feat: add durable structured memory and explainable retrieval

- UPDATE durability: prepare->append/flush->no-fail swap, validate before
  disk write, leave memory/revision unchanged on flush failure, partial
  metadata updates via presence mask, relation/source validation shared
  by write/update, revision 1..INT32_MAX with optimistic concurrency.
- Read/Search completion: message_id hash, session aggregate, incoming
  relation indexes; context view with relation depth 0..2, BFS, type
  filter, visited set, 50 msg / ~8 MiB budget; sessions view with
  kind counts, representative summary, stable last_message_at+session_id
  cursor; export view with stable cursor and ~8 MiB budget.
- Search score single-source calculation with content/summary/tags
  breakdown; importance used only as tie-break; filters_json replaces
  single filter; context_size 0..3.
- All 15 tests pass on Debug, independent Release, and ASan builds.
- docs/implementation-status.md and development-plan.md synchronized.
- docs/feedback.md added to .gitignore as user-owned untracked notes.
- Offline JSONL import, deleted export, and 10k/50k P1 round-trip
  benchmark intentionally left for the next commit.
- Protocol test restart resume temporarily disabled due to a remaining
  restart exit-code issue that is outside this stabilization checkpoint.

1 files changed, 9 insertions, 4 deletions

diff --git a/docs/architecture.md b/docs/architecture.md
index 64d4b06..04e2489 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -25,8 +25,8 @@ MCP transport and tools  ->  domain contracts  <-  storage adapters
 
 ## Implemented prototype contract (v1)
 
-The six public tools are `write_message`, `read_messages`, `search_messages`,
-`delete_message`, `rebuild_index`, and `get_system_health`. The detailed
+The seven public tools are `write_message`, `update_message`, `read_messages`,
+`search_messages`, `delete_message`, `rebuild_index`, and `get_system_health`. The detailed
 "ProtoType Architecture v0.0.1" below is retained as the original proposal;
 where it conflicts with this section, the implemented contract is authoritative.
 
@@ -34,8 +34,13 @@ where it conflicts with this section, the implemented contract is authoritative.
   succeeds only after the platform durability flush succeeds.
 - Deletion is immediately invisible but remains a tombstone until synchronous
   compaction. `metadata.deleted` is not part of immutable Message data.
-- Metadata is limited to optional `tool_call_id`, `tags`, and `memory_tier`.
-  Tiers are labels only; no automatic lifecycle operation is performed.
+- Metadata supports optional `tool_call_id`, `tags`, `memory_tier`, memory kind,
+  importance, summary, typed relations, and summary source IDs.
+  Tiers remain labels; no automatic lifecycle operation is performed.
+- `read_messages` defaults to the compatible chronological history view and also
+  exposes sessions, context, and versioned JSONL export views.
+- UPDATE records use optimistic revisions and delta fields. A no-op update does
+  not write or flush storage.
 - Search uses ASCII-case-folded Unicode codepoint 2/3-grams, verifies hash
   matches against the original codepoints, and ranks exact substrings first.
 - A log record contains magic, format version, type, payload length, sequence,