feat: project scoping for notes, export drift detection, per-kind decay defaults, hygiene nudges

[navbytes]

Implements the small-effort recommendations from the note-creation design review, focused on the cross-project knowledge use case: project-specific notes cleanly separable at query time, domain notes discoverable from anywhere, and the store's maintenance loops surfacing themselves instead of waiting to be run.

Project scoping — one rule, every surface

• note.ProjectKey / SameProject / AnyProject: one case-insensitive, whitespace-trimmed comparison shared by index, search, and the dedup fold. Previously three surfaces matched projects three different ways (nt index was exact case-sensitive, recall tokenized, dedup lowercased), so --project WTCockpit was recallable but not indexable as wtcockpit.
• MCP nt_index and nt_search gain a project filter. An agent over MCP previously had no project-scoped retrieval at all — the CLI-only nt index --project was the single hard filter, and strict-args turned an MCP attempt into an error. nt_search/nt search accept project alone (bare scope listing), since project: frontmatter is deliberately invisible to the text match.
• nt search --project on the CLI; tasks filter by +project with the same fold.
• Repair path for mis-scoped notes: nt edit --project <name|none> and the same project field on nt_note_edit (note.SetProject preserves adjacent unmodeled frontmatter).
• nt tags now prints the project vocabulary (notes' project: + tasks' +project, case-folded) alongside tags, with a --projects mode; the default --json stays [{tag,count}] (existing machine contract). The skill's "check the store's vocabulary before scoping" advice — and the index empty-match warning — are now actionable.

Export drift detection

nt export --out records target, selection, and content hash in $NT_DIR/export-state.json (hand-editable, beside views.json). nt doctor re-renders each recorded selection against the current store and warns — with the copy-pasteable refresh command — when the compiled file no longer matches, including "edited outside nt export" and "file is gone" cases. This closes the compiled-rules staleness trap: a rule pruned by /nt-distill or added by /nt-learn no longer silently never reaches CLAUDE.md. Docs now recommend compiling into a dedicated file and @-importing it (exporting over CLAUDE.md itself is a full-file overwrite).

Per-kind decay defaults

A [decay] section in config.toml (lesson = "180d", ref = "270d", …) stamps a default half_life: on new notes of that kind when the caller gives none — CLI and MCP alike. Stamped frontmatter, never an invisible read-time rule, so a config change can't silently re-rank existing notes; an explicit --half-life/half_life always wins; unparseable values stamp nothing and are reported by nt doctor. The AgeBasis doc now states the mtime caveat (any file write — notably a fresh git checkout of the store — resets decay clocks).

Proactive hygiene

The unscoped session-start read — nt index (stderr) and nt_index (warning field) — nags once near-duplicate pairs (≥3) or reclaimable notes (≥5) accumulate, pointing at nt doctor/nt distill/nt gc (surface-appropriate: MCP points at nt_distill). The O(n²) pair scan is gated behind note.HygieneScanMaxNotes so the hottest read never pays it on large stores; doctor remains the uncapped check. Doctor and gc now share one retention constant instead of two independently hardcoded 30-day literals.

TUI: notes first

The tab order is now notes · tasks · logbook, and the TUI opens on notes — the knowledge base is the primary surface. Presentation order lives in one place (tabOrder): the header renders from it, the mouse hit-boxes are recorded in the same loop, and [ / ] / tab cycle through it, so the visual order and cycling can never disagree. The tab enum values stay stable identities (they index per-tab cursor/offset state), decoupled from display order.

Docs

• SPEC §5 documents the project: frontmatter contract (it was implemented but absent from the note-format schema); §7.3/§11 pick up the new flags and [decay].
• README's recall claim now matches the implementation (a deliberately loose precision floor + confidence tiers, not "returns nothing when nothing is relevant"), and its TUI blurb reflects the new tab order.
• The nt skill finally mentions $NT_DIR/synonyms.txt — the recall-vocabulary escape hatch existed but no skill told the agent, so a miss ("gateway" vs a note saying "ingress") had no discoverable fix at the moment it happened.

Testing

• New tests: CLI project scoping/edit/tags/hygiene (project_scope_test.go), export drift lifecycle (exportdrift_test.go), decay defaults (decaydefault_test.go), MCP equivalents (projectscope_test.go), the note-package helpers (projectkey_test.go), and updated TUI tab-order/click/cycling tests.
• Full go test ./internal/... green; -race clean on all touched packages; gofmt/go vet clean.
• A self-review pass over the branch produced three findings (ungated O(n²) scan, stale nt_search description, duplicated project-membership helper), all fixed in 604724f.