noteconnection 1.7.0 → 1.9.0

package/dist/src/export/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./types"), exports);
+__exportStar(require("./WorkspaceExportBundle"), exports);

package/dist/src/export/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/src/fixrisk.issue.verifier.contract.test.js

@@ -57,8 +57,10 @@ describe('fixrisk issue verifier contract', () => {
         expect(script).toContain("'FR-013'");
         expect(script).toContain("'FR-014'");
         expect(script).toContain("'FR-015'");
-        expect(script).toContain('actions/setup-java@v5');
+        expect(script).toContain('actions/setup-java@v4');
         expect(script).toContain('java-version');
+        expect(script).toContain('setup-node pins Node 24 baseline');
+        expect(script).toContain('no FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 transition override');
         expect(script).toContain('verify-capacitor-evidence-freshness.js');
         expect(script).toContain('NOTE_CONNECTION_REQUIRE_LARGE_GRAPH_EVIDENCE');
         expect(script).toContain('NOTE_CONNECTION_MIN_EVIDENCE_NODE_COUNT');

package/dist/src/foundation.ann.runtime.contract.test.js

@@ -0,0 +1,81 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+describe('foundation ann runtime verification contract', () => {
+    const repoRoot = path.resolve(__dirname, '..');
+    const packageJsonPath = path.join(repoRoot, 'package.json');
+    const scriptPath = path.join(repoRoot, 'scripts', 'verify-foundation-ann-runtime.js');
+    function readJson(filePath) {
+        const raw = fs.readFileSync(filePath, 'utf8');
+        return JSON.parse(raw);
+    }
+    test('keeps the host-level ann runtime verifier wired in package scripts', () => {
+        const packageJson = readJson(packageJsonPath);
+        expect(packageJson.scripts?.['verify:foundation:ann-runtime']).toBe('npm run build && node scripts/ensure-sidecar-ready.js && node scripts/verify-foundation-ann-runtime.js');
+        expect(packageJson.scripts?.['verify:foundation:ann-runtime:matrix']).toBe('npm run build && node scripts/ensure-sidecar-ready.js && node scripts/verify-foundation-ann-runtime.js --matrix');
+        expect(packageJson.scripts?.['verify:foundation:ann-runtime:release']).toBe('npm run build && node scripts/ensure-sidecar-ready.js && node scripts/verify-foundation-ann-runtime.js --matrix --release-gates');
+    });
+    test('verifier script covers smoke/medium/heavy ann profiles, report evidence, release gates, and restart continuity', () => {
+        const source = fs.readFileSync(scriptPath, 'utf8');
+        expect(source).toContain('WORKLOAD_PROFILES');
+        expect(source).toContain("profileId: 'medium'");
+        expect(source).toContain("profileId: 'heavy'");
+        expect(source).toContain("options.suiteKind = 'matrix'");
+        expect(source).toContain("arg === '--release-gates'");
+        expect(source).toContain('startReferenceAnnService');
+        expect(source).toContain('/sync-index');
+        expect(source).toContain('/select-candidates');
+        expect(source).toContain('dist_node_runtime');
+        expect(source).toContain('packaged_sidecar');
+        expect(source).toContain('/api/knowledge/ingest');
+        expect(source).toContain('/api/knowledge/query');
+        expect(source).toContain('/api/knowledge/query-backend-diagnostics');
+        expect(source).toContain("configuredBackend || '') === 'local_vector'");
+        expect(source).toContain("String(runtime.backendId || '') === 'local-vector-v1'");
+        expect(source).toContain("String(acceleration.mode || '') === 'ann_prefilter'");
+        expect(source).toContain("String(acceleration.adapterId || '') === 'external-http-vector-acceleration-v1'");
+        expect(source).toContain("String(acceleration.representationStatus || '') === 'aligned'");
+        expect(source).toContain('anchorkey');
+        expect(source).toContain('foundation-ann-runtime-report-latest.json');
+        expect(source).toContain('writeStructuredReport');
+        expect(source).toContain('collectScenarioPerformance');
+        expect(source).toContain('buildReleaseGateSummary');
+        expect(source).toContain('minExpectedRecall');
+        expect(source).toContain('maxQueryP95Ms');
+        expect(source).toContain('queryDurationMs');
+    });
+});

package/dist/src/foundation.release.evidence.contract.test.js

@@ -0,0 +1,524 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+describe('foundation release evidence freshness contract', () => {
+    const repoRoot = path.resolve(__dirname, '..');
+    const packageJsonPath = path.join(repoRoot, 'package.json');
+    const scriptPath = path.join(repoRoot, 'scripts', 'verify-foundation-release-evidence.js');
+    const provenance = require('../scripts/foundation-evidence-provenance');
+    const fingerprints = require('../scripts/sidecar-build-fingerprint');
+    let fixtureIdentity;
+    function readJson(filePath) {
+        const raw = fs.readFileSync(filePath, 'utf8');
+        return JSON.parse(raw);
+    }
+    function createTempReportRoot() {
+        const root = fs.mkdtempSync(path.join(os.tmpdir(), 'noteconnection-foundation-release-evidence-'));
+        fs.mkdirSync(path.join(root, 'dist', 'src'), { recursive: true });
+        fs.mkdirSync(path.join(root, 'src-tauri', 'bin'), { recursive: true });
+        fs.writeFileSync(path.join(root, 'dist', 'src', 'server.js'), 'fixture runtime');
+        const sidecar = path.join(root, 'src-tauri', 'bin', 'fixture-sidecar');
+        fs.writeFileSync(sidecar, 'fixture packaged runtime');
+        fixtureIdentity = { ...provenance.readFoundationRuntimeIdentity(root, sidecar), sourceTreeHash: fingerprints.computeSidecarSourceFingerprint(repoRoot).digest };
+        return root;
+    }
+    function writeJson(filePath, value) {
+        fs.mkdirSync(path.dirname(filePath), { recursive: true });
+        const report = structuredClone(value);
+        if (report.profileRuns) {
+            report.host = { nodeVersion: process.version, ...report.host };
+            report.provenance = {
+                schemaVersion: 1, runId: `${report.host.evidenceHostId}-${report.verifiedAt}`,
+                sourceRevision: 'a'.repeat(40), ...fixtureIdentity, workloadHash: provenance.foundationWorkloadHash(report),
+            };
+            for (const profile of report.profileRuns)
+                for (const mode of profile.modes) {
+                    mode.runtime = { ...report.host };
+                    if (mode.soak) {
+                        const provided = new Map(mode.soak.gates.map((gate) => [gate.gateId, gate]));
+                        mode.soak.gates = ['startup_p95', 'startup_max', 'ingest_p95', 'ingest_max', 'readiness_p95', 'diagnostics_p95', 'query_p95', 'query_max'].map(gateId => ({
+                            observedMs: 100, maxAllowedMs: 2500, sampleCount: 8, passed: true, gateId, ...provided.get(gateId),
+                        }));
+                    }
+                    if (mode.releaseGates) {
+                        const provided = new Map(mode.releaseGates.gates.map((gate) => [gate.gateId, gate]));
+                        mode.releaseGates.gates = ['startup_p95', 'ingest_p95', 'diagnostics_p95', 'query_p95', 'query_max', 'expected_recall'].map(gateId => ({
+                            observed: gateId === 'expected_recall' ? 1 : 100, required: gateId === 'expected_recall' ? 1 : 2500,
+                            comparison: gateId === 'expected_recall' ? 'gte' : 'lte', sampleCount: 8, passed: true, gateId, ...provided.get(gateId),
+                        }));
+                    }
+                }
+        }
+        fs.writeFileSync(filePath, `${JSON.stringify(report, null, 2)}\n`, 'utf8');
+    }
+    function buildPassingSqliteReport(verifiedAt, host = { platform: 'win32', arch: 'x64', evidenceHostId: 'windows-ci-a' }) {
+        return {
+            verifiedAt,
+            host,
+            suiteKind: 'soak',
+            soakCycles: 5,
+            profileRuns: [
+                {
+                    workloadProfile: {
+                        profileId: 'heavy',
+                        documentCount: 180,
+                    },
+                    modes: [
+                        {
+                            mode: 'dist_node_runtime',
+                            suiteKind: 'soak',
+                            profileId: 'heavy',
+                            restartCycleCount: 5,
+                            performance: {
+                                queryDurationMs: { count: 8, p95Ms: 120 },
+                            },
+                            soak: {
+                                pass: true,
+                                gates: [
+                                    { gateId: 'startup_p95', passed: true },
+                                    { gateId: 'query_p95', passed: true },
+                                ],
+                            },
+                        },
+                        {
+                            mode: 'packaged_sidecar',
+                            suiteKind: 'soak',
+                            profileId: 'heavy',
+                            restartCycleCount: 5,
+                            performance: {
+                                queryDurationMs: { count: 8, p95Ms: 180 },
+                            },
+                            soak: {
+                                pass: true,
+                                gates: [
+                                    { gateId: 'startup_p95', passed: true },
+                                    { gateId: 'query_p95', passed: true },
+                                ],
+                            },
+                        },
+                    ],
+                },
+            ],
+        };
+    }
+    function buildPassingAnnReport(verifiedAt, host = { platform: 'win32', arch: 'x64', evidenceHostId: 'windows-ci-a' }) {
+        return {
+            verifiedAt,
+            host,
+            suiteKind: 'matrix',
+            releaseGatesEnabled: true,
+            releaseThresholds: {
+                minExpectedRecall: 1,
+            },
+            profileRuns: ['smoke', 'medium', 'heavy'].map((profileId) => ({
+                workloadProfile: {
+                    profileId,
+                    documentCount: profileId === 'heavy' ? 260 : profileId === 'medium' ? 140 : 40,
+                },
+                modes: ['dist_node_runtime', 'packaged_sidecar'].map((mode) => ({
+                    mode,
+                    profileId,
+                    performance: {
+                        queryDurationMs: { count: 8, p95Ms: 240 },
+                    },
+                    expectedRecall: {
+                        expectedQueryCount: 6,
+                        matchedQueryCount: 6,
+                        ratio: 1,
+                    },
+                    releaseGates: {
+                        pass: true,
+                        expectedRecall: {
+                            expectedQueryCount: 6,
+                            matchedQueryCount: 6,
+                            ratio: 1,
+                        },
+                        gates: [
+                            { gateId: 'startup_p95', passed: true },
+                            { gateId: 'query_p95', passed: true },
+                            { gateId: 'expected_recall', passed: true },
+                        ],
+                    },
+                })),
+            })),
+        };
+    }
+    function buildNonReleaseAnnReport(verifiedAt) {
+        return {
+            verifiedAt,
+            suiteKind: 'single',
+            releaseGatesEnabled: false,
+            profileRuns: [
+                {
+                    workloadProfile: {
+                        profileId: 'smoke',
+                        documentCount: 40,
+                    },
+                    modes: [],
+                },
+            ],
+        };
+    }
+    test('keeps the release evidence verifier wired in package scripts and migration contracts', () => {
+        const packageJson = readJson(packageJsonPath);
+        expect(packageJson.scripts?.['verify:foundation:release-evidence']).toBe('node scripts/verify-foundation-release-evidence.js');
+        expect(packageJson.scripts?.['verify:foundation:release-evidence:strict']).toBe('node scripts/verify-foundation-release-evidence.js --min-report-count 3');
+        expect(packageJson.scripts?.['verify:foundation:release-evidence:multi-host']).toBe('node scripts/verify-foundation-release-evidence.js --min-report-count 3 --min-host-count 2');
+        expect(packageJson.scripts?.['test:migration']).toContain('src/foundation.release.evidence.contract.test.ts');
+    });
+    test('verifier script validates latest sqlite soak and ANN release-gate reports with bounded freshness', () => {
+        const source = fs.readFileSync(scriptPath, 'utf8');
+        expect(source).toContain('foundation-sqlite-runtime-report-latest.json');
+        expect(source).toContain('foundation-ann-runtime-report-latest.json');
+        expect(source).toContain('foundation-release-evidence-report-latest.json');
+        expect(source).toContain('NOTE_CONNECTION_FOUNDATION_RELEASE_EVIDENCE_MAX_AGE_HOURS');
+        expect(source).toContain('NOTE_CONNECTION_FOUNDATION_RELEASE_EVIDENCE_MIN_REPORT_COUNT');
+        expect(source).toContain('NOTE_CONNECTION_FOUNDATION_RELEASE_EVIDENCE_MIN_HOST_COUNT');
+        expect(source).toContain('--min-report-count');
+        expect(source).toContain('--min-host-count');
+        expect(source).toContain('foundation-sqlite-runtime-report-');
+        expect(source).toContain('foundation-ann-runtime-report-');
+        expect(source).toContain('verify:foundation:sqlite-runtime:release');
+        expect(source).toContain('verify:foundation:ann-runtime:release');
+        expect(source).toContain("suiteKind === 'soak'");
+        expect(source).toContain("suiteKind === 'matrix'");
+        expect(source).toContain('releaseGatesEnabled');
+        expect(source).toContain('expectedRecall');
+        expect(source).toContain('minimumReportCount');
+        expect(source).toContain('minimumHostCount');
+        expect(source).toContain('dist_node_runtime');
+        expect(source).toContain('packaged_sidecar');
+    });
+    test('bounded integer parsing uses defaults for missing environment values', () => {
+        const verifier = require(scriptPath);
+        expect(verifier.parseBoundedInteger('', { min: 1, max: 10, default: 7 })).toBe(7);
+        expect(verifier.parseBoundedInteger(undefined, { min: 1, max: 10, default: 7 })).toBe(7);
+    });
+    test('accepts fresh passing sqlite soak and ANN release-gate reports', () => {
+        const verifier = require(scriptPath);
+        const tempRoot = createTempReportRoot();
+        const sqliteReportPath = path.join(tempRoot, 'foundation-sqlite-runtime-report-latest.json');
+        const annReportPath = path.join(tempRoot, 'foundation-ann-runtime-report-latest.json');
+        const now = new Date('2026-06-06T00:00:00.000Z');
+        try {
+            writeJson(sqliteReportPath, buildPassingSqliteReport('2026-06-05T23:00:00.000Z'));
+            writeJson(annReportPath, buildPassingAnnReport('2026-06-05T22:00:00.000Z'));
+            const result = verifier.verifyFoundationReleaseEvidence({ artifactRoot: tempRoot,
+                sqliteReportPath,
+                annReportPath,
+                now,
+                maxAgeHours: 24,
+            });
+            expect(result.ok).toBe(true);
+            expect(result.errors).toEqual([]);
+            expect(result.summary.sqlite).toMatchObject({
+                suiteKind: 'soak',
+                requiredProfiles: ['heavy'],
+            });
+            expect(result.summary.ann).toMatchObject({
+                suiteKind: 'matrix',
+                requiredProfiles: ['smoke', 'medium', 'heavy'],
+            });
+        }
+        finally {
+            fs.rmSync(tempRoot, { recursive: true, force: true });
+        }
+    });
+    test('rejects stale release evidence even when runtime gates passed', () => {
+        const verifier = require(scriptPath);
+        const tempRoot = createTempReportRoot();
+        const sqliteReportPath = path.join(tempRoot, 'foundation-sqlite-runtime-report-latest.json');
+        const annReportPath = path.join(tempRoot, 'foundation-ann-runtime-report-latest.json');
+        const now = new Date('2026-06-06T00:00:00.000Z');
+        try {
+            writeJson(sqliteReportPath, buildPassingSqliteReport('2026-06-01T00:00:00.000Z'));
+            writeJson(annReportPath, buildPassingAnnReport('2026-06-05T22:00:00.000Z'));
+            const result = verifier.verifyFoundationReleaseEvidence({ artifactRoot: tempRoot,
+                sqliteReportPath,
+                annReportPath,
+                now,
+                maxAgeHours: 24,
+            });
+            expect(result.ok).toBe(false);
+            expect(result.errors.join('\n')).toContain('sqlite release evidence is stale');
+        }
+        finally {
+            fs.rmSync(tempRoot, { recursive: true, force: true });
+        }
+    });
+    test('a later matrix run does not hide a fresh dated SQLite soak', () => {
+        const verifier = require(scriptPath);
+        const tempRoot = createTempReportRoot();
+        const sqliteReportPath = path.join(tempRoot, 'foundation-sqlite-runtime-report-latest.json');
+        const annReportPath = path.join(tempRoot, 'foundation-ann-runtime-report-latest.json');
+        try {
+            writeJson(sqliteReportPath, { ...buildPassingSqliteReport('2026-06-05T23:30:00.000Z'), suiteKind: 'matrix' });
+            writeJson(path.join(tempRoot, 'foundation-sqlite-runtime-report-2026-06-05T23-00-00.json'), buildPassingSqliteReport('2026-06-05T23:00:00.000Z'));
+            writeJson(annReportPath, buildPassingAnnReport('2026-06-05T23:00:00.000Z'));
+            const result = verifier.verifyFoundationReleaseEvidence({ artifactRoot: tempRoot, sqliteReportPath, annReportPath, now: new Date('2026-06-06T00:00:00Z') });
+            expect(result.ok).toBe(true);
+            expect(result.summary.sqlite.reportPath).toContain('2026-06-05T23-00-00');
+        }
+        finally {
+            fs.rmSync(tempRoot, { recursive: true, force: true });
+        }
+    });
+    test('latest and dated copies of one run do not count as repeated evidence', () => {
+        const verifier = require(scriptPath);
+        const tempRoot = createTempReportRoot();
+        const sqliteReportPath = path.join(tempRoot, 'foundation-sqlite-runtime-report-latest.json');
+        const annReportPath = path.join(tempRoot, 'foundation-ann-runtime-report-latest.json');
+        try {
+            const sqlite = buildPassingSqliteReport('2026-06-05T23:00:00.000Z');
+            const ann = buildPassingAnnReport('2026-06-05T23:00:00.000Z');
+            writeJson(sqliteReportPath, sqlite);
+            writeJson(annReportPath, ann);
+            writeJson(path.join(tempRoot, 'foundation-sqlite-runtime-report-copy.json'), sqlite);
+            writeJson(path.join(tempRoot, 'foundation-ann-runtime-report-copy.json'), ann);
+            const result = verifier.verifyFoundationReleaseEvidence({ artifactRoot: tempRoot, sqliteReportPath, annReportPath, minReportCount: 2, now: new Date('2026-06-06T00:00:00Z') });
+            expect(result.ok).toBe(false);
+            expect(result.summary.sqlite.reportCount).toBe(1);
+            expect(result.summary.ann.reportCount).toBe(1);
+        }
+        finally {
+            fs.rmSync(tempRoot, { recursive: true, force: true });
+        }
+    });
+    test.each([
+        ['missing provenance', (report) => { delete report.provenance; }],
+        ['wrong source', (report) => { report.provenance.sourceTreeHash = 'f'.repeat(64); }],
+        ['wrong artifact', (report) => { report.provenance.artifacts.packaged_sidecar.sha256 = 'f'.repeat(64); }],
+        ['changed workload', (report) => { report.profileRuns[0].workloadProfile.documentCount++; }],
+        ['unsupported runtime', (report) => { report.profileRuns[0].modes[0].runtime.nodeVersion = 'v20.19.0'; }],
+        ['future report', (report) => { report.verifiedAt = '2026-06-07T00:00:00Z'; }],
+        ['missing gate', (report) => { report.profileRuns[0].modes[0].soak.gates.pop(); }],
+        ['unsubstantiated pass', (report) => { report.profileRuns[0].modes[0].soak.gates[0].observedMs = 999999; }],
+    ])('rejects %s even if the report declares passing gates', (_name, mutate) => {
+        const verifier = require(scriptPath);
+        const tempRoot = createTempReportRoot();
+        const sqliteReportPath = path.join(tempRoot, 'foundation-sqlite-runtime-report-latest.json');
+        const annReportPath = path.join(tempRoot, 'foundation-ann-runtime-report-latest.json');
+        try {
+            writeJson(sqliteReportPath, buildPassingSqliteReport('2026-06-05T23:00:00Z'));
+            writeJson(annReportPath, buildPassingAnnReport('2026-06-05T23:00:00Z'));
+            const report = readJson(sqliteReportPath);
+            mutate(report);
+            fs.writeFileSync(sqliteReportPath, JSON.stringify(report));
+            const result = verifier.verifyFoundationReleaseEvidence({ artifactRoot: tempRoot, sqliteReportPath, annReportPath, now: new Date('2026-06-06T00:00:00Z') });
+            expect(result.ok).toBe(false);
+            expect(result.errors.length).toBeGreaterThan(0);
+        }
+        finally {
+            fs.rmSync(tempRoot, { recursive: true, force: true });
+        }
+    });
+    test('an eligible recent failure is not masked by an older passing soak', () => {
+        const verifier = require(scriptPath);
+        const tempRoot = createTempReportRoot();
+        const sqliteReportPath = path.join(tempRoot, 'foundation-sqlite-runtime-report-latest.json');
+        const annReportPath = path.join(tempRoot, 'foundation-ann-runtime-report-latest.json');
+        try {
+            const failed = buildPassingSqliteReport('2026-06-05T23:30:00.000Z');
+            failed.profileRuns[0].modes[0].soak.pass = false;
+            writeJson(sqliteReportPath, failed);
+            writeJson(path.join(tempRoot, 'foundation-sqlite-runtime-report-earlier.json'), buildPassingSqliteReport('2026-06-05T23:00:00.000Z'));
+            writeJson(annReportPath, buildPassingAnnReport('2026-06-05T23:00:00.000Z'));
+            expect(verifier.verifyFoundationReleaseEvidence({ artifactRoot: tempRoot, sqliteReportPath, annReportPath, now: new Date('2026-06-06T00:00:00Z') }).ok).toBe(false);
+        }
+        finally {
+            fs.rmSync(tempRoot, { recursive: true, force: true });
+        }
+    });
+    test('accepts repeated sqlite and ANN release evidence when enough fresh history reports exist', () => {
+        const verifier = require(scriptPath);
+        const tempRoot = createTempReportRoot();
+        const sqliteReportPath = path.join(tempRoot, 'sqlite', 'foundation-sqlite-runtime-report-latest.json');
+        const annReportPath = path.join(tempRoot, 'ann', 'foundation-ann-runtime-report-latest.json');
+        const now = new Date('2026-06-06T00:00:00.000Z');
+        try {
+            writeJson(sqliteReportPath, buildPassingSqliteReport('2026-06-05T23:00:00.000Z'));
+            writeJson(path.join(tempRoot, 'sqlite', 'foundation-sqlite-runtime-report-2026-06-05T22-30-00-000Z.json'), buildPassingSqliteReport('2026-06-05T22:30:00.000Z'));
+            writeJson(annReportPath, buildPassingAnnReport('2026-06-05T22:00:00.000Z'));
+            writeJson(path.join(tempRoot, 'ann', 'foundation-ann-runtime-report-2026-06-05T21-30-00-000Z.json'), buildPassingAnnReport('2026-06-05T21:30:00.000Z'));
+            const result = verifier.verifyFoundationReleaseEvidence({ artifactRoot: tempRoot,
+                sqliteReportPath,
+                annReportPath,
+                now,
+                maxAgeHours: 24,
+                minReportCount: 2,
+            });
+            expect(result.ok).toBe(true);
+            expect(result.errors).toEqual([]);
+            expect(result.summary.sqlite).toMatchObject({
+                minimumReportCount: 2,
+                reportCount: 2,
+            });
+            expect(result.summary.ann).toMatchObject({
+                minimumReportCount: 2,
+                reportCount: 2,
+            });
+        }
+        finally {
+            fs.rmSync(tempRoot, { recursive: true, force: true });
+        }
+    });
+    test('accepts multi-host release evidence when enough fresh reports cover distinct hosts', () => {
+        const verifier = require(scriptPath);
+        const tempRoot = createTempReportRoot();
+        const sqliteReportPath = path.join(tempRoot, 'sqlite', 'foundation-sqlite-runtime-report-latest.json');
+        const annReportPath = path.join(tempRoot, 'ann', 'foundation-ann-runtime-report-latest.json');
+        const windowsHost = { platform: 'win32', arch: 'x64', evidenceHostId: 'windows-ci-a' };
+        const linuxHost = { platform: 'linux', arch: 'x64', evidenceHostId: 'linux-ci-b' };
+        const now = new Date('2026-06-06T00:00:00.000Z');
+        try {
+            writeJson(sqliteReportPath, buildPassingSqliteReport('2026-06-05T23:00:00.000Z', windowsHost));
+            writeJson(path.join(tempRoot, 'sqlite', 'foundation-sqlite-runtime-report-2026-06-05T22-30-00-000Z.json'), buildPassingSqliteReport('2026-06-05T22:30:00.000Z', linuxHost));
+            writeJson(annReportPath, buildPassingAnnReport('2026-06-05T22:00:00.000Z', windowsHost));
+            writeJson(path.join(tempRoot, 'ann', 'foundation-ann-runtime-report-2026-06-05T21-30-00-000Z.json'), buildPassingAnnReport('2026-06-05T21:30:00.000Z', linuxHost));
+            const result = verifier.verifyFoundationReleaseEvidence({ artifactRoot: tempRoot,
+                sqliteReportPath,
+                annReportPath,
+                now,
+                maxAgeHours: 24,
+                minReportCount: 2,
+                minHostCount: 2,
+            });
+            expect(result.ok).toBe(true);
+            expect(result.errors).toEqual([]);
+            expect(result.summary.sqlite).toMatchObject({
+                minimumReportCount: 2,
+                reportCount: 2,
+                minimumHostCount: 2,
+                hostCount: 2,
+            });
+            expect(result.summary.ann).toMatchObject({
+                minimumReportCount: 2,
+                reportCount: 2,
+                minimumHostCount: 2,
+                hostCount: 2,
+            });
+        }
+        finally {
+            fs.rmSync(tempRoot, { recursive: true, force: true });
+        }
+    });
+    test('rejects multi-host release evidence when repeated reports come from one host', () => {
+        const verifier = require(scriptPath);
+        const tempRoot = createTempReportRoot();
+        const sqliteReportPath = path.join(tempRoot, 'sqlite', 'foundation-sqlite-runtime-report-latest.json');
+        const annReportPath = path.join(tempRoot, 'ann', 'foundation-ann-runtime-report-latest.json');
+        const windowsHost = { platform: 'win32', arch: 'x64', evidenceHostId: 'windows-ci-a' };
+        const now = new Date('2026-06-06T00:00:00.000Z');
+        try {
+            writeJson(sqliteReportPath, buildPassingSqliteReport('2026-06-05T23:00:00.000Z', windowsHost));
+            writeJson(path.join(tempRoot, 'sqlite', 'foundation-sqlite-runtime-report-2026-06-05T22-30-00-000Z.json'), buildPassingSqliteReport('2026-06-05T22:30:00.000Z', windowsHost));
+            writeJson(annReportPath, buildPassingAnnReport('2026-06-05T22:00:00.000Z', windowsHost));
+            writeJson(path.join(tempRoot, 'ann', 'foundation-ann-runtime-report-2026-06-05T21-30-00-000Z.json'), buildPassingAnnReport('2026-06-05T21:30:00.000Z', windowsHost));
+            const result = verifier.verifyFoundationReleaseEvidence({ artifactRoot: tempRoot,
+                sqliteReportPath,
+                annReportPath,
+                now,
+                maxAgeHours: 24,
+                minReportCount: 2,
+                minHostCount: 2,
+            });
+            expect(result.ok).toBe(false);
+            expect(result.errors.join('\n')).toContain('sqlite release evidence history covers 1 host(s), expected at least 2');
+            expect(result.errors.join('\n')).toContain('ann release evidence history covers 1 host(s), expected at least 2');
+        }
+        finally {
+            fs.rmSync(tempRoot, { recursive: true, force: true });
+        }
+    });
+    test('rejects strict repeated evidence when only latest reports exist', () => {
+        const verifier = require(scriptPath);
+        const tempRoot = createTempReportRoot();
+        const sqliteReportPath = path.join(tempRoot, 'sqlite', 'foundation-sqlite-runtime-report-latest.json');
+        const annReportPath = path.join(tempRoot, 'ann', 'foundation-ann-runtime-report-latest.json');
+        const now = new Date('2026-06-06T00:00:00.000Z');
+        try {
+            writeJson(sqliteReportPath, buildPassingSqliteReport('2026-06-05T23:00:00.000Z'));
+            writeJson(annReportPath, buildPassingAnnReport('2026-06-05T22:00:00.000Z'));
+            const result = verifier.verifyFoundationReleaseEvidence({ artifactRoot: tempRoot,
+                sqliteReportPath,
+                annReportPath,
+                now,
+                maxAgeHours: 24,
+                minReportCount: 2,
+            });
+            expect(result.ok).toBe(false);
+            expect(result.errors.join('\n')).toContain('sqlite release evidence history has 1 report(s), expected at least 2');
+            expect(result.errors.join('\n')).toContain('ann release evidence history has 1 report(s), expected at least 2');
+        }
+        finally {
+            fs.rmSync(tempRoot, { recursive: true, force: true });
+        }
+    });
+    test('does not fail default freshness verification because older non-release history reports exist', () => {
+        const verifier = require(scriptPath);
+        const tempRoot = createTempReportRoot();
+        const sqliteReportPath = path.join(tempRoot, 'sqlite', 'foundation-sqlite-runtime-report-latest.json');
+        const annReportPath = path.join(tempRoot, 'ann', 'foundation-ann-runtime-report-latest.json');
+        const now = new Date('2026-06-06T00:00:00.000Z');
+        try {
+            writeJson(sqliteReportPath, buildPassingSqliteReport('2026-06-05T23:00:00.000Z'));
+            writeJson(path.join(tempRoot, 'sqlite', 'foundation-sqlite-runtime-report-2026-05-30T00-00-00-000Z.json'), buildPassingSqliteReport('2026-05-30T00:00:00.000Z'));
+            writeJson(annReportPath, buildPassingAnnReport('2026-06-05T22:00:00.000Z'));
+            writeJson(path.join(tempRoot, 'ann', 'foundation-ann-runtime-report-2026-06-05T21-00-00-000Z.json'), buildNonReleaseAnnReport('2026-06-05T21:00:00.000Z'));
+            const result = verifier.verifyFoundationReleaseEvidence({ artifactRoot: tempRoot,
+                sqliteReportPath,
+                annReportPath,
+                now,
+                maxAgeHours: 24,
+            });
+            expect(result.ok).toBe(true);
+            expect(result.summary.sqlite).toMatchObject({
+                minimumReportCount: 1,
+                reportCount: 1,
+            });
+            expect(result.summary.ann).toMatchObject({
+                minimumReportCount: 1,
+                reportCount: 1,
+            });
+            expect(result.warnings.join('\n')).toContain('ann release evidence history report ignored');
+        }
+        finally {
+            fs.rmSync(tempRoot, { recursive: true, force: true });
+        }
+    });
+});