diff --git a/desktop/VALIDATION.md b/desktop/VALIDATION.md
index d2c2963222..6d22245ac1 100644
--- a/desktop/VALIDATION.md
+++ b/desktop/VALIDATION.md
@@ -22,7 +22,7 @@ cargo test --locked --manifest-path desktop/src-tauri/Cargo.toml
 
 ## Compatibility scope
 
-[compatibility.json](src-tauri/src/connections/compatibility.json) preserves the recorded Server sources, normalized OpenAPI contract digests and qualification-wheel digests for the historical profiles below. The current contract is qualified by `sqlite-atomic-dd62723d-v1` below; ordinary builds require explicitly selecting it and checking the connection before business operations become available. The `sqlite-atomic-98275dbb-v1`, `sqlite-atomic-1da99747-v1`, `sqlite-atomic-8f10c560-v1`, `sqlite-atomic-d9a78567-v1`, `sqlite-atomic-caf2a35a-v1`, `sqlite-atomic-683e2db0-v1` and `sqlite-atomic-cab054db-v1` records qualify their corresponding Server source deployments and do not match this bundled contract. Historical records are disabled in the selector, and saved unavailable selections remain visible until explicitly replaced. CI builds have their own artifact identities and do not change product qualification.
+[compatibility.json](src-tauri/src/connections/compatibility.json) preserves the recorded Server sources, normalized OpenAPI contract digests and qualification-wheel digests for the historical profiles below. The current contract has source-specific qualifications `sqlite-atomic-dd62723d-v1` and `sqlite-atomic-4ffdf4e9-v1` below. Ordinary builds require explicitly selecting the record whose tested Server source and wheel match the deployment, then checking the connection before business operations become available. The `dd62723d` record covers the migration-framework sources; the `4ffdf4e9` record covers the earlier release-preparation sources. The `sqlite-atomic-98275dbb-v1`, `sqlite-atomic-1da99747-v1`, `sqlite-atomic-8f10c560-v1`, `sqlite-atomic-d9a78567-v1`, `sqlite-atomic-caf2a35a-v1`, `sqlite-atomic-683e2db0-v1` and `sqlite-atomic-cab054db-v1` records qualify their corresponding Server source deployments and do not match this bundled contract. Historical records are disabled in the selector, and saved unavailable selections remain visible until explicitly replaced. CI builds have their own artifact identities and do not change product qualification.
 
 The real Server harness covers SQLite with anonymous loopback, static Bearer, HTTPS with explicit CA/base path, and injected-provider/enforced access. It exercises save/search/exact reads, identity changes, binding revocation, ambiguous writes without replay and Scope pagination. Installed UI checks cover repeated launches preserving the existing editor, late committed-save responses preserving a new Scope draft, explicit connection/Scope selection, clipboard copies, connection isolation, draft cancellation, byte limits and independent Server survival after Desktop exit.
 
@@ -30,6 +30,45 @@ Selecting a compatibility profile does not attest the remote binary identity. Ex
 
 ### Current Server protocol qualification
 
+#### Server 4ffdf4e9 protocol qualification
+
+`sqlite-atomic-4ffdf4e9-v1` qualifies the v1.4.1 preparation sources at
+`4ffdf4e97ad43c55d8718a1df581596db2e6097d` for the bundled OpenAPI digest
+`c12901b88b8e958c9cd63469298b9a04b9d5e2b0b4564d83b50f7ae95542519a`.
+The qualification wheel is `powercontext-1.4.1.dev176+g4ffdf4e97-py3-none-any.whl`, SHA-256
+`33079ebc5eb61d03dd4cccc0d104c47b0415beab1502a5b01fbc38f2cc30af2b`, built from that clean commit.
+All 552 packaged runtime files in `powercontext/` and `powercontext_service_bootstrap/`
+match the source bytes at that commit. The runtime manifest digest is
+`ea7f63e5e0a16fa7386c3bdea80ea083dd09fe00447a3639391ed114a9e65ec3`
+(sorted `wheel/path sha256` lines, with a final newline).
+This is a development wheel from the release preparation branch; it is not evidence of a published v1.4.1 package.
+
+On 2026-10-26, Linux x86_64 with Python 3.14.6 and Rust 1.96.0 ran the existing
+`desktop/tests/real_server.py` harness against the extracted wheel and independent SQLite Server processes.
+All four modes passed: anonymous loopback, static Bearer, HTTPS with an explicit CA and base path,
+and an injected provider with enforced access. The ten recorded operations cover Atomic Memory
+save/search/exact revision reads, Scope selection and pagination, identity changes, same-identity
+revocation, committed writes with lost responses without replay, and Server survival after client exit.
+The report records the source commit above and `desktopWorkingTreeDirty=false`.
+
+The native client compiled the unmodified product `connections`, `credentials`, `error`, and `transport`
+modules and the existing `server_probe.rs` in a standalone library. Dependency versions and checksums
+match the product Cargo lock. The standalone library excludes the Tauri GUI shell because the local
+Linux environment lacks WebKit development libraries. These results qualify SQLite protocol behavior;
+Windows/macOS packaging, native vaults, installed UI, signing, IME, and screen-reader behavior require
+their own platform checks.
+
+From the recorded checkout, use an empty wheel output directory and a platform with the Desktop native
+build dependencies to run the existing harness:
+
+```sh
+uv sync --frozen --python 3.14
+uv build --wheel --out-dir desktop/.artifacts/server-wheel
+cargo build --locked --manifest-path desktop/src-tauri/Cargo.toml --example server_probe
+uv run --no-sync python desktop/tests/fixture_qualification.py --server-commit 4ffdf4e97ad43c55d8718a1df581596db2e6097d
+uv run --no-sync python desktop/tests/real_server.py
+```
+
 #### Server dd62723d protocol qualification
 
 `sqlite-atomic-dd62723d-v1` qualifies Server sources at `dd62723dceabae8b41e293531f0080a819f87c68`
diff --git a/desktop/src-tauri/src/connections/compatibility.json b/desktop/src-tauri/src/connections/compatibility.json
index 109fcd6456..db01c42325 100644
--- a/desktop/src-tauri/src/connections/compatibility.json
+++ b/desktop/src-tauri/src/connections/compatibility.json
@@ -209,6 +209,25 @@
     ],
     "evidence": "desktop/VALIDATION.md#server-98275dbb-protocol-qualification"
   },
+  {
+    "id": "sqlite-atomic-4ffdf4e9-v1",
+    "serverCommit": "4ffdf4e97ad43c55d8718a1df581596db2e6097d",
+    "contractSha256": "c12901b88b8e958c9cd63469298b9a04b9d5e2b0b4564d83b50f7ae95542519a",
+    "artifactSha256": "33079ebc5eb61d03dd4cccc0d104c47b0415beab1502a5b01fbc38f2cc30af2b",
+    "operations": [
+      "get_access_principal",
+      "get_artifact_revision",
+      "get_capabilities",
+      "get_default_scope",
+      "get_liveness",
+      "get_readiness",
+      "get_scope",
+      "list_scopes",
+      "remember_memory",
+      "search_memory"
+    ],
+    "evidence": "desktop/VALIDATION.md#server-4ffdf4e9-protocol-qualification"
+  },
   {
     "id": "sqlite-atomic-dd62723d-v1",
     "serverCommit": "dd62723dceabae8b41e293531f0080a819f87c68",
diff --git a/docs/en/development/releasing.md b/docs/en/development/releasing.md
index 69b815e2a4..0036cf640c 100644
--- a/docs/en/development/releasing.md
+++ b/docs/en/development/releasing.md
@@ -131,7 +131,10 @@ installation pins are synchronized.
 
 `release/upgrade-support.json` declares the target version, source-version selection policy, backends, and
 configurations. `automatic_sources` keeps 1.3.0 as its fixed baseline; explicit `cases` are empty.
-The gate requires twelve cases: one source × three backends × vectors enabled/disabled × Code enabled/disabled.
+The catalog declares twelve cases: one source × three backends × vectors enabled/disabled × Code enabled/disabled.
+Publication requires the ten automatic cases to pass. The two embedded seekDB configurations with Code enabled
+are temporarily manual-only because of native DDL waits; they remain unverified and are excluded from supported
+upgrade declarations. Passing the automatic gate does not establish complete twelve-case acceptance.
 The target is always the actual wheel built by CI. Future target releases keep testing 1.3.0;
 intervening releases are not added automatically. The registered 1.4.0 bridge remains implemented but is outside
 CI upgrade acceptance, so a passing gate does not certify its upgrade path. Source wheel URLs and SHA-256s are resolved
@@ -183,7 +186,8 @@ policy validation alone does not establish an upgrade path. Ordinary PR builds m
 version; the `--release` check must run against the final tagged wheel without overriding its version.
 
 The **Upgrade release gate** CI job requires successful public migration commands, full Server readiness, target
-startup, preserved records and new writes on real 1.3.0 databases in all twelve declared cases. Limited bundle verification with
+startup, preserved records and new writes on real 1.3.0 databases in all ten required automatic cases. The two
+manual seekDB Code cases do not block publication or establish supported upgrades. Limited bundle verification with
 `server_ready=false` fails. Every backend runs even if another backend fails, with separate logs and results.
 seekDB runs embedded in a temporary runner directory. PR and publication jobs start a disposable OceanBase CE
 container, wait for its MySQL tenant, archive diagnostics, and remove it even on failure. No external database
diff --git a/docs/zh/development/releasing.md b/docs/zh/development/releasing.md
index db8baa0718..a1d6c3573c 100644
--- a/docs/zh/development/releasing.md
+++ b/docs/zh/development/releasing.md
@@ -123,7 +123,9 @@ DSH README 中说明某项能力已包含在 `1.1.0` 的文字同样属于历史
 ### 数据库升级支持范围
 
 `release/upgrade-support.json` 声明目标版本、来源版本选择策略、后端和配置。`automatic_sources` 继续将 1.3.0
-作为固定基线，显式 `cases` 为空。共要求 12 个组合：一个来源 × 三种后端 × 向量开关 × Code 开关。
+作为固定基线，显式 `cases` 为空。共登记 12 个组合：一个来源 × 三种后端 × 向量开关 × Code 开关。
+发布要求十个自动验收组合全部通过。两个启用 Code 的嵌入式 seekDB 配置因原生 DDL 等待暂时仅手动运行，
+尚未验收，不计入支持的升级声明；自动门禁通过不代表完整的十二项验收通过。
 目标始终是本次 CI 构建的实际 wheel；后续目标发布版本继续测试 1.3.0，不自动加入中间发行版。
 1.4.0 桥接实现和登记仍保留，但不纳入 CI 升级验收；门禁通过不能证明该路径已通过验收。来源 wheel 的公开 PyPI 地址和 SHA-256 与目标产物一起记录。
 
@@ -162,7 +164,7 @@ uv run python scripts/run_upgrade_release_gate.py --release --release-notes /pat
 旧版发行包和目标 wheel。测试缺失、后端跳过、执行失败或证据缺失都会阻断检查。仅通过静态策略检查不表示
 存在升级路径。普通 PR 构建允许使用开发版本；`--release` 必须验证最终 tag 构建的 wheel，不能覆盖版本号。
 
-CI 中的 **Upgrade release gate** 要求真实 1.3.0 数据库在全部 12 个登记组合中通过公开命令迁移、
+CI 中的 **Upgrade release gate** 要求真实 1.3.0 数据库在十个必测自动组合中通过公开命令迁移、
 完整 Server 就绪验证、目标版本启动、历史数据读取和新增写入。局部迁移验证返回 `server_ready=false` 也会失败。一个后端失败后，仍继续执行其他后端，
 分别保存结果和日志。seekDB 直接在 runner 临时目录中以嵌入式启动；PR 和发布工作流均启动隔离的 OceanBase CE
 容器，等待 MySQL 租户就绪，归档诊断并在测试失败时也清理容器，不依赖外部数据库凭据。
diff --git a/tests/test_api_contract.py b/tests/test_api_contract.py
index a4672b80b2..92e89a677f 100644
--- a/tests/test_api_contract.py
+++ b/tests/test_api_contract.py
@@ -96,6 +96,7 @@
 from powercontext.http._generated.operations import (
     ACKNOWLEDGE_HANDOFF,
     ACTIVATE_HANDOFF,
+    API_VERSION,
     APPROVE_CANDIDATE,
     CAPTURE_CONTENT_SOURCE,
     CAPTURE_WORKING_NOTE,
@@ -197,7 +198,7 @@ def test_contract_uses_the_namespaced_request_id_header() -> None:
 def test_server_info_contract_is_observable_and_forward_compatible() -> None:
     contract = yaml.safe_load(CONTRACT_PATH.read_text())
 
-    assert contract["info"]["version"] == "1.4.1"
+    assert contract["info"]["version"] == API_VERSION
     operation = contract["paths"]["/v1/server-info"]["get"]
     assert operation["operationId"] == "get_server_info"
     assert operation["x-powercontext-access"] == {
diff --git a/website/src/lib/releases.ts b/website/src/lib/releases.ts
index 087abd95bc..388d498f60 100644
--- a/website/src/lib/releases.ts
+++ b/website/src/lib/releases.ts
@@ -32,27 +32,47 @@ export const releases: Release[] = [
     version: 'v1.4.1',
     date: '2026-10-26',
     title: {
-      en: 'Registered database upgrades and recovery',
-      zh: '已登记数据库的升级与恢复',
+      en: 'Faster recall and Memory writes · Portable archives · More reliable Agent and Desktop workflows',
+      zh: '优化检索与记忆写入 · 支持可移植归档 · 完善 Agent 与桌面工作流',
     },
     summary: {
-      en: 'PowerContext 1.4.1 completes the reusable Server migration framework with source recognition, ordered schema and data transitions, recovery evidence and full readiness checks. Release acceptance tests the real 1.3.0 source against the exact target artifact.',
-      zh: 'PowerContext 1.4.1 完善可复用的 Server 迁移框架，提供来源识别、有序结构与数据转换、恢复证据和完整就绪校验。发布验收使用真实 1.3.0 来源与本次目标产物。',
+      en: 'PowerContext 1.4.1 reduces repeated database work during recall and Memory writes, removes duplicate Source text from extraction requests, and adds offline archive export and restore. It also expands Kimi Code workflows, improves Desktop navigation and save recovery, and adds dependency and processing observations alongside managed logs.',
+      zh: 'PowerContext 1.4.1 减少检索和记忆写入中的重复数据库操作，移除提取请求中重复的 Source 正文，并支持离线归档导出与恢复。同时扩展 Kimi Code 工作流，完善桌面端导航与保存失败后的恢复操作，增加依赖和处理状态观测，并提供托管日志。',
     },
     changes: {
       en: [
-        'Use db-migrate status, plan, apply and verify for registered Server storage. Exact source layouts, reviewed plans, maintenance locks and explicit backup policies guard schema and data transitions; incomplete validation cannot report full Server readiness.',
+        'Reduce repeated database work by consolidating context recall queries, batching Memory lifecycle and authorization checks, reusing exact evidence revisions, and batching cited Experience reads. Scheduled processing skips consumed Scope windows, and Source capture can proceed while Memory extraction is running.',
+        'Remove duplicate Source text from Atomic Memory extraction requests and compact repeated bodies in additional model projections. Skip reconciliation when a candidate has no comparable memories, and return invalid reconciliation decisions to the model for correction within the configured retry budget.',
+        'Export, inspect, validate, and restore selected complete Scopes as portable .pcb archives. Preserve exact identities, revisions, evidence, and supported review state; validate conflicts before writes and recognize identical records on replay. This is an offline operator workflow, excludes deployment credentials and derived indexes, and does not replace a complete database backup or schema migration.',
+        'Complete the Server migration framework through db-migrate status, plan, apply and verify for registered Server storage. Exact source layouts, reviewed plans, maintenance locks and explicit backup policies guard schema and data transitions; incomplete validation cannot report full Server readiness.',
         'Preserve registered source history and original recovery evidence across interrupted upgrades and idempotent retries. Startup validates authoritative records, search projections, embedding profiles and retained history before serving requests.',
         'Display migration steps as v1_4_1_001 through v1_4_1_003 while preserving existing revision IDs and checksums. The 1.3.0 and 1.4.0 source bridges remain separate; registration does not certify every intermediate software release.',
-        'Require twelve installed-release upgrade combinations for 1.3.0 across SQLite, embedded seekDB and OceanBase, with vectors and Code enabled or disabled. The 1.4.0 bridge is outside this CI upgrade matrix. Failed, skipped or missing cases block publication; the support policy remains upgrade-required until acceptance is complete.',
-        'Stop writers and back up existing databases before maintenance. Drain unsupported queued or running 1.3.0 Dream tasks, preserve the historical embedding configuration, and follow the documented recovery procedure after interruption.',
+        'Declare twelve 1.3.0 upgrade combinations across SQLite, embedded seekDB, and OceanBase, with vectors and Code enabled or disabled. Publication requires the ten automatic cases to pass against the exact target artifact. The two seekDB cases with Code enabled remain manual-only, unverified, and excluded from supported upgrades; the 1.4.0 bridge is outside this CI matrix. Failed, skipped, or missing automatic cases block publication, and support remains upgrade-required until acceptance and the reviewed support declaration are complete.',
+        'Inspect durable Topic Memory processing blocks and explicitly resume eligible work after correcting its cause. Reject Topic Memory semantic mismatches, make the recall embedding budget configurable, and report why preparation fell back from semantic recall.',
+        'Expand the experimental Kimi Code integration with workspace Scope bindings and opt-in recommended/full tool profiles, including Handoff, Experience, managed Skill, and Candidate workflows. Initial setup still defaults to the minimal profile; larger profiles require the corresponding Server capabilities and explicit approval for review operations.',
+        'Improve Desktop shared navigation, Scope recovery, exact revision reading, and draft preservation after failed or ambiguous saves. Add an unsigned macOS app and disk-image preview and fix Linux packaged navigation. Protocol checks and hosted-runner tests do not establish signed distribution, clean-machine installation, or complete native accessibility coverage.',
+        'Add an independent local Ops tool for inspecting, configuring, and managing a prepared personal Server runtime through explicit preflight and apply operations. Runtime downloading, repair, and the Desktop installation bridge remain separate work. Add a Scope CLI command group and text search for Experiences in the web Dashboard.',
+        'Add managed rotating log files and worker log aggregation, plus dependency and processing observations. Bound HTTP request bodies and active responses, authenticate MCP calls per HTTP request, preserve path authorization, and make local write ownership atomic. Repair eligible ownerless migrated memories without inventing historical owners.',
+        'Aggregate streamed model output so generation can survive gateway idle timeouts while retaining a complete result. Python applications can explicitly inject the optional Jev reranker with its own credentials and pinned model; it is not enabled by default or configured through the Server environment settings.',
+        'Guard automatic prompt capture and context preparation, bound long-prompt recall and WorkBuddy Scope discovery, and improve Codex shim resolution and Windows receipt replacement. Reject blank text Sources at creation so they cannot poison later processing; make tool failures identify the rejected field or reason.',
+        'Upgrade Server, clients, and Agent integrations together only when the source version and backend have an accepted path for the exact target artifact. Stop writers, back up data and configuration, and review the migration plan. Drain unsupported queued or running 1.3.0 Dream tasks, preserve the historical embedding configuration, and follow the documented recovery procedure after interruption. Complete migration and full Server readiness verification before restarting services.',
       ],
       zh: [
-        '通过 db-migrate status、plan、apply、verify 维护已登记的 Server 存储。以精确来源结构、已审阅计划、维护锁和明确备份策略约束结构与数据转换；校验不完整时不能报告完整 Server 就绪。',
+        '合并上下文召回查询，批量处理 Memory 生命周期与授权检查，复用精确证据版本，并批量读取被引用的 Experience，减少重复数据库操作。定时处理跳过已消费的 Scope 窗口，Memory 提取期间仍可采集新的 Source。',
+        '移除 Atomic Memory 提取请求中重复的 Source 正文，并压缩其他模型投影中的重复内容。候选记忆没有可比较对象时跳过协调步骤；模型给出无效协调决策时，在配置的重试预算内反馈原因并请求纠正。',
+        '以可移植 .pcb 归档导出、检查、验证和恢复选定的完整 Scope，保留精确身份、历史版本、证据与受支持的审核状态；写入前检查冲突，重复恢复识别已有相同记录。这是离线运维操作，不包含部署凭据与派生索引，也不替代完整数据库备份或结构迁移。',
+        '完善 Server 迁移框架，通过 db-migrate status、plan、apply、verify 维护已登记的 Server 存储。以精确来源结构、已审阅计划、维护锁和明确备份策略约束结构与数据转换；校验不完整时不能报告完整 Server 就绪。',
         '中断升级和幂等重试保留已登记来源历史与原始恢复证据。启动前检查权威记录、搜索投影、向量配置和必留历史，再开放服务。',
         '迁移步骤显示为 v1_4_1_001 至 v1_4_1_003，保留原有 revision ID 和校验和。1.3.0、1.4.0 来源桥接独立登记，不能据此推导所有中间软件版本均通过验收。',
-        '发布门禁验证真实 1.3.0 到目标产物的十二个组合，覆盖 SQLite、嵌入式 seekDB、OceanBase 及向量、Code 开关。1.4.0 桥接不纳入该 CI 升级矩阵。失败、跳过或证据缺失均阻止发布；验收完成前保留 upgrade-required 策略。',
-        '维护前停止写入并备份已有数据库，排空不兼容的 1.3.0 queued／running Dream 任务，保持历史向量配置；发生中断时遵循文档中的恢复流程。',
+        '登记真实 1.3.0 到目标产物的十二个升级组合，覆盖 SQLite、嵌入式 seekDB、OceanBase 及向量、Code 开关。发布要求十个自动验收组合针对目标发行物全部通过；两个启用 Code 的 seekDB 组合暂仅支持手动执行，尚未验收，不计入支持的升级范围。1.4.0 桥接也不在该 CI 矩阵内。自动验收失败、跳过或证据缺失均阻止发布；验收和支持声明审阅完成前保留 upgrade-required 策略。',
+        '查看持久化的 Topic Memory 处理阻塞，修正原因后显式恢复符合条件的任务；拒绝语义不一致的 Topic Memory。支持配置召回 Embedding 预算，并说明上下文准备为何回退到非语义检索。',
+        '试验性 Kimi Code 集成新增工作目录与 Scope 绑定，并提供需显式选择的 recommended/full 工具档位，覆盖 Handoff、Experience、托管 Skill 与 Candidate 工作流。首次安装仍默认 minimal；更多工具需要相应 Server 能力，审核操作仍需显式批准。',
+        '完善桌面端共享导航、Scope 恢复、精确版本读取，以及保存失败或结果不确定时的草稿保留。新增未签名的 macOS 应用与磁盘镜像预览，修复 Linux 打包后的导航。协议检查和托管运行器测试不代表已完成签名发行、干净机器安装或完整原生无障碍验收。',
+        '新增独立本地 Ops 工具，通过显式预检与执行操作检查、配置和管理已准备好的个人 Server 运行环境。运行环境下载、修复与桌面安装桥接仍属于独立工作；新增 Scope CLI 命令组和网页 Dashboard 的 Experience 文本搜索。',
+        '新增托管轮转日志文件、Worker 日志汇聚，以及依赖和处理状态观测。限制 HTTP 请求体和活跃响应规模，按每次 HTTP 请求认证 MCP 调用，保留路径授权约束，并让本地写入与所有权登记原子提交。修复符合条件的迁移后无主记忆，同时保留历史所有权证据的真实边界。',
+        '聚合模型流式输出，让生成过程在网关空闲超时限制下持续接收数据并返回完整结果。Python 应用可显式注入 Jev 重排器，并配置独立凭据与固定模型；该能力默认不启用，也不通过 Server 环境变量配置。',
+        '为自动提示采集与上下文准备增加边界检查，限制长提示召回和 WorkBuddy Scope 发现，完善 Codex shim 解析与 Windows 回执替换。在创建时拒绝空白文本 Source，避免阻塞后续处理；工具失败时明确指出被拒绝的字段或原因。',
+        '只有来源版本与后端具备针对目标发行物的已验收升级路径时，才能一起升级 Server、Client 与 Agent 集成。先停止写入、备份数据与配置并检查迁移计划；排空不兼容的 1.3.0 queued／running Dream 任务，保持历史向量配置，发生中断时遵循文档中的恢复流程。完成迁移和完整 Server 就绪验证后再重启服务。',
       ],
     },
     installCommand: 'uv tool install --force "powercontext[cli,server]==1.4.1"',