docs: module dossier + install/quickstart sync for truthful cutover sprints

- API_CLI_REFERENCE.md, INSTALL_GUIDE.md, quickstart.md, architecture/integrations.md, dev/DEV_ENVIRONMENT_SETUP.md, integrations/LOCAL_SERVICES.md: reflect real-service wiring.
- docs/modules/**: module dossier updates across the modules touched by SPRINT_20260415_001..007 + SPRINT_20260416_003..017 + SPRINT_20260417_018..024 + SPRINT_20260418_025 + SPRINT_20260419_026.
- docs/features/checked/web/**: update feature notes where UI changed.
- docs/qa/feature-checks/runs/web/evidence-presentation-ux/: QA evidence artifacts.
- docs/setup/**, docs/technical/**: align with setup wizard contracts.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/modules/binary-index/architecture.md

@@ -633,6 +633,8 @@ public enum MatchMethod { BuildIdCatalog, FingerprintMatch, RangeMatch }
 
 The `binaries` schema stores binary identity, fingerprint, and match data.
 
+`BinaryIndex.WebService` uses the `binaries` schema as its authoritative live runtime store for binary vulnerability assertions, fix-index reads, and delta-signature state whenever `ConnectionStrings:Default` is configured. The service no longer falls back to process-local in-memory stores for these backends in live mode; missing Postgres configuration is treated as a startup configuration error.
+
 ```sql
 CREATE SCHEMA IF NOT EXISTS binaries;
 CREATE SCHEMA IF NOT EXISTS binaries_app;
@@ -1187,6 +1189,12 @@ BinaryIndex:
 | `RetryOnFailure` | bool | true | Retry transient failures |
 | `BatchSize` | int | 100 | Batch insert size |
 
+For `BinaryIndex.WebService`, the live host contract is:
+- `ConnectionStrings:Default` is required for authoritative PostgreSQL-backed golden-set, vulnerability, and delta-signature state.
+- `ConnectionStrings:Redis` is required for the authoritative resolution cache.
+- Live runtime does not degrade to in-memory storage when either connection string is absent.
+- Restart-survival proof is covered by `BinaryIndexDurableRuntimeTests`, which writes golden-set state through the HTTP API, persists resolution cache data in Valkey, restarts the host, and reads both back from the durable services.
+
 ```yaml
 Postgres:
   BinaryIndex:
@@ -1787,10 +1795,10 @@ The Symbols subsystem provides debug symbol storage, resolution, and marketplace
 |---------|----------|------|
 | `StellaOps.Symbols.Core` | `__Libraries/StellaOps.Symbols.Core/` | Leaf library: models, abstractions (`ISymbolRepository`, `ISymbolResolver`), hashing |
 | `StellaOps.Symbols.Client` | `__Libraries/StellaOps.Symbols.Client/` | HTTP client for Symbols.Server API (depends on Core) |
-| `StellaOps.Symbols.Infrastructure` | `__Libraries/StellaOps.Symbols.Infrastructure/` | In-memory and persistent storage, Blake3 hashing (depends on Core) |
+| `StellaOps.Symbols.Infrastructure` | `__Libraries/StellaOps.Symbols.Infrastructure/` | Manifest/blob/runtime plumbing, Blake3 hashing, and testing-only local fallback storage (depends on Core) |
 | `StellaOps.Symbols.Marketplace` | `__Libraries/StellaOps.Symbols.Marketplace/` | Marketplace scoring and catalog (leaf) |
 | `StellaOps.Symbols.Bundle` | `__Libraries/StellaOps.Symbols.Bundle/` | Deterministic symbol bundles for air-gapped installs with DSSE manifests (depends on Core) |
-| `StellaOps.Symbols.Server` | `StellaOps.Symbols.Server/` | Deployable ASP.NET Core WebService (depends on Core, Infrastructure, Marketplace) |
+| `StellaOps.Symbols.Server` | `StellaOps.Symbols.Server/` | Deployable ASP.NET Core WebService with PostgreSQL-backed source/catalog runtime and startup migrations (depends on Core, Infrastructure, Marketplace) |
 | `StellaOps.Symbols.Tests` | `__Tests/StellaOps.Symbols.Tests/` | Test project covering all Symbols libraries |
 
 ### Symbols.Server API Surface
@@ -1806,7 +1814,9 @@ The server exposes REST endpoints on port 8080 (mapped to `127.1.0.38:80` in com
 | POST | `/v1/symbols/resolve` | `symbols:read` | Batch-resolve symbol addresses |
 | GET | `/v1/symbols/by-debug-id/{debugId}` | `symbols:read` | Get manifests by debug ID |
 
-Additional marketplace endpoints are mapped via `app.MapSymbolSourceEndpoints()`.
+Additional marketplace endpoints are mapped via `app.MapSymbolSourceEndpoints()`. `StellaOps.Symbols.Server` now has a split runtime contract:
+- Source/catalog endpoints wire `AddSymbolsRuntimePersistence(...)`, which loads `Migrations/001_initial_schema.sql` at startup and requires `ConnectionStrings:Default` outside `Testing`.
+- Manifest/blob/resolve endpoints use in-memory storage only in `Testing`; outside `Testing` they return truthful `501 problem+json` responses until a durable manifest/blob backend exists.
 
 ### Consumers
 
@@ -1815,6 +1825,6 @@ Additional marketplace endpoints are mapped via `app.MapSymbolSourceEndpoints()`
 
 ---
 
-*Document Version: 1.6.0*
-*Last Updated: 2026-03-04*
+*Document Version: 1.6.1*
+*Last Updated: 2026-04-16*