[knqiufan]

Which issue or RFC does this PR close?

Related issue: #2115 — managed local runtime bootstrap (database admission follow-up to #2203).

This PR completes the existing-database admission integration: compatible storage can start through the verified target Server; changed or incompatible storage is rejected without migration or source writes. The broader #2115 remains open: clean Windows/macOS bootstrap using published, qualified resources and installed acceptance remain outstanding. Keep #2115 open until that evidence is linked.

Parent: #2114. Contract: RFC #1733. Resource production: #2288 / #2112. Desktop native bridge: #2289 / #2116.

Rationale for this change

Managed installation can initialize a new SQLite database, but subsequent start/restart currently rejects every existing database as unknown. This change admits an existing database only when the verified target Server can establish complete compatibility, without migrating or modifying the source database.

What changes are included in this PR?

• Add a bounded private snapshot admission path using the installed target Server's schema, domain, configuration, history and recovery checks.
• Preserve committed WAL content while keeping SQLite connections away from the original database and its sidecars.
• Bind approved starts to the resource identity and database evidence, and reject changed, incomplete or incompatible state.
• Keep passive inspection and same-version program repair independent from expensive admission and preserve data and explicit-stop state.
• Document limits and add real SQLite / child-process regression coverage.
• Update the persistence compatibility review digest without changing the upgrade-required policy or acceptance matrix.

Are there any user-facing changes?

Compatible existing managed SQLite storage can be started again. Normal writes invalidate an approved plan: for a busy database, stop the service, obtain a fresh start plan after writes stop, and approve it. Rejected restart plans leave the running service unchanged. Unsupported storage requires explicit maintenance; no automatic migration, data deletion or runtime upgrade is introduced. This does not complete resource publication or installed-platform acceptance for #2115.

How was this change tested?

Integrated current master 0a98473a, including the corrected MySQL-vector admission fixture accepting allow_missing_database and the repository's consolidated CI configuration. Preserve master's full persistence rationale, upgrade-required policy and acceptance matrix; append managed admission and recompute the exact combined digest. The six managed-admission runtime files are unchanged by this integration.

• The previous four Python 3.11–3.14 unit jobs all failed the same three fixture cases with unexpected keyword argument 'allow_missing_database'. The existing three cases now pass without changing their read-only or checksum/profile assertions.
• Combined admission/Ops/installer/startup/repair/MySQL-vector tests: 152 passed, 1 platform skip.
• Persistence regression expansion: uv run --no-sync pytest tests/builtin/persistence tests/test_ops_database_admission.py -q -n 3: 828 passed, 116 external-backend skips.
• Full Linux-target ty check, file pre-commit lint/format checks and git diff --check pass. Release/API generation, upgrade policy and workflow pins pass. Native macOS full make check retains one inherited Linux-only socket.SO_PEERCRED diagnostic; Linux CI is checked separately.
• The earlier Code-publication fixture correction is retained. Existing module coverage passed 15 tests; production database behavior is unchanged.
• Tests execute actual SQLite and target subprocesses; MySQL reflection and managed services are modeled. These are not installed-platform or external-backend acceptance.

Validation host: macOS arm64, Python 3.12.15. Updated cloud core validation passes: Python 3.11 and 3.14 full unit jobs and Python 3.12 E2E all succeed. Native integration/resource builds continue; no complete-workflow pass is claimed yet.

AI usage statement

OpenAI Codex assisted with implementation, conflict resolution, local review and validation. Earlier feature review used the Open Code Review CLI and its delegate workflow.

[hidb4ai]

Reviewed 6e2d3ec. No blocking findings. The target-owned snapshot admission reuses complete Server compatibility checks and preserves explicit migration and recovery boundaries. No database tables, schema revisions, or public HTTP/MCP endpoints are added. Native installation acceptance with published resources remains separate work under #2115.

[hidb4ai]

The current head (0803ed7) cannot merge with current master (838f726): git merge-tree --write-tree --name-only 838f726c 0803ed7e reports a content conflict in release/upgrade-support.json. Please sync master, preserve both the managed SQLite admission review and master's database-selection/recovery review, and regenerate schema_review.persistence_sha256 from the reconciled tree rather than retaining either side's digest. Please rerun the upgrade-policy check and required CI on the updated head. The current green CI does not cover that reconciled tree.

[hidb4ai]

@knqiufan Follow-up: the PR head is still 0803ed7e, and the merge blocker remains against current master 90355b8e. Rechecking with git merge-tree --write-tree --name-only 90355b8e 0803ed7e reproduces the content conflict in release/upgrade-support.json. Please sync master, preserve both sets of persistence review rationale, regenerate the persistence digest from the reconciled tree, and rerun the upgrade-policy check and required CI. Please push the updated head so the resolved merge can be reviewed; the existing green CI does not validate that merged tree.

[hireview001]

• Resolve merge conflicts with the target branch.

[hidb4ai]

Reviewed 4d7e3d8. No blocking findings. The branch merges cleanly with current master, retains the complete persistence review rationale, and passes the recomputed persistence-digest gate. Target-owned snapshot admission preserves explicit migration and recovery boundaries without adding database tables, schema revisions, or public HTTP/MCP endpoints. Qualified resource publication and installed-platform acceptance remain separate work under #2115.