false);
+});
+
 // ============================================
 // Task 7: Compaction quality gate tests
 // ============================================
@@ -176,6 +196,41 @@ test("parseWorkspaceMemoryCandidates rejects raw error", () => {
  assert.equal(items.length, 0);
 });

+test("compaction accepted candidate returns privacy-safe extraction evidence", () => {
+  const summary = `
+Memory candidates:
+- [decision] Use accounting evidence events to explain promoted memories in diagnostics.
+`;
+
+  const result = parseWorkspaceMemoryCandidatesWithEvidence(summary);
+
+  assert.equal(result.entries.length, 1);
+  assert.equal(result.evidence.length, 1);
+  assert.equal(result.evidence[0].type, "extraction_candidate_accepted");
+  assert.ok(result.evidence[0].reasonCodes.includes("quality_gate_passed"));
+  assert.ok(result.evidence[0].reasonCodes.includes("valid_candidate_format"));
+  assert.match(result.evidence[0].textPreview ?? "", /accounting evidence events/);
+});
+
+test("compaction rejected candidate returns rejection evidence without secrets", () => {
+  const summary = `
+Memory candidates:
+- [feedback] password: sushi Admin PIN 是 456123 Bearer abc.def.ghi TypeError: Cannot read property x
+`;
+
+  const result = parseWorkspaceMemoryCandidatesWithEvidence(summary);
+  const raw = JSON.stringify(result.evidence);
+
+  assert.equal(result.entries.length, 0);
+  assert.equal(result.evidence.length, 1);
+  assert.equal(result.evidence[0].type, "extraction_candidate_rejected");
+  assert.ok(result.evidence[0].reasonCodes.length > 0);
+  assert.equal(raw.includes("sushi"), false);
+  assert.equal(raw.includes("456123"), false);
+  assert.equal(raw.includes("abc.def.ghi"), false);
+  assert.ok((result.evidence[0].textPreview?.length ?? 0) <= 80);
+});
+
 test("parseWorkspaceMemoryCandidates rejects stack trace", () => {
  const summary = `
 ## Memory Candidates
@@ -1,14 +1,15 @@
 import test from "node:test";
 import assert from "node:assert/strict";
 import { execFile } from "node:child_process";
-import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
+import { appendEvidenceEvents, type EvidenceEventInput } from "../src/evidence-log.ts";
 import type { LongTermMemoryEntry, WorkspaceMemoryStore } from "../src/types.ts";
-import { LONG_TERM_LIMITS } from "../src/types.ts";
-import { workspaceKey, workspaceMemoryPath } from "../src/paths.ts";
+import { LONG_TERM_LIMITS, PROMOTION_RETRY_LIMITS, type PendingMemoryJournalStore } from "../src/types.ts";
+import { workspaceKey, workspaceMemoryPath, workspacePendingJournalPath } from "../src/paths.ts";

 const execFileAsync = promisify(execFile);
 const repoRoot = join(dirname(fileURLToPath(import.meta.url)), "..");
@@ -46,17 +47,43 @@ async function writeWorkspaceStore(root: string, entries: LongTermMemoryEntry[],
 }

 async function runMemoryDiagHealth(root: string): Promise<string> {
+  return runMemoryDiag(["health", "--workspace", root]);
+}
+
+async function runMemoryDiag(args: string[]): Promise<string> {
  const { stdout } = await execFileAsync(process.execPath, [
    "--experimental-strip-types",
    "scripts/memory-diag.ts",
-    "health",
-    "--workspace",
-    root,
+    ...args,
  ], { cwd: repoRoot });

  return stdout;
 }

+async function writePendingJournal(root: string, entries: LongTermMemoryEntry[]): Promise<void> {
+  const key = await workspaceKey(root);
+  const path = await workspacePendingJournalPath(root);
+  const store: PendingMemoryJournalStore = {
+    version: 1,
+    workspace: { root, key },
+    entries,
+    updatedAt: new Date().toISOString(),
+  };
+  await mkdir(dirname(path), { recursive: true });
+  await writeFile(path, JSON.stringify(store, null, 2), "utf8");
+}
+
+function evidence(overrides: Partial<EvidenceEventInput>): EvidenceEventInput {
+  return {
+    type: "promotion_promoted",
+    phase: "promotion",
+    outcome: "promoted",
+    memory: { memoryId: "mem-rendered", type: "feedback", source: "explicit", status: "active" },
+    reasonCodes: ["new_workspace_entry"],
+    ...overrides,
+  };
+}
+
 test("memory health reports stored vs rendered retention counts", async () => {
  const root = await mkdtemp(join(tmpdir(), "opencode-memory-diag-"));
  try {
@@ -77,7 +104,7 @@ test("memory health reports stored vs rendered retention counts", async () => {
  }
 });

-test("memory health reports dormancy and retention monitoring alerts", async () => {
+test("memory health reports dormancy and retention monitoring deprecations", async () => {
  const root = await mkdtemp(join(tmpdir(), "opencode-memory-diag-"));
  try {
    const lastActivityAt = new Date(Date.now() - 19 * 24 * 60 * 60 * 1000).toISOString();
@@ -96,7 +123,7 @@ test("memory health reports dormancy and retention monitoring alerts", async ()
    assert.match(stdout, /dormant discount active: yes/);
    assert.match(stdout, /dormant days past grace: 5\.0/);
    assert.match(stdout, /high_importance_ratio: 40\.0% .* ALERT/);
-    assert.match(stdout, /safety_critical_count: 6 .* ALERT/);
+    assert.match(stdout, /safety_critical_count: 6 .*deprecated.* WARNING/);
    assert.match(stdout, /max_reinforced_count: 2 \(20\.0%, alert > 10%\) ALERT/);
  } finally {
    await rm(root, { recursive: true, force: true });
@@ -135,9 +162,151 @@ test("memory health reports missing dormancy and non-alert monitoring defaults",
    assert.match(stdout, /wall days since activity: unknown/);
    assert.match(stdout, /dormant discount active: no/);
    assert.match(stdout, /high_importance_ratio: 0\.0% \(alert > 30%\)\n/);
-    assert.match(stdout, /safety_critical_count: 0 \(alert > 5\)\n/);
+    assert.match(stdout, /safety_critical_count: 0 \(deprecated field\)\n/);
    assert.match(stdout, /max_reinforced_count: 0 \(alert > 10% active\)/);
  } finally {
    await rm(root, { recursive: true, force: true });
  }
 });
+
+test("memory health --json prints parseable privacy-safe diagnostics matching human counts", async () => {
+  const root = await mkdtemp(join(tmpdir(), "opencode-memory-diag-json-"));
+  try {
+    const rendered = { ...entry("mem-rendered", "Prefer small focused changes", "feedback"), source: "explicit" as const };
+    const secret = { ...entry("mem-secret", "Use password: sushi only in test fixtures", "decision"), source: "manual" as const };
+    const superseded = { ...entry("mem-old", "Old decision that was superseded", "decision"), status: "superseded" as const };
+    const pending = { ...entry("mem-pending", "Retry this pending memory later", "project"), promotionAttempts: 1 };
+    await writeWorkspaceStore(root, [rendered, secret, superseded]);
+    await writePendingJournal(root, [pending]);
+    await appendEvidenceEvents(root, [
+      evidence({ type: "extraction_candidate_rejected", phase: "extraction", outcome: "rejected", memory: { memoryId: "mem-rejected", type: "feedback", source: "explicit" }, reasonCodes: ["raw_secret"], textPreview: "password: sushi should not leak" }),
+      evidence({ type: "storage_corrupt_json_quarantined", phase: "storage", outcome: "quarantined", memory: undefined, reasonCodes: ["invalid_json"] }),
+      evidence({ type: "promotion_promoted", phase: "promotion", outcome: "promoted", memory: { memoryId: "mem-rendered", type: "feedback", source: "explicit", status: "active" }, reasonCodes: ["new_workspace_entry"] }),
+      evidence({ type: "render_selected", phase: "render", outcome: "rendered", memory: { memoryId: "mem-rendered", type: "feedback", source: "explicit", status: "active" }, reasonCodes: ["within_caps", "within_char_budget"] }),
+    ]);
+
+    const human = await runMemoryDiagHealth(root);
+    const jsonText = await runMemoryDiag(["health", "--workspace", root, "--json"]);
+    const parsed = JSON.parse(jsonText) as {
+      version: 1;
+      summary: { storedActive: number; rendered: number; pending: number; rejectedLast7Days: number; corruptStoresQuarantinedLast30Days: number };
+      memories: Array<{ id: string; status: string; reasonCodes: string[]; evidenceEventIds: string[]; textPreview?: string }>;
+      recentEvents: Array<{ eventId: string; type: string; outcome: string; createdAt: string; reasonCodes: string[] }>;
+    };
+
+    assert.equal(parsed.version, 1);
+    assert.equal(parsed.summary.storedActive, Number(human.match(/Stored active memories: (\d+)/)?.[1]));
+    assert.equal(parsed.summary.rendered, Number(human.match(/Rendered candidates: (\d+)/)?.[1]));
+    assert.equal(parsed.summary.pending, Number(human.match(/Pending journal:\n\s+total: (\d+)/)?.[1]));
+    assert.equal(parsed.summary.rejectedLast7Days, 1);
+    assert.equal(parsed.summary.corruptStoresQuarantinedLast30Days, 1);
+    assert.ok(parsed.recentEvents.some(event => event.eventId && event.type === "render_selected" && event.outcome === "rendered" && event.createdAt && event.reasonCodes.includes("within_caps")));
+    assert.ok(parsed.memories.find(memory => memory.id === "mem-rendered")?.evidenceEventIds.length);
+    assert.ok(!jsonText.includes("sushi"));
+    assert.ok(jsonText.trim().startsWith("{"));
+    assert.ok(jsonText.trim().endsWith("}"));
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("memory-diag explain shows rendered, omitted, pending, and evidence reason status", async () => {
+  const root = await mkdtemp(join(tmpdir(), "opencode-memory-diag-explain-"));
+  try {
+    const rendered = { ...entry("mem-rendered", "Rendered feedback wins the render set", "feedback"), source: "explicit" as const };
+    const superseded = { ...entry("mem-superseded", "Superseded memory is not rendered", "decision"), status: "superseded" as const };
+    const typeCapped = Array.from({ length: 11 }, (_, i) => entry(`mem-type-${i}`, `Type cap feedback memory ${i}`, "feedback"));
+    const globalCapped = [
+      ...Array.from({ length: 10 }, (_, i) => entry(`mem-g-feedback-${i}`, `Global cap feedback memory ${i}`, "feedback")),
+      ...Array.from({ length: 10 }, (_, i) => entry(`mem-g-decision-${i}`, `Global cap decision memory ${i}`, "decision")),
+      ...Array.from({ length: 8 }, (_, i) => entry(`mem-g-project-${i}`, `Global cap project memory ${i}`, "project")),
+      ...Array.from({ length: 7 }, (_, i) => entry(`mem-g-reference-${i}`, `Global cap reference memory ${i}`, "reference")),
+    ];
+    const charBudget = { ...entry("mem-char-budget", "This active memory cannot fit the tiny character budget", "project") };
+    await writeWorkspaceStore(root, [rendered, superseded, ...typeCapped, ...globalCapped, charBudget]);
+    const key = await workspaceKey(root);
+    const path = await workspaceMemoryPath(root);
+    const raw = JSON.parse(await readFile(path, "utf8")) as WorkspaceMemoryStore;
+    raw.limits.maxRenderedChars = 100;
+    raw.workspace = { root, key };
+    await writeFile(path, JSON.stringify(raw, null, 2), "utf8");
+
+    const retry = { ...entry("mem-pending-retry", "Pending retry memory", "project"), promotionAttempts: 1, lastPromotionFailureReason: "capacity_rejected" };
+    const exhausted = { ...entry("mem-pending-capacity", "Pending capacity rejected memory", "project"), promotionAttempts: PROMOTION_RETRY_LIMITS.maxExplicitAttempts, lastPromotionFailureReason: "capacity_rejected" };
+    await writePendingJournal(root, [retry, exhausted]);
+    await appendEvidenceEvents(root, [
+      evidence({ type: "promotion_absorbed_exact", phase: "promotion", outcome: "absorbed", memory: { memoryId: "mem-absorbed", type: "feedback", source: "explicit" }, reasonCodes: ["same_exact_key"] }),
+      evidence({ type: "storage_corrupt_json_quarantined", phase: "storage", outcome: "quarantined", memory: undefined, reasonCodes: ["invalid_json"] }),
+    ]);
+
+    const stdout = await runMemoryDiag(["explain", "--workspace", root]);
+
+    assert.match(stdout, /Memory mem-rendered: rendered/);
+    assert.match(stdout, /Memory mem-superseded: omitted_superseded/);
+    assert.match(stdout, /omitted_type_cap/);
+    assert.match(stdout, /omitted_global_cap/);
+    assert.match(stdout, /omitted_char_budget/);
+    assert.match(stdout, /Memory mem-pending-retry: pending_retry/);
+    assert.match(stdout, /Memory mem-pending-capacity: pending_rejected_capacity/);
+    assert.match(stdout, /Memory mem-absorbed: omitted_absorbed_duplicate/);
+    assert.match(stdout, /quarantined_corrupt_store/);
+    assert.match(stdout, /- strength=\d+\.\d{3}, type=feedback, source=explicit/);
+    assert.match(stdout, /- evidence: .*promotion_absorbed_exact/);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("memory-diag trace prints lifecycle relations and redacts secrets", async () => {
+  const root = await mkdtemp(join(tmpdir(), "opencode-memory-diag-trace-"));
+  try {
+    await writeWorkspaceStore(root, [
+      { ...entry("mem-life", "Old token password: sushi should be redacted", "decision"), status: "superseded" as const },
+      entry("mem-new", "Replacement memory", "decision"),
+    ]);
+    await appendEvidenceEvents(root, [
+      evidence({ type: "extraction_candidate_accepted", phase: "extraction", outcome: "accepted", memory: { memoryId: "mem-life", type: "decision", source: "compaction" }, reasonCodes: ["quality_gate_passed"], textPreview: "password: sushi" }),
+      evidence({ type: "pending_memory_appended", phase: "pending_journal", outcome: "accepted", memory: { memoryId: "mem-life", type: "decision", source: "compaction" }, relations: [{ role: "pending", memory: { memoryId: "mem-life" } }], reasonCodes: ["pending_journal_append"] }),
+      evidence({ type: "promotion_promoted", phase: "promotion", outcome: "promoted", memory: { memoryId: "mem-life", type: "decision", source: "compaction" }, reasonCodes: ["new_workspace_entry"] }),
+      evidence({ type: "memory_reinforced", phase: "reinforcement", outcome: "reinforced", memory: { memoryId: "mem-life", type: "decision", source: "compaction" }, relations: [{ role: "reinforced_by", memory: { memoryId: "mem-duplicate" } }], reasonCodes: ["duplicate_exact"] }),
+      evidence({ type: "promotion_superseded", phase: "promotion", outcome: "superseded", memory: { memoryId: "mem-life", type: "decision", source: "compaction" }, relations: [{ role: "superseded_by", memory: { memoryId: "mem-new" } }], reasonCodes: ["superseded_existing"] }),
+      evidence({ type: "render_omitted", phase: "render", outcome: "omitted", memory: { memoryId: "mem-life", type: "decision", source: "compaction" }, relations: [{ role: "omitted", memory: { memoryId: "mem-life" } }], reasonCodes: ["superseded"] }),
+    ]);
+
+    const stdout = await runMemoryDiag(["trace", "--workspace", root, "--memory", "mem-life"]);
+
+    assert.match(stdout, /Memory mem-life: omitted_superseded/);
+    assert.match(stdout, /Lifecycle:/);
+    assert.match(stdout, /extraction_candidate_accepted: accepted; reasons=quality_gate_passed/);
+    assert.match(stdout, /pending_memory_appended: accepted; reasons=pending_journal_append/);
+    assert.match(stdout, /promotion_superseded: superseded; reasons=superseded_existing; .*superseded_by=mem-new/);
+    assert.match(stdout, /memory_reinforced: reinforced; reasons=duplicate_exact; .*reinforced_by=mem-duplicate/);
+    assert.match(stdout, /Superseded by:\n- mem-new/);
+    assert.match(stdout, /Reinforced by:\n- mem-duplicate/);
+    assert.ok(!stdout.includes("sushi"));
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("memory-diag trace requires --memory and reports unknown IDs", async () => {
+  const root = await mkdtemp(join(tmpdir(), "opencode-memory-diag-trace-unknown-"));
+  try {
+    await assert.rejects(
+      execFileAsync(process.execPath, ["--experimental-strip-types", "scripts/memory-diag.ts", "trace", "--workspace", root], { cwd: repoRoot }),
+      (error: unknown) => {
+        const err = error as { code?: number; stderr?: string };
+        assert.notEqual(err.code, 0);
+        assert.match(err.stderr ?? "", /--memory requires an id/);
+        assert.match(err.stderr ?? "", /Usage:/);
+        return true;
+      },
+    );
+
+    const stdout = await runMemoryDiag(["trace", "--workspace", root, "--memory", "missing-memory"]);
+    assert.match(stdout, /Memory missing-memory: unknown/);
+    assert.match(stdout, /Lifecycle:\n\(none\)/);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
@@ -1,6 +1,6 @@
 import test from "node:test";
 import assert from "node:assert/strict";
-import { mkdir, mkdtemp, rm } from "node:fs/promises";
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { MemoryV2Plugin } from "../src/plugin.ts";
@@ -8,9 +8,10 @@ import { loadSessionState, saveSessionState } from "../src/session-state.ts";
 import { parseWorkspaceMemoryCandidates } from "../src/extractors.ts";
 import type { OpenError } from "../src/types.ts";
 import { PROMOTION_RETRY_LIMITS, WORKSPACE_MEMORY_CACHE_LIMITS } from "../src/types.ts";
-import { workspaceMemoryPath, workspacePendingJournalPath } from "../src/paths.ts";
+import { sessionStatePath, workspaceMemoryPath, workspacePendingJournalPath } from "../src/paths.ts";
 import { loadPendingJournal, savePendingJournal, memoryKey } from "../src/pending-journal.ts";
 import { loadWorkspaceMemory, updateWorkspaceMemory } from "../src/workspace-memory.ts";
+import { queryEvidenceEvents } from "../src/evidence-log.ts";

 // Mock client for root session (not a sub-agent)
 function mockRootClient() {
@@ -450,6 +451,62 @@ test("chat system transform reuses frozen rendered workspace snapshot", async ()
  }
 });

+test("chat system transform degrades gracefully when workspace memory JSON is corrupt", async () => {
+  const tmpDir = await mkdtemp(join(tmpdir(), "memory-plugin-test-"));
+
+  try {
+    const path = await workspaceMemoryPath(tmpDir);
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, "{ invalid json", "utf8");
+
+    const plugin = await MemoryV2Plugin({
+      directory: tmpDir,
+      client: mockRootClient(),
+    });
+    const output = { system: ["base header"] };
+
+    await assert.doesNotReject(async () => {
+      await (plugin as Record<string, Function>)["experimental.chat.system.transform"](
+        { sessionID: "corrupt-json-session", model: {} },
+        output,
+      );
+    });
+
+    assert.deepEqual(output.system, ["base header"]);
+  } finally {
+    await rm(tmpDir, { recursive: true, force: true });
+  }
+});
+
+test("hook failure emits hook_failed evidence without raw tool output", async () => {
+  const tmpDir = await mkdtemp(join(tmpdir(), "memory-plugin-test-"));
+
+  try {
+    const statePath = await sessionStatePath(tmpDir, "hook-failure-session");
+    await mkdir(dirname(statePath), { recursive: true });
+    await mkdir(statePath, { recursive: true });
+
+    const plugin = await MemoryV2Plugin({ directory: tmpDir, client: mockRootClient() });
+    await (plugin as Record<string, Function>)["tool.execute.after"](
+      {
+        tool: "bash",
+        sessionID: "hook-failure-session",
+        args: { command: "cat secret-output.txt" },
+      },
+      { output: "raw tool output password: sushi should not be in evidence", exitCode: 1 },
+    );
+
+    const events = await queryEvidenceEvents(tmpDir, { types: ["hook_failed"] });
+    const raw = JSON.stringify(events);
+    assert.equal(events.length, 1);
+    assert.equal(events[0].reasonCodes.includes("tool.execute.after"), true);
+    assert.equal(raw.includes("raw tool output"), false);
+    assert.equal(raw.includes("sushi"), false);
+  } finally {
+    await rm(tmpDir, { recursive: true, force: true });
+  }
+});
+
 test("no compaction: owned explicit memory is not promoted by unrelated next session start", async () => {
  const tmpDir = await mkdtemp(join(tmpdir(), "memory-plugin-test-"));

@@ -876,6 +933,85 @@ test("integration: explicit memory flows from user message through pending journ
  }
 });

+test("explicit memory lifecycle emits detected appended and promoted evidence", async () => {
+  const tmpDir = await mkdtemp(join(tmpdir(), "memory-plugin-test-"));
+
+  try {
+    const plugin = await MemoryV2Plugin({
+      directory: tmpDir,
+      client: mockClientWithLatestUser("remember this: Prefer evidence-backed lifecycle tests.", "msg-evidence-life"),
+    });
+
+    await (plugin as Record<string, Function>)["experimental.chat.system.transform"](
+      { sessionID: "evidence-life-session", model: {} },
+      { system: ["base header"] },
+    );
+
+    await (plugin as Record<string, Function>)["event"]({
+      event: { type: "session.compacted", properties: { sessionID: "evidence-life-session" } },
+    });
+
+    const events = await queryEvidenceEvents(tmpDir, { newestFirst: false });
+    const eventTypes = events.map(event => event.type);
+
+    assert.ok(eventTypes.includes("explicit_memory_detected"));
+    assert.ok(eventTypes.includes("pending_memory_appended"));
+    assert.ok(eventTypes.includes("promotion_promoted"));
+
+    const output = { system: ["base header"] };
+    await (plugin as Record<string, Function>)["experimental.chat.system.transform"](
+      { sessionID: "evidence-life-session", model: {} },
+      output,
+    );
+
+    const finalEvents = await queryEvidenceEvents(tmpDir, { newestFirst: false });
+    assert.ok(finalEvents.map(event => event.type).includes("render_selected"));
+  } finally {
+    await rm(tmpDir, { recursive: true, force: true });
+  }
+});
+
+test("session.compacted promotes first-time explicit memory without self-reinforcement", async () => {
+  const tmpDir = await mkdtemp(join(tmpdir(), "memory-plugin-test-"));
+
+  try {
+    const plugin = await MemoryV2Plugin({
+      directory: tmpDir,
+      client: mockClientWithLatestUser(
+        "remember this: Prefer no self reinforcement during first promotion.",
+        "msg-no-self-reinforce",
+      ),
+    });
+
+    await (plugin as Record<string, Function>)["experimental.chat.system.transform"](
+      { sessionID: "no-self-reinforce-session", model: {} },
+      { system: ["base header"] },
+    );
+
+    await (plugin as Record<string, Function>)["event"]({
+      event: {
+        type: "session.compacted",
+        properties: { sessionID: "no-self-reinforce-session" },
+      },
+    });
+
+    const workspace = await loadWorkspaceMemory(tmpDir);
+    const promoted = workspace.entries.find(entry =>
+      /Prefer no self reinforcement/.test(entry.text)
+    );
+
+    assert.ok(promoted, "explicit memory should be promoted");
+    assert.equal(promoted.reinforcementCount ?? 0, 0);
+    assert.equal(promoted.lastReinforcedSessionID, undefined);
+
+    const state = await loadSessionState(tmpDir, "no-self-reinforce-session");
+    assert.equal(state.pendingMemories.length, 0);
+    assert.equal((await loadPendingJournal(tmpDir)).entries.length, 0);
+  } finally {
+    await rm(tmpDir, { recursive: true, force: true });
+  }
+});
+
 test("integration: compaction candidate flows through journal promotion and clears pending journal", async () => {
  const tmpDir = await mkdtemp(join(tmpdir(), "memory-plugin-test-"));

@@ -1,7 +1,7 @@
 import test from "node:test";
 import assert from "node:assert/strict";
 import type { LongTermMemoryEntry } from "../src/types.ts";
-import { accountPendingPromotions } from "../src/promotion-accounting.ts";
+import { accountPendingPromotions, promotionAccountingEvidenceEvents } from "../src/promotion-accounting.ts";
 import { memoryKey } from "../src/pending-journal.ts";
 import type { MemoryConsolidationEvent } from "../src/workspace-memory.ts";
 import { workspaceMemoryExactKey, workspaceMemoryIdentityKey } from "../src/workspace-memory.ts";
@@ -229,3 +229,57 @@ test("accountPendingPromotions marks manual capacity rejection as retryable", ()
  assert.equal(result.clearableKeys.size, 0);
  assert.deepEqual([...result.retryableRejectedKeys], [memoryKey(pending[0])]);
 });
+
+test("promotionAccountingEvidenceEvents maps every promotion outcome with relations", () => {
+  const promoted = mem("promoted", "Promoted memory should produce evidence.", { source: "explicit" });
+  const absorbed = mem("absorbed", "Absorbed memory should produce evidence.", { source: "explicit" });
+  const retained = mem("retained", "absorbed memory should produce evidence.", { source: "explicit" });
+  const identityAbsorbed = mem("identity-absorbed", "Project config lives in `src/config.ts`", { type: "reference" });
+  const identityRetained = mem("identity-retained", "Project config lives in `./src/config.ts`", { type: "reference" });
+  const superseded = mem("superseded", "Parser supports 3 formats.", { source: "compaction" });
+  const replacement = mem("replacement", "Parser supports 4 formats.", { source: "compaction" });
+  const capacity = mem("capacity", "Capacity rejected explicit memory should retry.", { source: "explicit", type: "reference" });
+  const exhausted = mem("exhausted", "Exhausted explicit memory should stop retrying.", { source: "explicit", type: "reference" });
+  const pending = [promoted, absorbed, identityAbsorbed, superseded, capacity, exhausted];
+  const accounting = {
+    promotedKeys: new Set([memoryKey(promoted)]),
+    absorbedKeys: new Set([memoryKey(absorbed), memoryKey(identityAbsorbed)]),
+    supersededKeys: new Set([memoryKey(superseded)]),
+    rejectedKeys: new Set([memoryKey(capacity), memoryKey(exhausted)]),
+    retryableRejectedKeys: new Set([memoryKey(capacity), memoryKey(exhausted)]),
+    clearableKeys: new Set([memoryKey(promoted), memoryKey(absorbed), memoryKey(identityAbsorbed), memoryKey(superseded), memoryKey(exhausted)]),
+  };
+  const events = [
+    { ...event(absorbed, "absorbed_exact"), retainedId: retained.id },
+    { ...event(identityAbsorbed, "absorbed_identity"), retainedId: identityRetained.id },
+    { ...event(superseded, "superseded_existing"), retainedId: replacement.id, supersededId: superseded.id },
+    event(capacity, "rejected_capacity"),
+    event(exhausted, "rejected_capacity"),
+  ];
+
+  const evidence = promotionAccountingEvidenceEvents({
+    pending,
+    after: [promoted, retained, identityRetained, replacement],
+    events,
+    accounting,
+    exhaustedRejectedKeys: new Set([memoryKey(exhausted)]),
+  });
+
+  const expectedPromotionEventTypes = new Set([
+    "promotion_promoted",
+    "promotion_absorbed_exact",
+    "promotion_absorbed_identity",
+    "promotion_superseded",
+    "promotion_rejected_capacity",
+    "promotion_retry_scheduled",
+    "promotion_retry_exhausted",
+  ]);
+
+  assert.deepEqual(new Set(evidence.map(event => event.type)), expectedPromotionEventTypes);
+  const absorbedEvent = evidence.find(event => event.type === "promotion_absorbed_exact");
+  assert.ok(absorbedEvent?.relations?.some(relation => relation.role === "absorbed" && relation.memory?.memoryId === absorbed.id));
+  assert.ok(absorbedEvent?.relations?.some(relation => relation.role === "retained" && relation.memory?.memoryId === retained.id));
+  const supersededEvent = evidence.find(event => event.type === "promotion_superseded");
+  assert.ok(supersededEvent?.relations?.some(relation => relation.role === "superseded" && relation.memory?.memoryId === superseded.id));
+  assert.ok(supersededEvent?.relations?.some(relation => relation.role === "superseded_by" && relation.memory?.memoryId === replacement.id));
+});
@@ -1,11 +1,13 @@
 import test from "node:test";
 import assert from "node:assert/strict";
 import { existsSync } from "node:fs";
-import { mkdtemp, rm, writeFile } from "node:fs/promises";
-import { join } from "node:path";
+import { mkdir, mkdtemp, readdir, rm, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
 import { tmpdir } from "node:os";
 import { spawn } from "node:child_process";
-import { updateJSON } from "../src/storage.ts";
+import { readJSON, updateJSON } from "../src/storage.ts";
+import { queryEvidenceEvents } from "../src/evidence-log.ts";
+import { workspaceMemoryPath } from "../src/paths.ts";

 test("updateJSON serializes concurrent increments", async () => {
  const root = await mkdtemp(join(tmpdir(), "wm-storage-"));
@@ -37,6 +39,44 @@ test("updateJSON does not replace corrupt JSON with fallback", async () => {
  }
 });

+test("readJSON quarantines corrupt JSON and returns fallback", async () => {
+  const dir = await mkdtemp(join(tmpdir(), "wm-storage-corrupt-"));
+  const path = join(dir, "store.json");
+
+  try {
+    await writeFile(path, "{ invalid json", "utf8");
+
+    const loaded = await readJSON(path, () => ({ ok: true }));
+
+    assert.deepEqual(loaded, { ok: true });
+
+    const files = await readdir(dir);
+    assert.equal(files.includes("store.json"), false);
+    assert.equal(files.some(file => file.startsWith("store.json.corrupt-")), true);
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+test("readJSON emits corrupt JSON quarantine evidence for workspace stores", async () => {
+  const root = await mkdtemp(join(tmpdir(), "wm-storage-evidence-corrupt-"));
+  try {
+    const path = await workspaceMemoryPath(root);
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, "{ invalid json", "utf8");
+
+    const loaded = await readJSON(path, () => ({ ok: true }));
+    const events = await queryEvidenceEvents(root, { types: ["storage_corrupt_json_quarantined"] });
+
+    assert.deepEqual(loaded, { ok: true });
+    assert.equal(events.length, 1);
+    assert.equal(events[0].reasonCodes.includes("invalid_json"), true);
+    assert.equal(JSON.stringify(events).includes("invalid json"), false);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
 test("updateJSON recovers stale lock files left by crashed process", async () => {
  const root = await mkdtemp(join(tmpdir(), "wm-storage-stale-lock-"));
  try {
@@ -52,6 +92,47 @@ test("updateJSON recovers stale lock files left by crashed process", async () =>
  }
 });

+test("updateJSON emits stale lock recovery evidence for workspace stores", async () => {
+  const root = await mkdtemp(join(tmpdir(), "wm-storage-evidence-stale-lock-"));
+  try {
+    const path = await workspaceMemoryPath(root);
+    const lockPath = `${path}.lock`;
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(lockPath, `999999\n0\n`, "utf8");
+
+    await updateJSON(path, () => ({ count: 0 }), current => ({ count: current.count + 1 }));
+    const events = await queryEvidenceEvents(root, { types: ["storage_stale_lock_recovered"] });
+
+    assert.equal(events.length, 1);
+    assert.equal(events[0].reasonCodes.includes("stale_lock"), true);
+    assert.equal(JSON.stringify(events).includes("999999"), false);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("updateJSON emits lock timeout evidence and still throws", async () => {
+  const root = await mkdtemp(join(tmpdir(), "wm-storage-evidence-timeout-"));
+  try {
+    const path = await workspaceMemoryPath(root);
+    const lockPath = `${path}.lock`;
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(lockPath, `${process.pid}\n${Date.now()}\n`, "utf8");
+
+    await assert.rejects(
+      updateJSON(path, () => ({ count: 0 }), current => current),
+      /Timed out waiting for lock/,
+    );
+    const events = await queryEvidenceEvents(root, { types: ["storage_lock_timeout"] });
+
+    assert.equal(events.length, 1);
+    assert.equal(events[0].reasonCodes.includes("lock_wait_timeout"), true);
+    assert.equal(JSON.stringify(events).includes(String(process.pid)), false);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
 test("updateJSON serializes writes across separate node processes", async () => {
  const root = await mkdtemp(join(tmpdir(), "wm-storage-xproc-"));
  try {
@@ -81,3 +162,43 @@ test("updateJSON serializes writes across separate node processes", async () =>
    await rm(root, { recursive: true, force: true });
  }
 });
+
+test("updateJSON waits for a live cross-process lock and preserves both updates", async () => {
+  const root = await mkdtemp(join(tmpdir(), "wm-storage-live-lock-"));
+  try {
+    const path = join(root, "counter.json");
+    const worker = `
+      import { updateJSON } from ${JSON.stringify(new URL("../src/storage.ts", import.meta.url).href)};
+      const path = process.argv[1];
+      await updateJSON(path, () => ({ count: 0, order: [] }), async current => {
+        await new Promise(resolve => setTimeout(resolve, 250));
+        return { count: current.count + 1, order: [...current.order, "child"] };
+      });
+    `;
+
+    const child = spawn(
+      process.execPath,
+      ["--experimental-strip-types", "--input-type=module", "-e", worker, path],
+      { stdio: "inherit" },
+    );
+
+    await new Promise(resolve => setTimeout(resolve, 50));
+
+    await updateJSON(path, () => ({ count: 0, order: [] as string[] }), current => ({
+      count: current.count + 1,
+      order: [...current.order, "parent"],
+    }));
+
+    await new Promise<void>((resolve, reject) => {
+      child.on("exit", code => code === 0 ? resolve() : reject(new Error(`child exited ${code}`)));
+      child.on("error", reject);
+    });
+
+    const final = await updateJSON(path, () => ({ count: 0, order: [] as string[] }), current => current);
+    assert.equal(final.count, 2);
+    assert.deepEqual(new Set(final.order), new Set(["child", "parent"]));
+    assert.equal(existsSync(`${path}.lock`), false);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
@@ -8,6 +8,7 @@ import { HOT_STATE_LIMITS, LONG_TERM_LIMITS } from "../src/types.ts";
 import { workspaceKey, workspaceMemoryPath } from "../src/paths.ts";
 import {
  renderWorkspaceMemory,
+  accountWorkspaceMemoryRender,
  enforceLongTermLimits,
  dedupeLongTermEntriesWithAccounting,
  enforceLongTermLimitsWithAccounting,
@@ -19,13 +20,16 @@ import {
  loadWorkspaceMemory,
  saveWorkspaceMemory,
  updateWorkspaceMemoryWithAccounting,
+} from "../src/workspace-memory.ts";
+import {
+  RETENTION_TYPE_MAX,
  calculateInitialStrength,
  calculateEffectiveHalfLife,
  calculateRetentionStrength,
  calculateDormantDays,
  calculateEffectiveAgeDays,
  reinforceMemory,
-} from "../src/workspace-memory.ts";
+} from "../src/retention.ts";
 import { redactCredentials } from "../src/redaction.ts";
 import { assessMemoryQuality, isHardQualityReason, isProgressSnapshotViolation } from "../src/memory-quality.ts";
 import { reviewerCurrent28Fixture } from "./fixtures/memory-quality-current-28.ts";
@@ -154,6 +158,47 @@ test("renderWorkspaceMemory returns empty for no entries", () => {
  assert.equal(rendered, "");
 });

+test("accountWorkspaceMemoryRender reports rendered and omitted reasons", () => {
+  const store: WorkspaceMemoryStore = {
+    version: 1,
+    workspace: { root: "/repo", key: "abc" },
+    limits: { maxRenderedChars: LONG_TERM_LIMITS.maxRenderedChars, maxEntries: LONG_TERM_LIMITS.maxEntries },
+    entries: [
+      ...Array.from({ length: 12 }, (_, i) => entry(`feedback-render-${i}`, `Unique rendered feedback preference ${i}`, "feedback")),
+      { ...entry("superseded-render", "Old superseded memory", "decision"), status: "superseded" as const },
+    ],
+    updatedAt: new Date().toISOString(),
+  };
+
+  const accounting = accountWorkspaceMemoryRender(store);
+
+  assert.equal(accounting.rendered.length, 10);
+  assert.ok(accounting.omitted.some(item => item.reason === "type_cap"));
+  assert.ok(accounting.omitted.some(item => item.reason === "superseded"));
+  assert.ok(accounting.evidence.some(event => event.type === "render_selected"));
+  assert.ok(accounting.evidence.some(event => event.type === "render_omitted" && event.reasonCodes.includes("type_cap")));
+});
+
+test("accountWorkspaceMemoryRender reports char budget and empty budget omissions", () => {
+  const charBudgetStore: WorkspaceMemoryStore = {
+    version: 1,
+    workspace: { root: "/repo", key: "abc" },
+    limits: { maxRenderedChars: 180, maxEntries: LONG_TERM_LIMITS.maxEntries },
+    entries: Array.from({ length: 3 }, (_, i) => entry(`char-budget-${i}`, `Long rendered memory ${i} `.repeat(20), "decision")),
+    updatedAt: new Date().toISOString(),
+  };
+  const emptyBudgetStore: WorkspaceMemoryStore = {
+    ...charBudgetStore,
+    limits: { maxRenderedChars: 10, maxEntries: LONG_TERM_LIMITS.maxEntries },
+  };
+
+  const charBudget = accountWorkspaceMemoryRender(charBudgetStore);
+  const emptyBudget = accountWorkspaceMemoryRender(emptyBudgetStore);
+
+  assert.ok(charBudget.omitted.some(item => item.reason === "char_budget"));
+  assert.ok(emptyBudget.omitted.some(item => item.reason === "empty_render_budget"));
+});
+
 // ============================================
 // PR-2 Task 5 tests (for enforceLongTermLimits)
 // ============================================
@@ -270,7 +315,7 @@ test("enforceLongTermLimits respects maxEntries limit", () => {
  assert.ok(kept.length <= 28, `Should respect maxEntries. Got: ${kept.length}`);
 });

-test("calculateInitialStrength multiplies type, source, importance, and safety factors", () => {
+test("calculateInitialStrength multiplies type, source, and importance factors", () => {
  const memory: LongTermMemoryEntry = {
    ...entry("strength", "Never store raw credentials", "reference"),
    source: "explicit",
@@ -278,7 +323,20 @@ test("calculateInitialStrength multiplies type, source, importance, and safety f
    safetyCritical: true,
  };

-  assert.equal(calculateInitialStrength(memory), 18);
+  assert.equal(calculateInitialStrength(memory), 3);
+});
+
+test("calculateInitialStrength ignores deprecated safetyCritical field", () => {
+  const memory: LongTermMemoryEntry = {
+    ...entry("safety-deprecated", "Deprecated safety field should not affect strength", "decision"),
+    source: "explicit",
+    userImportance: "high",
+    safetyCritical: true,
+  };
+
+  const withoutSafety = { ...memory, safetyCritical: undefined };
+
+  assert.equal(calculateInitialStrength(memory), calculateInitialStrength(withoutSafety));
 });

 test("calculateEffectiveHalfLife clamps reinforcement count at configured maximum", () => {
@@ -447,6 +505,33 @@ test("reinforceMemory enforces session interval and max guards", () => {
  assert.equal(reinforceMemory(atMax, "session-c", now), atMax);
 });

+test("reinforceMemory requires distinct UTC calendar days between reinforcements", () => {
+  const firstReinforcedAt = Date.UTC(2026, 3, 29, 0, 15);
+  const sameUtcDayMuchLater = Date.UTC(2026, 3, 29, 23, 30);
+  const nextUtcDayAfterInterval = Date.UTC(2026, 3, 30, 1, 30);
+  const base: LongTermMemoryEntry = {
+    ...entry("calendar-day-gated", "Reinforcement requires distinct UTC calendar days", "decision"),
+    reinforcementCount: 1,
+    lastReinforcedAt: firstReinforcedAt,
+    lastReinforcedSessionID: "session-a",
+  };
+
+  assert.equal(reinforceMemory(base, "session-b", sameUtcDayMuchLater), base);
+
+  const reinforcedNextDay = reinforceMemory(base, "session-b", nextUtcDayAfterInterval);
+  assert.notEqual(reinforcedNextDay, base);
+  assert.equal(reinforcedNextDay.reinforcementCount, 2);
+  assert.equal(reinforcedNextDay.lastReinforcedAt, nextUtcDayAfterInterval);
+  assert.equal(reinforcedNextDay.lastReinforcedSessionID, "session-b");
+  assert.equal(reinforcedNextDay.retentionClock, nextUtcDayAfterInterval);
+
+  const atMax: LongTermMemoryEntry = {
+    ...base,
+    reinforcementCount: 6,
+  };
+  assert.equal(reinforceMemory(atMax, "session-c", nextUtcDayAfterInterval), atMax);
+});
+
 test("dedupeLongTermEntriesWithAccounting reinforces absorbed exact duplicates", () => {
  const now = Date.now();
  const retained: LongTermMemoryEntry = {
@@ -469,6 +554,30 @@ test("dedupeLongTermEntriesWithAccounting reinforces absorbed exact duplicates",
  assert.equal(result.kept[0].reinforcementCount, 1);
  assert.equal(result.kept[0].lastReinforcedSessionID, "reinforce-session");
  assert.ok(typeof result.kept[0].retentionClock === "number");
+  assert.ok(result.evidence.some(event =>
+    event.type === "memory_reinforced" &&
+    event.reasonCodes.includes("duplicate_exact") &&
+    event.relations?.some(relation => relation.role === "reinforced" && relation.memory?.memoryId === "duplicate") &&
+    event.relations?.some(relation => relation.role === "reinforced_by" && relation.memory?.memoryId === "retained")
+  ));
+});
+
+test("dedupeLongTermEntriesWithAccounting emits identity reinforcement evidence", () => {
+  const now = Date.now();
+  const retained: LongTermMemoryEntry = {
+    ...entry("retained-identity", "OpenCode plugin config location: `.opencode-agenthub/current/xdg/opencode/opencode.json` in workspace", "reference"),
+    retentionClock: now - 10 * DAY_MS,
+  };
+  const duplicate: LongTermMemoryEntry = {
+    ...entry("duplicate-identity", "OpenCode plugin config: .opencode-agenthub/current/xdg/opencode/opencode.json in workspace", "reference"),
+    pendingOwnerSessionID: "identity-session",
+  };
+
+  const result = dedupeLongTermEntriesWithAccounting([retained, duplicate]);
+
+  assert.ok(result.evidence.some(event =>
+    event.type === "memory_reinforced" && event.reasonCodes.includes("duplicate_identity")
+  ));
 });

 test("reinforced memory with same initial strength and age ranks above unreinforced memory", () => {
@@ -514,6 +623,7 @@ test("dedupe reinforcement does not increment for same session", () => {
  assert.ok(retained, "existing manual memory should be retained");
  assert.equal(retained.reinforcementCount, 1);
  assert.equal(retained.lastReinforcedSessionID, "same-session");
+  assert.equal(result.evidence.some(event => event.type === "memory_reinforced"), false);
 });

 test("dedupe reinforcement does not increment under one hour", () => {
@@ -536,6 +646,23 @@ test("dedupe reinforcement does not increment under one hour", () => {
  assert.ok(retained, "existing manual memory should be retained");
  assert.equal(retained.reinforcementCount, 1);
  assert.equal(retained.lastReinforcedSessionID, "old-session");
+  assert.equal(result.evidence.some(event => event.type === "memory_reinforced"), false);
+});
+
+test("dedupe reinforcement does not emit evidence at max reinforcement count", () => {
+  const existing: LongTermMemoryEntry = {
+    ...entry("existing-max", "Prefer deterministic consolidation accounting", "feedback"),
+    source: "manual",
+    reinforcementCount: 6,
+  };
+  const duplicate: LongTermMemoryEntry = {
+    ...entry("duplicate-max", "prefer deterministic consolidation accounting!!!", "feedback"),
+    pendingOwnerSessionID: "new-session",
+  };
+
+  const result = dedupeLongTermEntriesWithAccounting([existing, duplicate]);
+
+  assert.equal(result.evidence.some(event => event.type === "memory_reinforced"), false);
 });

 test("enforceLongTermLimits orders entries by retention strength", () => {
@@ -567,7 +694,73 @@ test("enforceLongTermLimits applies per-type caps after strength sorting", () =>
  assert.equal(kept.filter(memory => memory.type === "feedback").length, 10);
 });

-test("enforceLongTermLimits exempts safety-critical entries from type caps", () => {
+test("safetyCritical entries compete under RETENTION_TYPE_MAX caps like other entries", () => {
+  const safetyEntries: LongTermMemoryEntry[] = Array.from({ length: 6 }, (_, i) => ({
+    ...entry(`safety-${i}`, `Safety memory ${i}`, "feedback"),
+    source: "explicit",
+    safetyCritical: true,
+  }));
+
+  const ordinaryEntries: LongTermMemoryEntry[] = Array.from({ length: 10 }, (_, i) => ({
+    ...entry(`ordinary-${i}`, `Ordinary memory ${i}`, "feedback"),
+    source: "explicit",
+  }));
+
+  const all = [...safetyEntries, ...ordinaryEntries];
+  const kept = enforceLongTermLimits(all);
+
+  const feedbackCount = kept.filter(e => e.type === "feedback").length;
+  assert.equal(feedbackCount, RETENTION_TYPE_MAX.feedback);
+  // safetyCritical entries are no longer exempt from type caps
+  assert.ok(kept.filter(e => e.safetyCritical).length < 6);
+});
+
+test("workspace memory JSON with deprecated safetyCritical loads and competes normally", async () => {
+  const root = await mkdtemp(join(tmpdir(), "opencode-safety-compat-"));
+  try {
+    const key = await workspaceKey(root);
+    const path = await workspaceMemoryPath(root);
+    const now = new Date().toISOString();
+    const safetyEntries: LongTermMemoryEntry[] = Array.from({ length: 6 }, (_, i) => ({
+      ...entry(`safety-fixture-${i}`, `Safety fixture memory ${i}`, "feedback"),
+      source: "explicit",
+      userImportance: i === 0 ? "high" : "normal",
+      safetyCritical: true,
+    }));
+    const ordinaryEntries: LongTermMemoryEntry[] = Array.from({ length: 10 }, (_, i) => ({
+      ...entry(`ordinary-fixture-${i}`, `Ordinary fixture memory ${i}`, "feedback"),
+      source: "explicit",
+    }));
+    const store: WorkspaceMemoryStore = {
+      version: 1,
+      workspace: { root, key },
+      limits: { maxRenderedChars: LONG_TERM_LIMITS.maxRenderedChars, maxEntries: LONG_TERM_LIMITS.maxEntries },
+      entries: [...safetyEntries, ...ordinaryEntries],
+      migrations: [],
+      updatedAt: now,
+      lastActivityAt: now,
+    };
+
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, JSON.stringify(store, null, 2), "utf8");
+
+    const loaded = await loadWorkspaceMemory(root);
+    const safetyEntry = loaded.entries.find(memory => memory.safetyCritical);
+    assert.ok(safetyEntry, "fixture should include deprecated safetyCritical entries");
+    assert.equal(
+      calculateInitialStrength(safetyEntry),
+      calculateInitialStrength({ ...safetyEntry, safetyCritical: undefined }),
+    );
+
+    const kept = enforceLongTermLimits(loaded.entries);
+    assert.equal(kept.filter(memory => memory.type === "feedback").length, RETENTION_TYPE_MAX.feedback);
+    assert.ok(kept.filter(memory => memory.safetyCritical).length < safetyEntries.length);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("enforceLongTermLimits applies type caps to deprecated safetyCritical entries", () => {
  const ordinaryFeedback = Array.from({ length: 12 }, (_, i) =>
    entry(`feedback_${i}`, `Unique safe ordinary feedback preference ${i}`, "feedback")
  );
@@ -578,12 +771,11 @@ test("enforceLongTermLimits exempts safety-critical entries from type caps", ()

  const kept = enforceLongTermLimits([safetyCriticalFeedback, ...ordinaryFeedback]);

-  assert.equal(kept.length, 11);
-  assert.ok(kept.some(memory => memory.id === "safety-feedback"));
-  assert.equal(kept.filter(memory => memory.type === "feedback" && !memory.safetyCritical).length, 10);
+  assert.equal(kept.length, RETENTION_TYPE_MAX.feedback);
+  assert.equal(kept.filter(memory => memory.type === "feedback").length, RETENTION_TYPE_MAX.feedback);
 });

-test("mixed retention scenario applies caps, safety exemption, and reinforcement ordering", () => {
+test("mixed retention scenario applies caps and reinforcement ordering", () => {
  const now = Date.now();
  const oldAge = now - 120 * DAY_MS;
  const ordinaryFeedback = Array.from({ length: 17 }, (_, i) =>
@@ -625,18 +817,15 @@ test("mixed retention scenario applies caps, safety exemption, and reinforcement
    lastActivityAt: new Date(now).toISOString(),
  };

-  assert.ok(entries.filter(memory => memory.type === "feedback" && !memory.safetyCritical).length > 10);
-  assert.ok(entries.filter(memory => memory.type === "decision" && !memory.safetyCritical).length > 10);
+  assert.ok(entries.filter(memory => memory.type === "feedback").length > 10);
+  assert.ok(entries.filter(memory => memory.type === "decision").length > 10);

  const result = enforceLongTermLimitsWithAccounting(entries, store);

  assert.ok(result.kept.length <= 28);
-  assert.ok(result.kept.filter(memory => memory.type === "feedback" && !memory.safetyCritical).length <= 10);
-  assert.ok(result.kept.filter(memory => memory.type === "decision" && !memory.safetyCritical).length <= 10);
-  assert.ok(result.kept.some(memory => memory.safetyCritical));
-  assert.equal(result.kept.filter(memory => memory.type === "feedback" && !memory.safetyCritical).length, 10);
-  assert.equal(result.kept.filter(memory => memory.type === "feedback" && memory.safetyCritical).length, 1);
-  assert.equal(result.kept.filter(memory => memory.type === "feedback").length, 11);
+  assert.ok(result.kept.filter(memory => memory.type === "feedback").length <= RETENTION_TYPE_MAX.feedback);
+  assert.ok(result.kept.filter(memory => memory.type === "decision").length <= RETENTION_TYPE_MAX.decision);
+  assert.equal(result.kept.filter(memory => memory.type === "feedback").length, RETENTION_TYPE_MAX.feedback);
  const reinforcedIndex = result.kept.findIndex(memory => memory.id === "old-reinforced");
  const unreinforcedIndex = result.kept.findIndex(memory => memory.id === "old-unreinforced");
  assert.ok(reinforcedIndex >= 0, "old reinforced reference should be kept");
Author	SHA1	Message	Date
Ralph Chang	0ed61d1ba2	Merge branch 'feat/deprecate-safety-critical'	2026-04-30 19:54:50 +08:00
Ralph Chang	2dbfb50080	chore(release): prepare v1.5.1	2026-04-30 19:54:24 +08:00
Ralph Chang	d569297c30	fix(retention): add UTC calendar-day diversity gate to reinforceMemory Implement OQ-2 decision: allow at most one reinforcement per memory identity per UTC calendar day. Same-day reinforcement is blocked regardless of session or interval. This prevents repetitive-task gaming where a daily recurring task could reach MAX_COUNT=6 in hours. Guard order: same-session → calendar-day → 1-hour → max-count (existing guards kept as defense-in-depth) 1 hour guard is redundant within same day but preserved for sub-hour edge cases.	2026-04-30 18:38:29 +08:00
Ralph Chang	4f1c0348b4	feat(explainability): add diagnostics JSON, per-memory explain, lifecycle trace Phase 4 Tasks 4.1-4.3: - memory-diag health --json: machine-readable MemoryDiagJSON output - memory-diag explain: per-memory render status with strength, reasons, evidence event IDs - memory-diag trace --memory <id>: lifecycle history from evidence events and relations (superseded_by, reinforced_by) - MemoryRenderStatus type with 9 statuses - All diagnostics are read-only, no storage mutations - Privacy-safe: redacted text previews, no raw secrets - 270 tests pass, typecheck pass	2026-04-30 18:06:28 +08:00
Ralph Chang	bc0847e3ed	feat(evidence): wire evidence events into extraction, promotion, reinforcement, render, storage, and hook lifecycle Phase 3 Tasks 3.2-3.6: - Extraction evidence: accepted/rejected/explicit_detected/explicit_ignored - Promotion evidence with relation edges (superseded/superseded_by, absorbed/retained) - Reinforcement evidence with reinforced/reinforced_by relations - Render accounting helper with render_selected/render_omitted evidence - Storage evidence: corrupt_json_quarantined, stale_lock_recovered, lock_timeout - Hook failure evidence in plugin - All evidence failures swallowed, never throw into memory behavior - Privacy-safe textPreview (redacted + truncated) - 266 tests pass, typecheck pass	2026-04-30 17:54:13 +08:00
Ralph Chang	6a81fc384c	feat(evidence): add evidence infrastructure - types, append, query, retention Phase 3 Task 3.1: - Create src/evidence-log.ts with EvidenceEventType, EvidencePhase, EvidenceOutcome, MemoryEvidenceRef, EvidenceRelation, EvidenceEventV1, EvidenceEventInput types - Add appendEvidenceEvent/appendEvidenceEvents with safe write, privacy hashing (SHA-256 truncated), textPreview redaction, bounded retention - Add queryEvidenceEvents, summarizeMemoryEvidence, traceMemoryLifecycle - Add workspaceEvidenceLogPath to src/paths.ts - Add 8 evidence-log tests: round-trip, privacy, query, resilience, retention - Relations limited to wiring roles only (no kind/derived_from/validates) - 253 tests pass	2026-04-30 17:33:40 +08:00
Ralph Chang	ed4590ca18	refactor(retention): extract retention module from workspace-memory Move retention constants and math to a focused src/retention.ts module: - All half-life, reinforcement, dormancy constants - TYPE_FACTOR, SOURCE_FACTOR, USER_IMPORTANCE_FACTOR - RETENTION_TYPE_MAX (renamed from TYPE_MAX) - calculateInitialStrength, calculateEffectiveHalfLife, calculateRetentionStrength, calculateDormantDays, calculateEffectiveAgeDays, reinforceMemory No behavior changes. retention.ts imports only types from types.ts. Workspace-memory.ts still owns storage, consolidation, and rendering.	2026-04-30 17:28:31 +08:00
Ralph Chang	09cc4a2ffb	feat(deprecation): remove safetyCritical retention multiplier and type-cap bypass - Remove SAFETY_CRITICAL_FACTOR = 6.0 from workspace-memory.ts - Remove safetyFactor from calculateInitialStrength() - all memories now fade according to the same rules - Remove safetyCritical bypass from applyTypeMaxCaps() - safetyCritical entries compete normally under TYPE_MAX caps - Preserve safetyCritical?: boolean in LongTermMemoryEntry type for backward compatibility (no producer sets it to true) - Update memory-diag to show deprecation warning instead of capacity alert - Update tests: add backward-compatibility fixture test, deprecation strength test, normal cap competition test - Update docs/architecture.md, RELEASE_NOTES.md, CHANGELOG.md, docs/configuration.md Phase 1.5 complete: safetyCritical is now a deprecated field with no active behavior. Safety rules belong in user-controlled agent.md files.	2026-04-30 17:23:01 +08:00
Ralph Chang	c0ebd84d7e	fix(security): harden hooks, quarantine corrupt JSON, test locks, fix promotion dedupe - Wrap hooks with try/catch to prevent OpenCode disruption - Add warnMemoryHook() for safe error logging - Quarantine corrupt JSON files before fallback - Add cross-process lock safety tests - Fix pending promotion same-batch dedupe - Update docs/architecture.md with lock semantics - 242 tests passing	2026-04-30 11:52:01 +08:00
Ralph Chang	20a6cfe1a6	chore(release): prepare v1.5.0	2026-04-29 16:56:47 +08:00
Ralph Chang	36b78ea91c	feat(memory): add retention model test gaps and health diagnostics Wave 1 - P0 Test Gaps: - Add hard stale prune removed regression test - Add dormant overlap tests (entry created during dormancy) - Add invalid timestamp NaN protection test - Add reinforcement ordering test with reference type - Add dedupe same-session/under-1hr guard tests - Fix NaN handling with Number.isFinite check Wave 2 - Helper Functions: - Add timestampMs() for safe timestamp conversion - Add isSafetyCriticalForDiag() aligned with runtime Wave 3 - Health Output Format: - Fix top rendered candidates sorted by strength (not text length) - Add stored vs rendered counts breakdown - Add type caps and global cap overflow display - Track globalCapped array explicitly - Add dormant status section Wave 4 - Monitoring Metrics: - Add high_importance_ratio (alert > 30%) - Add safety_critical_count (alert > 5) - Add max_reinforced_count (alert > 10% active) Wave 5 - Integration Fixture: - Add 34-entry over-cap test - Add mixed retention regression fixture - Test TYPE_MAX caps, safety-critical exemption, reinforcement ordering Tests: 224 → 237	2026-04-29 15:26:44 +08:00
Ralph Chang	406c160c9f	fix(memory): correct dormant formula, remove hard prune, integrate reinforcement P0.1 - Fix dormant effective age formula: - Use overlap logic: only apply dormancy to entry's lifetime - Formula: activeDays + dormantOverlapDays * 0.25 - calculateDormantDays now returns total days (not excess past grace) - Test: 28 dormant days → 17.5 effective days P0.2 - Remove hard stale pruning: - Remove isPrunableByAge from enforcement - Remove rejected_stale from accounting reasons - Elimination now by cap competition only P0.3 - Integrate reinforcement: - Call reinforceMemory in dedupe absorption path - Call reinforceMemory in promotion duplicate path - Update retentionClock on reinforcement A1 - Retention clock reset on reinforcement A4 - Fix tests to encode correct formula	2026-04-29 14:55:25 +08:00
Ralph Chang	968aedd5c5	feat(memory): add dormant tracking and reinforcement mechanism Wave 2c - Dormant workspace tracking: - Add lastActivityAt to WorkspaceMemoryStore - Implement calculateDormantDays with 14-day grace period - Wire dormant days into retention-strength calculation Wave 3 - Reinforcement: - Add lastReinforcedSessionID to LongTermMemoryEntry - Implement reinforceMemory with guards (same-session, 1hr interval, max 6) - Set retentionClock on memory creation in extractors.ts and plugin.ts Tests: 219 → 222, all pass	2026-04-29 14:32:39 +08:00
Ralph Chang	d4053b2d35	feat(memory): implement retention decay model with strength-based ordering - Add retention model constants (45-day half-life, 6.0 safety factor) - Add TYPE_MAX caps (feedback:10, decision:10, project:8, reference:6) - Add strength calculation: initialStrength × 2^(-age/halfLife) - Integrate strength-based sorting into enforceLongTermLimits - Safety-critical entries bypass type caps - Add fields: retentionClock, reinforcementCount, userImportance, safetyCritical	2026-04-29 14:18:51 +08:00
Ralph Chang	85e11be2b9	feat: add maintainer diagnostics for memory quality calibration - health: inspect workspace memory store, pending journal, offline quality checks - rejections: review extraction rejection log with origin inference - audit: review migration logs with risky supersede heuristic - Maintainer-only, offline, no telemetry, no API calls	2026-04-29 10:25:35 +08:00
sdwolf4103	5b0083efae	Merge pull request #4 from sdwolf4103/feat/memory-quality-cleanup Release v1.4.0 memory quality cleanup	2026-04-28 14:53:12 +08:00
Ralph Chang	60b9ca75c8	fix(memory): isolate test workspace cleanup	2026-04-28 14:50:30 +08:00
Ralph Chang	8da39c7a9d	fix(memory): address quality cleanup audit findings	2026-04-28 14:29:28 +08:00
Ralph Chang	e8c95a62ec	docs(memory): document conservative quality cleanup migration	2026-04-28 14:19:18 +08:00
Ralph Chang	56d7ef9a68	test(memory): add real workspace quality cleanup regression fixture	2026-04-28 14:17:43 +08:00
Ralph Chang	7427221640	feat(memory): add local quality cleanup audit logs	2026-04-28 14:17:17 +08:00
Ralph Chang	9991c95ff6	fix(memory): make quality cleanup migration conservative	2026-04-28 14:15:34 +08:00
Ralph Chang	f7139f0844	chore: prepare v1.4.0 release	2026-04-28 13:37:14 +08:00
Ralph Chang	465edfabf1	fix: unify all memory quality rules in single module	2026-04-28 13:34:33 +08:00
Ralph Chang	6a80f4b047	fix: auto-supersede low-quality compaction memories	2026-04-28 13:29:28 +08:00
Ralph Chang	b21347c12b	fix: tighten compaction memory candidate prompt	2026-04-28 13:24:43 +08:00
Ralph Chang	ffb0477251	fix: unify workspace memory quality gate	2026-04-28 13:21:15 +08:00
Ralph Chang	a1b9bf4fbc	chore: prepare v1.3.3 release	2026-04-28 13:06:14 +08:00
Ralph Chang	a762e863d1	fix: owner scope in global unowned promotion Problem: clearPendingMemories() and recordPromotionRejections() would incorrectly clear or mutate owned entries during global unowned promotion. Fixes: 1. clearPendingMemories() now respects owner/unowned scope: - global clearUnowned only clears unowned same-key entries - owned same-key entries are preserved - explicit global clear-all-by-key fallback still works 2. recordPromotionRejections() now has includeUnownedOnly option: - global unowned rejection only increments/exhausts unowned entries - owned same-key entries are preserved 3. Added regression tests: - global unowned clear keeps owned same-key entries - global unowned rejection only exhausts unowned same-key entries Tests: 182 pass, 0 fail	2026-04-28 12:27:46 +08:00
Ralph Chang	222bae28de	fix: cross-process lock stale judgment and heartbeat Problem: CI test "updateJSON serializes writes across separate node processes" was failing with expect 100 but got 89/97. The root cause was isLockStale() being too aggressive - it could mistakenly delete locks held by other processes. Fixes: 1. isLockStale() now uses mtime only - fresh locks are never stale 2. Added heartbeat mechanism during lock hold to support long updaters 3. Removed PID check that was unreliable in CI/containers 4. Fixed ENOENT race when lock is released between EEXIST and stat Tests: 180 pass, 0 fail	2026-04-28 12:24:56 +08:00
Ralph Chang	53aa6d3c31	feat: implement Plan 1 - Critical Stability fixes Wave 1: Storage and Journal Safety - Add frozen cache TTL (1h) and size bounds (50 sessions) - Add pending journal source-aware retention (compaction-only TTL) - Add inter-process file lock with stale recovery - Move processLatestUserMessage to first transform (after isSubAgent guard) Wave 2: Promotion Ownership and Bounded Rejection - Add pendingOwnerSessionID/pendingMessageID metadata - Add owner-aware pending journal clearing - Add explicit/manual bounded retry (max 3 attempts) - Fix session.deleted cleanup idempotency Wave 3: Normalize, Security, and Cache Hardening - Fix load-time write loop (only write on security/migration change) - Add deterministic sort tie-breaker (createdAt -> id) - Add Bearer token redaction - Add processed message cache bounds - Remove priorityWithFreshness dead code Tests: 180 pass, 0 fail	2026-04-28 11:59:29 +08:00
Ralph Chang	034dfe8d91	fix: run compatibility CI on Node 24	2026-04-27 22:13:23 +08:00
Ralph Chang	e3ebdbfe9f	fix: support CI installs without lockfile	2026-04-27 22:04:11 +08:00
Ralph Chang	fdebd304f6	chore: prepare v1.3.1 release	2026-04-27 22:00:04 +08:00
Ralph Chang	77d60abf5f	refactor: make memory dedupe repo-agnostic	2026-04-27 21:19:42 +08:00
Ralph Chang	560f63f96b	docs: note PR 3 security hardening	2026-04-27 20:22:26 +08:00
Ralph Chang	11361abc91	test: cover security hardening edge cases	2026-04-27 20:22:09 +08:00
Ralph Chang	e071095422	merge: integrate PR #3 security hardening	2026-04-27 20:14:08 +08:00
Ralph Chang	909d6c7767	docs: document concise compatibility limitations	2026-04-27 19:57:21 +08:00
Ralph Chang	c697f63c67	fix: cap and prune pending memory journal	2026-04-27 18:54:44 +08:00
Ralph Chang	25b673fbb7	test: add opencode plugin compatibility checks	2026-04-27 18:54:14 +08:00
Steven Choo	acaa829df4	feat: implement indirect prompt injection protection and expanded secret redaction	2026-04-27 12:42:20 +02:00
Ralph Chang	fe6ce36e09	docs: prepare v1.3.0 release notes	2026-04-27 17:06:43 +08:00
Ralph Chang	3cc6dff7ae	feat: add consolidation accounting for workspace memory promotion P0 implementation with four waves: Wave 1: Dedup with accounting - Add dedupeLongTermEntriesWithAccounting() - Classify exact duplicate, identity duplicate, topic duplicate Wave 2: Normalization with accounting - Add normalizeWorkspaceMemoryWithAccounting() - Chain redaction → migration → enforceLongTermLimitsWithAccounting Wave 3: Promotion accounting integration - Update accountPendingPromotions() to use new accounting API - Add supersededKeys to classification - Distinguish promoted / absorbed / superseded / rejected Wave 4: Integration tests - End-to-end tests covering full pipeline Bug fixes: - Fix active vs superseded boundary (superseded entries no longer block promotion) - Remove unused rejected_duplicate_lower_quality type - Defer pending journal safety cap (TODO added) Tests: 135 passing (up from 115)	2026-04-27 16:45:55 +08:00
Ralph Chang	1c748f3ee2	chore: ignore superpowers plans and update architecture doc - Add docs/superpowers/plans/ to .gitignore - Remove tracked plan files from git - Update docs/architecture.md: - Change primary extraction format from XML to 'Memory candidates:' - Mark XML format as legacy/deprecated - Fix hot session state injection example	2026-04-27 14:53:07 +08:00
Ralph Chang	ca68b7f55c	feat: sharpen compaction memory extraction prompt Wave 3 of memory quality optimization plan. - Add good memory examples in buildCompactionPrompt() - Add bad memory examples to skip (test counts, commit hashes, etc.) - Add prompt assertions in tests to prevent regression - Emphasize 'useful if a new agent opens this workspace next week'	2026-04-27 14:40:32 +08:00
Ralph Chang	023589a905	test: add memory quality eval fixtures Wave 2 of memory quality optimization plan. - 5 accepted cases: durable facts that should be kept - 7 rejected cases: noise that should be filtered - Parser-level regression guard (zero API call) - All cases pass against current extractors.ts	2026-04-27 14:34:53 +08:00
Ralph Chang	24f807fed0	fix: account for absorbed pending memories - Add workspaceMemoryIdentityKey() to unify dedup/supersession identity semantics - Add accountPendingPromotions() to distinguish promoted/absorbed/rejected - Wire promotion accounting into promotePendingMemories() - Add clearableKeys.size > 0 guard to prevent journal wipe - Add regression tests for absorbed duplicate, cap-rejected, all-rejected edge cases Wave 1 of memory quality optimization plan.	2026-04-27 14:27:43 +08:00
Ralph Chang	097235e43b	docs: add memory quality optimization implementation plan P0 implementation plan with 3 waves: - Wave 1: Promotion accounting (fix absorbed duplicate data loss) - Wave 2: Memory quality eval (fixture-based regression guard) - Wave 3: Compaction prompt negative examples Addresses architecture review feedback: - Distinguish promoted/absorbed/rejected pending memories - Add clearableKeys.size > 0 guard to prevent journal wipe - Add regression tests for all edge cases	2026-04-27 14:16:46 +08:00
sdwolf4103	14bbb76cf1	Fix formatting in README.md	2026-04-27 13:00:26 +08:00