feat: UX-4 — two-layer graph (work layer + evidence on demand)

[kevintseng]

UX-4 — the graph has two layers: the work, and the evidence under it

The Knowledge Graph tab used to draw everything memesh has stored at one
altitude, ranked by recall traffic. On a real graph that means 168 commits and
78 session captures compete for attention with 16 decisions, and the decision
made this morning — access count zero — is the last thing labelled.

This splits the view. The work layer (WORK_LAYER_TYPES, the one whitelist in
src/core/work-topology.ts) is what loads; each node carries a badge counting
the mechanical capture that supports it; clicking a node loads that evidence and
only then.

The edge had to exist first

Hooks capture evidence but have never drawn an edge to the work it supports, so
every badge would have read zero. kg backfill gains Rule 5 (evidences,
on by default, --no-evidence-links to disable):

• Matched on an exact session id — the session:* tag, or metadata.session_id
  for commit entities, which carry no session tag by design (UX-3 put it in
  metadata precisely so pre-edit recall would not inject commit noise).
• No session match falls back to the most recent same-project work item created
  before the capture. A first run over months of history therefore
  distributes it across the items that were current at the time, instead of
  piling every old commit onto whatever node is newest today.
• Its sources are evidence entities, not orphans — a commit that already relates
  to something else is still evidence — so the zero-orphan early-out now checks
  the rule is actually off before taking the shortcut.

Server

GET /v1/graph?layer=work → work entities, work↔work relations, per-node
evidenceCounts. GET /v1/graph/evidence?node=NAME → the drill-down, capped at
200 with a truncated flag. An unknown layer value is a 400, not a silent
full-graph response; a node that does not exist is a 404, distinct from a node
with no evidence (200, empty arrays).

Three places this chose honest over convenient

• Ranking. Work nodes rank by recency, then evidence count. Status is
  deliberately not a key: measured on the live graph today, 0 of 53 active
  work entities are the target of a supersedes edge — supersession archives
  the loser and this view is active-only, so a status axis would rank on a
  constant. The verdict asked for "status/recency"; the measurement says the
  status half would have been decoration.
• The fallback speaks. Under three work items — a young install, where an
  empty work layer is the normal state — the tab shows the full graph and says
  it did. A silent fallback is exactly what R2 removed from recall.
• No ?? {} on evidenceCounts. A work payload missing that field is a
  shape error. Defaulting it would render every badge as zero — "nothing
  supports this decision" — from a response that never answered the question.

The badge participates in the label budget and the hit-test, not just the draw
call: a target you can see and cannot click is worse than no target.

Two contracts moved with the code

evidences is registered in a new DERIVED_RELATION_TYPES — the types
kg-backfill draws, as against the ones a model states deliberately
(supersedes archives; contradicts surfaces a conflict). Without that
distinction relation-types-documented would have demanded a
memesh remember --evidences flag and a line in every model's tool schema for
an edge no model is asked to write. A companion test pins the two lists
disjoint, so the derived list cannot become a way to retire a behavioural type
from the schema the model reads.

The i18n scan that derives backfill's relation vocabulary now imports that
constant instead of regexing the inline union it used to read as source text —
naming the union (a refactor that changed no behaviour) had made its match null,
and a null match made the check vacuous.

Verification (run in this session, verdicts by exit code)

node scripts/run-tests-isolated.mjs   exit=0   Test Files 150 passed (150) / Tests 2190 passed (2190); no "Errors" line
npm run verify:release                exit=0   (lint, typecheck, version coherence, generated mirror, doc claims, verification audit, audit:prod)

Break-tests — each mutation applied to the committed code, then reverted and
re-verified green:

Mutation	Result
Temporal fallback guard removed (link to newest regardless of time)	1 failed
Zero-orphan early-out reverted (Rule 5 skipped on a connected graph)	1 failed
Archived-evidence filter dropped from the badge count	1 failed
ORDER BY created_at DESC → ASC in the drill-down	1 failed
Fallback announcement suppressed (setFellBack(true) → false)	1 failed
WORK_LAYER_MIN_NODES raised to 9999	2 failed
evidenceCounts guard reverted to ?? {}	1 failed
relation.evidences dropped from the en catalogue	2 failed

One of those mutations initially survived and the fix is in the diff: the
first version of graph-two-layer.test.tsx built its fixture as
WORK_LAYER_MIN_NODES + 1, so raising the threshold moved the fixture with it
and the test could not fail. It now uses a fixed count and pins the constant
separately.

The full suite also caught four dashboard fixtures that answered every URL with
one payload shape; they now answer ?layer=work with the shape a real server
sends. One of them was sharing a single Response object across calls, which
only surfaced because this tab legitimately fetches twice on the fallback path.

Follow-ups (not in this PR)

• memesh kg backfill has to be run once for the badges to populate on an
  existing graph; the docs and the empty-state copy both say so.
• Germination replay and the mycelium pulse (DESIGN.md's living mechanics 4 and
  5) still need the recall event stream.