feat(memory): add hybrid memory foundation

[SunwardL]

Summary / 概要

• Add the P0 Kun Memory foundation: durable scoped records, explainable retrieval, safe lifecycle operations, and a resilient JSON + SQLite/FTS5 storage path.
• Keep canonical JSON as the source of truth while treating SQLite/FTS5 as a disposable, rebuildable projection with bounded filesystem fallback.
• Preserve existing installations and import workflows: legacy JSON records and the previous human-readable Markdown profile format continue to work.
• Add a complete Settings > Memory management surface and finish 9/9 real-Electron acceptance scenarios.

Why / 背景

Kun previously had a basic file-backed memory surface, but it did not provide the lifecycle, scope isolation, diagnostics, ranking evidence, or recovery guarantees needed for dependable long-lived memory. This change establishes those P0 contracts without introducing semantic/vector retrieval or making the native index a new source of truth.

The implementation was rebased onto develop@53fc235b, after #1257 and #1260 landed. That keeps the Memory work on top of the current quality and cross-platform packaging baseline.

Architecture and behavior / 架构与行为

Canonical records and backward compatibility

• Extend the versioned Memory record with type, authority, importance, evidence sources, temporal validity, disabled/deleted lifecycle fields, and audit timestamps.
• Normalize legacy JSON records that do not contain the new fields, supplying safe defaults without rewriting the caller's input.
• Continue loading legacy records from the existing store and quarantine ambiguous legacy workspace records rather than allowing cross-workspace leakage.
• Preserve the existing HTTP, TUI, Manager serialization, tool, and renderer paths while adding the new optional fields.

Hybrid storage and recovery

• Keep one canonical JSON file per record; writes use temp-file + rename semantics and deletion creates a tombstone.
• Add a transactional SQLite/FTS5 projection for bounded lexical candidate retrieval.
• Backfill and reconcile the projection from canonical JSON with resumable, idempotent migrations.
• Fall back to bounded filesystem retrieval when SQLite is unavailable, stale, or incompatible; recovery rebuilds the projection and returns diagnostics to ready.
• Redact credentials plus Windows, UNC, POSIX absolute, and file:// paths from degraded reasons while retaining useful platform/ABI diagnostics.

Retrieval and safety

• Enforce global/workspace/project scope before ranking and prompt injection.
• Exclude disabled, deleted, expired, and temporally invalid records.
• Rank deterministically from lexical relevance, scope affinity, type affinity, freshness, importance, and confidence.
• Enforce record-count and prompt-character budgets and expose a bounded retrieval trace explaining selection, filtering, truncation, channel, and scores.
• Treat retrieved memory as quoted context rather than executable instruction.

Settings UI and portable import/export

• Add create, edit, search, disable, restore, delete, diagnostics, degraded-state, and recovery flows under Settings > Memory.
• Create/edit supports scope/path, tags, confidence, type, and importance with complete dirty tracking and [0,1] validation.
• Retain the previous human-readable categorized Markdown import format.
• Append a strictly validated kun-memory-v2 block for portable round-trip of business fields, bounded sources, temporal fields, expiry, and disabled state.
• Generate fresh IDs and audit timestamps on structured import, omit tombstones, preserve record-owned scope/path, reject unsupported/invalid V2 data as a whole, and deduplicate by content + scope + target path.

Backward-compatibility guarantees / 向后兼容保证

• Legacy JSON without the P0 fields is accepted and normalized; focused store/contract tests cover this path.
• Legacy Markdown profile import remains available and still uses the scope/path selected in the import dialog.
• Existing record identity and canonical files are not bulk rewritten during read or migration.
• The native index can be deleted or fail to load without losing canonical records or blocking chat startup.
• No vector database, embeddings, cloud sync, autonomous extraction pipeline, or cross-user sharing is introduced in this P0.

Media / 截图或录屏

• Attached GIF: continuous real-Electron flow covering create, retrieval explanation, SQLite degradation, filesystem fallback, reconciliation, and recovery.
• The same isolated acceptance run also captured per-scenario screenshots and structured diagnostics for all 9 scenarios.

Tests / 测试

Local validation after the final rebase:

• Memory/compatibility focused Vitest: 39/39 renderer/shared tests and 51/51 Kun tests passed.
• Root Vitest: 8,695 passed, 5 skipped.
• npm run lint: 0 errors (30 pre-existing React Hooks warnings).
• npm run check:file-lines: 6,659 tracked files passed the 700-line gate.
• npm run typecheck: passed.
• npm run build:kun: passed.
• npm run build: passed.
• openspec validate add-kun-memory-foundation --strict: passed.
• git diff --check: passed.
• Real-Electron UI acceptance: 9/9 passed — create; edit/search; disable/restore; delete/tombstone; V2 import/export; scope isolation; restart persistence; SQLite degradation; stale recovery.

Windows-local aggregate notes:

• The full root and extension suites pass. The aggregate npm test reaches two upstream-identical, non-Memory Windows/POSIX harness assertions: NTFS does not expose the asserted 0700 directory mode, and the daily workflow test invokes /bin/bash without a Windows-visible node.
• The PR's Ubuntu Quality job is the authoritative full standard-command result. The five packaging jobs are the authoritative Windows x64, macOS x64/arm64, Linux x64, and Linux ARM64 artifact result.

Validation / 验证

• I agree that this contribution is submitted under the Contributor License Agreement. / 我同意本贡献遵循 Contributor License Agreement 提交。
• npm run test — local component suites passed; awaiting this PR's Ubuntu Quality job for the standard aggregate command.
• npm run typecheck
• npm run build
• npm run dev (real-Electron acceptance completed)
• UI change: video or GIF attached
• Logic change: unit tests added or updated

Review guidance / 评审提示

The change is organized as four commits:

1. feat(memory): add hybrid memory foundation
2. fix(memory): complete foundation recovery gates
3. fix(memory): close foundation UI acceptance gaps
4. docs(memory): record final rebase validation

The OpenSpec proposal, design, two capability specs, task checklist, bilingual architecture documentation, and reproducible retrieval evaluation are included in the diff. Please pay particular attention to scope filtering, tombstone behavior, legacy normalization, V2 import validation, and degraded/recovery semantics.

[SunwardL]

UI acceptance evidence (P0 Task 0.6, 9/9 scenarios):