feat: 将 Memori-Vault 完整代码并入 main（collab 分支）

.gitattributes

@@ -0,0 +1,11 @@
+# 二进制语料 / 测试 fixture：禁止任何行尾转换，避免 checkout 时损坏
+*.pdf  binary
+*.docx binary
+*.xlsx binary
+*.pptx binary
+*.doc  binary
+*.ppt  binary
+*.xls  binary
+*.png  binary
+*.jpg  binary
+*.gguf binary

.github/workflows/desktop-release.yml

@@ -0,0 +1,235 @@
+name: Desktop Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      publish:
+        description: "Publish release instead of keeping it as draft"
+        required: false
+        default: "false"
+        type: choice
+        options:
+          - "false"
+          - "true"
+  push:
+    tags:
+      - "v*"
+
+concurrency:
+  group: desktop-release-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    name: Build ${{ matrix.name }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Windows
+            os: windows-latest
+            artifact: windows
+          - name: Linux
+            os: ubuntu-22.04
+            artifact: linux
+          - name: macOS
+            os: macos-latest
+            artifact: macos
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+          run_install: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: "pnpm"
+          cache-dependency-path: ui/pnpm-lock.yaml
+
+      - name: Install Linux system dependencies (Tauri/WebKit/GTK)
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          if apt-cache show libwebkit2gtk-4.1-dev >/dev/null 2>&1; then
+            WEBKIT_DEV_PKG=libwebkit2gtk-4.1-dev
+          else
+            WEBKIT_DEV_PKG=libwebkit2gtk-4.0-dev
+          fi
+
+          sudo apt-get install -y \
+            pkg-config \
+            patchelf \
+            libglib2.0-dev \
+            libgirepository1.0-dev \
+            libgtk-3-dev \
+            libayatana-appindicator3-dev \
+            librsvg2-dev \
+            libsoup-3.0-dev \
+            "$WEBKIT_DEV_PKG"
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Restore Rust cache
+        uses: Swatinem/rust-cache@v2
+
+      - name: Install Tauri CLI
+        run: cargo install tauri-cli --version "^2.0" --locked
+
+      - name: Install frontend dependencies
+        run: pnpm --dir ui install --frozen-lockfile
+
+      - name: Validate version metadata
+        shell: bash
+        run: |
+          WORKSPACE_VERSION=$(python - <<'PY'
+          import pathlib, re
+          text = pathlib.Path('Cargo.toml').read_text(encoding='utf-8')
+          match = re.search(r'(?ms)^\[workspace\.package\]\s+.*?^version\s*=\s*"([^"]+)"', text)
+          if not match:
+              raise SystemExit('Failed to read workspace version from Cargo.toml')
+          print(match.group(1))
+          PY
+          )
+          UI_VERSION=$(python - <<'PY'
+          import json, pathlib
+          print(json.loads(pathlib.Path('ui/package.json').read_text(encoding='utf-8'))['version'])
+          PY
+          )
+          TAURI_VERSION=$(python - <<'PY'
+          import json, pathlib
+          print(json.loads(pathlib.Path('memori-desktop/tauri.conf.json').read_text(encoding='utf-8'))['version'])
+          PY
+          )
+          RELEASE_NOTES_PATH="docs/release/RELEASE_NOTES_v${WORKSPACE_VERSION}.md"
+
+          if [ "$WORKSPACE_VERSION" != "$UI_VERSION" ] || [ "$WORKSPACE_VERSION" != "$TAURI_VERSION" ]; then
+            echo "Version mismatch detected among Cargo workspace, ui/package.json, and memori-desktop/tauri.conf.json"
+            exit 1
+          fi
+
+          if [ ! -f "$RELEASE_NOTES_PATH" ]; then
+            echo "Missing release notes file: $RELEASE_NOTES_PATH"
+            exit 1
+          fi
+
+      - name: Build frontend
+        run: pnpm --dir ui run build
+
+      - name: Build desktop bundle
+        working-directory: memori-desktop
+        run: cargo tauri build --ci --config tauri.ci.conf.json
+
+      - name: Upload bundle artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: bundles-${{ matrix.artifact }}
+          if-no-files-found: error
+          path: |
+            target/release/bundle/**/*
+            memori-desktop/target/release/bundle/**/*
+
+  release:
+    name: Draft GitHub Release
+    needs: build
+    runs-on: ubuntu-latest
+    if: github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/')
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Resolve release version and tag
+        id: release_meta
+        shell: bash
+        run: |
+          VERSION="$(python -c "import json;print(json.load(open('memori-desktop/tauri.conf.json', encoding='utf-8'))['version'])")"
+          if [[ "${GITHUB_REF:-}" == refs/tags/* ]]; then
+            TAG="${GITHUB_REF#refs/tags/}"
+          else
+            TAG="v${VERSION}"
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+
+      - name: Validate release metadata
+        shell: bash
+        run: |
+          WORKSPACE_VERSION=$(python - <<'PY'
+          import pathlib, re
+          text = pathlib.Path('Cargo.toml').read_text(encoding='utf-8')
+          match = re.search(r'(?ms)^\[workspace\.package\]\s+.*?^version\s*=\s*"([^"]+)"', text)
+          if not match:
+              raise SystemExit('Failed to read workspace version from Cargo.toml')
+          print(match.group(1))
+          PY
+          )
+          UI_VERSION=$(python - <<'PY'
+          import json, pathlib
+          print(json.loads(pathlib.Path('ui/package.json').read_text(encoding='utf-8'))['version'])
+          PY
+          )
+          TAURI_VERSION=$(python - <<'PY'
+          import json, pathlib
+          print(json.loads(pathlib.Path('memori-desktop/tauri.conf.json').read_text(encoding='utf-8'))['version'])
+          PY
+          )
+          EXPECTED_VERSION="${{ steps.release_meta.outputs.version }}"
+          EXPECTED_TAG="v${EXPECTED_VERSION}"
+          RELEASE_NOTES_PATH="docs/release/RELEASE_NOTES_v${EXPECTED_VERSION}.md"
+
+          echo "workspace version: $WORKSPACE_VERSION"
+          echo "ui version: $UI_VERSION"
+          echo "tauri version: $TAURI_VERSION"
+          echo "release version: $EXPECTED_VERSION"
+          echo "release tag: ${{ steps.release_meta.outputs.tag }}"
+
+          if [ "$WORKSPACE_VERSION" != "$UI_VERSION" ] || [ "$WORKSPACE_VERSION" != "$TAURI_VERSION" ] || [ "$WORKSPACE_VERSION" != "$EXPECTED_VERSION" ]; then
+            echo "Version mismatch detected among Cargo workspace, ui/package.json, memori-desktop/tauri.conf.json, and resolved release version"
+            exit 1
+          fi
+
+          if [ "${{ github.event_name }}" = "push" ] && [ "${{ steps.release_meta.outputs.tag }}" != "$EXPECTED_TAG" ]; then
+            echo "Tag/version mismatch: expected $EXPECTED_TAG but got ${{ steps.release_meta.outputs.tag }}"
+            exit 1
+          fi
+
+          if [ ! -f "$RELEASE_NOTES_PATH" ]; then
+            echo "Missing release notes file: $RELEASE_NOTES_PATH"
+            exit 1
+          fi
+
+          grep -q "Memory OS Lite" "$RELEASE_NOTES_PATH"
+
+      - name: Download all build artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: release-artifacts
+          merge-multiple: true
+
+      - name: Publish draft release assets
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ steps.release_meta.outputs.tag }}
+          name: Memori-Vault ${{ steps.release_meta.outputs.version }}
+          draft: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.publish != 'true' }}
+          target_commitish: ${{ github.sha }}
+          body_path: docs/release/RELEASE_NOTES_v${{ steps.release_meta.outputs.version }}.md
+          files: |
+            release-artifacts/**/*.msi
+            release-artifacts/**/*-setup.exe
+            release-artifacts/**/*.dmg
+            release-artifacts/**/*.AppImage
+            release-artifacts/**/*.deb
+            release-artifacts/**/*.rpm
+            release-artifacts/**/*.sig

.github/workflows/perf-scale.yml

@@ -0,0 +1,71 @@
+name: Perf Scale
+
+# 50k 规模压测 CI 复跑：手动触发（可调参）+ 每周日定时全量 50k。
+# 结论阈值：并发 P50 / 顺序 P50（争用系数）不得超过 2.0，超标即本 run 失败。
+# 报告 JSON 作为 artifact 上传：perf-scale-report-<docs>/perf_scale_ci_report.json
+# 本地复跑命令见 docs/qa/PERF_SCALE_50K.md。
+
+on:
+  workflow_dispatch:
+    inputs:
+      docs:
+        description: '文档数（默认 50000 全量；排查时可跑 10000/1000 快档）'
+        required: false
+        default: '50000'
+      queries:
+        description: '查询数'
+        required: false
+        default: '300'
+      max_contention_factor:
+        description: '争用系数门槛（默认 2.0）'
+        required: false
+        default: '2.0'
+  schedule:
+    - cron: '34 2 * * 0' # 每周日 02:34 UTC（避开整点洪峰）
+
+concurrency:
+  group: perf-scale
+  # false：手动触发与周日定时 50k 并行时排队等待，而不是取消进行中的 2.5h 运行
+  # （与 desktop-release.yml 的发布型 job 先例一致）。
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  perf-scale:
+    name: perf-scale (docs=${{ github.event.inputs.docs || '50000' }})
+    runs-on: ubuntu-latest
+    # 50k 实测 ~2.5h（含建索引），留足编译与调度余量
+    timeout-minutes: 360
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Disk space check (50k DB 约 11GB，注意 runner 14GB 上限)
+        run: df -h .
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Restore Rust cache
+        uses: Swatinem/rust-cache@v2
+
+      - name: Run perf scale (offline deterministic, no rerank)
+        shell: bash
+        run: |
+          cargo run --release -p memori-core --example perf_scale -- \
+            --docs "${{ github.event.inputs.docs || '50000' }}" \
+            --sections 50 \
+            --queries "${{ github.event.inputs.queries || '300' }}" \
+            --concurrency 8 \
+            --report target/perf_scale_ci_report.json \
+            --max-contention-factor "${{ github.event.inputs.max_contention_factor || '2.0' }}"
+
+      - name: Upload report artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: perf-scale-report-${{ github.event.inputs.docs || '50000' }}
+          path: target/perf_scale_ci_report.json
+          if-no-files-found: error