feat(runtime): durable Work Ledger rebased onto current master

.env.example

@@ -71,6 +71,42 @@ POWERCONTEXT_SERVER_DATABASE_KIND=sqlite
 # The default database is powercontext; set test before upgrading an existing seekdb deployment.
 # POWERCONTEXT_SERVER_DATABASE_DATABASE=test
 
+# Deployment and durable work -------------------------------------------------
+# Local installs run every role in one process. Distributed mode requires OceanBase and one role per process.
+POWERCONTEXT_SERVER_DEPLOYMENT_MODE=single_node
+POWERCONTEXT_SERVER_DEPLOYMENT_ROLE=all
+POWERCONTEXT_SERVER_DEPLOYMENT_ID=local
+POWERCONTEXT_SERVER_DEPLOYMENT_BEHAVIOR_REVISION=default
+
+# Scheduler and member leases use database time. Renewal must stay within the validated lease ratios.
+POWERCONTEXT_SERVER_COORDINATION_SCHEDULER_LEASE_SECONDS=30
+POWERCONTEXT_SERVER_COORDINATION_SCHEDULER_RENEW_SECONDS=10
+POWERCONTEXT_SERVER_COORDINATION_SCAN_PAGE_SIZE=100
+POWERCONTEXT_SERVER_COORDINATION_MEMBER_TTL_SECONDS=30
+POWERCONTEXT_SERVER_COORDINATION_MEMBER_HEARTBEAT_SECONDS=10
+POWERCONTEXT_SERVER_COORDINATION_EMIT_PAYLOAD_VERSION=1
+
+POWERCONTEXT_SERVER_WORKER_CONCURRENCY=4
+POWERCONTEXT_SERVER_WORKER_LEASE_SECONDS=120
+POWERCONTEXT_SERVER_WORKER_HEARTBEAT_SECONDS=30
+POWERCONTEXT_SERVER_WORKER_SHUTDOWN_GRACE_SECONDS=90
+POWERCONTEXT_SERVER_WORKER_MAX_ATTEMPTS=5
+POWERCONTEXT_SERVER_WORKER_RETRY_BASE_SECONDS=2
+POWERCONTEXT_SERVER_WORKER_RETRY_MAX_SECONDS=300
+POWERCONTEXT_SERVER_WORKER_POLL_SECONDS=1
+
+POWERCONTEXT_SERVER_OPERATIONS_DEFAULT_WAIT_SECONDS=10
+POWERCONTEXT_SERVER_OPERATIONS_MAXIMUM_WAIT_SECONDS=30
+POWERCONTEXT_SERVER_OPERATIONS_POLL_SECONDS=0.2
+POWERCONTEXT_SERVER_OPERATIONS_RETENTION_DAYS=30
+POWERCONTEXT_SERVER_OPERATIONS_CLEANUP_BATCH_SIZE=500
+POWERCONTEXT_SERVER_OPERATIONS_CLEANUP_INTERVAL_SECONDS=3600
+
+# Shared OceanBase fixed-window limiting is optional and disabled by default.
+POWERCONTEXT_SERVER_RATE_LIMIT_ENABLED=false
+POWERCONTEXT_SERVER_RATE_LIMIT_REQUESTS=120
+POWERCONTEXT_SERVER_RATE_LIMIT_WINDOW_SECONDS=60
+
 # Runtime ---------------------------------------------------------------------
 POWERCONTEXT_SERVER_RUNTIME_SOURCE_WINDOW_LIMIT=100
 # Maximum sum of explicit assembly section limits; per-family limits still apply.

.licenserc.yaml

@@ -68,6 +68,8 @@ header:
     - 'src/powercontext/server/dashboard/static/vendor/**'
     - '.gitattributes'
     - '**/*.service.in'
+    # license-eye cannot determine the comment style of Alembic's Mako template.
+    - 'src/powercontext/builtin/persistence/migrations/script.py.mako'
     - '**/*.jsonl'
     # license-eye cannot determine the comment style of patch files.
     - '**/*.patch'

desktop/VALIDATION.md

@@ -118,7 +118,7 @@ The historical Server c535d816 protocol qualification below records the specific
 
 ## Compatibility scope
 
-[compatibility.json](src-tauri/src/connections/compatibility.json) preserves each recorded Server source, normalized OpenAPI contract digest, qualification-wheel digest and operation set. `sqlite-atomic-bae5d714-v1` records the current bundled contract's eleven protocol operations qualified below. Historical records retain their exact identities and evidence, including `sqlite-source-artifact-87b6fae2-v1` and the preceding `sqlite-artifact-merge-87d01f68-v1` record. The `sqlite-atomic-dd62723d-v1` and `sqlite-atomic-4ffdf4e9-v1` records retain their migration-framework and release-preparation source qualifications with their original contract digest. Other historical records also retain their exact identities and evidence. Ordinary builds require explicitly selecting the record whose tested Server source and wheel match the deployment, then checking the connection before business operations become available. Records with a different contract digest are disabled in the selector, and saved unavailable selections remain visible until explicitly replaced. Selecting a profile does not extend its recorded operation set or qualify a different Server source. CI builds have their own artifact identities and do not change product qualification.
+[compatibility.json](src-tauri/src/connections/compatibility.json) preserves each recorded Server source, normalized OpenAPI contract digest, qualification-wheel digest and operation set. `sqlite-atomic-d9f33be3-v1` records the current bundled contract's eleven protocol operations qualified below. Historical records retain their exact identities and evidence, including `sqlite-atomic-cf81c1a8-v1` and `sqlite-atomic-bae5d714-v1`, which qualified the preceding `c7f00e81…` and `0f6befcd…` contracts respectively, and `sqlite-source-artifact-87b6fae2-v1` with the preceding `sqlite-artifact-merge-87d01f68-v1` record. The `sqlite-atomic-dd62723d-v1` and `sqlite-atomic-4ffdf4e9-v1` records retain their migration-framework and release-preparation source qualifications with their original contract digest. Other historical records also retain their exact identities and evidence. Ordinary builds require explicitly selecting the record whose tested Server source and wheel match the deployment, then checking the connection before business operations become available. Records with a different contract digest are disabled in the selector, and saved unavailable selections remain visible until explicitly replaced. Selecting a profile does not extend its recorded operation set or qualify a different Server source. CI builds have their own artifact identities and do not change product qualification.
 
 The real Server harness covers SQLite with anonymous loopback, static Bearer, HTTPS with explicit CA/base path, and injected-provider/enforced access. It exercises save/search/exact reads, identity changes, binding revocation, ambiguous writes without replay and Scope pagination. Installed UI checks cover repeated launches preserving the existing editor, late committed-save responses preserving a new Scope draft, explicit connection/Scope selection, clipboard copies, connection isolation, draft cancellation, byte limits and independent Server survival after Desktop exit.
 
@@ -128,6 +128,40 @@ Selecting a compatibility profile does not attest the remote binary identity. Ex
 
 ### Server protocol qualification records
 
+#### Server d9f33be3 protocol qualification
+
+`sqlite-atomic-d9f33be3-v1` qualifies Server sources at
+`d9f33be3fde7a1801b51aa66c51d25af5b883d69` for the bundled OpenAPI digest
+`3a89f4131cf822d458a55e9ea4c57e1314aaffbaff764fd4f4935c7fc9a5f3cb`, the merged contract that carries
+master's 1.5.0 artifact-storage chain plus the four Scope-scoped durable operation endpoints. The
+qualification wheel is `powercontext-1.2.1.dev498+gd9f33be3f-py3-none-any.whl`, SHA-256
+`c23438d67cb79ee6e23d58307917853167d2f4dd1916138b35f2ceb169d48202`, built from that clean commit.
+All 685 packaged runtime files in `powercontext/` and `powercontext_service_bootstrap/` match the
+source bytes at that commit. The runtime manifest digest is
+`d81c6ed801f5d30686b7e7565ccc16a145af90dbf19b6788334a16d305a45cf3`
+(sorted `wheel/path sha256` lines, with a final newline).
+
+On 2026-11-02, macOS 27.2 ARM64 with Python 3.14.7 and Rust 1.95.0 ran the existing
+`desktop/tests/real_server.py` harness against the extracted wheel and independent SQLite Server
+processes. All four modes passed: anonymous loopback, static Bearer, HTTPS with an explicit CA and
+base path, and an injected provider with enforced access. The eleven recorded operations cover
+Atomic Memory save/search/exact revision reads, Scope selection and pagination, identity changes,
+same-identity revocation, committed writes with lost responses without replay, server discovery,
+and Server survival after client exit. The report records the source commit above and
+`desktopWorkingTreeDirty=false`.
+
+This is protocol qualification of the recorded source, contract and wheel. It does not qualify
+Windows/Intel execution, native credential persistence, installed GUI workflows, signing or release
+readiness, and it says nothing about the four new operation endpoints: they are Server-side contract
+covered by the Python suite and are deliberately absent from the Desktop operation set above.
+Reproduce from this clean commit with `uv build --wheel --out-dir desktop/.artifacts/server-wheel`,
+`cargo build --locked --example server_probe --example diagnostic_cli_probe`,
+`uv run --no-sync python desktop/tests/fixture_qualification.py --server-commit d9f33be3fde7a1801b51aa66c51d25af5b883d69`,
+and `uv run --no-sync python desktop/tests/real_server.py`.
+The bundled preview resolves its qualification by digest, so a contract change and a matching record
+have to land together. `tests/test_desktop_contract.py` fails the Python gate for a digest without a
+record, exactly as `bundled_qualification_allows_explicit_scope_browsing` fails the native one.
+
 #### Server bae5d714 protocol qualification
 
 `sqlite-atomic-bae5d714-v1` qualifies Server source
@@ -378,6 +412,39 @@ Ignored evidence is retained in `desktop/.artifacts/real-server.json` and
 原生客户端使用未修改的产品协议模块，依赖版本及校验和与产品 Cargo 锁文件一致。
 本次验收不覆盖 Windows／macOS 执行、原生凭据库、安装后 GUI 或发布验收。
 
+#### Server cf81c1a8 protocol qualification
+
+`sqlite-atomic-cf81c1a8-v1` qualifies Server sources at
+`cf81c1a8a9c40c1fe186944ba6e334b54aa5da70` for the bundled OpenAPI digest
+`c7f00e81a12848249c7105ba99c444b6233f4b2a4849d1d4443c419f53ac764f`, the contract that adds the four
+Scope-scoped durable operation endpoints. The qualification wheel is
+`powercontext-1.2.1.dev414+gcf81c1a8a-py3-none-any.whl`, SHA-256
+`0530ed69045ed45be3048aafd9256710d1e1ef4b234858b6314513556ff2b904`, built from that clean commit.
+All 632 packaged runtime files in `powercontext/` and `powercontext_service_bootstrap/` match the
+source bytes at that commit. The runtime manifest digest is
+`8f591bfb56ed302481297a2b02f06d1cb4f381eb15090a603a1322c6f72d1e93`
+(sorted `wheel/path sha256` lines, with a final newline).
+
+On 2026-10-30, macOS 27.2 ARM64 with Python 3.14.7 and Rust 1.95.0 ran the existing
+`desktop/tests/real_server.py` harness against the extracted wheel and independent SQLite Server
+processes. All four modes passed: anonymous loopback, static Bearer, HTTPS with an explicit CA and
+base path, and an injected provider with enforced access. The eleven recorded operations cover
+Atomic Memory save/search/exact revision reads, Scope selection and pagination, identity changes,
+same-identity revocation, committed writes with lost responses without replay, server discovery,
+and Server survival after client exit. The report records the source commit above and
+`desktopWorkingTreeDirty=false`.
+
+This is protocol qualification of the recorded source, contract and wheel. It does not qualify
+Windows/Intel execution, native credential persistence, installed GUI workflows, signing or release
+readiness, and it says nothing about the four new operation endpoints: they are Server-side contract
+covered by the Python suite and are deliberately absent from the Desktop operation set above.
+Reproduce from this clean commit with the existing wheel build, native `server_probe` build,
+`fixture_qualification.py --server-commit cf81c1a8a9c40c1fe186944ba6e334b54aa5da70`,
+and `real_server.py` commands recorded under [Server 4ffdf4e9 protocol qualification](#server-4ffdf4e9-protocol-qualification).
+The bundled preview resolves its qualification by digest, so a contract change and a matching record
+have to land together. `tests/test_desktop_contract.py` fails the Python gate for a digest without a
+record, exactly as `bundled_qualification_allows_explicit_scope_browsing` fails the native one.
+
 #### Server 4ffdf4e9 protocol qualification
 
 `sqlite-atomic-4ffdf4e9-v1` qualifies the v1.4.1 preparation sources at

desktop/src-tauri/src/connections/compatibility.json

@@ -1,4 +1,24 @@
 [
+  {
+    "id": "sqlite-atomic-d9f33be3-v1",
+    "serverCommit": "d9f33be3fde7a1801b51aa66c51d25af5b883d69",
+    "contractSha256": "3a89f4131cf822d458a55e9ea4c57e1314aaffbaff764fd4f4935c7fc9a5f3cb",
+    "artifactSha256": "c23438d67cb79ee6e23d58307917853167d2f4dd1916138b35f2ceb169d48202",
+    "operations": [
+      "get_access_principal",
+      "get_artifact_revision",
+      "get_capabilities",
+      "get_default_scope",
+      "get_liveness",
+      "get_readiness",
+      "get_scope",
+      "get_server_info",
+      "list_scopes",
+      "remember_memory",
+      "search_memory"
+    ],
+    "evidence": "desktop/VALIDATION.md#server-d9f33be3-protocol-qualification"
+  },
   {
     "id": "sqlite-6e237568-v1",
     "serverCommit": "6e2375688bc38a667840c6b2dc8269d8848027bc",
@@ -247,6 +267,26 @@
     ],
     "evidence": "desktop/VALIDATION.md#server-cc5980f0-protocol-qualification"
   },
+  {
+    "id": "sqlite-atomic-cf81c1a8-v1",
+    "serverCommit": "cf81c1a8a9c40c1fe186944ba6e334b54aa5da70",
+    "contractSha256": "c7f00e81a12848249c7105ba99c444b6233f4b2a4849d1d4443c419f53ac764f",
+    "artifactSha256": "0530ed69045ed45be3048aafd9256710d1e1ef4b234858b6314513556ff2b904",
+    "operations": [
+      "get_access_principal",
+      "get_artifact_revision",
+      "get_capabilities",
+      "get_default_scope",
+      "get_liveness",
+      "get_readiness",
+      "get_scope",
+      "get_server_info",
+      "list_scopes",
+      "remember_memory",
+      "search_memory"
+    ],
+    "evidence": "desktop/VALIDATION.md#server-cf81c1a8-protocol-qualification"
+  },
   {
     "id": "sqlite-atomic-4ffdf4e9-v1",
     "serverCommit": "4ffdf4e97ad43c55d8718a1df581596db2e6097d",

desktop/src-tauri/src/transport/operations.json

@@ -1,5 +1,5 @@
 {
-  "contractSha256": "0f6befcd87645b83e63ea6393ba57002387302b4e53cf85fc474a218292f4104",
+  "contractSha256": "3a89f4131cf822d458a55e9ea4c57e1314aaffbaff764fd4f4935c7fc9a5f3cb",
   "operations": {
     "get_liveness": {
       "method": "GET",