feat: implement memory and evidence administration with guided repairs

Add PostgreSQL-backed memory, editable evidence with source review and activation, and human-approved archive repairs across the harness, API, and UI. Include migrations, deployment support, regression coverage, and validation documentation.

Refresh permissions from validated session roles so existing administrator logins can access newly deployed archive management features.

frontend/src/shell/AppShell.tsx

@@ -17,6 +17,9 @@ import { StopConfirmDialog } from "./StopConfirmDialog";
 import { SteerInput, ComposerFooter } from "./SteerInput";
 import { WorkflowBar } from "./WorkflowBar";
 import { DatabaseManagementPage } from "./DatabaseManagementPage";
+import { MemoryManagementPage } from "./MemoryManagementPage";
+import { EvidenceManagementPage } from "./EvidenceManagementPage";
+import { ArchiveNavigation } from "./ArchiveNavigation";
 import { WorkspacePreprocessingControl } from "./WorkspacePreprocessingControl";
 import { Pencil, ArrowLeft, ArrowRight, ChevronDown, Trash2 } from "lucide-react";
 import { Accordion } from "@base-ui/react/accordion";
@@ -46,7 +49,7 @@ interface AppShellProps {
   canLogout: boolean;
 }
 
-type ActiveSurface = "core" | "database-management";
+type ActiveSurface = "core" | "database-management" | "memory-management" | "evidence-management";
 type ActiveManagementPanel = "workspace" | "pi" | null;
 const SESSION_SCOPES: readonly SessionScope[] = ["mine", "all"];
 
@@ -153,6 +156,10 @@ export function AppShell({ canLogout }: AppShellProps) {
   const canManageWorkspace = permissions.includes("workspace.manage");
   const canManageWorkspaceSecrets = permissions.includes("workspace.secrets.manage");
   const canManageDatabase = permissions.includes("database.manage");
+  const canManageMemory = permissions.includes("memory.manage");
+  const canManageEvidence = permissions.includes("evidence.manage");
+  const [memoryDirty, setMemoryDirty] = useState(false);
+  const [memoryBusy, setMemoryBusy] = useState(false);
   const canManagePi = permissions.includes("pi.manage");
   const authGeneration = useAuthGeneration();
   const { data: installationSettings } = useQuery({
@@ -299,6 +306,13 @@ export function AppShell({ canLogout }: AppShellProps) {
   }
 
   function canLeaveDatabaseManagement(): boolean {
+    if (activeSurface === "memory-management" && memoryBusy) {
+      toast.info("Wait for the Memory operation to finish before leaving this page");
+      return false;
+    }
+    if (activeSurface === "memory-management" && memoryDirty) {
+      return window.confirm("Discard unsaved Memory changes and leave Memory management?");
+    }
     if (activeSurface !== "database-management") return true;
     if (databaseNavigationRef.current.busy) {
       toast.info("Wait for the database operation to finish before leaving this page");
@@ -695,7 +709,7 @@ export function AppShell({ canLogout }: AppShellProps) {
 
   const currentNavigation = activeSurface === "database-management"
     ? "database"
-    : activeManagementPanel ?? "core";
+    : activeSurface === "memory-management" ? "memory" : activeSurface === "evidence-management" ? "evidence" : activeManagementPanel ?? "core";
   const adminNavigationOpen = adminNavigationValue.includes("administration");
   const managementNavigationCurrent = currentNavigation !== "core";
 
@@ -709,6 +723,7 @@ export function AppShell({ canLogout }: AppShellProps) {
       data-session-resizing={sessionResizing}
       className={[
         "flex h-screen bg-background text-foreground",
+        ["memory-management", "evidence-management"].includes(activeSurface) ? "max-md:pt-12" : "",
         activityResizing || sessionResizing ? "select-none cursor-col-resize" : "",
       ].join(" ")}
     >
@@ -749,6 +764,10 @@ export function AppShell({ canLogout }: AppShellProps) {
 
       {/* Conversation column */}
       <WorkAreaPanelHost data-testid="conversation-column" className="flex min-w-0 flex-1 flex-col">
+        {activeSurface === "memory-management" && (
+          <MemoryManagementPage canManage={canManageMemory} onDirtyChange={setMemoryDirty} onBusyChange={setMemoryBusy} />
+        )}
+        {activeSurface === "evidence-management" && <EvidenceManagementPage canManage={canManageEvidence} />}
         {activeSurface === "database-management" && (
           <DatabaseManagementPage
             canManage={canManageDatabase}
@@ -853,7 +872,8 @@ export function AppShell({ canLogout }: AppShellProps) {
       </WorkAreaPanelHost>
 
       {/* Right session rail */}
-      {(activeSurface === "database-management" || !showActivity) && (
+      {(activeSurface !== "core" || !showActivity) && (
+        <ArchiveNavigation surface={activeSurface}>
         <aside aria-label="Session navigation" className="flex w-64 shrink-0 flex-col bg-sidebar">
         <div className="thot-session-navigation__header relative text-center">
           <h1 className="font-heading text-xl font-semibold leading-none tracking-tight text-foreground">
@@ -928,12 +948,33 @@ export function AppShell({ canLogout }: AppShellProps) {
                     disabled={!canManageDatabase}
                     title={canManageDatabase ? undefined : "Database management permission is required"}
                     onClick={() => {
+                      if (!canLeaveDatabaseManagement()) return;
                       setActiveManagementPanel(null);
                       setActiveSurface("database-management");
                     }}
                   >
                     Database management
                   </Button>
+                  <Button
+                    variant={currentNavigation === "memory" ? "navigationActive" : "outline"}
+                    size="sm"
+                    className="w-full min-w-0 max-w-full gap-[0.25rem] px-[0.75rem]"
+                    aria-current={currentNavigation === "memory" ? "page" : undefined}
+                    disabled={!canManageMemory}
+                    title={canManageMemory ? undefined : "Memory management permission is required"}
+                    data-navigation-state={currentNavigation === "memory" ? "current" : "available"}
+                    onClick={() => {
+                      if (!canLeaveDatabaseManagement()) return;
+                      setActiveManagementPanel(null);
+                      setActiveSurface("memory-management");
+                    }}
+                  >Memory management</Button>
+                  <Button variant={currentNavigation === "evidence" ? "navigationActive" : "outline"}
+                    size="sm" className="w-full min-w-0 max-w-full gap-[0.25rem] px-[0.75rem]"
+                    aria-current={currentNavigation === "evidence" ? "page" : undefined}
+                    disabled={!canManageEvidence} title={canManageEvidence ? undefined : "Evidence management permission is required"}
+                    onClick={() => { if (!canLeaveDatabaseManagement()) return; setActiveManagementPanel(null); setActiveSurface("evidence-management"); }}
+                  >Evidence management</Button>
                   <div role="separator" aria-orientation="horizontal" className="mx-1 h-px bg-border/90" />
                   <Button
                     variant={currentNavigation === "workspace" ? "navigationActive" : "outline"}
@@ -1154,6 +1195,7 @@ export function AppShell({ canLogout }: AppShellProps) {
           </div>
         </div>
         </aside>
+        </ArchiveNavigation>
       )}
       <Toaster />