fix(Alden): preserve activity cursors and verify memory history against source

[twoimo]

Alden's existing persisted collection journal could advance the viewer cursor while skipping invalid or out-of-order entries. History rows also conflated confirmed removals and relation changes with generic "stored" steps, and selected history events had no verification of current source/index status.

This stacked change preserves the existing project/target/cancellation boundaries and improves the actual runtime:

• Validate each entire graph activity page before recording event IDs or advancing the durable cursor. Reversed sequence, malformed event, duplicated event ID, and sequence beyond the returned cursor cause bounded same-cursor retry without false 3D pulses.
• Validate saved history pages in the correct direction (newest-first initial/older, oldest-first forward). A corrupt page preserves the visible history, counts, filters, and cursor; it never silently filters a bad row then commits a later page.
• On actual revision storage, retain previous_version from that target's own membership. A same-name or same original from another target cannot impersonate the former version.
• Display added/revised/unchanged/removed/relation-change states and exact removed/relation-change summary counts.
• On user opening a stored/indexed memory history detail only, use existing read-only collection-trace with explicit allowed projects, document, version and target. Show confirmed original SHA-256, FTS and derived Dense binding only if document/version/target/projects and completed run_id match. Report retractions, later revisions and unavailable readback honestly; dispose/hide/filter/journal-reset fences suppress late replies. No reading creates collection events or AI-model-activity pulses.
• Preserve visual palette/3D effects; use the existing evidence detail layout and no new background services.

Validation: macOS GitHub Actions 38070713835 exact CI SHA 6250f436ccaa7d41b0f1a1cebf269d0967e50266: 60/60 focused Python source/pipeline tests, 471/471 desktop UI tests, TypeScript/Vite production build. The 6 affected source/test blob SHAs were independently compared against this draft PR branch and all match. Early failed runs 38070024117 (test TTL fixture) and 38070472923 (TypeScript null narrowing) are retained; both were corrected and reevaluated.

Release gates: source-only + remote macOS CI, not the user's installed Alden. Source commit/branch is stacked on draft PR #29, then #28, then #27; no merges. No Mac Core turn_token or Desktop Computer Use connector is currently available, so the designated Mac clone, goal-objective.md/local outputs/STATUS.md, user DB/model/process/queue, physical STT/TTS and external osk-system host cannot be honestly claimed as verified. Current unsigned 0.3.58 artifact from commit c494a53 predates these changes.

Design, evidence and the pending Mac install/rollback steps: dated integration note.

Unsigned macOS candidate built from this change

GitHub Actions #38070940937 completed successfully: arm64 release bundle, source-bound allowlisted resource checks, archive SHA manifest and artifact upload. Build commit cf1f40779d9830dc14024cdf271ea9cdd30fe9b1 is the PR #30 head c62d6b7763a6644151aa18ff3a4edc7f239e3821 plus exactly one CI-only workflow file. Bundle version remains 0.3.58 and bundle ID com.openkakao.alden.desktop; bundled collection/retrieval/MCP/menu source Git blob SHAs match PR #30. GitHub Actions artifact: Alden-unsigned-macos-arm64-memory-continuity (artifact ID 11676592857). Inner app ZIP SHA-256 8daa4bccf9ec77297a5cb918371c0f9047fc7b8e12a3e2f03de8814f34057d17; verified 63 ZIP entries / 54 resource files / arm64 Mach-O. This is an unsigned, unnotarized, uninstalled build candidate, not a public release or owner's physical Mac runtime proof. The earlier candidate c494a53 is retained as dated prior evidence.

[cursor]

This stops another target's version from being copied into previous_version, but the stored event still uses change=category, and category is still decided from the shared documents row (old is None / documents.current_version) just above.

Reproduced on this head c62d6b7763a6644151aa18ff3a4edc7f239e3821:

• Target B's first ingest of the same original and the same text returns added=0, unchanged=1. activity_page for B is empty, because unchanged is not an activity kind, so the live graph consumer is not told about the new membership.
• A further target's first ingest of different text returns revised=1. The stored detail is {change: "revised"} and has no previous_version.

test_revision_history_uses_previous_version_from_its_own_target_only passes and only checks that previous_version is absent. The new history labels then show those rows as "기존 자료 유지" and "기존 자료 수정".

Fix direction: classify added when this target has no membership. Keep previous_version only for a real change of that membership's version.

Regression that should exist: both first-time B cases above assert change=="added", added==1, no previous_version, and an activity item with kind=="added".