fix(remember): honor write_class=deliberate gate contract; grading never blocks write

[cdeust]

Root cause (two independent defects, not one)

1. write_class="deliberate" novelty-rejected — contract violation

handlers/remember.py:167-169 computes resolved_write_class but never
threads it into evaluate_gate (handlers/remember.py:193-194 pre-fix) ->
_compute_gate_decision -> core/write_gate.py::determine_bypass
(write_gate.py:115-133 pre-fix), which had zero knowledge of write_class
— it only bypasses on force / error-keyword content / decision-keyword
content / important/critical tags. A plain, low-novelty deliberate
write (or one that omits write_class, which source-falls-back to
deliberate per core/write_class.py) fell straight through to the
ordinary novelty threshold and got below_threshold-rejected, contradicting
the tool's own documented contract ("deliberate — NEVER rejected by the
gate for low novelty; near-duplicates are still merged/linked/superseded by
curation").

Fix: thread the already-resolved write_class through evaluate_gate /
_compute_gate_decision / determine_bypass. determine_bypass now
bypasses on write_class == "deliberate", checked last (after
force/error/decision/tag) so a more specific, more informative bypass
reason still wins when it applies — a deliberate write with error-shaped
content still reports bypass_error, not the generic
bypass_write_class_deliberate.

2. force=True intermittent FileNotFoundError + misleading DATABASE_URL hint

handlers/remember_helpers.py::insert_and_post_process (line 717-719
pre-fix) calls:

grade_report = validate_memory.grade_from_content(
    content, directory_context=directory, base_dir=directory or os.getcwd()
)

unconditionally, for every successful insert (create/supersede), as
part of the M-D5 write-time provenance-grading step. This was the one
enrichment call in that function not wrapped in the same defensive
try/except pattern already used for its siblings (source_attribution
classification a few lines below, the habituation signature a few lines
after that). os.getcwd() raises FileNotFoundError: [Errno 2] No such file or directory when the process's current working directory has been
removed — e.g. a worktree cleaned up mid-session — which is exactly the
observed intermittence (a call at ~12:30 succeeded because the cwd still
existed; two calls at ~14:00 failed because it had since been removed).
This is unrelated to the DB and unrelated to write_class; it happens
before the row is ever inserted, so the write is lost entirely.

The escaped exception then hit tool_error_handler.py::safe_handler's
generic branch, which appended "If this persists, check that PostgreSQL is running and DATABASE_URL is set correctly." to any unclassified
exception type — including FileNotFoundError — misleading a user chasing
a genuine filesystem issue into checking a database that was healthy the
entire time.

Fix:

• _grade_content_best_effort wraps the os.getcwd() + grade_from_content
  call; it never raises. On failure it returns a fallback UNVERIFIABLE
ProvenanceReport and the caller appends an observable
  prov-grading-failed:<ExceptionType> tag to the row (never silently
  absorbed — matches the repo's anti-silent-fallback standard).
• tool_error_handler.py::safe_handler no longer appends the DATABASE_URL
  hint for exception types _classify_error didn't recognize as DB-related
  — the two genuinely DB-related categories already carry their own
  actionable guide text as the message body.

Symptom 3 — reason: "bypass_error" on a successful store: not a bug

The issue speculated this was evidence of an internal exception in the
bypass machinery. Investigated and confirmed by design:
bypass_error is the gate_reason determine_bypass returns whenever
content matches core/thermodynamics.py::is_error_content's
error/exception-keyword regex — a legitimate, existing, tested bypass path
(tests_py/core/test_write_gate.py::TestDetermineBypass::test_error_content_bypasses).
Two unrelated symptoms shared this label by pure name collision with the
observer's hypothesis, not by a shared code path. Pinned with
TestBypassErrorIsNotAnInternalFailure so it isn't "re-fixed" later.

Files changed

• mcp_server/core/write_gate.py — determine_bypass gains a
  write_class parameter, checked last.
• mcp_server/handlers/remember.py — threads resolved_write_class into
  evaluate_gate.
• mcp_server/handlers/remember_helpers.py — evaluate_gate /
  _compute_gate_decision accept and forward write_class; new
  _grade_content_best_effort wraps the provenance-grading call.
• mcp_server/tool_error_handler.py — removes the misleading DATABASE_URL
  hint for unclassified, non-DB exception types.
• tests_py/handlers/test_issue_147_write_class_and_grading.py — 13 new
  regression tests.

Test plan

• pytest tests_py/handlers/test_issue_147_write_class_and_grading.py — 13/13 pass
• pytest tests_py/core/test_write_gate.py tests_py/handlers/test_remember.py tests_py/handlers/test_remember_provenance_at_write.py tests_py/handlers/test_remember_helpers_novelty_normalize.py tests_py/handlers/test_remember_helpers_silent_failures.py tests_py/server/test_tool_error_handler_classification.py — 128/128 pass
• Full suite: pytest -q — 5178 passed, 2 pre-existing failures
  (tests_py/hooks/test_hook_receipts.py::test_agent_briefing_emits_receipt_with_marker,
  ::test_agent_briefing_skips_superseded_prior_work) confirmed failing
  identically on unmodified main (unrelated to this change — verified via
  git stash + targeted re-run before restoring the diff).
• ruff check . — clean
• ruff format --check on all touched files — clean

Out of scope / self-flagged

• mcp_server/handlers/remember_helpers.py (935 lines) and
  mcp_server/core/write_gate.py (450 lines) already exceed the 300-line
  file cap on main, pre-dating this change. Not touched beyond the
  minimal diff required for this fix — a full split is a separate,
  much larger refactor out of this PR's blast radius.
• The recall/scoring path was not touched by this fix.

Fixes #147

🤖 Generated with Claude Code