docs: 术语与架构措辞对齐（coldcontext / stablemem / security+device 模块）

1. 术语统一：
   - doc_query / doc_commit → coldcontext_query / coldcontext_commit
   - 「图记忆 / Graph 层」→「稳定记忆 / Stablemem 层（L3）」
   - 分层命名补上 L1/L2/L3 语义：Context(热) / Cold-context(冷) / Stablemem(持久)
   涉及 README.md、README_EN.md、assets/docs/{zh,en}/{ARCHITECTURE,OVERVIEW}.md

2. 补上本次最大的结构变化（文档里此前完全没有）：
   - 安全防火墙作为**独立内核模块**：凭据闸门、工具黑白名单+沙箱、
     敏感词与提示词注入预警、按主体授权与插件命名限式；显式代理而非 monkey patch
   - device 数据面作为**独立内核模块**：工具注册与路由、inputch/outputch、设备登记；
     路由表在 internal/toolroute 以避免 core ↔ kernelboot 成环

3. 历史计划文档（memory-*.md / context-overflow-l4-design / entities-retirement /
   git-branching）加**归档说明**：明确术语已过时、现行口径以 ARCHITECTURE.md 为准。
   刻意不改写历史正文 —— 那是决策记录，改写等于伪造。

剩余旧词只出现在归档文档与 scripts/capability-bench/PLAN.md（评测历史记录）。

assets/docs/en/OVERVIEW.md

@@ -30,9 +30,9 @@ require touching the kernel, and no second version of business truth accumulates
 **Three-Layer Memory Architecture** — Manages information retention across long agent runtimes through a tiered storage strategy:
 - **Context Layer**: In-memory pretrained word embedding scored event window (StaticEmbedder word vectors → CosineSimilarity, TF-IDF fallback), maintains recent context in real-time, low-relevance events automatically sink to the next layer
 - **Document Layer**: JSON files + TF-IDF vector-indexed temporary memory, supports explicit submission and implicit archival, cold data distills to Graph
-- **Graph Layer**: SQLite graph database, persists entities and relations, BFS traversal recall, distillation pipeline extracts triples from conversations
+- **Stablemem Layer**: SQLite graph database, persists entities and relations, BFS traversal recall, distillation pipeline extracts triples from conversations
 
-Three progressive layers — context, cold archive, long-term graph memory — form an information decay and consolidation pipeline from short-term to persistent storage.
+Three progressive layers — context, cold archive, long-term stable memory — form an information decay and consolidation pipeline from short-term to persistent storage.
 
 **Media Memory (first-class memory blocks since v1.2.0)** — Images and audio are not attachments; they are first-class nodes of memory:
 - **Content-addressed store (CAS)**: addressed by digest, metadata in SQLite and blobs on disk (two-level
@@ -44,7 +44,7 @@ Three progressive layers — context, cold archive, long-term graph memory — f
   Context → Document → Graph is a **migration** of a block, not a copy, and nothing is kept alive by
   references; **deleting a block deletes its content.**
 - **Reaches the plugin boundary since v1.1.1**: plugins read and write media through `InsertWithMedia` /
-  `InjectInputMedia`; the model attaches media via the `media_digests` argument of `memory_commit` / `doc_commit`.
+  `InjectInputMedia`; the model attaches media via the `media_digests` argument of `memory_commit` / `coldcontext_commit`.
 - **The old mechanism was removed entirely**: the **descriptive index** — writing the vision model's
   description into the body text as a `[<mime> <short digest>] <description>` marker and retrieving by it —
   together with `media_refs` reference counting, was deleted in v1.2.0. A description is second-hand