chore(release): prepare v1.5.2

Implement OQ-2 decision: allow at most one reinforcement per memory
identity per UTC calendar day. Same-day reinforcement is blocked
regardless of session or interval. This prevents repetitive-task
gaming where a daily recurring task could reach MAX_COUNT=6 in hours.

Guard order: same-session → calendar-day → 1-hour → max-count
(existing guards kept as defense-in-depth)

1 hour guard is redundant within same day but preserved for
sub-hour edge cases.

.gitignore

@@ -51,6 +51,8 @@ pnpm-lock.yaml
 
 # Superpowers local planning artifacts
 docs/superpowers/plans/
+docs/plans/
+docs/disruptions/
 
 # Local dev/admin script inputs
 scripts/dev/run-migration-roots.local.txt

CHANGELOG.md

@@ -5,13 +5,27 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.5.1] - 2026-04-30
+
+### Added
+
+- Per-workspace evidence log for extraction, promotion, reinforcement, render, storage, and hook lifecycle events.
+- `memory-diag health --json` for machine-readable diagnostics.
+- `memory-diag explain` for per-memory render status, strength, reasons, and evidence event IDs.
+- `memory-diag trace --memory <id>` for memory lifecycle history.
+- UTC calendar-day reinforcement gate so repeated matches cannot inflate a memory multiple times in the same day.
+
+### Changed
+
+- Retention constants and calculations moved to `src/retention.ts`.
+- `safetyCritical` is now fully inert: no retention multiplier and no type-cap bypass, while remaining JSON-compatible.
+
 ## [1.5.0] - 2026-04-29
 
 ### Added
 
 - Strength-based workspace memory retention using exponential decay instead of additive priority scoring.
 - Per-type rendered caps for workspace memory candidates: feedback 10, decision 10, project 8, and reference 6.
-- Safety-critical memory weighting and type-cap exemption so important entries survive type floods while still competing under the global rendered cap.
 - Dormant-workspace effective age: after 14 days without activity, additional dormant time counts at 0.25x for retention decay.
 - Reinforcement tracking for repeated memories, with same-session and one-hour guards to prevent accidental reinforcement spam.
 - Memory health diagnostics for stored vs rendered counts, type caps, global cap overflow, dormancy, retention monitoring, and strength-ranked top/weakest entries.
@@ -21,6 +35,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Workspace memory rendering now ranks entries by retention strength, not the previous priority/penalty model.
 - Confidence is retained for compatibility but no longer affects retention scoring.
+- Deprecated `safetyCritical` is retained for JSON compatibility but no longer affects retention strength or type-cap behavior.
 - Old or stale-marked memories are no longer hard-pruned; they remain stored and only fall out of rendered context through strength and cap competition.
 - Existing duplicate promotion and dedupe paths now reinforce the surviving memory instead of only absorbing the duplicate.
 - Health output now separates stored active memories from rendered candidates to make cap behavior easier to understand.

README.md

@@ -209,6 +209,22 @@ npm run cleanup:workspaces -- --quarantine
 
 The cleanup command only quarantines definite temp/test workspace residues by default. It does not delete unknown missing-root workspaces.
 
+### Local Inspection CLI
+
+Maintainers can run read-only inspection surfaces without telemetry or mutation. Human output redacts absolute paths and credentials by default; pass `--raw` only when you intentionally need local paths.
+
+```bash
+bun scripts/memory-diag.ts quality --workspace /path/to/repo
+bun scripts/memory-diag.ts coverage --workspace /path/to/repo --include-historical
+bun scripts/memory-diag.ts disappearances --workspace /path/to/repo --explain
+bun scripts/memory-diag.ts rejections --quality --reason bad_decision --unique
+```
+
+- `quality` summarizes store caps, retention clocks, evidence coverage, disappearances, and rejection scoping.
+- `coverage` classifies per-memory evidence lifecycle coverage, optionally including historical evidence-only memory IDs.
+- `disappearances --explain` reports evidence memory IDs absent from the current store with terminal capacity, promotion, supersession, or render-omission context when available.
+- `rejections --quality` groups rejection records by scope, reason distribution, and heuristic possible false-positive buckets.
+
 ## Configuration
 
 OpenCode Working Memory works out of the box.

RELEASE_NOTES.md

@@ -1,12 +1,47 @@
 # Release Notes
 
+## 1.5.1 (2026-04-30)
+
+### Evidence Loop and Explainability
+
+This release adds an evidence-based audit trail for memory lifecycle events and user-facing diagnostics for understanding why memories are rendered, promoted, or rejected.
+
+> **Evidence before sublimation.** Every memory decision can be traced.
+
+### What Changed
+
+- **Evidence log**: extraction, promotion, reinforcement, render, and storage events are now recorded in a per-workspace `events.jsonl` with 90-day retention and 5000-event cap.
+- **User explainability**: `memory-diag explain` shows per-memory render status with strength, reasons, and evidence. `memory-diag trace --memory <id>` shows the full lifecycle history.
+- **Machine-readable diagnostics**: `memory-diag health --json` outputs structured `MemoryDiagJSON` for scripting.
+- **Calendar-day reinforcement gate**: reinforcement now requires distinct UTC calendar days, preventing repetitive-task gaming that could inflate a memory's strength within a single day.
+- **SafetyCritical deprecation complete**: the `safetyCritical` field no longer affects retention strength or type-cap bypass. All memories fade by the same rules.
+- **Retention module extraction**: retention constants and calculations moved to `src/retention.ts` for cleaner separation.
+
+### Privacy
+
+- Evidence text previews are credential-redacted. Memory content is stored as truncated hashes, never in full.
+- Diagnostics default to redacted output. `--raw` is available for maintainers.
+
+### Upgrade Notes
+
+- No configuration changes required.
+- Existing workspace memory files remain compatible.
+- Evidence logs are created automatically; no migration needed.
+
+### Validation
+
+- `npm run typecheck`
+- `npm test` — 271 tests passing
+
+---
+
 ## 1.5.0 (2026-04-29)
 
 ### Retention Decay Model
 
 This release changes workspace memory retention from hard stale pruning and additive priority scoring to a strength-based decay model.
 
-Think of it like a forgetting curve: memories fade over time, but important, reinforced, and safety-critical memories decay slower. Weak entries fall out of rendered prompt context by cap competition, not hard deletion.
+Think of it like a forgetting curve: memories fade over time, but important and reinforced memories decay slower. Weak entries fall out of rendered prompt context by cap competition, not hard deletion.
 
 > **Memory should fade, so the agent can keep learning.**
 > Important memories decay slower, but every memory must leave room for newer project reality and avoid long-term memory pollution.
@@ -27,10 +62,10 @@ Think of it like a forgetting curve: memories fade over time, but important, rei
 ### What Changed
 
 - **Strength-based retention**: workspace memory now uses exponential decay: initial strength × age decay.
-- **Better initial strength**: type, source, user importance, and safety-critical status now determine how strong a memory starts.
+- **Better initial strength**: type, source, and user importance now determine how strong a memory starts.
 - **No confidence scoring**: confidence remains in stored data for compatibility, but it no longer affects retention ranking.
 - **Type caps**: rendered workspace memory now caps feedback, decisions, project facts, and references separately so one type cannot monopolize all 28 slots.
-- **Safety-critical protection**: safety-critical entries get stronger retention and are exempt from per-type caps, while still competing under the global rendered cap.
+- **Deprecation:** `safetyCritical` field no longer affects retention strength or type-cap bypass. All system memories now fade according to the same rules. Safety rules belong in user-controlled `agent.md` files, not in system memory.
 - **Dormant-aware age**: after 14 inactive days, additional dormant workspace time counts at 0.25x so paused projects do not forget too aggressively.
 - **Reinforcement**: repeated matching memories reinforce the survivor and slow future decay, with same-session and one-hour guards to avoid accidental spam.
 - **No hard stale pruning**: old or stale-marked memories are no longer automatically dropped by age; they lose rendered space only through cap competition.
@@ -96,7 +131,7 @@ Retention monitoring:
 ### Validation
 
 - `npm run typecheck`
-- `npm test` — 237 tests passing
+- `npm test` — 242 tests passing
 - `bun scripts/memory-diag.ts health`
 
 ---

docs/architecture.md

@@ -109,14 +109,14 @@ Retention then decides which active memories are rendered into prompt context. I
 strength = initialStrength * 2 ** (-effectiveAgeDays / effectiveHalfLifeDays)
 ```
 
-Initial strength is based on memory type, source, optional user importance, and safety-critical status. Confidence remains stored for compatibility but is not part of retention scoring.
+Initial strength is based on memory type, source, and optional user importance. Confidence remains stored for compatibility but is not part of retention scoring.
 
 Rendered candidates are selected in this order:
 
 1. Exclude `status: "superseded"` entries.
 2. Compute current retention strength.
 3. Sort by strength descending.
-4. Apply per-type caps, with safety-critical entries exempt from type caps.
+4. Apply per-type caps.
 5. Keep the top 28 rendered entries under the workspace memory character budget.
 
 Default type caps:
@@ -132,6 +132,10 @@ The type-cap total is 34, intentionally above the global 28-entry cap. These are
 
 Dormant workspaces age more slowly: after 14 inactive days, additional dormant time counts at 0.25x for retention decay. Repeated duplicate memories reinforce the surviving entry and slow future decay, but same-session and under-one-hour repeats do not stack reinforcement.
 
+### Safety-Critical Deprecation
+
+The `safetyCritical` field on `LongTermMemoryEntry` is deprecated as of the retention v1.5.1 model update. It no longer affects retention strength or type-cap bypass. The field is preserved in the type definition for backward compatibility with existing workspace memory JSON files, but has no active behavior. Safety rules should be maintained in user-controlled files such as `agent.md` rather than in system memory.
+
 ### System Prompt Injection
 
 Workspace memory is injected at the top of every message:
@@ -343,6 +347,10 @@ canonical("Use npm cache for plugins") === "use npm cache for plugins"
 const workspaceKey = sha256(realpath(workspaceRoot)).slice(0, 16)
 ```
 
+### Storage Safety
+
+All read-modify-write updates go through `updateJSON()`, which combines an in-process promise queue with an on-disk `.lock` file. The lock file uses exclusive creation, heartbeat refreshes while held, stale-lock recovery after 30 seconds, and a 5 second wait timeout for live contention. Direct `readJSON()` is fallback-oriented and does not mutate data except when corrupt JSON is quarantined.
+
 ## Performance Considerations
 
 ### Memory Budgets

docs/configuration.md

@@ -34,7 +34,7 @@ const WORKSPACE_DORMANT_AFTER_DAYS = 14;
 const DORMANT_DECAY_MULTIPLIER = 0.25;
 ```
 
-Initial strength uses type, source, user importance, and safety-critical factors. Confidence is stored for compatibility but is not used for retention scoring.
+Initial strength uses type, source, and user importance factors. Confidence is stored for compatibility but is not used for retention scoring.
 
 Rendered type caps prevent one type from filling all workspace memory slots:
 
@@ -45,7 +45,7 @@ Rendered type caps prevent one type from filling all workspace memory slots:
 | `project` | 8 |
 | `reference` | 6 |
 
-Safety-critical memories are exempt from type caps but still compete under the global `maxEntries` limit. Old or stale-marked memories are not hard-pruned by age; they lose rendered space through strength and cap competition.
+Old or stale-marked memories are not hard-pruned by age; they lose rendered space through strength and cap competition. The deprecated `safetyCritical` field is preserved for compatibility but no longer affects strength or type caps.
 
 ## Hot Session State Limits
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-working-memory",
-  "version": "1.5.0",
+  "version": "1.5.2",
   "description": "Three-layer memory architecture for OpenCode with workspace memory and hot session state",
   "type": "module",
   "main": "index.ts",
@@ -15,8 +15,8 @@
   ],
   "scripts": {
     "build": "node -e \"console.log('No build step required: OpenCode loads index.ts directly')\"",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsc --noEmit && node -e \"console.log('TYPECHECK_PASS')\"",
-    "test": "node --import ./tests/setup-xdg-data-home.ts --test --experimental-strip-types tests/*.test.ts",
+    "test": "node --import ./tests/setup-xdg-data-home.ts --test --experimental-strip-types tests/*.test.ts && node -e \"console.log('TEST_PASS')\"",
     "cleanup:workspaces": "node --experimental-strip-types scripts/dev/cleanup-workspaces.ts",
     "check:compat": "npm install --no-save @opencode-ai/plugin@latest && npm run typecheck && npm test"
   },

src/evidence-log.ts

@@ -0,0 +1,529 @@
+import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
+import { appendFile, mkdir, readFile, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { dataHome, workspaceEvidenceLogPath, workspaceKey } from "./paths.ts";
+import { redactCredentials } from "./redaction.ts";
+
+export type EvidenceEventType =
+  | "extraction_candidate_accepted"
+  | "extraction_candidate_rejected"
+  | "explicit_memory_detected"
+  | "explicit_memory_ignored"
+  | "pending_memory_appended"
+  | "pending_memory_cleared"
+  | "promotion_promoted"
+  | "promotion_absorbed_exact"
+  | "promotion_absorbed_identity"
+  | "promotion_superseded"
+  | "promotion_rejected_capacity"
+  | "promotion_retry_scheduled"
+  | "promotion_retry_exhausted"
+  | "memory_reinforced"
+  | "render_selected"
+  | "render_omitted"
+  | "memory_removed_capacity"
+  | "storage_corrupt_json_quarantined"
+  | "storage_stale_lock_recovered"
+  | "storage_lock_timeout"
+  | "hook_failed";
+
+export type EvidencePhase =
+  | "extraction"
+  | "explicit"
+  | "pending_journal"
+  | "promotion"
+  | "reinforcement"
+  | "render"
+  | "storage"
+  | "hook";
+
+export type EvidenceOutcome =
+  | "accepted"
+  | "rejected"
+  | "promoted"
+  | "absorbed"
+  | "superseded"
+  | "rendered"
+  | "omitted"
+  | "removed"
+  | "retried"
+  | "exhausted"
+  | "reinforced"
+  | "quarantined"
+  | "failed"
+  | "recovered";
+
+export type MemoryEvidenceRef = {
+  memoryId?: string;
+  memoryKeyHash?: string;
+  identityKeyHash?: string;
+  type?: "feedback" | "project" | "decision" | "reference";
+  source?: "explicit" | "compaction" | "manual";
+  status?: "active" | "superseded";
+};
+
+export type EvidenceRelation = {
+  role:
+    | "candidate"
+    | "pending"
+    | "promoted"
+    | "retained"
+    | "absorbed"
+    | "superseded"
+    | "superseded_by"
+    | "reinforced"
+    | "reinforced_by"
+    | "rendered"
+    | "omitted"
+    | "removed";
+  memory?: MemoryEvidenceRef;
+};
+
+export type EvidenceDetailValue = string | number | boolean | null | string[] | number[];
+
+export type EvidenceEventV1 = {
+  version: 1;
+  eventId: string;
+  createdAt: string;
+  workspaceKey: string;
+  workspaceRootHash: string;
+  sessionHash?: string;
+  messageHash?: string;
+  type: EvidenceEventType;
+  phase: EvidencePhase;
+  outcome: EvidenceOutcome;
+  memory?: MemoryEvidenceRef;
+  relations?: EvidenceRelation[];
+  reasonCodes: string[];
+  details?: Record<string, EvidenceDetailValue>;
+  textPreview?: string;
+};
+
+export type EvidenceEventInput = Omit<
+  EvidenceEventV1,
+  "version" | "eventId" | "createdAt" | "workspaceKey" | "workspaceRootHash"
+>;
+
+export type EvidenceQuery = {
+  since?: string;
+  until?: string;
+  types?: EvidenceEventType[];
+  phases?: EvidencePhase[];
+  outcomes?: EvidenceOutcome[];
+  memoryId?: string;
+  memoryKeyHash?: string;
+  identityKeyHash?: string;
+  sessionHash?: string;
+  limit?: number;
+  newestFirst?: boolean;
+};
+
+export type MemoryEvidenceSummary = {
+  memoryId?: string;
+  memoryKeyHash?: string;
+  latestOutcome?: EvidenceOutcome;
+  latestRenderStatus?: "rendered" | "omitted";
+  reasonCodes: string[];
+  eventIds: string[];
+  lastEventAt?: string;
+};
+
+export type MemoryLifecycleTrace = {
+  memoryId?: string;
+  memoryKeyHash?: string;
+  identityKeyHash?: string;
+  events: EvidenceEventV1[];
+  createdBy?: EvidenceEventV1;
+  acceptedBy?: EvidenceEventV1;
+  promotedBy?: EvidenceEventV1;
+  absorbedBy?: EvidenceEventV1;
+  supersededBy?: EvidenceEventV1;
+  reinforcedBy: EvidenceEventV1[];
+  latestRender?: EvidenceEventV1;
+  currentStatus:
+    | "accepted"
+    | "pending"
+    | "promoted"
+    | "absorbed"
+    | "superseded"
+    | "rendered"
+    | "omitted"
+    | "rejected"
+    | "unknown";
+};
+
+export const EVIDENCE_LOG_LIMITS = {
+  maxAgeDays: 90,
+  maxEventsPerWorkspace: 5000,
+  maxBytesPerWorkspace: 2 * 1024 * 1024,
+  pruneEveryAppendCount: 100,
+} as const;
+
+const appendCounts = new Map<string, number>();
+const HASH_PATTERN = /^[a-f0-9]{16}$/i;
+const DAY_MS = 24 * 60 * 60 * 1000;
+const MAX_DETAIL_STRING_CHARS = 240;
+const MAX_DETAIL_ARRAY_ITEMS = 25;
+
+function evidenceHash(value: string): string {
+  return createHash("sha256").update(value).digest("hex").slice(0, 16);
+}
+
+function normalizeHashValue(value: string | undefined): string | undefined {
+  if (!value) return undefined;
+  return HASH_PATTERN.test(value) ? value.toLowerCase() : evidenceHash(value);
+}
+
+async function resolvedRoot(root: string): Promise<string> {
+  return realpath(root).catch(() => root);
+}
+
+function evidenceTextPreview(text: string, maxChars = 120): string {
+  return redactCredentials(text).replace(/\s+/g, " ").trim().slice(0, maxChars);
+}
+
+function sanitizeReasonCode(reason: string): string {
+  return reason.replace(/[^a-zA-Z0-9_.:-]/g, "_").slice(0, 120);
+}
+
+function sanitizeMemoryRef(memory: MemoryEvidenceRef | undefined): MemoryEvidenceRef | undefined {
+  if (!memory) return undefined;
+  const sanitized: MemoryEvidenceRef = {};
+  if (typeof memory.memoryId === "string" && memory.memoryId) sanitized.memoryId = memory.memoryId.slice(0, 160);
+  if (memory.memoryKeyHash) sanitized.memoryKeyHash = normalizeHashValue(memory.memoryKeyHash);
+  if (memory.identityKeyHash) sanitized.identityKeyHash = normalizeHashValue(memory.identityKeyHash);
+  if (memory.type) sanitized.type = memory.type;
+  if (memory.source) sanitized.source = memory.source;
+  if (memory.status) sanitized.status = memory.status;
+  return Object.keys(sanitized).length > 0 ? sanitized : undefined;
+}
+
+function sanitizeRelations(relations: EvidenceRelation[] | undefined): EvidenceRelation[] | undefined {
+  if (!relations) return undefined;
+  const sanitized = relations
+    .map(relation => ({
+      role: relation.role,
+      memory: sanitizeMemoryRef(relation.memory),
+    }))
+    .slice(0, 25);
+  return sanitized.length > 0 ? sanitized : undefined;
+}
+
+function sanitizeDetailString(value: string): string {
+  return evidenceTextPreview(value, MAX_DETAIL_STRING_CHARS);
+}
+
+function sanitizeDetails(details: EvidenceEventInput["details"]): EvidenceEventV1["details"] {
+  if (!details) return undefined;
+  const sanitized: Record<string, EvidenceDetailValue> = {};
+
+  for (const [rawKey, rawValue] of Object.entries(details).slice(0, 50)) {
+    const key = rawKey.replace(/[^a-zA-Z0-9_.:-]/g, "_").slice(0, 80);
+    if (!key) continue;
+
+    if (typeof rawValue === "string") {
+      sanitized[key] = sanitizeDetailString(rawValue);
+    } else if (typeof rawValue === "number") {
+      if (Number.isFinite(rawValue)) sanitized[key] = rawValue;
+    } else if (typeof rawValue === "boolean" || rawValue === null) {
+      sanitized[key] = rawValue;
+    } else if (Array.isArray(rawValue)) {
+      if (rawValue.every(item => typeof item === "string")) {
+        sanitized[key] = rawValue.slice(0, MAX_DETAIL_ARRAY_ITEMS).map(item => sanitizeDetailString(item));
+      } else if (rawValue.every(item => typeof item === "number" && Number.isFinite(item))) {
+        sanitized[key] = rawValue.slice(0, MAX_DETAIL_ARRAY_ITEMS) as number[];
+      }
+    }
+  }
+
+  return Object.keys(sanitized).length > 0 ? sanitized : undefined;
+}
+
+function buildEvidenceEvent(
+  input: EvidenceEventInput,
+  workspaceKeyValue: string,
+  workspaceRootHash: string,
+): EvidenceEventV1 {
+  const textPreviewMax = input.type === "extraction_candidate_rejected" ? 80 : 120;
+  const event: EvidenceEventV1 = {
+    version: 1,
+    eventId: `evt_${Date.now()}_${Math.random().toString(36).slice(2, 10).padEnd(8, "0")}`,
+    createdAt: new Date().toISOString(),
+    workspaceKey: workspaceKeyValue,
+    workspaceRootHash,
+    type: input.type,
+    phase: input.phase,
+    outcome: input.outcome,
+    reasonCodes: input.reasonCodes.map(sanitizeReasonCode).filter(Boolean).slice(0, 25),
+  };
+
+  const memory = sanitizeMemoryRef(input.memory);
+  const relations = sanitizeRelations(input.relations);
+  const details = sanitizeDetails(input.details);
+  if (input.sessionHash) event.sessionHash = normalizeHashValue(input.sessionHash);
+  if (input.messageHash) event.messageHash = normalizeHashValue(input.messageHash);
+  if (memory) event.memory = memory;
+  if (relations) event.relations = relations;
+  if (details) event.details = details;
+  if (input.textPreview) event.textPreview = evidenceTextPreview(input.textPreview, textPreviewMax);
+
+  return event;
+}
+
+async function safeAppendEvidenceLine(path: string, line: string): Promise<void> {
+  try {
+    await mkdir(dirname(path), { recursive: true });
+    await appendFile(path, `${line}\n`, "utf8");
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(`[memory] failed to write evidence event: ${message}`);
+  }
+}
+
+async function maybePruneEvidenceLog(path: string): Promise<void> {
+  const nextCount = (appendCounts.get(path) ?? 0) + 1;
+  appendCounts.set(path, nextCount);
+  if (nextCount % EVIDENCE_LOG_LIMITS.pruneEveryAppendCount !== 0) return;
+
+  try {
+    await pruneEvidenceLogPath(path);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(`[memory] failed to prune evidence log: ${message}`);
+  }
+}
+
+export async function appendEvidenceEvent(root: string, event: EvidenceEventInput): Promise<EvidenceEventV1> {
+  const records = await appendEvidenceEvents(root, [event]);
+  return records[0];
+}
+
+export async function appendEvidenceEvents(root: string, events: EvidenceEventInput[]): Promise<EvidenceEventV1[]> {
+  const path = await workspaceEvidenceLogPath(root);
+  const rootPath = await resolvedRoot(root);
+  const workspaceRootHash = evidenceHash(rootPath);
+  const workspaceKeyValue = await workspaceKey(root);
+  const records = events.map(event => buildEvidenceEvent(event, workspaceKeyValue, workspaceRootHash));
+
+  for (const record of records) {
+    await safeAppendEvidenceLine(path, JSON.stringify(record));
+    await maybePruneEvidenceLog(path);
+  }
+
+  return records;
+}
+
+export async function appendEvidenceEventForWorkspaceKey(
+  workspaceKeyValue: string,
+  event: EvidenceEventInput,
+): Promise<EvidenceEventV1> {
+  const path = join(dataHome(), "opencode-working-memory", "workspaces", workspaceKeyValue, "evidence", "events.jsonl");
+  const record = buildEvidenceEvent(event, workspaceKeyValue, workspaceKeyValue);
+  await safeAppendEvidenceLine(path, JSON.stringify(record));
+  await maybePruneEvidenceLog(path);
+  return record;
+}
+
+type ParsedEvidenceLine = {
+  event: EvidenceEventV1;
+  index: number;
+};
+
+function parseEvidenceLine(line: string): EvidenceEventV1 | null {
+  try {
+    const parsed = JSON.parse(line) as Partial<EvidenceEventV1>;
+    if (parsed.version !== 1 || !parsed.eventId || !parsed.createdAt || !parsed.type) return null;
+    return parsed as EvidenceEventV1;
+  } catch {
+    return null;
+  }
+}
+
+async function readEvidenceLines(path: string, warnInvalid: boolean): Promise<{ valid: ParsedEvidenceLine[]; invalid: string[] }> {
+  if (!existsSync(path)) return { valid: [], invalid: [] };
+  const raw = await readFile(path, "utf8");
+  const valid: ParsedEvidenceLine[] = [];
+  const invalid: string[] = [];
+
+  raw.split(/\n/).forEach((line, index) => {
+    if (!line.trim()) return;
+    const event = parseEvidenceLine(line);
+    if (event) {
+      valid.push({ event, index });
+    } else {
+      invalid.push(line);
+      if (warnInvalid) console.warn(`[memory] skipped invalid evidence log line ${index + 1}`);
+    }
+  });
+
+  return { valid, invalid };
+}
+
+function eventTimeMs(event: EvidenceEventV1): number {
+  const ms = new Date(event.createdAt).getTime();
+  return Number.isFinite(ms) ? ms : 0;
+}
+
+async function atomicWriteText(path: string, text: string): Promise<void> {
+  await mkdir(dirname(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 10)}.tmp`;
+  try {
+    await writeFile(tmp, text, { encoding: "utf8", mode: 0o600 });
+    await rename(tmp, path);
+  } catch (error) {
+    await rm(tmp, { force: true }).catch(() => undefined);
+    throw error;
+  }
+}
+
+function serializeEvents(events: EvidenceEventV1[]): string {
+  return events.map(event => JSON.stringify(event)).join("\n") + (events.length > 0 ? "\n" : "");
+}
+
+function trimEventsToByteLimit(events: EvidenceEventV1[]): EvidenceEventV1[] {
+  let kept = [...events];
+  while (kept.length > 0 && Buffer.byteLength(serializeEvents(kept), "utf8") > EVIDENCE_LOG_LIMITS.maxBytesPerWorkspace) {
+    kept = kept.slice(1);
+  }
+  return kept;
+}
+
+async function pruneEvidenceLogPath(path: string): Promise<void> {
+  if (!existsSync(path)) return;
+  const stats = await stat(path);
+  if (stats.isDirectory()) return;
+
+  const { valid, invalid } = await readEvidenceLines(path, false);
+  if (invalid.length > 0) {
+    const corruptPath = `${path}.corrupt-lines-${Date.now()}.jsonl`;
+    await writeFile(corruptPath, invalid.join("\n") + "\n", { encoding: "utf8", mode: 0o600 }).catch(error => {
+      const message = error instanceof Error ? error.message : String(error);
+      console.error(`[memory] failed to quarantine invalid evidence lines: ${message}`);
+    });
+  }
+
+  const cutoff = Date.now() - EVIDENCE_LOG_LIMITS.maxAgeDays * DAY_MS;
+  let events = valid
+    .filter(item => eventTimeMs(item.event) >= cutoff)
+    .sort((a, b) => eventTimeMs(a.event) - eventTimeMs(b.event) || a.index - b.index)
+    .map(item => item.event);
+
+  if (events.length > EVIDENCE_LOG_LIMITS.maxEventsPerWorkspace) {
+    events = events.slice(events.length - EVIDENCE_LOG_LIMITS.maxEventsPerWorkspace);
+  }
+
+  events = trimEventsToByteLimit(events);
+  await atomicWriteText(path, serializeEvents(events));
+}
+
+function memoryRefMatches(memory: MemoryEvidenceRef | undefined, query: Pick<EvidenceQuery, "memoryId" | "memoryKeyHash" | "identityKeyHash">): boolean {
+  if (!memory) return false;
+  const memoryKeyHash = normalizeHashValue(query.memoryKeyHash);
+  const identityKeyHash = normalizeHashValue(query.identityKeyHash);
+  if (query.memoryId && memory.memoryId === query.memoryId) return true;
+  if (memoryKeyHash && memory.memoryKeyHash === memoryKeyHash) return true;
+  if (identityKeyHash && memory.identityKeyHash === identityKeyHash) return true;
+  return false;
+}
+
+function eventMatchesMemory(event: EvidenceEventV1, query: Pick<EvidenceQuery, "memoryId" | "memoryKeyHash" | "identityKeyHash">): boolean {
+  if (!query.memoryId && !query.memoryKeyHash && !query.identityKeyHash) return true;
+  if (memoryRefMatches(event.memory, query)) return true;
+  return (event.relations ?? []).some(relation => memoryRefMatches(relation.memory, query));
+}
+
+export async function queryEvidenceEvents(
+  root: string,
+  query: EvidenceQuery = {},
+): Promise<EvidenceEventV1[]> {
+  const path = await workspaceEvidenceLogPath(root);
+  const { valid } = await readEvidenceLines(path, true);
+  const sinceMs = query.since ? new Date(query.since).getTime() : undefined;
+  const untilMs = query.until ? new Date(query.until).getTime() : undefined;
+  const sessionHash = normalizeHashValue(query.sessionHash);
+
+  let events = valid.map(item => item.event).filter(event => {
+    const createdAtMs = eventTimeMs(event);
+    if (Number.isFinite(sinceMs) && createdAtMs < sinceMs) return false;
+    if (Number.isFinite(untilMs) && createdAtMs > untilMs) return false;
+    if (query.types && !query.types.includes(event.type)) return false;
+    if (query.phases && !query.phases.includes(event.phase)) return false;
+    if (query.outcomes && !query.outcomes.includes(event.outcome)) return false;
+    if (sessionHash && event.sessionHash !== sessionHash) return false;
+    if (!eventMatchesMemory(event, query)) return false;
+    return true;
+  });
+
+  if (query.newestFirst) events = events.slice().reverse();
+  if (typeof query.limit === "number" && query.limit >= 0) events = events.slice(0, query.limit);
+  return events;
+}
+
+export async function summarizeMemoryEvidence(
+  root: string,
+  input: { memoryId?: string; memoryKeyHash?: string },
+): Promise<MemoryEvidenceSummary> {
+  const events = await queryEvidenceEvents(root, input);
+  const latest = events.at(-1);
+  const latestRender = events.filter(event => event.phase === "render").at(-1);
+  const reasonCodes = new Set<string>();
+  for (const event of events) {
+    for (const reason of event.reasonCodes) reasonCodes.add(reason);
+  }
+
+  return {
+    memoryId: input.memoryId,
+    memoryKeyHash: normalizeHashValue(input.memoryKeyHash),
+    latestOutcome: latest?.outcome,
+    latestRenderStatus: latestRender?.outcome === "rendered" || latestRender?.outcome === "omitted"
+      ? latestRender.outcome
+      : undefined,
+    reasonCodes: [...reasonCodes],
+    eventIds: events.map(event => event.eventId),
+    lastEventAt: latest?.createdAt,
+  };
+}
+
+function currentStatusFromEvent(event: EvidenceEventV1 | undefined): MemoryLifecycleTrace["currentStatus"] {
+  if (!event) return "unknown";
+  if (event.outcome === "accepted") return "accepted";
+  if (event.outcome === "promoted") return "promoted";
+  if (event.outcome === "absorbed") return "absorbed";
+  if (event.outcome === "superseded") return "superseded";
+  if (event.outcome === "rendered") return "rendered";
+  if (event.outcome === "omitted") return "omitted";
+  if (event.outcome === "rejected") return "rejected";
+  if (event.type === "pending_memory_appended") return "pending";
+  return "unknown";
+}
+
+export async function traceMemoryLifecycle(
+  root: string,
+  input: { memoryId?: string; memoryKeyHash?: string; identityKeyHash?: string },
+): Promise<MemoryLifecycleTrace> {
+  const events = await queryEvidenceEvents(root, input);
+  const createdBy = events.find(event => event.type === "explicit_memory_detected" || event.type === "pending_memory_appended");
+  const acceptedBy = events.find(event => event.type === "extraction_candidate_accepted" || event.type === "explicit_memory_detected");
+  const promotedBy = events.find(event => event.type === "promotion_promoted");
+  const absorbedBy = events.find(event => event.outcome === "absorbed");
+  const supersededBy = events.find(event => event.outcome === "superseded");
+  const reinforcedBy = events.filter(event => event.type === "memory_reinforced" || event.outcome === "reinforced");
+  const latestRender = events.filter(event => event.phase === "render").at(-1);
+  const latest = events.at(-1);
+
+  return {
+    memoryId: input.memoryId,
+    memoryKeyHash: normalizeHashValue(input.memoryKeyHash),
+    identityKeyHash: normalizeHashValue(input.identityKeyHash),
+    events,
+    createdBy,
+    acceptedBy,
+    promotedBy,
+    absorbedBy,
+    supersededBy,
+    reinforcedBy,
+    latestRender,
+    currentStatus: currentStatusFromEvent(latest),
+  };
+}

src/extractors.ts

@@ -6,6 +6,7 @@ import { LONG_TERM_LIMITS } from "./types.ts";
 import { assessMemoryQuality } from "./memory-quality.ts";
 import { extractionRejectionLogPath } from "./paths.ts";
 import { redactCredentials } from "./redaction.ts";
+import type { EvidenceEventInput } from "./evidence-log.ts";
 
 function id(prefix: string): string {
   return `${prefix}_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
@@ -46,6 +47,34 @@ function isNegatedMemoryRequest(text: string, matchIndex: number): boolean {
 }
 
 export function extractExplicitMemories(text: string): LongTermMemoryEntry[] {
+  return extractExplicitMemoriesWithEvidence(text).entries;
+}
+
+export type WorkspaceMemoryParseResult = {
+  entries: LongTermMemoryEntry[];
+  evidence: EvidenceEventInput[];
+};
+
+function evidenceTextPreview(text: string, maxChars = 120): string {
+  return redactCredentials(text).replace(/\s+/g, " ").trim().slice(0, maxChars);
+}
+
+function memoryEvidence(memory: LongTermMemoryEntry): EvidenceEventInput["memory"] {
+  return {
+    memoryId: memory.id,
+    type: memory.type,
+    source: memory.source,
+    status: memory.status,
+  };
+}
+
+function extractionEvidence(
+  input: Pick<EvidenceEventInput, "type" | "phase" | "outcome" | "reasonCodes" | "textPreview" | "memory" | "details">,
+): EvidenceEventInput {
+  return input;
+}
+
+export function extractExplicitMemoriesWithEvidence(text: string): WorkspaceMemoryParseResult {
   // 注意：所有pattern必須有 g flag，因為使用 matchAll()
   // Pattern 必須在行首匹配，避免匹配到句子中間的非指令式用法
   const patterns = [
@@ -71,29 +100,74 @@ export function extractExplicitMemories(text: string): LongTermMemoryEntry[] {
   const nowMs = Date.now();
   const now = new Date(nowMs).toISOString();
   const entries: LongTermMemoryEntry[] = [];
+  const evidence: EvidenceEventInput[] = [];
   const seen = new Set<string>();
+  const negatedLinePattern = /(?:^|\n)\s*(?:(?:please\s+)?(?:do\s+not|don't|dont|never)\s+remember(?:\s+(?:this|that))?|不要\s*(?:記住|记住)|別\s*(?:記住|记住)|别\s*(?:記住|记住))[:：,，]?\s*(.+)$/gim;
+  for (const match of text.matchAll(negatedLinePattern)) {
+    evidence.push(extractionEvidence({
+      type: "explicit_memory_ignored",
+      phase: "explicit",
+      outcome: "rejected",
+      reasonCodes: ["negated_request"],
+      textPreview: evidenceTextPreview(match[1] ?? match[0], 80),
+    }));
+  }
 
   for (const pattern of patterns) {
     for (const match of text.matchAll(pattern)) {
       const body = match[1]?.trim();
-      if (!body || body.length < 8) continue;
+      if (body && /^(再说|再說|later|next time)$/i.test(body)) {
+        evidence.push(extractionEvidence({
+          type: "explicit_memory_ignored",
+          phase: "explicit",
+          outcome: "rejected",
+          reasonCodes: ["deferral"],
+          textPreview: evidenceTextPreview(body, 80),
+        }));
+        continue;
+      }
+      if (!body || body.length < 8) {
+        evidence.push(extractionEvidence({
+          type: "explicit_memory_ignored",
+          phase: "explicit",
+          outcome: "rejected",
+          reasonCodes: ["too_short"],
+          textPreview: evidenceTextPreview(body ?? match[0], 80),
+        }));
+        continue;
+      }
       
       // Calculate actual trigger position (after possible newline)
       const triggerIndex = match.index! + (match[0].match(/^[\s\n]*/)?.[0]?.length || 0);
       
       // Check if this is a negated request (e.g., "不要記住")
-      if (isNegatedMemoryRequest(text, triggerIndex)) continue;
+      if (isNegatedMemoryRequest(text, triggerIndex)) {
+        evidence.push(extractionEvidence({
+          type: "explicit_memory_ignored",
+          phase: "explicit",
+          outcome: "rejected",
+          reasonCodes: ["negated_request"],
+          textPreview: evidenceTextPreview(body, 80),
+        }));
+        continue;
+      }
       
-      // Check if it's a deferral (e.g., "later", "next time")
-      if (/^(再说|再說|later|next time)$/i.test(body)) continue;
-
       // Dedupe by canonical body
       const key = body.toLowerCase().replace(/\s+/g, " ").trim();
-      if (seen.has(key)) continue;
+      if (seen.has(key)) {
+        evidence.push(extractionEvidence({
+          type: "explicit_memory_ignored",
+          phase: "explicit",
+          outcome: "rejected",
+          reasonCodes: ["duplicate_in_message"],
+          textPreview: evidenceTextPreview(body, 80),
+        }));
+        continue;
+      }
       seen.add(key);
 
       const type = classifyExplicitMemory(body);
-      entries.push({
+      const memory: LongTermMemoryEntry = {
         id: id("mem"),
         type,
         text: body.slice(0, LONG_TERM_LIMITS.maxEntryTextChars),
@@ -104,11 +178,20 @@ export function extractExplicitMemories(text: string): LongTermMemoryEntry[] {
         updatedAt: now,
         retentionClock: nowMs,
         staleAfterDays: staleAfterDaysFor(type),
-      });
+      };
+      entries.push(memory);
+      evidence.push(extractionEvidence({
+        type: "explicit_memory_detected",
+        phase: "explicit",
+        outcome: "accepted",
+        reasonCodes: ["explicit_trigger_matched"],
+        memory: memoryEvidence(memory),
+        textPreview: evidenceTextPreview(memory.text),
+      }));
     }
   }
 
-  return entries;
+  return { entries, evidence };
 }
 
 function classifyExplicitMemory(text: string): LongTermType {
@@ -239,6 +322,13 @@ type ExtractionRejectionLogEntry = {
   text: string;
   reasons: string[];
   source: "compaction";
+  workspaceKey?: string;
+  workspaceRootHash?: string;
+};
+
+type WorkspaceMemoryCandidateParseOptions = {
+  workspaceKey?: string;
+  workspaceRootHash?: string;
 };
 
 async function logExtractionRejection(entry: ExtractionRejectionLogEntry): Promise<void> {
@@ -251,15 +341,15 @@ async function logExtractionRejection(entry: ExtractionRejectionLogEntry): Promi
   }
 }
 
-function shouldAcceptWorkspaceMemoryCandidate(
+function evaluateWorkspaceMemoryCandidate(
   entry: {
     type: LongTermType;
     text: string;
   },
   options: {
     fromMemoryTrigger?: boolean;
-  } = {},
+  } & WorkspaceMemoryCandidateParseOptions = {},
-): boolean {
+): { accepted: boolean; reasons: string[] } {
   const text = entry.text.trim();
   const minLength = options.fromMemoryTrigger ? 6 : 20;
 
@@ -267,14 +357,14 @@ function shouldAcceptWorkspaceMemoryCandidate(
   if (entry.type === "reference" && /\b(?:admin\s+)?pin\s|scrypt|n=\d+|r=\d+|p=\d+/i.test(text)) {
     // Stable config values can be short — allow below generic min length
   } else if (text.length < minLength) {
-    return false;
+    return { accepted: false, reasons: ["too_short"] };
   }
 
   // Indirect Prompt Injection / Adversarial Instructions
   // Rejects attempts to overwrite system behavior or "ignore" rules.
   // comparative "instead of" is allowed.
-  if (/\b(ignore\s+all|ignore\s+previous|ignore\s+instruction|overwrite\s+system|overwrite\s+rules|forget\s+all|delete\s+root)\b/i.test(text)) return false;
+  if (/\b(ignore\s+all|ignore\s+previous|ignore\s+instruction|overwrite\s+system|overwrite\s+rules|forget\s+all|delete\s+root)\b/i.test(text)) return { accepted: false, reasons: ["prompt_injection"] };
-  if (/\b(ignore|instruction|overwrite)\b/i.test(text) && /\b(previous|all|rules|behavior|prompt|system)\b/i.test(text)) return false;
+  if (/\b(ignore|instruction|overwrite)\b/i.test(text) && /\b(previous|all|rules|behavior|prompt|system)\b/i.test(text)) return { accepted: false, reasons: ["prompt_injection"] };
 
   const quality = assessMemoryQuality({ type: entry.type, text, source: "compaction" });
   if (!quality.accepted) {
@@ -284,11 +374,25 @@ function shouldAcceptWorkspaceMemoryCandidate(
       text: redactCredentials(text),
       reasons: quality.reasons,
       source: "compaction",
+      workspaceKey: options.workspaceKey,
+      workspaceRootHash: options.workspaceRootHash,
     });
-    return false;
+    return { accepted: false, reasons: quality.reasons };
   }
 
-  return true;
+  return { accepted: true, reasons: ["quality_gate_passed"] };
+}
+
+function shouldAcceptWorkspaceMemoryCandidate(
+  entry: {
+    type: LongTermType;
+    text: string;
+  },
+  options: {
+    fromMemoryTrigger?: boolean;
+  } & WorkspaceMemoryCandidateParseOptions = {},
+): boolean {
+  return evaluateWorkspaceMemoryCandidate(entry, options).accepted;
 }
 
 /**
@@ -315,13 +419,24 @@ function extractCandidateBlock(summary: string): string | null {
   return null;
 }
 
-export function parseWorkspaceMemoryCandidates(summary: string): LongTermMemoryEntry[] {
+export function parseWorkspaceMemoryCandidates(
+  summary: string,
+  options?: WorkspaceMemoryCandidateParseOptions,
+): LongTermMemoryEntry[] {
+  return parseWorkspaceMemoryCandidatesWithEvidence(summary, options).entries;
+}
+
+export function parseWorkspaceMemoryCandidatesWithEvidence(
+  summary: string,
+  options: WorkspaceMemoryCandidateParseOptions = {},
+): WorkspaceMemoryParseResult {
   const block = extractCandidateBlock(summary);
-  if (!block) return [];
+  if (!block) return { entries: [], evidence: [] };
 
   const nowMs = Date.now();
   const now = new Date(nowMs).toISOString();
   const entries: LongTermMemoryEntry[] = [];
+  const evidence: EvidenceEventInput[] = [];
 
   for (const line of block.split("\n")) {
     // Accept both "- [type] text" (bracketed) and "- type text" (bracketless)
@@ -331,18 +446,53 @@ export function parseWorkspaceMemoryCandidates(summary: string): LongTermMemoryE
     if (!item) continue;
     const type = (item[1] ?? item[2]).toLowerCase() as LongTermType;
     const normalizedBody = normalizeCandidateBody(item[3]);
-    if (!normalizedBody) continue;
+    if (!normalizedBody) {
+      evidence.push(extractionEvidence({
+        type: "extraction_candidate_rejected",
+        phase: "extraction",
+        outcome: "rejected",
+        reasonCodes: ["negated_request"],
+        memory: { type, source: "compaction" },
+        textPreview: evidenceTextPreview(item[3], 80),
+      }));
+      continue;
+    }
 
     const minLength = normalizedBody.hadTrigger ? 6 : 12;
-    if (normalizedBody.text.length < minLength) continue;
+    if (normalizedBody.text.length < minLength) {
+      evidence.push(extractionEvidence({
+        type: "extraction_candidate_rejected",
+        phase: "extraction",
+        outcome: "rejected",
+        reasonCodes: ["too_short"],
+        memory: { type, source: "compaction" },
+        textPreview: evidenceTextPreview(normalizedBody.text, 80),
+      }));
+      continue;
+    }
 
     // Apply quality gate
-    if (!shouldAcceptWorkspaceMemoryCandidate(
+    const quality = evaluateWorkspaceMemoryCandidate(
       { type, text: normalizedBody.text },
-      { fromMemoryTrigger: normalizedBody.hadTrigger },
+      {
-    )) continue;
+        fromMemoryTrigger: normalizedBody.hadTrigger,
+        workspaceKey: options.workspaceKey,
+        workspaceRootHash: options.workspaceRootHash,
+      },
+    );
+    if (!quality.accepted) {
+      evidence.push(extractionEvidence({
+        type: "extraction_candidate_rejected",
+        phase: "extraction",
+        outcome: "rejected",
+        reasonCodes: quality.reasons,
+        memory: { type, source: "compaction" },
+        textPreview: evidenceTextPreview(normalizedBody.text, 80),
+      }));
+      continue;
+    }
 
-    entries.push({
+    const memory: LongTermMemoryEntry = {
       id: id("mem"),
       type,
       text: normalizedBody.text.slice(0, LONG_TERM_LIMITS.maxEntryTextChars),
@@ -353,8 +503,17 @@ export function parseWorkspaceMemoryCandidates(summary: string): LongTermMemoryE
       updatedAt: now,
       retentionClock: nowMs,
       staleAfterDays: staleAfterDaysFor(type),
-    });
+    };
+    entries.push(memory);
+    evidence.push(extractionEvidence({
+      type: "extraction_candidate_accepted",
+      phase: "extraction",
+      outcome: "accepted",
+      reasonCodes: ["quality_gate_passed", "valid_candidate_format"],
+      memory: memoryEvidence(memory),
+      textPreview: evidenceTextPreview(memory.text),
+    }));
   }
 
-  return entries;
+  return { entries, evidence };
 }

src/memory-quality.ts

@@ -78,15 +78,39 @@ export function isFeedbackQualityViolation(text: string): boolean {
   return true;
 }
 
-export function isDecisionQualityViolation(text: string): boolean {
+export function hasFutureRule(text: string): boolean {
-  const futureRule = /\b(?:use|keep|prefer|avoid|do not|don't|must|should|never|always|require|choose|reject)\b/i.test(text)
+  return /\b(?:use|keep|prefer|avoid|do not|don't|must|should|never|always|require|choose|reject)\b/i.test(text)
     || /(?:使用|保持|避免|不要|必須|必须|應該|应该|選擇|选择)/u.test(text);
-  if (!futureRule) return true;
+}
+
+export function isArchitectureLikeDecision(text: string): boolean {
+  if (/\b(?:[A-Z][A-Z0-9]*_[A-Z0-9_]*|[A-Z][A-Z0-9]{3,})\b/.test(text)) return true;
+  if (/\b(?:schema|model|scoring|retention|cap|evidence|normalization|root cause|architecture(?!\s+keywords?)|boundary|rule|memory system)\b/i.test(text)) return true;
+  if (/(?:模型|架構|架构|证据|證據|規則|规则|邊界|边界|記憶系統|记忆系统|原因|採用|采用)/u.test(text)) return true;
+  return false;
+}
+
+export function isImplementationStatusDecision(text: string): boolean {
   if (/\b(?:implemented|added|updated|fixed|completed|reviewed)\b/i.test(text)) return true;
   if (/\b(?:was|were|has been|had been)\b/i.test(text) && /\b(?:previous|last|latest|this session|this wave|already)\b/i.test(text)) return true;
   return false;
 }
 
+export function isDecisionQualityViolation(text: string): boolean {
+  if (hasFutureRule(text)) {
+    if (isImplementationStatusDecision(text)) return true;
+    return false;
+  }
+
+  if (isArchitectureLikeDecision(text)) {
+    if (isImplementationStatusDecision(text)) return true;
+    if (/\b(?:session|wave|task|test|CI|compatibility|commit)\b/i.test(text)) return true;
+    return false;
+  }
+
+  return true;
+}
+
 function isRawErrorViolation(text: string): boolean {
   if (/^\s*(Error|TypeError|ReferenceError|SyntaxError|Exception):/i.test(text)) return true;
   if (/at \S+ \([^)]+:\d+:\d+\)/.test(text)) return true;

src/paths.ts

@@ -24,6 +24,10 @@ export async function workspacePendingJournalPath(root: string): Promise<string>
   return join(await memoryRoot(root), "workspace-pending-journal.json");
 }
 
+export async function workspaceEvidenceLogPath(root: string): Promise<string> {
+  return join(await memoryRoot(root), "evidence", "events.jsonl");
+}
+
 export async function sessionStatePath(root: string, sessionID: string): Promise<string> {
   const safeSessionID = createHash("sha256").update(sessionID).digest("hex").slice(0, 32);
   return join(await memoryRoot(root), "sessions", `${safeSessionID}.json`);

src/plugin.ts

@@ -23,21 +23,23 @@
  * - Parses compaction summaries for memory candidates and merges them
  */
 
-import { rm } from "fs/promises";
+import { createHash } from "node:crypto";
+import { realpath, rm } from "fs/promises";
 import type { Plugin } from "@opencode-ai/plugin";
 import {
-  extractExplicitMemories,
+  extractExplicitMemoriesWithEvidence,
   extractActiveFiles,
   extractErrorsFromBash,
-  parseWorkspaceMemoryCandidates,
+  parseWorkspaceMemoryCandidatesWithEvidence,
 } from "./extractors.ts";
 import {
   loadWorkspaceMemory,
   updateWorkspaceMemory,
   updateWorkspaceMemoryWithAccounting,
-  renderWorkspaceMemory,
+  accountWorkspaceMemoryRender,
-  reinforceMemory,
+  workspaceMemoryIdentityKey,
 } from "./workspace-memory.ts";
+import { reinforceMemory } from "./retention.ts";
 import {
   appendPendingMemories,
   clearPendingMemories,
@@ -56,14 +58,15 @@ import {
   addRecentDecision,
   renderHotSessionState,
 } from "./session-state.ts";
-import { sessionStatePath } from "./paths.ts";
+import { sessionStatePath, workspaceKey } from "./paths.ts";
 import {
   latestUserText,
   latestCompactionSummary,
   pendingTodos,
 } from "./opencode.ts";
-import { accountPendingPromotions } from "./promotion-accounting.ts";
+import { accountPendingPromotions, promotionAccountingEvidenceEvents } from "./promotion-accounting.ts";
-import { WORKSPACE_MEMORY_CACHE_LIMITS } from "./types.ts";
+import { appendEvidenceEvent, appendEvidenceEvents, type EvidenceEventInput, type MemoryEvidenceRef } from "./evidence-log.ts";
+import { type LongTermMemoryEntry, WORKSPACE_MEMORY_CACHE_LIMITS } from "./types.ts";
 
 /**
  * Build the complete compaction prompt.
@@ -162,6 +165,38 @@ function renderTodosForCompaction(todos: Array<{ content: string; status: string
   return lines.join("\n");
 }
 
+function safeErrorMessage(error: unknown): string {
+  const message = error instanceof Error ? error.message : String(error);
+  return message.replace(/\s+/g, " ").slice(0, 240);
+}
+
+async function warnMemoryHook(scope: string, error: unknown, root?: string): Promise<void> {
+  const message = safeErrorMessage(error);
+  console.error(`[memory] ${scope} failed: ${message}`);
+  if (root) {
+    await appendEvidenceEvent(root, {
+      type: "hook_failed",
+      phase: "hook",
+      outcome: "failed",
+      reasonCodes: [scope],
+      details: { message },
+    }).catch(() => undefined);
+  }
+}
+
+async function workspaceRootHash(root: string): Promise<string> {
+  const resolved = await realpath(root).catch(() => root);
+  return createHash("sha256").update(resolved).digest("hex").slice(0, 16);
+}
+
+async function workspaceIdentity(root: string): Promise<{ workspaceKey: string; workspaceRootHash: string }> {
+  const [workspaceKeyValue, workspaceRootHashValue] = await Promise.all([
+    workspaceKey(root),
+    workspaceRootHash(root),
+  ]);
+  return { workspaceKey: workspaceKeyValue, workspaceRootHash: workspaceRootHashValue };
+}
+
 export const MemoryV2Plugin: Plugin = async (input) => {
   const { directory, client } = input;
 
@@ -198,6 +233,29 @@ export const MemoryV2Plugin: Plugin = async (input) => {
   // Cache for processed user message IDs (to avoid duplicate processing)
   const processedUserMessages = new Map<string, Set<string>>();
 
+  function memoryEvidenceRef(memory: LongTermMemoryEntry): MemoryEvidenceRef {
+    return {
+      memoryId: memory.id,
+      memoryKeyHash: memoryKey(memory),
+      identityKeyHash: workspaceMemoryIdentityKey(memory),
+      type: memory.type,
+      source: memory.source,
+      status: memory.status,
+    };
+  }
+
+  function pendingAppendedEvidence(memory: LongTermMemoryEntry): EvidenceEventInput {
+    return {
+      type: "pending_memory_appended",
+      phase: "pending_journal",
+      outcome: "accepted",
+      memory: memoryEvidenceRef(memory),
+      relations: [{ role: "pending", memory: memoryEvidenceRef(memory) }],
+      reasonCodes: ["pending_journal_append"],
+      textPreview: memory.text,
+    };
+  }
+
   function pruneFrozenWorkspaceMemoryCache(now = Date.now()): void {
     for (const [sessionID, cached] of frozenWorkspaceMemoryCache) {
       if (now - cached.loadedAt > WORKSPACE_MEMORY_CACHE_LIMITS.frozenTtlMs) {
@@ -254,7 +312,14 @@ export const MemoryV2Plugin: Plugin = async (input) => {
 
     if (!latestMessage?.id || processedForSession.has(latestMessage.id)) return;
 
-    const memories = extractExplicitMemories(latestMessage.text).map(memory => ({
+    const extraction = extractExplicitMemoriesWithEvidence(latestMessage.text);
+    await appendEvidenceEvents(directory, extraction.evidence.map(event => ({
+      ...event,
+      sessionHash: sessionID,
+      messageHash: latestMessage.id,
+    })));
+
+    const memories = extraction.entries.map(memory => ({
       ...memory,
       pendingOwnerSessionID: sessionID,
       pendingMessageID: latestMessage.id,
@@ -267,6 +332,11 @@ export const MemoryV2Plugin: Plugin = async (input) => {
         return state;
       });
       await appendPendingMemories(directory, memories);
+      await appendEvidenceEvents(directory, memories.map(memory => ({
+        ...pendingAppendedEvidence(memory),
+        sessionHash: sessionID,
+        messageHash: latestMessage.id,
+      })));
     }
 
     if (decisions.length > 0) {
@@ -285,6 +355,22 @@ export const MemoryV2Plugin: Plugin = async (input) => {
     rememberProcessedUserMessage(sessionID, latestMessage.id, processedForSession);
   }
 
+  function dedupePendingPromotionMemories(
+    memories: LongTermMemoryEntry[],
+  ): LongTermMemoryEntry[] {
+    const seen = new Set<string>();
+    const deduped: LongTermMemoryEntry[] = [];
+
+    for (const memory of memories) {
+      const key = memoryKey(memory);
+      if (seen.has(key)) continue;
+      seen.add(key);
+      deduped.push(memory);
+    }
+
+    return deduped;
+  }
+
   async function promotePendingMemories(
     sessionID?: string,
     options: { includeUnownedJournal?: boolean; includeOwnedJournal?: boolean } = {},
@@ -302,10 +388,10 @@ export const MemoryV2Plugin: Plugin = async (input) => {
       return false;
     });
 
-    const pending = [
+    const pending = dedupePendingPromotionMemories([
       ...(sessionState?.pendingMemories ?? []),
       ...journalPending,
-    ];
+    ]);
     if (pending.length === 0) return;
 
     let beforeEntries: Awaited<ReturnType<typeof loadWorkspaceMemory>>["entries"] = [];
@@ -364,6 +450,20 @@ export const MemoryV2Plugin: Plugin = async (input) => {
       },
     );
 
+    await appendEvidenceEvents(directory, [
+      ...updateResult.evidence,
+      ...promotionAccountingEvidenceEvents({
+        pending,
+        after: updateResult.store.entries,
+        events: updateResult.events,
+        accounting,
+        exhaustedRejectedKeys,
+      }),
+    ].map(event => ({
+      ...event,
+      sessionHash: sessionID,
+    })));
+
     const sessionRemovalKeys = new Set([
       ...accounting.clearableKeys,
       ...exhaustedRejectedKeys,
@@ -438,7 +538,12 @@ export const MemoryV2Plugin: Plugin = async (input) => {
     }
 
     const store = await loadWorkspaceMemory(root);
-    const renderedPrompt = renderWorkspaceMemory(store);
+    const renderAccounting = accountWorkspaceMemoryRender(store);
+    const renderedPrompt = renderAccounting.prompt;
+    await appendEvidenceEvents(root, renderAccounting.evidence.map(event => ({
+      ...event,
+      sessionHash: sessionID,
+    })));
     frozenWorkspaceMemoryCache.set(sessionID, { store, renderedPrompt, loadedAt: now });
     pruneFrozenWorkspaceMemoryCache(now);
     return { store, renderedPrompt };
@@ -462,38 +567,42 @@ export const MemoryV2Plugin: Plugin = async (input) => {
       const { sessionID } = hookInput;
       if (!sessionID) return;
 
-      pruneFrozenWorkspaceMemoryCache();
+      try {
-      pruneProcessedUserMessagesCache();
+        pruneFrozenWorkspaceMemoryCache();
+        pruneProcessedUserMessagesCache();
 
-      // Sub-agents are short-lived - skip memory system
+        // Sub-agents are short-lived - skip memory system
-      if (await isSubAgent(sessionID)) return;
+        if (await isSubAgent(sessionID)) return;
 
-      // Process explicit user memory even on no-tool turns. Keep this after the
+        // Process explicit user memory even on no-tool turns. Keep this after the
-      // sub-agent guard so child sessions never append to the parent journal.
+        // sub-agent guard so child sessions never append to the parent journal.
-      await processLatestUserMessage(sessionID);
+        await processLatestUserMessage(sessionID);
 
-      // Before first snapshot in this session, promote durable unowned backlog from
+        // Before first snapshot in this session, promote durable unowned backlog from
-      // prior sessions. Current-turn owned explicit memory remains pending and only
+        // prior sessions. Current-turn owned explicit memory remains pending and only
-      // appears in hot state for this transform.
+        // appears in hot state for this transform.
-      if (!frozenWorkspaceMemoryCache.has(sessionID) && await hasPendingJournalEntries(directory)) {
+        if (!frozenWorkspaceMemoryCache.has(sessionID) && await hasPendingJournalEntries(directory)) {
-        await promotePendingMemories(undefined, { includeUnownedJournal: true, includeOwnedJournal: false });
+          await promotePendingMemories(undefined, { includeUnownedJournal: true, includeOwnedJournal: false });
-      }
+        }
 
-      // Get frozen workspace memory snapshot (loaded and rendered once per session)
+        // Get frozen workspace memory snapshot (loaded and rendered once per session)
-      const workspaceSnapshot = await getFrozenWorkspaceMemorySnapshot(directory, sessionID);
+        const workspaceSnapshot = await getFrozenWorkspaceMemorySnapshot(directory, sessionID);
 
-      // Get current hot session state
+        // Get current hot session state
-      const sessionState = await loadSessionState(directory, sessionID);
+        const sessionState = await loadSessionState(directory, sessionID);
 
-      // Inject frozen workspace memory snapshot
+        // Inject frozen workspace memory snapshot
-      if (workspaceSnapshot.renderedPrompt) {
+        if (workspaceSnapshot.renderedPrompt) {
-        output.system.push(workspaceSnapshot.renderedPrompt);
+          output.system.push(workspaceSnapshot.renderedPrompt);
-      }
+        }
 
-      // Render and inject hot session state
+        // Render and inject hot session state
-      const hotPrompt = renderHotSessionState(sessionState, directory);
+        const hotPrompt = renderHotSessionState(sessionState, directory);
-      if (hotPrompt) {
+        if (hotPrompt) {
-        output.system.push(hotPrompt);
+          output.system.push(hotPrompt);
+        }
+      } catch (error) {
+        await warnMemoryHook("chat.system.transform", error, directory);
       }
     },
 
@@ -506,50 +615,54 @@ export const MemoryV2Plugin: Plugin = async (input) => {
       // Sub-agents don't need memory tracking
       if (await isSubAgent(sessionID)) return;
 
-      await updateSessionState(directory, sessionID, state => {
+      try {
-        // Track active files from tool usage
+        await updateSessionState(directory, sessionID, state => {
-        if (toolName === "read" || toolName === "edit" || toolName === "write" || toolName === "grep") {
+          // Track active files from tool usage
-          const files = extractActiveFiles(
+          if (toolName === "read" || toolName === "edit" || toolName === "write" || toolName === "grep") {
-            toolName,
+            const files = extractActiveFiles(
-            args as Record<string, unknown>,
+              toolName,
-            toolOutput ?? ""
+              args as Record<string, unknown>,
-          );
+              toolOutput ?? ""
-          for (const { path, action } of files) {
+            );
-            touchActiveFile(state, path, action);
+            for (const { path, action } of files) {
-            if (action === "edit" || action === "write") {
+              touchActiveFile(state, path, action);
-              markErrorsMaybeFixedForFile(state, path, directory);
+              if (action === "edit" || action === "write") {
+                markErrorsMaybeFixedForFile(state, path, directory);
+              }
             }
           }
-        }
 
-        // Track errors from failed bash commands
+          // Track errors from failed bash commands
-        if (toolName === "bash") {
+          if (toolName === "bash") {
-          const argsRecord = args as Record<string, unknown>;
+            const argsRecord = args as Record<string, unknown>;
-          const command: string = typeof argsRecord?.command === "string"
+            const command: string = typeof argsRecord?.command === "string"
-            ? argsRecord.command
+              ? argsRecord.command
-            : "";
+              : "";
-          const outputText: string = toolOutput ?? "";
+            const outputText: string = toolOutput ?? "";
 
-          // Check if command succeeded - clear errors for that category
+            // Check if command succeeded - clear errors for that category
-          const exitCode = bashExitCode(hookOutput);
+            const exitCode = bashExitCode(hookOutput);
-          if (typeof exitCode !== "number") {
+            if (typeof exitCode !== "number") {
-            // Unknown exit status: do not extract and do not clear
+              // Unknown exit status: do not extract and do not clear
-          } else if (exitCode === 0 && command) {
+            } else if (exitCode === 0 && command) {
-            clearErrorsForSuccessfulCommand(state, command);
+              clearErrorsForSuccessfulCommand(state, command);
-          } else if (command) {
+            } else if (command) {
-            // Only extract errors for commands with explicit non-zero exit
+              // Only extract errors for commands with explicit non-zero exit
-            const errors = extractErrorsFromBash(command, outputText);
+              const errors = extractErrorsFromBash(command, outputText);
-            for (const error of errors) {
+              for (const error of errors) {
-              upsertOpenError(state, error);
+                upsertOpenError(state, error);
+              }
             }
           }
-        }
+          return state;
-        return state;
+        });
-      });
 
-      // Process explicit memory from latest user message
+        // Process explicit memory from latest user message
-      // Only process once per message ID
+        // Only process once per message ID
-      await processLatestUserMessage(sessionID);
+        await processLatestUserMessage(sessionID);
+      } catch (error) {
+        await warnMemoryHook("tool.execute.after", error, directory);
+      }
     },
 
     /**
@@ -567,95 +680,110 @@ export const MemoryV2Plugin: Plugin = async (input) => {
       const { sessionID } = hookInput;
       if (!sessionID) return;
 
-      // Sub-agents don't need compaction support
+      try {
-      if (await isSubAgent(sessionID)) return;
+        // Sub-agents don't need compaction support
+        if (await isSubAgent(sessionID)) return;
 
-      // Preserve context injected by other plugins that ran before us.
+        // Preserve context injected by other plugins that ran before us.
-      // Setting output.prompt bypasses the default prompt + context join,
+        // Setting output.prompt bypasses the default prompt + context join,
-      // so we must explicitly carry forward any existing output.context.
+        // so we must explicitly carry forward any existing output.context.
-      const otherContext = output.context.filter(Boolean).join("\n\n");
+        const otherContext = output.context.filter(Boolean).join("\n\n");
 
-      // Build our private context (workspace memory, hot state, todos)
+        // Build our private context (workspace memory, hot state, todos)
-      const contextParts: string[] = [];
+        const contextParts: string[] = [];
 
       // 1. Frozen workspace memory snapshot
-      const workspaceSnapshot = await getFrozenWorkspaceMemorySnapshot(directory, sessionID);
+        const workspaceSnapshot = await getFrozenWorkspaceMemorySnapshot(directory, sessionID);
-      if (workspaceSnapshot.renderedPrompt) {
+        if (workspaceSnapshot.renderedPrompt) {
-        contextParts.push(workspaceSnapshot.renderedPrompt);
+          contextParts.push(workspaceSnapshot.renderedPrompt);
+        }
+
+        // 2. Hot session state
+        const sessionState = await loadSessionState(directory, sessionID);
+        const hotPrompt = renderHotSessionState(sessionState, directory);
+        if (hotPrompt) {
+          contextParts.push(hotPrompt);
+        }
+
+        // 3. Pending todos from OpenCode
+        const todos = await pendingTodos(client, sessionID);
+        const todosPrompt = renderTodosForCompaction(todos);
+        if (todosPrompt) {
+          contextParts.push(todosPrompt);
+        }
+
+        // Combine: other plugins' context first, then our private context
+        const privateContext = [otherContext, ...contextParts]
+          .filter(Boolean)
+          .join("\n\n");
+
+        // Replace the default prompt entirely with our ---free template
+        output.prompt = buildCompactionPrompt(privateContext);
+
+        // Clear context array since we consumed it into output.prompt.
+        // Subsequent plugins that set output.prompt will also need to check
+        // output.context if they want to preserve other plugin contributions.
+        output.context.length = 0;
+      } catch (error) {
+        await warnMemoryHook("session.compacting", error, directory);
       }
-
-      // 2. Hot session state
-      const sessionState = await loadSessionState(directory, sessionID);
-      const hotPrompt = renderHotSessionState(sessionState, directory);
-      if (hotPrompt) {
-        contextParts.push(hotPrompt);
-      }
-
-      // 3. Pending todos from OpenCode
-      const todos = await pendingTodos(client, sessionID);
-      const todosPrompt = renderTodosForCompaction(todos);
-      if (todosPrompt) {
-        contextParts.push(todosPrompt);
-      }
-
-      // Combine: other plugins' context first, then our private context
-      const privateContext = [otherContext, ...contextParts]
-        .filter(Boolean)
-        .join("\n\n");
-
-      // Replace the default prompt entirely with our ---free template
-      output.prompt = buildCompactionPrompt(privateContext);
-
-      // Clear context array since we consumed it into output.prompt.
-      // Subsequent plugins that set output.prompt will also need to check
-      // output.context if they want to preserve other plugin contributions.
-      output.context.length = 0;
     },
 
     // Handle session events
     event: async ({ event }) => {
       if (event.type === "session.compacted") {
-        const sessionID = sessionIDFromEventProperties(event.properties);
-        if (!sessionID) return;
-
-        // Sub-agents don't need post-compaction processing
-        if (await isSubAgent(sessionID)) return;
-
-        // Parse latest compaction summary for memory candidates, stage them into
-        // durable pending journal, then promote pending memories.
-        const summary = await latestCompactionSummary(client, sessionID);
-        const candidates = summary ? parseWorkspaceMemoryCandidates(summary) : [];
-        if (candidates.length > 0) {
-          await appendPendingMemories(directory, candidates);
-        }
-
         try {
+          const sessionID = sessionIDFromEventProperties(event.properties);
+          if (!sessionID) return;
+
+          // Sub-agents don't need post-compaction processing
+          if (await isSubAgent(sessionID)) return;
+
+          // Parse latest compaction summary for memory candidates, stage them into
+          // durable pending journal, then promote pending memories.
+          const summary = await latestCompactionSummary(client, sessionID);
+          const parseResult = summary
+            ? parseWorkspaceMemoryCandidatesWithEvidence(summary, await workspaceIdentity(directory))
+            : { entries: [], evidence: [] };
+          await appendEvidenceEvents(directory, parseResult.evidence.map(event => ({
+            ...event,
+            sessionHash: sessionID,
+          })));
+          const candidates = parseResult.entries;
+          if (candidates.length > 0) {
+            await appendPendingMemories(directory, candidates);
+            await appendEvidenceEvents(directory, candidates.map(memory => ({
+              ...pendingAppendedEvidence(memory),
+              sessionHash: sessionID,
+            })));
+          }
+
           await promotePendingMemories(sessionID, { includeUnownedJournal: true });
-        } catch {
+        } catch (error) {
           // Keep pending memories in session/journal for retry on next event/session.
+          await warnMemoryHook("event.session.compacted", error, directory);
         }
       }
 
       if (event.type === "session.deleted") {
-        const sessionID = sessionIDFromEventProperties(event.properties);
+        try {
-        if (sessionID) {
+          const sessionID = sessionIDFromEventProperties(event.properties);
+          if (sessionID) {
           // Promote pending memories before deleting per-session state.
           // If promotion fails, leave session state and journal intact.
-          let promoted = false;
+            let promoted = false;
-          try {
             await promotePendingMemories(sessionID, { includeOwnedJournal: true, includeUnownedJournal: false });
             promoted = true;
-          } catch {
-            return;
-          } finally {
             if (promoted) {
               frozenWorkspaceMemoryCache.delete(sessionID);
               processedUserMessages.delete(sessionID);
               sessionParentCache.delete(sessionID);
             }
-          }
 
-          await rm(await sessionStatePath(directory, sessionID), { force: true });
+            await rm(await sessionStatePath(directory, sessionID), { force: true });
+          }
+        } catch (error) {
+          await warnMemoryHook("event.session.deleted", error, directory);
         }
       }
     },

src/promotion-accounting.ts

@@ -2,6 +2,7 @@ import type { LongTermMemoryEntry } from "./types.ts";
 import { memoryKey } from "./pending-journal.ts";
 import type { MemoryConsolidationEvent } from "./workspace-memory.ts";
 import { workspaceMemoryIdentityKey } from "./workspace-memory.ts";
+import type { EvidenceEventInput, MemoryEvidenceRef } from "./evidence-log.ts";
 
 export type PendingPromotionAccounting = {
   promotedKeys: Set<string>;
@@ -105,3 +106,118 @@ export function accountPendingPromotions(input: {
     clearableKeys,
   };
 }
+
+function memoryRef(memory: LongTermMemoryEntry | undefined): MemoryEvidenceRef | undefined {
+  if (!memory) return undefined;
+  return {
+    memoryId: memory.id,
+    memoryKeyHash: memoryKey(memory),
+    identityKeyHash: workspaceMemoryIdentityKey(memory),
+    type: memory.type,
+    source: memory.source,
+    status: memory.status,
+  };
+}
+
+function retainedMemoryFor(
+  pending: LongTermMemoryEntry,
+  event: MemoryConsolidationEvent | undefined,
+  after: LongTermMemoryEntry[],
+): LongTermMemoryEntry | undefined {
+  if (event?.retainedId) {
+    const byId = after.find(memory => memory.id === event.retainedId);
+    if (byId) return byId;
+  }
+
+  const exactKey = memoryKey(pending);
+  const identityKey = workspaceMemoryIdentityKey(pending);
+  return after.find(memory => memory.status !== "superseded" && (
+    memoryKey(memory) === exactKey || workspaceMemoryIdentityKey(memory) === identityKey
+  ));
+}
+
+function promotionEventBase(
+  type: EvidenceEventInput["type"],
+  outcome: EvidenceEventInput["outcome"],
+  memory: LongTermMemoryEntry,
+  reasonCodes: string[],
+): EvidenceEventInput {
+  return {
+    type,
+    phase: "promotion",
+    outcome,
+    memory: memoryRef(memory),
+    reasonCodes,
+    textPreview: memory.text,
+  };
+}
+
+export function promotionAccountingEvidenceEvents(input: {
+  pending: LongTermMemoryEntry[];
+  after: LongTermMemoryEntry[];
+  events?: MemoryConsolidationEvent[];
+  accounting: PendingPromotionAccounting;
+  exhaustedRejectedKeys?: Set<string>;
+}): EvidenceEventInput[] {
+  const terminalByKey = new Map((input.events ?? []).map(event => [event.memoryKey, event]));
+  const exhaustedRejectedKeys = input.exhaustedRejectedKeys ?? new Set<string>();
+  const evidence: EvidenceEventInput[] = [];
+
+  for (const pending of input.pending) {
+    const key = memoryKey(pending);
+    const terminal = terminalByKey.get(key);
+    const retained = retainedMemoryFor(pending, terminal, input.after);
+
+    if (input.accounting.promotedKeys.has(key)) {
+      evidence.push({
+        ...promotionEventBase("promotion_promoted", "promoted", pending, ["new_workspace_entry"]),
+        relations: [
+          { role: "promoted", memory: memoryRef(retained ?? pending) },
+        ],
+      });
+      continue;
+    }
+
+    if (input.accounting.absorbedKeys.has(key)) {
+      const exact = terminal?.reason !== "absorbed_identity";
+      evidence.push({
+        ...promotionEventBase(
+          exact ? "promotion_absorbed_exact" : "promotion_absorbed_identity",
+          "absorbed",
+          pending,
+          [exact ? "same_exact_key" : "same_identity_key"],
+        ),
+        relations: [
+          { role: "absorbed" as const, memory: memoryRef(pending) },
+          { role: "retained" as const, memory: memoryRef(retained) },
+        ].filter(relation => relation.memory),
+      });
+      continue;
+    }
+
+    if (input.accounting.supersededKeys.has(key)) {
+      evidence.push({
+        ...promotionEventBase("promotion_superseded", "superseded", pending, ["superseded_existing"]),
+        relations: [
+          { role: "superseded" as const, memory: memoryRef(pending) },
+          { role: "superseded_by" as const, memory: memoryRef(retained) },
+        ].filter(relation => relation.memory),
+      });
+      continue;
+    }
+
+    if (input.accounting.rejectedKeys.has(key)) {
+      evidence.push(promotionEventBase("promotion_rejected_capacity", "rejected", pending, ["capacity_rejected"]));
+      if (input.accounting.retryableRejectedKeys.has(key)) {
+        evidence.push(promotionEventBase(
+          exhaustedRejectedKeys.has(key) ? "promotion_retry_exhausted" : "promotion_retry_scheduled",
+          exhaustedRejectedKeys.has(key) ? "exhausted" : "retried",
+          pending,
+          [exhaustedRejectedKeys.has(key) ? "max_attempts_reached" : "retryable_capacity_rejection"],
+        ));
+      }
+    }
+  }
+
+  return evidence;
+}

src/retention.ts

@@ -0,0 +1,148 @@
+import type { LongTermMemoryEntry, WorkspaceMemoryStore } from "./types.ts";
+
+// Retention decay model constants (v1.5)
+export const BASE_HALF_LIFE_DAYS = 45;
+export const REINFORCEMENT_HALFLIFE_FACTOR = 0.85;
+export const REINFORCEMENT_MAX_COUNT = 6;
+export const REINFORCEMENT_MIN_INTERVAL_MS = 60 * 60 * 1000; // 1 hour
+export const WORKSPACE_DORMANT_AFTER_DAYS = 14;
+export const DORMANT_DECAY_MULTIPLIER = 0.25;
+export const DAY_MS = 24 * 60 * 60 * 1000;
+
+export const TYPE_FACTOR = {
+  reference: 1.0,
+  project: 1.25,
+  feedback: 2.25,
+  decision: 2.5,
+} as const;
+
+export const SOURCE_FACTOR = {
+  compaction: 1.0,
+  manual: 1.4,
+  explicit: 2.0,
+} as const;
+
+export const USER_IMPORTANCE_FACTOR = {
+  low: 0.7,
+  normal: 1.0,
+  high: 1.5,
+} as const;
+
+export const RETENTION_TYPE_MAX = {
+  feedback: 10,
+  decision: 10,
+  project: 8,
+  reference: 6,
+} as const;
+
+export function calculateInitialStrength(memory: LongTermMemoryEntry): number {
+  const typeFactor = TYPE_FACTOR[memory.type] ?? 1.0;
+  const sourceFactor = SOURCE_FACTOR[memory.source] ?? 1.0;
+  const importanceFactor = USER_IMPORTANCE_FACTOR[memory.userImportance ?? "normal"] ?? 1.0;
+
+  return typeFactor * sourceFactor * importanceFactor;
+}
+
+export function calculateEffectiveHalfLife(memory: LongTermMemoryEntry): number {
+  const reinforcementCount = Math.min(
+    memory.reinforcementCount ?? 0,
+    REINFORCEMENT_MAX_COUNT,
+  );
+  const factor = Math.pow(REINFORCEMENT_HALFLIFE_FACTOR, reinforcementCount);
+  return BASE_HALF_LIFE_DAYS / factor;
+}
+
+function timestampMs(value: unknown, fallback: number): number {
+  const ms = typeof value === "number" ? value : new Date(String(value)).getTime();
+  return Number.isFinite(ms) ? ms : fallback;
+}
+
+export function calculateRetentionStrength(
+  memory: LongTermMemoryEntry,
+  now: number,
+  lastActivityAt?: string,
+): number {
+  const initialStrength = calculateInitialStrength(memory);
+  const effectiveHalfLife = calculateEffectiveHalfLife(memory);
+
+  // Use retentionClock if available, fallback to updatedAt.
+  const retentionStart = Number.isFinite(memory.retentionClock)
+    ? memory.retentionClock
+    : memory.updatedAt ?? memory.createdAt;
+  const createdAtMs = timestampMs(retentionStart, now);
+  const effectiveAgeDays = calculateEffectiveAgeDays(createdAtMs, now, lastActivityAt);
+
+  // Calculate strength using exponential decay.
+  const strength = initialStrength * Math.pow(2, -effectiveAgeDays / effectiveHalfLife);
+
+  return Number.isFinite(strength) ? Math.max(0, strength) : 0;
+}
+
+export function calculateDormantDays(store: WorkspaceMemoryStore, now: number): number {
+  const lastActivity = store.lastActivityAt
+    ? new Date(store.lastActivityAt).getTime()
+    : now;
+  if (!Number.isFinite(lastActivity)) return 0;
+
+  const daysSinceActivity = (now - lastActivity) / DAY_MS;
+  return Math.max(0, daysSinceActivity);
+}
+
+export function calculateEffectiveAgeDays(
+  entryStartMs: number,
+  now: number,
+  lastActivityAt?: string,
+): number {
+  const wallAgeDays = Math.max(0, (now - entryStartMs) / DAY_MS);
+
+  if (!lastActivityAt) return wallAgeDays;
+
+  const lastActivityMs = new Date(lastActivityAt).getTime();
+  if (!Number.isFinite(lastActivityMs)) return wallAgeDays;
+
+  const dormantStartMs = lastActivityMs + WORKSPACE_DORMANT_AFTER_DAYS * DAY_MS;
+  const overlapStartMs = Math.max(entryStartMs, dormantStartMs);
+  const dormantOverlapDays = Math.max(0, (now - overlapStartMs) / DAY_MS);
+  const activeDays = wallAgeDays - dormantOverlapDays;
+
+  return activeDays + dormantOverlapDays * DORMANT_DECAY_MULTIPLIER;
+}
+
+function isSameUTCCalendarDay(ts1: number, ts2: number): boolean {
+  const d1 = new Date(ts1);
+  const d2 = new Date(ts2);
+  return d1.getUTCFullYear() === d2.getUTCFullYear()
+    && d1.getUTCMonth() === d2.getUTCMonth()
+    && d1.getUTCDate() === d2.getUTCDate();
+}
+
+export function reinforceMemory(
+  memory: LongTermMemoryEntry,
+  sessionId: string,
+  now: number,
+): LongTermMemoryEntry {
+  if (memory.lastReinforcedSessionID === sessionId) {
+    return memory;
+  }
+
+  // Calendar-day diversity gate (OQ-2): same UTC day = no reinforcement.
+  if (memory.lastReinforcedAt && isSameUTCCalendarDay(memory.lastReinforcedAt, now)) {
+    return memory;
+  }
+
+  if (memory.lastReinforcedAt && now - memory.lastReinforcedAt < REINFORCEMENT_MIN_INTERVAL_MS) {
+    return memory;
+  }
+
+  if ((memory.reinforcementCount ?? 0) >= REINFORCEMENT_MAX_COUNT) {
+    return memory;
+  }
+
+  return {
+    ...memory,
+    reinforcementCount: (memory.reinforcementCount ?? 0) + 1,
+    lastReinforcedAt: now,
+    lastReinforcedSessionID: sessionId,
+    retentionClock: now,
+  };
+}

src/storage.ts

@@ -3,17 +3,66 @@ import { randomUUID } from "crypto";
 import { mkdir, open, readFile, rename, rm, stat, writeFile } from "fs/promises";
 import type { FileHandle } from "fs/promises";
 import { dirname } from "path";
+import { appendEvidenceEventForWorkspaceKey } from "./evidence-log.ts";
 
 const fileLocks = new Map<string, Promise<unknown>>();
 const LOCK_WAIT_TIMEOUT_MS = 5000;
 const LOCK_STALE_MS = 30_000;
 const LOCK_HEARTBEAT_MS = 1_000;
 
+function workspaceKeyFromStorePath(path: string): string | undefined {
+  return path.match(/[\\/]opencode-working-memory[\\/]workspaces[\\/]([a-f0-9]{16})[\\/]/i)?.[1];
+}
+
+function storeKindFromPath(path: string): string {
+  if (path.endsWith("workspace-memory.json")) return "workspace_memory";
+  if (path.endsWith("workspace-pending-journal.json")) return "pending_journal";
+  if (path.includes(`${"/"}sessions${"/"}`) || path.includes(`${"\\"}sessions${"\\"}`)) return "session_state";
+  return "unknown";
+}
+
+async function emitStorageEvidence(path: string, event: Parameters<typeof appendEvidenceEventForWorkspaceKey>[1]): Promise<void> {
+  const key = workspaceKeyFromStorePath(path);
+  if (!key) return;
+  await appendEvidenceEventForWorkspaceKey(key, event).catch(() => undefined);
+}
+
+async function quarantineCorruptJSON(path: string): Promise<string | null> {
+  const quarantinePath = `${path}.corrupt-${Date.now()}-${process.pid}-${randomUUID()}`;
+
+  try {
+    await rename(path, quarantinePath);
+    return quarantinePath;
+  } catch {
+    return null;
+  }
+}
+
 export async function readJSON<T>(path: string, fallback: () => T): Promise<T> {
   if (!existsSync(path)) return fallback();
+
   try {
     return JSON.parse(await readFile(path, "utf8")) as T;
-  } catch {
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const quarantinePath = await quarantineCorruptJSON(path);
+
+    if (quarantinePath) {
+      console.error(`[memory] invalid JSON in ${path}; quarantined to ${quarantinePath}: ${message}`);
+      await emitStorageEvidence(path, {
+        type: "storage_corrupt_json_quarantined",
+        phase: "storage",
+        outcome: "quarantined",
+        reasonCodes: ["invalid_json"],
+        details: {
+          storeKind: storeKindFromPath(path),
+          quarantined: true,
+        },
+      });
+    } else {
+      console.error(`[memory] invalid JSON in ${path}; using fallback without quarantine: ${message}`);
+    }
+
     return fallback();
   }
 }
@@ -82,10 +131,30 @@ async function withFileLock<T>(path: string, fn: () => Promise<T>): Promise<T> {
 
       if (await isLockStale(lockPath)) {
         await rm(lockPath, { force: true });
+        await emitStorageEvidence(path, {
+          type: "storage_stale_lock_recovered",
+          phase: "storage",
+          outcome: "recovered",
+          reasonCodes: ["stale_lock"],
+          details: {
+            storeKind: storeKindFromPath(path),
+            waitMs: Date.now() - started,
+          },
+        });
         continue;
       }
 
       if (Date.now() - started > LOCK_WAIT_TIMEOUT_MS) {
+        await emitStorageEvidence(path, {
+          type: "storage_lock_timeout",
+          phase: "storage",
+          outcome: "failed",
+          reasonCodes: ["lock_wait_timeout"],
+          details: {
+            storeKind: storeKindFromPath(path),
+            waitMs: LOCK_WAIT_TIMEOUT_MS,
+          },
+        });
         throw new Error(`Timed out waiting for lock ${lockPath}`);
       }
 

src/workspace-memory.ts

@@ -6,148 +6,18 @@ import { migrationLogPath, workspaceKey, workspaceMemoryPath } from "./paths.ts"
 import { atomicWriteJSON, readJSON, updateJSON } from "./storage.ts";
 import { assessMemoryQuality, isHardQualityReason, isProgressSnapshotViolation } from "./memory-quality.ts";
 import { redactCredentials } from "./redaction.ts";
+import {
+  RETENTION_TYPE_MAX,
+  calculateRetentionStrength,
+  reinforceMemory,
+} from "./retention.ts";
+import type { EvidenceEventInput, MemoryEvidenceRef } from "./evidence-log.ts";
 
 // Minimum length for workspace_memory envelope: <workspace_memory>\n...\n</workspace_memory>
 const MIN_ENVELOPE_LENGTH = 80;
 const MIGRATION_ID = "2026-04-26-p0-cleanup";
 const QUALITY_CLEANUP_MIGRATION_ID = "2026-04-28-quality-cleanup";
-
+const RETENTION_CLOCK_BACKFILL_MIGRATION_ID = "2026-05-01-retention-clock-backfill";
-// Retention decay model constants (v1.5)
-const BASE_HALF_LIFE_DAYS = 45;
-const REINFORCEMENT_HALFLIFE_FACTOR = 0.85;
-const REINFORCEMENT_MAX_COUNT = 6;
-const REINFORCEMENT_MIN_INTERVAL_MS = 60 * 60 * 1000; // 1 hour
-const WORKSPACE_DORMANT_AFTER_DAYS = 14;
-const DORMANT_DECAY_MULTIPLIER = 0.25;
-const DAY_MS = 24 * 60 * 60 * 1000;
-
-const TYPE_FACTOR = {
-  reference: 1.0,
-  project: 1.25,
-  feedback: 2.25,
-  decision: 2.5,
-} as const;
-
-const SOURCE_FACTOR = {
-  compaction: 1.0,
-  manual: 1.4,
-  explicit: 2.0,
-} as const;
-
-const USER_IMPORTANCE_FACTOR = {
-  low: 0.7,
-  normal: 1.0,
-  high: 1.5,
-} as const;
-
-const SAFETY_CRITICAL_FACTOR = 6.0;
-
-const TYPE_MAX = {
-  feedback: 10,
-  decision: 10,
-  project: 8,
-  reference: 6,
-} as const;
-
-export function calculateInitialStrength(memory: LongTermMemoryEntry): number {
-  const typeFactor = TYPE_FACTOR[memory.type] ?? 1.0;
-  const sourceFactor = SOURCE_FACTOR[memory.source] ?? 1.0;
-  const importanceFactor = USER_IMPORTANCE_FACTOR[memory.userImportance ?? "normal"] ?? 1.0;
-  const safetyFactor = memory.safetyCritical ? SAFETY_CRITICAL_FACTOR : 1.0;
-
-  return typeFactor * sourceFactor * importanceFactor * safetyFactor;
-}
-
-export function calculateEffectiveHalfLife(memory: LongTermMemoryEntry): number {
-  const reinforcementCount = Math.min(
-    memory.reinforcementCount ?? 0,
-    REINFORCEMENT_MAX_COUNT,
-  );
-  const factor = Math.pow(REINFORCEMENT_HALFLIFE_FACTOR, reinforcementCount);
-  return BASE_HALF_LIFE_DAYS / factor;
-}
-
-function timestampMs(value: unknown, fallback: number): number {
-  const ms = typeof value === "number" ? value : new Date(String(value)).getTime();
-  return Number.isFinite(ms) ? ms : fallback;
-}
-
-export function calculateRetentionStrength(
-  memory: LongTermMemoryEntry,
-  now: number,
-  lastActivityAt?: string,
-): number {
-  const initialStrength = calculateInitialStrength(memory);
-  const effectiveHalfLife = calculateEffectiveHalfLife(memory);
-
-  // Use retentionClock if available, fallback to updatedAt.
-  const retentionStart = Number.isFinite(memory.retentionClock)
-    ? memory.retentionClock
-    : memory.updatedAt ?? memory.createdAt;
-  const createdAtMs = timestampMs(retentionStart, now);
-  const effectiveAgeDays = calculateEffectiveAgeDays(createdAtMs, now, lastActivityAt);
-
-  // Calculate strength using exponential decay.
-  const strength = initialStrength * Math.pow(2, -effectiveAgeDays / effectiveHalfLife);
-
-  return Number.isFinite(strength) ? Math.max(0, strength) : 0;
-}
-
-export function calculateDormantDays(store: WorkspaceMemoryStore, now: number): number {
-  const lastActivity = store.lastActivityAt
-    ? new Date(store.lastActivityAt).getTime()
-    : now;
-  if (!Number.isFinite(lastActivity)) return 0;
-
-  const daysSinceActivity = (now - lastActivity) / DAY_MS;
-  return Math.max(0, daysSinceActivity);
-}
-
-export function calculateEffectiveAgeDays(
-  entryStartMs: number,
-  now: number,
-  lastActivityAt?: string,
-): number {
-  const wallAgeDays = Math.max(0, (now - entryStartMs) / DAY_MS);
-
-  if (!lastActivityAt) return wallAgeDays;
-
-  const lastActivityMs = new Date(lastActivityAt).getTime();
-  if (!Number.isFinite(lastActivityMs)) return wallAgeDays;
-
-  const dormantStartMs = lastActivityMs + WORKSPACE_DORMANT_AFTER_DAYS * DAY_MS;
-  const overlapStartMs = Math.max(entryStartMs, dormantStartMs);
-  const dormantOverlapDays = Math.max(0, (now - overlapStartMs) / DAY_MS);
-  const activeDays = wallAgeDays - dormantOverlapDays;
-
-  return activeDays + dormantOverlapDays * DORMANT_DECAY_MULTIPLIER;
-}
-
-export function reinforceMemory(
-  memory: LongTermMemoryEntry,
-  sessionId: string,
-  now: number,
-): LongTermMemoryEntry {
-  if (memory.lastReinforcedSessionID === sessionId) {
-    return memory;
-  }
-
-  if (memory.lastReinforcedAt && now - memory.lastReinforcedAt < REINFORCEMENT_MIN_INTERVAL_MS) {
-    return memory;
-  }
-
-  if ((memory.reinforcementCount ?? 0) >= REINFORCEMENT_MAX_COUNT) {
-    return memory;
-  }
-
-  return {
-    ...memory,
-    reinforcementCount: (memory.reinforcementCount ?? 0) + 1,
-    lastReinforcedAt: now,
-    lastReinforcedSessionID: sessionId,
-    retentionClock: now,
-  };
-}
 
 export type MemoryConsolidationReason =
   | "promoted"
@@ -170,6 +40,7 @@ export type LongTermLimitResult = {
   dropped: MemoryConsolidationEvent[];
   absorbed: MemoryConsolidationEvent[];
   superseded: MemoryConsolidationEvent[];
+  evidence: EvidenceEventInput[];
 };
 
 export type WorkspaceMemoryNormalizationResult = LongTermLimitResult & {
@@ -177,6 +48,16 @@ export type WorkspaceMemoryNormalizationResult = LongTermLimitResult & {
   events: MemoryConsolidationEvent[];
 };
 
+export type WorkspaceMemoryRenderAccounting = {
+  rendered: LongTermMemoryEntry[];
+  omitted: Array<{
+    memory: LongTermMemoryEntry;
+    reason: "superseded" | "type_cap" | "global_cap" | "char_budget" | "empty_render_budget";
+  }>;
+  evidence: EvidenceEventInput[];
+  prompt: string;
+};
+
 export type QualityCleanupMigrationLogEntry = {
   migrationId: string;
   timestamp: string;
@@ -249,6 +130,7 @@ function hasSecurityOrMigrationChange(
     if (beforeEntry.text !== afterEntry.text) return true;
     if ((beforeEntry.rationale ?? "") !== (afterEntry.rationale ?? "")) return true;
     if (beforeEntry.status !== afterEntry.status) return true;
+    if ((beforeEntry.retentionClock ?? null) !== (afterEntry.retentionClock ?? null)) return true;
   }
 
   const beforeMigrations = JSON.stringify(before.migrations ?? []);
@@ -288,6 +170,7 @@ export async function updateWorkspaceMemoryWithAccounting(
     dropped: [],
     absorbed: [],
     superseded: [],
+    evidence: [],
     events: [],
   };
 }
@@ -303,7 +186,8 @@ export async function normalizeWorkspaceMemoryWithAccounting(
   root: string,
   store: WorkspaceMemoryStore,
 ): Promise<WorkspaceMemoryNormalizationResult> {
-  const nowIso = new Date().toISOString();
+  const nowMs = Date.now();
+  const nowIso = new Date(nowMs).toISOString();
 
   let result: WorkspaceMemoryStore = {
     ...store,
@@ -355,6 +239,15 @@ export async function normalizeWorkspaceMemoryWithAccounting(
     result = runMigrationP0Cleanup(result, nowIso);
   }
 
+  result.entries = result.entries.map(entry => backfillRetentionClock(entry, nowMs));
+  if (!result.migrations.includes(RETENTION_CLOCK_BACKFILL_MIGRATION_ID)) {
+    result = {
+      ...result,
+      migrations: [...result.migrations, RETENTION_CLOCK_BACKFILL_MIGRATION_ID],
+      updatedAt: nowIso,
+    };
+  }
+
   // P0 accounting only considers active entries. Entries that were already
   // superseded before this normalization are preserved in storage; entries that
   // lose during this enforcement are reported via accounting events but are not
@@ -376,10 +269,29 @@ export async function normalizeWorkspaceMemoryWithAccounting(
     dropped: accounting.dropped,
     absorbed: accounting.absorbed,
     superseded: accounting.superseded,
+    evidence: accounting.evidence,
     events: [...accounting.dropped, ...accounting.absorbed, ...accounting.superseded],
   };
 }
 
+function backfillRetentionClock(entry: LongTermMemoryEntry, nowMs: number): LongTermMemoryEntry {
+  if (Number.isFinite(entry.retentionClock)) {
+    return entry;
+  }
+
+  const createdAtMs = new Date(entry.createdAt).getTime();
+  if (Number.isFinite(createdAtMs)) {
+    return { ...entry, retentionClock: createdAtMs };
+  }
+
+  const updatedAtMs = new Date(entry.updatedAt).getTime();
+  if (Number.isFinite(updatedAtMs)) {
+    return { ...entry, retentionClock: updatedAtMs };
+  }
+
+  return { ...entry, retentionClock: nowMs };
+}
+
 export function runMigrationP0Cleanup(
   store: WorkspaceMemoryStore,
   nowIso: string,
@@ -588,6 +500,31 @@ function consolidationEvent(
   };
 }
 
+function capacityRemovalEvidence(
+  memory: LongTermMemoryEntry,
+  reason: "type_cap" | "global_cap" | "capacity",
+): EvidenceEventInput {
+  return {
+    type: "memory_removed_capacity",
+    phase: "storage",
+    outcome: "removed",
+    reasonCodes: [reason],
+    memory: memoryEvidenceRef(memory),
+    relations: [{
+      role: "removed",
+      memory: memoryEvidenceRef(memory),
+    }],
+    details: {
+      type: memory.type,
+      globalCap: LONG_TERM_LIMITS.maxEntries,
+      ...(reason === "type_cap" ? { typeCap: RETENTION_TYPE_MAX[memory.type] } : {}),
+      ...(typeof memory.retentionClock === "number" && Number.isFinite(memory.retentionClock) ? { retentionClock: memory.retentionClock } : {}),
+      ...(memory.createdAt ? { createdAt: memory.createdAt } : {}),
+      ...(memory.source ? { source: memory.source } : {}),
+    },
+  };
+}
+
 /** Choose better memory when identity/topic keys conflict */
 function chooseBetterMemory(
   a: LongTermMemoryEntry,
@@ -643,6 +580,13 @@ export function enforceLongTermLimitsWithAccounting(
   const capped = applyTypeMaxCaps(sorted);
   const kept = capped.slice(0, LONG_TERM_LIMITS.maxEntries);
   const keptIds = new Set(kept.map(entry => entry.id));
+  const cappedIds = new Set(capped.map(entry => entry.id));
+  const typeCapLosers = sorted.filter(entry => !cappedIds.has(entry.id));
+  const globalCapLosers = capped.filter(entry => !keptIds.has(entry.id));
+  const capacityEvidence: EvidenceEventInput[] = [
+    ...typeCapLosers.map(entry => capacityRemovalEvidence(entry, "type_cap")),
+    ...globalCapLosers.map(entry => capacityRemovalEvidence(entry, "global_cap")),
+  ];
   const capacityDropped = sorted
     .filter(entry => !keptIds.has(entry.id))
     .map(entry => consolidationEvent(entry, "rejected_capacity"));
@@ -652,34 +596,39 @@ export function enforceLongTermLimitsWithAccounting(
     dropped: [...dedupeResult.dropped, ...capacityDropped],
     absorbed: dedupeResult.absorbed,
     superseded: dedupeResult.superseded,
+    evidence: [...dedupeResult.evidence, ...capacityEvidence],
   };
 }
 
 function applyTypeMaxCaps(entries: LongTermMemoryEntry[]): LongTermMemoryEntry[] {
+  return applyTypeMaxCapsWithOmissions(entries).kept;
+}
+
+function applyTypeMaxCapsWithOmissions(entries: LongTermMemoryEntry[]): { kept: LongTermMemoryEntry[]; omitted: LongTermMemoryEntry[] } {
   const capped: LongTermMemoryEntry[] = [];
+  const omitted: LongTermMemoryEntry[] = [];
   const typeCounts: Partial<Record<LongTermMemoryEntry["type"], number>> = {};
 
   for (const entry of entries) {
-    if (entry.safetyCritical) {
+    const count = typeCounts[entry.type] ?? 0;
-      capped.push(entry);
+    const max = RETENTION_TYPE_MAX[entry.type] ?? Infinity;
+    if (count >= max) {
+      omitted.push(entry);
       continue;
     }
 
-    const count = typeCounts[entry.type] ?? 0;
-    const max = TYPE_MAX[entry.type] ?? Infinity;
-    if (count >= max) continue;
-
     capped.push(entry);
     typeCounts[entry.type] = count + 1;
   }
 
-  return capped;
+  return { kept: capped, omitted };
 }
 
 export function dedupeLongTermEntriesWithAccounting(entries: LongTermMemoryEntry[]): LongTermLimitResult {
   const now = Date.now();
   const absorbed: MemoryConsolidationEvent[] = [];
   const superseded: MemoryConsolidationEvent[] = [];
+  const evidence: EvidenceEventInput[] = [];
 
   // For project/reference/feedback: dedupe by concrete identity or exact canonical text.
   const projectRefEntries = entries.filter(e => e.type === "project" || e.type === "reference" || e.type === "feedback");
@@ -703,6 +652,8 @@ export function dedupeLongTermEntriesWithAccounting(entries: LongTermMemoryEntry
         reinforcementSessionId(retained, dropped),
         now,
       );
+      const reinforcedEvent = reinforcementEvidence(retained, dropped, reinforced, reason);
+      if (reinforcedEvent) evidence.push(reinforcedEvent);
 
       absorbed.push(consolidationEvent(dropped, reason, reinforced));
       entityDeduped.set(key, reinforced);
@@ -729,6 +680,8 @@ export function dedupeLongTermEntriesWithAccounting(entries: LongTermMemoryEntry
         reinforcementSessionId(retained, dropped),
         now,
       );
+      const reinforcedEvent = reinforcementEvidence(retained, dropped, reinforced, reason);
+      if (reinforcedEvent) evidence.push(reinforcedEvent);
 
       if (reason === "superseded_existing") {
         superseded.push(consolidationEvent(dropped, reason, reinforced));
@@ -751,6 +704,40 @@ export function dedupeLongTermEntriesWithAccounting(entries: LongTermMemoryEntry
     dropped: [],
     absorbed,
     superseded,
+    evidence,
+  };
+}
+
+function memoryEvidenceRef(memory: LongTermMemoryEntry): MemoryEvidenceRef {
+  return {
+    memoryId: memory.id,
+    memoryKeyHash: workspaceMemoryExactKey(memory),
+    identityKeyHash: workspaceMemoryIdentityKey(memory),
+    type: memory.type,
+    source: memory.source,
+    status: memory.status,
+  };
+}
+
+function reinforcementEvidence(
+  retained: LongTermMemoryEntry,
+  dropped: LongTermMemoryEntry,
+  reinforced: LongTermMemoryEntry,
+  reason: "absorbed_exact" | "absorbed_identity" | "superseded_existing",
+): EvidenceEventInput | undefined {
+  if ((reinforced.reinforcementCount ?? 0) <= (retained.reinforcementCount ?? 0)) return undefined;
+  const duplicateReason = reason === "absorbed_identity" ? "duplicate_identity" : "duplicate_exact";
+  return {
+    type: "memory_reinforced",
+    phase: "reinforcement",
+    outcome: "reinforced",
+    memory: memoryEvidenceRef(reinforced),
+    relations: [
+      { role: "reinforced", memory: memoryEvidenceRef(reinforced) },
+      { role: "reinforced_by", memory: memoryEvidenceRef(dropped) },
+    ],
+    reasonCodes: [duplicateReason, "reinforcement_window_allowed"],
+    textPreview: reinforced.text,
   };
 }
 
@@ -785,20 +772,49 @@ function wouldFit(
 }
 
 export function renderWorkspaceMemory(store: WorkspaceMemoryStore): string {
-  const active = enforceLongTermLimitsWithAccounting(store.entries, store).kept;
+  return accountWorkspaceMemoryRender(store).prompt;
-  if (active.length === 0) return "";
+}
 
+export function accountWorkspaceMemoryRender(store: WorkspaceMemoryStore): WorkspaceMemoryRenderAccounting {
+  const now = Date.now();
   const maxChars = Math.min(
     store.limits.maxRenderedChars,
     LONG_TERM_LIMITS.maxRenderedChars
   );
+  const omitted: WorkspaceMemoryRenderAccounting["omitted"] = [];
+  const evidence: EvidenceEventInput[] = [];
+
+  for (const entry of store.entries) {
+    if (entry.status === "superseded") {
+      omitted.push({ memory: entry, reason: "superseded" });
+    }
+  }
+
+  const activeEntries = store.entries.filter(entry => entry.status !== "superseded");
+  const phase1 = activeEntries.map(entry => ({ ...entry, text: entry.text.slice(0, LONG_TERM_LIMITS.maxEntryTextChars) }));
+  const dedupeResult = dedupeLongTermEntriesWithAccounting(phase1);
+  const sorted = [...dedupeResult.kept].sort((a, b) => compareLongTermMemoryForRetention(a, b, now, store.lastActivityAt));
+  const typeCapResult = applyTypeMaxCapsWithOmissions(sorted);
+  for (const memory of typeCapResult.omitted) omitted.push({ memory, reason: "type_cap" });
+  const active = typeCapResult.kept.slice(0, LONG_TERM_LIMITS.maxEntries);
+  for (const memory of typeCapResult.kept.slice(LONG_TERM_LIMITS.maxEntries)) omitted.push({ memory, reason: "global_cap" });
+
+  if (active.length === 0) {
+    for (const item of omitted) evidence.push(renderEvidence(item.memory, "omitted", item.reason));
+    return { rendered: [], omitted, evidence, prompt: "" };
+  }
 
   // If maxChars smaller than minimum envelope, return empty string
-  if (maxChars < MIN_ENVELOPE_LENGTH) return "";
+  if (maxChars < MIN_ENVELOPE_LENGTH) {
+    for (const memory of active) omitted.push({ memory, reason: "empty_render_budget" });
+    for (const item of omitted) evidence.push(renderEvidence(item.memory, "omitted", item.reason));
+    return { rendered: [], omitted, evidence, prompt: "" };
+  }
 
   const lines: string[] = [
     "Workspace memory (cross-session, verify if stale):",
   ];
+  const rendered: LongTermMemoryEntry[] = [];
 
   for (const type of ["feedback", "project", "decision", "reference"] as const) {
     const items = active.filter(entry => entry.type === type);
@@ -810,6 +826,9 @@ export function renderWorkspaceMemory(store: WorkspaceMemoryStore): string {
       const line = `- ${renderEntry(item)}`;
       if ([...lines, ...sectionLines, line].join("\n").length <= maxChars) {
         sectionLines.push(line);
+        rendered.push(item);
+      } else {
+        omitted.push({ memory: item, reason: "char_budget" });
       }
     }
 
@@ -818,7 +837,26 @@ export function renderWorkspaceMemory(store: WorkspaceMemoryStore): string {
     }
   }
 
-  return lines.join("\n");
+  for (const memory of rendered) evidence.push(renderEvidence(memory, "rendered"));
+  for (const item of omitted) evidence.push(renderEvidence(item.memory, "omitted", item.reason));
+
+  return { rendered, omitted, evidence, prompt: lines.join("\n") };
+}
+
+function renderEvidence(
+  memory: LongTermMemoryEntry,
+  outcome: "rendered" | "omitted",
+  reason?: WorkspaceMemoryRenderAccounting["omitted"][number]["reason"],
+): EvidenceEventInput {
+  return {
+    type: outcome === "rendered" ? "render_selected" : "render_omitted",
+    phase: "render",
+    outcome,
+    memory: memoryEvidenceRef(memory),
+    relations: [{ role: outcome === "rendered" ? "rendered" : "omitted", memory: memoryEvidenceRef(memory) }],
+    reasonCodes: outcome === "rendered" ? ["within_caps", "within_char_budget"] : [reason ?? "char_budget"],
+    textPreview: memory.text,
+  };
 }
 
 function renderEntry(entry: LongTermMemoryEntry): string {

tests/evidence-log.test.ts

@@ -0,0 +1,288 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
+import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { realpath } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import {
+  EVIDENCE_LOG_LIMITS,
+  appendEvidenceEvent,
+  appendEvidenceEvents,
+  queryEvidenceEvents,
+  summarizeMemoryEvidence,
+  traceMemoryLifecycle,
+  type EvidenceEventInput,
+  type EvidenceEventV1,
+} from "../src/evidence-log.ts";
+import { workspaceEvidenceLogPath, workspaceKey } from "../src/paths.ts";
+
+async function tempRoot(): Promise<string> {
+  return mkdtemp(join(tmpdir(), "opencode-evidence-log-"));
+}
+
+function eventInput(overrides: Partial<EvidenceEventInput> = {}): EvidenceEventInput {
+  return {
+    type: "promotion_promoted",
+    phase: "promotion",
+    outcome: "promoted",
+    reasonCodes: ["new_workspace_entry"],
+    memory: { memoryId: "mem-a", type: "decision", source: "explicit", status: "active" },
+    textPreview: "Use npm test before release",
+    ...overrides,
+  };
+}
+
+async function readLog(root: string): Promise<string> {
+  return readFile(await workspaceEvidenceLogPath(root), "utf8");
+}
+
+function privacyHash(value: string): string {
+  return createHash("sha256").update(value).digest("hex").slice(0, 16);
+}
+
+async function workspaceRootHash(root: string): Promise<string> {
+  const resolved = await realpath(root).catch(() => root);
+  return privacyHash(resolved);
+}
+
+function manualEvent(rootKey: string, rootHash: string, id: string, createdAt: string): EvidenceEventV1 {
+  return {
+    version: 1,
+    eventId: id,
+    createdAt,
+    workspaceKey: rootKey,
+    workspaceRootHash: rootHash,
+    type: "render_selected",
+    phase: "render",
+    outcome: "rendered",
+    memory: { memoryId: id, type: "decision" },
+    reasonCodes: ["within_caps", "within_char_budget"],
+  };
+}
+
+test("appendEvidenceEvent writes versioned JSONL with workspace hashes", async () => {
+  const root = await tempRoot();
+  try {
+    const event = await appendEvidenceEvent(root, eventInput({ sessionHash: "session-1", messageHash: "message-1" }));
+    const raw = await readLog(root);
+    const stored = JSON.parse(raw.trim()) as EvidenceEventV1;
+
+    assert.equal(stored.version, 1);
+    assert.match(stored.eventId, /^evt_\d+_[a-z0-9]{8}$/);
+    assert.equal(stored.eventId, event.eventId);
+    assert.equal(stored.workspaceKey, await workspaceKey(root));
+    assert.equal(stored.workspaceRootHash, await workspaceRootHash(root));
+    assert.equal(stored.sessionHash, privacyHash("session-1"));
+    assert.equal(stored.messageHash, privacyHash("message-1"));
+    assert.equal(stored.type, "promotion_promoted");
+    assert.equal(stored.outcome, "promoted");
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("appendEvidenceEvent redacts text previews before writing", async () => {
+  const root = await tempRoot();
+  try {
+    await appendEvidenceEvent(root, eventInput({
+      type: "extraction_candidate_rejected",
+      phase: "extraction",
+      outcome: "rejected",
+      reasonCodes: ["raw_error"],
+      textPreview: "password: sushi\nAdmin PIN 是 456123\nBearer abc.def.ghi\nThis candidate is rejected and should be short",
+      details: {
+        note: "password: sushi Admin PIN 是 456123 Bearer abc.def.ghi",
+      },
+    }));
+
+    const raw = await readLog(root);
+    const stored = JSON.parse(raw.trim()) as EvidenceEventV1;
+    assert.ok(!raw.includes("sushi"));
+    assert.ok(!raw.includes("456123"));
+    assert.ok(!raw.includes("abc.def.ghi"));
+    assert.ok(stored.textPreview?.includes("[REDACTED]"));
+    assert.ok((stored.textPreview?.length ?? 0) <= 80);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("queryEvidenceEvents filters by type outcome and memory id", async () => {
+  const root = await tempRoot();
+  try {
+    await appendEvidenceEvents(root, [
+      eventInput({ type: "promotion_promoted", outcome: "promoted", memory: { memoryId: "mem-a" } }),
+      eventInput({ type: "render_omitted", phase: "render", outcome: "omitted", reasonCodes: ["type_cap"], memory: { memoryId: "mem-a" } }),
+      eventInput({ type: "render_omitted", phase: "render", outcome: "omitted", reasonCodes: ["global_cap"], memory: { memoryId: "mem-b" } }),
+    ]);
+
+    const result = await queryEvidenceEvents(root, {
+      types: ["render_omitted"],
+      outcomes: ["omitted"],
+      memoryId: "mem-a",
+    });
+
+    assert.equal(result.length, 1);
+    assert.equal(result[0].type, "render_omitted");
+    assert.equal(result[0].memory?.memoryId, "mem-a");
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("memory_removed_capacity event round-trips through append and query", async () => {
+  const root = await tempRoot();
+  try {
+    await appendEvidenceEvent(root, eventInput({
+      type: "memory_removed_capacity",
+      phase: "storage",
+      outcome: "removed",
+      reasonCodes: ["global_cap"],
+      memory: { memoryId: "removed-memory", type: "reference", source: "compaction", status: "active" },
+      relations: [{ role: "removed", memory: { memoryId: "removed-memory", type: "reference", source: "compaction", status: "active" } }],
+      details: {
+        type: "reference",
+        globalCap: 28,
+        retentionClock: Date.UTC(2026, 4, 1),
+        createdAt: "2026-05-01T00:00:00.000Z",
+        source: "compaction",
+      },
+    }));
+
+    const result = await queryEvidenceEvents(root, {
+      types: ["memory_removed_capacity"],
+      phases: ["storage"],
+      outcomes: ["removed"],
+      memoryId: "removed-memory",
+    });
+
+    assert.equal(result.length, 1);
+    assert.equal(result[0].type, "memory_removed_capacity");
+    assert.equal(result[0].phase, "storage");
+    assert.equal(result[0].outcome, "removed");
+    assert.deepEqual(result[0].details, {
+      type: "reference",
+      globalCap: 28,
+      retentionClock: Date.UTC(2026, 4, 1),
+      createdAt: "2026-05-01T00:00:00.000Z",
+      source: "compaction",
+    });
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("queryEvidenceEvents supports newestFirst and limit", async () => {
+  const root = await tempRoot();
+  try {
+    const events = await appendEvidenceEvents(root, [
+      eventInput({ memory: { memoryId: "oldest" } }),
+      eventInput({ memory: { memoryId: "middle" } }),
+      eventInput({ memory: { memoryId: "newest" } }),
+    ]);
+
+    const result = await queryEvidenceEvents(root, { newestFirst: true, limit: 2 });
+
+    assert.deepEqual(result.map(event => event.eventId), [events[2].eventId, events[1].eventId]);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("appendEvidenceEvent returns a record when appendFile fails", async () => {
+  const root = await tempRoot();
+  try {
+    const path = await workspaceEvidenceLogPath(root);
+    await mkdir(path, { recursive: true });
+
+    const event = await appendEvidenceEvent(root, eventInput());
+
+    assert.equal(event.version, 1);
+    assert.match(event.eventId, /^evt_\d+_[a-z0-9]{8}$/);
+    assert.equal(event.workspaceKey, await workspaceKey(root));
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("evidence log pruning drops old events, caps count, and quarantines invalid lines", async () => {
+  const root = await tempRoot();
+  try {
+    const path = await workspaceEvidenceLogPath(root);
+    await mkdir(dirname(path), { recursive: true });
+    const rootKey = await workspaceKey(root);
+    const rootHash = await workspaceRootHash(root);
+    const old = manualEvent(rootKey, rootHash, "old-event", new Date(Date.now() - 91 * 24 * 60 * 60 * 1000).toISOString());
+    const recentEvents = Array.from({ length: EVIDENCE_LOG_LIMITS.maxEventsPerWorkspace + 1 }, (_, i) =>
+      manualEvent(rootKey, rootHash, `recent-${i}`, new Date(Date.now() - (EVIDENCE_LOG_LIMITS.maxEventsPerWorkspace - i) * 1000).toISOString())
+    );
+    await writeFile(path, [
+      JSON.stringify(old),
+      "{not valid json",
+      ...recentEvents.map(event => JSON.stringify(event)),
+    ].join("\n") + "\n", "utf8");
+
+    const appended = await appendEvidenceEvents(root, Array.from({ length: EVIDENCE_LOG_LIMITS.pruneEveryAppendCount }, (_, i) =>
+      eventInput({ memory: { memoryId: `appended-${i}` }, reasonCodes: ["new_workspace_entry"] })
+    ));
+
+    const events = await queryEvidenceEvents(root);
+    const memoryIds = new Set(events.map(event => event.memory?.memoryId));
+    const files = await readdir(dirname(path));
+
+    assert.ok(events.length <= EVIDENCE_LOG_LIMITS.maxEventsPerWorkspace);
+    assert.equal(memoryIds.has("old-event"), false);
+    assert.equal(memoryIds.has("recent-0"), false, "oldest events over the count cap should be pruned");
+    assert.equal(memoryIds.has(appended.at(-1)?.memory?.memoryId), true);
+    assert.ok(files.some(file => file.startsWith("events.jsonl.corrupt-lines-")));
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("memory evidence summary and lifecycle trace derive latest status", async () => {
+  const root = await tempRoot();
+  try {
+    await appendEvidenceEvents(root, [
+      eventInput({ type: "extraction_candidate_accepted", phase: "extraction", outcome: "accepted", reasonCodes: ["quality_gate_passed"], memory: { memoryId: "mem-life", memoryKeyHash: "raw-key" } }),
+      eventInput({ type: "promotion_promoted", phase: "promotion", outcome: "promoted", reasonCodes: ["new_workspace_entry"], memory: { memoryId: "mem-life", memoryKeyHash: "raw-key" } }),
+      eventInput({ type: "memory_reinforced", phase: "reinforcement", outcome: "reinforced", reasonCodes: ["duplicate_exact"], relations: [{ role: "reinforced", memory: { memoryId: "mem-life", memoryKeyHash: "raw-key" } }] }),
+      eventInput({ type: "render_selected", phase: "render", outcome: "rendered", reasonCodes: ["within_caps", "within_char_budget"], memory: { memoryId: "mem-life", memoryKeyHash: "raw-key" } }),
+    ]);
+
+    const summary = await summarizeMemoryEvidence(root, { memoryId: "mem-life" });
+    const trace = await traceMemoryLifecycle(root, { memoryId: "mem-life" });
+
+    assert.equal(summary.latestOutcome, "rendered");
+    assert.equal(summary.latestRenderStatus, "rendered");
+    assert.ok(summary.reasonCodes.includes("duplicate_exact"));
+    assert.equal(trace.currentStatus, "rendered");
+    assert.ok(trace.acceptedBy);
+    assert.ok(trace.promotedBy);
+    assert.equal(trace.reinforcedBy.length, 1);
+    assert.equal(trace.latestRender?.type, "render_selected");
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("evidence relation roles reject sublimation placeholders at compile-time surface", () => {
+  const allowedRoles: Array<NonNullable<EvidenceEventInput["relations"]>[number]["role"]> = [
+    "candidate",
+    "pending",
+    "promoted",
+    "retained",
+    "absorbed",
+    "superseded",
+    "superseded_by",
+    "reinforced",
+    "reinforced_by",
+    "rendered",
+    "omitted",
+    "removed",
+  ];
+
+  assert.equal(allowedRoles.includes("candidate"), true);
+});

tests/extractors.test.ts

@@ -3,7 +3,13 @@ import assert from "node:assert/strict";
 import { mkdtemp, readFile, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { extractErrorsFromBash, extractExplicitMemories, parseWorkspaceMemoryCandidates } from "../src/extractors.ts";
+import {
+  extractErrorsFromBash,
+  extractExplicitMemories,
+  extractExplicitMemoriesWithEvidence,
+  parseWorkspaceMemoryCandidates,
+  parseWorkspaceMemoryCandidatesWithEvidence,
+} from "../src/extractors.ts";
 
 async function waitForFile(path: string, attempts = 20): Promise<string> {
   let lastError: unknown;
@@ -145,6 +151,20 @@ test("extractExplicitMemories captures multiple memories in same message", () =>
   assert.equal(items.length, 2);
 });
 
+test("explicit memory extraction returns detected and ignored evidence", () => {
+  const result = extractExplicitMemoriesWithEvidence([
+    "remember this: Prefer deterministic tests.",
+    "don't remember this: temporary password: sushi",
+    "remember this: later",
+  ].join("\n"));
+
+  assert.equal(result.entries.length, 1);
+  assert.ok(result.evidence.some(event => event.type === "explicit_memory_detected"));
+  assert.ok(result.evidence.some(event => event.type === "explicit_memory_ignored" && event.reasonCodes.includes("negated_request")));
+  assert.ok(result.evidence.some(event => event.type === "explicit_memory_ignored" && event.reasonCodes.includes("deferral")));
+  assert.equal(JSON.stringify(result.evidence).includes("sushi"), false);
+});
+
 // ============================================
 // Task 7: Compaction quality gate tests
 // ============================================
@@ -176,6 +196,41 @@ test("parseWorkspaceMemoryCandidates rejects raw error", () => {
   assert.equal(items.length, 0);
 });
 
+test("compaction accepted candidate returns privacy-safe extraction evidence", () => {
+  const summary = `
+Memory candidates:
+- [decision] Use accounting evidence events to explain promoted memories in diagnostics.
+`;
+
+  const result = parseWorkspaceMemoryCandidatesWithEvidence(summary);
+
+  assert.equal(result.entries.length, 1);
+  assert.equal(result.evidence.length, 1);
+  assert.equal(result.evidence[0].type, "extraction_candidate_accepted");
+  assert.ok(result.evidence[0].reasonCodes.includes("quality_gate_passed"));
+  assert.ok(result.evidence[0].reasonCodes.includes("valid_candidate_format"));
+  assert.match(result.evidence[0].textPreview ?? "", /accounting evidence events/);
+});
+
+test("compaction rejected candidate returns rejection evidence without secrets", () => {
+  const summary = `
+Memory candidates:
+- [feedback] password: sushi Admin PIN 是 456123 Bearer abc.def.ghi TypeError: Cannot read property x
+`;
+
+  const result = parseWorkspaceMemoryCandidatesWithEvidence(summary);
+  const raw = JSON.stringify(result.evidence);
+
+  assert.equal(result.entries.length, 0);
+  assert.equal(result.evidence.length, 1);
+  assert.equal(result.evidence[0].type, "extraction_candidate_rejected");
+  assert.ok(result.evidence[0].reasonCodes.length > 0);
+  assert.equal(raw.includes("sushi"), false);
+  assert.equal(raw.includes("456123"), false);
+  assert.equal(raw.includes("abc.def.ghi"), false);
+  assert.ok((result.evidence[0].textPreview?.length ?? 0) <= 80);
+});
+
 test("parseWorkspaceMemoryCandidates rejects stack trace", () => {
   const summary = `
 ## Memory Candidates
@@ -332,6 +387,36 @@ Memory candidates:
   }
 });
 
+test("new rejection records include workspaceKey and workspaceRootHash when provided", async () => {
+  const dataHome = await mkdtemp(join(tmpdir(), "wm-extraction-scope-data-"));
+  const previousXdgDataHome = process.env.XDG_DATA_HOME;
+  process.env.XDG_DATA_HOME = dataHome;
+
+  try {
+    const summary = `
+Memory candidates:
+- feedback Wave 1 completed successfully and all tests passed
+`;
+
+    const result = parseWorkspaceMemoryCandidatesWithEvidence(summary, {
+      workspaceKey: "testkey1234567",
+      workspaceRootHash: "abcdef123456",
+    });
+
+    assert.equal(result.entries.length, 0);
+    const logPath = join(dataHome, "opencode-working-memory", "extraction-rejections.jsonl");
+    const lines = (await waitForFile(logPath)).trim().split("\n");
+    assert.equal(lines.length, 1);
+    const event = JSON.parse(lines[0]);
+    assert.equal(event.workspaceKey, "testkey1234567");
+    assert.equal(event.workspaceRootHash, "abcdef123456");
+  } finally {
+    if (previousXdgDataHome === undefined) delete process.env.XDG_DATA_HOME;
+    else process.env.XDG_DATA_HOME = previousXdgDataHome;
+    await rm(dataHome, { recursive: true, force: true });
+  }
+});
+
 test("parseWorkspaceMemoryCandidates redacts secrets in extraction rejection log", async () => {
   const dataHome = await mkdtemp(join(tmpdir(), "wm-extraction-redact-data-"));
   const previousXdgDataHome = process.env.XDG_DATA_HOME;

tests/memory-diag.test.ts

@@ -1,14 +1,15 @@
 import test from "node:test";
 import assert from "node:assert/strict";
 import { execFile } from "node:child_process";
-import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
+import { appendEvidenceEvents, type EvidenceEventInput } from "../src/evidence-log.ts";
 import type { LongTermMemoryEntry, WorkspaceMemoryStore } from "../src/types.ts";
-import { LONG_TERM_LIMITS } from "../src/types.ts";
+import { LONG_TERM_LIMITS, PROMOTION_RETRY_LIMITS, type PendingMemoryJournalStore } from "../src/types.ts";
-import { workspaceKey, workspaceMemoryPath } from "../src/paths.ts";
+import { extractionRejectionLogPath, workspaceKey, workspaceMemoryPath, workspacePendingJournalPath } from "../src/paths.ts";
 
 const execFileAsync = promisify(execFile);
 const repoRoot = join(dirname(fileURLToPath(import.meta.url)), "..");
@@ -46,17 +47,49 @@ async function writeWorkspaceStore(root: string, entries: LongTermMemoryEntry[],
 }
 
 async function runMemoryDiagHealth(root: string): Promise<string> {
+  return runMemoryDiag(["health", "--workspace", root]);
+}
+
+async function runMemoryDiag(args: string[]): Promise<string> {
   const { stdout } = await execFileAsync(process.execPath, [
     "--experimental-strip-types",
     "scripts/memory-diag.ts",
-    "health",
+    ...args,
-    "--workspace",
-    root,
   ], { cwd: repoRoot });
 
   return stdout;
 }
 
+async function writePendingJournal(root: string, entries: LongTermMemoryEntry[]): Promise<void> {
+  const key = await workspaceKey(root);
+  const path = await workspacePendingJournalPath(root);
+  const store: PendingMemoryJournalStore = {
+    version: 1,
+    workspace: { root, key },
+    entries,
+    updatedAt: new Date().toISOString(),
+  };
+  await mkdir(dirname(path), { recursive: true });
+  await writeFile(path, JSON.stringify(store, null, 2), "utf8");
+}
+
+async function writeRejectionRecords(records: unknown[]): Promise<void> {
+  const path = extractionRejectionLogPath();
+  await mkdir(dirname(path), { recursive: true });
+  await writeFile(path, records.map(record => JSON.stringify(record)).join("\n") + "\n", "utf8");
+}
+
+function evidence(overrides: Partial<EvidenceEventInput>): EvidenceEventInput {
+  return {
+    type: "promotion_promoted",
+    phase: "promotion",
+    outcome: "promoted",
+    memory: { memoryId: "mem-rendered", type: "feedback", source: "explicit", status: "active" },
+    reasonCodes: ["new_workspace_entry"],
+    ...overrides,
+  };
+}
+
 test("memory health reports stored vs rendered retention counts", async () => {
   const root = await mkdtemp(join(tmpdir(), "opencode-memory-diag-"));
   try {
@@ -77,7 +110,7 @@ test("memory health reports stored vs rendered retention counts", async () => {
   }
 });
 
-test("memory health reports dormancy and retention monitoring alerts", async () => {
+test("memory health reports dormancy and retention monitoring deprecations", async () => {
   const root = await mkdtemp(join(tmpdir(), "opencode-memory-diag-"));
   try {
     const lastActivityAt = new Date(Date.now() - 19 * 24 * 60 * 60 * 1000).toISOString();
@@ -96,7 +129,7 @@ test("memory health reports dormancy and retention monitoring alerts", async ()
     assert.match(stdout, /dormant discount active: yes/);
     assert.match(stdout, /dormant days past grace: 5\.0/);
     assert.match(stdout, /high_importance_ratio: 40\.0% .* ALERT/);
-    assert.match(stdout, /safety_critical_count: 6 .* ALERT/);
+    assert.match(stdout, /safety_critical_count: 6 .*deprecated.* WARNING/);
     assert.match(stdout, /max_reinforced_count: 2 \(20\.0%, alert > 10%\) ALERT/);
   } finally {
     await rm(root, { recursive: true, force: true });
@@ -135,9 +168,356 @@ test("memory health reports missing dormancy and non-alert monitoring defaults",
     assert.match(stdout, /wall days since activity: unknown/);
     assert.match(stdout, /dormant discount active: no/);
     assert.match(stdout, /high_importance_ratio: 0\.0% \(alert > 30%\)\n/);
-    assert.match(stdout, /safety_critical_count: 0 \(alert > 5\)\n/);
+    assert.match(stdout, /safety_critical_count: 0 \(deprecated field\)\n/);
     assert.match(stdout, /max_reinforced_count: 0 \(alert > 10% active\)/);
   } finally {
     await rm(root, { recursive: true, force: true });
   }
 });
+
+test("memory health --json prints parseable privacy-safe diagnostics matching human counts", async () => {
+  const root = await mkdtemp(join(tmpdir(), "opencode-memory-diag-json-"));
+  try {
+    const rendered = { ...entry("mem-rendered", "Prefer small focused changes", "feedback"), source: "explicit" as const };
+    const secret = { ...entry("mem-secret", "Use password: sushi only in test fixtures", "decision"), source: "manual" as const };
+    const superseded = { ...entry("mem-old", "Old decision that was superseded", "decision"), status: "superseded" as const };
+    const pending = { ...entry("mem-pending", "Retry this pending memory later", "project"), promotionAttempts: 1 };
+    await writeWorkspaceStore(root, [rendered, secret, superseded]);
+    await writePendingJournal(root, [pending]);
+    await appendEvidenceEvents(root, [
+      evidence({ type: "extraction_candidate_rejected", phase: "extraction", outcome: "rejected", memory: { memoryId: "mem-rejected", type: "feedback", source: "explicit" }, reasonCodes: ["raw_secret"], textPreview: "password: sushi should not leak" }),
+      evidence({ type: "storage_corrupt_json_quarantined", phase: "storage", outcome: "quarantined", memory: undefined, reasonCodes: ["invalid_json"] }),
+      evidence({ type: "promotion_promoted", phase: "promotion", outcome: "promoted", memory: { memoryId: "mem-rendered", type: "feedback", source: "explicit", status: "active" }, reasonCodes: ["new_workspace_entry"] }),
+      evidence({ type: "render_selected", phase: "render", outcome: "rendered", memory: { memoryId: "mem-rendered", type: "feedback", source: "explicit", status: "active" }, reasonCodes: ["within_caps", "within_char_budget"] }),
+    ]);
+
+    const human = await runMemoryDiagHealth(root);
+    const jsonText = await runMemoryDiag(["health", "--workspace", root, "--json"]);
+    const parsed = JSON.parse(jsonText) as {
+      version: 1;
+      summary: { storedActive: number; rendered: number; pending: number; rejectedLast7Days: number; corruptStoresQuarantinedLast30Days: number };
+      memories: Array<{ id: string; status: string; reasonCodes: string[]; evidenceEventIds: string[]; textPreview?: string }>;
+      recentEvents: Array<{ eventId: string; type: string; outcome: string; createdAt: string; reasonCodes: string[] }>;
+    };
+
+    assert.equal(parsed.version, 1);
+    assert.equal(parsed.summary.storedActive, Number(human.match(/Stored active memories: (\d+)/)?.[1]));
+    assert.equal(parsed.summary.rendered, Number(human.match(/Rendered candidates: (\d+)/)?.[1]));
+    assert.equal(parsed.summary.pending, Number(human.match(/Pending journal:\n\s+total: (\d+)/)?.[1]));
+    assert.equal(parsed.summary.rejectedLast7Days, 1);
+    assert.equal(parsed.summary.corruptStoresQuarantinedLast30Days, 1);
+    assert.ok(parsed.recentEvents.some(event => event.eventId && event.type === "render_selected" && event.outcome === "rendered" && event.createdAt && event.reasonCodes.includes("within_caps")));
+    assert.ok(parsed.memories.find(memory => memory.id === "mem-rendered")?.evidenceEventIds.length);
+    assert.ok(!jsonText.includes("sushi"));
+    assert.ok(jsonText.trim().startsWith("{"));
+    assert.ok(jsonText.trim().endsWith("}"));
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("memory-diag explain shows rendered, omitted, pending, and evidence reason status", async () => {
+  const root = await mkdtemp(join(tmpdir(), "opencode-memory-diag-explain-"));
+  try {
+    const rendered = { ...entry("mem-rendered", "Rendered feedback wins the render set", "feedback"), source: "explicit" as const };
+    const superseded = { ...entry("mem-superseded", "Superseded memory is not rendered", "decision"), status: "superseded" as const };
+    const typeCapped = Array.from({ length: 11 }, (_, i) => entry(`mem-type-${i}`, `Type cap feedback memory ${i}`, "feedback"));
+    const globalCapped = [
+      ...Array.from({ length: 10 }, (_, i) => entry(`mem-g-feedback-${i}`, `Global cap feedback memory ${i}`, "feedback")),
+      ...Array.from({ length: 10 }, (_, i) => entry(`mem-g-decision-${i}`, `Global cap decision memory ${i}`, "decision")),
+      ...Array.from({ length: 8 }, (_, i) => entry(`mem-g-project-${i}`, `Global cap project memory ${i}`, "project")),
+      ...Array.from({ length: 7 }, (_, i) => entry(`mem-g-reference-${i}`, `Global cap reference memory ${i}`, "reference")),
+    ];
+    const charBudget = { ...entry("mem-char-budget", "This active memory cannot fit the tiny character budget", "project") };
+    await writeWorkspaceStore(root, [rendered, superseded, ...typeCapped, ...globalCapped, charBudget]);
+    const key = await workspaceKey(root);
+    const path = await workspaceMemoryPath(root);
+    const raw = JSON.parse(await readFile(path, "utf8")) as WorkspaceMemoryStore;
+    raw.limits.maxRenderedChars = 100;
+    raw.workspace = { root, key };
+    await writeFile(path, JSON.stringify(raw, null, 2), "utf8");
+
+    const retry = { ...entry("mem-pending-retry", "Pending retry memory", "project"), promotionAttempts: 1, lastPromotionFailureReason: "capacity_rejected" };
+    const exhausted = { ...entry("mem-pending-capacity", "Pending capacity rejected memory", "project"), promotionAttempts: PROMOTION_RETRY_LIMITS.maxExplicitAttempts, lastPromotionFailureReason: "capacity_rejected" };
+    await writePendingJournal(root, [retry, exhausted]);
+    await appendEvidenceEvents(root, [
+      evidence({ type: "promotion_absorbed_exact", phase: "promotion", outcome: "absorbed", memory: { memoryId: "mem-absorbed", type: "feedback", source: "explicit" }, reasonCodes: ["same_exact_key"] }),
+      evidence({ type: "storage_corrupt_json_quarantined", phase: "storage", outcome: "quarantined", memory: undefined, reasonCodes: ["invalid_json"] }),
+    ]);
+
+    const stdout = await runMemoryDiag(["explain", "--workspace", root]);
+
+    assert.match(stdout, /Memory mem-rendered: rendered/);
+    assert.match(stdout, /Memory mem-superseded: omitted_superseded/);
+    assert.match(stdout, /omitted_type_cap/);
+    assert.match(stdout, /omitted_global_cap/);
+    assert.match(stdout, /omitted_char_budget/);
+    assert.match(stdout, /Memory mem-pending-retry: pending_retry/);
+    assert.match(stdout, /Memory mem-pending-capacity: pending_rejected_capacity/);
+    assert.match(stdout, /Memory mem-absorbed: omitted_absorbed_duplicate/);
+    assert.match(stdout, /quarantined_corrupt_store/);
+    assert.match(stdout, /- strength=\d+\.\d{3}, type=feedback, source=explicit/);
+    assert.match(stdout, /- evidence: .*promotion_absorbed_exact/);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("memory-diag trace prints lifecycle relations and redacts secrets", async () => {
+  const root = await mkdtemp(join(tmpdir(), "opencode-memory-diag-trace-"));
+  try {
+    await writeWorkspaceStore(root, [
+      { ...entry("mem-life", "Old token password: sushi should be redacted", "decision"), status: "superseded" as const },
+      entry("mem-new", "Replacement memory", "decision"),
+    ]);
+    await appendEvidenceEvents(root, [
+      evidence({ type: "extraction_candidate_accepted", phase: "extraction", outcome: "accepted", memory: { memoryId: "mem-life", type: "decision", source: "compaction" }, reasonCodes: ["quality_gate_passed"], textPreview: "password: sushi" }),
+      evidence({ type: "pending_memory_appended", phase: "pending_journal", outcome: "accepted", memory: { memoryId: "mem-life", type: "decision", source: "compaction" }, relations: [{ role: "pending", memory: { memoryId: "mem-life" } }], reasonCodes: ["pending_journal_append"] }),
+      evidence({ type: "promotion_promoted", phase: "promotion", outcome: "promoted", memory: { memoryId: "mem-life", type: "decision", source: "compaction" }, reasonCodes: ["new_workspace_entry"] }),
+      evidence({ type: "memory_reinforced", phase: "reinforcement", outcome: "reinforced", memory: { memoryId: "mem-life", type: "decision", source: "compaction" }, relations: [{ role: "reinforced_by", memory: { memoryId: "mem-duplicate" } }], reasonCodes: ["duplicate_exact"] }),
+      evidence({ type: "promotion_superseded", phase: "promotion", outcome: "superseded", memory: { memoryId: "mem-life", type: "decision", source: "compaction" }, relations: [{ role: "superseded_by", memory: { memoryId: "mem-new" } }], reasonCodes: ["superseded_existing"] }),
+      evidence({ type: "render_omitted", phase: "render", outcome: "omitted", memory: { memoryId: "mem-life", type: "decision", source: "compaction" }, relations: [{ role: "omitted", memory: { memoryId: "mem-life" } }], reasonCodes: ["superseded"] }),
+    ]);
+
+    const stdout = await runMemoryDiag(["trace", "--workspace", root, "--memory", "mem-life"]);
+
+    assert.match(stdout, /Memory mem-life: omitted_superseded/);
+    assert.match(stdout, /Lifecycle:/);
+    assert.match(stdout, /extraction_candidate_accepted: accepted; reasons=quality_gate_passed/);
+    assert.match(stdout, /pending_memory_appended: accepted; reasons=pending_journal_append/);
+    assert.match(stdout, /promotion_superseded: superseded; reasons=superseded_existing; .*superseded_by=mem-new/);
+    assert.match(stdout, /memory_reinforced: reinforced; reasons=duplicate_exact; .*reinforced_by=mem-duplicate/);
+    assert.match(stdout, /Superseded by:\n- mem-new/);
+    assert.match(stdout, /Reinforced by:\n- mem-duplicate/);
+    assert.ok(!stdout.includes("sushi"));
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("memory-diag trace requires --memory and reports unknown IDs", async () => {
+  const root = await mkdtemp(join(tmpdir(), "opencode-memory-diag-trace-unknown-"));
+  try {
+    await assert.rejects(
+      execFileAsync(process.execPath, ["--experimental-strip-types", "scripts/memory-diag.ts", "trace", "--workspace", root], { cwd: repoRoot }),
+      (error: unknown) => {
+        const err = error as { code?: number; stderr?: string };
+        assert.notEqual(err.code, 0);
+        assert.match(err.stderr ?? "", /--memory requires an id/);
+        assert.match(err.stderr ?? "", /Usage:/);
+        return true;
+      },
+    );
+
+    const stdout = await runMemoryDiag(["trace", "--workspace", root, "--memory", "missing-memory"]);
+    assert.match(stdout, /Memory missing-memory: unknown/);
+    assert.match(stdout, /Lifecycle:\n\(none\)/);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+async function setupQualityFixture(): Promise<string> {
+  const root = await mkdtemp(join(tmpdir(), "opencode-memory-diag-quality-"));
+  const key = await workspaceKey(root);
+  const now = new Date().toISOString();
+  const entries = Array.from({ length: LONG_TERM_LIMITS.maxEntries }, (_, i) => ({
+    ...entry(`quality-${i}`, `Quality fixture memory ${i}`, i % 2 === 0 ? "feedback" as const : "decision" as const),
+    retentionClock: i === 0 ? -1 : Date.now(),
+  }));
+  await writeWorkspaceStore(root, entries);
+  await appendEvidenceEvents(root, [
+    evidence({ type: "promotion_promoted", phase: "promotion", outcome: "promoted", memory: { memoryId: "quality-1", type: "decision", source: "compaction" }, reasonCodes: ["new_workspace_entry"] }),
+    evidence({ type: "promotion_promoted", phase: "promotion", outcome: "promoted", memory: { memoryId: "quality-historical", type: "reference", source: "compaction" }, reasonCodes: ["new_workspace_entry"] }),
+  ]);
+  await writeRejectionRecords([
+    { timestamp: now, workspaceKey: key, workspaceRootHash: "hash", type: "decision", source: "compaction", text: "Implemented phase 2 and updated tests", reasons: ["bad_decision"] },
+    { timestamp: now, type: "feedback", source: "compaction", text: "Wave 1 completed successfully", reasons: ["progress_snapshot", "bad_feedback"] },
+  ]);
+  return root;
+}
+
+test("quality human output includes summary and aggregate inspection counts", async () => {
+  const root = await setupQualityFixture();
+  try {
+    const stdout = await runMemoryDiag(["quality", "--workspace", root]);
+
+    assert.match(stdout, /Memory quality inspection/);
+    assert.match(stdout, /Summary: Workspace memory quality is degraded:/);
+    assert.match(stdout, /Caps:\n\s+active: 28 \/ 28/);
+    assert.match(stdout, /decision: 14 \/ 10 FULL/);
+    assert.match(stdout, /feedback: 14 \/ 10 FULL/);
+    assert.match(stdout, /Retention clocks:\n\s+present: 27\n\s+missing: 0\n\s+invalid: 1/);
+    assert.match(stdout, /Evidence:\n\s+current with evidence: 1\n\s+current without evidence: 27/);
+    assert.match(stdout, /Rejection scoping:\n\s+total records: 2\n\s+workspace scoped: 1\n\s+legacy unscoped: 1/);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("quality --json includes summaryText, caps, retention, evidence, and rejections", async () => {
+  const root = await setupQualityFixture();
+  try {
+    const stdout = await runMemoryDiag(["quality", "--workspace", root, "--json"]);
+    const parsed = JSON.parse(stdout) as {
+      summaryText: string;
+      caps: { active: number; capsFull: boolean };
+      retention: { invalid: number };
+      evidence: { currentWithEvidence: number; unknownDisappearances: number };
+      rejections: { workspaceScopedCount: number; legacyUnscopedCount: number };
+    };
+
+    assert.match(parsed.summaryText, /Workspace memory quality is degraded/);
+    assert.equal(parsed.caps.active, LONG_TERM_LIMITS.maxEntries);
+    assert.equal(parsed.caps.capsFull, true);
+    assert.equal(parsed.retention.invalid, 1);
+    assert.equal(parsed.evidence.currentWithEvidence, 1);
+    assert.equal(parsed.evidence.unknownDisappearances, 1);
+    assert.equal(parsed.rejections.workspaceScopedCount, 1);
+    assert.equal(parsed.rejections.legacyUnscopedCount, 1);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("coverage human output includes class counts and per-memory rows", async () => {
+  const root = await mkdtemp(join(tmpdir(), "opencode-memory-diag-coverage-"));
+  try {
+    await writeWorkspaceStore(root, [
+      entry("mem-full", "Full lifecycle memory", "feedback"),
+      entry("mem-render-only", "Render only memory", "decision"),
+      entry("mem-no-evidence", "No evidence memory", "project"),
+    ]);
+    await appendEvidenceEvents(root, [
+      evidence({ type: "extraction_candidate_accepted", phase: "extraction", outcome: "accepted", memory: { memoryId: "mem-full", type: "feedback", source: "compaction" }, reasonCodes: ["quality_gate_passed"] }),
+      evidence({ type: "promotion_promoted", phase: "promotion", outcome: "promoted", memory: { memoryId: "mem-full", type: "feedback", source: "compaction" }, reasonCodes: ["new_workspace_entry"] }),
+      evidence({ type: "render_selected", phase: "render", outcome: "rendered", memory: { memoryId: "mem-render-only", type: "decision", source: "compaction" }, reasonCodes: ["within_caps"] }),
+    ]);
+
+    const stdout = await runMemoryDiag(["coverage", "--workspace", root]);
+
+    assert.match(stdout, /Class counts:/);
+    assert.match(stdout, /full_lifecycle: 1/);
+    assert.match(stdout, /render_only: 1/);
+    assert.match(stdout, /no_evidence: 1/);
+    assert.match(stdout, /Per-memory rows:/);
+    assert.match(stdout, /mem-full full_lifecycle .*extraction=1 promotion=1/);
+    assert.match(stdout, /mem-render-only render_only .*render=1/);
+    assert.match(stdout, /mem-no-evidence no_evidence .*total=0/);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("coverage --json includes event counts", async () => {
+  const root = await mkdtemp(join(tmpdir(), "opencode-memory-diag-coverage-json-"));
+  try {
+    await writeWorkspaceStore(root, [entry("mem-full", "Full lifecycle memory", "feedback")]);
+    await appendEvidenceEvents(root, [
+      evidence({ type: "promotion_promoted", phase: "promotion", outcome: "promoted", memory: { memoryId: "mem-full", type: "feedback", source: "compaction" }, reasonCodes: ["new_workspace_entry"] }),
+    ]);
+
+    const stdout = await runMemoryDiag(["coverage", "--workspace", root, "--json"]);
+    const parsed = JSON.parse(stdout) as { memories: Array<{ id: string; eventCounts: { total: number; byType: Record<string, number> } }> };
+    const row = parsed.memories.find(memory => memory.id === "mem-full");
+
+    assert.equal(row?.eventCounts.total, 1);
+    assert.equal(row?.eventCounts.byType.promotion_promoted, 1);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("disappearances labels historical evidence-only memory unknown without terminal event", async () => {
+  const root = await mkdtemp(join(tmpdir(), "opencode-memory-diag-disappear-"));
+  try {
+    await writeWorkspaceStore(root, [entry("current", "Current memory", "feedback")]);
+    await appendEvidenceEvents(root, [
+      evidence({ type: "promotion_promoted", phase: "promotion", outcome: "promoted", memory: { memoryId: "historical-unknown", type: "decision", source: "compaction" }, reasonCodes: ["new_workspace_entry"] }),
+    ]);
+
+    const stdout = await runMemoryDiag(["disappearances", "--workspace", root]);
+
+    assert.match(stdout, /Memory historical-unknown: historical_absent_unknown_reason terminal=unknown/);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("disappearances --explain shows capacity details and render omitted type-cap observations", async () => {
+  const root = await mkdtemp(join(tmpdir(), "opencode-memory-diag-disappear-explain-"));
+  try {
+    await writeWorkspaceStore(root, [entry("current", "Current memory", "feedback")]);
+    await appendEvidenceEvents(root, [
+      evidence({
+        type: "memory_removed_capacity",
+        phase: "storage",
+        outcome: "removed",
+        memory: { memoryId: "capacity-loser", type: "decision", source: "compaction", status: "active" },
+        relations: [{ role: "removed", memory: { memoryId: "capacity-loser", type: "decision", source: "compaction", status: "active" } }],
+        reasonCodes: ["type_cap"],
+        details: { type: "decision", globalCap: 28, typeCap: 10, source: "compaction" },
+      }),
+      evidence({ type: "render_omitted", phase: "render", outcome: "omitted", memory: { memoryId: "render-loser", type: "feedback", source: "compaction" }, reasonCodes: ["type_cap"] }),
+    ]);
+
+    const stdout = await runMemoryDiag(["disappearances", "--workspace", root, "--explain"]);
+
+    assert.match(stdout, /capacity-loser: historical_absent_with_reason terminal=memory_removed_capacity reasons=type_cap/);
+    assert.match(stdout, /memory_removed_capacity details: .*globalCap=28 .*typeCap=10/);
+    assert.match(stdout, /render-loser: historical_absent_with_reason terminal=render_omitted reasons=type_cap/);
+    assert.match(stdout, /render_omitted type-cap observation: reasons=type_cap/);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("rejections --quality --reason bad_decision --unique groups architecture-like samples heuristically", async () => {
+  const root = await mkdtemp(join(tmpdir(), "opencode-memory-diag-rejections-quality-"));
+  try {
+    const key = await workspaceKey(root);
+    const now = new Date().toISOString();
+    await writeRejectionRecords([
+      { timestamp: now, workspaceKey: key, type: "decision", source: "compaction", text: "Retention scoring model uses evidence caps to avoid normalization drift", reasons: ["bad_decision"] },
+      { timestamp: now, workspaceKey: key, type: "decision", source: "compaction", text: "Implemented phase 2 and updated tests", reasons: ["bad_decision"] },
+      { timestamp: now, type: "decision", source: "compaction", text: "Maybe useful", reasons: ["bad_decision"] },
+    ]);
+
+    const stdout = await runMemoryDiag(["rejections", "--quality", "--workspace", root, "--reason", "bad_decision", "--unique"]);
+
+    assert.match(stdout, /Possible false-positive grouping is heuristic, not deterministic truth/);
+    assert.match(stdout, /architecture_like_possible_false_positive: 1/);
+    assert.match(stdout, /clearly_garbage: 1/);
+    assert.match(stdout, /ambiguous: 1/);
+    assert.doesNotMatch(stdout, /deterministic truth\s*:/);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("rejections --quality --json includes scoping, unique reasons, and possible false-positive groups", async () => {
+  const root = await mkdtemp(join(tmpdir(), "opencode-memory-diag-rejections-json-"));
+  try {
+    const key = await workspaceKey(root);
+    const now = new Date().toISOString();
+    await writeRejectionRecords([
+      { timestamp: now, workspaceKey: key, workspaceRootHash: "hash", type: "decision", source: "compaction", text: "Memory system schema boundary should remain stable", reasons: ["bad_decision"] },
+      { timestamp: now, type: "feedback", source: "compaction", text: "Wave 1 completed successfully", reasons: ["progress_snapshot", "bad_feedback"] },
+    ]);
+
+    const stdout = await runMemoryDiag(["rejections", "--quality", "--workspace", root, "--json"]);
+    const parsed = JSON.parse(stdout) as {
+      workspaceScopedCount: number;
+      legacyUnscopedCount: number;
+      uniqueReasonDistribution: Record<string, number>;
+      possibleFalsePositiveGroups: Record<string, { count: number }>;
+    };
+
+    assert.equal(parsed.workspaceScopedCount, 1);
+    assert.equal(parsed.legacyUnscopedCount, 1);
+    assert.equal(parsed.uniqueReasonDistribution.bad_decision, 1);
+    assert.equal(parsed.possibleFalsePositiveGroups.architecture_like_possible_false_positive.count, 1);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});

tests/memory-quality-eval.test.ts

@@ -136,6 +136,33 @@ test("decision must be future-facing rule, not completed implementation note", (
   assert.equal(assessMemoryQuality({ type: "decision", text: "Added semantic merge tests in the previous wave", source: "compaction" }).accepted, false);
 });
 
+test("bad_decision 3-tier gate: architecture-like decisions accepted without future-rule imperative", () => {
+  const architectureLikeCases = [
+    { text: "Rule 不在記憶系統 schema 內，歸用戶（agent.md / claude.md），系統最多到 Preference + Suggestion", type: "decision" as const },
+    { text: "Ghost memory root cause: normalization 把 capacity losers 從 store 移除時沒有 emit terminal evidence", type: "decision" as const },
+    { text: "BASE_HALF_LIFE_DAYS 應從 60 降低到 45", type: "decision" as const },
+    { text: "採用 decay-rate 模型取代 priority+penalty 模型", type: "decision" as const },
+    { text: "從 scoring 移除 confidence，目前是固定值無意義", type: "decision" as const },
+  ];
+
+  const stillRejectedCases = [
+    { text: "Implemented phase 2 and updated tests", type: "decision" as const },
+    { text: "Implemented CI_SCHEMA_UPDATE for compatibility run 42", type: "decision" as const },
+    { text: "Session reviewed the architecture model changes", type: "decision" as const },
+    { text: "Some random text with no architecture keywords or future rules", type: "decision" as const },
+  ];
+
+  for (const entry of architectureLikeCases) {
+    const result = assessMemoryQuality({ ...entry, source: "compaction" });
+    assert.equal(result.reasons.includes("bad_decision"), false, `${entry.text} -> ${result.reasons.join(",")}`);
+  }
+
+  for (const entry of stillRejectedCases) {
+    const result = assessMemoryQuality({ ...entry, source: "compaction" });
+    assert.equal(result.reasons.includes("bad_decision"), true, `${entry.text} -> ${result.reasons.join(",")}`);
+  }
+});
+
 test("shared quality gate owns extractor low-quality syntax rejections", () => {
   const rejected = [
     { type: "project" as const, text: "fix: add new feature" },

tests/plugin.test.ts

@@ -1,6 +1,6 @@
 import test from "node:test";
 import assert from "node:assert/strict";
-import { mkdir, mkdtemp, rm } from "node:fs/promises";
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { MemoryV2Plugin } from "../src/plugin.ts";
@@ -8,9 +8,10 @@ import { loadSessionState, saveSessionState } from "../src/session-state.ts";
 import { parseWorkspaceMemoryCandidates } from "../src/extractors.ts";
 import type { OpenError } from "../src/types.ts";
 import { PROMOTION_RETRY_LIMITS, WORKSPACE_MEMORY_CACHE_LIMITS } from "../src/types.ts";
-import { workspaceMemoryPath, workspacePendingJournalPath } from "../src/paths.ts";
+import { sessionStatePath, workspaceMemoryPath, workspacePendingJournalPath } from "../src/paths.ts";
 import { loadPendingJournal, savePendingJournal, memoryKey } from "../src/pending-journal.ts";
 import { loadWorkspaceMemory, updateWorkspaceMemory } from "../src/workspace-memory.ts";
+import { queryEvidenceEvents } from "../src/evidence-log.ts";
 
 // Mock client for root session (not a sub-agent)
 function mockRootClient() {
@@ -450,6 +451,62 @@ test("chat system transform reuses frozen rendered workspace snapshot", async ()
   }
 });
 
+test("chat system transform degrades gracefully when workspace memory JSON is corrupt", async () => {
+  const tmpDir = await mkdtemp(join(tmpdir(), "memory-plugin-test-"));
+
+  try {
+    const path = await workspaceMemoryPath(tmpDir);
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, "{ invalid json", "utf8");
+
+    const plugin = await MemoryV2Plugin({
+      directory: tmpDir,
+      client: mockRootClient(),
+    });
+    const output = { system: ["base header"] };
+
+    await assert.doesNotReject(async () => {
+      await (plugin as Record<string, Function>)["experimental.chat.system.transform"](
+        { sessionID: "corrupt-json-session", model: {} },
+        output,
+      );
+    });
+
+    assert.deepEqual(output.system, ["base header"]);
+  } finally {
+    await rm(tmpDir, { recursive: true, force: true });
+  }
+});
+
+test("hook failure emits hook_failed evidence without raw tool output", async () => {
+  const tmpDir = await mkdtemp(join(tmpdir(), "memory-plugin-test-"));
+
+  try {
+    const statePath = await sessionStatePath(tmpDir, "hook-failure-session");
+    await mkdir(dirname(statePath), { recursive: true });
+    await mkdir(statePath, { recursive: true });
+
+    const plugin = await MemoryV2Plugin({ directory: tmpDir, client: mockRootClient() });
+    await (plugin as Record<string, Function>)["tool.execute.after"](
+      {
+        tool: "bash",
+        sessionID: "hook-failure-session",
+        args: { command: "cat secret-output.txt" },
+      },
+      { output: "raw tool output password: sushi should not be in evidence", exitCode: 1 },
+    );
+
+    const events = await queryEvidenceEvents(tmpDir, { types: ["hook_failed"] });
+    const raw = JSON.stringify(events);
+    assert.equal(events.length, 1);
+    assert.equal(events[0].reasonCodes.includes("tool.execute.after"), true);
+    assert.equal(raw.includes("raw tool output"), false);
+    assert.equal(raw.includes("sushi"), false);
+  } finally {
+    await rm(tmpDir, { recursive: true, force: true });
+  }
+});
+
 test("no compaction: owned explicit memory is not promoted by unrelated next session start", async () => {
   const tmpDir = await mkdtemp(join(tmpdir(), "memory-plugin-test-"));
 
@@ -876,6 +933,85 @@ test("integration: explicit memory flows from user message through pending journ
   }
 });
 
+test("explicit memory lifecycle emits detected appended and promoted evidence", async () => {
+  const tmpDir = await mkdtemp(join(tmpdir(), "memory-plugin-test-"));
+
+  try {
+    const plugin = await MemoryV2Plugin({
+      directory: tmpDir,
+      client: mockClientWithLatestUser("remember this: Prefer evidence-backed lifecycle tests.", "msg-evidence-life"),
+    });
+
+    await (plugin as Record<string, Function>)["experimental.chat.system.transform"](
+      { sessionID: "evidence-life-session", model: {} },
+      { system: ["base header"] },
+    );
+
+    await (plugin as Record<string, Function>)["event"]({
+      event: { type: "session.compacted", properties: { sessionID: "evidence-life-session" } },
+    });
+
+    const events = await queryEvidenceEvents(tmpDir, { newestFirst: false });
+    const eventTypes = events.map(event => event.type);
+
+    assert.ok(eventTypes.includes("explicit_memory_detected"));
+    assert.ok(eventTypes.includes("pending_memory_appended"));
+    assert.ok(eventTypes.includes("promotion_promoted"));
+
+    const output = { system: ["base header"] };
+    await (plugin as Record<string, Function>)["experimental.chat.system.transform"](
+      { sessionID: "evidence-life-session", model: {} },
+      output,
+    );
+
+    const finalEvents = await queryEvidenceEvents(tmpDir, { newestFirst: false });
+    assert.ok(finalEvents.map(event => event.type).includes("render_selected"));
+  } finally {
+    await rm(tmpDir, { recursive: true, force: true });
+  }
+});
+
+test("session.compacted promotes first-time explicit memory without self-reinforcement", async () => {
+  const tmpDir = await mkdtemp(join(tmpdir(), "memory-plugin-test-"));
+
+  try {
+    const plugin = await MemoryV2Plugin({
+      directory: tmpDir,
+      client: mockClientWithLatestUser(
+        "remember this: Prefer no self reinforcement during first promotion.",
+        "msg-no-self-reinforce",
+      ),
+    });
+
+    await (plugin as Record<string, Function>)["experimental.chat.system.transform"](
+      { sessionID: "no-self-reinforce-session", model: {} },
+      { system: ["base header"] },
+    );
+
+    await (plugin as Record<string, Function>)["event"]({
+      event: {
+        type: "session.compacted",
+        properties: { sessionID: "no-self-reinforce-session" },
+      },
+    });
+
+    const workspace = await loadWorkspaceMemory(tmpDir);
+    const promoted = workspace.entries.find(entry =>
+      /Prefer no self reinforcement/.test(entry.text)
+    );
+
+    assert.ok(promoted, "explicit memory should be promoted");
+    assert.equal(promoted.reinforcementCount ?? 0, 0);
+    assert.equal(promoted.lastReinforcedSessionID, undefined);
+
+    const state = await loadSessionState(tmpDir, "no-self-reinforce-session");
+    assert.equal(state.pendingMemories.length, 0);
+    assert.equal((await loadPendingJournal(tmpDir)).entries.length, 0);
+  } finally {
+    await rm(tmpDir, { recursive: true, force: true });
+  }
+});
+
 test("integration: compaction candidate flows through journal promotion and clears pending journal", async () => {
   const tmpDir = await mkdtemp(join(tmpdir(), "memory-plugin-test-"));
 

tests/promotion-accounting.test.ts

@@ -1,7 +1,7 @@
 import test from "node:test";
 import assert from "node:assert/strict";
 import type { LongTermMemoryEntry } from "../src/types.ts";
-import { accountPendingPromotions } from "../src/promotion-accounting.ts";
+import { accountPendingPromotions, promotionAccountingEvidenceEvents } from "../src/promotion-accounting.ts";
 import { memoryKey } from "../src/pending-journal.ts";
 import type { MemoryConsolidationEvent } from "../src/workspace-memory.ts";
 import { workspaceMemoryExactKey, workspaceMemoryIdentityKey } from "../src/workspace-memory.ts";
@@ -229,3 +229,57 @@ test("accountPendingPromotions marks manual capacity rejection as retryable", ()
   assert.equal(result.clearableKeys.size, 0);
   assert.deepEqual([...result.retryableRejectedKeys], [memoryKey(pending[0])]);
 });
+
+test("promotionAccountingEvidenceEvents maps every promotion outcome with relations", () => {
+  const promoted = mem("promoted", "Promoted memory should produce evidence.", { source: "explicit" });
+  const absorbed = mem("absorbed", "Absorbed memory should produce evidence.", { source: "explicit" });
+  const retained = mem("retained", "absorbed memory should produce evidence.", { source: "explicit" });
+  const identityAbsorbed = mem("identity-absorbed", "Project config lives in `src/config.ts`", { type: "reference" });
+  const identityRetained = mem("identity-retained", "Project config lives in `./src/config.ts`", { type: "reference" });
+  const superseded = mem("superseded", "Parser supports 3 formats.", { source: "compaction" });
+  const replacement = mem("replacement", "Parser supports 4 formats.", { source: "compaction" });
+  const capacity = mem("capacity", "Capacity rejected explicit memory should retry.", { source: "explicit", type: "reference" });
+  const exhausted = mem("exhausted", "Exhausted explicit memory should stop retrying.", { source: "explicit", type: "reference" });
+  const pending = [promoted, absorbed, identityAbsorbed, superseded, capacity, exhausted];
+  const accounting = {
+    promotedKeys: new Set([memoryKey(promoted)]),
+    absorbedKeys: new Set([memoryKey(absorbed), memoryKey(identityAbsorbed)]),
+    supersededKeys: new Set([memoryKey(superseded)]),
+    rejectedKeys: new Set([memoryKey(capacity), memoryKey(exhausted)]),
+    retryableRejectedKeys: new Set([memoryKey(capacity), memoryKey(exhausted)]),
+    clearableKeys: new Set([memoryKey(promoted), memoryKey(absorbed), memoryKey(identityAbsorbed), memoryKey(superseded), memoryKey(exhausted)]),
+  };
+  const events = [
+    { ...event(absorbed, "absorbed_exact"), retainedId: retained.id },
+    { ...event(identityAbsorbed, "absorbed_identity"), retainedId: identityRetained.id },
+    { ...event(superseded, "superseded_existing"), retainedId: replacement.id, supersededId: superseded.id },
+    event(capacity, "rejected_capacity"),
+    event(exhausted, "rejected_capacity"),
+  ];
+
+  const evidence = promotionAccountingEvidenceEvents({
+    pending,
+    after: [promoted, retained, identityRetained, replacement],
+    events,
+    accounting,
+    exhaustedRejectedKeys: new Set([memoryKey(exhausted)]),
+  });
+
+  const expectedPromotionEventTypes = new Set([
+    "promotion_promoted",
+    "promotion_absorbed_exact",
+    "promotion_absorbed_identity",
+    "promotion_superseded",
+    "promotion_rejected_capacity",
+    "promotion_retry_scheduled",
+    "promotion_retry_exhausted",
+  ]);
+
+  assert.deepEqual(new Set(evidence.map(event => event.type)), expectedPromotionEventTypes);
+  const absorbedEvent = evidence.find(event => event.type === "promotion_absorbed_exact");
+  assert.ok(absorbedEvent?.relations?.some(relation => relation.role === "absorbed" && relation.memory?.memoryId === absorbed.id));
+  assert.ok(absorbedEvent?.relations?.some(relation => relation.role === "retained" && relation.memory?.memoryId === retained.id));
+  const supersededEvent = evidence.find(event => event.type === "promotion_superseded");
+  assert.ok(supersededEvent?.relations?.some(relation => relation.role === "superseded" && relation.memory?.memoryId === superseded.id));
+  assert.ok(supersededEvent?.relations?.some(relation => relation.role === "superseded_by" && relation.memory?.memoryId === replacement.id));
+});

tests/storage.test.ts

@@ -1,11 +1,13 @@
 import test from "node:test";
 import assert from "node:assert/strict";
 import { existsSync } from "node:fs";
-import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { mkdir, mkdtemp, readdir, rm, writeFile } from "node:fs/promises";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { tmpdir } from "node:os";
 import { spawn } from "node:child_process";
-import { updateJSON } from "../src/storage.ts";
+import { readJSON, updateJSON } from "../src/storage.ts";
+import { queryEvidenceEvents } from "../src/evidence-log.ts";
+import { workspaceMemoryPath } from "../src/paths.ts";
 
 test("updateJSON serializes concurrent increments", async () => {
   const root = await mkdtemp(join(tmpdir(), "wm-storage-"));
@@ -37,6 +39,44 @@ test("updateJSON does not replace corrupt JSON with fallback", async () => {
   }
 });
 
+test("readJSON quarantines corrupt JSON and returns fallback", async () => {
+  const dir = await mkdtemp(join(tmpdir(), "wm-storage-corrupt-"));
+  const path = join(dir, "store.json");
+
+  try {
+    await writeFile(path, "{ invalid json", "utf8");
+
+    const loaded = await readJSON(path, () => ({ ok: true }));
+
+    assert.deepEqual(loaded, { ok: true });
+
+    const files = await readdir(dir);
+    assert.equal(files.includes("store.json"), false);
+    assert.equal(files.some(file => file.startsWith("store.json.corrupt-")), true);
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+test("readJSON emits corrupt JSON quarantine evidence for workspace stores", async () => {
+  const root = await mkdtemp(join(tmpdir(), "wm-storage-evidence-corrupt-"));
+  try {
+    const path = await workspaceMemoryPath(root);
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, "{ invalid json", "utf8");
+
+    const loaded = await readJSON(path, () => ({ ok: true }));
+    const events = await queryEvidenceEvents(root, { types: ["storage_corrupt_json_quarantined"] });
+
+    assert.deepEqual(loaded, { ok: true });
+    assert.equal(events.length, 1);
+    assert.equal(events[0].reasonCodes.includes("invalid_json"), true);
+    assert.equal(JSON.stringify(events).includes("invalid json"), false);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
 test("updateJSON recovers stale lock files left by crashed process", async () => {
   const root = await mkdtemp(join(tmpdir(), "wm-storage-stale-lock-"));
   try {
@@ -52,6 +92,47 @@ test("updateJSON recovers stale lock files left by crashed process", async () =>
   }
 });
 
+test("updateJSON emits stale lock recovery evidence for workspace stores", async () => {
+  const root = await mkdtemp(join(tmpdir(), "wm-storage-evidence-stale-lock-"));
+  try {
+    const path = await workspaceMemoryPath(root);
+    const lockPath = `${path}.lock`;
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(lockPath, `999999\n0\n`, "utf8");
+
+    await updateJSON(path, () => ({ count: 0 }), current => ({ count: current.count + 1 }));
+    const events = await queryEvidenceEvents(root, { types: ["storage_stale_lock_recovered"] });
+
+    assert.equal(events.length, 1);
+    assert.equal(events[0].reasonCodes.includes("stale_lock"), true);
+    assert.equal(JSON.stringify(events).includes("999999"), false);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("updateJSON emits lock timeout evidence and still throws", async () => {
+  const root = await mkdtemp(join(tmpdir(), "wm-storage-evidence-timeout-"));
+  try {
+    const path = await workspaceMemoryPath(root);
+    const lockPath = `${path}.lock`;
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(lockPath, `${process.pid}\n${Date.now()}\n`, "utf8");
+
+    await assert.rejects(
+      updateJSON(path, () => ({ count: 0 }), current => current),
+      /Timed out waiting for lock/,
+    );
+    const events = await queryEvidenceEvents(root, { types: ["storage_lock_timeout"] });
+
+    assert.equal(events.length, 1);
+    assert.equal(events[0].reasonCodes.includes("lock_wait_timeout"), true);
+    assert.equal(JSON.stringify(events).includes(String(process.pid)), false);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
 test("updateJSON serializes writes across separate node processes", async () => {
   const root = await mkdtemp(join(tmpdir(), "wm-storage-xproc-"));
   try {
@@ -81,3 +162,43 @@ test("updateJSON serializes writes across separate node processes", async () =>
     await rm(root, { recursive: true, force: true });
   }
 });
+
+test("updateJSON waits for a live cross-process lock and preserves both updates", async () => {
+  const root = await mkdtemp(join(tmpdir(), "wm-storage-live-lock-"));
+  try {
+    const path = join(root, "counter.json");
+    const worker = `
+      import { updateJSON } from ${JSON.stringify(new URL("../src/storage.ts", import.meta.url).href)};
+      const path = process.argv[1];
+      await updateJSON(path, () => ({ count: 0, order: [] }), async current => {
+        await new Promise(resolve => setTimeout(resolve, 250));
+        return { count: current.count + 1, order: [...current.order, "child"] };
+      });
+    `;
+
+    const child = spawn(
+      process.execPath,
+      ["--experimental-strip-types", "--input-type=module", "-e", worker, path],
+      { stdio: "inherit" },
+    );
+
+    await new Promise(resolve => setTimeout(resolve, 50));
+
+    await updateJSON(path, () => ({ count: 0, order: [] as string[] }), current => ({
+      count: current.count + 1,
+      order: [...current.order, "parent"],
+    }));
+
+    await new Promise<void>((resolve, reject) => {
+      child.on("exit", code => code === 0 ? resolve() : reject(new Error(`child exited ${code}`)));
+      child.on("error", reject);
+    });
+
+    const final = await updateJSON(path, () => ({ count: 0, order: [] as string[] }), current => current);
+    assert.equal(final.count, 2);
+    assert.deepEqual(new Set(final.order), new Set(["child", "parent"]));
+    assert.equal(existsSync(`${path}.lock`), false);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});

tests/workspace-memory.test.ts

@@ -8,6 +8,7 @@ import { HOT_STATE_LIMITS, LONG_TERM_LIMITS } from "../src/types.ts";
 import { workspaceKey, workspaceMemoryPath } from "../src/paths.ts";
 import {
   renderWorkspaceMemory,
+  accountWorkspaceMemoryRender,
   enforceLongTermLimits,
   dedupeLongTermEntriesWithAccounting,
   enforceLongTermLimitsWithAccounting,
@@ -19,13 +20,16 @@ import {
   loadWorkspaceMemory,
   saveWorkspaceMemory,
   updateWorkspaceMemoryWithAccounting,
+} from "../src/workspace-memory.ts";
+import {
+  RETENTION_TYPE_MAX,
   calculateInitialStrength,
   calculateEffectiveHalfLife,
   calculateRetentionStrength,
   calculateDormantDays,
   calculateEffectiveAgeDays,
   reinforceMemory,
-} from "../src/workspace-memory.ts";
+} from "../src/retention.ts";
 import { redactCredentials } from "../src/redaction.ts";
 import { assessMemoryQuality, isHardQualityReason, isProgressSnapshotViolation } from "../src/memory-quality.ts";
 import { reviewerCurrent28Fixture } from "./fixtures/memory-quality-current-28.ts";
@@ -154,6 +158,47 @@ test("renderWorkspaceMemory returns empty for no entries", () => {
   assert.equal(rendered, "");
 });
 
+test("accountWorkspaceMemoryRender reports rendered and omitted reasons", () => {
+  const store: WorkspaceMemoryStore = {
+    version: 1,
+    workspace: { root: "/repo", key: "abc" },
+    limits: { maxRenderedChars: LONG_TERM_LIMITS.maxRenderedChars, maxEntries: LONG_TERM_LIMITS.maxEntries },
+    entries: [
+      ...Array.from({ length: 12 }, (_, i) => entry(`feedback-render-${i}`, `Unique rendered feedback preference ${i}`, "feedback")),
+      { ...entry("superseded-render", "Old superseded memory", "decision"), status: "superseded" as const },
+    ],
+    updatedAt: new Date().toISOString(),
+  };
+
+  const accounting = accountWorkspaceMemoryRender(store);
+
+  assert.equal(accounting.rendered.length, 10);
+  assert.ok(accounting.omitted.some(item => item.reason === "type_cap"));
+  assert.ok(accounting.omitted.some(item => item.reason === "superseded"));
+  assert.ok(accounting.evidence.some(event => event.type === "render_selected"));
+  assert.ok(accounting.evidence.some(event => event.type === "render_omitted" && event.reasonCodes.includes("type_cap")));
+});
+
+test("accountWorkspaceMemoryRender reports char budget and empty budget omissions", () => {
+  const charBudgetStore: WorkspaceMemoryStore = {
+    version: 1,
+    workspace: { root: "/repo", key: "abc" },
+    limits: { maxRenderedChars: 180, maxEntries: LONG_TERM_LIMITS.maxEntries },
+    entries: Array.from({ length: 3 }, (_, i) => entry(`char-budget-${i}`, `Long rendered memory ${i} `.repeat(20), "decision")),
+    updatedAt: new Date().toISOString(),
+  };
+  const emptyBudgetStore: WorkspaceMemoryStore = {
+    ...charBudgetStore,
+    limits: { maxRenderedChars: 10, maxEntries: LONG_TERM_LIMITS.maxEntries },
+  };
+
+  const charBudget = accountWorkspaceMemoryRender(charBudgetStore);
+  const emptyBudget = accountWorkspaceMemoryRender(emptyBudgetStore);
+
+  assert.ok(charBudget.omitted.some(item => item.reason === "char_budget"));
+  assert.ok(emptyBudget.omitted.some(item => item.reason === "empty_render_budget"));
+});
+
 // ============================================
 // PR-2 Task 5 tests (for enforceLongTermLimits)
 // ============================================
@@ -270,7 +315,7 @@ test("enforceLongTermLimits respects maxEntries limit", () => {
   assert.ok(kept.length <= 28, `Should respect maxEntries. Got: ${kept.length}`);
 });
 
-test("calculateInitialStrength multiplies type, source, importance, and safety factors", () => {
+test("calculateInitialStrength multiplies type, source, and importance factors", () => {
   const memory: LongTermMemoryEntry = {
     ...entry("strength", "Never store raw credentials", "reference"),
     source: "explicit",
@@ -278,7 +323,20 @@ test("calculateInitialStrength multiplies type, source, importance, and safety f
     safetyCritical: true,
   };
 
-  assert.equal(calculateInitialStrength(memory), 18);
+  assert.equal(calculateInitialStrength(memory), 3);
+});
+
+test("calculateInitialStrength ignores deprecated safetyCritical field", () => {
+  const memory: LongTermMemoryEntry = {
+    ...entry("safety-deprecated", "Deprecated safety field should not affect strength", "decision"),
+    source: "explicit",
+    userImportance: "high",
+    safetyCritical: true,
+  };
+
+  const withoutSafety = { ...memory, safetyCritical: undefined };
+
+  assert.equal(calculateInitialStrength(memory), calculateInitialStrength(withoutSafety));
 });
 
 test("calculateEffectiveHalfLife clamps reinforcement count at configured maximum", () => {
@@ -447,6 +505,33 @@ test("reinforceMemory enforces session interval and max guards", () => {
   assert.equal(reinforceMemory(atMax, "session-c", now), atMax);
 });
 
+test("reinforceMemory requires distinct UTC calendar days between reinforcements", () => {
+  const firstReinforcedAt = Date.UTC(2026, 3, 29, 0, 15);
+  const sameUtcDayMuchLater = Date.UTC(2026, 3, 29, 23, 30);
+  const nextUtcDayAfterInterval = Date.UTC(2026, 3, 30, 1, 30);
+  const base: LongTermMemoryEntry = {
+    ...entry("calendar-day-gated", "Reinforcement requires distinct UTC calendar days", "decision"),
+    reinforcementCount: 1,
+    lastReinforcedAt: firstReinforcedAt,
+    lastReinforcedSessionID: "session-a",
+  };
+
+  assert.equal(reinforceMemory(base, "session-b", sameUtcDayMuchLater), base);
+
+  const reinforcedNextDay = reinforceMemory(base, "session-b", nextUtcDayAfterInterval);
+  assert.notEqual(reinforcedNextDay, base);
+  assert.equal(reinforcedNextDay.reinforcementCount, 2);
+  assert.equal(reinforcedNextDay.lastReinforcedAt, nextUtcDayAfterInterval);
+  assert.equal(reinforcedNextDay.lastReinforcedSessionID, "session-b");
+  assert.equal(reinforcedNextDay.retentionClock, nextUtcDayAfterInterval);
+
+  const atMax: LongTermMemoryEntry = {
+    ...base,
+    reinforcementCount: 6,
+  };
+  assert.equal(reinforceMemory(atMax, "session-c", nextUtcDayAfterInterval), atMax);
+});
+
 test("dedupeLongTermEntriesWithAccounting reinforces absorbed exact duplicates", () => {
   const now = Date.now();
   const retained: LongTermMemoryEntry = {
@@ -469,6 +554,30 @@ test("dedupeLongTermEntriesWithAccounting reinforces absorbed exact duplicates",
   assert.equal(result.kept[0].reinforcementCount, 1);
   assert.equal(result.kept[0].lastReinforcedSessionID, "reinforce-session");
   assert.ok(typeof result.kept[0].retentionClock === "number");
+  assert.ok(result.evidence.some(event =>
+    event.type === "memory_reinforced" &&
+    event.reasonCodes.includes("duplicate_exact") &&
+    event.relations?.some(relation => relation.role === "reinforced" && relation.memory?.memoryId === "duplicate") &&
+    event.relations?.some(relation => relation.role === "reinforced_by" && relation.memory?.memoryId === "retained")
+  ));
+});
+
+test("dedupeLongTermEntriesWithAccounting emits identity reinforcement evidence", () => {
+  const now = Date.now();
+  const retained: LongTermMemoryEntry = {
+    ...entry("retained-identity", "OpenCode plugin config location: `.opencode-agenthub/current/xdg/opencode/opencode.json` in workspace", "reference"),
+    retentionClock: now - 10 * DAY_MS,
+  };
+  const duplicate: LongTermMemoryEntry = {
+    ...entry("duplicate-identity", "OpenCode plugin config: .opencode-agenthub/current/xdg/opencode/opencode.json in workspace", "reference"),
+    pendingOwnerSessionID: "identity-session",
+  };
+
+  const result = dedupeLongTermEntriesWithAccounting([retained, duplicate]);
+
+  assert.ok(result.evidence.some(event =>
+    event.type === "memory_reinforced" && event.reasonCodes.includes("duplicate_identity")
+  ));
 });
 
 test("reinforced memory with same initial strength and age ranks above unreinforced memory", () => {
@@ -514,6 +623,7 @@ test("dedupe reinforcement does not increment for same session", () => {
   assert.ok(retained, "existing manual memory should be retained");
   assert.equal(retained.reinforcementCount, 1);
   assert.equal(retained.lastReinforcedSessionID, "same-session");
+  assert.equal(result.evidence.some(event => event.type === "memory_reinforced"), false);
 });
 
 test("dedupe reinforcement does not increment under one hour", () => {
@@ -536,6 +646,23 @@ test("dedupe reinforcement does not increment under one hour", () => {
   assert.ok(retained, "existing manual memory should be retained");
   assert.equal(retained.reinforcementCount, 1);
   assert.equal(retained.lastReinforcedSessionID, "old-session");
+  assert.equal(result.evidence.some(event => event.type === "memory_reinforced"), false);
+});
+
+test("dedupe reinforcement does not emit evidence at max reinforcement count", () => {
+  const existing: LongTermMemoryEntry = {
+    ...entry("existing-max", "Prefer deterministic consolidation accounting", "feedback"),
+    source: "manual",
+    reinforcementCount: 6,
+  };
+  const duplicate: LongTermMemoryEntry = {
+    ...entry("duplicate-max", "prefer deterministic consolidation accounting!!!", "feedback"),
+    pendingOwnerSessionID: "new-session",
+  };
+
+  const result = dedupeLongTermEntriesWithAccounting([existing, duplicate]);
+
+  assert.equal(result.evidence.some(event => event.type === "memory_reinforced"), false);
 });
 
 test("enforceLongTermLimits orders entries by retention strength", () => {
@@ -567,7 +694,73 @@ test("enforceLongTermLimits applies per-type caps after strength sorting", () =>
   assert.equal(kept.filter(memory => memory.type === "feedback").length, 10);
 });
 
-test("enforceLongTermLimits exempts safety-critical entries from type caps", () => {
+test("safetyCritical entries compete under RETENTION_TYPE_MAX caps like other entries", () => {
+  const safetyEntries: LongTermMemoryEntry[] = Array.from({ length: 6 }, (_, i) => ({
+    ...entry(`safety-${i}`, `Safety memory ${i}`, "feedback"),
+    source: "explicit",
+    safetyCritical: true,
+  }));
+
+  const ordinaryEntries: LongTermMemoryEntry[] = Array.from({ length: 10 }, (_, i) => ({
+    ...entry(`ordinary-${i}`, `Ordinary memory ${i}`, "feedback"),
+    source: "explicit",
+  }));
+
+  const all = [...safetyEntries, ...ordinaryEntries];
+  const kept = enforceLongTermLimits(all);
+
+  const feedbackCount = kept.filter(e => e.type === "feedback").length;
+  assert.equal(feedbackCount, RETENTION_TYPE_MAX.feedback);
+  // safetyCritical entries are no longer exempt from type caps
+  assert.ok(kept.filter(e => e.safetyCritical).length < 6);
+});
+
+test("workspace memory JSON with deprecated safetyCritical loads and competes normally", async () => {
+  const root = await mkdtemp(join(tmpdir(), "opencode-safety-compat-"));
+  try {
+    const key = await workspaceKey(root);
+    const path = await workspaceMemoryPath(root);
+    const now = new Date().toISOString();
+    const safetyEntries: LongTermMemoryEntry[] = Array.from({ length: 6 }, (_, i) => ({
+      ...entry(`safety-fixture-${i}`, `Safety fixture memory ${i}`, "feedback"),
+      source: "explicit",
+      userImportance: i === 0 ? "high" : "normal",
+      safetyCritical: true,
+    }));
+    const ordinaryEntries: LongTermMemoryEntry[] = Array.from({ length: 10 }, (_, i) => ({
+      ...entry(`ordinary-fixture-${i}`, `Ordinary fixture memory ${i}`, "feedback"),
+      source: "explicit",
+    }));
+    const store: WorkspaceMemoryStore = {
+      version: 1,
+      workspace: { root, key },
+      limits: { maxRenderedChars: LONG_TERM_LIMITS.maxRenderedChars, maxEntries: LONG_TERM_LIMITS.maxEntries },
+      entries: [...safetyEntries, ...ordinaryEntries],
+      migrations: [],
+      updatedAt: now,
+      lastActivityAt: now,
+    };
+
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, JSON.stringify(store, null, 2), "utf8");
+
+    const loaded = await loadWorkspaceMemory(root);
+    const safetyEntry = loaded.entries.find(memory => memory.safetyCritical);
+    assert.ok(safetyEntry, "fixture should include deprecated safetyCritical entries");
+    assert.equal(
+      calculateInitialStrength(safetyEntry),
+      calculateInitialStrength({ ...safetyEntry, safetyCritical: undefined }),
+    );
+
+    const kept = enforceLongTermLimits(loaded.entries);
+    assert.equal(kept.filter(memory => memory.type === "feedback").length, RETENTION_TYPE_MAX.feedback);
+    assert.ok(kept.filter(memory => memory.safetyCritical).length < safetyEntries.length);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("enforceLongTermLimits applies type caps to deprecated safetyCritical entries", () => {
   const ordinaryFeedback = Array.from({ length: 12 }, (_, i) =>
     entry(`feedback_${i}`, `Unique safe ordinary feedback preference ${i}`, "feedback")
   );
@@ -578,12 +771,11 @@ test("enforceLongTermLimits exempts safety-critical entries from type caps", ()
 
   const kept = enforceLongTermLimits([safetyCriticalFeedback, ...ordinaryFeedback]);
 
-  assert.equal(kept.length, 11);
+  assert.equal(kept.length, RETENTION_TYPE_MAX.feedback);
-  assert.ok(kept.some(memory => memory.id === "safety-feedback"));
+  assert.equal(kept.filter(memory => memory.type === "feedback").length, RETENTION_TYPE_MAX.feedback);
-  assert.equal(kept.filter(memory => memory.type === "feedback" && !memory.safetyCritical).length, 10);
 });
 
-test("mixed retention scenario applies caps, safety exemption, and reinforcement ordering", () => {
+test("mixed retention scenario applies caps and reinforcement ordering", () => {
   const now = Date.now();
   const oldAge = now - 120 * DAY_MS;
   const ordinaryFeedback = Array.from({ length: 17 }, (_, i) =>
@@ -625,18 +817,15 @@ test("mixed retention scenario applies caps, safety exemption, and reinforcement
     lastActivityAt: new Date(now).toISOString(),
   };
 
-  assert.ok(entries.filter(memory => memory.type === "feedback" && !memory.safetyCritical).length > 10);
+  assert.ok(entries.filter(memory => memory.type === "feedback").length > 10);
-  assert.ok(entries.filter(memory => memory.type === "decision" && !memory.safetyCritical).length > 10);
+  assert.ok(entries.filter(memory => memory.type === "decision").length > 10);
 
   const result = enforceLongTermLimitsWithAccounting(entries, store);
 
   assert.ok(result.kept.length <= 28);
-  assert.ok(result.kept.filter(memory => memory.type === "feedback" && !memory.safetyCritical).length <= 10);
+  assert.ok(result.kept.filter(memory => memory.type === "feedback").length <= RETENTION_TYPE_MAX.feedback);
-  assert.ok(result.kept.filter(memory => memory.type === "decision" && !memory.safetyCritical).length <= 10);
+  assert.ok(result.kept.filter(memory => memory.type === "decision").length <= RETENTION_TYPE_MAX.decision);
-  assert.ok(result.kept.some(memory => memory.safetyCritical));
+  assert.equal(result.kept.filter(memory => memory.type === "feedback").length, RETENTION_TYPE_MAX.feedback);
-  assert.equal(result.kept.filter(memory => memory.type === "feedback" && !memory.safetyCritical).length, 10);
-  assert.equal(result.kept.filter(memory => memory.type === "feedback" && memory.safetyCritical).length, 1);
-  assert.equal(result.kept.filter(memory => memory.type === "feedback").length, 11);
   const reinforcedIndex = result.kept.findIndex(memory => memory.id === "old-reinforced");
   const unreinforcedIndex = result.kept.findIndex(memory => memory.id === "old-unreinforced");
   assert.ok(reinforcedIndex >= 0, "old reinforced reference should be kept");
@@ -840,6 +1029,143 @@ test("normalizeWorkspaceMemoryWithAccounting redacts credentials before accounti
   assert.equal(result.store.entries[0].text, "Admin PIN 是 [REDACTED]");
 });
 
+test("retentionClock backfill: missing clock becomes createdAt timestamp", async () => {
+  const root = "/repo";
+  const createdAt = "2026-01-02T03:04:05.000Z";
+  const memory = {
+    ...entry("backfill-created", "Use durable createdAt for retention backfill", "decision"),
+    createdAt,
+    updatedAt: "2026-04-01T03:04:05.000Z",
+  };
+  const store: WorkspaceMemoryStore = {
+    version: 1,
+    workspace: { root, key: "abc" },
+    limits: { maxRenderedChars: LONG_TERM_LIMITS.maxRenderedChars, maxEntries: LONG_TERM_LIMITS.maxEntries },
+    migrations: ["2026-04-28-quality-cleanup", "2026-04-26-p0-cleanup"],
+    entries: [memory],
+    updatedAt: createdAt,
+  };
+
+  const result = await normalizeWorkspaceMemoryWithAccounting(root, store);
+
+  assert.equal(result.store.entries[0].retentionClock, new Date(createdAt).getTime());
+});
+
+test("retentionClock backfill: invalid createdAt uses updatedAt", async () => {
+  const root = "/repo";
+  const updatedAt = "2026-02-03T04:05:06.000Z";
+  const memory = {
+    ...entry("backfill-updated", "Use updatedAt only when createdAt is invalid", "decision"),
+    createdAt: "not-a-date",
+    updatedAt,
+  };
+  const store: WorkspaceMemoryStore = {
+    version: 1,
+    workspace: { root, key: "abc" },
+    limits: { maxRenderedChars: LONG_TERM_LIMITS.maxRenderedChars, maxEntries: LONG_TERM_LIMITS.maxEntries },
+    migrations: ["2026-04-28-quality-cleanup", "2026-04-26-p0-cleanup"],
+    entries: [memory],
+    updatedAt,
+  };
+
+  const result = await normalizeWorkspaceMemoryWithAccounting(root, store);
+
+  assert.equal(result.store.entries[0].retentionClock, new Date(updatedAt).getTime());
+});
+
+test("retentionClock backfill: both invalid uses Date.now()", async () => {
+  const root = "/repo";
+  const before = Date.now();
+  const memory = {
+    ...entry("backfill-now", "Use current wall clock when stored timestamps are invalid", "decision"),
+    createdAt: "not-a-date",
+    updatedAt: "also-not-a-date",
+  };
+  const store: WorkspaceMemoryStore = {
+    version: 1,
+    workspace: { root, key: "abc" },
+    limits: { maxRenderedChars: LONG_TERM_LIMITS.maxRenderedChars, maxEntries: LONG_TERM_LIMITS.maxEntries },
+    migrations: ["2026-04-28-quality-cleanup", "2026-04-26-p0-cleanup"],
+    entries: [memory],
+    updatedAt: new Date(before).toISOString(),
+  };
+
+  const result = await normalizeWorkspaceMemoryWithAccounting(root, store);
+  const after = Date.now();
+  const retentionClock = result.store.entries[0].retentionClock;
+
+  assert.equal(typeof retentionClock, "number");
+  assert.ok(Number.isFinite(retentionClock));
+  assert.ok((retentionClock ?? 0) >= before);
+  assert.ok((retentionClock ?? 0) <= after);
+});
+
+test("retentionClock backfill: valid clock is unchanged", async () => {
+  const root = "/repo";
+  const createdAt = "2026-01-02T03:04:05.000Z";
+  const retentionClock = new Date("2025-12-31T00:00:00.000Z").getTime();
+  const memory = {
+    ...entry("backfill-valid", "Preserve existing valid retention clocks", "decision"),
+    createdAt,
+    updatedAt: "2026-04-01T03:04:05.000Z",
+    retentionClock,
+  };
+  const store: WorkspaceMemoryStore = {
+    version: 1,
+    workspace: { root, key: "abc" },
+    limits: { maxRenderedChars: LONG_TERM_LIMITS.maxRenderedChars, maxEntries: LONG_TERM_LIMITS.maxEntries },
+    migrations: ["2026-04-28-quality-cleanup", "2026-04-26-p0-cleanup"],
+    entries: [memory],
+    updatedAt: createdAt,
+  };
+
+  const result = await normalizeWorkspaceMemoryWithAccounting(root, store);
+
+  assert.equal(result.store.entries[0].retentionClock, retentionClock);
+});
+
+test("retentionClock backfill: rendered IDs unchanged before and after", async () => {
+  const root = "/repo";
+  const oldCreatedAt = "2026-01-01T00:00:00.000Z";
+  const newCreatedAt = "2026-02-01T00:00:00.000Z";
+  const entries = [
+    {
+      ...entry("with-clock", "Decision with a pre-existing retention clock", "decision"),
+      createdAt: newCreatedAt,
+      updatedAt: newCreatedAt,
+      retentionClock: new Date(newCreatedAt).getTime(),
+    },
+    {
+      ...entry("missing-clock", "Decision missing a retention clock but with createdAt", "decision"),
+      createdAt: oldCreatedAt,
+      updatedAt: "2026-04-01T00:00:00.000Z",
+    },
+  ];
+  const baseStore: WorkspaceMemoryStore = {
+    version: 1,
+    workspace: { root, key: "abc" },
+    limits: { maxRenderedChars: LONG_TERM_LIMITS.maxRenderedChars, maxEntries: LONG_TERM_LIMITS.maxEntries },
+    migrations: ["2026-04-28-quality-cleanup", "2026-04-26-p0-cleanup"],
+    entries,
+    updatedAt: newCreatedAt,
+  };
+  const prefilledStore: WorkspaceMemoryStore = {
+    ...baseStore,
+    entries: entries.map(memory => ({
+      ...memory,
+      retentionClock: memory.retentionClock ?? new Date(memory.createdAt).getTime(),
+    })),
+  };
+
+  const missingClockResult = await normalizeWorkspaceMemoryWithAccounting(root, baseStore);
+  const prefilledResult = await normalizeWorkspaceMemoryWithAccounting(root, prefilledStore);
+
+  assert.deepEqual(
+    missingClockResult.kept.map(memory => memory.id),
+    prefilledResult.kept.map(memory => memory.id),
+  );
+});
+
 test("normalizeWorkspaceMemoryWithAccounting reports overflow capacity drops", async () => {
   const root = "/repo";
   const now = new Date().toISOString();
@@ -1990,3 +2316,108 @@ test("loadWorkspaceMemory normalizes and persists credentials from legacy unreda
     await rm(sandbox, { recursive: true, force: true });
   }
 });
+
+function decisionEntry(id: string, text: string, timestampMs: number): LongTermMemoryEntry {
+  const timestamp = new Date(timestampMs).toISOString();
+  return {
+    id,
+    type: "decision",
+    text,
+    source: "compaction",
+    confidence: 0.75,
+    status: "active",
+    createdAt: timestamp,
+    updatedAt: timestamp,
+    retentionClock: timestampMs,
+  };
+}
+
+test("enforceLongTermLimitsWithAccounting capacity drops return 3 lower-ranked decisions in dropped", () => {
+  const now = Date.UTC(2026, 4, 1, 6, 24, 0);
+  const thirtyDaysAgo = now - 30 * DAY_MS;
+  const existingDecisions = Array.from({ length: 10 }, (_, i) =>
+    decisionEntry(
+      `existing-decision-${i}`,
+      `Existing durable architecture decision ${i}`,
+      thirtyDaysAgo,
+    )
+  );
+  const newDecisions = Array.from({ length: 3 }, (_, i) =>
+    decisionEntry(
+      `new-decision-${i}`,
+      `Newer durable architecture decision ${i}`,
+      now,
+    )
+  );
+
+  const result = enforceLongTermLimitsWithAccounting([...existingDecisions, ...newDecisions]);
+  const capacityDrops = result.dropped.filter(event => event.reason === "rejected_capacity");
+  const droppedIds = new Set(capacityDrops.map(event => event.memory.id));
+  const capacityEvidence = result.evidence.filter(event => event.type === "memory_removed_capacity");
+
+  assert.equal(capacityDrops.length, 3);
+  assert.equal(capacityEvidence.length, 3);
+  for (const event of capacityEvidence) {
+    assert.equal(event.phase, "storage");
+    assert.equal(event.outcome, "removed");
+    assert.ok(event.memory?.memoryId, "capacity evidence should include removed memory id");
+    assert.ok(event.memory.memoryKeyHash, "capacity evidence should include removed memory key hash");
+    assert.ok(event.memory.identityKeyHash, "capacity evidence should include removed identity key hash");
+    assert.equal(droppedIds.has(event.memory.memoryId), true);
+    assert.ok(event.relations?.[0]?.memory.memoryKeyHash, "removed relation should include memory key hash");
+    assert.ok(event.relations?.[0]?.memory.identityKeyHash, "removed relation should include identity key hash");
+    assert.deepEqual(event.reasonCodes, ["type_cap"]);
+  }
+});
+
+test("enforceLongTermLimitsWithAccounting emits global_cap evidence for global cap losers", () => {
+  const now = Date.UTC(2026, 4, 1, 6, 24, 0);
+  const entries: LongTermMemoryEntry[] = [
+    ...Array.from({ length: RETENTION_TYPE_MAX.feedback }, (_, i) =>
+      decisionEntry(`global-feedback-${i}`, `Global cap feedback ${i}`, now)
+    ).map(memory => ({ ...memory, type: "feedback" as const })),
+    ...Array.from({ length: RETENTION_TYPE_MAX.decision }, (_, i) =>
+      decisionEntry(`global-decision-${i}`, `Global cap decision ${i}`, now)
+    ),
+    ...Array.from({ length: RETENTION_TYPE_MAX.project }, (_, i) =>
+      decisionEntry(`global-project-${i}`, `Global cap project ${i}`, now)
+    ).map(memory => ({ ...memory, type: "project" as const })),
+    ...Array.from({ length: RETENTION_TYPE_MAX.reference }, (_, i) =>
+      decisionEntry(`global-reference-${i}`, `Global cap reference ${i}`, now)
+    ).map(memory => ({ ...memory, type: "reference" as const })),
+  ];
+
+  const result = enforceLongTermLimitsWithAccounting(entries);
+  const capacityEvidence = result.evidence.filter(event => event.type === "memory_removed_capacity");
+  const globalCapEvidence = capacityEvidence.filter(event => event.reasonCodes.includes("global_cap"));
+
+  assert.equal(entries.length, 34);
+  assert.equal(result.kept.length, LONG_TERM_LIMITS.maxEntries);
+  assert.equal(globalCapEvidence.length, entries.length - LONG_TERM_LIMITS.maxEntries);
+  assert.equal(capacityEvidence.some(event => event.reasonCodes.includes("type_cap")), false);
+  assert.ok(globalCapEvidence.every(event => event.phase === "storage" && event.outcome === "removed"));
+});
+
+test("accountWorkspaceMemoryRender emits render_omitted for type_cap with 11 decisions", () => {
+  const now = Date.UTC(2026, 4, 1, 6, 24, 0);
+  const store: WorkspaceMemoryStore = {
+    version: 1,
+    workspace: { root: "/repo", key: "abc" },
+    limits: { maxRenderedChars: LONG_TERM_LIMITS.maxRenderedChars, maxEntries: LONG_TERM_LIMITS.maxEntries },
+    entries: Array.from({ length: 11 }, (_, i) =>
+      decisionEntry(`render-decision-${i}`, `Render durable decision ${i}`, now)
+    ),
+    updatedAt: new Date(now).toISOString(),
+    lastActivityAt: new Date(now).toISOString(),
+  };
+
+  const accounting = accountWorkspaceMemoryRender(store);
+  const typeCapOmissions = accounting.omitted.filter(item => item.reason === "type_cap");
+  const typeCapEvidence = accounting.evidence.filter(event =>
+    event.type === "render_omitted" && event.reasonCodes.includes("type_cap")
+  );
+
+  assert.equal(accounting.rendered.length, RETENTION_TYPE_MAX.decision);
+  assert.equal(typeCapOmissions.length, 1);
+  assert.equal(typeCapEvidence.length, 1);
+});