feat(assistant): add traceable evidence and recoverable watch alerts

[TNT-Likely]

Background

Watch requests need trustworthy source times, complete alert conditions, reviewable approvals, and evidence that corresponds to the actual production task. The earlier acceptance summary did not clearly distinguish a successful safety rejection from a fulfilled alert request. Broader review also found parsing gaps, local metadata being treated as undated external evidence, and missing details in the first live approval card.

Changes

• Preserve source time separately from retrieval time, including quote freshness, trading date, session state and provider snapshot semantics. Local capability, calendar and configuration reads use query-snapshot labels; external quotes, announcements, archived research and mixed portfolio valuation retain source-time checks.
• Preserve the original watch request and relative expiry. Check ordinary close/consecutive-session expressions, explicit instrument identity, condition connectors and scope; reject unsupported mixed AND/OR logic and unsupported stateful conditions before writes. Older approval checkpoints are rechecked without moving their saved expiry. Explicit whole-turn retries resolve the preceding user request before context compression, retain its target/conditions/original expiry, and stop at a newer user topic. Unresolved references require clarification rather than treating an empty parse as supported; older retry and approval paths are rechecked.
• Carry complete AND/OR rules, expiry, channels, cooldown, daily trigger quota, repeat mode and session mode through approval, persistence and readback. Durable approval events now include the stored human-readable presentation; live events, legacy SSE and snapshots mark SQLite UTC expiry correctly. Loading and approval labels no longer claim failure or completed execution. Approval reconnection starts after the already consumed pause cursor, so an accepted POST with an empty/dropped response cannot replay the old pause as a new wait state.
• Register read-only watchlist, scoped research history, announcement/full-content and monitoring tools. Preserve canonical nested diagnosis calls and source-linked judgments.
• Persist price-alert checks and per-channel outbox deliveries, with bounded retries, leases, manual retry and recovery of durable pending deliveries. Trigger quota and channel acceptance are reported with their actual meanings.
• Expand the default live runtime evaluator to ten cases and separate functional, guardrail and cancellation outcomes. Project-level delivery skills now require explicit business-goal outcomes, retained failures and a service lifecycle independent of a temporary terminal.

Validation

• Current isolated backend regression at 3d1e7ca: 402 passed, with 13 existing warnings, including explicit retries, repeated retries, original expiry, topic boundaries, compression, policy rejection and old approval revalidation. Earlier 392-test evidence retains its original source/run identity.
• Frontend checks at fd533666: pnpm check:ui, pnpm check:i18n, pnpm check:market-colors, pnpm run test --run (230 passed, including empty/dropped approval responses) and pnpm build passed. Local runtime was Node 24.19.0 / pnpm 9.15.9; CI uses the repository pin.
• Current exported frontend/base-ui sources match that 230-test snapshot; a fresh frozen-lockfile install, production build and sealed artifact at 3d1e7ca passed, with the same artifact hash. The 230-test suite was reused by source identity, not reported as newly executed.
• Isolation helper tests: 15 passed; project skill installer tests: 12 passed; project installation check passed. No global skill installation was changed.
• Actual glm-5.3-flash runtime execution at db6daf4: all ten listed automatic cases passed (eleven requests), including AND/OR approval and DB readback, rejection, unsupported conditions, monitoring, research history, real announcement content and nested diagnosis. These are finite assertions, not proof of every answer's correctness. Final approval-event changes and frontend labels were separately exercised through a fresh real-model UI task at fd533666; source/version reuse is documented locally.
• Supported-rule UI at fd533666: first approval displayed every requested field and the local deadline; no rule existed before approval. After approval, the page reached completed automatically without reload or navigation, and exactly one rule (加一个美国夜盘和长桥那边的信息？ #9) matched all approved parameters in task 能否优化 ai 添加模型逻辑 #11 at fd533666 (run b1a0e22c-d359-4d6d-8f81-2efce5247aa8). The same QA database, credentials and completed objects survived an owned-service restart; authenticated API and page reload were checked.
• Latest real UI/model retry at 3d1e7ca, run b4de4823-3953-42e3-83a7-5c083285d0b3, task 能否单独设置图像 模型 #13: host snapshot correctly retained the original CN:600519 request and all three unsupported conditions, with zero rule writes and approvals. Fresh live capability-check acceptance failed: the model answered from historical context without calling any tool, leaving structured evidence empty. No claim of a fresh check or fulfilled C15 alert is made. A same-data restart preserved completed tasks, rules and credentials; authenticated API and actual page reload passed.
• git diff --check passed. Current-head CI validate, smoke (ubuntu-latest) and smoke (ubuntu-24.04-arm) all passed; results are recorded in the local report and PR checks.
• Failures remain recorded: earlier QA driver stock joins/UTC comparisons, the diagnosis timeout, false local-time warnings, quote narrative claims, initial approval presentation/UTC display, isolation-baseline refusal, the temporary restart verifier refusing an incorrect child-command expectation before any mutation, stale approval-copy/cursor-arity test expectations, and an earlier UI staying at awaiting approval after DB completion. The final UI reproduced the approval flow and reached completion without refresh. Later passes do not rewrite those receipts.

Boundaries and risks

Overall business acceptance is not complete. The latest retry skipped a fresh capability-tool call even though host planning and write guards passed their contracts; this live-path failure remains open. Manual sentence review still found an unsupported “last market / frozen quote feed” inference in the quote answer, despite correct tool fields and explicit snapshot limits. The narrow automated wording check missed this paraphrase; its PASS does not override the manual FAIL. A previous real diagnosis also hit the 120-second tool timeout; a later successful run does not establish reliable latency for larger portfolios or other models.

Confirmed close, moving averages, consecutive sessions and stateful crossings remain unimplemented (C15); the user explicitly deferred this feature, and no C15 implementation is included. Their guardrail PASS means no substitute rule was created, not that the requested alert exists. Persistent research tasks (C08) and hard AI-spend budgets (C18) are also outside this change; the implemented daily quota counts alert triggers.

Notification tests use synthetic QA data and an owned loopback Bark-compatible receiver. They do not establish delivery to a real Feishu/Telegram/phone recipient or human readership. Delivery is at least once and can duplicate after external acceptance but before receipt persistence. Original controlled 503/crash tests retain their original source/run identity; unchanged monitoring code was compared, not presented as a new fault exercise.

Current UI observations are at the browser's actual 1280×720 size, with light/dark, keyboard and scrolling checks. The advertised viewport override did not change actual dimensions, so this audit does not claim a new 390px or physical-device pass. Natural-language parsing and announcement coverage remain bounded. Completed-task persistence is not running-task resume, and client SSE disconnection is not a server network outage.

The consolidated local handoff HTML/ZIP includes the latest status/evidence at 3d1e7ca and the intact earlier full audit at fd533666; earlier live-model results and failures keep their original identities. The offline HTML/ZIP and detailed evidence are delivered locally only. Extracted files, hashes and relative assets/links passed validation. The browser rejected file-URL navigation, so report visual rendering is explicitly unexecuted; no workaround was used. No credentials, databases, raw logs or browser storage are attached to this PR; no merge, deployment or release was performed.

Follow-up

• Ensure explicit retries actually recheck capabilities through the live tool path.
• Ground quote narrative claims and extend semantic evaluation beyond narrow wording matches.
• Address diagnosis latency and preservation of partial results at the timeout boundary.
• C15 is deferred at the user's request; persistent research and hard AI-spend budgets also remain separate future work.
• Complete current narrow-screen/device and real-recipient acceptance before claiming those layers.