feat: implement memory and evidence administration with guided repairs

Add PostgreSQL-backed memory, editable evidence with source review and activation, and human-approved archive repairs across the harness, API, and UI. Include migrations, deployment support, regression coverage, and validation documentation.

Refresh permissions from validated session roles so existing administrator logins can access newly deployed archive management features.

backend/test/catalog-schema-routes.test.ts

@@ -117,6 +117,7 @@ async function setup(env: Record<string, string> = {}) {
   });
   const introspector: CatalogSchemaIntrospector = { scan };
   const operations = new CatalogOperationCoordinator();
+  const cleanup = vi.fn(async () => ({ code: 0, stdout: JSON.stringify({ indexed: true, deleted: 0 }), stderr: "" }));
   const registry = {
     list: vi.fn(async () => [revision]),
     listCatalog: vi.fn(async () => [{ id: "psd-clinical", name: "Policlinico San Donato", configurationState: "ready", revision }]),
@@ -124,7 +125,7 @@ async function setup(env: Record<string, string> = {}) {
     readPinned: vi.fn(async () => ({ workspace, workspaceConfigPath: revision.snapshotPath })),
   } as unknown as WorkspaceRegistry;
   const app = buildApp(loadConfig({ THT_HARNESS_DIR: "/missing", NODE_ENV: "test", ...env }), {
-    thtRunner: {} as never,
+    thtRunner: { withPrincipal: () => ({ runWithRuntimeSnapshot: cleanup }) } as never,
     workspaceRegistry: registry,
     workspaceSecretStore: new WorkspaceSecretStore({ root: secretRoot, runtimeRoot, installationId: "test" }),
     catalogRepository: repository,
@@ -133,7 +134,7 @@ async function setup(env: Record<string, string> = {}) {
     workspaceDiagnoser: vi.fn(),
   });
   return {
-    app, repository, database: (await repository.get(created.id))!, scan, operations,
+    app, repository, database: (await repository.get(created.id))!, scan, operations, cleanup,
     setObserved(next: ObservedSchemaSnapshot) { observed = next; },
   };
 }
@@ -614,6 +615,45 @@ test("waits for confirmation and rescans before applying destructive changes", a
   expect(scan).toHaveBeenCalledTimes(3);
 });
 
+test("retries committed Memory cleanup with the original removals without rescanning", async () => {
+  const { app, repository, database, scan, setObserved, cleanup } = await setup();
+  await seedCatalog(repository, database);
+  const observed = snapshot();
+  observed.tables = observed.tables.filter(t => t.name !== "visits");
+  observed.columns = observed.columns.filter(c => c.tableName !== "visits");
+  observed.relationships = [];
+  setObserved(observed);
+  cleanup.mockResolvedValueOnce({ code: 0, stdout: JSON.stringify({ indexed: false, deleted: 2 }), stderr: "" });
+  const started = await app.inject({ method: "POST", url: `/catalog/databases/${database.id}/sync-runs`,
+    payload: { version: database.version, scope: "all", tableIds: [] } });
+  const waiting = await waitFor(repository, started.json().id, "awaiting_confirmation");
+  expect(cleanup).not.toHaveBeenCalled();
+  await app.inject({ method: "POST", url: `/catalog/sync-runs/${waiting.id}/confirm`,
+    payload: { confirmationToken: waiting.confirmationToken } });
+  const failed = await waitFor(repository, waiting.id, "failed");
+  expect(failed).toMatchObject({ phase: "memory_cleanup", errorCode: "memory_cleanup_pending",
+    plannedDiff: { deletedTables: ["visits"] } });
+  expect((await repository.listTables(database.id)).map(t => t.name)).toEqual(["patients"]);
+  const callsBeforeRetry = scan.mock.calls.length;
+  const blocked = await app.inject({ method: "POST", url: `/catalog/databases/${database.id}/sync-runs`,
+    payload: { version: database.version, scope: "all", tableIds: [] } });
+  expect(blocked.statusCode).toBe(409);
+  // Simulate startup recovery and an unreachable DWH after schema application.
+  await repository.interruptActiveSyncRuns();
+  scan.mockRejectedValue(new Error("DWH unavailable"));
+  cleanup.mockResolvedValue({ code: 0, stdout: JSON.stringify({ indexed: true, deleted: 2 }), stderr: "" });
+  const retried = await app.inject({ method: "POST", url: `/catalog/sync-runs/${waiting.id}/retry` });
+  expect(retried.statusCode).toBe(202);
+  const completed = await waitFor(repository, waiting.id, "succeeded");
+  expect(completed.counts).toMatchObject({ memoryDeleted: 2 });
+  expect(scan.mock.calls.length).toBe(callsBeforeRetry);
+  expect(cleanup).toHaveBeenCalledTimes(2);
+  expect(cleanup.mock.calls[1]).toEqual(cleanup.mock.calls[0]);
+  const request = JSON.parse((cleanup.mock.calls[0] as unknown as string[])[1]!).request;
+  expect(request).toMatchObject({ sync_id: waiting.id, database: "warehouse",
+    schema_name: "datawarehouse", removed_tables: ["visits"] });
+});
+
 test("deletes every catalog table for multiple selected databases and cascades dependent metadata", async () => {
   const { app, repository, database } = await setup();
   const second = await repository.create({