fix: harden reviewer workflow and memory handling

harness/.pi/skills/tht-sessione/SKILL.md

@@ -225,11 +225,15 @@ Prerequisite: Phase 1 closed.
 2. The hit comes with full metadata (subject/detail/rationale): read what it says,
    where it comes from, why it might apply here, the out-of-context risk.
 3. Present candidates in **a single** `reviewer_decide(multi:true, advance:true,
-   allow_empty:true)`. Rules: at most **5** candidates; ONLY the 3 reusable types
-   (`concept_clarified`, `table_promoted`, `table_excluded`) — query-specific
-   decisions (`question_rewritten`, `sql_approved`, …) are NOT transferable, never
-   propose them. Each option carries `type`/`subject`/`rationale`; cite the source
-   memory id (`mem-<id>`) in its rationale when applying it. Every option describes a
+   allow_empty:true)`. Rules: at most **5** candidates; ONLY
+   `concept_clarified`. Table choices (`table_promoted`, `table_excluded`) and all
+   other query-specific decisions (`question_rewritten`, `sql_approved`, …) are NOT
+   transferable and must never be stored, retrieved, or proposed as memories. Each
+   option carries `type`/`subject`/`rationale`; cite the source
+   memory id (`mem-<id>`) in its rationale when applying it. Copy the hit's full
+   `content` verbatim into the option `description`: the reviewer must see the exact
+   memory text before deciding. Deduplicate hits by memory id before calling the gate.
+   Every option describes a
    candidate memory; never create an opposite "do not use" option. Only
    `recommended:true` options start checked. A
    deselected candidate is **not applied now**, not rejected, and may be considered
@@ -411,8 +415,15 @@ Prerequisite: Phase 6 closed.
 
 Prerequisite: Phase 7 closed.
 
-1. Ask the reviewer whether they want a datamart (`reviewer_select` yes/no).
-2. If yes: `tht datamart generate` (stub — raises NotImplementedError for now). Tell
+1. Call `reviewer_datamart` with the session id. This gate is deployment-aware and is
+   the ONLY allowed way to record the datamart choice:
+   - `THT_PROFILE=workstation`: it records `datamart_declined` automatically and shows
+     no question to the reviewer;
+   - `THT_PROFILE=server` (including the default): it always shows both choices,
+     "Sì, genera il datamart" and "No, salta il datamart", and records the selected one.
+   Never replace this gate with a hand-built `reviewer_select`.
+2. On a server, if the reviewer chose yes: `tht datamart generate` (stub — raises
+   NotImplementedError for now). Tell
    the reviewer that dbt generation is not implemented yet.
 3. **Memory promotion closes the session.** Call `reviewer_memory_promote` with ONLY
    the session id: the gate computes the candidates itself (`tht memory promote