feat: UX-3 — project history + memesh why file attribution

[kevintseng]

UX-3 — project history + memesh why

The work-topology arc's history slice: the Project tab learns to tell one project's story honestly, and a new memesh why <file> answers "why does this file look like this" from local git plus the graph — with every gap in the chain reported as a typed abstention, never guessed around.

memesh why <file> (CLI + POST /v1/why)

• The chain: local git resolves which commits touched the file (git log --follow, or git blame for --line N) → the graph joins each hash to the commit entity the post-commit hook captured → metadata.session_id walks to the session's entities → file:<basename> tags collect associated memories, labelled "associated, not commit-derived".
• The load-bearing join is prefix-based, both directions: post-commit names entities commit-<ABBREVIATED hash> (git's own [branch abc1234] output line) while blame/log emit full 40-char SHAs — an exact-name lookup finds nothing, ever. Break-tested: reverting the prefix match to equality turns 3 tests red.
• Typed abstentions (not_a_git_repo, file_not_tracked, git_unavailable, line_out_of_range, line_uncommitted, no_commit_entity, no_session_link): core emits codes, the CLI renders sentences. A commit memesh never saw says so; a commit captured before session recording says so.
• The HTTP route never runs git. POST /v1/why takes commit hashes from the caller; its strict schema has no repo-path field on purpose, so the server is never handed a directory to execute anything in (pinned by a test that posts a sneaky cwd key and expects 400).
• Forward fix: post-commit now records metadata.session_id + metadata.files (cap 50) on commit entities — metadata rather than tags, so pre-edit-recall's file:* join cannot start injecting commit noise into every edit. Break-tested (removing the metadata write turns the new hook test red). captureEntity grew an INSERT-only metadata param that cannot displace the provenance stamps.

Project tab

• Capture density by category — per-cluster histogram of created_at (the same axis the phase strip segments on), honestly named: it shows what memesh captured, not everything that happened, and the caveat renders beside the title. Bar is aria-hidden; title/note/legend counts carry the information. Quiet periods stay as real empty buckets — the gap is the data.
• Lineage overlay — supersedes (solid neutral) and contradicts (dashed warning) arcs on the tree timeline, measured off the DOM so an arc only ever connects rows actually on screen; the visible legend counts drawn arcs only. Only the two behavioural relation types are drawn — caused exists in MCP prose but no writer emits it.
• Superseded nodes come back — supersedes auto-archives its target on write, so the old active-only filter hid exactly the node every chain points at. selectProjectEntities() re-admits archived entities an active one points at with a lineage edge — and only those (pinned by its own test file).
• ADR-style Decisions view — one card per decision entity with a two-state status derived from the graph (active / superseded; no invented proposed/accepted lifecycle) and its supersession chain spelled out with jump links. Expander per DESIGN.md (aria-expanded/aria-controls, lazy body, memory voice for content).
• URL deep links — the SPA now writes ?tab= back (the read side existed since the 5-tab shell; nothing ever wrote it) and the Project tab reads/writes ?project=, so a copied URL shows the reader the view being looked at.

Docs & gates in the same PR

• API_REFERENCE: POST /v1/why + memesh why; ARCHITECTURE: counts follow (28 commands, 33 routes) + core/why.ts module line; CHANGELOG under [Unreleased].
• i18n: 10 new keys in all 11 locales.
• Audit baseline: 6 entries re-keyed for pure line shifts (statement verified unchanged), 12 new hits triaged with reasons.
• New component registered in component-contracts with a dedicated degenerate-input test file.

Verification (run in this session, verdicts by exit code)

node scripts/run-tests-isolated.mjs   exit=0   Test Files 146 passed (146) / Tests 2152 passed (2152); 0 "Errors" lines
npm run verify:release                exit=0   (lint, typecheck, version-coherence, generated-mirror, doc-claims, verification-audit, audit:prod all green)
npm run test:e2e-dashboard            exit=0   "Dashboard packaged e2e smoke passed"

Break-tests against the committed baseline (mutate → red → restore → green):

• prefix join reverted to exact-name equality → tests/core/why.test.ts 3 failed (exit 1); restored → 12 passed.
• post-commit metadata write removed → tests/hooks/post-commit.test.ts 1 failed (exit 1); restored → 20 passed.