feat(foundation): verify sqlite runtime across dist and sidecar

Author: Jacobinwwey

docs/diataxis/en/explanation/development-progress-dashboard.md

@@ -19,6 +19,7 @@ It tracks what is already implemented, where the hard gaps remain, and how to ve
 - What is real at HEAD:
   - graph/store operations semantics exist in `src/learning/store.ts`, including file-backed ops, embedded SQLite graphdb persistence/query paths, and HTTP adapter paths with fallback diagnostics,
   - the embedded sqlite baseline now also has restart-durability proof: shutdown closes the store cleanly, the adapter can reopen safely, and server integration covers ingest -> shutdown -> fresh module reload -> diagnostics/query/readiness continuity,
+  - a new host-level verifier now exercises that same embedded sqlite baseline through both `dist` runtime and packaged sidecar flows on the current Windows host: ingest -> store diagnostics/foundation readiness -> restart -> query continuity (`scripts/verify-foundation-sqlite-runtime.js`),
   - ANN-style prefilter, representation telemetry, circuit health, remote index sync, and live `external_http` connector proof now exist in `src/learning/queryBackend.ts` and `src/learning/vectorAccelerationAdapter.ts`,
   - runtime capability/runbook governance now includes explicit ANN remote index-sync health (`query_vector_acceleration_index_sync_health`) in addition to prefilter, health, traceability, and circuit checks,
   - runtime capability governance now also includes explicit gate `query_vector_acceleration_calibration_readiness`, which formalizes whether the ANN path is even ready for release-grade threshold tuning,
@@ -30,12 +31,12 @@ It tracks what is already implemented, where the hard gaps remain, and how to ve
   - Phase-2 runtime diagnostics are now materially implemented in `src/learning/KnowledgeLearningPlatform.ts` for query-backend comparison/history/trend, knowledge staleness diagnostics/rebuild planning, learning-quality history/trend, session-plan quality evaluation/history/trend/runtime-threshold diagnostics, query-backend config, and query-backend diagnostics,
   - Phase-3 tutor/memory diagnostics remain real and now include an active default runtime tutor adapter path in `src/server.ts`, so normal server execution can emit adapter telemetry instead of staying catalog-only.
 - What is not closed yet:
-  - Phase-1 A8 has advanced beyond a file-only default: `src/server.ts` now defaults to `graphdb/sqlite` with explicit file fallback, and restart durability is already proved, but packaged/runtime proof and heavier-workload hardening are still open before calling the local graph backend production-closed,
+  - Phase-1 A8 has advanced beyond a file-only default: `src/server.ts` now defaults to `graphdb/sqlite` with explicit file fallback, restart durability is already proved, and host-level dist/runtime + packaged sidecar proof is now in place, but heavier-workload hardening is still open before calling the local graph backend production-closed,
   - Phase-1 A9 is now operational rather than scaffold-only, but recall/latency calibration and larger-workload validation are still open before calling the ANN layer production-closed,
   - Phase-2 quality/session/query observability is now real, but it is not yet release-closed because these gates still require release-grade calibration on top of the current graph/ANN operational baseline; the new ANN calibration-readiness gate only formalizes prerequisites, not closure,
   - default tutor routing is no longer catalog-only, but the runtime is still effectively `local`-first and retains explicit rule-engine fallback rather than a production-proven multi-provider routing policy.
 - Active execution focus therefore shifts to truth-first foundation recovery:
-  - finish the remaining packaged/runtime + heavier-workload closure for the embedded graph backend baseline,
+  - finish the remaining heavier-workload closure for the embedded graph backend baseline while keeping the new dist/runtime + packaged sidecar proof green,
   - finish the remaining workload/threshold closure for the now-live ANN connector baseline,
   - move the newly surfaced ANN runbook visibility from operator-readable summaries to workload-calibrated release gates,
   - keep the new diagnostic surfaces honest against the same runtime truth,
@@ -133,7 +134,9 @@ Current branch status for this slice:
 ## Latest Validation Snapshot (2026-05-14)
 
 - Reconfirmed on the current Windows host in this turn: `node node_modules/jest/bin/jest.js src/learning/runtimeCapability.test.ts src/knowledge.api.contract.test.ts --runInBand --no-cache`, `node node_modules/jest/bin/jest.js src/agent_workspace.frontend.test.ts --runInBand --no-cache`, `npm run test:agent-workspace:contracts`, `npm run build:with-vite`, `npm run docs:diataxis:check`, `npm run docs:site:build`, `NOTE_CONNECTION_AGENT_WORKSPACE_BROWSER_STRICT=1 NOTE_CONNECTION_AGENT_WORKSPACE_BROWSER_UI_STRICT=1 NOTE_CONNECTION_AGENT_WORKSPACE_BROWSER_UI_DYNAMIC_STRICT=1 node scripts/verify-agent-workspace-browser.js`.
+- Reconfirmed on the current Windows host in this turn: `npm run build:sidecar`, `npm run verify:foundation:sqlite-runtime`.
 - The strict browser proof now explicitly verifies the bilingual runtime-runbook verify/checks ANN governance labels that were added in this slice: sync-health plus circuit, traceability, and prefilter summaries, along with the threshold/signal drilldowns and calibration-readiness cues that support budget-tuning work.
+- The embedded sqlite graph baseline now also has a repeatable host-level runtime proof outside Jest integration scope: both `dist` runtime and packaged sidecar flows preserve ingest -> diagnostics/readiness -> restart -> query continuity on the same runtime data directory.
 - Tauri strict evidence is implementation-closed but still host-dependent:
   - the current Windows host proves non-strict tauri/runtime behavior and load-flow parity,
   - Linux strict evidence commands (`verify:agent-workspace:tauri:rust:strict`, `verify:agent-workspace:tauri:window-evidence:strict`, strict evidence index/manifest) still require provisioned `webkit2gtk-4.1`, `javascriptcoregtk-4.1`, and `libsoup-3.0`.

docs/diataxis/zh/explanation/development-progress-dashboard.md

@@ -9,6 +9,7 @@
 - 当前已经真实落地的部分：
   - `src/learning/store.ts` 已具备 file-backed ops、embedded SQLite graphdb persistence/query 路径，以及 HTTP adapter 语义路径，
   - embedded sqlite 基线现在还具备了重启耐久性证明：shutdown 会干净关闭 store，adapter 可安全重开，server integration 已覆盖 ingest -> shutdown -> fresh module reload -> diagnostics/query/readiness 连续性，
+  - 现在还有一条新的主机级验证器，会在当前 Windows 宿主上分别走 `dist` runtime 与 packaged sidecar 两条路径，证明同一条 embedded sqlite 基线可以完成 ingest -> store diagnostics/foundation readiness -> restart -> query 连续性（`scripts/verify-foundation-sqlite-runtime.js`），
   - `src/learning/queryBackend.ts` / `src/learning/vectorAccelerationAdapter.ts` 现已具备 ANN 风格 prefilter、representation telemetry、circuit health、远端索引同步，以及 live `external_http` connector 证明，
   - runtime capability / runbook 治理也已新增显式的 ANN 远端索引同步健康度检查（`query_vector_acceleration_index_sync_health`），与 prefilter、health、traceability、circuit 并列，
   - runtime capability 治理现在也新增了显式门禁 `query_vector_acceleration_calibration_readiness`，用来正式回答当前 ANN 路径是否已经具备进入发布级阈值校准的前提条件，
@@ -20,12 +21,12 @@
   - `src/learning/KnowledgeLearningPlatform.ts` 中的 Phase-2 运行时诊断面已接通真实实现，包括 query-backend comparison/history/trend、knowledge staleness diagnostics/rebuild planning、learning-quality history/trend、session-plan quality evaluate/history/trend/runtime-threshold diagnostics、query-backend config、query-backend diagnostics，
   - Phase-3 的导师/记忆诊断仍为真实实现，且 `src/server.ts` 现已注入默认激活态 tutor adapter，正常 server 路径可直接产出 adapter telemetry。
 - 当前仍未闭环的部分：
-  - Phase-1 A8 已经超出 file-only 默认态：`src/server.ts` 现在默认走 `graphdb/sqlite` 并保留显式 file fallback，且重启耐久性已证明；但在宣布本地图后端达到生产闭环之前，packaged/runtime 证明与更重工作负载级加固仍未完成；
+  - Phase-1 A8 已经超出 file-only 默认态：`src/server.ts` 现在默认走 `graphdb/sqlite` 并保留显式 file fallback，重启耐久性已证明，而且主机级 dist/runtime + packaged sidecar 证明也已具备；但在宣布本地图后端达到生产闭环之前，更重工作负载级加固仍未完成；
   - Phase-1 A9 现已进入 operational baseline，而不再只是 scaffolding：但在宣布 ANN 层达到生产闭环前，仍需补齐 recall/latency 校准与更大工作负载验证；
   - Phase-2 的 quality/session/query 可观测性已不再是空占位，但它们仍需要建立在当前 graph/ANN operational baseline 之上的发布级校准，因此还不能宣称发布级闭环；新的 ANN calibration-readiness gate 只是把前提条件正式化，并不等于校准完成；
   - 默认 tutor routing 已不再只是 catalog-only，但当前 runtime 仍是 `local`-first，并保留显式 rule-engine fallback，而不是已验证的生产级多 provider 路由策略。
 - 因此当前活跃重心不是“默认认为 Phase-1 已完成然后推进上层”，而是：
-  1. 先补完 embedded graph backend 基线剩余的 packaged/runtime + 更重工作负载闭环，
+  1. 在保持新的 dist/runtime + packaged sidecar 证明持续为绿的前提下，先补完 embedded graph backend 基线剩余的更重工作负载闭环，
   2. 补完当前 live ANN connector baseline 的工作负载与阈值闭环，
   3. 把当前已前推到 runbook 卡片中的 ANN 指标可见性，继续推进为带工作负载校准的发布级门禁，
   4. 让这批新诊断面始终与同一份运行时真相保持一致，
@@ -145,7 +146,9 @@
 ## 最新验证快照（2026-05-14）
 
 - 本轮已在当前 Windows 宿主重新确认通过：`node node_modules/jest/bin/jest.js src/learning/runtimeCapability.test.ts src/knowledge.api.contract.test.ts --runInBand --no-cache`、`node node_modules/jest/bin/jest.js src/agent_workspace.frontend.test.ts --runInBand --no-cache`、`npm run test:agent-workspace:contracts`、`npm run build:with-vite`、`npm run docs:diataxis:check`、`npm run docs:site:build`、`NOTE_CONNECTION_AGENT_WORKSPACE_BROWSER_STRICT=1 NOTE_CONNECTION_AGENT_WORKSPACE_BROWSER_UI_STRICT=1 NOTE_CONNECTION_AGENT_WORKSPACE_BROWSER_UI_DYNAMIC_STRICT=1 node scripts/verify-agent-workspace-browser.js`。
+- 本轮已在当前 Windows 宿主重新确认通过：`npm run build:sidecar`、`npm run verify:foundation:sqlite-runtime`。
 - 严格浏览器证据现在已显式校验本轮新增的双语 runtime-runbook verify/checks ANN 治理标签：不仅验证 sync-health，也验证熔断、可追踪性、预筛选摘要，以及支撑校准工作的阈值/信号钻取和校准就绪态。
+- embedded sqlite 图基线现在也具备了 Jest 集成测试之外、可重复执行的主机级运行时证明：`dist` runtime 与 packaged sidecar 两条路径都会在同一个 runtime data 目录上保持 ingest -> diagnostics/readiness -> restart -> query 连续性。
 - Tauri strict 证据链在实现层面已经闭环，但仍受宿主依赖约束：
   - 当前 Windows 宿主已经证明 non-strict tauri/runtime 行为与 load-flow parity，
   - Linux strict 证据命令（`verify:agent-workspace:tauri:rust:strict`、`verify:agent-workspace:tauri:window-evidence:strict` 及 strict evidence index/manifest）仍要求宿主预装 `webkit2gtk-4.1`、`javascriptcoregtk-4.1`、`libsoup-3.0`。

docs/en/TEST_REPORT.md

@@ -41,6 +41,10 @@
   - PASS
 - [x] `npm run build:with-vite`
   - PASS
+- [x] `npm run build:sidecar`
+  - PASS
+- [x] `npm run verify:foundation:sqlite-runtime`
+  - PASS
 - [x] `npm run docs:diataxis:check`
   - PASS
 - [x] `npm run docs:site:build`
@@ -50,14 +54,18 @@
 
 ### What This Refresh Adds
 
-1. The Phase-2 ANN governance slice is now operator-visible through the frontend runbook shell, not only backend JSON:
+1. The embedded `graphdb/sqlite` baseline now also has repeatable host-level runtime proof on the current Windows machine:
+   - `npm run verify:foundation:sqlite-runtime` covers both `dist` runtime and packaged sidecar flows,
+   - both modes now prove ingest -> store diagnostics/foundation readiness -> restart -> query continuity on the same runtime data directory,
+   - A8 is therefore no longer blocked on missing packaged/runtime evidence; the remaining honest gap is heavier-workload hardening.
+2. The Phase-2 ANN governance slice is now operator-visible through the frontend runbook shell, not only backend JSON:
    - verify/checks now surface ANN sync-health, circuit-budget, traceability, and prefilter summaries plus threshold/signal drilldowns,
    - they now also surface ANN circuit budget flags and prefilter calibration-readiness cues,
    - action-queue continues to carry the index-sync incident drilldown.
-2. `query_vector_acceleration_prefilter_effectiveness` now shares the ANN fast-lane escalation path instead of using the slower generic escalation branch.
-3. Runtime capability governance now has explicit gate `query_vector_acceleration_calibration_readiness`, which fails or warns until the ANN path has representative sync/prefilter/traceability/stability telemetry in the same runtime window.
-4. The workspace verify/checks cards now surface that calibration-readiness gate directly, instead of forcing operators to infer it only from the underlying budget signals.
-5. This refresh still does **not** prove release-grade Phase-2 closure:
+3. `query_vector_acceleration_prefilter_effectiveness` now shares the ANN fast-lane escalation path instead of using the slower generic escalation branch.
+4. Runtime capability governance now has explicit gate `query_vector_acceleration_calibration_readiness`, which fails or warns until the ANN path has representative sync/prefilter/traceability/stability telemetry in the same runtime window.
+5. The workspace verify/checks cards now surface that calibration-readiness gate directly, instead of forcing operators to infer it only from the underlying budget signals.
+6. This refresh still does **not** prove release-grade Phase-2 closure:
    - it closes visibility and browser/runtime proof for the new ANN governance summaries,
    - it does **not** close workload/threshold calibration for those budgets.
 
@@ -69,7 +77,7 @@
    - conversation memory lifecycle,
    - memory-policy diagnostics/history/trend.
 2. These passes do **not** prove Phase-1 A8/A9 closure:
-   - runtime no longer defaults to `local-file-graphdb`, and restart durability for the embedded `graphdb/sqlite` baseline is now integration-proved, but packaged/runtime proof and heavier workload hardening still remain,
+   - runtime no longer defaults to `local-file-graphdb`, restart durability for the embedded `graphdb/sqlite` baseline is integration-proved, and host-level dist/runtime + packaged sidecar proof is now in place, but heavier workload hardening still remains,
    - ANN no longer stops at query-only scaffolding: the `external_http` path now has remote index sync plus live end-to-end query proof, but workload and threshold calibration still remain before production closure.
 3. These passes do **not** prove Phase-2 quality-gate closure:
    - query comparison, staleness, learning-quality, session-plan-quality, and query-backend diagnostics are now implementation-real, but they still require release-grade calibration on top of the current graph/ANN operational baseline.

docs/en/TODO.md

@@ -9,7 +9,8 @@
 - [x] Query-backend comparison/history/trend, staleness diagnostics/rebuild planning, learning-quality history/trend, session-plan quality evaluate/history/trend/runtime-threshold diagnostics, query-backend config, and query-backend diagnostics are now live in `src/learning/KnowledgeLearningPlatform.ts`.
 - [x] Default server runtime now injects an active local `tutorAdapter` while retaining the `local` + `cloud` adapter catalog.
 - [x] Default runtime graph backend is no longer `local-file-graphdb`: the server now targets embedded `graphdb/sqlite` with explicit file fallback.
-- [~] The new embedded `graphdb/sqlite` baseline is now restart-durability-proved, but packaged/runtime proof and heavier workload gates still remain before calling A8 production-closed.
+- [x] Host-level dist runtime plus packaged sidecar verification now proves the embedded `graphdb/sqlite` baseline across ingest -> store diagnostics/foundation readiness -> restart -> query continuity on the current Windows host (`npm run verify:foundation:sqlite-runtime`).
+- [~] The new embedded `graphdb/sqlite` baseline is now restart-durability-proved and host-level runtime-packaging-proved, but heavier workload gates still remain before calling A8 production-closed.
 - [~] Phase-1 A9 now has a live `external_http` connector baseline with remote index sync and end-to-end query proof, but recall/latency thresholds and larger-workload validation still remain before production closure.
 - [x] Agent-workspace runbook verify/checks now surface ANN index-sync, circuit, traceability, and prefilter summaries plus threshold/signal drilldowns, while action-queue keeps the index-sync incident drilldown.
 - [x] `query_vector_acceleration_prefilter_effectiveness` now shares the ANN fast-lane escalation path instead of lagging behind the other ANN governance checks.
@@ -38,11 +39,12 @@ After syncing the repository to the latest upstream `main` baseline, we re-audit
   - [x] ANN connector hardening does expose candidate normalization, representation telemetry, and prefilter effectiveness signals.
   - [x] Default runtime now targets an embedded `graphdb/sqlite` backend with explicit file fallback.
   - [x] Embedded sqlite restart durability is now covered by server integration proof (`ingest -> shutdown -> fresh module restart -> query/readiness continuity`).
+  - [x] Host-level dist runtime + packaged sidecar verification now proves the same embedded sqlite baseline across ingest/readiness/diagnostics/restart/query continuity (`npm run verify:foundation:sqlite-runtime`).
   - [x] The `external_http` ANN path now syncs a remote prefilter index and serves live query traffic under integration proof.
-  - [ ] Packaged/runtime proof and heavier workload hardening still remain for A8.
+  - [ ] Heavier workload hardening still remains for A8.
   - [ ] ANN still needs workload/threshold calibration before production closure.
 - [ ] Next active implementation phase is now split:
-  - [ ] finish the remaining A8 packaged/runtime + workload closure,
+  - [ ] finish the remaining A8 heavier-workload closure on top of the new dist/runtime + packaged sidecar proof,
   - [ ] finish the remaining A9 workload/threshold closure on top of the live connector baseline,
   - [ ] move next into Phase-2 release-grade gate hardening,
   - [ ] continue Phase-3 tutor/memory hardening in parallel.