Heal legacy frontmatter automatically; never hard-fail on old enum values

[execsumo]

Problem

Updating Dossier on a machine with existing dossiers errored with invalid importance: "medium". Root cause is broader than stale data: the importance/urgency schema narrowed from a three-level scale to binary high|low (SPEC.md, Eisenhower 2×2), but the write side never locked down — the MCP tool schema still advertised low|medium|high, the CLI passed non-h/l values through verbatim, and SPEC.md documented h|m|l. So even a fresh install could regenerate the error. Validation runs on every write over the whole frontmatter (fsstore.go:291), so a single bad value locked the entire record against any edit.

Fix

A general normalization layer with the invariant "map toward attention, not away": any value that is no longer a valid enum member, or a field absent from an older file, coerces to its highest-attention valid value (importance/urgency → high, status → active). Implemented once in Frontmatter.Normalize (internal/core/dossier.go) and wired at three layers so it self-heals without manual steps:

• Read / sort — CalculatePriorityScore normalizes its copy, so a legacy medium dossier sorts toward attention immediately instead of silently collapsing to low.
• Write — Service.Save heals + persists canonical + emits a Warning per coercion (surfaced via CLI/MCP/TUI).
• Startup — a version-gated one-time sweep (Service.Migrate, config.schema_version vs core.CurrentSchemaVersion) runs from wire, rewriting every stale Dossier once and logging to stderr (never stdout, so mcp serve stays clean). The gate makes it a no-op on every subsequent launch.

doctor now reports legacy values as healable rather than fatal. The write-side source of medium was also closed: MCP tool schema, CLI --importance/--urgency mapping, and the SPEC.md CLI synopsis.

Extending for a future field: add the field's Normalize + one block in Frontmatter.Normalize, and bump CurrentSchemaVersion.

Verification

• Table tests for the enum and Frontmatter normalizers (incl. idempotency), priority-score-toward-attention, Save heals+warns, and Migrate store-wide + idempotent.
• Full suite, go vet, and gofmt all clean.
• End-to-end against the real filesystem store: a hand-written legacy importance: medium file auto-healed to high on the next launch (with stderr warning + version bump), and the second run was silent.

Note for reviewers

One judgment call: an unknown status coerces to active (toward visibility). If unknown statuses should instead map to blocked (force triage), that's a one-line change.

🤖 Generated with Claude Code

https://claude.ai/code/session_016hmNrNMx38h6ewgJwJXpEp

---

Generated by Claude Code