feat(harness): nsp memory save-one core — targeted upsert via writer key (D11)

The D11 deviation is a single-row pgvector upsert, not a full vectorstore resync.
Ports memory.py + session/{store,artifacts} + textutil (deps of memory), renamed
psdwp3->nsp. Decision import paths rewired from nsp.session.decisions to nsp.decisions
(our A4 port lives at the top level). session/models.py left UNCHANGED to preserve
the Phase-A ThothII additions (D12/D15 author/summary, D14a grounded_values,
D14b concept_formulas).

New in memory.py:
- memory_vector_record_for_decision(records, decision_seq): the single VectorRecord
  for a chosen decision (reuses memory_vector_records, filtered to one).
- save_one_memory(records, decision_seq, writer, embedder): embeds one record and
  calls writer.upsert_records('memory', [row]) -- NEVER writer.sync (that's the
  full-resync, server-side-only path). Returns the upsert count.

L1: test_memory_save_one (5 tests) pins the contract -- single row, one upsert
call, sync never called, None/0 for unknown seq.

Deferred: the full nsp memory save-one CLI command (config/session loading + the
workstation write-guard) lands when memory_cmd.py is ported alongside the other
CLI commands. The pure D11 core is what L1 can honestly cover here.

harness/tests/test_memory_save_one.py

@@ -0,0 +1,89 @@
+"""L1: nsp memory save-one -- targeted upsert via the writer key (spec D11).
+
+The D11 deviation: instead of a full vectorstore resync (nsp memory index / sync),
+a remote workstation with a writer key can push a SINGLE promoted decision to
+pgvector as a one-row upsert. This test pins the pure core of that behavior:
+- exactly one VectorRecord is built for the chosen decision_seq
+- the writer.upsert_records is called once with a single row
+- writer.sync is NEVER called (that is the full-resync path)
+"""
+from datetime import datetime
+from pathlib import Path
+from unittest.mock import MagicMock
+
+import pytest
+
+from nsp.memory import MemoryRecord, memory_vector_record_for_decision, save_one_memory
+
+
+def _record(seq: int = 7, **kw) -> MemoryRecord:
+    base = dict(
+        id="mem-0007", ts=datetime(2025, 1, 1), session_id="s1", decision_seq=seq,
+        type="table_promoted", subject="pazienti", detail="promossa", rationale="r",
+        question_context="dammi i pazienti", tables=["pazienti"], concepts=[],
+    )
+    base.update(kw)
+    return MemoryRecord(**base)
+
+
+# --- memory_vector_record_for_decision (single-record filter) ------------------
+
+def test_single_record_built_for_decision_seq():
+    records = [_record(seq=7), _record(seq=8, id="mem-0008")]
+    vr = memory_vector_record_for_decision(records, decision_seq=7)
+    assert vr is not None
+    assert vr.id == "memory:mem-0007"  # memory_vector_records prefix
+    assert vr.kind == "memory"
+    assert "pazienti" in vr.content
+
+
+def test_returns_none_for_unknown_decision_seq():
+    records = [_record(seq=7)]
+    assert memory_vector_record_for_decision(records, decision_seq=999) is None
+
+
+# --- save_one_memory (the D11 orchestrator: single upsert, never sync) ---------
+
+def test_save_one_calls_upsert_with_single_row_never_sync():
+    records = [_record(seq=7)]
+    writer = MagicMock()
+    writer.upsert_records.return_value = 1
+    embedder = MagicMock()
+    embedder.embed_documents.return_value = [[0.1] * 8]
+
+    upserted = save_one_memory(records, decision_seq=7, writer=writer, embedder=embedder)
+
+    assert upserted == 1
+    writer.sync.assert_not_called()  # the whole point of D11: no full resync
+    writer.upsert_records.assert_called_once()
+    args = writer.upsert_records.call_args
+    # table is memory, exactly one row
+    assert args[0][0] == "memory"
+    rows = args[0][1]
+    assert len(rows) == 1
+    assert rows[0]["record_key"] == "memory:mem-0007"
+    assert "embedding" in rows[0]
+
+
+def test_save_one_no_record_for_seq_is_noop():
+    records = [_record(seq=7)]
+    writer = MagicMock()
+    embedder = MagicMock()
+    upserted = save_one_memory(records, decision_seq=42, writer=writer, embedder=embedder)
+    assert upserted == 0
+    writer.upsert_records.assert_not_called()
+    writer.sync.assert_not_called()
+    embedder.embed_documents.assert_not_called()
+
+
+def test_save_one_uses_writer_key_for_upsert():
+    """The upsert must flow through the writer client (writer key), not a reader.
+    Verified indirectly: save_one_memory takes the writer as its client argument."""
+    records = [_record(seq=7)]
+    writer = MagicMock()
+    writer.upsert_records.return_value = 1
+    embedder = MagicMock()
+    embedder.embed_documents.return_value = [[0.0] * 4]
+    save_one_memory(records, decision_seq=7, writer=writer, embedder=embedder)
+    # one upsert call, single row, table=memory
+    assert writer.upsert_records.call_count == 1