Correction: close the gaps a memory-systems survey found, and gate the eval

[MakerViking]

Four commits. One fixes something that was outright broken; the rest close
the axes where Mimir read thinner than the best of the 151 open-source
memory systems in Yves' survey, whose sharpest metric was "can a deleted
fact be silently re-extracted." Mimir's could.

A forgotten fact could walk back in (428508e)

Reproduced before fixing:

remember → m:M7FQ29 ; forget m:M7FQ29 ; recall → no results
remember (same text) → m:9B80AP, no warning, and it's back

Duplicate detection only ever looked at live nodes, so a tombstone left
nothing that could catch the re-add. An importer re-run, an extractor
re-reading an unchanged source, or an agent that saw the fact twice each
quietly undid the delete.

remember now refuses with the date it was forgotten on. Three details
that mattered more than the main change:

• Precedence. An exact live copy stays an ordinary duplicate even when
  an older tombstone exists — otherwise --force is a one-way door.
• Rewording. The hash pass alone missed "…03:00 utc.", because
  tokens keeps trailing punctuation whole so file.rs survives. A
  token-overlap pass over tombstones catches it; a reword is the common
  shape of re-extraction, not an edge case.
• Decay archival is excluded. consolidate soft-deletes idle
  low-strength nodes with meta.archived = 1. Nobody decided those, and
  treating them as deletions would train everyone to --force by reflex,
  which is how the guard on real deletions stops meaning anything.

MCP has no force parameter, so an agent cannot resurrect what a human
deleted.

The eval became a gate (428508e)

The corpus was committed and deterministic, but every baseline was
#[ignore]d and the only live assertions were well-formedness checks with
an MRR > 0.2 floor — a ranking change could land with nothing to notice.
Now on plain cargo test: a per-set baseline that must reproduce
exactly in both directions (an improvement nobody wrote down is also
unreviewed), plus a per-knob ablation. Verified by zeroing
type_prior_alpha: previously green, now two failures naming the metric
and delta.

It immediately found that scoring.code_damp moves nothing on the
corpus — same numbers in every category, including the code-vs-memory
scenario that exists to guard it. Pinned by a test that fails when it stops
being inert, rather than asserting a win that isn't there.

Grounding you can falsify (287f349)

Every other signal on a memory is a policy — strength rises because it got
used, a type prior favours gotchas — and none can be proven wrong by the
code that assigns it. A link to an indexed artifact can be. Verified end to
end: link by symbol name → 1 grounded; delete the source, reindex,
rebuild → 1 stale, and the memory carries

! grounding stale: symbol retry_with_backoff is no longer indexed

Flag-only by decision: reported, never scored. A live artifact beats a dead
one so re-chunking can't flap it; links to other memories ground nothing,
since two assertions agreeing isn't evidence.

A refusal ledger that isn't itself a leak (287f349)

The secret guard refused things and kept no record, so nothing could tell
you a value was being retried. It now records a blake3 fingerprint, the
detector's label, the surface, and first/last seen with a count — never the
value. Repeats increment one row: one secret offered forty times is a loop,
and forty rows would bury that. Guarded by a test that sweeps every column
of every table for the plaintext.

Confidence, separate from retrieval strength (74d5ec1)

strength conflated "how often this got used" with "how much to believe
it", which is how a guess becomes canon. --confidence certain|likely| unsure, author-declared at capture on the same argument expires_at rests
on. Absent is a real state, not a synonym for likely. Only unsure
reaches the compact recall line — that line is what an agent acts from.

Verified: a memory declared unsure and opened 8 times shows ↑8 and is
still unsure. Usage moved, the claim didn't.

Also

remember --link <symbol> never worked on the CLI — both surfaces
advertise "a code symbol or node" but the CLI only resolved ids. MCP had
the fallback already. Left alone this would have shipped grounding with its
main entry point broken.

Review notes

• New migration (the refusal table). Upgrade path covered by a test
  that keeps an existing store's rows and writes the new table, written
  against MIGRATIONS.len() - 1 so it guards whatever lands next.
• No ranking change. Grounding and confidence are both inert in
  scoring, and the hermetic baseline reproduces byte-identically — that is
  the check, not an assertion.
• Local: fmt, clippy -D warnings, 384 tests, plus end-to-end runs against
  the real binary for the forget guard, the ledger, grounding and
  confidence. Windows is unverified — this PR is what runs it, and the
  last two Windows breakages here were a stack overflow and schema-shaped.