feat(recall): add bounded atomic memory manifest

desktop/VALIDATION.md

@@ -47,11 +47,11 @@ The native `get_server_info` adapter and full real-Server harness were exercised
 
 The native suite passed all 61 tests, including synthetic HTTP regressions for missing/denied/unavailable/invalid/incompatible discovery, optional-field additions, operation membership, duplicate deployment-identity fields, qualification isolation, cancellation, credentials and uncertain writes. A synthetic HTTP regression verifies that a qualified connection blocks Scope requests after discovery returns 503 and allows them again after an explicit successful recheck. The bundled-product qualification test also exercised explicit Scope browsing through the normal manager. All 116 frontend tests passed, including distinct bilingual discovery diagnostics, replacement of a temporary-failure diagnostic after a successful recheck, and per-operation Memory/Scope gating with restriction reasons while independently supported operations remain available, including exact-read gating for records returned by a save. Clippy with `--all-targets -- -D warnings`, Rust formatting, generated contract drift, IPC export drift, frontend lint/type checks/build and seven focused Python contract/fixture tests passed. Generation was executed from a Windows checkout whose path contains a space. Repository hooks passed except default Windows `ty check`, which reported POSIX-only attributes in unchanged Python modules; `ty check --python-platform linux` passed. Synthetic HTTP and UI fixtures establish local status/recovery handling, not installed-host or release acceptance.
 
-The historical Server c535d816 protocol qualification below records the specific source, wheel and operation identities independently of the CI-only fixture. It does not establish installed UI or release acceptance. The focused `server_probe <fixture.json> discovery-only` mode calls discovery without readiness or Memory requests and accepts the full probe's fixture format. Historical product records remain unchanged; the locally generated qualification file is a CI-only fixture. This historical discovery qualification retains its original contract digest; the current-contract records retain their ten independently qualified operations and do not add discovery qualification. Deployment-aware read/write fencing, explicit readiness separation, local setup approval handoff and installed Windows/macOS qualification remain separate acceptance requirements.
+The historical Server c535d816 protocol qualification below records the specific source, wheel and operation identities independently of the CI-only fixture. It does not establish installed UI or release acceptance. The focused `server_probe <fixture.json> discovery-only` mode calls discovery without readiness or Memory requests and accepts the full probe's fixture format. Historical product records remain unchanged; the locally generated qualification file is a CI-only fixture. This historical discovery qualification retains its original contract digest; the `cc5980f0`, `dd62723d` and `4ffdf4e9` records retain their ten independently qualified operations and do not add discovery qualification. The `cc5980f0` acceptance predates the native discovery adapter and does not establish real-Server acceptance of the combined client and Server sources. Deployment-aware read/write fencing, explicit readiness separation, local setup approval handoff and installed Windows/macOS qualification remain separate acceptance requirements.
 
 ## Compatibility scope
 
-[compatibility.json](src-tauri/src/connections/compatibility.json) preserves the recorded Server sources, normalized OpenAPI contract digests and qualification-wheel digests for the historical profiles below. The current contract has source-specific qualifications `sqlite-atomic-dd62723d-v1` and `sqlite-atomic-4ffdf4e9-v1` below. Ordinary builds require explicitly selecting the record whose tested Server source and wheel match the deployment, then checking the connection before business operations become available. The `dd62723d` record covers the migration-framework sources; the `4ffdf4e9` record covers the earlier release-preparation sources. The `sqlite-atomic-c535d816-v1`, `sqlite-atomic-98275dbb-v1`, `sqlite-atomic-1da99747-v1`, `sqlite-atomic-8f10c560-v1`, `sqlite-atomic-d9a78567-v1`, `sqlite-atomic-caf2a35a-v1`, `sqlite-atomic-683e2db0-v1` and `sqlite-atomic-cab054db-v1` records qualify their corresponding Server source deployments and do not match this bundled contract. Historical records are disabled in the selector, and saved unavailable selections remain visible until explicitly replaced. CI builds have their own artifact identities and do not change product qualification.
+[compatibility.json](src-tauri/src/connections/compatibility.json) preserves each recorded Server source, normalized OpenAPI contract digest, qualification-wheel digest and operation set. The bundled contract digest matches `sqlite-atomic-cc5980f0-v1`, which records the ten protocol operations qualified below. The `sqlite-atomic-dd62723d-v1` and `sqlite-atomic-4ffdf4e9-v1` records retain their migration-framework and release-preparation source qualifications with their original contract digest. Other historical records also retain their exact identities and evidence. Ordinary builds require explicitly selecting the record whose tested Server source and wheel match the deployment, then checking the connection before business operations become available. Records with a different contract digest are disabled in the selector, and saved unavailable selections remain visible until explicitly replaced. Selecting a profile does not extend its recorded operation set or qualify a different Server source. CI builds have their own artifact identities and do not change product qualification.
 
 The real Server harness covers SQLite with anonymous loopback, static Bearer, HTTPS with explicit CA/base path, and injected-provider/enforced access. It exercises save/search/exact reads, identity changes, binding revocation, ambiguous writes without replay and Scope pagination. Installed UI checks cover repeated launches preserving the existing editor, late committed-save responses preserving a new Scope draft, explicit connection/Scope selection, clipboard copies, connection isolation, draft cancellation, byte limits and independent Server survival after Desktop exit.
 
@@ -61,10 +61,100 @@ Selecting a compatibility profile does not attest the remote binary identity. Ex
 
 ### Server protocol qualification records
 
+#### Server cc5980f0 protocol qualification
+
+`sqlite-atomic-cc5980f0-v1` qualifies Server sources at
+`cc5980f01610f32b2f86b4d4068dd72a0408a500` for OpenAPI digest
+`fd8f5dcf8dfb1a02c186623c08c3c62217ecdbc21a80cd5d9c329f3497b85f7d`.
+The wheel `powercontext-1.4.1.dev211+gcc5980f0-py3-none-any.whl` has SHA-256
+`443f5ec8c73148045caadbba09cf6f08cc6e17329fcf9764378ebcc2cb03ba7c`.
+It was built from `git archive` of that commit with
+`SETUPTOOLS_SCM_PRETEND_VERSION=1.4.1.dev211+gcc5980f0 uv build --wheel`.
+All 614 packaged runtime files across `powercontext/` and `powercontext_service_bootstrap/`
+match the archived sources byte for byte. Their manifest digest (sorted `wheel/path sha256`
+lines with a final newline) is
+`ea0a886acb5092548822b43b2dcee7f3e414a5ffba7d6bdc0b193ac311e157c1`.
+The OpenAPI contract, project configuration and lock also match that commit.
+
+On 2026-10-27, macOS 26.6.2 ARM64, Python 3.13.12 and Rust 1.99.1 ran
+`desktop/tests/real_server.py` with the freshly built native `server_probe` against
+independent SQLite Server processes loaded from that wheel. Anonymous loopback,
+static Bearer, HTTPS with an explicit CA/base path, and injected-provider/enforced
+access all passed. The ten operations recorded in the profile cover liveness,
+readiness, access principal, capabilities, Scope listing/detail/default, Atomic Memory
+save/search and exact Artifact revision reads. The same native connection manager also
+passed Scope pagination, identity changes, same-identity revocation, committed writes
+with lost responses without replay, and independent Server survival after client exit.
+
+The client Rust sources, Cargo manifest/lock and qualification harnesses match the
+recorded commit. The candidate fixture profile supplied the exact wheel/contract identity
+to the probe. Evidence is
+retained locally in ignored `desktop/.artifacts/real-server.json`,
+`desktop/.artifacts/qualification-wheel-identity.json`,
+`desktop/.artifacts/qualification-cc5980f0/` and `desktop/.artifacts/server-wheel/`.
+
+`cargo test --locked --manifest-path desktop/src-tauri/Cargo.toml` passed all 62 tests,
+including `bundled_qualification_allows_explicit_scope_browsing`, with this product record.
+
+This qualifies the listed SQLite protocol operations on that host. Windows execution,
+installed UI, native credential persistence, signing and packaging require their own
+acceptance checks. Historical profiles retain their original identities and evidence.
+
+2026-10-27，使用上述提交的归档源码构建独立 wheel，并逐文件核对 614 个运行时文件及
+OpenAPI、项目配置和锁文件。原生探针通过匿名回环、Bearer、显式 CA／路径前缀 HTTPS
+及强制访问控制四种真实 SQLite 协议验收，覆盖所列十项操作、Scope 分页、身份变更、
+同身份撤权、响应丢失后不重放已提交写入及客户端退出后 Server 独立存活。该记录仅覆盖
+上述主机的协议行为，不包含 Windows、安装界面、原生凭据持久化、签名或打包验收。
+包含随包兼容资格用例在内的全部 62 项 Rust 测试通过。
+
+On 2026-10-28, the macOS ARM64 checkout adapter also passed all four modes against
+the same archived wheel. The native `server_probe` executable had SHA-256
+`c88e62723a05419b144282eedd90207cdd1d670a73aef2ec1b84eb94cfdc3d84`.
+This run used the disposable CI fixture profile, including `get_server_info`, and
+`cargo test --locked --manifest-path desktop/src-tauri/Cargo.toml` passed. Evidence
+is retained in ignored `desktop/.artifacts/qualification-cc5980f0-client-oct28/`.
+These results verify the checkout adapter against that archived Server; they do
+not extend the product profile's ten qualified operations or validate subsequent
+Server migration code.
+
+2026-10-28，macOS ARM64 上的当前检出客户端使用相同归档 wheel，再次通过四种连接模式，
+并通过全部 Rust 测试。本次使用包含 `get_server_info` 的临时 CI 资格记录，仅验证客户端
+与该归档 Server 的协议交互，不扩大产品记录的十项操作范围，也不验证后续 Server 迁移代码。
+
+#### Server 777bfdb7 protocol qualification
+
+`sqlite-atomic-777bfdb7-v1` qualifies Server sources at
+`777bfdb7ef45e1380a8a9ea6d6639149924b639f` for OpenAPI digest
+`f5e455eabb8d0e0353d963141802df5b14a4c1fdbb1a4a64ed1cfab6235730f1`.
+The wheel `powercontext-1.4.1.dev202+g777bfdb7-py3-none-any.whl` has SHA-256
+`9b0543d1c907774ea0f35d4b804b87c3f927925eb65661ebc6e7a1a184412199`.
+It was built from `git archive` of that commit with the distribution version supplied explicitly.
+All 553 packaged runtime files match the archived sources byte for byte. Their manifest digest
+(sorted `wheel/path sha256` lines with a final newline) is
+`55b6e3fcbb95f0d29d1ccecefd4d757498e305f23df1421b7f529bacedb0c07f`.
+
+On 2026-10-26, macOS 26.6.2 ARM64, Python 3.13.12 and Rust 1.99.1 ran
+`desktop/tests/real_server.py` with the native `server_probe` against independent SQLite
+Server processes loaded from that wheel. Anonymous loopback, static Bearer, HTTPS with an
+explicit CA/base path, and injected-provider/enforced access all passed. The ten listed
+operations cover save/search/exact revision reads, Scope pagination, identity changes,
+same-identity revocation, committed writes with lost responses without replay, and independent
+Server survival after client exit. The client was built from commit `777bfdb7`; the working
+tree also contained a persistence projection change, which was excluded from the archived
+Server wheel and does not change the native client. Evidence is retained locally in ignored
+`desktop/.artifacts/real-server.json` and `desktop/.artifacts/server-wheel/`.
+This qualifies the listed SQLite protocol operations, not manifest descriptions, Windows
+execution, native vaults, installed UI, signing or packaging. Historical records keep their
+original source, contract and wheel identities.
+
+2026-10-26，使用上述提交的归档源码构建独立 wheel，并逐文件核对 553 个运行时文件。
+原生探针通过匿名回环、Bearer、显式 CA／路径前缀 HTTPS 及强制访问控制四种真实 SQLite
+协议验收。该记录仅覆盖所列十项操作，不包含 manifest 摘要、Windows、安装包或原生凭据库验收。
+
 #### Server 4ffdf4e9 protocol qualification
 
 `sqlite-atomic-4ffdf4e9-v1` qualifies the v1.4.1 preparation sources at
-`4ffdf4e97ad43c55d8718a1df581596db2e6097d` for the bundled OpenAPI digest
+`4ffdf4e97ad43c55d8718a1df581596db2e6097d` for OpenAPI digest
 `c12901b88b8e958c9cd63469298b9a04b9d5e2b0b4564d83b50f7ae95542519a`.
 The qualification wheel is `powercontext-1.4.1.dev176+g4ffdf4e97-py3-none-any.whl`, SHA-256
 `33079ebc5eb61d03dd4cccc0d104c47b0415beab1502a5b01fbc38f2cc30af2b`, built from that clean commit.

desktop/src-tauri/src/connections/compatibility.json

@@ -209,6 +209,44 @@
     ],
     "evidence": "desktop/VALIDATION.md#server-98275dbb-protocol-qualification"
   },
+  {
+    "id": "sqlite-atomic-777bfdb7-v1",
+    "serverCommit": "777bfdb7ef45e1380a8a9ea6d6639149924b639f",
+    "contractSha256": "f5e455eabb8d0e0353d963141802df5b14a4c1fdbb1a4a64ed1cfab6235730f1",
+    "artifactSha256": "9b0543d1c907774ea0f35d4b804b87c3f927925eb65661ebc6e7a1a184412199",
+    "operations": [
+      "get_liveness",
+      "get_readiness",
+      "get_access_principal",
+      "get_capabilities",
+      "list_scopes",
+      "get_scope",
+      "get_default_scope",
+      "remember_memory",
+      "search_memory",
+      "get_artifact_revision"
+    ],
+    "evidence": "desktop/VALIDATION.md#server-777bfdb7-protocol-qualification"
+  },
+  {
+    "id": "sqlite-atomic-cc5980f0-v1",
+    "serverCommit": "cc5980f01610f32b2f86b4d4068dd72a0408a500",
+    "contractSha256": "fd8f5dcf8dfb1a02c186623c08c3c62217ecdbc21a80cd5d9c329f3497b85f7d",
+    "artifactSha256": "443f5ec8c73148045caadbba09cf6f08cc6e17329fcf9764378ebcc2cb03ba7c",
+    "operations": [
+      "get_access_principal",
+      "get_artifact_revision",
+      "get_capabilities",
+      "get_default_scope",
+      "get_liveness",
+      "get_readiness",
+      "get_scope",
+      "list_scopes",
+      "remember_memory",
+      "search_memory"
+    ],
+    "evidence": "desktop/VALIDATION.md#server-cc5980f0-protocol-qualification"
+  },
   {
     "id": "sqlite-atomic-4ffdf4e9-v1",
     "serverCommit": "4ffdf4e97ad43c55d8718a1df581596db2e6097d",

desktop/src-tauri/src/transport/api.rs

@@ -402,6 +402,7 @@ impl ServerApi {
             text: text.to_owned(),
             reason: None,
             expected_revision: None,
+            description: None,
         };
         let body = serde_json::to_value(request)
             .map_err(|_| ApiFailure::before(SafeError::InvalidInput))?;

desktop/src-tauri/src/transport/operations.json

@@ -1,5 +1,5 @@
 {
-  "contractSha256": "c12901b88b8e958c9cd63469298b9a04b9d5e2b0b4564d83b50f7ae95542519a",
+  "contractSha256": "fd8f5dcf8dfb1a02c186623c08c3c62217ecdbc21a80cd5d9c329f3497b85f7d",
   "operations": {
     "get_liveness": {
       "method": "GET",

desktop/src-tauri/src/transport/wire.rs

@@ -1232,6 +1232,16 @@ pub struct RememberMemoryRequest {
         skip_serializing_if = "Option::is_none"
     )]
     pub expected_revision: Option<Option<i64>>,
+    /// Optional supplied single-line summary. When omitted, the Server stores a whitespace-collapsed text prefix of at most 200 Unicode characters, including a trailing ellipsis when truncated. Explicit writes do not invoke a generation model.
+    #[ts(optional)]
+    #[ts(type = "string | null")]
+    #[serde(
+        rename = "description",
+        default,
+        with = "::serde_with::rust::double_option",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub description: Option<Option<String>>,
 }
 
 impl RememberMemoryRequest {
@@ -1243,6 +1253,7 @@ impl RememberMemoryRequest {
             text,
             reason: None,
             expected_revision: None,
+            description: None,
         }
     }
 }