@@ -236,7 +236,7 @@ Shows whether learning is on, whether automatic promotion is on with its last pr
 
 A correction matches a lesson when it names one of the lesson's backtick identifiers plus another word from the lesson, or contains most of the lesson's words. The text output lists only lessons with a matching correction and summarizes the rest as "no observed correction". That is not proof the agent followed them. Corrections are recorded only while capture is on. Status also lists up to 5 identifiers that were corrected in 2 or more sessions with no matching current lesson. They are taken from your local corrections and never leave the project. If the analysis fails, status shows `Recurrence unavailable` (`recurrence_error` in JSON), and the rest of the status still prints.
 
-When the current text of a lesson has `recurred` in 2 or more sessions, reflection marks it `r:N` in the playbook it sends the model. The model is asked to make the lesson clearer or more specific, never weaker. The result is a candidate like any other and goes through the same review or automatic-promotion gates.
+When the current text of a lesson has `recurred` in 2 or more sessions, reflection marks it `r:N` in the playbook it sends the model. The model is asked to make the lesson clearer or more specific when the feedback shows the wording is unclear, and to keep it when the agent simply did not follow a correct rule. The result is a candidate like any other and goes through the same review or automatic-promotion gates.
 
 ```bash
 altimate-code learn status
 
@@ -92,16 +92,22 @@ export interface MessageLike {
   time?: { created?: number; completed?: number }
 }
 
-export type TurnMessage = MessageLike & { synthetic?: boolean; compaction?: boolean }
+export type TurnMessage = MessageLike & { synthetic?: boolean; compaction?: boolean; replay?: boolean }
 
-/** Session history as turn boundaries: all-synthetic text continues a turn; a compaction part marks compaction. */
-export function turnMessages(messages: readonly { info: MessageLike; parts: readonly { type: string; synthetic?: boolean }[] }[]): TurnMessage[] {
+type TurnPart = { type: string; synthetic?: boolean; metadata?: Record<string, unknown> }
+
+/**
+ * Session history as turn boundaries. All-synthetic text continues a turn unless the message carries user input
+ * (an attachment or agent mention, whose text companions are synthetic). Compaction and its replay are marked.
+ */
+export function turnMessages(messages: readonly { info: MessageLike; parts: readonly TurnPart[] }[]): TurnMessage[] {
   return messages.map(({ info, parts }) => {
     const text = parts.filter((part) => part.type === "text")
     return {
       ...info,
-      synthetic: text.length > 0 && text.every((part) => part.synthetic),
+      synthetic: text.length > 0 && text.every((part) => part.synthetic) && !parts.some((part) => part.type === "file" || part.type === "agent"),
       compaction: parts.some((part) => part.type === "compaction"),
+      replay: text.some((part) => typeof part.metadata?.learnOriginalMessage === "string"),
     }
   })
 }
@@ -114,7 +120,7 @@ export function correctedTurnStart(messages: readonly TurnMessage[], messageID:
   const end = messages.findIndex((message) => message.id === messageID && message.role === "user")
   if (end < 0) return
   const previous = messages.slice(0, end).findLastIndex((message) => message.role === "user" && !message.synthetic && !message.compaction)
-  if (previous < 0) return
+  if (previous < 0 || messages[previous].replay) return
   if (messages.slice(0, previous).findLast((message) => message.role === "user")?.compaction) return
   return messages.slice(previous + 1, end).find((message) => message.role === "assistant")?.time?.created
 }
 
@@ -103,10 +103,12 @@ export async function readShownSnapshots(root: string, options: { limit?: number
   for (const { file } of files.sort((a, b) => b.mtime - a.mtime || a.file.localeCompare(b.file)).slice(0, limit)) {
     try {
       const state = State.parse(JSON.parse((await read(root, file)) ?? ""))
+      if (path.basename(file) !== Store.sha256(state.session) + ".json") throw new Error("Learn session state belongs to another session")
       snapshots.push({ session: state.session, shown: state.shown.map(({ name, lesson, tier, at }) => ({
         name, id: lesson.id, textHash: lessonTextHash(lesson.text), tier, at,
       })) })
     } catch (error) {
+      if (error instanceof SafeFS.UnsafeLearnPathError) throw error
       coverage.sessions_skipped_malformed++
       log.warn("learn session snapshot skipped", { file, error })
     }
 
@@ -36,4 +36,4 @@ Bullet text rules (deterministic checks reject unsafe content and flag verificat
 Output: a JSON object {"deltas": [...]}. Each delta is {"op": "ADD"|"EDIT"|"REMOVE"|"HELPFUL"|"HARMFUL", "id": "<bullet id, for every op except ADD>", "text": "<bullet text, for ADD and EDIT>", "reason": "<one short sentence citing the feedback>"}.
 Optional fields: "supersedes": "<existing bullet id>" for ADD, and "coexists": ["<existing bullet id>", ...] for ADD or EDIT. Omit these fields when they do not apply.
 
-r = sessions where this rule was shown and the user still corrected the same topic; consider making it more specific or clearer (EDIT), never weaker
+r = sessions where this rule was shown and the user still corrected the same topic. If the feedback shows the wording is unclear or incomplete, EDIT it to be clearer or more specific. If the agent simply did not follow a correct rule, keep it. Narrow a rule only when the feedback shows it is too broad; never drop the behavior it requires.
@@ -107,7 +107,8 @@ export function attribute(signals: readonly Signal[], snapshots: readonly ShownS
   }
 }
 
-export async function analyzeRecurrence(root: string, options: { limit?: number } = {}) {
+/** With `name`, only that store's lessons and signals are attributed. */
+export async function analyzeRecurrence(root: string, options: { limit?: number; name?: string } = {}) {
   const { snapshots, coverage } = await readShownSnapshots(root, options)
   const dir = path.join(root, ".altimate-code", "learn")
   await SafeFS.assertSafePath(root, dir)
@@ -121,6 +122,7 @@ export async function analyzeRecurrence(root: string, options: { limit?: number
   for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
     if (!entry.isDirectory()) continue
     try { validateName(entry.name) } catch { continue }
+    if (options.name !== undefined && entry.name !== options.name) continue
     if (sessions.size) signals.push(...(await readSignalsSnapshot(root, entry.name)).filter((signal) => sessions.has(signal.sessionID)))
     const file = Store.paths(root, entry.name).approved
     try {
 
@@ -108,7 +108,7 @@ export async function reflectCore(input: ReflectCoreInput): Promise<ReflectCoreR
   const digest = buildDigest(input.source)
   const snapshot = await prepareReflection(root, name, input.applyPaths)
   const originalText = new Map(Playbook.bullets(snapshot).map((b) => [b.id, b.text]))
-  const recurrence = await analyzeRecurrence(root).catch((error) => {
+  const recurrence = await analyzeRecurrence(root, { name }).catch((error) => {
     log.warn("learn recurrence unavailable", { error })
     return undefined
   })
 
@@ -381,7 +381,7 @@ const StatusCommand = effectCmd({
           retired: (await Store.loadRetired(root, name)).length,
           open_signals: signals.length,
           // Attribution is advisory; its failure must not hide the rest of the status.
-          ...await analyzeRecurrence(root).then((recurrence) => ({ recurrence }), (error) => ({ recurrence_error: error instanceof Error ? error.message : String(error) })),
+          ...await analyzeRecurrence(root, { name }).then((recurrence) => ({ recurrence }), (error) => ({ recurrence_error: error instanceof Error ? error.message : String(error) })),
           pending_recoveries: sessions.length,
           pending_replacements: (await Store.readPendingReplacements(root, name)).length,
           backoff_sessions: sessions.filter((session) => (state.recoveries[session]?.retryAt ?? 0) > Date.now()).length,
 
@@ -370,6 +370,11 @@ describe("correction turn start", () => {
     expect(mapped.map(({ synthetic, compaction }) => [synthetic, compaction])).toEqual([
       [false, false], [false, false], [true, false], [false, true], [false, false],
     ])
+    const [attachment, replay] = turnMessages([
+      { info: info("attach", "user", 4000), parts: [{ type: "text", synthetic: true }, { type: "file" }] },
+      { info: info("replay", "user", 4100), parts: [{ type: "text", metadata: { learnOriginalMessage: "u1" } }] },
+    ])
+    expect([attachment.synthetic, replay.synthetic, replay.replay]).toEqual([false, false, true])
   })
   test("a replayed request after compaction has no known turn start", () => {
     const at = (id: string, role: string, created: number, extra = {}) => ({ id, sessionID: "s", role, time: { created, completed: created + 1 }, ...extra })
@@ -379,6 +384,9 @@ describe("correction turn start", () => {
       at("replay", "user", 3200), at("final", "assistant", 4000), at("correction", "user", 5000),
     ]
     expect(correctedTurnStart(compacted, "correction")).toBeUndefined()
+    // A replay marked by its text metadata is unknown even when no marker precedes it.
+    const marked = compacted.filter((m) => m.id !== "marker").map((m) => m.id === "replay" ? { ...m, replay: true } : m)
+    expect(correctedTurnStart(marked, "correction")).toBeUndefined()
     // A manual compaction without a replay leaves the original request as the boundary.
     expect(correctedTurnStart(compacted.filter((m) => m.id !== "replay"), "correction")).toBe(2000)
   })
 
@@ -176,7 +176,7 @@ describe("learn opt-in and status", () => {
       lessons: [], unmatched_topics: [],
       coverage: { sessions_analyzed: 0, sessions_skipped_malformed: 0, truncated: false },
     })
-    const shown = await learn(dir.path, "status")
+    const shown = await runLearn(dir.path, ["status"], undefined, { ALTIMATE_LEARN: "0" })
     expect(shown.stdout).toContain("Recurrence (observed counts need capture on)")
     expect(shown.stdout).toContain("no matching current lesson")
   })
 
@@ -150,7 +150,9 @@ describe("recurrence attribution", () => {
   })
 
   test("human status reports coverage, uncertainty and no matching current lesson", () => {
-    const text = formatRecurrence({ ...run([]), coverage: { sessions_analyzed: 1, sessions_skipped_malformed: 0, truncated: false } })
+    const unmatched = (session: string) => signal(session, { id: `sig_u_${session}`, text: "No, filter out _is_deleted rows" })
+    const text = formatRecurrence({ ...run([unmatched("s1"), unmatched("s2")], [snapshot("s1"), snapshot("s2")]), coverage: { sessions_analyzed: 2, sessions_skipped_malformed: 0, truncated: false } })
+    expect(text).toContain("    _is_deleted: 2 sessions (sig_u_s1, sig_u_s2)")
     expect(text).toContain("Recurrence")
     expect(text).toContain("no observed correction")
     expect(text).toContain("counts need capture on")
@@ -168,8 +170,8 @@ test("snapshot analysis is bounded, skips malformed files and never repairs any
       name: lesson.name, lesson: { ...lesson.lesson, tags: [], scope: "project", helpful: 0, harmful: 0, applied: 0, created: time(0), updated: time(0) },
       tier: "file", at: time(1), queryHash: "hash",
     }], requests: [], compactions: [], counted: [] })
-    const old = path.join(dir, "old.json")
-    const good = path.join(dir, "good.json")
+    const old = path.join(dir, Store.sha256("old") + ".json")
+    const good = path.join(dir, Store.sha256("s1") + ".json")
     const bad = path.join(dir, "bad.json")
     await fs.writeFile(old, JSON.stringify(state("old")))
     await fs.writeFile(good, JSON.stringify(state("s1")))
@@ -190,5 +192,15 @@ test("snapshot analysis is bounded, skips malformed files and never repairs any
     expect(await fs.readFile(signals, "utf8")).toBe(raw)
     expect((await fs.readdir(p.learnDir)).sort()).toEqual([path.basename(p.approved), "signals.jsonl"].sort())
     expect((await readShownSnapshots(root, { limit: 0 })).coverage).toMatchObject({ sessions_analyzed: 0, truncated: true })
+    // A copied snapshot under another session's file name is not that session's evidence.
+    await fs.copyFile(good, path.join(dir, Store.sha256("copy") + ".json"))
+    expect((await readShownSnapshots(root)).coverage).toMatchObject({ sessions_analyzed: 2, sessions_skipped_malformed: 2 })
+    // Another store's lessons and signals stay out of a named analysis.
+    expect((await analyzeRecurrence(root, { name: "other-store" })).lessons.every((row) => row.recurred === 0)).toBe(true)
+    // Unbounded, both valid sessions ("old" and "s1") carry a matching correction after exposure.
+    expect((await analyzeRecurrence(root, { name: lesson.name })).lessons[0]).toMatchObject({ recurred: 2 })
+    // An unsafe snapshot path fails closed instead of counting as malformed.
+    await fs.symlink(good, path.join(dir, Store.sha256("link") + ".json"))
+    await expect(readShownSnapshots(root)).rejects.toThrow()
   } finally { await fs.rm(root, { recursive: true, force: true }) }
 })