Memory Palace v3.9.0: Memory Maintenance Engine v2, Hybrid Search, and Security Hardening

记忆维护引擎 v2（全新模块）

• 遗忘引擎 (forgetting_engine.py)：基于半衰期的记忆衰减机制，长期未访问的记忆自动降低权重，搜索结果更聚焦当前需要的内容
• 压缩引擎 (compression_engine.py)：将相似或冗余的记忆合并为精简摘要，减少信息重复
• 程序性记忆引擎 (procedural_engine.py)：提取高频使用模式，加速常用操作的检索
• 分层引擎 (layering_engine.py)：将记忆按访问频率和重要性分为多层（工作层 → 归档层 → 休眠层），热数据优先呈现
• 前端面板：新增「遗忘管理」(ForgettingPanel) 和「记忆分层」(LayerHierarchyPanel) 可视化操作面板，支持查看衰减模拟、批量保留/归档操作
• 新增 API 端点：/api/forgetting、/api/layering、/api/search_quality

搜索质量提升

• RRF 混合搜索默认开启：将 FTS5 全文搜索、语义向量搜索、实体匹配三路结果通过 Reciprocal Rank Fusion (RRF_K=10) 融合排序，Profile B/C/D 默认启用（据 commit 记录：MRR +8%，延迟 -24%）
• sqlite-vec 原生向量引擎：Profile C/D 默认启用 sqlite-vec>=0.1.9 原生向量搜索，通过 pip 自动发现，缺失时回退到旧引擎
• 向量维度自动适配：切换 embedding 模型维度后，vec0 KNN 表自动检测维度并 DROP+重建索引，避免静默回退到旧打分逻辑
• 混合维度搜索修复：当前维度的向量存在时继续语义搜索，而非整体降级为纯关键词搜索
• 搜索质量监控面板 (SearchQualityPanel)：在可观测性页面展示 MRR@8、Recall@8、p95 延迟等指标和各通道贡献

安全加固

• 并发写入保护 (CAS)：update_memory 接口增加乐观锁 expected_memory_id 参数，多端同时编辑同一条记忆时返回 409 冲突，不再静默覆盖
• 错误信息脱敏：browse/review/setup/forgetting/layering/maintenance 所有 API 端点的错误响应改为结构化 {error, reason}，不再暴露内部 memory ID、堆栈等信息（原始异常仅写入服务端日志）
• 时序安全校验：遗忘审核的 token 和确认短语比对改用 hmac.compare_digest，防止时序攻击 (runtime_state.py:1460-1462)
• Docker Compose 端口绑定：默认绑定 127.0.0.1 而非 0.0.0.0，防止意外暴露服务到公网
• 前端容器非 root 运行：Dockerfile.frontend 使用 USER 101 以非 root 身份运行
• 后端容器权限隔离：Dockerfile.backend 创建专用 app 用户组 (UID 10001) 并设置文件归属权限
• 数据库迁移备份：改用 SQLite 原生 conn.backup() API（migration_gate.py:617），WAL 模式下也能保证备份一致性

国际化与无障碍

• 中文翻译补全：将 LayerHierarchyPanel 和 ForgettingPanel 中硬编码的英文字符串迁移至 locale 文件（新增 13 个 i18n 键），补齐遗漏的活力度相关中文翻译
• 清理废弃翻译：移除 en.js 和 zh-CN.js 中 45 个未使用的 i18n 键，保持 614/614 中英对齐
• CJK 标题支持：搜索和记忆创建支持中日韩字符标题（_CJK_RUNTIME_TOKEN_PATTERN 覆盖 CJK Unified Ideographs、Hiragana、Katakana、Hangul 等 Unicode 区段）
• 无障碍增强：MemoryBrowser 9 个表单控件添加 aria-label；App.jsx 新增键盘 skip-link (<a href="#main-content">) 和 <main> 地标区域
• 减弱动画支持：FluidBackground 和全局 CSS 响应 prefers-reduced-motion: reduce 媒体查询，自动关闭流体背景动效
• CSP 合规：语言检测脚本外置为 public/lang-detect.js，附带 zh/zh-TW/zh-HK 规范化的回归测试
• 表单安全：SetupAssistantModal 6 个输入框添加 autoComplete="off"

Docker 一键部署优化

• SSE 连接稳定性：修复 /sse 尾斜杠重定向导致 CORS 失败的问题；可观测性页面新增 SSE 断连后的 connectionLost 提示横幅
• 端口回退修复：修复 _is_loopback_port_available 始终返回 True 的 bug，端口冲突时现在能正确回退到备用端口
• Docker 网络地址修正：docker_one_click.sh 自动将 127.0.0.1/0.0.0.0/localhost 等环回地址重写为 host.docker.internal
• PowerShell 脚本加固：添加 Set-StrictMode、过期锁恢复、UTF-8 文件读取；修复 $host 变量遮蔽
• 错误边界增强：RootErrorBoundary 支持路由切换时自动重置 + 新增「重试」按钮

文档与仓库瘦身

• 文档精简：全部用户文档精简约 38%（~6500 行），移除冗余描述、内部验证数据和开发者细节
• 中英文对齐：同步所有 EN/CN 文档对至相同信息覆盖范围
• 仓库体积缩减：从 git 索引中移除约 82 MB 已跟踪的基准测试数据集，改为 prepare_public_datasets.py 按需下载
• 文档命名规范：DASHBOARD_GUIDE_CN.md 重命名为 DASHBOARD_GUIDE.md，统一 .md=中文、_EN.md=英文的命名约定

测试与工具

• 后端 1300+ 测试、前端 200+ 测试全部通过，零回归
• 新增专项回归测试：CAS 冲突 409、向量维度切换 (64→1024→64)、RRF+sqlite-vec 组合、MCP 错误脱敏、i18n 键对齐
• 新增 scripts/cross_platform_smoke.py：跨平台冒烟测试脚本（749 行）
• 新增 scripts/i18n_audit.py：自动检测未翻译和废弃的国际化键（712 行）

---

完整变更：3e165d9...v3.9

---

English Release Notes

Memory Maintenance Engine v2 (New Modules)

• Forgetting engine (forgetting_engine.py): adds half-life based memory decay. Memories that have not been accessed for a long time automatically lose weight, keeping search results focused on currently useful content.
• Compression engine (compression_engine.py): merges similar or redundant memories into concise summaries to reduce repetition.
• Procedural memory engine (procedural_engine.py): extracts frequently used patterns and speeds up retrieval for common operations.
• Layering engine (layering_engine.py): groups memories by access frequency and importance across layers (working layer -> archive layer -> dormant layer), so hot data is surfaced first.
• Frontend panels: adds the Forgetting Management (ForgettingPanel) and Memory Layering (LayerHierarchyPanel) visual panels, with decay simulation, bulk keep, and archive operations.
• New API endpoints: /api/forgetting, /api/layering, and /api/search_quality.

Search Quality Improvements

• RRF hybrid search is enabled by default: combines FTS5 full-text search, semantic vector search, and entity matching with Reciprocal Rank Fusion (RRF_K=10). Profiles B/C/D enable it by default (based on commit records: MRR +8%, latency -24%).
• Native sqlite-vec vector engine: Profiles C/D enable native vector search through sqlite-vec>=0.1.9 by default, discovered automatically through pip and falling back to the previous engine when unavailable.
• Automatic vector dimension adaptation: after switching embedding model dimensions, the vec0 KNN table now detects dimension changes and drops/rebuilds the index, avoiding silent fallback to the old scoring path.
• Mixed-dimension search fix: semantic search continues when vectors for the current dimension exist, instead of downgrading the whole request to keyword-only search.
• Search quality monitoring panel (SearchQualityPanel): the Observability page now shows MRR@8, Recall@8, p95 latency, and per-channel contribution metrics.

Security Hardening

• Concurrent write protection (CAS): update_memory now accepts the optimistic lock parameter expected_memory_id. Concurrent edits to the same memory return 409 Conflict instead of silently overwriting each other.
• Sanitized error messages: browse/review/setup/forgetting/layering/maintenance API endpoints now return structured {error, reason} responses and no longer expose internal memory IDs or stack traces. Raw exceptions are kept in server logs only.
• Timing-safe validation: forgetting-review tokens and confirmation phrases now use hmac.compare_digest, reducing timing-attack risk (runtime_state.py:1460-1462).
• Docker Compose port binding: services now bind to 127.0.0.1 by default instead of 0.0.0.0, preventing accidental public exposure.
• Non-root frontend container: Dockerfile.frontend now runs as USER 101.
• Backend container permission isolation: Dockerfile.backend creates a dedicated app user/group (UID 10001) and sets file ownership accordingly.
• Database migration backups: backups now use SQLite's native conn.backup() API (migration_gate.py:617), preserving backup consistency under WAL mode.

Internationalization and Accessibility

• Completed Chinese translations: hard-coded English strings in LayerHierarchyPanel and ForgettingPanel were moved into locale files, with 13 new i18n keys and missing vitality-related Chinese translations filled in.
• Removed stale translations: 45 unused i18n keys were removed from en.js and zh-CN.js, keeping English/Chinese coverage aligned at 614/614.
• CJK title support: search and memory creation now support Chinese/Japanese/Korean titles. _CJK_RUNTIME_TOKEN_PATTERN covers CJK Unified Ideographs, Hiragana, Katakana, Hangul, and related Unicode blocks.
• Accessibility improvements: nine MemoryBrowser form controls now have aria-label; App.jsx adds a keyboard skip link (<a href="#main-content">) and a <main> landmark.
• Reduced motion support: FluidBackground and global CSS now respect prefers-reduced-motion: reduce and automatically disable the fluid background animation.
• CSP compliance: language detection was moved into public/lang-detect.js, with regression coverage for zh/zh-TW/zh-HK normalization.
• Form safety: six SetupAssistantModal inputs now set autoComplete="off".

Docker One-Click Deployment Improvements

• More stable SSE connection: fixes CORS failures caused by /sse trailing-slash redirects. The Observability page now shows a connectionLost banner after SSE disconnects.
• Port fallback fix: fixes a bug where _is_loopback_port_available always returned True; port conflicts can now correctly fall back to alternate ports.
• Docker network address correction: docker_one_click.sh automatically rewrites loopback addresses such as 127.0.0.1, 0.0.0.0, and localhost to host.docker.internal.
• PowerShell script hardening: adds Set-StrictMode, stale-lock recovery, and UTF-8 file reads; also fixes $host variable shadowing.
• Improved error boundary: RootErrorBoundary now resets automatically on route changes and adds a Retry button.

Documentation and Repository Size Reduction

• Documentation simplification: all user-facing documentation was reduced by about 38% (~6,500 lines), removing redundant wording, internal validation data, and developer-only details.
• English/Chinese alignment: all EN/CN documentation pairs were synchronized to the same coverage scope.
• Repository size reduction: about 82 MB of tracked benchmark datasets were removed from the git index and replaced with on-demand downloads through prepare_public_datasets.py.
• Documentation naming convention: DASHBOARD_GUIDE_CN.md was renamed to DASHBOARD_GUIDE.md, standardizing the convention that .md is Chinese and _EN.md is English.

Tests and Tools

• Backend 1300+ tests and frontend 200+ tests all pass with zero regressions.
• New targeted regression tests cover CAS 409 conflicts, vector dimension switching (64 -> 1024 -> 64), RRF + sqlite-vec combinations, MCP error sanitization, and i18n key alignment.
• Adds scripts/cross_platform_smoke.py: a cross-platform smoke test script (749 lines).
• Adds scripts/i18n_audit.py: an automated i18n audit script for untranslated and stale keys (712 lines).

---

Full changelog: 3e165d9...v3.9