feat: archive versioned identity corpus replay

Author: Jacobinwwey

config/identity-corpus.v1.json

@@ -0,0 +1,31 @@
+{
+  "schemaVersion": 1,
+  "corpusId": "noteconnection-identity-g4-v1",
+  "compatibility": {
+    "publicIdsChanged": false,
+    "snapshotSchemaChanged": false,
+    "projectionSchemaChanged": false,
+    "mobileRuntimeChanged": false
+  },
+  "requiredCases": [
+    "legacy_snapshot_restore",
+    "same_content_isolation",
+    "cross_root_nfc_identity",
+    "nfc_case_collision_rejection",
+    "move_journal_restart_alias_delete",
+    "mixed_batch_rollback",
+    "four_owner_convergence",
+    "upsert_alias_collision_rejection"
+  ],
+  "requiredProjectionHosts": [
+    "web",
+    "tauri",
+    "capacitor",
+    "android"
+  ],
+  "gates": {
+    "canonicalPublicIdCutover": "blocked_until_all_cases_and_projection_hosts_pass",
+    "nativeDeviceEvidence": "separate_gate",
+    "rssEvidence": "separate_gate"
+  }
+}

docs/diataxis/en/explanation/development-progress-dashboard.md

@@ -1923,3 +1923,11 @@ Run G1 registry shadow parity, G2 fresh mobile artifact/RSS evidence, G3 version
 - Rollback covers graph records, resource/workspace/index owners, identity journal, telemetry, and ID allocation. `upsert`/`move` alias ownership, explicit source aliases, ambiguity, and required owner presence are checked at the boundary.
 - The mixed-batch G4 regression proves no partial move is visible after a later collision. Public IDs, projection schemas, Bridge fields, and mobile-slim dependencies remain unchanged.
 - The trade-off is transient graph-proportional memory and clone/restore latency; native low-memory acceptance must use bounded batches and real RSS evidence. Versioned replay manifests remain open gates.
+
+## 2026-08-21 Phase 27 Versioned G4 Identity Corpus Replay
+
+- `config/identity-corpus.v1.json` now tracks eight identity/persistence cases instead of relying on scattered test names.
+- `scripts/verify-identity-corpus.js` executes production identity owners and requires the four-host Web/Tauri/Capacitor/Android projection replay.
+- 8 cases and 4 hosts passed with result hash `4274a5a2d087875d309fdef9dd4232f5704103b9496ee5524744229bf550b5bb`; evidence is `host-code-replay`, not native-device evidence.
+- Public-ID cutover remains blocked pending independent review. Signed arm64 execution, SAF/retry/continuity, and RSS remain separate G2/G3 gates.
+- Final regression is 149 Jest suites / 1,289 passed / 26 skipped; TypeScript no-emit, Rust, mobile budget, projection replay, native recovery, and Diataxis passed.

docs/diataxis/zh/explanation/development-progress-dashboard.md

@@ -1951,3 +1951,11 @@ Migration matrix 57 suite / 307 个测试通过，同时 projection/Bridge 定
 - rollback 覆盖 graph record、resource/workspace/index owner、identity journal、telemetry 与 ID allocation；`upsert`/`move` 的 alias ownership、显式 source alias、歧义与必需 owner 均在边界校验。
 - mixed-batch G4 回归证明后续 collision 后不可观察到部分 move。Public ID、projection schema、Bridge 字段与 mobile-slim 依赖保持不变。
 - 代价是与 graph 成比例的瞬时内存及 clone/restore 延迟；原生低内存验收必须使用有界 batch 与真实 RSS。版本化 replay manifest 仍是开放门禁。
+
+## 2026-08-21 第 27 阶段：版本化 G4 identity corpus 回放
+
+- `config/identity-corpus.v1.json` 现在跟踪八个 identity/persistence 用例，不再依赖分散的测试名称。
+- `scripts/verify-identity-corpus.js` 执行生产 identity owner，并强制 Web/Tauri/Capacitor/Android 四 host projection replay。
+- 8 个 case 与 4 个 host 通过，result hash 为 `4274a5a2d087875d309fdef9dd4232f5704103b9496ee5524744229bf550b5bb`；证据级别是 `host-code-replay`，不是原生设备证据。
+- Public-ID 切换仍需独立评审并保持阻塞。签名 arm64 执行、SAF/重试/continuity 与 RSS 仍是独立 G2/G3 门禁。
+- 最终回归为 149 个 Jest suite / 1,289 passed / 26 skipped；TypeScript no-emit、Rust、mobile budget、projection replay、native recovery 与 Diataxis 通过。

docs/en/implementation_plan.md

@@ -849,3 +849,11 @@ Identity ownership is checked at the boundary for both `upsert` and `move`. Path
 This closes the Phase 25 partial-commit gap without changing public IDs, snapshot/projection schemas, Bridge fields, or the runtime-first mobile package. The trade-off is transient memory proportional to the graph plus JSON clone/restore latency; low-memory acceptance must measure it with bounded batches. Versioned old-snapshot/cross-root/move-journal/collision/rollback manifests and native signed-arm64/RSS evidence remain required before public-ID, SQLite/WASM, Godot, budget, or strict-default route promotion.
 
 Current verification: TypeScript no-emit passed; 148 Jest suites passed with 1,287 passed and 26 skipped; Rust passed with 30 passed and 1 ignored; mobile-low staging passed at 122 files / 4,283,033 uncompressed / 1,552,689 estimated compressed bytes; projection replay passed for 4 hosts; native recovery passed 8 scenarios; Diataxis passed with 18 entries / 36 paths / 64 canonical references; `git diff --check` passed.
+
+## 2026-08-21 Phase 27 Versioned G4 Identity Corpus Replay
+
+`config/identity-corpus.v1.json` is now the tracked corpus contract for eight cases: legacy snapshot restore, same-content isolation, cross-root NFC identity, NFC/case collision rejection, move-journal restart with old-alias deletion, mixed-batch rollback, four-owner convergence, and upsert alias collision rejection. `scripts/verify-identity-corpus.js` executes production `Graph`, `ResourceIdentity`, `KnowledgeLearningPlatform`, and file-store paths, then requires the four-host projection replay.
+
+The report is explicitly `host-code-replay` with `nativeDeviceEvidence: false` and `canonicalPublicIdCutover: blocked`. The run passed 8 cases and 4 projection hosts with result hash `4274a5a2d087875d309fdef9dd4232f5704103b9496ee5524744229bf550b5bb`; the manifest contract passed 2 tests. This is a release evidence boundary, not native Android acceptance. Public-ID migration still requires independent review; G2/G3 still require signed arm64, SAF/retry/continuity, and RSS evidence.
+
+Final regression is 149 Jest suites / 1,289 passed / 26 skipped; TypeScript no-emit, Rust 30 passed / 1 ignored, mobile-low budget, native recovery, projection replay, and Diataxis passed.

docs/en/task.md

@@ -481,3 +481,14 @@ The harness deliberately executes only explicit `adbArgs` from a checked workloa
 - [x] Keep public IDs, snapshot/projection schemas, mobile runtime dependencies, and `mobile-slim` boundaries unchanged.
 - [ ] Archive versioned old-snapshot/cross-root/move-journal/collision/rollback manifests and replay them across every host adapter before canonical-ID cutover.
 - [~] Native G2/G3 remains open; the rollback pre-image adds transient memory proportional to the current graph and must be measured on the target low-memory profile.
+
+## 2026-08-21 Phase 27 Versioned G4 Identity Corpus Replay
+
+- [x] Add `config/identity-corpus.v1.json` with eight required old-snapshot, same-content, cross-root/NFC, move-journal, collision, rollback, and four-owner cases.
+- [x] Add `scripts/verify-identity-corpus.js` to execute identity/persistence replay and invoke Web/Tauri/Capacitor/Android projection replay.
+- [x] Add a manifest contract test; reports are `host-code-replay` only, explicitly set `nativeDeviceEvidence: false`, include a stable result hash, and keep canonical public-ID cutover blocked.
+- [x] Replay result: 8 cases passed, 4 projection hosts passed; result hash `4274a5a2d087875d309fdef9dd4232f5704103b9496ee5524744229bf550b5bb`.
+- [x] Final regression: 149 Jest suites / 1,289 passed / 26 skipped; TypeScript no-emit, Rust 30 passed / 1 ignored, mobile-low budget, native recovery, projection replay, and Diataxis passed.
+- [x] Keep public IDs, snapshot/projection schemas, Bridge fields, mobile runtime dependencies, and `mobile-slim` unchanged.
+- [ ] Perform an independent canonical-ID migration review from the archived manifest; no public-ID switch is included here.
+- [~] Native G2/G3 remains separate: signed arm64 device execution, SAF/permission/retry, force-stop/reopen, and RSS `<= 256 MiB` are unavailable on this host.

docs/en/walkthrough.md

@@ -356,3 +356,11 @@ The boundary validates `upsert` and `move` ownership: duplicate path/URI/aliases
 The implementation reuses the existing snapshot/replay contract, leaving public IDs, projection schemas, Bridge fields, and the runtime-first mobile package unchanged. Transient memory and JSON clone/restore latency grow with the current graph, so low-memory native acceptance must use bounded batches and record RSS. Versioned G4 manifests and signed arm64 evidence remain release gates.
 
 Current verification is 148 Jest suites / 1,287 passed / 26 skipped, Rust 30 passed / 1 ignored, TypeScript no-emit, 122-file mobile-low staging, four-host projection replay, eight native-recovery scenarios, Diataxis, and `git diff --check`.
+
+## 2026-08-21 Phase 27 Versioned G4 Identity Corpus Replay Walkthrough
+
+`config/identity-corpus.v1.json` defines the tracked G4 contract. The verifier runs eight production-path cases: legacy snapshot atomic restore, same-content isolation, cross-root NFC normalization, NFC/case collision rejection, move-journal restart plus old-alias deletion, mixed-batch rollback, four-owner convergence, and upsert alias collision rejection. It then requires the existing Web/Tauri/Capacitor/Android projection replay.
+
+All 8 cases and 4 hosts passed. The stable result hash is `4274a5a2d087875d309fdef9dd4232f5704103b9496ee5524744229bf550b5bb`. The report is `host-code-replay` with `nativeDeviceEvidence: false`, so it is not a signed-device, process-death, or RSS claim. Public-ID migration remains a separate review; G2/G3 still require signed arm64 hardware, SAF/retry/continuity, and RSS evidence.
+
+Final regression is 149 Jest suites / 1,289 passed / 26 skipped; TypeScript no-emit, Rust 30 passed / 1 ignored, mobile-low budget, native recovery, projection replay, Diataxis, and `git diff --check` passed.

docs/solutions/architecture-hardening-forward-compatibility-2026-08-16.md

@@ -420,3 +420,23 @@ This is deliberately implemented by reusing the current snapshot/replay contract
 实现复用当前 snapshot/replay contract，保持 public ID、projection schema、Bridge 字段与 runtime-first 移动包不变；代价是与 graph 大小成正比的瞬时内存和 JSON clone/restore 延迟。因此原生低内存验收需要有界 batch 与真实 RSS 证据。在 canonical-ID、SQLite/WASM、Godot、预算或 route-registry 提升前，仍需归档有版本的 old-snapshot/cross-root/move-journal/collision/rollback manifest。
 
 当前验证：TypeScript no-emit 通过；148 个 Jest suite / 1,287 passed / 26 skipped；Rust 30 passed / 1 ignored；mobile-low staging 122 文件 / 4,283,033 未压缩 / 1,552,689 估算压缩 bytes；4 host projection replay；8 个 native-recovery scenario；Diataxis 与 `git diff --check` 均通过。
+
+## 2026-08-21 Phase 27 Versioned G4 Identity Corpus Replay
+
+### English
+
+The G4 identity evidence is now a tracked contract instead of an unbounded collection of test names. `config/identity-corpus.v1.json` requires eight cases covering legacy snapshot atomic restore, same-content isolation, cross-root NFC identity, NFC/case collision rejection, move-journal restart and old-alias deletion, mixed-batch rollback, four-owner convergence, and upsert alias collision rejection.
+
+`scripts/verify-identity-corpus.js` executes production TypeScript owners and then invokes the four-host projection replay. The run passed 8 cases and `web`, `tauri`, `capacitor`, and `android`; result hash `4274a5a2d087875d309fdef9dd4232f5704103b9496ee5524744229bf550b5bb`. The report is explicitly `evidenceLevel: host-code-replay`, sets `nativeDeviceEvidence: false`, and leaves `canonicalPublicIdCutover: blocked`.
+
+This closes the versioned host-code corpus gate without changing public IDs, snapshot/projection schemas, Bridge fields, or mobile payloads. It does not close signed-device, process-death, SAF permission/retry, or RSS gates; canonical-ID migration remains an independent review.
+
+### 中文
+
+G4 identity 证据现在成为受跟踪的 contract，而不是分散且无上限的测试名称集合。`config/identity-corpus.v1.json` 要求八个用例，覆盖 legacy snapshot 原子恢复、同内容隔离、跨 root NFC identity、NFC/case collision rejection、move-journal 重启与旧 alias 删除、mixed-batch rollback、四 owner 收敛和 upsert alias collision rejection。
+
+`scripts/verify-identity-corpus.js` 执行生产 TypeScript owner，再调用四 host projection replay。本次 8 个 case 与 `web`、`tauri`、`capacitor`、`android` 全部通过；result hash 为 `4274a5a2d087875d309fdef9dd4232f5704103b9496ee5524744229bf550b5bb`。报告明确标记 `evidenceLevel: host-code-replay`、`nativeDeviceEvidence: false`，并保持 `canonicalPublicIdCutover: blocked`。
+
+本阶段关闭了版本化 host-code corpus 门禁，但不改变 public ID、snapshot/projection schema、Bridge 字段或移动 payload。签名真机、进程死亡、SAF 权限/重试和 RSS 门禁仍未闭合；canonical-ID 迁移继续独立评审。
+
+最终回归为 149 个 Jest suite / 1,289 passed / 26 skipped；TypeScript no-emit、Rust 30 passed / 1 ignored、mobile-low budget、native recovery、projection replay 与 Diataxis 通过。

docs/zh/implementation_plan.md

@@ -1321,3 +1321,11 @@ identity ownership 在 `upsert` 与 `move` 的边界统一校验。path/URI/alia
 本阶段关闭 Phase 25 的 partial-commit 缺口，不改变 public ID、snapshot/projection schema、Bridge 字段或 runtime-first 移动包。代价是与 graph 成比例的瞬时内存及 JSON clone/restore 延迟；低内存验收必须使用有界 batch 实测。在 public-ID、SQLite/WASM、Godot、预算或 strict-default route 提升前，仍需有版本 old-snapshot/cross-root/move-journal/collision/rollback manifest 与原生签名 arm64/RSS 证据。
 
 当前验证：TypeScript no-emit 通过；148 个 Jest suite 通过，1,287 passed、26 skipped；Rust 通过，30 passed、1 ignored；mobile-low staging 通过，为 122 文件 / 未压缩 4,283,033 / 估算压缩 1,552,689 bytes；projection replay 通过（4 hosts）；native recovery 通过（8 scenarios）；Diataxis 通过（18 entries / 36 paths / 64 canonical references）；`git diff --check` 通过。
+
+## 2026-08-21 第 27 阶段：版本化 G4 identity corpus 回放
+
+`config/identity-corpus.v1.json` 现在是受跟踪的八用例 corpus contract，覆盖 legacy snapshot restore、same-content isolation、cross-root NFC identity、NFC/case collision rejection、move-journal restart + old-alias deletion、mixed-batch rollback、four-owner convergence 与 upsert alias collision rejection。`scripts/verify-identity-corpus.js` 执行生产 `Graph`、`ResourceIdentity`、`KnowledgeLearningPlatform` 与 file store 路径，再强制执行四 host projection replay。
+
+报告明确标记为 `host-code-replay`、`nativeDeviceEvidence: false`、`canonicalPublicIdCutover: blocked`。本次 8 个 case 与 4 个 projection host 通过，result hash 为 `4274a5a2d087875d309fdef9dd4232f5704103b9496ee5524744229bf550b5bb`；manifest contract 通过 2 tests。这是 release evidence boundary，不是 Android 真机验收。Public-ID 迁移仍需独立评审；G2/G3 仍需签名 arm64、SAF/重试/continuity 与 RSS 证据。
+
+最终回归为 149 个 Jest suite / 1,289 passed / 26 skipped；TypeScript no-emit、Rust 30 passed / 1 ignored、mobile-low budget、native recovery、projection replay 与 Diataxis 通过。

docs/zh/task.md

@@ -690,3 +690,14 @@ harness 只执行 workload spec 中明确列出的 `adbArgs`。这比任意 shel
 - [x] 保持 public ID、snapshot/projection schema、移动运行时依赖与 `mobile-slim` 边界不变。
 - [ ] 在 canonical-ID 切换前归档有版本的 old-snapshot/cross-root/move-journal/collision/rollback manifest，并跨所有 host adapter 回放。
 - [~] 原生 G2/G3 仍开放；rollback pre-image 会按当前 graph 产生瞬时内存开销，必须在目标低内存 profile 实测。
+
+## 2026-08-21 第 27 阶段：版本化 G4 identity corpus 回放
+
+- [x] 增加 `config/identity-corpus.v1.json`，声明八个 old-snapshot、same-content、cross-root/NFC、move-journal、collision、rollback 与四 owner 用例。
+- [x] 增加 `scripts/verify-identity-corpus.js`，实际执行 identity/persistence replay，并调用 Web/Tauri/Capacitor/Android projection replay。
+- [x] 增加 manifest contract test；报告只标记 `host-code-replay`，明确 `nativeDeviceEvidence: false`，包含稳定 result hash，并继续阻止 canonical public-ID 切换。
+- [x] 回放结果：8 个 case 通过，4 个 projection host 通过；result hash 为 `4274a5a2d087875d309fdef9dd4232f5704103b9496ee5524744229bf550b5bb`。
+- [x] 最终回归：149 个 Jest suite / 1,289 passed / 26 skipped；TypeScript no-emit、Rust 30 passed / 1 ignored、mobile-low budget、native recovery、projection replay 与 Diataxis 通过。
+- [x] 保持 public ID、snapshot/projection schema、Bridge 字段、移动运行时依赖与 `mobile-slim` 不变。
+- [ ] 基于已归档 manifest 独立评审 canonical-ID 迁移；本阶段不切换 public ID。
+- [~] 原生 G2/G3 仍独立开放：签名 arm64 真机、SAF/权限/重试、force-stop/reopen 与 RSS `<= 256 MiB` 当前 host 仍无法提供。

docs/zh/walkthrough.md

@@ -347,3 +347,11 @@ Release workflow 将打包与验收分离：签名 arm64 APK/AAB 先是 workflow
 实现复用现有 snapshot/replay contract，因此 public ID、projection schema、Bridge 字段与 runtime-first 移动包保持不变。瞬时内存及 JSON clone/restore 延迟会随 graph 增长，原生低内存验收必须使用有界 batch 并记录 RSS。版本化 G4 manifest 与签名 arm64 证据仍是 release 门禁。
 
 当前验证为 148 个 Jest suite / 1,287 passed / 26 skipped、Rust 30 passed / 1 ignored、TypeScript no-emit、122 文件 mobile-low staging、4 host projection replay、8 个 native-recovery scenario、Diataxis 与 `git diff --check`。
+
+## 2026-08-21 第 27 阶段：版本化 G4 identity corpus 回放 Walkthrough
+
+`config/identity-corpus.v1.json` 定义受跟踪的 G4 contract。验证器执行八个生产路径用例：legacy snapshot 原子恢复、同内容隔离、跨 root NFC 规范化、NFC/case collision rejection、move-journal 重启并通过旧 alias 删除、mixed-batch rollback、四 owner 收敛与 upsert alias collision rejection，随后强制执行 Web/Tauri/Capacitor/Android projection replay。
+
+8 个 case 与 4 个 host 全部通过，稳定 result hash 为 `4274a5a2d087875d309fdef9dd4232f5704103b9496ee5524744229bf550b5bb`。报告标记 `host-code-replay` 与 `nativeDeviceEvidence: false`，不代表签名真机、进程死亡或 RSS 通过。Public-ID 迁移仍需独立评审，G2/G3 仍需签名 arm64、SAF/重试/continuity 与 RSS 证据。
+
+最终回归为 149 个 Jest suite / 1,289 passed / 26 skipped；TypeScript no-emit、Rust 30 passed / 1 ignored、mobile-low budget、native recovery、projection replay、Diataxis 与 `git diff --check` 通过。