docs: document internal semantic infrastructure

scripts/test-verify-workspace-install-docs.sh

@@ -11,6 +11,7 @@ trap 'rm -f "$output" "$verifier_functions"; rm -rf "$negative_root"' EXIT HUP I
 "$root/scripts/verify-workspace-install-docs.sh" --fixtures-only >"$output"
 
 for fixture in \
+  "internal semantic infrastructure documentation contract" \
   "local installation guide contract" \
   "source update fail-closed semantics" \
   "Windows line-ending recovery guide contract" \
@@ -35,6 +36,25 @@ for fixture in \
   }
 done
 
+grep -Fq '## Internal Qdrant + Ollama semantic infrastructure' "$root/PROJECT_STATE.md" || {
+  echo "PROJECT_STATE.md does not record the internal Qdrant/Ollama snapshot" >&2
+  exit 1
+}
+grep -Fq 'Qdrant and Ollama are internal Compose services' "$root/AGENTS.md" || {
+  echo "AGENTS.md does not record the stable internal semantic-service guidance" >&2
+  exit 1
+}
+grep -Fq 'Do not add vector or embedding endpoint credentials to the bundle.' \
+  "$root/deploy/secrets/README.md" || {
+  echo "secret bundle guide still permits vector/embedding runtime secrets" >&2
+  exit 1
+}
+if rg -n 'engine: pgvector|provider: ollama_compatible|THT_WS_<NAMESPACE>_VECTOR_TRANSPORT|THT_WS_<NAMESPACE>_EMBEDDING_BASE_URL' \
+  "$root/docs/workspace-diagnostic-protocol.md"; then
+  echo "workspace diagnostic protocol still documents external vector or embedding contracts" >&2
+  exit 1
+fi
+
 server_guide="$root/docs/install/server.md"
 grep -Fq 'scripts/prepare-server-pi-state.sh /srv/thothii/pi-state 10001 10001' "$server_guide" || {
   echo "server guide does not initialize nested Pi-state targets before Compose" >&2