feat: connect add memory UI

.env.example

@@ -1,17 +1,9 @@
-# Trauma local development environment.
+# Trauma local browser import environment.
 #
 # Copy this file to `.env` (the project gitignores `.env`) and adjust values.
-# Bun loads `.env` automatically for `bun run` scripts, so the values below
-# flow into the dev/start servers, the dev smoke check, and Playwright's
-# webServer configuration unless overridden by the shell.
+# Bun loads `.env` automatically for `bun run` scripts.
 
-# Bind address for `bun run dev` and `bun run start`.
-# Use `127.0.0.1` (loopback only) for the no-auth local model.
-HOST=127.0.0.1
-
-# Port used by `bun run dev` and `bun run start`.
-PORT=3000
-
-# Base HMR port used in `app.config.ts`. Server and server-function routers
-# use the next two ports (default: 24678 / 24679 / 24680).
-TRAUMA_HMR_PORT=24678
+# Browser-assisted imports are disabled by default. Enable only for local
+# development with a random token that is also configured in the extension.
+TRAUMA_BROWSER_IMPORT_ENABLED=false
+TRAUMA_BROWSER_IMPORT_TOKEN=

.gitignore

@@ -8,6 +8,7 @@ playwright-report/
 test-results/
 .trauma/
 data/
+/~/
 /.serena/
 /config.json
 /trauma.config.json

README.md

@@ -45,9 +45,9 @@ Create the local environment file from the example:
 cp .env.example .env
 ```
 
-`.env` is gitignored. It controls the dev/start bind address (`HOST`),
-listening port (`PORT`), and base HMR port (`TRAUMA_HMR_PORT`). The defaults
-in `.env.example` bind loopback only (`127.0.0.1:3000`); adjust as needed.
+`.env` is gitignored. Keep it for local TRAUMA settings such as browser import.
+The `dev`, `start`, and `preview` scripts default `HOST` to `127.0.0.1` unless
+you set another host in the shell.
 
 Run the dev server:
 

docs/architecture/flows.md

@@ -24,6 +24,11 @@ link-only memory. Record extraction status and error details in SQLite.
 
 Raw HTML is not stored in the initial design.
 
+Default extraction runs behind an interruptible runtime boundary. The import
+timeout budget covers fetch, validation, parser work, and markdown conversion;
+if the budget is exhausted, the importer returns link-only fallback instead of
+persisting late extraction output.
+
 ## Browser-Assisted Import
 
 Safari, browser extension, or share-sheet assisted capture is future work.
@@ -72,6 +77,10 @@ Selection payload:
 If persistence fails, the optimistic UI state is rolled back or surfaced as
 failed.
 
+If highlight persistence returns backup failsafe metadata, the frontend must
+refresh the global backup failsafe alert before showing the local highlight
+failure state.
+
 ## Git Backup
 
 Backup is built-in git backup, not a generic hook system.
@@ -91,3 +100,31 @@ Backup failures do not roll back memory creation or highlight creation.
 On startup, Trauma should find pending, queued, or failed backup states that are
 eligible for retry and re-enqueue them. `queued` is process-local, so queued rows
 from a previous process are eligible after restart.
+
+Backup failsafe recovery actions must be retry-safe. If migration already
+copied a file before a later git step failed, rerunning migration may accept the
+existing target only when its bytes match the source. Different target content
+remains a hard conflict.
+
+Backup readiness is tied to the full backup identity, not just filesystem
+paths. The persisted stamp must match project path, store path, git remote,
+remote URL, branch, and already-successful tracked content before new writes are
+accepted. If the repository is recreated at the same path, or the configured
+remote/branch changes while successful backup rows already exist, Trauma must
+force an explicit recovery path instead of silently treating the new repository
+as complete.
+
+When already-successful backup rows point at missing, out-of-scope, or
+untracked content, the alert is a content-integrity failure rather than a path
+drift. The UI and logs must not describe this as a backup location change or
+offer path migration as a remedy.
+
+Only `missing_file` content-integrity alerts may offer deletion of the orphan
+SQLite memory record. If the content still exists but is untracked or outside
+the configured paths, recovery must preserve the record and require backup
+repository/path repair instead.
+
+If migration commits local backup content but the configured push fails, the
+operator must be able to retry that recovered push after repairing the remote.
+A push-failure alert must not turn a completed local migration into an
+unrecoverable banner state.