feat: implement memory and evidence administration with guided repairs

Add PostgreSQL-backed memory, editable evidence with source review and activation, and human-approved archive repairs across the harness, API, and UI. Include migrations, deployment support, regression coverage, and validation documentation.

Refresh permissions from validated session roles so existing administrator logins can access newly deployed archive management features.

harness/.pi/extensions/gate/__tests__/archive_repair.test.js

@@ -0,0 +1,61 @@
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const { installRepairGate } = require("../memory/repair.js");
+
+function gate({ answers, fail = false, resume = false }) {
+    let tool;
+    const calls = [], widgets = [];
+    const repair = { repair_id: "receipt", choice: null, status: "proposed", can_apply: true,
+        saved: false, indexed: false, options: [{ id: "fix", content: { detail: "Correction" } }] };
+    installRepairGate({ registerTool: def => { tool = def; } }, {
+        workflow: { activate() {}, phase: () => ({ id: "F4" }) },
+        memory: { execute: (_ctx, args) => {
+            calls.push(args);
+            if (args[0] === "repair-apply") {
+                const choice = args[args.indexOf("--choice") + 1];
+                if (choice === "reject") Object.assign(repair, { choice, status: "rejected" });
+                else Object.assign(repair, { choice, saved: true, indexed: !fail,
+                    status: fail ? "pending_activation" : "active" });
+                fail = false;
+            }
+            return JSON.stringify(repair);
+        } },
+        waitForReviewer: async (_ctx, descriptor) => {
+            widgets.push(descriptor);
+            assert.ok(answers.length, "gate must not ask an unbounded extra question");
+            return answers.shift();
+        },
+        toTextResult: text => text,
+    });
+    return { calls, widgets, run: () => tool.execute("id", {
+        session: "s", ...(resume ? { repair_id: "receipt" } : { proposal: { reason: "conflict", options: [] } }),
+    }, null, null, {}) };
+}
+
+test("human choice applies once and the next widget reports activation", async () => {
+    const g = gate({ answers: [{ choices: ["fix"] }, { choices: ["continue"] }] });
+    assert.equal(JSON.parse(await g.run()).indexed, true);
+    assert.deepEqual(g.calls.map(args => args[0]), ["repair-prepare", "repair-apply"]);
+    assert.equal(g.widgets[0].repair.saved, false);
+    assert.equal(g.widgets[1].repair.status, "active");
+});
+test("rejection asks for reformulation without a normal workflow decision", async () => {
+    const g = gate({ answers: [{ choices: ["reject"] }] });
+    assert.match(await g.run(), /rejected as inadequate/);
+    assert.equal(g.calls.length, 2);
+});
+test("retry keeps the receipt and selected choice, then reports true activation", async () => {
+    const g = gate({ resume: true, fail: true,
+        answers: [{ choices: ["fix"] }, { choices: ["fix"] }, { choices: ["continue"] }] });
+    assert.equal(JSON.parse(await g.run()).indexed, true);
+    assert.equal(g.widgets[1].repair.status, "pending_activation");
+    assert.equal(g.calls[0][0], "repair-show");
+    assert.deepEqual(g.calls[1], g.calls[2]);
+});
+test("free text and forged choices never apply a correction", async () => {
+    for (const response of [{ control: "freetext", text: "Explain the conflict" }, { choices: ["forged"] }]) {
+        const g = gate({ answers: [response] });
+        await g.run();
+        assert.equal(g.calls.length, 1);
+    }
+});

harness/.pi/extensions/gate/__tests__/gate_memory_promote.test.js

@@ -1,163 +1,44 @@
 const test = require("node:test");
-const assert = require("node:assert");
+const assert = require("node:assert/strict");
 const { createMemoryGate } = require("../memory/index.js");
-const { buildMultiselectRequest } = require("../core/builders.js");
-const { isReserved } = require("../core/reserved-labels.mjs");
 const { createFakePi } = require("./fake_pi_runtime.js");
 
-
-const TABLE_CANDIDATE = {
-  decision_seq: 3,
-  type: "table_promoted",
-  subject: "fact_seeablazione",
-  detail: "tabella principale ablazioni",
-  rationale: "scelta dal reviewer",
-  question_context: "quante ablazioni nel 2023",
-  tables: ["fact_seeablazione"],
-  concepts: [],
-};
-
-const MEMORY_CANDIDATE = {
-  decision_seq: 5,
-  type: "concept_clarified",
-  subject: "paziente attivo",
-  detail: "flag_attivo = TRUE",
-  rationale: "scelta dal reviewer",
-  question_context: "quante ablazioni nel 2023",
-  tables: [],
-  concepts: ["paziente attivo"],
-};
-
-
-test("the public Memory facade owns F8 policy and mutation ordering", async () => {
-  const { pi, tools, ctx } = createFakePi();
+function setup({ phase = 8, response, failure = null } = {}) {
+  const runtime = createFakePi();
   const calls = [];
-  let descriptor;
-  const duplicateMemory = { ...MEMORY_CANDIDATE, decision_seq: 6 };
-  const declinedMemory = {
-    ...MEMORY_CANDIDATE,
-    decision_seq: 7,
-    subject: "ricovero indice",
-    detail: "first_event",
-  };
-  ctx.ui.input = async (title) => {
-    descriptor = JSON.parse(title);
-    calls.push(["review", descriptor.options.map((option) => option.id)]);
-    return JSON.stringify({ id: descriptor.id, choices: ["seq-5"] });
-  };
-
-  const memoryGate = createMemoryGate({
-    workflow: {
-      activate: () => calls.push(["activate"]),
-      phase: () => ({ number: 8, id: "F8" }),
-      close: (_ctx, _session, phaseNumber, summary) => {
-        calls.push(["close", phaseNumber, summary]);
-        return null;
-      },
-    },
-    memory: {
-      execute: (_ctx, args) => {
-        calls.push(["memory-execute", args]);
-        return JSON.stringify([
-          TABLE_CANDIDATE,
-          MEMORY_CANDIDATE,
-          duplicateMemory,
-          declinedMemory,
-        ]);
-      },
-      mutate: (_ctx, args, recovery) => {
-        calls.push(["memory-mutate", args, recovery]);
-        return null;
-      },
-    },
-    ledger: {
-      record: (_ctx, session, decision, recovery) => {
-        calls.push(["ledger", session, decision, recovery]);
-        return null;
-      },
-    },
-    reviewer: {
-      buildMultiselect: buildMultiselectRequest,
-      isReserved,
-    },
-    waitForReviewer: async (runtimeContext, widget) => {
-      const response = await runtimeContext.ui.input(JSON.stringify(widget), "");
-      return JSON.parse(response);
-    },
-    toTextResult: (text) => ({ content: [{ type: "text", text }] }),
+  const summary = { summary_id: "summary", items: [{ id: "rule", card: { subject: "Rule" } }] };
+  createMemoryGate({
+    workflow: { activate() {}, phase: () => ({ number: phase, id: "F" + phase }),
+      close: () => { calls.push("close"); return "closed"; } },
+    memory: { execute: () => JSON.stringify(summary),
+      mutate: async (_ctx, args) => { calls.push(["save", args]); return failure; } },
+    ledger: { record: (_ctx, _session, decision) => { calls.push(["ledger", decision]); } },
+    waitForReviewer: async (_ctx, widget) => { calls.push(["widget", widget]); return response; },
+    toTextResult: text => ({ content: [{ type: "text", text }] }),
+  }).install(runtime.pi);
+  return { calls, run: () => runtime.tools.get("reviewer_memory_promote").def.execute(
+    "id", { session: "s1" }, null, null, runtime.ctx) };
+}
+for (const control of ["back", "exit", "freetext"]) {
+  test("review control " + control + " never saves or closes", async () => {
+    const { calls, run } = setup({ response: { control, text: "Revise scope" } });
+    await run();
+    assert.deepEqual(calls.map(call => call[0]), ["widget"]);
   });
-  memoryGate.install(pi);
-
-  const result = await tools.get("reviewer_memory_promote").def.execute(
-    "promote-via-facade",
-    { session: "s1" },
-    null,
-    null,
-    ctx,
-  );
-
-  assert.deepEqual(descriptor.options, [
-    {
-      id: "seq-5",
-      label: "concept_clarified: paziente attivo",
-      detail: "flag_attivo = TRUE",
-      rationale: "scelta dal reviewer",
-      meta: { question_context: "quante ablazioni nel 2023" },
-      selected: true,
-    },
-    {
-      id: "seq-7",
-      label: "concept_clarified: ricovero indice",
-      detail: "first_event",
-      rationale: "scelta dal reviewer",
-      meta: { question_context: "quante ablazioni nel 2023" },
-      selected: true,
-    },
-  ]);
-  assert.deepEqual(descriptor.selected, ["seq-5", "seq-7"]);
-  assert.doesNotMatch(descriptor.content, /fact_seeablazione/);
-  assert.match(descriptor.content, /flag_attivo = TRUE/);
-  assert.deepEqual(calls.slice(0, 7), [
-    ["activate"],
-    [
-      "memory-execute",
-      ["promote", "--session", "s1", "--preview", "--json"],
-    ],
-    ["review", ["seq-5", "seq-7"]],
-    [
-      "memory-mutate",
-      ["save-one", "--session", "s1", "--decision", "5", "--json"],
-      "Recupero manuale (umano): tht memory save-one --session s1 " +
-        "--decision 5. Finora salvate: 0.",
-    ],
-    [
-      "ledger",
-      "s1",
-      {
-        type: "memory_promoted",
-        subject: "paziente attivo",
-        detail: "seq:5",
-        rationale: "scelta dal reviewer",
-      },
-      "Memoria salvata nel vectordb ma decisione memory_promoted NON registrata: " +
-        "recupero manuale (umano) con tht decision add --session s1 " +
-        "--type memory_promoted --subject \"paziente attivo\" --detail seq:5.",
-    ],
-    [
-      "ledger",
-      "s1",
-      {
-        type: "memory_promotion_declined",
-        subject: "ricovero indice",
-        detail: "seq:7",
-      },
-      "",
-    ],
-    [
-      "close",
-      8,
-      "Promozione registrata: 1 memorie salvate nel vectordb, 1 candidati scartati.",
-    ],
-  ]);
-  assert.match(result.content[0].text, /1 memorie salvate.*1 candidati scartati/);
+}
+test("a mismatched review identity cannot mutate Memory", async () => {
+  const { calls, run } = setup({ response: { text: JSON.stringify({ summary_id: "old", items: [] }) } });
+  assert.match((await run()).content[0].text, /Invalid/);
+  assert.equal(calls.length, 1);
+});
+test("review is only presented at F8", async () => {
+  const { calls, run } = setup({ phase: 7 });
+  assert.match((await run()).content[0].text, /end of F8/);
+  assert.equal(calls.length, 0);
+});
+test("a persistence failure prevents the review marker and closing", async () => {
+  const { calls, run } = setup({ failure: "database unavailable",
+    response: { text: JSON.stringify({ summary_id: "summary", items: [] }) } });
+  assert.equal(await run(), "database unavailable");
+  assert.deepEqual(calls.map(call => call[0]), ["widget", "save"]);
 });

harness/.pi/extensions/gate/__tests__/gate_memory_selection.test.js

@@ -117,6 +117,18 @@ test("the Memory facade normalizes search hits and applies only the selected F2
   assert.match(result.content[0].text, /1 decisioni.*La fase resta aperta/s);
 });
 
+test("authoritative UUID card identities survive normalization into the reviewer widget", async () => {
+  const { ctx, memoryGate, descriptor } = setupRecall(["first"]);
+  const id = "mem-11111111-1111-4111-8111-111111111111";
+  await memoryGate.reviewRecall(ctx, {
+    session: "s1", title: "Memory", allow_empty: true, advance: false,
+    options: [{ ...MEMORY_OPTIONS[0], decision: {
+      ...MEMORY_OPTIONS[0].decision, rationale: `Riusa ${id}`,
+    } }],
+  }, "F2");
+  assert.equal(descriptor().options[0].meta.memory_id, id);
+});
+
 
 test("the Memory facade accepts a deselected F2 result without a rejection", async () => {
   const { ctx, calls, memoryGate } = setupRecall([]);

harness/.pi/extensions/gate/__tests__/gate_promote_autoclose.test.js

@@ -25,7 +25,7 @@ echo "$@" >> "${log}"
 case "$1 $2" in
   "phase show") echo "Fase corrente: ${phase}";;
   "phase meta") echo '{"max_phase":8,"phases":[{"num":2,"id":"F2","emits":[]},{"num":8,"id":"F8","emits":[]}]}';;
-  "memory promote") echo "[]";;
+  "memory summary") echo '{"summary_id":"saved-review","reviewed":true}';;
   "session show") echo '{"status":"${status}"}';;
   *) echo "OK";;
 esac
@@ -52,7 +52,7 @@ async function runPromote(t, { phase }) {
   return { res, calls: fake.calls() };
 }
 
-test("F8 + zero candidati: il gate avanza la fase e finalizza da solo", async (t) => {
+test("F8 recupera un riepilogo già salvato e finalizza da solo", async (t) => {
   const { res, calls } = await runPromote(t, { phase: 8 });
   const text = res.content[0].text;
   assert.match(text, /sessione finalizzata \(s1\)/);
@@ -63,7 +63,7 @@ test("F8 + zero candidati: il gate avanza la fase e finalizza da solo", async (t
 
 test("fuori dall'ultima fase non chiude nulla (comportamento precedente)", async (t) => {
   const { res, calls } = await runPromote(t, { phase: 2 });
-  assert.match(res.content[0].text, /prosegui con la chiusura della sessione/);
+  assert.match(res.content[0].text, /end of F8/);
   assert.doesNotMatch(calls, /phase advance/);
   assert.doesNotMatch(calls, /session finalize/);
 });

harness/.pi/extensions/gate/__tests__/gate_workflow_observable_contract.test.js

@@ -33,12 +33,12 @@ const PHASE_META = JSON.stringify({
       num: 8,
       id: "F8",
       name: "datamart",
-      emits: ["datamart_declined", "memory_promoted", "memory_promotion_declined"],
+      emits: ["datamart_declined", "memory_summary_reviewed"],
     },
   ],
 });
 
-function useShell({ phase, preview = [], fail = () => null }) {
+function useShell({ phase, preview = [], fail = () => null, indexed = true, reviewed = false }) {
   const calls = [];
   shell.current = (_file, args, options = {}) => {
     calls.push({ args: [...args], input: options.input });
@@ -51,7 +51,8 @@ function useShell({ phase, preview = [], fail = () => null }) {
     }
     if (sameArgs(args, ["phase", "meta", "--json"])) return PHASE_META;
     if (startsWithArgs(args, ["phase", "show", "--session"])) return `Fase corrente: ${phase}\n`;
-    if (startsWithArgs(args, ["memory", "promote", "--session"])) return JSON.stringify(preview);
+    if (startsWithArgs(args, ["memory", "summary", "--session"])) return JSON.stringify({ summary_id: "summary-1", items: preview, reviewed });
+    if (startsWithArgs(args, ["memory", "review-apply"])) return JSON.stringify({ indexed, saved: true });
     return "";
   };
   return calls;
@@ -73,7 +74,7 @@ function mutationArgs(calls, prefixes) {
 
 function memoryPromotionMutationArgs(calls) {
   return mutationArgs(calls, [
-    ["memory", "save-one"],
+    ["memory", "review-apply"],
     ["decision", "add"],
     ["phase", "advance"],
     ["session", "finalize"],
@@ -511,144 +512,55 @@ test("F4 persists exactly the reviewer-selected Evidence disposition", async ()
 });
 
 const PROMOTION_CANDIDATE = {
-  decision_seq: 5,
-  type: "concept_clarified",
-  subject: "paziente attivo",
-  detail: "flag_attivo = TRUE",
-  rationale: "scelta dal reviewer",
-  question_context: "quanti pazienti attivi",
-  tables: [],
-  concepts: ["paziente attivo"],
+  id: "decision-5", card: { family: "domain_clarification", subject: "paziente attivo", detail: "flag_attivo = TRUE" },
 };
-
-test("F8 saves an accepted Memory before its ledger marker and finalizes", async () => {
-  const { ctx, tools, calls } = await setupGate({ phase: 8, preview: [PROMOTION_CANDIDATE] });
-  let descriptor;
-  answerNextWidget(ctx, ["seq-5"], (value) => { descriptor = value; });
-
-  const result = await tools.get("reviewer_memory_promote").def.execute(
-    "promote-accepted",
-    { session: "s1" },
-    null,
-    null,
-    ctx,
-  );
-
-  assert.equal(descriptor.phase, "F8");
-  assert.equal(descriptor.widget, "multiselect");
-  assert.deepEqual(descriptor.selected, ["seq-5"]);
-  assert.match(descriptor.content, /flag_attivo = TRUE/);
-  const mutations = memoryPromotionMutationArgs(calls);
-  assert.deepEqual(mutations, [
-    ["memory", "save-one", "--session", "s1", "--decision", "5", "--json"],
-    [
-      "decision", "add", "--session", "s1", "--type", "memory_promoted",
-      "--subject", "paziente attivo", "--detail", "seq:5",
-      "--rationale", "scelta dal reviewer",
-    ],
-    ["phase", "advance", "--session", "s1"],
-    ["session", "finalize", "s1"],
-  ]);
-  assert.match(result.content[0].text, /1 memorie salvate.*sessione finalizzata/s);
-});
-
-test("F8 records a declined candidate without saving it and finalizes", async () => {
-  const { ctx, tools, calls } = await setupGate({ phase: 8, preview: [PROMOTION_CANDIDATE] });
-  answerNextWidget(ctx, []);
-
-  const result = await tools.get("reviewer_memory_promote").def.execute(
-    "promote-declined",
-    { session: "s1" },
-    null,
-    null,
-    ctx,
-  );
-
-  const mutations = memoryPromotionMutationArgs(calls);
-  assert.deepEqual(mutations, [
-    [
-      "decision", "add", "--session", "s1", "--type", "memory_promotion_declined",
-      "--subject", "paziente attivo", "--detail", "seq:5",
-    ],
-    ["phase", "advance", "--session", "s1"],
-    ["session", "finalize", "s1"],
-  ]);
-  assert.match(result.content[0].text, /1 candidati scartati.*sessione finalizzata/s);
-});
-
-test("F8 with no promotion candidates finalizes without showing a widget", async () => {
-  const { ctx, tools, calls } = await setupGate({ phase: 8, preview: [] });
-  ctx.ui.input = async () => { throw new Error("a promotion widget must not be shown"); };
-
-  const result = await tools.get("reviewer_memory_promote").def.execute(
-    "promote-absent",
-    { session: "s1" },
-    null,
-    null,
-    ctx,
-  );
-
-  assert.equal(calls.some(({ args }) => startsWithArgs(args, ["memory", "save-one"])), false);
-  assert.equal(calls.some(({ args }) => startsWithArgs(args, ["decision", "add"])), false);
-  assert.deepEqual(
-    mutationArgs(calls, [["phase", "advance"], ["session", "finalize"]]),
-    [["phase", "advance", "--session", "s1"], ["session", "finalize", "s1"]],
-  );
-  assert.equal(ctx.notifications.length, 1);
-  assert.match(result.content[0].text, /Nessun candidato.*sessione finalizzata/s);
-});
-
-test("F8 does not write the ledger or finalize when the vector save fails", async () => {
-  const { ctx, tools, calls } = await setupGate({
-    phase: 8,
-    preview: [PROMOTION_CANDIDATE],
-    fail: (args) => startsWithArgs(args, ["memory", "save-one"])
-      ? { status: 1, stderr: "vector save failed" }
-      : null,
+function answerReview(ctx, items) {
+  ctx.ui.input = async title => {
+    const descriptor = JSON.parse(title);
+    assert.equal(descriptor.widget, "memory-review");
+    return JSON.stringify({ id: descriptor.id, text: JSON.stringify({
+      summary_id: descriptor.summary.summary_id, items,
+    }) });
+  };
+}
+for (const selected of [true, false]) {
+  test(`F8 persists the edited review (selected=${selected}) before its marker and finalization`, async () => {
+    const { ctx, tools, calls } = await setupGate({ phase: 8, preview: [PROMOTION_CANDIDATE] });
+    const items = selected ? [{ ...PROMOTION_CANDIDATE, card: { ...PROMOTION_CANDIDATE.card, detail: "Reviewer correction" } }] : [];
+    answerReview(ctx, items);
+    const result = await tools.get("reviewer_memory_promote").def.execute("review", { session: "s1" }, null, null, ctx);
+    const mutations = memoryPromotionMutationArgs(calls);
+    assert.deepEqual(mutations[0], ["memory", "review-apply", "--session", "s1", "--review-json",
+      JSON.stringify({ summary_id: "summary-1", items }), "--json"]);
+    assert(mutations[1].includes("memory_summary_reviewed"));
+    assert.deepEqual(mutations.slice(2), [["phase", "advance", "--session", "s1"], ["session", "finalize", "s1"]]);
+    assert.match(result.content[0].text, /sessione finalizzata/s);
   });
-  answerNextWidget(ctx, ["seq-5"]);
-
-  const result = await tools.get("reviewer_memory_promote").def.execute(
-    "promote-save-failure",
-    { session: "s1" },
-    null,
-    null,
-    ctx,
-  );
-
-  const mutations = memoryPromotionMutationArgs(calls);
-  assert.deepEqual(mutations, [
-    ["memory", "save-one", "--session", "s1", "--decision", "5", "--json"],
-  ]);
-  assert.match(result.content[0].text, /vector save failed.*Recupero manuale/s);
+}
+test("F8 warns about pending indexing but preserves the saved review and finalizes", async () => {
+  const { ctx, tools, calls } = await setupGate({ phase: 8, preview: [PROMOTION_CANDIDATE], indexed: false });
+  answerReview(ctx, [PROMOTION_CANDIDATE]);
+  await tools.get("reviewer_memory_promote").def.execute("pending", { session: "s1" }, null, null, ctx);
+  assert(ctx.notifications.some(({ message, level }) => level === "warning" && message.includes("Memory saved")));
+  assert(memoryPromotionMutationArgs(calls).some(args => args.includes("memory_summary_reviewed")));
 });
-
-test("F8 reports manual recovery and does not finalize after save succeeds but ledger fails", async () => {
-  const { ctx, tools, calls } = await setupGate({
-    phase: 8,
-    preview: [PROMOTION_CANDIDATE],
-    fail: (args) => args.includes("--type") && args.includes("memory_promoted")
-      ? { status: 1, stderr: "promotion ledger failed" }
-      : null,
+test("F8 recovers a saved review without asking again or saving cards again", async () => {
+  const { ctx, tools, calls } = await setupGate({ phase: 8, reviewed: true });
+  ctx.ui.input = async () => { throw new Error("review must not be shown twice"); };
+  await tools.get("reviewer_memory_promote").def.execute("recover", { session: "s1" }, null, null, ctx);
+  const mutations = memoryPromotionMutationArgs(calls);
+  assert.equal(mutations.length, 3);
+  assert(mutations[0].includes("memory_summary_reviewed"));
+  assert.deepEqual(mutations.at(-1), ["session", "finalize", "s1"]);
+});
+for (const failingStep of ["review-apply", "memory_summary_reviewed"]) {
+  test(`F8 stops after failure at ${failingStep} without finalizing`, async () => {
+    const { ctx, tools, calls } = await setupGate({ phase: 8, preview: [PROMOTION_CANDIDATE],
+      fail: args => args.includes(failingStep) ? { status: 1, stderr: "persistence unavailable" } : null });
+    answerReview(ctx, [PROMOTION_CANDIDATE]);
+    const result = await tools.get("reviewer_memory_promote").def.execute("fail", { session: "s1" }, null, null, ctx);
+    const mutations = memoryPromotionMutationArgs(calls);
+    assert.equal(mutations.length, failingStep === "review-apply" ? 1 : 2);
+    assert.match(result.content[0].text, /persistence unavailable/s);
   });
-  answerNextWidget(ctx, ["seq-5"]);
-
-  const result = await tools.get("reviewer_memory_promote").def.execute(
-    "promote-ledger-failure",
-    { session: "s1" },
-    null,
-    null,
-    ctx,
-  );
-
-  const mutations = memoryPromotionMutationArgs(calls);
-  assert.deepEqual(mutations, [
-    ["memory", "save-one", "--session", "s1", "--decision", "5", "--json"],
-    [
-      "decision", "add", "--session", "s1", "--type", "memory_promoted",
-      "--subject", "paziente attivo", "--detail", "seq:5",
-      "--rationale", "scelta dal reviewer",
-    ],
-  ]);
-  assert.match(result.content[0].text, /vectordb.*NON registrata.*recupero manuale/is);
-});
+}

harness/.pi/extensions/gate/__tests__/golden/pi_tool_schemas.json

@@ -150,6 +150,36 @@
       "properties": { "session": { "type": "string" } }
     }
   },
+  {
+    "name": "reviewer_archive_repair",
+    "parameters": {
+      "type": "object",
+      "required": ["session"],
+      "properties": {
+        "session": { "type": "string" },
+        "repair_id": { "type": "string" },
+        "proposal": {
+          "type": "object", "required": ["reason", "options"],
+          "properties": {
+            "reason": { "type": "string" },
+            "options": {
+              "type": "array", "minItems": 1, "maxItems": 5,
+              "items": {
+                "type": "object",
+                "required": ["id", "label", "archive", "target_id", "revision", "content"],
+                "properties": {
+                  "id": { "type": "string" }, "label": { "type": "string" },
+                  "archive": { "anyOf": [{ "const": "memory", "type": "string" }, { "const": "evidence", "type": "string" }] },
+                  "target_id": { "type": "string" }, "revision": { "type": "string" },
+                  "content": { "type": "object", "patternProperties": { "^.*$": {} } }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  },
   {
     "name": "rewrite_question",
     "parameters": {

harness/.pi/extensions/gate/memory/index.js

@@ -1,4 +1,5 @@
 import { Type } from "typebox";
+import { installRepairGate } from "./repair.js";
 
 // Compatibility note: reviewer labels move verbatim from the composition root.
 // Tickets #22 and #23 require observable parity; translating existing chrome is a
@@ -9,7 +10,7 @@ function normalizedText(value) {
 }
 
 
-const MEMORY_ID_RE = /\bmem-\d{4,}\b/i;
+const MEMORY_ID_RE = /\bmem-(?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|\d{4,})\b/i;
 
 
 function memoryOptionKey(option) {
@@ -160,208 +161,69 @@ async function reviewRecall(ctx, params, phase, dependencies) {
 }
 
 
-// The candidates come from `tht memory promote --preview --json` (deterministic,
-// reviewer-approved decisions only); the model never authors them.
-function dedupePromotionCandidates(candidates) {
-	const seen = new Set();
-	return candidates.filter((candidate) => {
-		if (candidate.type !== "concept_clarified") return false;
-		const key = [
-			candidate.type,
-			candidate.subject,
-			candidate.detail,
-			candidate.rationale,
-			candidate.question_context,
-		].map(normalizedText).join("\u0000");
-		if (seen.has(key)) return false;
-		seen.add(key);
-		return true;
-	});
-}
-
-
-function promotionOptions(candidates) {
-	return candidates.map((candidate) => ({
-		id: `seq-${candidate.decision_seq}`,
-		label: `${candidate.type}: ${candidate.subject}`,
-		detail: candidate.detail || "",
-		rationale: candidate.rationale || "",
-		meta: { question_context: candidate.question_context || "" },
-	}));
-}
-
-
-function promotionContent(candidates) {
-	return candidates
-		.map(
-			(candidate) =>
-				`- **${candidate.type}: ${candidate.subject}** (decisione #${candidate.decision_seq})\n` +
-				`  ${candidate.detail || ""}\n` +
-				`  Motivo: ${candidate.rationale || "—"}\n` +
-				`  Domanda di contesto: ${candidate.question_context || "—"}`,
-		)
-		.join("\n");
-}
-
-
-function splitPromotionChoices(candidates, choices) {
-	const chosen = new Set(choices ?? []);
-	const promote = [];
-	const decline = [];
-	for (const candidate of candidates) {
-		(chosen.has(`seq-${candidate.decision_seq}`) ? promote : decline).push(candidate);
-	}
-	return { promote, decline };
-}
-
-
-/**
- * Install the public F8 Memory tool against the narrow capability supplied by the
- * workflow composition root. Memory owns candidate policy, presentation and mutation
- * order; the capability keeps shared phase, ledger and persistence mechanisms in core.
- */
-function installMemoryGate(
-	pi,
-	{ workflow, memory, ledger, reviewer, waitForReviewer, toTextResult },
-) {
-	pi.registerTool({
-		name: "reviewer_memory_promote",
-		label: "Promozione memorie riusabili (reviewer)",
-		description:
-			"F8 (prima della chiusura di fase): propone al reviewer i candidati di promozione " +
-			"calcolati dalla CLI (tht memory promote --preview: solo concept_clarified, " +
-			"max 5, esclusi i gia' promossi/rifiutati). Le selezioni " +
-			"vengono salvate nel vectordb (tht memory save-one) e registrate come memory_promoted; " +
-			"le deselezioni come memory_promotion_declined (non riproposte). Nessun parametro oltre " +
-			"alla sessione: i candidati sono deterministici, NON li scrivi tu. Registrata la " +
-			"promozione, in F8 il gate chiude la fase e finalizza la sessione da solo: NON " +
-			"presentare un reviewer_confirm dopo.",
-		parameters: Type.Object({
-			session: Type.String(),
-		}),
-		async execute(_id, params, _signal, _onUpdate, ctx) {
-			workflow.activate();
-			try {
-				const { session } = params;
-				const phase = workflow.phase(ctx, session);
-				let candidates;
-				try {
-					candidates = JSON.parse(memory.execute(
-						ctx,
-						["promote", "--session", session, "--preview", "--json"],
-					));
-				} catch (error) {
-					const message = (error.stderr || error.message || String(error)).toString().trim();
-					return toTextResult(`Preview di promozione non disponibile: ${message}`);
-				}
-				if (!Array.isArray(candidates) || candidates.length === 0) {
-					await ctx.ui.notify(
-						"Nessuna decisione riusabile da promuovere in memoria per questa sessione.",
-						"info",
-					);
-					const closed = workflow.close(
-						ctx, session, phase.number, "Nessun candidato di promozione.",
-					);
-					if (closed) return closed;
-					return toTextResult(
-						"Nessun candidato di promozione: prosegui con la chiusura della sessione.",
-					);
-				}
-				candidates = dedupePromotionCandidates(candidates);
-				if (candidates.length === 0) {
-					await ctx.ui.notify(
-						"Nessun concetto chiarito da salvare come memory per questa sessione.",
-						"info",
-					);
-					const closed = workflow.close(
-						ctx, session, phase.number, "Nessun candidato di promozione.",
-					);
-					if (closed) return closed;
-					return toTextResult(
-						"Nessun candidato di promozione: prosegui con la chiusura della sessione.",
-					);
-				}
-				const options = promotionOptions(candidates);
-				const widget = reviewer.buildMultiselect({
-					id: `u${Date.now()}`,
-					phase: phase.id,
-					title: "Quali concetti chiariti salvare nella memoria riutilizzabile?",
-					allowEmpty: true,
-					options,
-					selected: options.map((option) => option.id),
-					content: promotionContent(candidates),
-				});
-				const response = await waitForReviewer(ctx, widget);
-				if (response.control === "freetext") {
-					return toTextResult(
-						`Altro (reviewer): ${response.text}. Valuta e ripresenta il gate.`,
-					);
-				}
-				if (response.control === "back") {
-					return toTextResult("Il reviewer vuole tornare indietro.");
-				}
-				if (response.control === "exit") {
-					return toTextResult("Il reviewer vuole uscire.");
-				}
-				const { promote, decline } = splitPromotionChoices(candidates, response.choices);
-				let saved = 0;
-				for (const candidate of promote) {
-					const saveError = memory.mutate(
-						ctx,
-						[
-							"save-one", "--session", session,
-							"--decision", String(candidate.decision_seq), "--json",
-						],
-						`Recupero manuale (umano): tht memory save-one --session ${session} ` +
-							`--decision ${candidate.decision_seq}. Finora salvate: ${saved}.`,
-					);
-					if (saveError) return saveError;
-					const ledgerError = ledger.record(
-						ctx,
-						session,
-						{
-							type: "memory_promoted",
-							subject: candidate.subject,
-							detail: `seq:${candidate.decision_seq}`,
-							rationale: candidate.rationale || candidate.detail || "",
-						},
-						"Memoria salvata nel vectordb ma decisione memory_promoted NON registrata: " +
-							`recupero manuale (umano) con tht decision add --session ${session} ` +
-							`--type memory_promoted --subject "${candidate.subject}" ` +
-							`--detail seq:${candidate.decision_seq}.`,
-					);
-					if (ledgerError) return ledgerError;
-					saved++;
-				}
-				for (const candidate of decline) {
-					const ledgerError = ledger.record(ctx, session, {
-						type: "memory_promotion_declined",
-						subject: candidate.subject,
-						detail: `seq:${candidate.decision_seq}`,
-					}, "");
-					if (ledgerError) return ledgerError;
-				}
-				const summary =
-					`Promozione registrata: ${saved} memorie salvate nel vectordb, ` +
-					`${decline.length} candidati scartati.`;
-				const closed = workflow.close(ctx, session, phase.number, summary);
-				if (closed) return closed;
-				return toTextResult(summary);
-			} catch (fatal) {
-				const message = (fatal.stderr || fatal.message || String(fatal)).toString().trim();
-				return toTextResult(
-					`[reviewer_memory_promote ERRORE INTERNO] ${message}. ` +
-					"Riprova o usa un approccio diverso.",
-				);
-			}
-		},
-	});
+function installMemoryGate(pi, { workflow, memory, ledger, waitForReviewer, toTextResult }) {
+    pi.registerTool({
+        name: "reviewer_memory_promote",
+        label: "Review Memory summary",
+        description: "F8: show the editable Memory summary from persisted proposals and approved " +
+            "decisions. The reviewer selects additions, updates and links. Only those choices " +
+            "are saved. Then close F8 and finalize. Prepare reusable rules during the workflow " +
+            "with tht memory propose; do not call review-apply yourself.",
+        parameters: Type.Object({ session: Type.String() }),
+        async execute(_id, params, _signal, _onUpdate, ctx) {
+            workflow.activate();
+            try {
+                const { session } = params;
+                const phase = workflow.phase(ctx, session);
+                if (phase.number > 8) return workflow.close(ctx, session, phase.number, "Memory reviewed.");
+                if (phase.number !== 8) return toTextResult("Review the Memory summary at the end of F8.");
+                const summary = JSON.parse(memory.execute(ctx, ["summary", "--session", session, "--json"]));
+                if (summary.reviewed) {
+                    const failure = ledger.record(ctx, session, {
+                        type: "memory_summary_reviewed", subject: summary.summary_id,
+                        detail: "Previously saved Memory review recovered.",
+                    }, "Retry to record the recovered Memory review.");
+                    if (failure) return failure;
+                    return workflow.close(ctx, session, phase.number, "Memory review recovered.");
+                }
+                const response = await waitForReviewer(ctx, {
+                    id: `u${Date.now()}`, schema_version: 1, phase: phase.id,
+                    widget: "memory-review", title: "Memory for future questions",
+                    summary, reserved: ["other", "back", "exit"],
+                });
+                if (response.control) return toTextResult(
+                    response.control === "freetext"
+                        ? `Reviewer feedback: ${response.text}. Revise the proposals and present the summary again.`
+                        : `Reviewer requested: ${response.control}.`);
+                const selection = JSON.parse(response.text || "{}");
+                if (selection.summary_id !== summary.summary_id || !Array.isArray(selection.items))
+                    return toTextResult("Invalid Memory review response. Present the summary again.");
+                const failure = await memory.mutate(ctx, [
+                    "review-apply", "--session", session, "--review-json", JSON.stringify(selection), "--json",
+                ], "The Memory review is recoverable. Present the summary again if its content changed.");
+                if (failure) return failure;
+                const selected = new Set(selection.items.map(item => item.id));
+                const ledgerFailure = ledger.record(ctx, session, {
+                    type: "memory_summary_reviewed", subject: summary.summary_id,
+                    detail: `Saved ${selected.size} cards; declined ${summary.items.length-selected.size}.`,
+                }, "Memory is saved. Retry to record the review and finalize.");
+                if (ledgerFailure) return ledgerFailure;
+                const message = `Memory reviewed: ${selected.size} cards saved, ${summary.items.length-selected.size} declined.`;
+                return workflow.close(ctx, session, phase.number, message) || toTextResult(message);
+            } catch (error) {
+                return toTextResult(`[reviewer_memory_promote] ${String(error.stderr || error.message || error).trim()}`);
+            }
+        },
+    });
 }
 
 
 export function createMemoryGate(dependencies) {
 	return {
-		install: (pi) => installMemoryGate(pi, dependencies),
+		install: (pi) => {
+            installMemoryGate(pi, dependencies);
+            installRepairGate(pi, dependencies);
+        },
 		reviewRecall: (ctx, params, phase) => reviewRecall(ctx, params, phase, dependencies),
 	};
 }

harness/.pi/extensions/gate/memory/repair.js

@@ -0,0 +1,74 @@
+import { Type } from "typebox";
+
+export function installRepairGate(pi, { workflow, memory, waitForReviewer, toTextResult }) {
+    pi.registerTool({
+        name: "reviewer_archive_repair",
+        label: "Resolve Memory / Evidence conflict",
+        description: "Present closed archive correction choices with current and resulting content. " +
+            "Pass a reason and options (id, label, archive memory|evidence, target_id, revision, " +
+            "complete content). Only the human selects the persistent correction. " +
+            "Resume with repair_id from tht memory repairs --session. Never run repair-apply yourself. " +
+            "This gate does not approve or advance the current workflow phase.",
+        parameters: Type.Object({
+            session: Type.String(),
+            repair_id: Type.Optional(Type.String()),
+            proposal: Type.Optional(Type.Object({
+                reason: Type.String(), options: Type.Array(Type.Object({
+                    id: Type.String(), label: Type.String(),
+                    archive: Type.Union([Type.Literal("memory"), Type.Literal("evidence")]),
+                    target_id: Type.String(), revision: Type.String(),
+                    content: Type.Record(Type.String(), Type.Unknown()),
+                }), { minItems: 1, maxItems: 5 }),
+            })),
+        }),
+        async execute(_id, params, _signal, _update, ctx) {
+            workflow.activate();
+            try {
+                if (!!params.repair_id === !!params.proposal)
+                    return toTextResult("Supply either a new proposal or an existing repair_id.");
+                const run = args => JSON.parse(memory.execute(ctx,
+                    [...args, "--session", params.session, "--json"]));
+                let repair = params.repair_id
+                    ? run(["repair-show", "--repair-id", params.repair_id])
+                    : run(["repair-prepare", "--proposal-json", JSON.stringify(params.proposal)]);
+                let error;
+                while (true) {
+                    const response = await waitForReviewer(ctx, {
+                        id: `u${Date.now()}`, schema_version: 1,
+                        phase: workflow.phase(ctx, params.session).id,
+                        widget: "archive-repair", title: "Resolve archive conflict",
+                        repair, error, reserved: ["other", "back", "exit"],
+                    });
+                    if (response.control) return toTextResult(response.control === "freetext"
+                        ? `Reviewer feedback: ${response.text}. Reformulate the repair choices. ` +
+                          `Existing receipt ${repair.repair_id}: ${repair.status}.`
+                        : `Reviewer requested ${response.control}. Repair ${repair.repair_id}: ${repair.status}.`);
+                    const selected = response.choices;
+                    if (!Array.isArray(selected) || selected.length !== 1)
+                        return toTextResult("Invalid archive repair selection. Present the gate again.");
+                    const choice = selected[0];
+                    if (choice === "continue" && (repair.choice || !repair.can_apply))
+                        return toTextResult(JSON.stringify({ repair_id: repair.repair_id,
+                            status: repair.status, saved: repair.saved, indexed: repair.indexed,
+                            choice: repair.choice,
+                            correction: repair.options.find(o => o.id === repair.choice)?.content,
+                            next: "Continue the normal question review gates. Archive status above is authoritative." }));
+                    if (choice !== "reject" && !repair.options.some(o => o.id === choice))
+                        return toTextResult("Select only a displayed repair choice.");
+                    try {
+                        repair = run(["repair-apply", "--repair-id", repair.repair_id, "--choice", choice]);
+                        error = undefined;
+                        if (repair.status === "rejected")
+                            return toTextResult("All repair proposals were rejected as inadequate. " +
+                                "No archive was changed. Reformulate the options for the reviewer.");
+                    } catch (failure) {
+                        error = "The correction could not complete. Review the current archive state before retrying.";
+                        repair = run(["repair-show", "--repair-id", repair.repair_id]);
+                    }
+                }
+            } catch (error) {
+                return toTextResult(`[reviewer_archive_repair] ${String(error.stderr || error.message || error).trim()}`);
+            }
+        },
+    });
+}

harness/.pi/extensions/tht-gate.js

@@ -152,7 +152,7 @@ const FORBIDDEN = [
 	/\btht\s+decision\s+add\b/,
 	/\btht\s+cte\s+plan\b/,
 	// La promozione in memoria passa dal reviewer (reviewer_memory_promote), mai da shell.
-	/\btht\s+memory\s+(promote|save-one)\b/,
+	/\btht\s+memory\s+(promote|save-one|review-apply|repair-apply|create|update|delete|admin|index)\b/,
 	// La re-introspezione del DWH (~3 min) è manutenzione fuori sessione, mai in workflow.
 	/\btht\s+schema\s+introspect\b[^\n]*--refresh/,
 ];
@@ -627,9 +627,17 @@ export default function (pi) {
 		},
 		memory: {
 			execute: (ctx, args) => tht(ctx, ["memory", ...args]),
-			mutate: (ctx, args, recovery) => relayIfThtFails(
-				ctx, ["memory", ...args], recovery,
-			),
+			mutate: async (ctx, args, recovery) => {
+				try {
+					const result = JSON.parse(tht(ctx, ["memory", ...args]));
+					if (result.indexed === false) {
+						await ctx.ui.notify("Memory saved. Index update is incomplete; an administrator can retry it in Memory management.", "warning");
+					}
+					return null;
+				} catch (error) {
+					return textResult(`${(error.stderr || error.message || String(error)).toString().trim()} ${recovery}`);
+				}
+			},
 		},
 		ledger: {
 			validate: validateDecisionTypes,

harness/.pi/skills/tht-evidence-authoring/SKILL.md

@@ -9,6 +9,10 @@ You receive exactly one normalized Source Evidence request. Return one JSON obje
 only a `candidates` array, without Markdown fences, comments, or explanatory text. The
 host strictly rejects unknown or missing fields.
 
+Candidate JSON uses response protocol version 1. The host renders accepted candidates
+as editable Curated Evidence v4; supply the typed payload and exact excerpts in this
+response, leaving file rendering and provenance metadata to the host.
+
 Use only facts present in `normalized_text`. Never merge, cite, or infer facts from
 another source. Reuse an `existing_id` only when it was supplied in `previous_units`;
 otherwise omit it. Preserve prior reviewed wording when it is still supported. When a

harness/.pi/skills/tht-sessione/SKILL.md

@@ -81,6 +81,9 @@ kind:"cte_result"` of the plan (F6), `reviewer_confirm kind:"sql"` (F7), and
    Back" (rollback, see discipline 11), or "Esci/Exit" (session abort). If the
    reviewer closes without choosing, the gate re-presents the same widget — there is
    no silent skip.
+   When Memory and Evidence conflict and a shared archive needs correction, read
+   `archive-repair.md` and use `reviewer_archive_repair`. Its receipt reports the
+   persistent correction; the normal phase gate still approves the current question.
 6. **Self-contained messages.** When you call any `reviewer_*` tool, ALWAYS include
    in the `message` (or in the `options`' labels/descriptions) a concise recap of the
    context the reviewer needs to decide: what was asked, what you found, what each
@@ -310,6 +313,10 @@ Prerequisite: Phase 3 closed.
    questions show which tables comparable questions used. Cite relevant precedents
    (session id + tables) to the reviewer as CONTEXT — they are reference material,
    NOT decisions to apply; their filters/periods may not transfer.
+   Run `tht memory rules "<question>" --session <id> --json` for reusable join rules
+   and explained errors. Read `memory-review.md` when a rule is relevant or a reviewer
+   approves a reusable correction. Present the applicable rule and its Memory ID in
+   the existing table/join proposal; that gate decides its use for this question.
 2. Propose tables to promote/exclude with **`reviewer_schema_linking`**: pass
    `tables[]` as `{id, name, kind: "promote"|"exclude", rationale, suggested_columns}`.
    Do NOT list every column yourself — the gate loads the full column set (with
@@ -383,6 +390,8 @@ Prerequisite: Phase 5 closed.
 
 1. Read `cte.md`. Decompose the rewritten question into CTEs (Agent View Generation):
    each CTE captures an informative subset with a clear purpose, named in snake_case.
+   Consult `tht memory rules "<question>" --session <id> --json` and follow
+   `memory-review.md` for reusable calculation rules and explained errors.
    `tht memory solved-search "<question>" --json` shows how similar solved questions
    were structured — use as reference only.
 2. Present the full CTE plan to the reviewer with `reviewer_confirm kind:"cte_plan"`,
@@ -428,6 +437,8 @@ Prerequisite: Phase 6 closed.
 
 1. Read `sql-generation.md`. Recursive divide-and-conquer: the CTEs approved in
    Phase 6 are the preferred building blocks (reuse them by name).
+   Consult `tht memory rules "<question>" --session <id> --json`; show applicable
+   rules and Memory IDs in the SQL explanation approved by the existing SQL gate.
    `tht memory solved-search "<question>" --json` gives the final SQL of similar
    solved questions: reference exemplars — never copy filters, periods or
    populations without checking them against the current rewritten question.
@@ -460,15 +471,12 @@ Prerequisite: Phase 7 closed.
 2. On a server, if the reviewer chose yes: `tht datamart generate` (stub — raises
    NotImplementedError for now). Tell
    the reviewer that dbt generation is not implemented yet.
-3. **Memory promotion closes the session.** Call `reviewer_memory_promote` with ONLY
-   the session id: the gate computes the candidates itself (`tht memory promote
-   --preview` — the 3 reusable types, already excluding promoted/declined ones) and
-   shows the reviewer a pre-selected checklist. Selected → saved to the vectordb +
-   `memory_promoted`; deselected → `memory_promotion_declined` (never re-proposed).
-   After recording the promotion (even with zero candidates) the gate advances F8 and
-   finalizes the session itself — do NOT present a `reviewer_confirm kind:"phase"`
-   afterwards: there is nothing left to approve. When the gate answers "sessione
-   finalizzata", give the reviewer the final summary and end the turn.
+3. **Memory review closes the session.** Follow `memory-review.md` to finish any
+   persisted proposals, then call `reviewer_memory_promote` with the session ID.
+   The reviewer edits and selects additions, explicit updates and links in one
+   summary, including the consultative solved question. Only the selected cards
+   are saved. The gate records `memory_summary_reviewed`, advances F8 and finalizes.
+   Once it reports finalization, give the session summary and end the turn.
 4. If the gate reports an error instead (e.g. the datamart decision is missing),
    fix the prerequisite and call `reviewer_memory_promote` again. Only if the gate
    says the session is still open, close with `reviewer_confirm kind:"phase"` as a
@@ -478,7 +486,8 @@ Prerequisite: Phase 7 closed.
 
 When the promotion gate (or, as fallback, the F8 phase gate) closes Phase 8, the
 gate calls `tht session finalize` automatically.
-Finalize also indexes the question→SQL pair in the vectordb (kind `solved_question`,
-best-effort — on failure recover with `tht memory solved-index <id>`). The persisted
+Exemplars are saved only when selected in the Memory summary. Finalize performs
+no additional automatic Memory writes. Pending indexing is recovered through
+Memory management. The persisted
 state (ledger `review_decisions.jsonl` + artifacts) is the truth: what is not
 recorded did not happen.

harness/.pi/skills/tht-sessione/archive-repair.md

@@ -0,0 +1,37 @@
+# Resolve a conflict in the shared archives
+
+Use this gate when the retrieved Memory and Evidence disagree and the reviewer
+must decide which archive to correct. State the conflict, its effect on the current
+question, and the concrete alternative corrections. Each choice replaces one existing
+Memory Card or one Evidence unit; offer only changes that resolve the stated conflict.
+
+1. Read the complete current target and revision through
+   `tht memory repair-target --session <id> --archive memory|evidence --target-id <id> --json`.
+   Keep all content fields that the proposed correction does not change. An Evidence
+   correction retains its identity, kind and original source history. Evidence must
+   already be consolidated; external file edits must be reconciled first.
+2. Call `reviewer_archive_repair` with `session` and `proposal`:
+   `{reason, options:[{id,label,archive,target_id,revision,content}]}`.
+   `content` is the complete resulting card or Evidence unit. Use one to five distinct
+   choice IDs, excluding the reserved `reject` and `continue`. The gate loads the current
+   content itself and shows both versions. The human selects the archive correction.
+3. A rejection means every proposal was inadequate. Reformulate the choices using the
+   reviewer's feedback and present a new proposal. No archive mutation follows rejection.
+   A non-administrator can reject or continue the question; shared corrections require
+   an administrator. Do not disguise a shared correction as a final-summary promotion.
+4. The result distinguishes `active`, `pending_activation`, `applying`, and `superseded`.
+   `saved` alone does not establish retrieval availability. The gate offers retry of
+   the same approved correction after an index failure. A newer archive edit requires
+   reconciliation and a new proposal; replay never overwrites that edit.
+5. After interruption, run `tht memory repairs --session <id> --json`, then call
+   `reviewer_archive_repair` with `session` and `repair_id`. This refreshes current
+   archive status. The list's `recorded_status` is historical. Resume the existing
+   receipt for recovery instead of proposing the already-saved correction again.
+6. Continue the ordinary clarification/schema/SQL gate for the current question,
+   carrying the chosen meaning and the reported archive status. Archive repair does
+   not advance a phase. If activation remains pending, report that explicitly.
+
+The extension alone invokes `repair-apply` after the human response. Model-authored
+shell commands may prepare or inspect proposals, but cannot apply them. Correction
+receipts, like phase artifacts, persist independently of the live chat. Git remains
+an operator action after reviewing the Evidence file diff.

harness/.pi/skills/tht-sessione/memory-review.md

@@ -0,0 +1,74 @@
+# Reusable Memory during the workflow
+
+Consult rules at schema linking and SQL construction with
+`tht memory rules "<current question>" --session <id> --json`.
+An optional `--filters '{"table":"orders","column":"id"}'` narrows the physical
+context. The runtime fixes database and schema. A returned card is a candidate:
+explain its scope and Memory ID in the existing join, CTE or SQL proposal. That
+gate approves the concrete use; a retrieved link is not an approval. Exemplars
+remain references to previous questions.
+
+## Prepare additions and updates
+
+After a reviewer approves a reusable definition, join/calculation rule or explained
+correction, prepare a card citing the effective decision sequence(s) from
+`tht session show <id>`. Preserve the explanation and physical dependencies.
+Keep query-specific choices (for example only using 2024) in the solved question.
+An unselected option, unexplained rejection or timeout is not a reusable source.
+When an error and correction state the same rule, prepare one card.
+
+Write the complete current proposal list to a temporary JSON file and run
+`tht memory propose --session <id> --data <file.json>`. This persists
+`memory_proposals.json` in the session without changing the shared archive.
+Reuse proposal IDs when refining their wording. The accepted shape is:
+
+```json
+[
+  {
+    "id": "order-grain",
+    "source_seqs": [11],
+    "reason": "The reviewer corrected repeated header totals; this also applies to future questions.",
+    "card": {
+      "family": "sql_rule",
+      "subject": "Order totals after joining lines",
+      "detail": "Aggregate each order once before combining it with line totals.",
+      "scope": "Sales orders and order lines",
+      "rationale": "A line join repeats the header amount once per line.",
+      "concepts": ["order grain"],
+      "dependencies": [{"database": "warehouse", "schema_name": "sales", "table": "orders", "column": "total"}],
+      "links": []
+    }
+  }
+]
+```
+
+Use the actual decision numbers and schema identifiers from this session. Families
+are `domain_clarification`, `sql_rule`, `explained_error` and `solved_question`.
+Explained errors require both the corrected behavior and an approved explanation.
+The summary adds domain clarifications and the current approved exemplar when they
+are not covered by authored proposals, so author only the additions/changes needed.
+
+For an update, include `target_id` and `target_revision` from the current recalled
+card, explain the change in `reason`, and provide its complete resulting content.
+The reviewer sees the current card alongside the proposal. A conflicting manual
+edit requires a refreshed proposal and another review; it is not overwritten.
+Keep different rules with different scopes separate. Exact duplicates do not need
+another card. Semantic deletion belongs to Memory management.
+
+Links contain `target_id` and `meaning`. Use a current Memory ID for an existing
+destination or `proposal:<proposal-id>` for another new card in the summary. The
+reviewer may edit/remove links; a link to a new card requires selecting that card.
+
+## Final review
+
+At the end of F8, call `reviewer_memory_promote`. The widget permits content, scope,
+concept, dependency and link edits and accepts an empty selection. Approved exemplar
+SQL remains the session's solution; changing it requires returning to SQL review.
+The gate applies selected cards and links atomically in PostgreSQL and then updates
+Qdrant. An incomplete index update is reported and retained for explicit retry.
+An interrupted review is recovered from its persisted receipt rather than applied
+again. Once the gate reports finalization, end the session without another gate.
+
+For a Memory/Evidence conflict requiring a persistent correction, follow
+`archive-repair.md`. A correction already saved by that gate does not need a
+duplicate update in the final summary.

harness/.pi/skills/tht-sessione/modules/memory/phase-8-promotion.md

@@ -1,12 +1,9 @@
-3. **Memory promotion closes the session.** Call `reviewer_memory_promote` with ONLY
-   the session id: the gate computes the candidates itself (`tht memory promote
-   --preview` — the 3 reusable types, already excluding promoted/declined ones) and
-   shows the reviewer a pre-selected checklist. Selected → saved to the vectordb +
-   `memory_promoted`; deselected → `memory_promotion_declined` (never re-proposed).
-   After recording the promotion (even with zero candidates) the gate advances F8 and
-   finalizes the session itself — do NOT present a `reviewer_confirm kind:"phase"`
-   afterwards: there is nothing left to approve. When the gate answers "sessione
-   finalizzata", give the reviewer the final summary and end the turn.
+3. **Memory review closes the session.** Follow `memory-review.md` to finish any
+   persisted proposals, then call `reviewer_memory_promote` with the session ID.
+   The reviewer edits and selects additions, explicit updates and links in one
+   summary, including the consultative solved question. Only the selected cards
+   are saved. The gate records `memory_summary_reviewed`, advances F8 and finalizes.
+   Once it reports finalization, give the session summary and end the turn.
 4. If the gate reports an error instead (e.g. the datamart decision is missing),
    fix the prerequisite and call `reviewer_memory_promote` again. Only if the gate
    says the session is still open, close with `reviewer_confirm kind:"phase"` as a

harness/.pi/skills/tht-sessione/modules/memory/solved-finalization.md

@@ -1,2 +1,3 @@
-Finalize also indexes the question→SQL pair in the vectordb (kind `solved_question`,
-best-effort — on failure recover with `tht memory solved-index <id>`). The persisted
+Exemplars are saved only when selected in the Memory summary. Finalize performs
+no additional automatic Memory writes. Pending indexing is recovered through
+Memory management. The persisted

harness/.pi/skills/tht-sessione/modules/memory/solved-search-f4.md

@@ -2,3 +2,7 @@
    questions show which tables comparable questions used. Cite relevant precedents
    (session id + tables) to the reviewer as CONTEXT — they are reference material,
    NOT decisions to apply; their filters/periods may not transfer.
+   Run `tht memory rules "<question>" --session <id> --json` for reusable join rules
+   and explained errors. Read `memory-review.md` when a rule is relevant or a reviewer
+   approves a reusable correction. Present the applicable rule and its Memory ID in
+   the existing table/join proposal; that gate decides its use for this question.

harness/.pi/skills/tht-sessione/modules/memory/solved-search-f6.md

@@ -1,2 +1,4 @@
+   Consult `tht memory rules "<question>" --session <id> --json` and follow
+   `memory-review.md` for reusable calculation rules and explained errors.
    `tht memory solved-search "<question>" --json` shows how similar solved questions
    were structured — use as reference only.

harness/.pi/skills/tht-sessione/modules/memory/solved-search-f7.md

@@ -1,3 +1,5 @@
+   Consult `tht memory rules "<question>" --session <id> --json`; show applicable
+   rules and Memory IDs in the SQL explanation approved by the existing SQL gate.
    `tht memory solved-search "<question>" --json` gives the final SQL of similar
    solved questions: reference exemplars — never copy filters, periods or
    populations without checking them against the current rewritten question.

harness/.pi/skills/tht-sessione/projection.md.tmpl

@@ -81,6 +81,9 @@ kind:"cte_result"` of the plan (F6), `reviewer_confirm kind:"sql"` (F7), and
    Back" (rollback, see discipline 11), or "Esci/Exit" (session abort). If the
    reviewer closes without choosing, the gate re-presents the same widget — there is
    no silent skip.
+   When Memory and Evidence conflict and a shared archive needs correction, read
+   `archive-repair.md` and use `reviewer_archive_repair`. Its receipt reports the
+   persistent correction; the normal phase gate still approves the current question.
 6. **Self-contained messages.** When you call any `reviewer_*` tool, ALWAYS include
    in the `message` (or in the `options`' labels/descriptions) a concise recap of the
    context the reviewer needs to decide: what was asked, what you found, what each