fix(doctor,storage): a broken AI feature nobody was told about (D13, D15)

[kevintseng]

D13 — four AI-backed features had failed every call for days, and nothing said so

llm_telemetry is written by every Smart-Mode flow and was read by nothing
that could alert anyone. memesh telemetry shows it on request, which
means a broken flow needed someone to think to ask. grep -n "llm_telemetry" src/core/doctor.ts found nothing before this PR.

Measured on the maintainer's graph on 2026-09-02, 7-day trailing window:

flow	recent calls	succeeded
guard_proposer	69	0
dreamer	47	0
auto_tagger	20	0
failure_analyzer	8	0

All bad_request, all starting 2026-08-28. memesh doctor reported a clean
bill of health throughout.

Why 7 days and not the CLI's own 30-day default

At 30 days, dreamer's stale successes from 2026-08-23 dilute the rate to
"36% succeeded" and hide that it has been fully broken all week. The shorter
window is the difference between seeing this and not.

transcript_extractor — 114/118 = 96.6% healthy over its lifetime, real
background noise — had no calls inside the window, so it stays silent.
Correctly, not by luck: a test pins that an ordinary mixed failure rate is not
flagged, and another pins that failover attempts are counted as calls, not as
attempts (2 calls × 2 providers must not read as 4 and trip a 3-call
threshold).

D15 — emptied lesson shells kept the recall history of the bucket they used to be

splitFusedLessons moves a fused bucket's observations into their own entities
but left the emptied shell's recall_hits/recall_misses behind. Of 49
archived shells, 4 carried stale counters: 3/61, 1/35, 3/1, 0/1.

Not merely inert — scripts/audit/measure-signals.mjs sums those columns over
all entities with no status filter, so the stale number pollutes that
signal permanently.

Zeroed, not divided and not copied onto the successors. A hit is recorded
against the bucket id, never against one observation inside it: dividing
fabricates a fraction nobody earned, and copying claims each successor
independently earned the whole bucket's track record. The real numbers are
preserved under metadata.retired_recall.

Scope, stated precisely: the default recall path was never affected — an
archived shell loses its FTS row and search() filters to active by default.
What was wrong is the audit aggregate and any includeArchived: true read.

Repair, on a copy of the snapshot

global SUM(recall_hits)/SUM(recall_misses): 97/561 → 90/463   (Δ −7/−98)
rows changed: 4 — exactly the 4 shells, nothing else
successors with nonzero recall: 0 before, 0 after (26 checked, none touched)

The part worth reading: two guards that could not fail

Break-testing this PR found that removing retireRecallHistory from both
live archive points in splitFusedLessons left every existing test green —
including the two tests written specifically for those points.

Both wirings run inside the same openDatabase, and the one-shot repair runs
second. On a fresh database it silently rescued anything the archive points
failed to retire, so a test that opens once cannot tell the two apart.

But the repair is a runOnceMigration, already stamped at its current version
(1) — it will not fire again as-is. That is not what protects an ordinary
bucket the runtime fuses today: the current code no longer creates new
-other buckets at all, so this state only matters for the next time
FUSED_LESSON_SPLIT_KEY bumps past 2 (this split logic changing again) while
the shell repair stays stamped and can no longer rescue what it misses — the
archive points then have to retire the history on their own.

The two new tests seed exactly that state (shell repair already stamped, split
still owed) and each asserts the stamp did not move during the run, so they
cannot quietly stop isolating the thing they claim to isolate.

Verification, at a317f5d5 in the PR worktree

node scripts/run-tests-isolated.mjs   -> exit=0
  Test Files  230 passed | 1 skipped (231)
  Tests  3295 passed | 11 skipped (3306)
npm run verify:release                -> exit=0   (all nine steps)
invariant vs unrepaired snapshot      -> exit=1   (names the 4 shells)
invariant vs repaired copy            -> exit=0

Break-tests — mutate, run, restore, byte-identical restore asserted:

Mutation	Result
disable the doctor detector entirely (dist/ rebuilt — that test spawns the built CLI)	exit=1 → restored exit=0
drop retireRecallHistory from archive point A (the -other bucket loop)	exit=1 → restored exit=0
drop it from archive point B (the legacy readable-only loop)	exit=1 → restored exit=0
drop it from the one-shot repair	exit=1 → restored exit=0

The middle two were exit=0 before the tests in this PR were added. That is
the finding, not a footnote.

Dashboard strings

The new doctor code has catalogue entries in all 11 locales rather than falling
back to raw English, matching how this project already closed the same gap for
sibling codes.