add baseline and sqlite

README.md

@@ -54,6 +54,11 @@ files are gzip-compressed and 14 archives are retained. Override this when neede
 FGAI_LOG_ROTATE_BYTES=$((100 * 1024 * 1024)) FGAI_LOG_ROTATE_COUNT=30 ./start.sh restart
 ```
 
+The continuous monitor also stores a local SQLite behavior baseline at
+`state/fgai-baseline.sqlite3`. A source becomes baseline-ready after 12 completed
+five-minute windows. Historical rate and hitcount-rate deviations then contribute
+to its anomaly score. Set `FGAI_BASELINE_DB` to use another location.
+
 Analyze local logs:
 
 ```bash