feat: implement memory and evidence administration with guided repairs

Add PostgreSQL-backed memory, editable evidence with source review and activation, and human-approved archive repairs across the harness, API, and UI. Include migrations, deployment support, regression coverage, and validation documentation.

Refresh permissions from validated session roles so existing administrator logins can access newly deployed archive management features.

docs/plans/2026-09-09-memory-m3-validation.md

@@ -0,0 +1,78 @@
+# Memory M3 — validation
+
+Implemented on 2026-09-09 in the rapid-harbor worktree.
+
+## Delivered behavior
+
+- F8 presents an editable summary of proposed additions, explicit updates and links.
+  Only selected content is saved, including the optional solved-question exemplar.
+- Proposals reference effective approved decisions. Exact existing content is reused.
+  Concurrent edits invalidate an update; manual identities and origins are preserved.
+- Selected cards and links commit atomically. Durable receipts recover repeat delivery
+  and the gap before the session review marker. Finalization does not add Memory.
+- F4/F6/F7 retrieve SQL rules and explained errors for the existing approval gates.
+  Retrieval is consultative and does not write an approval decision.
+- Successful Catalog physical sync deletes cards with matching removed dependencies.
+  The same Catalog transaction marks pending Memory cleanup. Retry keeps the original
+  removals and does not rescan; deletion receipts and projection tombstones survive restarts.
+- Migration 003 adds minimal review and physical-cleanup receipts.
+
+## Executed checks
+
+| Check | Result |
+| --- | --- |
+| Harness deterministic suite, excluding portable-path environment cases | 1,152 passed |
+| Portable-path suite without the temporary THT_HOME override | 9 passed |
+| Memory service/retrieval with isolated PostgreSQL and Qdrant | 41 passed, 1 optional real-embedding case skipped, 1 L2 case excluded |
+| Pi gate suite | 195 passed |
+| Backend full suite | 1,346 passed; one auth timing test exceeded 5 seconds under concurrent load |
+| Isolated auth and Catalog route rerun | All 40 passed, including the timed-out case |
+| Catalog PostgreSQL integration after adding atomic cleanup-marker coverage | All 5 passed |
+| Frontend full suite | 635 passed |
+| Chromium summary review, desktop and 390px mobile | Passed; no page errors or horizontal overflow |
+| Configured real GLM 5.3 generation | Passed on synthetic PostgreSQL data |
+| Backend/frontend production builds, modified Python lint, strict docs build | Passed |
+
+The existing local Docker preview was rebuilt from this worktree, migration 003
+was applied, and core/frontend were recreated with the existing persistent volumes.
+The preview remains at `http://127.0.0.1:8080`.
+
+The browser check uses the production widget in an isolated Vite fixture. It edits
+the rule, declines the exemplar, submits only the selected card and checks responsive
+layout. Gate tests separately verify request ordering through the production Pi
+composition root; service and Catalog tests use real PostgreSQL. This is not a claim
+of an automated complete live Pi conversation.
+
+The L2 case retrieves an approved SQL rule, excludes a card bound to another database,
+and asks the configured GLM 5.3 model to generate a query. Order IDs repeat between
+financial years; the correct composite join returns 120 on the synthetic fixture.
+The generated SQL is validated and executed in a read-only PostgreSQL transaction.
+No real DWH rows are sent. Embeddings in this case are deterministic; the real
+embedding/hybrid retrieval evidence remains documented in M2.
+
+## Reproduction
+
+From the harness:
+
+```sh
+THT_HOME=/private/tmp/thothii-m1-harness-home .venv/bin/pytest -q -m 'not l0 and not l2' --ignore=tests/test_portable_paths.py
+.venv/bin/pytest -q tests/test_portable_paths.py
+THT_HOME=/private/tmp/thothii-m1-harness-home .venv/bin/pytest -q tests/memory/test_administration.py tests/memory/test_retrieval.py -m 'not l2'
+npm test
+```
+
+The optional generation case requires an installation YAML path and its running
+core container. It resolves the model credential inside core without printing it:
+
+```sh
+THT_MEMORY_L2_INSTALLATION=<installation.yaml> THT_MEMORY_L2_CORE=<core-container> \
+  .venv/bin/pytest -q -s -m l2 tests/memory/test_administration.py -k real_model
+```
+
+From frontend: `npx playwright test e2e/memory-review.spec.ts`.
+Screenshots are written to `/private/tmp/thothii-m3-summary-desktop.png` and
+`/private/tmp/thothii-m3-summary-mobile.png`.
+
+Evidence authoring and the joint X1 persistent Memory/Evidence conflict repair remain
+outside M3. This increment does not infer knowledge from unexplained failures or
+promise general improvements in SQL-generation accuracy.