- The user selects or inherits a scoped workspace/corpus target.
agent_workspace.jssends the conversation request withactiveTargetandscope.KnowledgeLearningPlatform.agentConversation()resolves scoped retrieval, grouped knowledge points, citations, memory actions, and a durableknowledgeRun.conversationComposer.tsorganizes the grounded reply into structured blocks while preserving legacyassistantMessage.- The frontend renders the reply and presents grouped file-first knowledge hits.
- Clicking a grouped knowledge hit can open source markdown in the graph-focus pane, where matched spans are highlighted in-place.
- Workflow artifacts such as
flashcard_batchandknowledge_runcan be queried and followed up through dedicated runtime endpoints.
- Structured grounded conversation is operational with additive compatibility.
- Graph focus can render original markdown knowledge sources with matched-span highlighting.
- Durable workflow artifacts now exist for review loops and knowledge-run inspection.
- The current DAG-backed learning substrate already exists underneath retrieval and learning-path/session flows.
- The visible answer area is still richer than the final intended product surface and should contract toward a single targeted answer.
- Left-side knowledge hits still need to converge on a right-pane-first reading model.
- The current DAG still needs a dedicated graph-conditioned context-assembly layer before answer synthesis can be called graph-native.
- 用户选择或继承一个 scoped workspace/corpus target。
agent_workspace.js会把activeTarget与scope一起发送到会话请求中。KnowledgeLearningPlatform.agentConversation()解析 scoped retrieval、grouped knowledge point、citation、memory action 与 durableknowledgeRun。conversationComposer.ts会把 grounded reply 组织为结构化 block，同时继续保留 legacyassistantMessage。- 前端渲染回答，并展示按文件优先的 grouped knowledge hit。
- 点击 grouped knowledge hit 后，可在 graph-focus pane 中打开原始 markdown，并在原文内高亮 matched span。
flashcard_batch与knowledge_run这类 workflow artifact 现在也可以通过独立运行时端点进行查询与 follow-up。
- 结构化 grounded conversation 已进入可运行状态，并保持 additive compatibility。
- graph focus 已能渲染原始知识 markdown，并在原文中高亮 matched span。
- 用于 review loop 与 knowledge-run inspection 的 durable workflow artifact 已经存在。
- 当前 DAG 学习底座已经在 retrieval 与 learning-path/session 流水线下方真实存在。
- 用户可见回答区仍比最终目标产品面更重，仍需继续收缩为“一个 targeted answer 优先”。
- 左侧 knowledge hit 仍需进一步收敛为 right-pane-first 阅读模型。
- 现有 DAG 仍需 dedicated graph-conditioned context-assembly layer，才能让 answer synthesis 进入真正 graph-native 状态。
This addendum documents the current Bridge-first runtime flow after migration progress:
- Tauri launches the Rust host process.
- Rust spawns the Node sidecar and Godot executable.
- Godot connects to PathBridge (
ws://127.0.0.1:9876). - Backend receives configuration/path actions through bridge messages.
- Graph data is restored from cache or rebuilt and then synchronized to frontend/Godot consumers.
- Sidecar startup and graph build pipeline execute successfully in Tauri mini GPU runs.
- Worker-thread graph stages (keyword/statistical/layout workers) resolve from runtime paths correctly in sidecar execution.
- Path Mode control migration is operational with Godot-driven settings and actions.
- Existing-data prompt behavior must consistently ask users to reuse cache or rebuild before load.
- Startup should avoid duplicate load execution after a single load action.
- WebSocket startup sequencing should avoid redundant early disconnect/reconnect cycles.
- History recording should capture center-node switching triggered by double-click navigation in Godot.
- Run
npm run tauri:dev:mini:gpu. - Select a source that already has cached data.
- Confirm exactly one prompt appears and exactly one load path executes.
- Confirm no duplicate build/restore in sidecar logs.
- Confirm History list updates when switching central nodes in Godot.
本补充说明记录了迁移后 Bridge-first 的当前运行流程：
- Tauri 启动 Rust 宿主进程。
- Rust 拉起 Node Sidecar 与 Godot 可执行文件。
- Godot 连接 PathBridge（
ws://127.0.0.1:9876）。 - 后端通过桥接消息接收配置与路径动作。
- 图数据从缓存恢复或重新构建后，同步给前端/Godot 使用方。
- 在 Tauri mini GPU 运行下，Sidecar 启动与图构建流水线可正常执行。
- 图构建的 worker 阶段（关键词/统计/布局）在 Sidecar 运行时路径解析正确。
- Path Mode 控制迁移已可用，由 Godot 侧设置与动作驱动。
- 缓存已存在时，应稳定提示用户选择复用缓存或重建。
- 单次加载动作不应触发重复执行。
- WebSocket 启动时序应避免早期重复断开/重连。
- Godot 双击切换中心节点时，History 记录应同步更新。
- 运行
npm run tauri:dev:mini:gpu。 - 选择一个已有缓存数据的源。
- 确认只出现一次提示，且只执行一次加载路径。
- 确认 Sidecar 日志中无重复 build/restore。
- 确认 Godot 切换中心节点后 History 列表有记录。
Issue: When double-clicking a node or switching the center, the Tree View would crash and revert to a linear list because the treeLayout data was missing from the update payload.
Fix: Updated path_app.js's switchCentral function to explicitly call triggerUpdate(). This forces the Web Worker to re-calculate the full treeLayout (including correct levels and connections) for the new central node before sending it to Godot.
- In-Degree Display Setting: Added option to toggle between "Visible" (default) and "Total" In-Degree counts in Node Popup.
- Godot Lazy Loading: Implemented "Expand (+)" and "Collapse (-)" buttons in Godot Tree View to manage prerequisite visibility.
- i18n Fixes: Added missing keys
focus_inbound/focus_outboundto English and Chinese locales.
- Visuals ("Zen Mode"): Simplified view removing all extra buttons. Only nodes and connections are visible.
- Interactions:
- Double Click / Right Click: Toggle Context (Expand/Collapse prerequisites).
- Long Press (Left): Navigate to Node (Switch Central). Visualized by a progress ring overlay.
- Middle Click: Collapse All nodes (Reset view).
- Focus Mode:
- Toggle via Settings ("Focus on this node").
- Highlights the Central Node and its direct incoming prerequisites.
- Dims all other nodes to reduce clutter and focus on immediate dependencies.
- This creates a cleaner, less cluttered tree where lines only connect direct neighbors (Level 1 → Level 2), as requested.
Last Node Cleanup:
- The "Expand" button logic relies on data validation. With the
treeLayoutnow correctly re-computing, the "Target" node (which corresponds to the end of the chain) correctly reports0children in the layout, so the expand button will automatically be hidden.
- Navigation: Double-clicking nodes in Tree View now correctly keeps the Tree View active and re-centers the graph.
- Aesthetics: Long, confusing Bezier curves skipping levels are gone.
- Data: In-degree numbers are visible.
- Missing Edges: Fixed
treeLayouthaving 0 edges by sanitizing data in path_app.js (converting Object references back to ID strings for the worker). - Right-Click Toggle: Fixed "Cannot Collapse" bug by:
- Patching path_core.js to correctly pass
isExpandedstate. - Updating PathBridge.ts to relay collapsePrereqs messages (which were previously dropped).
- Patching path_core.js to correctly pass
- Collapse All:
- Added a visible
[-]button to the Godot UI. - Updated PathBridge.ts to relay the collapseAll message.
- Added a visible
问题 (Issue): 双击节点或切换中心时，由于更新负载中缺少 treeLayout 数据，树状视图会崩溃并恢复为线性列表。
修复 (Fix): 更新了 path_app.js 的 switchCentral 函数，显式调用 triggerUpdate()。这强制 Web Worker 在将新的中心节点发送到 Godot 之前重新计算完整的 treeLayout（包括正确的层级和连接）。
- 入度显示设置: 在节点弹窗中添加了选项，用于在“可见” (默认) 和“总计”入度计数之间切换。
- Godot 懒加载: 在 Godot 树状视图中实现了“展开 (+)”和“折叠 (-)”按钮，以管理前置节点的可见性。
- 国际化修复: 为英语和中文语言环境添加了缺失的键
focus_inbound/focus_outbound。
- 视觉效果 ("禅模式"): 简化视图，移除所有额外按钮。仅节点和连接可见。
- 交互:
- 双击 / 右键单击: 切换上下文（展开/折叠前置节点）。
- 长按 (左键): 导航到节点（切换中心）。通过进度环叠加层可视化。
- 中键单击: 折叠所有节点（重置视图）。
- 专注模式:
- 通过设置切换（“聚焦于此节点”）。
- 高亮显示中心节点及其直接传入的前置节点。
- 调暗所有其他节点以减少混乱并专注于直接依赖关系。
- 这创造了一个更清晰、更少混乱的树，其中线条仅连接直接邻居（Level 1 → Level 2），按要求。
末端节点清理:
- “展开”按钮逻辑依赖于数据验证。由于
treeLayout现在可以正确重新计算，对应于链末端的“目标”节点正确报告布局中的0个子节点，因此展开按钮将自动隐藏。
- 导航: 树状视图中的双击节点现在可以正确保持树状视图处于活动状态并重新居中图表。
- 美学: 移除了跳层级的长而混乱的贝塞尔曲线。
- 数据: 入度数字可见。
- 缺失边: 通过在 path_app.js 中清理数据（将对象引用转回 Workers 的 ID 字符串），修复了
treeLayout只有 0 条边的问题。 - 右键切换: 修复了“无法折叠”的 Bug：
- 修补 path_core.js 以正确传递
isExpanded状态。 - 更新 PathBridge.ts 以转发 collapsePrereqs 消息（以前被丢弃）。
- 修补 path_core.js 以正确传递
- 全部折叠:
- 在 Godot UI 中添加了一个可见的
[-]按钮。 - 更新 PathBridge.ts 以转发 collapseAll 消息。
- 在 Godot UI 中添加了一个可见的
Performed comprehensive gap analysis between tree_path_mockup.html (702 lines, 9 rules) and production code.
| File | Lines | Purpose |
|---|---|---|
tree_path_mockup.html |
702 | Reference implementation with all 9 rules |
path_core.js |
1375 | Production core algorithm (getTreeLayout() L742-1133) |
tree_renderer.gd |
531 | Godot tree visualization |
tree_view_panel.gd |
159 | Godot panel controller |
path_app.js |
1166 | Frontend bridge and interaction handler |
- 8 of 9 rules are completely missing from production
- 5 core concepts absent: ownership, expansion order, effective index, visibility chain, hull collision avoidance
- 7 existing features preserved: spine ID, contour collision, tributary placement, hull drawing, collapse state, WebSocket bridge, tree renderer
- Production code is geometrically correct but lacks the semantic claiming/ownership layer
- implementation_plan.md — Phase 3 with 13 steps
- brainstorming.md — Session 6: Ownership Engine design
- task.md — v1.4.3 checklist (EN + ZH)
- TODO.md — v1.4.3 implementation checklist
Implementation of 13 steps across 4 components (Core Algorithm, Frontend Bridge, Godot Renderer, Worker Communication).
对 tree_path_mockup.html（702 行，9 条规则）和生产代码进行了全面的差距分析。
| 文件 | 行数 | 用途 |
|---|---|---|
tree_path_mockup.html |
702 | 包含所有 9 条规则的参考实现 |
path_core.js |
1375 | 生产核心算法 |
tree_renderer.gd |
531 | Godot 树可视化 |
tree_view_panel.gd |
159 | Godot 面板控制器 |
path_app.js |
1166 | 前端桥接和交互处理 |
- 9 条规则中有 8 条在生产代码中完全缺失
- 5 个核心概念缺失：所有权、展开顺序、有效索引、可见性链、hull 碰撞避让
- 7 个现有特性保留：脊柱识别、轮廓碰撞、支流放置、hull 绘制、折叠状态、WebSocket 桥、树渲染器
- 生产代码几何上正确但缺乏语义认领/所有权层
implementation_plan.md— 第三阶段，13 个步骤brainstorming.md— 会话 6：所有权引擎设计task.md— v1.4.3 清单（中英双语）TODO.md— v1.4.3 实施清单
跨 4 个组件（核心算法、前端桥接、Godot 渲染器、Worker 通信）实施 13 个步骤。
FileLoaderresolves every source under a workspace root and records a normalized relative path.GraphBuilderrejects ambiguous legacy basenames before adding any node; existing basename IDs remain the compatibility key for non-ambiguous workspaces.- Protected HTTP/sidecar requests pass through the same token decision, with both existing credential header forms accepted.
- File-backed snapshots write a unique sibling temp file, atomically rename it, then update the in-process cache.
- Desktop continues to use the sidecar/full profile; mobile consumes deterministic
mobile-slimbundles and now has a callable bounded local exact-analysis projection. Device/RSS evidence remains a separate gate.
scoped source package
-> streaming parser
-> stable resource/revision validation
-> compact exact graph/index projection
-> bounded Worker/WASM query
-> evidence/result projection
-> Tauri/Capacitor UI
-> optional cancellable remote synthesis
The new replay path is deliberately additive. A graph snapshot is parsed into a temporary Graph, validated for duplicate IDs, alias collisions, and undeclared edge endpoints, then swapped into the target instance. Learning move events update the existing document and its evidence paths, append old identities to the alias set, and persist a bounded journal; a restart can therefore delete the pre-move path without guessing from content hashes.
The modular ingest endpoint now rejects malformed JSON, oversized bodies/documents, invalid alias arrays, and unsupported operation names at the HTTP boundary. Legacy field spellings still normalize to the same domain contract. Keyword matching builds a token anchor index once, while checkMatch remains the final predicate, so exact phrase behavior is unchanged.
On mobile, the exact analyzer projects only identity, labels, tags, degrees, and bounded adjacency. URI/alias lookup uses NFC normalization. Edge provenance is classified for filtering and diagnostics, but no full document body, Node sidecar, Godot runtime, or model weight is introduced into mobile-slim. PathBridge 2.0 envelopes let hosts advertise the same analysis/cancellation contract; the host, not the client, owns policy and persistence.
Verification for this increment: TypeScript build passed; the migration matrix passed 57 suites / 307 tests, focused projection/Bridge suites passed, Diataxis passed, and Rust graph-runtime tests passed. The latest slim staging measures 120 files, 4,251,345 uncompressed bytes, and 1,545,813 estimated compressed bytes. Signed APK/RSS and registry response parity are not inferred from these tests.
本次 replay 路径保持 additive：graph snapshot 先解析到临时 Graph，校验重复 ID、alias 冲突和未声明 edge endpoint 后，再原子替换目标实例。learning move 事件更新原文档及其 evidence 路径，把旧身份加入 alias 集合并持久化有界 journal；重启后可以按重命名前路径删除，而不是从内容 hash 猜测身份。
模块化 ingest endpoint 现在在 HTTP 边界拒绝非法 JSON、超大 body/document、错误 alias 数组和未知 operation；旧字段拼写仍归一化到相同 domain 契约。keyword matching 只建立一次 token 锚点索引，最终仍由 checkMatch 判定，因此 exact phrase 语义不变。
移动端 exact analyzer 只投影身份、标签、tags、度数和有界邻接，URI/alias 查询使用 NFC 归一化。边 provenance 可用于过滤和诊断，但 mobile-slim 不增加正文、Node sidecar、Godot runtime 或模型权重。PathBridge 2.0 envelope 让各 host 声明统一分析/取消契约；策略与持久化仍由 host 掌握。
本增量验证：TypeScript build 通过；migration matrix 57 suite / 307 个测试、projection/Bridge 定向 suite、Diataxis 与 Rust graph-runtime 测试通过。最新 slim staging 为 119 个文件、未压缩 4,242,970 字节、估算压缩 1,543,913 字节。不能从这些测试推断签名 APK/RSS 或 registry response parity 已完成。
The mobile flow must never require the desktop Node sidecar or Godot process. Large source text is paged by reference, inferred edges are Top-K bounded, and signed APK/AAB + RSS evidence determines release readiness.
FileLoader在 workspace root 下解析每个 source，并记录规范化相对路径。GraphBuilder在加入任何 node 前拒绝歧义 legacy basename；无冲突 workspace 继续用 basename ID 兼容旧布局。- 受保护 HTTP/sidecar 请求使用同一 token 判定，并兼容已有两种凭证头。
- 文件快照先写唯一同目录临时文件，原子 rename 后再刷新进程内缓存。
- Desktop 继续使用 sidecar/full profile；mobile 消费 deterministic
mobile-slimbundle，并已具备可调用的有界本地 exact-analysis projection；设备/RSS 证据仍是独立门禁。
scoped source package
-> streaming parser
-> stable resource/revision validation
-> compact exact graph/index projection
-> bounded Worker/WASM query
-> evidence/result projection
-> Tauri/Capacitor UI
-> optional cancellable remote synthesis
移动链路不得依赖桌面 Node sidecar 或 Godot 进程；大文本按 reference 分页，inferred edge 必须 Top-K 有界，签名 APK/AAB 与 RSS 证据决定 release readiness。
The route shadow harness now separates legacy-equivalent URLs from registry-only URLs. The equivalent set starts isolated legacy and registry servers against the same knowledge-base fixture, compares normalized status/body/headers, and checks that read-only or invalid probes do not mutate runtime files. Valid ingest is the only declared write boundary. The registry-only set expects a legacy miss and a registry success, so newly extracted routes are visible without being misreported as regressions.
The parity run passed with 14 equivalent probes and 6 registry-only probes. During implementation it exposed and fixed response-shape drift (operationSummary, ingest/query payloads, query-backend diagnostics) and several error-status mismatches. The default dispatch remains registry, while NOTE_CONNECTION_ROUTE_DISPATCH_MODE=legacy is available for rollback diagnosis.
verify-mobile-artifact.js parses APK/AAB ZIP central-directory entries without requiring Android tooling. It requires an arm64-v8a payload in release mode, rejects desktop sidecars, Godot/model payloads, SVG/binary leakage, and profile budget overruns. A release invocation must pass --require-rss --require-arm64 with a device-generated JSON file; staging measurements alone remain non-release evidence.
The SQLite fixture now closes an adapter, creates a fresh adapter for the same file, replays the committed snapshot, and verifies node/metadata reads. Graph restore tests also prove that a rejected snapshot leaves the previous graph intact. Cross-host replay, signed arm64 artifacts, and device RSS are still open gates.
route shadow harness 现在把 legacy-equivalent URL 与 registry-only URL 分开。等价集合会针对同一知识库 fixture 启动隔离的 legacy 与 registry server，对比归一化后的 status/body/headers，并确认只读或非法 probe 不会修改 runtime 文件；只有显式标记的 ingest 是写边界。registry-only 集合要求 legacy miss、registry success，因此新抽取路由可见但不会被误报为回归。
本次 parity 通过 14 条 equivalent probe 与 6 条 registry-only probe。实现过程中真实暴露并修复了 response shape 漂移（operationSummary、ingest/query payload、query-backend diagnostics）和多个错误状态码差异。默认 dispatch 仍是 registry，同时保留 NOTE_CONNECTION_ROUTE_DISPATCH_MODE=legacy 作为回滚诊断入口。
verify-mobile-artifact.js 不依赖 Android tooling，直接解析 APK/AAB ZIP central-directory entry；release 模式要求 arm64-v8a payload，并拒绝 desktop sidecar、Godot/model payload、SVG/二进制泄漏和 profile 超预算。release 调用必须带 --require-rss --require-arm64 与真机生成的 JSON；staging 测量本身仍不是 release evidence。
SQLite fixture 会关闭 adapter，再用同一文件创建新 adapter，回放已提交 snapshot 并校验 node/metadata 读取。Graph restore 测试也证明被拒绝的 snapshot 不会破坏旧 graph。跨 host replay、签名 arm64 产物和真机 RSS 仍是开放门禁。
FileLoader reads a note, normalizes its workspace-relative path once, and creates sourceUri, revision, and aliases. GraphBuilder copies those fields into the node and metadata. Graph registers the current ID, source URI, relative path, and legacy aliases in one collision-checked index. Existing algorithms continue to consume the legacy ID; URI/relative frontmatter and saved layouts are resolved at the boundary and serialized output remains backward-readable.
- Exact layout lookup checks source URI, relative path, explicit aliases, then the legacy basename; old layouts remain readable, but basename is not an implicit priority when aliases collide.
- Old nodes without identity fields remain valid because all new fields are optional.
- Alias collisions fail before graph mutation, and case-folding makes the policy deterministic across Windows/POSIX.
- Mobile slim packaging gains no Node/Godot/LLM dependency; this is backend metadata consumed only when present.
The identity suites and URI/layout compatibility tests pass (15 tests total), and npx tsc --noEmit passes. The next checkpoint is move/rename replay plus old-snapshot corpus verification; public ID migration remains blocked until that evidence exists.
The mobile write path now follows one bounded sequence: collect Markdown -> build a body-free graph -> normalize through knowledge_projection_contract.js -> persist versioned nodes/edges/adjacency -> replay with the exact analyzer. Capacitor and Tauri Rust both emit schemaVersion=1, identity metadata, and edge provenance. Unknown future schemas fail closed instead of being silently treated as legacy data.
The Bridge path is additive. With no host adapter, existing clients still receive the old broadcast behavior. With an adapter, the host executes the use case and the Bridge returns an operationResult carrying request/correlation IDs; timeout, disconnect, and explicit cancel all abort the host signal. This prevents mobile clients from selecting graph or persistence policy.
Fresh verification: npm run build:mini, npm run mobile:prepare:slim, npm run test:migration (57 suites / 307 passing tests), focused projection/Bridge tests, cargo check, and targeted Rust graph-runtime tests. cargo fmt --check could not run because rustfmt is not installed. No signed arm64 APK/AAB or device RSS evidence exists yet.
移动写入路径现在遵循同一条有界链路：收集 Markdown -> 构建无正文 graph -> 经过 knowledge_projection_contract.js 归一化 -> 持久化版本化 node/edge/adjacency -> 用 exact analyzer replay。Capacitor 与 Tauri Rust 都输出 schemaVersion=1、身份元数据和边 provenance；未知未来 schema 会 fail closed，不会静默按 legacy 数据处理。
Bridge 采用 additive 方式。未配置 host adapter 时，现有客户端仍收到旧广播行为；配置 adapter 后，由 host 执行 use case，Bridge 返回带 request/correlation ID 的 operationResult，超时、断连和显式 cancel 都会中止 host signal，移动客户端不能选择 graph 或 persistence policy。
最新验证：npm run build:mini、npm run mobile:prepare:slim、npm run test:migration（57 suite / 307 个测试通过）、projection/Bridge 定向测试、cargo check 与 Rust graph-runtime 定向测试通过。由于本机未安装 rustfmt，cargo fmt --check 无法执行；目前仍没有签名 arm64 APK/AAB 或真机 RSS 证据。
FileLoader 读取笔记后只在边界做一次 workspace-relative path 规范化，并生成 sourceUri、revision 与 alias。GraphBuilder 将字段复制到节点和 metadata。Graph 在一个经过冲突检查的索引中登记当前 ID、source URI、relative path 与 legacy alias。现有算法继续使用 legacy ID；URI/relative frontmatter 和保存布局在边界解析，序列化输出保持向后可读。
- exact layout lookup 依次检查 source URI、relative path、显式 alias 和 legacy basename；旧布局仍可读，但 alias 冲突时不再假定 basename 优先。
- 没有身份字段的旧节点仍然有效，因为新增字段均为可选。
- alias 冲突在图变更前 fail-fast，大小写折叠策略保证 Windows/POSIX 一致。
- mobile slim 不增加 Node/Godot/LLM 依赖；这些后端元数据只在存在时被消费。
身份 suite 与 URI/layout 兼容测试共 15 个通过，npx tsc --noEmit 通过。下一检查点是文件移动/重命名 replay 与旧 snapshot 语料验证；在获得证据前不切换公开 ID。
The executable flow is now:
runtime-first build
-> mobile-slim staging/filter
-> compressed-byte + forbidden-artifact gate
-> Capacitor or Tauri Android frontend
-> local Rust/Capacitor graph build
-> mobile_exact_analyzer exact query/path projection
-> optional remote inference
The staged frontend intentionally excludes Mermaid/GPU desktop payloads, generated graph caches, SVG files, binaries, and model paths. The default Android runner also removes stale generated Godot bridge/assets; NOTE_CONNECTION_ANDROID_INCLUDE_GODOT_PATHMODE=1 is the only extended-profile opt-in. RSS is measured only from supplied device evidence.
The build boundary now passes kbRoot into FileLoader when a target subdirectory is scanned. A note loaded through Knowledge_Base/ and the same note loaded through Knowledge_Base/algebra/ therefore share relativePath and sourceUri; the old basename documentId is unchanged.
The learning ingest payload keeps sourceUri, revision, and identityAliases optional. A URI/alias delete resolves the persisted document before the legacy path normalizer is consulted. This is an additive bridge for replay and migration, not a claim that a path-derived URI survives rename.
On Android, corpus admission checks metadata sizes before reading bodies and bounds documents, total input bytes, and edges. This prevents the low-memory projection from turning an oversized import into an unbounded allocation; it does not replace device RSS evidence.
现在 target 子目录扫描会把 kbRoot 传入 FileLoader。同一笔记从 Knowledge_Base/ 或 Knowledge_Base/algebra/ 加载时会得到一致的 relativePath 与 sourceUri；旧 basename documentId 保持不变。
学习摄入 payload 以可选字段保留 sourceUri、revision 与 identityAliases。按 URI/alias 删除时先查持久化文档，再回退到旧 path normalizer。这是用于 replay 与迁移的 additive bridge，并不声称路径派生 URI 能抵抗重命名。
Android 在读取正文前检查文件元数据大小，并限制文档数、总输入字节数与边数；读取时直接提取 link candidate，中间 projection 不保留语料正文，避免超大导入在低内存 projection 中形成无界分配；它不能替代真机 RSS 证据。
当前可执行链路为：
runtime-first build
-> mobile-slim staging/filter
-> 压缩字节 + 禁入物门禁
-> Capacitor 或 Tauri Android frontend
-> 本地 Rust/Capacitor 建图
-> mobile_exact_analyzer exact query/path projection
-> 可选远程推理
staging 前端会主动排除 Mermaid/GPU 桌面 payload、生成图缓存、SVG、二进制和模型路径。默认 Android runner 还会移除旧生成工程中的 Godot bridge/asset；只有 NOTE_CONNECTION_ANDROID_INCLUDE_GODOT_PATHMODE=1 才能启用扩展档。RSS 只有在提供真机 evidence 后才会测量。
The persistence path is now explicit: graph_data.json -> knowledge_projection_store.js -> versioned projection contract -> mobile_exact_analyzer. A host can provide a persistent read/write adapter, or fall back to an in-memory projection. The fallback is deliberately narrow: it preserves the last successful projection during transient adapter failure; it does not accept an unknown future schema.
The Android path is asynchronous by design. Rust requests ACTION_OPEN_DOCUMENT_TREE; the generated Kotlin bridge copies Markdown streams into the app-local workspace under bounded document/total byte budgets, then writes a short result marker. Rust polls and persists only the app-local path. The selected external URI is provenance, not a permanent graph identity. This keeps the mobile package free of Node, Godot, models, SVG, and desktop binaries while still allowing user-selected knowledge bases.
Verification for this increment: 24 focused Jest tests, TypeScript no-emit, and 26 Rust tests pass. Generated Android patching is idempotent; a fresh arm64 slim build produced an unsigned APK (9,555,787 bytes) and AAB (7,179,228 bytes), and static artifact verification passed with no forbidden entries. No signed artifact, physical-device import run, or RSS JSON exists yet.
本轮新鲜 arm64 slim 构建生成未签名 APK（9,555,787 字节）与 AAB（7,179,228 字节），静态 artifact 检查通过且没有禁入条目。当前仍缺少签名发布产物、真机导入运行和 RSS JSON；这些证据不能由静态打包结果推断。
持久化链路现在明确为：graph_data.json -> knowledge_projection_store.js -> 版本化 projection contract -> mobile_exact_analyzer。Host 可以提供 persistent read/write adapter，也可以回退到内存 projection。这个 fallback 只保留最近一次成功 projection 用于短暂 adapter 故障，不接受未知未来 schema。
Android 链路刻意采用异步状态机：Rust 请求 ACTION_OPEN_DOCUMENT_TREE，生成的 Kotlin bridge 在单文档/总字节预算内把 Markdown 流式复制到 app-local workspace，再写入短结果 marker；Rust 轮询并只持久化 app-local path。外部 URI 只是 provenance，不是永久 graph identity。这样移动包仍不包含 Node、Godot、模型、SVG 或桌面二进制，同时允许用户选择知识库。
本轮验证：24 项 Jest 聚焦测试、TypeScript no-emit 与 Rust 26 项测试通过。Android 生成工程 patch 已幂等；新鲜 arm64 slim 构建生成未签名 APK（9,555,787 字节）与 AAB（7,179,228 字节），静态 artifact 检查通过且没有禁入条目。尚无签名 arm64 产物、真机导入运行或 RSS JSON。
The Android path is now ACTION_OPEN_DOCUMENT_TREE -> bounded staging -> v1 import journal -> backup/activate -> atomic result marker. Startup recovery is idempotent: an active target wins cleanup, a missing target with a backup restores the previous knowledge base, and abandoned staging is removed. Journal schema/path violations fail closed. This is an internal durability change; it does not change projection schema, Rust request/poll fields, or public IDs.
Verification passed: Android picker/mobile contract suites, TypeScript no-emit, and app:compileArm64ReleaseKotlin. Device signing, SAF workload, process-death replay, and RSS evidence are not available on the current host and remain release gates.
Android 链路现在是 ACTION_OPEN_DOCUMENT_TREE -> 有界 staging -> v1 import journal -> backup/activate -> 原子 result marker。启动恢复具有幂等性：已有 active target 时清理，target 缺失但有 backup 时恢复旧知识库，abandoned staging 被删除；journal schema/路径违规直接 fail closed。它是内部耐久性变更，不改变 projection schema、Rust request/poll 字段或公共 ID。
本轮已通过 Android picker/mobile 契约测试、TypeScript no-emit 与 app:compileArm64ReleaseKotlin。当前宿主无法取得设备签名、SAF workload、进程死亡 replay 与 RSS 证据，这些仍是 release 门禁。
signed arm64 APK -> artifact signature/arm64/budget gate
-> device install -> SAF import -> graph build -> exact query -> path
-> force-stop/reopen -> continuity -> VmRSS samples -> evidence manifest
The new recorder is present and contract-tested, but this host has no signing keystore, online device/AVD, or workload spec. No device evidence is claimed; static payload and fixture replay remain separate lower-level gates.
The replay verifier now runs separate Web storage, Tauri atomic-file, Capacitor chunked-file, and Android journaled-file paths. Reports carry host-boundary-contract; this is intentionally not device acceptance.
Projection nodes carry additive URI-derived canonicalId while retaining legacy id. The exact analyzer resolves both keys and the schema rejects duplicate canonical identities before analysis. No public-ID cutover occurs. Route shadow now covers 17 equivalent probes, including invalid JSON and invalid build defaults. Android graph reads are capped before full UTF-8 allocation, and the G4 corpus covers same-content, NFC/cross-root identity, legacy snapshots, and rollback.
Current slim staging is 121 files / 4,263,740 uncompressed bytes / 1,548,695 estimated compressed bytes. Existing APK/AAB outputs are older unsigned builds and require a fresh rebuild before source attribution.
Replay verifier 现在分别运行 Web storage、Tauri atomic-file、Capacitor chunked-file 与 Android journaled-file 路径，报告携带 host-boundary-contract，明确不等于真机验收。
Projection node 增加由 URI 派生的 additive canonicalId，同时保留 legacy id；exact analyzer 两者均可解析，schema 在分析前拒绝重复 canonical identity，本轮不切 public ID。Route shadow 现在覆盖 17 条等价 probe，包括 invalid JSON 与非法 build default。Android graph read 在完整 UTF-8 分配前有上限，G4 corpus 覆盖同内容、NFC/跨 root identity、legacy snapshot 与 rollback。
当前 slim staging 为 121 个文件 / 未压缩 4,263,740 字节 / 估算压缩 1,548,695 字节。已有 APK/AAB 属于更早的未签名构建，必须重新构建后才能归因到本轮源码。
The new field is emitted by every current producer: TypeScript identity and desktop GraphBuilder, browser identity and Capacitor projection, plus Android Rust full/lite projection. canonicalId is the normalized relative path without the Markdown extension; legacy id remains unchanged. Focused verification passes with 5 suites / 20 tests, TypeScript no-emit, and 27 Rust tests. Fresh slim staging is 121 files / 4,265,579 uncompressed bytes / 1,549,039 estimated compressed bytes with SHA-256 7a62a376e05228e326732db0e1d76e9eedb84d7d344f862df8ee259a42d7bb72; RSS remains not measured.
新增字段已由当前所有 producer 输出：TypeScript identity 与桌面 GraphBuilder、浏览器 identity 与 Capacitor projection，以及 Android Rust full/lite projection。canonicalId 是去除 Markdown 扩展名的规范 relative path；legacy id 不变。定向验证为 5 个 suite / 20 个测试、TypeScript no-emit 与 27 个 Rust 测试通过；fresh slim staging 为 121 个文件 / 未压缩 4,265,579 字节 / 估算压缩 1,549,039 字节，SHA-256 为 7a62a376e05228e326732db0e1d76e9eedb84d7d344f862df8ee259a42d7bb72，RSS 仍为 not measured。
The verification boundary is now executable: a dependency-free test-only comparator matches canonical nodes and compares normalized URI provenance plus directed edge type/kind/provenance. Capacitor and Rust resolve direct canonical paths, source-relative paths, then unique stems; ambiguous legacy basenames and duplicate canonical paths fail closed. The Capacitor worker and single-thread builder also agree when only sourceUri is available.
The replay script creates one nested/relative/Markdown/NFC corpus, builds it through Capacitor, and invokes the ignored Rust Cargo probe against the same files. The semantic result is 6 nodes and 4 edges with no mismatch. This is host-boundary evidence, not signed-device, SAF UI, process-death, or RSS evidence. The comparator is excluded from mobile-slim, and the runtime remains on legacy id plus schema-1 snapshots.
验证边界现在可执行：无依赖的 test-only comparator 按 canonical node 匹配，并比较归一化 URI provenance 与带方向的 edge type/kind/provenance。Capacitor 与 Rust 按 direct canonical path、source-relative path、unique stem 解析；含糊 legacy basename 与重复 canonical path fail closed；当输入只有 sourceUri 时，Capacitor worker 与 single-thread builder 也保持一致。
Replay 脚本创建 nested/relative/Markdown/NFC 单一语料，分别经 Capacitor 与 ignored Rust Cargo probe 构建，语义结果为 6 个节点、4 条边且无 mismatch。这只是 host-boundary 证据，不是签名真机、SAF UI、进程死亡或 RSS 证据。comparator 已排除出 mobile-slim，运行时继续使用 legacy id 与 schema-1 snapshot。
verify-mobile-native-recovery.js now replays the production Kotlin journal contract in a temporary host directory. The six cases are intentionally state-oriented:
staging + active target -> preserve target
target-backed-up -> restore previous target
target-activated + target -> preserve activated target
orphan backup -> restore newest backup
unsafe journal / unknown schema -> fail closed
The contract test writes a schema-1 report with evidenceLevel: host-recovery-state-machine and nativeDeviceEvidence: false. This is a deterministic recovery mirror and CI drift detector, but it does not execute Android process death, SAF UI, storage/permission failures, or RSS sampling. The mobile runtime remains Kotlin-owned and the verifier is excluded from mobile-slim.
Current verification is 146 Jest suites / 1,271 passed / 26 skipped, TypeScript no-emit, Rust 28 passed with 1 ignored probe, four-host projection replay (6 nodes / 4 edges), slim budget (121 files / 4,275,083 uncompressed / 1,550,638 estimated compressed, SHA-256 5d5bafa20770bf42531b2e39ec62364537e0eade83b29a9aa2209f4f03bf7c38), and Diataxis. Signed-device SAF/query/path, force-stop continuity, and RSS <= 256 MiB remain open; public-ID and SQLite/WASM promotion stay frozen.
verify-mobile-native-recovery.js 现在在临时 host 目录中回放生产 Kotlin journal 契约。六个场景按状态设计：
staging + active target -> 保留 target
target-backed-up -> 恢复旧 target
target-activated + target -> 保留已激活 target
orphan backup -> 恢复最新 backup
unsafe journal / unknown schema -> fail closed
契约测试写入 schema-1 报告，包含 evidenceLevel: host-recovery-state-machine 与 nativeDeviceEvidence: false。这是确定性的恢复镜像和 CI 漂移探测器，但不会执行 Android 进程死亡、SAF UI、存储/权限失败或 RSS 采样。移动运行时仍由 Kotlin 拥有，verifier 也不会进入 mobile-slim。
当前验证为全量 Jest 146 suites / 1,271 passed / 26 skipped、TypeScript no-emit、Rust 28 passed 加 1 个 ignored probe、四 host projection replay（6 个节点 / 4 条边）、slim budget（121 个文件 / 未压缩 4,275,083 / 估算压缩 1,550,638 字节，SHA-256 为 5d5bafa20770bf42531b2e39ec62364537e0eade83b29a9aa2209f4f03bf7c38）与 Diataxis。签名真机 SAF/query/path、force-stop continuity 与 RSS <= 256 MiB 仍未闭合；public-ID 与 SQLite/WASM 提升继续冻结。
The Android import outer catch now has an explicit ownership boundary:
import failure -> delete staging
-> no backup exists: clear journal
-> backup exists: retain backup + journal for next bind recovery
The previous implementation deleted backupRoot and journalFile unconditionally. That was unsafe after replaceImportedTree() had moved the old corpus away from the active target but could not complete or undo activation. The new contract test inspects only this failure catch, so cleanup in successful replacement and recovery branches remains legal.
This preserves the existing result marker and Rust polling surface, adds no mobile runtime dependency, and keeps the current slim staging budget. It is still not native-device evidence: rollback failure, next-bind recovery, SAF/storage permission failures, force-stop continuity, signed artifacts, and RSS <= 256 MiB remain required.
Android import 外层 catch 现在有明确的所有权边界：
import 失败 -> 删除 staging
-> 不存在 backup：清理 journal
-> 存在 backup：保留 backup + journal，等待下次 bind recovery
旧实现会无条件删除 backupRoot 与 journalFile。当 replaceImportedTree() 已将旧知识库移出 active target、但激活或回滚未完成时，这会造成数据丢失。新契约测试只扫描该失败 catch，因此成功替换与 recovery 分支中的合法清理仍被保留。
本修复保持既有 result marker 与 Rust polling surface，不增加移动运行时依赖，也不改变 slim staging budget。它仍不是原生设备证据：rollback failure、下次 bind recovery、SAF/存储权限失败、force-stop continuity、签名产物与 RSS <= 256 MiB 仍待完成。
Startup recovery now has an explicit retry branch:
backup exists + rename succeeds -> restore target, clear journal
backup exists + rename fails -> delete staging, retain backup+journal, retry later
no backup -> clear journal, report recovered_empty
The host verifier now replays eight scenarios, including deterministic journaled and orphan rename failures. Those scenarios leave recoverable state in place and emit recovery-pending or orphan-recovery-pending; the report still declares nativeDeviceEvidence: false.
A fresh Tauri Android build completed with the slim arm64 profile. Static verification passed for the unsigned universal APK (9,576,838 compressed payload bytes, SHA-256 eb5f63697c6a3e33f3c54659a530f9ed014c600181067ee95684e2377610fbc6) and AAB (7,055,579 compressed payload bytes, SHA-256 ee3e9b9451e2afeeb861a4a81311d9caccf9cd64d7871e206453bac3d42f2934). Both are below 25 MiB and contain an arm64 payload; signing and RSS remain unmeasured.
启动恢复现在有明确的重试分支：
backup 存在且 rename 成功 -> 恢复 target，清理 journal
backup 存在但 rename 失败 -> 删除 staging，保留 backup+journal，稍后重试
不存在 backup -> 清理 journal，报告 recovered_empty
Host verifier 现在回放 8 个场景，包含 journaled 与 orphan 的确定性 rename failure。这些场景保留可恢复状态，并分别输出 recovery-pending 或 orphan-recovery-pending；报告仍声明 nativeDeviceEvidence: false。
新鲜 Tauri Android slim arm64 构建已完成。静态验证通过未签名 universal APK（压缩 payload 9,576,838 字节，SHA-256 为 eb5f63697c6a3e33f3c54659a530f9ed014c600181067ee95684e2377610fbc6）与 AAB（压缩 payload 7,055,579 字节，SHA-256 为 ee3e9b9451e2afeeb861a4a81311d9caccf9cd64d7871e206453bac3d42f2934）。两者均低于 25 MiB 且包含 arm64 payload；签名与 RSS 仍未测量。
The post-Phase-20 host check is reproducible: Android prerequisites, TypeScript no-emit, the 8 recovery scenarios, and the 4-host projection replay pass. Generated reports are ignored and git status remains clean.
The host does have an AVD, but its facts matter: Medium_Phone_API_36.1 resolves to E:\Android\avd\Medium_Phone.avd, uses Android 36.1 / Play Store / x86_64, and has 2 GiB RAM. adb devices -l has no online target. This AVD can validate tooling behavior only; it cannot close the arm64 release gate. No approved .jks, .keystore, or .p12 was found, so unsigned artifacts remain static evidence and the recorder must fail before device execution when --require-signed is in force.
The next run is intentionally external and bounded:
CI ephemeral signing -> signed arm64 APK/AAB
-> approved arm64 low-memory device
-> SAF import -> graph build -> exact query -> path
-> force-stop -> relaunch -> continuity
-> storage/permission retry cases -> VmRSS samples
-> manifest + rss.json + artifact hash + logcat
Rebuilding for x86_64, creating a local debug keystore, or enabling emulator-only evidence would produce a different claim, not the requested mobile release evidence. Public-ID cutover, default SQLite/WASM, and budget changes remain frozen.
Phase 20 后的宿主复核可复现：Android prerequisite、TypeScript no-emit、8 个 recovery 场景与 4-host projection replay 均通过。生成报告被忽略，git status 仍为 clean。
宿主确实存在 AVD，但其事实不能被省略：Medium_Phone_API_36.1 解析到 E:\Android\avd\Medium_Phone.avd，使用 Android 36.1 / Play Store / x86_64，内存 2 GiB；adb devices -l 没有 online target。该 AVD 只能验证工具链行为，不能关闭 arm64 release gate。未找到获批 .jks、.keystore 或 .p12，所以未签名产物仍只是静态证据；启用 --require-signed 时 recorder 必须在设备执行前 fail。
下一次运行刻意保持外部化且有界：
CI 临时签名 -> 签名 arm64 APK/AAB
-> 获批 arm64 低内存设备
-> SAF import -> graph build -> exact query -> path
-> force-stop -> relaunch -> continuity
-> 存储/权限重试 -> VmRSS 样本
-> manifest + rss.json + artifact hash + logcat
重建 x86_64、生成本地 debug keystore 或开启 emulator-only evidence 都会产生不同的结论，不能替代要求的移动 release 证据。public-ID 切换、默认 SQLite/WASM 与预算变化继续冻结。
The release path now has an explicit signing boundary:
CI secrets -> ephemeral release.jks
-> slim aarch64 build
-> signed APK/AAB verification (--require-arm64 --require-signed)
-> copy verified artifacts + remove keystore
Local builds intentionally stay unsigned. AAB verification accepts jarsigner status 4 only when the archive is signed and the certificate chain is untrusted/self-signed; unsigned archives still fail. A local ephemeral JKS smoke observed APK payload 9,576,838 bytes and AAB payload 7,140,668 bytes, but the certificate is not release evidence.
The current slim manifest is 121 files, 4,275,083 uncompressed bytes, and 1,550,638 estimated compressed bytes. The APK's largest payload is the arm64 Rust library at roughly 7 MiB. This explains the packaging floor, but not runtime memory: full Markdown reads, JSON duplication, projection maps, and SAF staging/backup remain separate RSS/disk risks.
One naming defect remains explicit: the workflow says universal, while the inspected archive contains only arm64-v8a native payload. The next change must either rename the output to arm64 or verify every declared ABI. No filename is accepted as ABI proof.
Release acceptance still stops before native execution:
approved signing key + online arm64 device
-> SAF import -> graph build -> exact query -> path
-> force-stop -> reopen -> continuity
-> storage/permission retry -> VmRSS samples
-> manifest + rss.json + artifact hash + logcat
Missing evidence, an unobservable process death, or peak RSS above 256 MiB fails closed. Public-ID migration, default SQLite/WASM, Godot inclusion, and mobile budget increases remain frozen.
release 路径现在有明确的签名边界：
CI secrets -> 临时 release.jks
-> slim aarch64 构建
-> 签名 APK/AAB 验证（--require-arm64 --require-signed）
-> 复制已验证产物并删除 keystore
本地构建刻意保持 unsigned。AAB 只有在归档已签名且证书链不受信任/自签时才接受 jarsigner 返回码 4；unsigned 归档仍失败。临时 JKS smoke 观测到 APK payload 9,576,838 字节、AAB payload 7,140,668 字节，但该证书不是 release 证据。
当前 slim manifest 为 121 个文件、未压缩 4,275,083 字节、估算压缩 1,550,638 字节。APK 最大项是约 7 MiB 的 arm64 Rust library。这解释了包体下限，但不代表运行时内存达标：完整 Markdown 读取、JSON 重复驻留、projection Map 与 SAF staging/backup 仍是独立 RSS/磁盘风险。
还有一个必须保留的命名缺陷：workflow 称为 universal，而检查到的归档只有 arm64-v8a native payload。下一步要么把产物改名为 arm64，要么逐 ABI 验证；不能把文件名当 ABI 证据。
原生 release 验收仍停在设备执行前：
获批签名 key + 在线 arm64 设备
-> SAF import -> graph build -> exact query -> path
-> force-stop -> reopen -> continuity
-> 存储/权限重试 -> VmRSS 样本
-> manifest + rss.json + artifact hash + logcat
缺证据、进程死亡不可观测或 peak RSS 超过 256 MiB 都必须 fail closed。public-ID 迁移、默认 SQLite/WASM、Godot inclusion 与移动预算上调继续冻结。
The mobile build now derives its limits from one checked-in contract:
{
"schemaVersion": 1,
"profiles": { "mobile-low": { "artifactCompressedBytes": 26214400, "maxResidentBytes": 268435456 } },
"runtime": {
"maxDocuments": 5000,
"maxDocumentBytes": 16777216,
"maxTotalInputBytes": 67108864,
"maxEdges": 250000,
"maxDepth": 64,
"maxProjectionBytes": 50331648
}
}The staging manifest records this contract version and runtime budget. Rust checks serialized graph_data.json, data.js, and target caches before atomic replacement. Content reads on Android use the same 16 MiB sentinel-bounded reader as graph ingestion, so an oversized note fails before returning a large String.
The release workflow now builds aarch64, requires exactly arm64-v8a, and publishes noteconnection-arm64-release.apk/.aab. Universal remains an explicit local opt-in only; no release claim is made for unverified ABIs.
This increment changes no projection schema or IPC field. It makes failure monotonic: a new over-budget graph or note is rejected while the previous valid projection remains intact. Native device/RSS evidence is still required before claiming G2/G3 completion.
移动构建现在从一份 checked-in contract 推导限制：
{
"schemaVersion": 1,
"profiles": { "mobile-low": { "artifactCompressedBytes": 26214400, "maxResidentBytes": 268435456 } },
"runtime": {
"maxDocuments": 5000,
"maxDocumentBytes": 16777216,
"maxTotalInputBytes": 67108864,
"maxEdges": 250000,
"maxDepth": 64,
"maxProjectionBytes": 50331648
}
}staging manifest 会记录 contract version 与 runtime budget。Rust 在 atomic replacement 前检查 graph_data.json、data.js 与 target cache 的序列化大小。Android content read 复用 graph ingestion 的 16 MiB sentinel-bounded reader，超大笔记在返回大 String 前失败。
release workflow 现在构建 aarch64，强制精确 arm64-v8a，并发布 noteconnection-arm64-release.apk/.aab。Universal 只保留为显式本地 opt-in，不对未验证 ABI 作 release 声明。
本轮不改变 projection schema 或 IPC 字段，而是让失败单调：新的超预算图谱或正文被拒绝，上一份有效 projection 保持不变。G2/G3 仍需真机与 RSS 证据后才能关闭。
The Phase 23 JSON contract now has a deliberately small browser projection. index.html loads mobile_budget_runtime.js before the storage provider, so WebView and Capacitor use the same runtime limits without shipping Node or Rust loaders. The contract remains additive metadata; projection schema, public IDs, and IPC fields are unchanged.
The mobile read path is now bounded at the edge. Capacitor checks the filesystem-reported size before readFile when the platform exposes stat, then measures decoded UTF-8 bytes as a fallback. Directory depth is checked for every enumerated entry, and graph edges/projection bytes are validated after worker or single-thread construction. The failure mode is monotonic: an oversized input is rejected while the previous valid projection remains available.
The native side follows the same rule. Tauri rejects oversized generated assets before bootstrap/IPC reads, and Android evidence records ABI plus device RAM. mobile-low accepts only measurable devices at or below 4 GiB and exact arm64-v8a artifacts; mobile-standard raises the device ceiling to 8 GiB without changing the low profile.
CI now makes the evidence boundary visible: signed arm64 outputs are workflow artifacts, while GitHub Release upload depends on an explicit self-hosted workload and real VmRSS samples. The current static staging is 122 files / 4,283,033 uncompressed bytes / 1,552,689 estimated compressed bytes / SHA-256 c60fe683957faf8fcf88a34b1c766740340c2cdd005bc526cc4efe13befbf77c. No native G2/G3 claim is made on this host.
第 23 阶段的 JSON contract 现在有一个刻意保持很小的 browser projection。index.html 在 storage provider 之前加载 mobile_budget_runtime.js，因此 WebView 与 Capacitor 共用同一组 runtime limits，不需要把 Node 或 Rust loader 放进移动包。Contract 仍只是 additive metadata，projection schema、public ID 与 IPC 字段不变。
移动 read path 在边界处有界：Capacitor 在平台提供 stat 时先检查 filesystem 报告的大小，再在 readFile 后以 decoded UTF-8 字节兜底。每个枚举 entry 都检查目录深度，worker 与 single-thread 构图后都校验边数和 projection 字节。失败保持单调：超限输入被拒绝，上一次有效 projection 仍可用。
Native 侧遵循同一规则。Tauri 在 bootstrap/IPC read 前拒绝超限 generated asset，Android evidence 记录 ABI 与设备 RAM。mobile-low 只接受可测且不超过 4 GiB 的设备与精确 arm64-v8a 产物；mobile-standard 将设备上限提高到 8 GiB，但不改变 low profile。
CI 现在显式隔离证据边界：签名 arm64 产物先是 workflow artifact，只有显式 self-hosted workload 与真实 VmRSS 样本成功后才上传 GitHub Release。当前静态 staging 为 122 文件 / 未压缩 4,283,033 bytes / 估算压缩 1,552,689 bytes / SHA-256 c60fe683957faf8fcf88a34b1c766740340c2cdd005bc526cc4efe13befbf77c。当前宿主不宣称原生 G2/G3 通过。
The identity transition path now checks the full destination alias set before mutation. A historical basename or URI is still a valid compatibility lookup, so collision detection includes the current path, current URI, and every retained alias of every other document. A move that would claim one of those aliases fails before the document, registry, workspace, or index state changes.
After a valid move, KnowledgeLearningPlatform keeps the legacy documentId and content revision, updates the document's atoms/evidence, then mirrors the new path and identity metadata into ResourceRegistry, its workspace binding, and IndexLifecycle. Existing resource/projection/index IDs and content hashes are preserved, which prevents a path-only rename from being misreported as content churn. The persisted G4 fixture verifies both the rejected-collision state and the successful four-owner state.
This is an in-process owner-convergence boundary, not a full transaction engine. A mixed request that mutates one document and fails on a later operation can still expose partial ingest state; whole-request preflight or journaled rollback is the next reliability slice. The change adds no mobile dependency, database, model, Godot asset, or budget, and does not promote public canonical IDs.
Focused verification is 3 suites / 11 tests, TypeScript no-emit, and git diff --check. Full regression is 148 Jest suites / 1,284 passed / 26 skipped plus 30 Rust tests and one ignored probe; four-host projection replay and fresh mobile-low budget pass. Native G2/G3 remains open because signed arm64 artifacts, approved low-memory hardware, SAF execution, force-stop/reopen continuity, failure retries, and measured RSS are unavailable on this host.
身份迁移路径现在会在 mutation 前检查完整目标 alias 集合。历史 basename 或 URI 仍是兼容查询入口，因此 collision 检查包含当前 path、当前 URI 以及其他文档保留的全部 alias。若 move 会抢占这些 alias，操作会在 document、registry、workspace 或 index 状态变化前失败。
合法 move 保留旧 documentId 与 content revision，更新 document 的 atom/evidence，再把新 path 与身份元数据同步到 ResourceRegistry、workspace binding 与 IndexLifecycle。既有 resource/projection/index ID 与 content hash 不变，path-only rename 不会被误报成 content churn。持久化 G4 fixture 同时验证 rejected-collision 与成功后的四 owner 状态。
这仍是进程内 owner convergence 边界，不是完整事务引擎。混合请求如果先修改一个文档、再在后续 operation 失败，仍可能暴露部分 ingest state；下一阶段应增加 whole-request preflight 或 journaled rollback。本改动不增加移动端依赖、数据库、模型、Godot asset 或预算，也不切换 public canonical ID。
定向验证为 3 suites / 11 tests、TypeScript no-emit 与 git diff --check。全量回归为 148 个 Jest suite / 1,284 passed / 26 skipped，加上 Rust 30 个通过与 1 个 ignored probe；四 host projection replay 与 fresh mobile-low budget 通过。原生 G2/G3 仍开放，因为当前宿主没有签名 arm64 产物、获批低内存硬件、SAF 执行、force-stop/reopen continuity、失败重试与 RSS 实测证据。
ingestKnowledge is now serialized per platform instance. Before a request mutates the graph, it captures a deep copy of the existing versioned snapshot. If a later operation, relation recompute, owner mirror, or atomic save fails, the platform restores the document graph, secondary registries, index, identity journal, telemetry, and ID counter as one pre-image. A second import cannot interleave with that restore.
The boundary also validates ownership for upsert and move: duplicate path/URI/aliases, an explicit move whose from* alias belongs elsewhere, ambiguous source aliases, and missing secondary owners are rejected. The mixed-batch fixture moves one document successfully, forces a collision on the next move, verifies the persisted bytes remain unchanged, then moves the first document from its original alias to prove in-memory rollback.
This is a deliberate reuse of the existing snapshot/replay contract, so public IDs, projection schemas, Bridge fields, and the runtime-first mobile package remain unchanged. The cost is transient memory proportional to the current graph and JSON clone/restore latency; native low-memory acceptance must measure that cost with bounded import batches. Versioned G4 manifests and signed arm64/RSS evidence remain release gates.
Current verification is 148 Jest suites / 1,287 passed / 26 skipped, Rust 30 passed / 1 ignored, TypeScript no-emit, 122-file mobile-low staging, four-host projection replay, eight native-recovery scenarios, Diataxis, and git diff --check.
ingestKnowledge 现在按 platform instance 串行执行。请求在 mutation 前保存 versioned snapshot 的深拷贝；后续 operation、relation recompute、owner mirror 或 atomic save 失败时，document graph、secondary registry、index、identity journal、telemetry 与 ID counter 作为一个 pre-image 一起恢复，第二个 import 不能在恢复期间插入。
边界同时为 upsert 与 move 校验 ownership：重复 path/URI/alias、显式 move 的 from* alias 属于其他文档、source alias 歧义以及 secondary owner 缺失都会被拒绝。mixed-batch fixture 先让一个 move 成功，再让下一步 collision，验证持久化字节未改变，随后从原始 alias 成功迁移第一文档，证明内存状态也已回滚。
实现复用现有 snapshot/replay contract，因此 public ID、projection schema、Bridge 字段与 runtime-first 移动包保持不变。代价是与当前 graph 成比例的瞬时内存及 JSON clone/restore 延迟；原生低内存验收必须用有界 import batch 实测。版本化 G4 manifest 与签名 arm64/RSS 证据仍是 release 门禁。
当前验证为 148 个 Jest suite / 1,287 passed / 26 skipped、Rust 30 passed / 1 ignored、TypeScript no-emit、122 文件 mobile-low staging、4 host projection replay、8 个 native-recovery scenario、Diataxis 与 git diff --check。
config/identity-corpus.v1.json now defines the tracked G4 contract instead of leaving identity evidence distributed across individual tests. The verifier runs eight production-path cases: legacy snapshot atomic restore, same-content isolation, cross-root NFC normalization, NFC/case collision rejection, move-journal restart plus deletion through the old alias, mixed-batch rollback, four-owner convergence, and upsert alias collision rejection.
It then runs the existing projection replay and requires web, tauri, capacitor, and android. The run passed all 8 cases and all 4 hosts. Its stable result hash is 4274a5a2d087875d309fdef9dd4232f5704103b9496ee5524744229bf550b5bb. The generated report says host-code-replay and nativeDeviceEvidence: false; it is not a signed-device, process-death, or RSS claim.
This phase keeps the public ID and all snapshot/projection/mobile contracts unchanged. Canonical-ID migration is still a separate review, and native G2/G3 remains gated by signed arm64 hardware, SAF/permission/retry, force-stop/reopen, and measured RSS.
Final regression is 149 Jest suites / 1,289 passed / 26 skipped; TypeScript no-emit, Rust 30 passed / 1 ignored, mobile-low budget, native recovery, projection replay, Diataxis, and git diff --check passed.
config/identity-corpus.v1.json 现在定义受跟踪的 G4 contract，identity 证据不再分散在单个测试中。验证器执行八个生产路径用例：legacy snapshot 原子恢复、同内容隔离、跨 root NFC 规范化、NFC/case collision rejection、move-journal 重启并通过旧 alias 删除、mixed-batch rollback、四 owner 收敛与 upsert alias collision rejection。
随后执行既有 projection replay，并强制要求 web、tauri、capacitor、android 四 host。8 个 case 与 4 个 host 全部通过，稳定 result hash 为 4274a5a2d087875d309fdef9dd4232f5704103b9496ee5524744229bf550b5bb。报告标记 host-code-replay 与 nativeDeviceEvidence: false，不代表签名真机、进程死亡或 RSS 通过。
本阶段保持 public ID 及所有 snapshot/projection/mobile contract 不变。Canonical-ID 迁移仍需独立评审，原生 G2/G3 仍受签名 arm64、SAF/权限/重试、force-stop/reopen 与 RSS 实测门禁约束。
mobile:build:release is now the single documented Android release entry. It delegates to mobile:build:tauri-android, which already owns slim preparation and Android prerequisite checks. The historical mobile:build:both command remains intact, while mobile:build:compatibility makes its Capacitor-plus-Tauri purpose explicit.
The routing change does not alter projection schemas, IPC fields, public IDs, storage formats, or mobile payloads. Capacitor removal remains deferred until downstream and CI usage is audited. This phase also does not create native signing, SAF, continuity, or RSS evidence.
mobile:build:release 现在是唯一文档化 Android release 入口，委托 mobile:build:tauri-android，由后者继续拥有 slim preparation 与 Android prerequisite。历史 mobile:build:both 保持不变，mobile:build:compatibility 明确其 Capacitor + Tauri 兼容验证用途。
该路由调整不改变 projection schema、IPC 字段、public ID、存储格式或移动 payload。移除 Capacitor 仍需先审计下游与 CI 使用，本阶段也不会生成签名、SAF、continuity 或 RSS 原生证据。
Phase 29 回归验证为 150 个 Jest suite / 1,291 passed / 26 skipped；TypeScript no-emit、Tauri Rust 30 passed / 1 ignored、Fixrisk FR-001..FR-015 全部通过、Diataxis 与 git diff --check 通过。
The conversation path now builds a pre-RAG GraphAnswerPlan, passes it through graphConditionedContext, and records the resulting bounded selection in ragContextPack.graphConditioning. Matching atoms and relation edges are preferred only after the existing role and score ordering; unmatched fragments remain available under the normal budget. Recovery uses the same plan, so the retry cannot silently change graph scope.
本阶段的图回答计划在 RAG 前参与 fragment 选择，并通过 ragContextPack.graphConditioning 记录命中 claim、fragment、atom、edge 与 fallback。匹配只在既有 role/score 排序之后生效，未命中 fragment 仍受正常 budget 管理；恢复路径复用同一 plan，不会静默扩大图 scope。
Focused verification: 25 learning suites / 510 passed, the platform conversation regression passed, 4 mobile profile/pipeline suites / 27 passed, TypeScript no-emit passed, and git diff --check passed. Native signed arm64, SAF/continuity, and RSS evidence remain explicitly not measured.