Boulea7 · Boulea7 · Mar 20, 2026 · Mar 20, 2026 · Mar 20, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -28,8 +28,20 @@ jobs:
       - name: Lint
         run: pnpm lint
 
+      - name: Docs Contract
+        run: pnpm test:docs-contract
+
+      - name: Reviewer Smoke
+        run: pnpm test:reviewer-smoke
+
+      - name: CLI Smoke
+        run: pnpm test:cli-smoke
+
       - name: Test
         run: pnpm test
 
       - name: Build
         run: pnpm build
+
+      - name: Pack Check
+        run: pnpm pack:check
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -21,6 +21,9 @@ When proposing changes, evaluate them against that product contract first.
 ```bash
 pnpm install
 pnpm lint
+pnpm test:docs-contract
+pnpm test:reviewer-smoke
+pnpm test:cli-smoke
 pnpm test
 pnpm build
 ```
@@ -41,21 +44,25 @@ Use Node 20+ and `pnpm`.
 - Keep file formats human-readable.
 - Avoid over-engineering. Start with the simplest version that keeps future migration possible.
 - Keep comments in English.
+- Keep reviewer-only warnings and confidence prose in audit/reviewer surfaces; they should not become continuity body content.
 
 ## Documentation Guidelines
 
 If your change affects one of these areas, update the matching file:
 
 - Claude behavior parity: `docs/claude-reference.md`
 - internals and storage model: `docs/architecture.md`
+- reviewer continuity contract: `docs/session-continuity.md`
+- release-time reviewer checks: `docs/release-checklist.md`
 - future native compatibility: `docs/native-migration.md`
-- onboarding and positioning: `README.md`
+- onboarding and positioning: `README.md` and `README.en.md`
 
 The repository now uses a bilingual public-doc setup:
 
 - `README.md` is the default Chinese landing page
 - `README.en.md` is the English landing page
 - `docs/claude-reference.*`, `docs/architecture.*`, and `docs/native-migration.*` are maintained in both Chinese and English
+- `docs/session-continuity.md` and `docs/release-checklist.md` are English-first maintainer/reviewer docs and should still be updated when reviewer surfaces or command contracts change
 
 If you change shared meaning in one of those files, update the sibling language version in the same task or explicitly note the follow-up gap in your handoff.
 

diff --git a/README.en.md b/README.en.md
@@ -113,6 +113,7 @@ Not a good fit:
 | Native hooks / memory integration | Built in | Experimental / under development | Compatibility seam only |
 
 `cam memory` is intentionally an inspection and audit surface. It exposes the quoted startup files that actually made it into the startup payload, currently the scoped `MEMORY.md` / index content, plus the startup budget, on-demand topic refs, edit paths, and recent durable sync audit events behind `--recent [count]`. Those topic refs are lookup pointers, not proof that topic bodies were eagerly loaded at startup.
+Recent durable sync audit events now also surface conservatively suppressed conflict candidates so contradictory rollout output does not silently merge into durable memory.
 Those recent sync events come from `~/.codex-auto-memory/projects/<project-id>/audit/sync-log.jsonl` and only cover sync-flow `applied`, `no-op`, and `skipped` events. Manual `cam remember` / `cam forget` updates stay outside that audit stream by design.
 When primary memory files were written but the reviewer sidecar did not complete, `cam memory` will try to expose a pending sync recovery marker so reviewers can see that partial-success state explicitly; that marker is only cleared when the same rollout/session later completes successfully, not by an unrelated successful sync.
 Explicit updates still happen through `cam remember`, `cam forget`, or direct Markdown edits rather than a `/memory`-style in-command editor.
@@ -170,22 +171,23 @@ cam audit           # check the repository for unexpected sensitive content
 | :-- | :-- |
 | `cam run` / `cam exec` / `cam resume` | compile startup memory and launch Codex through the wrapper |
 | `cam sync` | manually sync the latest rollout into durable memory |
-| `cam memory` | inspect the quoted startup files that actually entered the payload, on-demand topic refs, startup budget, edit paths, and durable sync audit events via `--recent [count]` |
+| `cam memory` | inspect the quoted startup files that actually entered the payload, on-demand topic refs, startup budget, edit paths, and durable sync audit events plus suppressed conflict candidates via `--recent [count]` |
 | `cam remember` / `cam forget` | explicitly add or remove durable memory |
 | `cam session save` | merge / incremental save; append rollout-derived continuity without cleaning stale state immediately |
 | `cam session refresh` | replace / clean regeneration; rebuild continuity from the selected provenance and replace the selected scope |
-| `cam session load` / `status` | continuity reviewer surface for the latest audit drill-down, compact prior preview, and any pending continuity recovery marker |
+| `cam session load` / `status` | continuity reviewer surface for the latest continuity diagnostics, including `confidence` / warnings when present, plus the latest audit drill-down, compact prior preview, and any pending continuity recovery marker |
 | `cam session clear` / `open` | clear active continuity files or open the local continuity directory |
 | `cam audit` | run privacy and secret-hygiene checks against the repository |
 | `cam doctor` | inspect local companion wiring and native-readiness posture |
 
 ## Audit Surface Map
 
 - `cam audit`: repository-level privacy and secret-hygiene audit.
-- `cam memory --recent [count]`: durable sync audit for recent `applied`, `no-op`, and `skipped` sync events, without mixing in manual `remember` / `forget`.
+- `cam memory --recent [count]`: durable sync audit for recent `applied`, `no-op`, and `skipped` sync events, without mixing in manual `remember` / `forget`; suppressed conflict candidates stay reviewer-visible here instead of silently merging.
 - `cam session save`: the merge path for the continuity audit surface. It records the latest diagnostics, latest rollout, and latest audit drill-down, but it remains an incremental save and does not immediately clean polluted state.
 - `cam session refresh`: the replace path for the continuity audit surface. It regenerates continuity from selected provenance and replaces the selected scope; `--json` additionally exposes `action`, `writeMode`, and `rolloutSelection`.
-- `cam session load|status`: reviewer surface for the latest continuity diagnostics, latest rollout, latest audit drill-down, and a compact prior audit preview sourced from the continuity audit log that excludes the latest entry, coalesces consecutive repeats, and is not a full prior-history replay. Their `--json` output continues to expose raw recent audit entries.
+- `cam session load|status`: reviewer surface for the latest continuity diagnostics, latest rollout, latest audit drill-down, and a compact prior audit preview sourced from the continuity audit log that excludes the latest entry, coalesces consecutive repeats, and is not a full prior-history replay. Their `--json` output continues to expose raw recent audit entries, plus continuity `confidence` and warnings for conservative summaries.
+- continuity reviewer warnings still belong to the audit/reviewer surface rather than the continuity body; the current implementation applies a minimal deterministic scrub so obvious reviewer warning prose is not written back into continuity Markdown.
 - `pending continuity recovery marker`: a visible warning that continuity Markdown was written but the audit sidecar failed. It is not a general repair mechanism and is not equivalent to `cam session refresh`.
 
 ## How it works
@@ -205,10 +207,12 @@ flowchart TD
     B --> C[Inject quoted MEMORY.md startup files plus on-demand topic refs]
     C --> D[Run Codex]
     D --> E[Read rollout JSONL]
-    E --> F[Extract durable memory operations]
+    E --> F[Extract candidate durable memory operations]
     E --> G[Optional continuity summary]
-    F --> H[Update MEMORY.md and topic files]
-    G --> I[Update shared and local continuity files]
+    F --> H[Contradiction review and conservative suppression]
+    H --> I[Update MEMORY.md and topic files]
+    I --> J[Append durable sync audit]
+    G --> K[Update shared and local continuity files]
 ```
 
 ### Why the project does not switch to native memory yet
@@ -286,7 +290,7 @@ Current public-ready status:
 
 - stronger contradiction handling
 - clearer `cam memory` and `cam session` reviewer UX
-- tighter continuity diagnostics and reviewer packets
+- tighter continuity diagnostics and reviewer packets, with explicit confidence and warning surfaces
 - keep a compatibility seam for future hook surfaces
 
 ### v0.3+

diff --git a/README.md b/README.md
@@ -113,6 +113,7 @@ Claude Code 已经公开了一套相对清晰的 auto memory 产品契约：
 | native hooks / memory | Built in | Experimental / under development | 当前只保留 compatibility seam |
 
 `cam memory` 当前是 inspection / audit surface：它会暴露真正进入 startup payload 的 quoted startup files（当前是各 scope 的 `MEMORY.md` / index 内容）、startup budget、按需 topic refs、edit paths，以及 `--recent [count]` 下的 recent durable sync audit。这里的 topic refs 只是按需定位信息，不表示 topic body 已在启动阶段 eager 读取。
+recent durable sync audit 现在也会显式暴露被保守 suppress 的 conflict candidates，避免在同一 rollout 或与现有 durable memory 冲突时发生静默 merge。
 这些 recent sync events 来自 `~/.codex-auto-memory/projects/<project-id>/audit/sync-log.jsonl`，只覆盖 sync flow 的 `applied` / `no-op` / `skipped` 事件，不包含 manual `cam remember` / `cam forget`。
 如果主 memory 文件已经写入，但 reviewer sidecar（audit / processed-state）没有完整落盘，`cam memory` 会尽力暴露一个 pending sync recovery marker，帮助 reviewer 识别 partial-success 状态；该 marker 只会在同一 rollout/session 后续成功补齐时清理，不会被不相关的成功 sync 顺手抹掉。
 显式更新仍通过 `cam remember`、`cam forget` 或直接编辑 Markdown 文件完成，而不是提供 `/memory` 风格的命令内编辑器。
@@ -170,22 +171,23 @@ cam audit           # 检查仓库有没有意外的敏感内容
 | :-- | :-- |
 | `cam run` / `cam exec` / `cam resume` | 编译 startup memory 并通过 wrapper 启动 Codex |
 | `cam sync` | 手动把最近 rollout 同步进 durable memory |
-| `cam memory` | 查看真正进入 startup payload 的 quoted startup files、按需 topic refs、startup budget、edit paths，以及 `--recent [count]` 下的 durable sync audit |
+| `cam memory` | 查看真正进入 startup payload 的 quoted startup files、按需 topic refs、startup budget、edit paths，以及 `--recent [count]` 下的 durable sync audit 与 suppressed conflict candidates |
 | `cam remember` / `cam forget` | 显式新增或删除 memory |
 | `cam session save` | merge / incremental save；从 rollout 增量写入 continuity，不主动清掉已有污染状态 |
 | `cam session refresh` | replace / clean regeneration；从选定 provenance 重新生成 continuity 并覆盖所选 scope |
-| `cam session load` / `status` | continuity reviewer surface；显示 latest audit drill-down、compact prior preview，以及 pending continuity recovery marker |
+| `cam session load` / `status` | continuity reviewer surface；显示 latest continuity diagnostics（含 `confidence` / warnings）、latest audit drill-down、compact prior preview，以及 pending continuity recovery marker |
 | `cam session clear` / `open` | 清理当前 active continuity，或打开 local continuity 目录 |
 | `cam audit` | 做仓库级隐私 / secret hygiene 审查 |
 | `cam doctor` | 检查当前 companion wiring 与 native readiness posture |
 
 ## 审计面地图
 
 - `cam audit`: 仓库级的 privacy / secret hygiene 审计。
-- `cam memory --recent [count]`: durable sync audit，查看 recent `applied` / `no-op` / `skipped` sync 事件，不混入 manual `remember` / `forget`。
+- `cam memory --recent [count]`: durable sync audit，查看 recent `applied` / `no-op` / `skipped` sync 事件，不混入 manual `remember` / `forget`；当本轮提取结果因冲突而被保守 suppress 时，也会在 reviewer surface 中显式暴露。
 - `cam session save`: continuity audit surface 的 merge 路径，记录最新 continuity diagnostics、latest rollout 与 latest audit drill-down；它是 incremental save，不会立刻把已有污染状态“洗干净”。
 - `cam session refresh`: continuity audit surface 的 replace 路径，从选定 provenance 重新生成 continuity，并覆盖所选 scope；`--json` 会额外暴露 `action`、`writeMode` 与 `rolloutSelection`。
-- `cam session load|status`: reviewer surface，继续展示 latest continuity diagnostics、latest rollout、latest audit drill-down，以及 compact prior audit preview（来自 continuity audit log，排除 latest，并收敛连续重复项，不是完整 prior history 回放）；两个命令的 `--json` 继续返回 raw recent audit entries。
+- `cam session load|status`: reviewer surface，继续展示 latest continuity diagnostics、latest rollout、latest audit drill-down，以及 compact prior audit preview（来自 continuity audit log，排除 latest，并收敛连续重复项，不是完整 prior history 回放）；最新 diagnostics 现在也会显式带出 `confidence` 与 warnings，帮助 reviewer 区分稳定事实、临时状态与需二次核实的冲突/噪音。
+- continuity reviewer warnings 仍属于 audit / reviewer surface，而不是 continuity body；当前实现会对明显的 reviewer warning prose 做最小 deterministic scrub，避免它们被模型原样写回 continuity Markdown。
 - `pending continuity recovery marker`: continuity Markdown 已写入但 audit sidecar 失败时的可见警告；它不等于 `cam session refresh` 会自动修复一切，只会在逻辑身份匹配的后续成功写入后被清理。
 
 ## 工作方式
@@ -205,10 +207,12 @@ flowchart TD
     B --> C[注入 quoted MEMORY.md startup files 与按需 topic refs]
     C --> D[运行 Codex]
     D --> E[读取 rollout JSONL]
-    E --> F[提取 durable memory 操作]
+    E --> F[提取 candidate durable memory 操作]
     E --> G[可选 continuity 总结]
-    F --> H[更新 MEMORY.md 与 topic files]
-    G --> I[更新 shared / local continuity]
+    F --> H[contradiction review / conservative suppression]
+    H --> I[更新 MEMORY.md 与 topic files]
+    I --> J[追加 durable sync audit]
+    G --> K[更新 shared / local continuity]
 ```
 
 ### 为什么不是直接上 native memory
@@ -286,7 +290,7 @@ Session continuity：
 
 - 更稳的 contradiction handling
 - 更清晰的 `cam memory` / `cam session` 审查 UX
-- continuity diagnostics 与 reviewer packet 继续收紧信息层次
+- continuity diagnostics 与 reviewer packet 继续收紧信息层次，并显式暴露 confidence / warnings
 - 继续保留对未来 hook surface 的 compatibility seam
 
 ### v0.3+

diff --git a/docs/architecture.en.md b/docs/architecture.en.md
@@ -31,10 +31,12 @@ flowchart TD
     B --> C[Inject quoted MEMORY.md startup files plus on-demand topic refs]
     C --> D[Run Codex]
     D --> E[Read rollout JSONL after session]
-    E --> F[Extract durable memory operations]
+    E --> F[Extract durable memory candidates]
     E --> G[Optional continuity summary]
-    F --> H[Update MEMORY.md and topic files]
-    G --> I[Update shared and local continuity files]
+    F --> H[Run contradiction review and conservative suppression]
+    H --> I[Update MEMORY.md and topic files]
+    I --> J[Append durable sync audit]
+    G --> K[Update shared and local continuity files]
 ```
 
 ## 1. Startup path
@@ -63,15 +65,18 @@ The sync path turns session evidence into durable Markdown memory:
 
 1. read the relevant rollout JSONL
 2. parse user messages, tool calls, and tool outputs
-3. let the extractor produce memory operations
-4. apply upserts and deletes to the Markdown store
-5. rebuild `MEMORY.md` for the affected scope
+3. let the extractor produce candidate memory operations
+4. run contradiction review so conflicting candidates can be conservatively suppressed while explicit corrections still win
+5. apply the reviewed upserts and deletes to the Markdown store
+6. rebuild `MEMORY.md` for the affected scope
+7. append durable sync audit entries that keep suppressed conflict candidates reviewer-visible
 
 The extractor is expected to:
 
 - keep stable, future-useful knowledge
 - avoid transcript replay
 - handle explicit corrections conservatively
+- prefer provable corrections over silent conflict merges
 - keep temporary next-step noise out of durable memory
 
 ## 3. Optional session continuity path
@@ -80,6 +85,8 @@ Session continuity is a separate companion layer, not part of the durable memory
 
 - shared continuity: project-wide working state shared across worktrees
 - project-local continuity: worktree-specific working state
+- reviewer warnings and confidence remain audit-side metadata, not continuity-body content
+- startup provenance only lists continuity files that were actually read for the injected block
 
 Its purpose is session recovery, not long-term memory.
 

diff --git a/docs/architecture.md b/docs/architecture.md
@@ -31,10 +31,12 @@ flowchart TD
     B --> C[注入 quoted MEMORY.md startup files 与按需 topic refs]
     C --> D[运行 Codex]
     D --> E[会话结束后读取 rollout JSONL]
-    E --> F[提取 durable memory operations]
+    E --> F[提取 durable memory candidates]
     E --> G[可选 continuity summary]
-    F --> H[更新 MEMORY.md 与 topic files]
-    G --> I[更新 shared / local continuity files]
+    F --> H[contradiction review 与保守 suppress]
+    H --> I[更新 MEMORY.md 与 topic files]
+    I --> J[写入 durable sync audit]
+    G --> K[更新 shared / local continuity files]
 ```
 
 ## 1. Startup path
@@ -63,15 +65,18 @@ sync path 的职责是把“值得长期保存的信息”写回 durable memory
 
 1. 读取相关 rollout JSONL
 2. 解析 user messages、tool calls、tool outputs
-3. 由 extractor 生成 memory operations
-4. 将 upsert / delete 应用到 Markdown store
-5. 重建对应 scope 的 `MEMORY.md`
+3. 由 extractor 生成 candidate memory operations
+4. 经过 contradiction review，对冲突 candidate 做保守 suppress，并优先保留明确更正
+5. 将审查后的 upsert / delete 应用到 Markdown store
+6. 重建对应 scope 的 `MEMORY.md`
+7. 追加 durable sync audit，显式暴露 suppressed conflict candidates 供 reviewer 审查
 
 当前 extractor 的设计目标是：
 
 - 保存稳定、未来有用的信息
 - 避免保存原始会话回放
 - 对显式 correction 做保守替换
+- 冲突场景下优先保留可证明的更正，而不是静默 merge
 - 避免把临时 next step / local edit noise 写进 durable memory
 
 ## 3. Optional session continuity path
@@ -80,6 +85,8 @@ session continuity 是独立 companion layer，不属于 durable memory 契约
 
 - shared continuity：跨 worktree 共享的项目级 working state
 - project-local continuity：当前 worktree 的本地 working state
+- reviewer warning / confidence 属于 audit side metadata，不属于 continuity body
+- startup provenance 只列出这次注入时真实读取到的 continuity 文件
 
 它的存在是为了帮助会话恢复，而不是替代 memory。