fix: harden reviewer workflow and memory handling

harness/.pi/skills/tht-sessione/SKILL.md

@@ -225,11 +225,15 @@ Prerequisite: Phase 1 closed.
 2. The hit comes with full metadata (subject/detail/rationale): read what it says,
    where it comes from, why it might apply here, the out-of-context risk.
 3. Present candidates in **a single** `reviewer_decide(multi:true, advance:true,
-   allow_empty:true)`. Rules: at most **5** candidates; ONLY the 3 reusable types
-   (`concept_clarified`, `table_promoted`, `table_excluded`) — query-specific
-   decisions (`question_rewritten`, `sql_approved`, …) are NOT transferable, never
-   propose them. Each option carries `type`/`subject`/`rationale`; cite the source
-   memory id (`mem-<id>`) in its rationale when applying it. Every option describes a
+   allow_empty:true)`. Rules: at most **5** candidates; ONLY
+   `concept_clarified`. Table choices (`table_promoted`, `table_excluded`) and all
+   other query-specific decisions (`question_rewritten`, `sql_approved`, …) are NOT
+   transferable and must never be stored, retrieved, or proposed as memories. Each
+   option carries `type`/`subject`/`rationale`; cite the source
+   memory id (`mem-<id>`) in its rationale when applying it. Copy the hit's full
+   `content` verbatim into the option `description`: the reviewer must see the exact
+   memory text before deciding. Deduplicate hits by memory id before calling the gate.
+   Every option describes a
    candidate memory; never create an opposite "do not use" option. Only
    `recommended:true` options start checked. A
    deselected candidate is **not applied now**, not rejected, and may be considered
@@ -411,8 +415,15 @@ Prerequisite: Phase 6 closed.
 
 Prerequisite: Phase 7 closed.
 
-1. Ask the reviewer whether they want a datamart (`reviewer_select` yes/no).
-2. If yes: `tht datamart generate` (stub — raises NotImplementedError for now). Tell
+1. Call `reviewer_datamart` with the session id. This gate is deployment-aware and is
+   the ONLY allowed way to record the datamart choice:
+   - `THT_PROFILE=workstation`: it records `datamart_declined` automatically and shows
+     no question to the reviewer;
+   - `THT_PROFILE=server` (including the default): it always shows both choices,
+     "Sì, genera il datamart" and "No, salta il datamart", and records the selected one.
+   Never replace this gate with a hand-built `reviewer_select`.
+2. On a server, if the reviewer chose yes: `tht datamart generate` (stub — raises
+   NotImplementedError for now). Tell
    the reviewer that dbt generation is not implemented yet.
 3. **Memory promotion closes the session.** Call `reviewer_memory_promote` with ONLY
    the session id: the gate computes the candidates itself (`tht memory promote

harness/.pi/skills/tht-sessione/memoria.md

@@ -9,8 +9,7 @@ already discarded (even after a Phase 2 reopen).
 For each memory to present in the checklist, include in the option's `label` and/or
 `description`:
 
-- **What it says**: type + subject + detail (e.g. "table_promoted:
-  fact_seeablazione — main table for ablazioni").
+- **What it says**: the clarified concept, its subject, and its full definition.
 - **Where it comes from**: question_context and origin session_id.
 - **Why it might apply here**: overlap of concepts/tables with the current question
   (fields tables/concepts), similarity score.
@@ -19,10 +18,10 @@ For each memory to present in the checklist, include in the option's `label` and
 
 Rules:
 
-- Propose at most **5** candidates. Include ONLY memories of the 3 reusable types:
-  `concept_clarified`, `table_promoted`, `table_excluded`. Query-specific decisions
-  (e.g. `question_rewritten`, `sql_approved`) are NOT to be proposed: they don't
-  transfer to other questions.
+- Propose at most **5** candidates. Include ONLY `concept_clarified` memories.
+  Table choices (`table_promoted`, `table_excluded`) and all other query-specific
+  decisions are not memories: never store, retrieve, or propose them because they
+  do not transfer to other questions.
 - All candidate memories go in **a single** `reviewer_decide(multi:true,
   advance:true, allow_empty:true)`: every option describes a candidate memory, never
   an opposite action such as "do not use it". Each selected option is applied