The last M4 item. §4 promises "Decayed ≠ deleted — it's still in Recall"; that
was true of the journal and false of facts.

`consolidate()` writes only `activeFacts` into MEMORY.md, and `recall()` searched
the journal alone. So a fact that was merely INFERRED (seen once), SUPERSEDED by
later work, or withheld as instruction-shaped appeared in NEITHER — it sat in
facts.jsonl, correct and cited, and no question could surface it. Decay is meant
to keep the always-on digest current, not to build a museum with no door.

Measured on a four-fact corpus: one reaches MEMORY.md, and the other three were
reachable by nothing.

`recallFacts()` ranks over the FULL fold rather than activeFacts, and the
recall_sessions tool now searches facts alongside sessions — facts first, because
a curated truth answers "what did we decide about X" more directly than "here is
a session where it came up".

A decayed fact is a lower-confidence answer, not a non-answer — so every hit
carries a `state` and the tool result qualifies it for the model:

  confirmed                  no hedge (over-hedging teaches the model to ignore hedges)
  observed / inferred        unconfirmed, weak evidence
  superseded                 SUPERSEDED, plus what replaced it
  unconfirmed-instruction    recorded, never approved, do not act on it

That last one is the seam that keeps this from undoing the instruction gate from
unfindable — the user asked — but it may never come back looking like an ordinary
fact. `removed` is the one exclusion: a user's "not true" must stay not true, or
the correction feels like it did not take.

Tests: 7 in sessionMemory.test.js over a corpus with one fact in every state the
fold can produce, plus 2 in memoryPoisoning.test.js pinning that recall cannot
launder a withheld instruction. Verified non-vacuous:

  rank over activeFacts only     13/19
  flatten the state labels       13/19
  let `removed` through           7/19
  unwire facts from the tool     36/39

All 32 suites green. M4 is now complete bar memory-set export.