feat(foundation): add ann runtime matrix proof

Author: Jacobinwwey

docs/diataxis/en/explanation/development-progress-dashboard.md

@@ -21,6 +21,8 @@ It tracks what is already implemented, where the hard gaps remain, and how to ve
   - the embedded sqlite baseline now also has restart-durability proof: shutdown closes the store cleanly, the adapter can reopen safely, and server integration covers ingest -> shutdown -> fresh module reload -> diagnostics/query/readiness continuity,
   - a host-level verifier now exercises that same embedded sqlite baseline through both `dist` runtime and packaged sidecar flows on the current Windows host: ingest -> store diagnostics/foundation readiness -> restart -> query continuity (`scripts/verify-foundation-sqlite-runtime.js`),
   - a host-level workload-matrix verifier now extends that proof across `smoke` / `medium` / `heavy` profiles on the same two runtime paths, including snapshot metadata counts plus restart and multi-point query continuity (`scripts/verify-foundation-sqlite-runtime.js --matrix`),
+  - a host-level ANN verifier now proves the `external_http` connector baseline on the same Windows host through both `dist` runtime and packaged sidecar flows: ingest -> live query-backend diagnostics -> restart -> query continuity (`scripts/verify-foundation-ann-runtime.js`),
+  - a host-level ANN workload-matrix verifier now extends that proof across `smoke` / `medium` / `heavy` profiles on the same two runtime paths, including sync/select telemetry, aligned representation metadata, and restart continuity (`scripts/verify-foundation-ann-runtime.js --matrix`),
   - ANN-style prefilter, representation telemetry, circuit health, remote index sync, and live `external_http` connector proof now exist in `src/learning/queryBackend.ts` and `src/learning/vectorAccelerationAdapter.ts`,
   - runtime capability/runbook governance now includes explicit ANN remote index-sync health (`query_vector_acceleration_index_sync_health`) in addition to prefilter, health, traceability, and circuit checks,
   - runtime capability governance now also includes explicit gate `query_vector_acceleration_calibration_readiness`, which formalizes whether the ANN path is even ready for release-grade threshold tuning,
@@ -33,7 +35,7 @@ It tracks what is already implemented, where the hard gaps remain, and how to ve
   - Phase-3 tutor/memory diagnostics remain real and now include an active default runtime tutor adapter path in `src/server.ts`, so normal server execution can emit adapter telemetry instead of staying catalog-only.
 - What is not closed yet:
   - Phase-1 A8 has advanced beyond a file-only default: `src/server.ts` now defaults to `graphdb/sqlite` with explicit file fallback, restart durability is already proved, host-level dist/runtime + packaged sidecar proof is in place, and a host-level workload matrix is now in place across `smoke` / `medium` / `heavy`, but soak / longer-duration / performance hardening is still open before calling the local graph backend production-closed,
-  - Phase-1 A9 is now operational rather than scaffold-only, but recall/latency calibration and larger-workload validation are still open before calling the ANN layer production-closed,
+  - Phase-1 A9 is now operational rather than scaffold-only: host-level runtime proof and a host-level workload matrix are now in place, but recall/latency threshold convergence and release-grade calibration are still open before calling the ANN layer production-closed,
   - Phase-2 quality/session/query observability is now real, but it is not yet release-closed because these gates still require release-grade calibration on top of the current graph/ANN operational baseline; the new ANN calibration-readiness gate only formalizes prerequisites, not closure,
   - default tutor routing is no longer catalog-only, but the runtime is still effectively `local`-first and retains explicit rule-engine fallback rather than a production-proven multi-provider routing policy.
 - Active execution focus therefore shifts to truth-first foundation recovery:
@@ -132,12 +134,13 @@ Current branch status for this slice:
 - M10 rollout profile operator visibility is now wired end-to-end: runtime payload now exposes `rolloutProfile` (store/vector strictness + aggregate mode), `runtime-capability-matrix` plus runbook/verify/history/history-checks/action-queue/remediation-history/replay-schedule endpoints (including remediation POST flows: `event`/`replay`/`schedule`/`tick`) now echo the same profile, and learning-workbench runtime summary now surfaces `rollout=<mode>(...)` cue; integration/contract/frontend behavior coverage is in place (`src/server.ts`, `src/notemd.server.integration.test.ts`, `src/knowledge.api.contract.test.ts`, `src/frontend/path_app.js`, `src/path_app.runtime_trace_filter.behavior.test.ts`),
 - the legacy global Path Mode entry now clears the docked pane first so full-path entry remains deterministic (`src/frontend/app.js`).
 
-## Latest Validation Snapshot (2026-05-14)
+## Latest Validation Snapshot (2026-05-18)
 
 - Reconfirmed on the current Windows host in this turn: `node node_modules/jest/bin/jest.js src/learning/runtimeCapability.test.ts src/knowledge.api.contract.test.ts --runInBand --no-cache`, `node node_modules/jest/bin/jest.js src/agent_workspace.frontend.test.ts --runInBand --no-cache`, `npm run test:agent-workspace:contracts`, `npm run build:with-vite`, `npm run docs:diataxis:check`, `npm run docs:site:build`, `NOTE_CONNECTION_AGENT_WORKSPACE_BROWSER_STRICT=1 NOTE_CONNECTION_AGENT_WORKSPACE_BROWSER_UI_STRICT=1 NOTE_CONNECTION_AGENT_WORKSPACE_BROWSER_UI_DYNAMIC_STRICT=1 node scripts/verify-agent-workspace-browser.js`.
-- Reconfirmed on the current Windows host in this turn: `npm run build:sidecar`, `npm run verify:foundation:sqlite-runtime`, `npm run verify:foundation:sqlite-runtime:matrix`.
+- Reconfirmed on the current Windows host in this turn: `npm run build:sidecar`, `npm run verify:foundation:sqlite-runtime`, `npm run verify:foundation:sqlite-runtime:matrix`, `npm run verify:foundation:ann-runtime`, `npm run verify:foundation:ann-runtime:matrix`.
 - The strict browser proof now explicitly verifies the bilingual runtime-runbook verify/checks ANN governance labels that were added in this slice: sync-health plus circuit, traceability, and prefilter summaries, along with the threshold/signal drilldowns and calibration-readiness cues that support budget-tuning work.
 - The embedded sqlite graph baseline now also has repeatable host-level runtime proofs outside Jest integration scope: the lighter verifier keeps `dist` runtime and packaged sidecar ingest -> diagnostics/readiness -> restart -> query continuity green, and the workload-matrix verifier proves the same two runtime paths across `smoke` / `medium` / `heavy` corpus sizes with snapshot metadata counts and multi-point restart queries.
+- The `external_http` ANN connector baseline now also has repeatable host-level runtime proofs outside Jest integration scope: the lighter verifier keeps `dist` runtime and packaged sidecar ingest -> query-backend diagnostics -> restart -> query continuity green, and the workload-matrix verifier proves the same two runtime paths across `smoke` / `medium` / `heavy` corpus sizes with sync/select telemetry and aligned representation metadata.
 - Tauri strict evidence is implementation-closed but still host-dependent:
   - the current Windows host proves non-strict tauri/runtime behavior and load-flow parity,
   - Linux strict evidence commands (`verify:agent-workspace:tauri:rust:strict`, `verify:agent-workspace:tauri:window-evidence:strict`, strict evidence index/manifest) still require provisioned `webkit2gtk-4.1`, `javascriptcoregtk-4.1`, and `libsoup-3.0`.

docs/diataxis/en/explanation/knowledge-mastery-evolution-roadmap.md

@@ -55,10 +55,10 @@ This requires:
 - The branch now contains real Phase-3 tutor/memory slices, but current HEAD should not be described as "Phase-1 closed".
 - The accurate state is:
   - Phase-1 A8 has advanced into an embedded local-backend baseline: graph/store ops semantics, embedded SQLite graphdb persistence/query paths, and HTTP adapter paths exist, the default runtime now targets `graphdb/sqlite` with explicit file fallback, restart durability is integration-proved, host-level dist/runtime + packaged sidecar proof is in place, and a host-level workload matrix is in place across `smoke` / `medium` / `heavy`; soak / longer-duration / performance hardening are still open.
-  - Phase-1 A9 has advanced into an ANN connector operational baseline: ANN-style prefilter, representation telemetry, remote index sync, and live `external_http` query proof now exist, but recall/latency calibration and larger-workload validation are still open.
+  - Phase-1 A9 has advanced into an ANN connector operational baseline: ANN-style prefilter, representation telemetry, remote index sync, live `external_http` query proof, host-level dist/runtime + packaged sidecar proof, and a host-level workload matrix across `smoke` / `medium` / `heavy` now exist, but recall/latency threshold convergence and release-grade calibration are still open.
   - Phase-2 now has an operational diagnostics baseline: `learning quality`, `session plan quality`, query comparison, staleness, query-backend config, and query-backend diagnostics are live in `KnowledgeLearningPlatform.ts`, but they are not yet release-closed because they still require release-grade calibration on top of the current graph/ANN operational baseline.
   - Phase-3 is now operational-baseline rather than catalog-only: tutor telemetry, tutor trace/provider trends, conversation memory, memory-policy diagnostics, and default runtime tutor-adapter injection are real, but production-proven multi-provider routing policy is still open.
-- Active rollout focus therefore changes from "assume closure and move on" to "keep the new A8 packaged/runtime and workload-matrix proofs green, finish the remaining soak/performance A8 closure plus A9 workload calibration, then move next into honest Phase-2 gate promotion."
+- Active rollout focus therefore changes from "assume closure and move on" to "keep the new A8 packaged/runtime and workload-matrix proofs green, keep the new A9 runtime and workload-matrix proofs green, finish the remaining soak/performance A8 closure plus A9 threshold convergence, then move next into honest Phase-2 gate promotion."
 
 ## Primary Structural Gaps Still Open
 
@@ -67,6 +67,7 @@ This requires:
    - treat restart durability, host-level packaged/runtime proof, and the new `smoke` / `medium` / `heavy` workload matrix as already proved, then extend verification into ops-preferred query semantics, fallback consistency, and soak/performance durability against that local graph engine.
 2. Real ANN connector closure:
    - keep the new live `external_http` connector path healthy under real sync/query traffic,
+   - keep the new host-level ANN runtime and workload-matrix proofs green,
    - benchmark recall/latency thresholds before calling the vector layer production-ready.
 3. Phase-2 quality gating:
    - keep the new `learning quality`, `session plan quality`, query-comparison, and staleness diagnostics aligned with the same runtime truth,

docs/diataxis/zh/explanation/development-progress-dashboard.md

@@ -11,6 +11,8 @@
   - embedded sqlite 基线现在还具备了重启耐久性证明：shutdown 会干净关闭 store，adapter 可安全重开，server integration 已覆盖 ingest -> shutdown -> fresh module reload -> diagnostics/query/readiness 连续性，
   - 现在已有一条主机级验证器，会在当前 Windows 宿主上分别走 `dist` runtime 与 packaged sidecar 两条路径，证明同一条 embedded sqlite 基线可以完成 ingest -> store diagnostics/foundation readiness -> restart -> query 连续性（`scripts/verify-foundation-sqlite-runtime.js`），
   - 现在还有一条主机级 workload matrix 验证器，把同样的证明扩展到 `smoke` / `medium` / `heavy` 三档语料规模：在同样两条 runtime 路径上验证 snapshot metadata 计数、restart 连续性与多点 query 连续性（`scripts/verify-foundation-sqlite-runtime.js --matrix`），
+  - 现在也已有一条主机级 ANN 验证器，会在当前 Windows 宿主上分别走 `dist` runtime 与 packaged sidecar 两条路径，证明同一条 `external_http` connector baseline 可以完成 ingest -> live query-backend diagnostics -> restart -> query 连续性（`scripts/verify-foundation-ann-runtime.js`），
+  - 现在还有一条主机级 ANN workload matrix 验证器，把同样的证明扩展到 `smoke` / `medium` / `heavy` 三档语料规模：在同样两条 runtime 路径上验证 sync/select telemetry、aligned representation metadata 与 restart 连续性（`scripts/verify-foundation-ann-runtime.js --matrix`），
   - `src/learning/queryBackend.ts` / `src/learning/vectorAccelerationAdapter.ts` 现已具备 ANN 风格 prefilter、representation telemetry、circuit health、远端索引同步，以及 live `external_http` connector 证明，
   - runtime capability / runbook 治理也已新增显式的 ANN 远端索引同步健康度检查（`query_vector_acceleration_index_sync_health`），与 prefilter、health、traceability、circuit 并列，
   - runtime capability 治理现在也新增了显式门禁 `query_vector_acceleration_calibration_readiness`，用来正式回答当前 ANN 路径是否已经具备进入发布级阈值校准的前提条件，
@@ -23,7 +25,7 @@
   - Phase-3 的导师/记忆诊断仍为真实实现，且 `src/server.ts` 现已注入默认激活态 tutor adapter，正常 server 路径可直接产出 adapter telemetry。
 - 当前仍未闭环的部分：
   - Phase-1 A8 已经超出 file-only 默认态：`src/server.ts` 现在默认走 `graphdb/sqlite` 并保留显式 file fallback，重启耐久性已证明，主机级 dist/runtime + packaged sidecar 证明也已具备，而且 `smoke` / `medium` / `heavy` 主机端 workload matrix 也已具备；但在宣布本地图后端达到生产闭环之前，仍需补齐 soak、长时段与性能级加固；
-  - Phase-1 A9 现已进入 operational baseline，而不再只是 scaffolding：但在宣布 ANN 层达到生产闭环前，仍需补齐 recall/latency 校准与更大工作负载验证；
+  - Phase-1 A9 现已进入 operational baseline，而不再只是 scaffolding：主机级 runtime 证明与主机级 workload matrix 也已具备；但在宣布 ANN 层达到生产闭环前，仍需补齐 recall/latency 阈值收敛与发布级校准；
   - Phase-2 的 quality/session/query 可观测性已不再是空占位，但它们仍需要建立在当前 graph/ANN operational baseline 之上的发布级校准，因此还不能宣称发布级闭环；新的 ANN calibration-readiness gate 只是把前提条件正式化，并不等于校准完成；
   - 默认 tutor routing 已不再只是 catalog-only，但当前 runtime 仍是 `local`-first，并保留显式 rule-engine fallback，而不是已验证的生产级多 provider 路由策略。
 - 因此当前活跃重心不是“默认认为 Phase-1 已完成然后推进上层”，而是：
@@ -144,12 +146,13 @@
 - M10 的 rollout profile 运维可观测性已打通：运行时 payload 新增 `rolloutProfile`（store/vector 严格度 + 聚合模式），`runtime-capability-matrix` 与 runbook/verify/history/history-checks/action-queue/remediation-history/replay-schedule 端点（含 remediation POST：`event`/`replay`/`schedule`/`tick`）同步回传该 profile；learning workbench runtime 摘要新增 `rollout=<mode>(...)` 提示，并已补齐集成/契约/前端行为测试覆盖（`src/server.ts`、`src/notemd.server.integration.test.ts`、`src/knowledge.api.contract.test.ts`、`src/frontend/path_app.js`、`src/path_app.runtime_trace_filter.behavior.test.ts`），
 - 旧的全局 Path Mode 入口在切入整屏路径工作区前会先释放停靠 pane，避免两条入口互相踩状态（`src/frontend/app.js`）。
 
-## 最新验证快照（2026-05-14）
+## 最新验证快照（2026-05-18）
 
 - 本轮已在当前 Windows 宿主重新确认通过：`node node_modules/jest/bin/jest.js src/learning/runtimeCapability.test.ts src/knowledge.api.contract.test.ts --runInBand --no-cache`、`node node_modules/jest/bin/jest.js src/agent_workspace.frontend.test.ts --runInBand --no-cache`、`npm run test:agent-workspace:contracts`、`npm run build:with-vite`、`npm run docs:diataxis:check`、`npm run docs:site:build`、`NOTE_CONNECTION_AGENT_WORKSPACE_BROWSER_STRICT=1 NOTE_CONNECTION_AGENT_WORKSPACE_BROWSER_UI_STRICT=1 NOTE_CONNECTION_AGENT_WORKSPACE_BROWSER_UI_DYNAMIC_STRICT=1 node scripts/verify-agent-workspace-browser.js`。
-- 本轮已在当前 Windows 宿主重新确认通过：`npm run build:sidecar`、`npm run verify:foundation:sqlite-runtime`、`npm run verify:foundation:sqlite-runtime:matrix`。
+- 本轮已在当前 Windows 宿主重新确认通过：`npm run build:sidecar`、`npm run verify:foundation:sqlite-runtime`、`npm run verify:foundation:sqlite-runtime:matrix`、`npm run verify:foundation:ann-runtime`、`npm run verify:foundation:ann-runtime:matrix`。
 - 严格浏览器证据现在已显式校验本轮新增的双语 runtime-runbook verify/checks ANN 治理标签：不仅验证 sync-health，也验证熔断、可追踪性、预筛选摘要，以及支撑校准工作的阈值/信号钻取和校准就绪态。
 - embedded sqlite 图基线现在也具备了 Jest 集成测试之外、可重复执行的主机级运行时证明：轻载验证会让 `dist` runtime 与 packaged sidecar 两条路径持续保持 ingest -> diagnostics/readiness -> restart -> query 连续性，而 workload matrix 验证则会在同样两条路径上证明 `smoke` / `medium` / `heavy` 三档 workload 的 snapshot metadata / restart / 多点 query 连续性。
+- `external_http` ANN connector baseline 现在也具备了 Jest 集成测试之外、可重复执行的主机级运行时证明：轻载验证会让 `dist` runtime 与 packaged sidecar 两条路径持续保持 ingest -> query-backend diagnostics -> restart -> query 连续性，而 workload matrix 验证则会在同样两条路径上证明 `smoke` / `medium` / `heavy` 三档 workload 的 sync/select telemetry 与 aligned representation metadata。
 - Tauri strict 证据链在实现层面已经闭环，但仍受宿主依赖约束：
   - 当前 Windows 宿主已经证明 non-strict tauri/runtime 行为与 load-flow parity，
   - Linux strict 证据命令（`verify:agent-workspace:tauri:rust:strict`、`verify:agent-workspace:tauri:window-evidence:strict` 及 strict evidence index/manifest）仍要求宿主预装 `webkit2gtk-4.1`、`javascriptcoregtk-4.1`、`libsoup-3.0`。