feat(kernel): finish phase3 bridge cutover and phase4 tree projection

- add generic mnote-web query transport and bridge routes for workspace/request/trace

- route sidebar compat traffic through mnote-web and tighten fixture fallback to dev/test

- unify sidebar/page tree/file tree/picker consumers on page_tree projection

- sync phase3/phase4 checklist, breakdown docs, and harness progress state

rust/crates/mnote-web/src/routes/kernel.rs

@@ -1,18 +1,16 @@
 use crate::app::{AppConfig, AppState};
 use crate::context::RequestContext;
 use crate::error::WebError;
-use crate::transport::convex::execute_sidebar_dataset_query;
+use crate::routes::query_support::{
+    execute_runtime_query_against_data, fetch_query_data_via_convex, resolve_effective_workspace_id,
+};
 use axum::extract::{Extension, Query, State};
 use axum::http::StatusCode;
 use axum::Json;
-use bridge_runtime::{
-    execute_runtime_input, execute_runtime_query, RuntimeActorWire, RuntimeBridgeContextWire,
-    RuntimeExecutionPlan, RuntimeInput, RuntimeQueryEnvelopeWire, RuntimeSourceWire,
-};
+use bridge_runtime::RuntimeQueryEnvelopeWire;
 use core_protocol::{KernelGraphDirection, KernelNodeType, KernelProjectionKind};
 use serde::Deserialize;
 use serde_json::{json, Value};
-use std::env;
 
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
@@ -45,86 +43,47 @@ pub struct KernelGraphQuery {
     pub max_depth: Option<u32>,
 }
 
-fn runtime_context(context: &RequestContext) -> RuntimeBridgeContextWire {
-    RuntimeBridgeContextWire {
-        deployment_id: context.workspace.deployment_id.clone(),
-        project_id: context.workspace.project_id.clone(),
-        workspace_id: context.workspace.workspace_id.clone(),
-        request_id: context.trace.request_id.clone(),
-        trace_id: context.trace.trace_id.clone(),
-        actor: RuntimeActorWire {
-            actor_type: context.auth.actor_type.clone(),
-            actor_id: context.auth.actor_id.clone(),
-            session_id: context.auth.session_id.clone(),
-        },
-        source: RuntimeSourceWire {
-            channel: context.source.channel.clone(),
-            client: context.source.client.clone(),
-        },
-        tenant_id: context.workspace.tenant_id.clone(),
-        auth_token: context.auth.authorization.clone(),
-        idempotency_key: context.source.idempotency_key.clone(),
-        validate_only: false,
-        dry_run: false,
+fn sidebar_dataset_query(workspace_id: &str) -> RuntimeQueryEnvelopeWire {
+    RuntimeQueryEnvelopeWire {
+        name: "sidebar.dataset.list".into(),
+        payload: json!({
+            "workspaceId": workspace_id,
+        }),
     }
 }
 
-fn build_sidebar_dataset_plan(
-    config: &AppConfig,
-    context: &RequestContext,
-    workspace_id: &str,
-) -> Result<Value, WebError> {
-    let runtime_input = RuntimeInput::Query {
-        context: runtime_context(context),
-        query: RuntimeQueryEnvelopeWire {
-            name: "sidebar.dataset.list".into(),
-            payload: json!({
-                "workspaceId": workspace_id,
-            }),
-        },
-        data: None,
-    };
-    let RuntimeExecutionPlan::Query(plan) = execute_runtime_input(runtime_input)
-        .map_err(|error| WebError::bad_request(error.message).with_context(context))?
-    else {
-        return Err(WebError::internal("sidebar.dataset.list 未返回 query plan").with_context(context));
-    };
-
-    let dataset = execute_sidebar_dataset_query(config, &plan)?;
-    Ok(dataset)
-}
-
 fn load_sidebar_dataset(
     config: &AppConfig,
     context: &RequestContext,
-    workspace_id: Option<&str>,
+    workspace_id: &str,
 ) -> Result<Value, WebError> {
-    if let Ok(raw) = env::var("MNOTE_WEB_KERNEL_SIDEBAR_FIXTURE_JSON") {
-        let trimmed = raw.trim();
-        if !trimmed.is_empty() {
-            return serde_json::from_str(trimmed).map_err(|error| {
-                WebError::internal(format!("kernel fixture JSON 非法: {error}")).with_context(context)
-            });
-        }
-    }
-
-    let workspace_id = workspace_id
-        .or(context.workspace.workspace_id.as_deref())
-        .unwrap_or("ws_demo");
-    build_sidebar_dataset_plan(config, context, workspace_id)
+    fetch_query_data_via_convex(
+        config,
+        context,
+        Some(workspace_id),
+        sidebar_dataset_query(workspace_id),
+    )
 }
 
 fn execute_kernel_query(
     context: &RequestContext,
+    workspace_id: &str,
     query: RuntimeQueryEnvelopeWire,
     dataset: Value,
 ) -> Result<Value, WebError> {
-    execute_runtime_query(RuntimeInput::Query {
-        context: runtime_context(context),
-        query,
-        data: Some(dataset),
-    })
-    .map_err(|error| WebError::bad_request(error.message).with_context(context))
+    execute_runtime_query_against_data(context, Some(workspace_id), query, dataset)
+}
+
+fn ok_response(context: &RequestContext, result: Value) -> (StatusCode, Json<Value>) {
+    (
+        StatusCode::OK,
+        Json(json!({
+            "ok": true,
+            "requestId": context.trace.request_id,
+            "traceId": context.trace.trace_id,
+            "result": result,
+        })),
+    )
 }
 
 pub async fn project_sidebar(
@@ -132,14 +91,18 @@ pub async fn project_sidebar(
     Extension(context): Extension<RequestContext>,
     Query(query): Query<KernelProjectionQuery>,
 ) -> Result<(StatusCode, Json<Value>), WebError> {
-    let dataset = load_sidebar_dataset(state.config(), &context, query.workspace_id.as_deref())?;
+    let effective_workspace_id =
+        resolve_effective_workspace_id(&context, query.workspace_id.as_deref(), true)?
+            .expect("workspace_required 已确保存在");
+    let dataset = load_sidebar_dataset(state.config(), &context, &effective_workspace_id)?;
     let result = execute_kernel_query(
         &context,
+        &effective_workspace_id,
         RuntimeQueryEnvelopeWire {
             name: "kernel.project_view".into(),
             payload: json!({
                 "projection": KernelProjectionKind::SidebarTree,
-                "workspaceId": query.workspace_id,
+                "workspaceId": effective_workspace_id,
                 "rootNodeId": query.root_node_id,
                 "depth": query.depth,
                 "includeEdges": true,
@@ -150,12 +113,7 @@ pub async fn project_sidebar(
         dataset,
     )?;
 
-    Ok((StatusCode::OK, Json(json!({
-        "ok": true,
-        "requestId": context.trace.request_id,
-        "traceId": context.trace.trace_id,
-        "result": result,
-    }))))
+    Ok(ok_response(&context, result))
 }
 
 pub async fn subtree(
@@ -163,13 +121,17 @@ pub async fn subtree(
     Extension(context): Extension<RequestContext>,
     Query(query): Query<KernelSubtreeQuery>,
 ) -> Result<(StatusCode, Json<Value>), WebError> {
-    let dataset = load_sidebar_dataset(state.config(), &context, query.workspace_id.as_deref())?;
+    let effective_workspace_id =
+        resolve_effective_workspace_id(&context, query.workspace_id.as_deref(), true)?
+            .expect("workspace_required 已确保存在");
+    let dataset = load_sidebar_dataset(state.config(), &context, &effective_workspace_id)?;
     let result = execute_kernel_query(
         &context,
+        &effective_workspace_id,
         RuntimeQueryEnvelopeWire {
             name: "kernel.subtree.get".into(),
             payload: json!({
-                "workspaceId": query.workspace_id,
+                "workspaceId": effective_workspace_id,
                 "rootNodeId": query.root_node_id,
                 "depth": query.depth,
                 "includeEdges": true,
@@ -178,12 +140,7 @@ pub async fn subtree(
         },
         dataset,
     )?;
-    Ok((StatusCode::OK, Json(json!({
-        "ok": true,
-        "requestId": context.trace.request_id,
-        "traceId": context.trace.trace_id,
-        "result": result,
-    }))))
+    Ok(ok_response(&context, result))
 }
 
 pub async fn edges(
@@ -191,25 +148,24 @@ pub async fn edges(
     Extension(context): Extension<RequestContext>,
     Query(query): Query<KernelEdgesQuery>,
 ) -> Result<(StatusCode, Json<Value>), WebError> {
-    let dataset = load_sidebar_dataset(state.config(), &context, query.workspace_id.as_deref())?;
+    let effective_workspace_id =
+        resolve_effective_workspace_id(&context, query.workspace_id.as_deref(), true)?
+            .expect("workspace_required 已确保存在");
+    let dataset = load_sidebar_dataset(state.config(), &context, &effective_workspace_id)?;
     let result = execute_kernel_query(
         &context,
+        &effective_workspace_id,
         RuntimeQueryEnvelopeWire {
             name: "kernel.edges.list".into(),
             payload: json!({
-                "workspaceId": query.workspace_id,
+                "workspaceId": effective_workspace_id,
                 "nodeId": query.node_id,
                 "direction": KernelGraphDirection::Both,
             }),
         },
         dataset,
     )?;
-    Ok((StatusCode::OK, Json(json!({
-        "ok": true,
-        "requestId": context.trace.request_id,
-        "traceId": context.trace.trace_id,
-        "result": result,
-    }))))
+    Ok(ok_response(&context, result))
 }
 
 pub async fn graph(
@@ -217,13 +173,17 @@ pub async fn graph(
     Extension(context): Extension<RequestContext>,
     Query(query): Query<KernelGraphQuery>,
 ) -> Result<(StatusCode, Json<Value>), WebError> {
-    let dataset = load_sidebar_dataset(state.config(), &context, query.workspace_id.as_deref())?;
+    let effective_workspace_id =
+        resolve_effective_workspace_id(&context, query.workspace_id.as_deref(), true)?
+            .expect("workspace_required 已确保存在");
+    let dataset = load_sidebar_dataset(state.config(), &context, &effective_workspace_id)?;
     let result = execute_kernel_query(
         &context,
+        &effective_workspace_id,
         RuntimeQueryEnvelopeWire {
             name: "kernel.graph.traverse".into(),
             payload: json!({
-                "workspaceId": query.workspace_id,
+                "workspaceId": effective_workspace_id,
                 "startNodeId": query.start_node_id,
                 "maxDepth": query.max_depth.unwrap_or(2),
                 "edgeTypes": [],
@@ -231,12 +191,7 @@ pub async fn graph(
         },
         dataset,
     )?;
-    Ok((StatusCode::OK, Json(json!({
-        "ok": true,
-        "requestId": context.trace.request_id,
-        "traceId": context.trace.trace_id,
-        "result": result,
-    }))))
+    Ok(ok_response(&context, result))
 }
 
 #[cfg(test)]
@@ -248,8 +203,8 @@ mod tests {
 
     fn app() -> axum::Router {
         std::env::set_var(
-            "MNOTE_WEB_KERNEL_SIDEBAR_FIXTURE_JSON",
-            r#"{"documents":[{"id":"page_root","workspace_id":"ws_demo","title":"工作区首页","parent_id":null,"sort_order":0,"is_starred":true,"is_template":false,"created_at":"2026-04-16T00:00:00Z","updated_at":"2026-04-16T00:00:00Z"},{"id":"page_child","workspace_id":"ws_demo","title":"子页面","parent_id":"page_root","sort_order":1,"is_starred":false,"is_template":false,"created_at":"2026-04-16T00:00:00Z","updated_at":"2026-04-16T00:00:00Z"}]}"#,
+            "MNOTE_WEB_QUERY_FIXTURES_JSON",
+            r#"{"sidebar:datasetList":{"documents":[{"id":"page_root","workspace_id":"ws_demo","title":"工作区首页","parent_id":null,"sort_order":0,"is_starred":true,"is_template":false,"created_at":"2026-04-16T00:00:00Z","updated_at":"2026-04-16T00:00:00Z"},{"id":"page_child","workspace_id":"ws_demo","title":"子页面","parent_id":"page_root","sort_order":1,"is_starred":false,"is_template":false,"created_at":"2026-04-16T00:00:00Z","updated_at":"2026-04-16T00:00:00Z"}]},"bridgeLogs:listWorkspaceOverview":{"workspace_id":"ws_demo","command_logs":[{"command_id":"cmd_1","request_id":"req_1","status":"applied","created_at":"2026-04-16T00:00:00Z"}],"domain_events":[{"command_id":"cmd_1","status":"published","created_at":"2026-04-16T00:00:00Z"}],"next_cursor":null,"has_more":false,"filters":{"command_status":null,"event_status":null,"target_page_id":null,"target_block_id":null,"aggregate_type":null,"aggregate_id":null},"generated_at":"2026-04-16T00:00:00Z"}}"#,
         );
         build_app(AppState::new(AppConfig {
             service_name: "mnote-web".into(),
@@ -259,6 +214,7 @@ mod tests {
             compat_next_base_path: "/api/compat/next".into(),
             convex_url: None,
             convex_admin_key: None,
+            allow_dev_fixtures: true,
             dev_user_id: "dev-user".into(),
             dev_user_name: "开发用户".into(),
             dev_user_email: "dev@mnote.local".into(),
@@ -270,7 +226,7 @@ mod tests {
         let response = app()
             .oneshot(
                 Request::builder()
-                    .uri("/api/kernel/projections/sidebar?rootNodeId=page_root")
+                    .uri("/api/kernel/projections/sidebar?workspaceId=ws_demo&rootNodeId=page_root")
                     .body(Body::empty())
                     .expect("request"),
             )