Merge origin/main and preserve approved teacher Agent consensus

.project-docs/30-worklog/current-state.md

@@ -4,6 +4,16 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 ## Integrated Through
 
+- 2026-10-11：用户授权回滚与主目录交接，已在本地 main 合入源 658bf7d 和正式文档整合 9949328，合并提交 5ae6ffd204e4d5e0f8546544fa8fc8cc3e1c51f1。恢复旧 Works Square 登录/刷新/注销路径；产品与已验证源一致。原有三份任务文档保持未提交，未推送、部署或删除工作区。见[主分支记录](tasks/20261011-integrate-makelore-rollback-b8f41a62.md)。
+
+- 2026-10-11：按用户明确要求，将 Makelore 平台 SSO 回滚源 `e28beff`（原平台 OIDC 实现 `7236def` 的逆提交）合入本地集成分支，客户端恢复 Works Square 传统密码/手机登录、刷新与注销边界。回滚验证沿用源任务的 60 项聚焦测试、typecheck、scoped lint、Renderer-only Vite build 与 `git diff --check`；正常 D: 构建仍因磁盘空间不足未完成。本次未推送、部署、迁移真实账号、改 LMS 或支付；主目录 3 份外来未跟踪文档原样保留且未纳入提交。此前 2026-10-10 的 OIDC 条目和来源任务继续保留为历史证据，当前运行时以本条及 ADR-004 为准。见[回滚源任务](tasks/20261011-rollback-makelore-platform-auth-7c4e9a2b.md)和[本次集成](tasks/20261011-integrate-rollback-makelore-c9d8e7f6.md)。
+
+- 2026-10-10：按用户确认，将 Makelore 平台 SSO 源 `7236def07d6a9a5cfde70c3239c6ac53764bcd7d` 无冲突快进合入本地 `main`，并修正来源登记提交 `86216b8458db9a2c58850a6835fd1a76cee5a846`。Electron Main 通过系统浏览器使用平台 OIDC Authorization Code + PKCE，校验 state/nonce/S256、精确 `niancode://auth/callback`，并在 Main 内持有 access/refresh token；平台身份按 issuer + `sub=platform:<UUID>` 使用，传统 Works Square 密码/手机登录路径保留。该条记录的是已回滚的历史迭代，不代表当前客户端状态。源验证沿用 65 项聚焦测试、typecheck 与变更文件 lint；本次未推送、部署、迁移真实账号、改 LMS 或支付。已有 3 份外来未跟踪文档原样保留且未纳入提交。见[源任务](tasks/20261010-makelore-platform-sso-a1b2.md)和[本次集成](tasks/20261010-integrate-makelore-platform-sso-9c2d.md)。
+
+- 2026-10-09：按用户要求，将集成源 `35e2a9149aed7d918176f00369cee6528505cdb8` 从 `fe1a3775` 无冲突快进合入本地 `main`。应用、测试、配置与已验证源保持相同，本次仅补充主分支交付记录。原有 3 份外来文档原样保留且未纳入提交；全部源分支和工作区按用户要求保留。未推送、部署、迁移生产数据或发布安装包；真实机构、OSS/网络、支付和设备验收仍待执行。见[本次合并](tasks/20261009-merge-product-dd0461f9.md)。本条更新下方独立分支阶段的未合主分支状态，历史来源记录不改写。
+
+- 2026-10-09：本独立 integration 分支以实施源 `0d442ce576430880355ca35382b844d2cec14d64` 为基线，整合原创作和永久点数决定及后续用户决定。D01 当前账号充值、可见收款对象及无课程客户端边界已有本地实现；家长登录孩子账号充值、麦洛不体现课程替代旧充值待定/客户端课程提案。应用和测试保持源版本，源记录原样保留。当前正式设计尚未推广到主分支；未部署、支付或删除工作区。本批无客户端迁移。真实机构、OSS/网络、支付或移动验收仍按各项目留项。见[正式设计](../20-architecture/community-collaboration.md)、[实施证据](tasks/20261009-makelore-product-implementation-eaa0ffa5.md)、[本次集成](tasks/20261009-makelore-product-integration-29d647c5.md)。下方日期条目为历史阶段，不以早期未实现/待定描述覆盖本条。
+
 - 2026-10-09：续接用户授权的老师 Agent 共识记录，确认[八方面内在映射框架](../00-brief/project-positioning.md#内在映射的八个方面)，[首版目标](../00-brief/project-positioning.md#首版内在映射目标)只重点覆盖前五方面：价值、动机与优先顺序，注意与问题构造，对世界的理解，经验与实践能力，证据标准与自我修正。身份与生命叙事、关系与社会处境、情绪与自我调节留待后续迭代，不另把第七方面列为首版要求；判断证据仍保留必要的事实背景。同步此前用户的平等身份澄清，“老师”是名称，具体真人与用户的交流不预设教师／学生关系；用户自己理解并向操作 Agent 表达执行要求的边界保留。基于既有共识提交 `00db469`、`07f009c` 更新产品定位、README、老师 ADR、决策索引及同一集成记录。下一步讨论 Codex 等工具痕迹能提供哪些证据及需要补充什么；本次只记录已确认方向，未读取个人历史或实现蒸馏，既有运行和发布边界保持。见[集成记录](tasks/20261008-teacher-consensus-integration-a9c2d7e1.md)。
 
 - 2026-10-08 补充（后续身份澄清见上条）：用户明确纠正老师建议进入执行的方式。老师建议后，学生须自己理解、决定是否采纳并向操作 Agent 表述目标与执行要求；不通过老师／系统直接转发、自动下发或一键采纳执行替代学生表达。随后查看作品结果，老师再基于可获得的事实继续判断。学生表达为观察理解提供依据，不等于自动证明理解；具体观察方法待讨论。本次基于共识提交 `00db469` 同步[产品定位](../00-brief/project-positioning.md#用户理解与执行表达)、README、老师 ADR 和决策索引，替换原先将老师建议与操作 Agent 交接留待设计的表述；仅更新文档，未改动运行代码、配置或发布。见[同一集成记录](tasks/20261008-teacher-consensus-integration-a9c2d7e1.md)。
@@ -1236,4 +1246,4 @@ Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选
 
 ## Last Updated
 
-2026-09-29
+2026-10-11

.project-docs/30-worklog/tasks/20261009-makelore-product-implementation-eaa0ffa5.md

@@ -0,0 +1,73 @@
+# Task: Implement approved product detailed design
+
+## Identity
+
+- Task ID: 20261009-makelore-product-implementation-eaa0ffa5
+- Mode: Feature
+- Branch: codex/20261009-makelore-product-implementation-eaa0ffa5-product-implementation
+- Worktree: D:\Datas\OthersProjects\.codex-worktrees\makelore\20261009-makelore-product-implementation-eaa0ffa5
+- Base commit: fe1a3775c5f785adaa6372bd7ea3102c79331656
+- Owner: codex
+- Status: Ready for Integration
+
+## Scope
+
+- Cross-project continuation: correct this task's obsolete course follow-up to the user's explicit no-course-client boundary; prepare the recharge rollout and canonical promotion handoff. No client course implementation or production actions.
+
+- Implement the first complete D01 slice from approved detailed design 28ac43ba: current-account personal-wallet recharge, parent-operates-child-account guidance, visible recipient, and existing payment/order recovery. Own PointWallet/caller, Main billing messages, README and focused unit/Electron tests.
+
+## Intent And Constraints
+
+- Cross-project continuation: official same-task Concurrent/Planning Gates Passed; read required context and all 146 unchanged peer scopes, with matching task/mode/worktree/branch/base. The user's later no-client-course decision controls over the original D05 plan. Only this owned task record changes. Formal integration start is Blocked by 20260929-merge-teacher-stream-1e4177fe; preserve its worktree, branch and all untracked/modified files. No subagents, canonical writes, client course code, merge/push, deployment or payment.
+
+- Concurrent and Planning Gates Passed in this isolated feature worktree; current owner/reservation matches. Preserve all foreign work and canonical documents. User explicitly approved child-account recharge; old parent-only guidance is superseded for permanent point recharge only. Do not change legacy membership, identity, shared funding choice, provider callbacks or frozen order owner. No subagents, live payment, push, merge or deployment.
+- Plan: implement backend qualification and both UI projections; test actual child/parent own-wallet orders, shared payer privacy, idempotency/recovery and account switching; run relevant backend/frontend and required client checks; commit each complete slice with evidence. D02–D08 remain subsequent implementation packages, not completion claims of this first slice.
+
+## Outcome
+
+- Cross-project handoff corrected obsolete future client-course work and promotion status. D01 remains the implemented client change; community/LMS own subsequent course and teaching flows. WS prepared the overall integration/rollout guide and task-owned canonical candidate. No application code, dependency or test changes this continuation.
+
+- D01 implemented in this worktree. Sidebar passes the authenticated account nickname/username into PointWallet; the wallet explicitly displays the recipient and asks parents to log into the child's account before paying.
+- Recharge uses the existing authenticated Main/Host API flow and still submits only product plus request ID. It does not submit a target child, change platform identity, transfer points or alter the selected funding source.
+- Server-denied recharge copy no longer tells users to switch to a separate parent identity. Existing pending-order recovery, frozen pricing, payment status confirmation and unknown-outcome behavior remain in place.
+- README records the approved current-account rule and WS rollout dependency. Existing captured server fixture remains a pre-D01 fixture; its false capability is still honored rather than fabricated.
+- Companion WS implementation: task 20261009-community-product-implementation-b001b1db, branch codex/20261009-community-product-implementation-b001b1db-product-implementation; it updates account/billing capability and order eligibility, community UI and focused tests. LMS has no D01 code change.
+- Work remains isolated; no primary checkout edits, subagents, merge, push, deployment or live payment.
+
+## Verification
+
+- This continuation's Task Documentation Gate: inspected committed scope since the recorded base and current changes; git diff --check and official task-aware document drift check passed. Only owned task records/supporting proposal and ordinary delivery/configuration files changed. Ready for Integration; canonical ownership handoff remains pending.
+
+- Reviewed base fe1a3775-to-HEAD 281e6dc file scope (10 files) and the current task-record diff; git merge-base --is-ancestor main HEAD succeeded at this checkpoint. No code change, so prior 41 unit tests, typecheck/build and Electron E2E remain the relevant evidence; did not repeat them for a task-record correction. Exact integration owner confirmed by failed official start; no ownership mutated.
+
+- PASS: `pnpm exec vitest run tests/unit/point-wallet.test.tsx tests/unit/sidebar-token-points.test.tsx tests/unit/works-billing-routes.test.ts tests/unit/works-billing-client.test.ts tests/unit/works-billing-server-contract.test.ts --maxWorkers=2`: five files, 41 tests passed.
+- Focused assertions cover actual Sidebar recipient props; child account recharge submits no extra recipient; shared funding is not automatically changed; safe denial copy; old server capability remains authoritative.
+- PASS: `pnpm run typecheck`.
+- PASS: scoped `pnpm exec eslint` on all changed TS/TSX implementation and test files.
+- PASS: `pnpm run build:vite` for Renderer, Main, preload and utility.
+- PASS: `pnpm exec playwright test tests/e2e/permanent-point-wallet.spec.ts --workers=1`: one Electron E2E. Verified child recipient/guidance, pending-order reopen, frozen price, one order POST and credit only after server-confirmed success.
+- Exact pinned pnpm 10.33.4 used; `pnpm install --frozen-lockfile --offline` used cached dependencies and respected approved scripts. No dependency or lockfile change.
+- Companion WS checks passed: 68 backend tests, 138 web tests, web build and rendered-browser payment/account-switch scenarios with synthetic responses.
+- Existing build warnings concern chunk size, mixed static/dynamic imports and Browserslist data. Tests use isolated fixtures/synthetic payments; real provider acceptance and real money settlement remain unverified.
+
+## Follow-ups
+
+- Integrate with WS D01 and deploy backend eligibility before expecting child-account recharge in this client. Existing 0094 permanent-points storage suffices; this slice adds no migration.
+- Validate child-account token acceptance with the actual payment provider before production rollout.
+- The user's subsequent instruction “makelore客户端不体现课程” supersedes the original client course plan. Do not implement course UI, course context, learningOrigins, course deep links or course-task recovery. D02–D08 now live in WS/LMS; WS implements course-work association in its own community page. Ordinary creation/publication and D01 recharge remain the client scope. The WS task-owned makelore-creation-boundary proposal records the amended D05 contract.
+- Retain the worktree/branch for review and integration.
+
+## Promotion Candidates
+
+- Target: .project-docs/40-domain/business-rules.md and .project-docs/20-architecture/system-overview.md.
+  Proposal: active current-account recharge uses the child's authenticated session when a parent pays for that child; recipient must be visible; account identity and selected shared funding remain unchanged.
+  Evidence: explicit user decision “家长登录孩子的号进行充值”, approved detailed design 28ac43ba, 41 focused unit tests, Electron E2E and companion WS tests.
+  Future impact: prevent reintroducing separate parent-wallet recharge guidance or client-side eligibility guesses.
+  Semantic conflict: supersedes old parent-only permanent-point recharge language; parent-only family administration and other legacy rules remain separate.
+  Human confirmation: already supplied by the user; canonical promotion still requires Integration Gate.
+- Target: .project-docs/30-worklog/current-state.md.
+  Proposal: after integration, record D01's client implementation and WS rollout dependency. Remove the superseded client course follow-up; WS through 3e39a8f4 and LMS through 4a84132 contain the D02–D08 implementation within their scopes. Preserve unverified production/provider/mobile acceptance as rollout work, not missing client course features.
+  Evidence: this task and companion 20261009-community-product-implementation-b001b1db.
+  Future impact: keeps implementation and deployed/integrated state distinct.
+  Semantic conflict: no canonical changes permitted from this feature task.
+  Human confirmation: no additional product decision needed.

.project-docs/30-worklog/tasks/20261009-makelore-product-integration-29d647c5.md

@@ -0,0 +1,54 @@
+# Task: Integrate implemented community product boundaries
+
+## Identity
+
+- Task ID: 20261009-makelore-product-integration-29d647c5
+- Mode: Integration
+- Branch: codex/20261009-makelore-product-integration-29d647c5-product-integration
+- Worktree: D:\Datas\OthersProjects\.codex-worktrees\makelore\20261009-makelore-product-integration-29d647c5
+- Base commit: 0d442ce576430880355ca35382b844d2cec14d64
+- Owner: codex
+- Status: Ready for Integration
+
+## Scope
+
+- Integrate the approved product design and implemented source into this isolated integration branch; update canonical architecture, rules, current state, evidence and remaining rollout work. Preserve all source task records and original worktrees.
+
+## Intent And Constraints
+
+- User explicitly authorized transfer of WS 20261008-integrate-product-design-50fdab23, LMS 20261008-integrate-product-design-b23c91e7 and Makelore 20260929-merge-teacher-stream-1e4177fe. Official release --force changed only those registrations/locks; old directories, branches, files and uncommitted contents retained.
+- Concurrent/Planning/Integration Gates Passed: bundled check/start/status matched this task, integration mode, absolute worktree, branch and recorded source base. Required entry, positioning, architecture/domain, accepted decisions, success/evidence/reflection/commitment context and source outcomes/candidates loaded. WS 277/LMS 26/Makelore 146 peer records read; none changed since preceding continuation. Historical Gateway record lacks Intent And Constraints, without a concrete dependency.
+- Project goal: community supplies courses/tools/support and public learning/works; institutions independently manage teaching with optional LMS; Makelore is a creation tool without courses. Current focus: unite separate approved design and implementation histories, amend only later explicitly confirmed behavior, and separate local evidence from deployment. Preserve existing wallet/family/tenant/publication boundaries. No subagents, primary-checkout adoption, main-branch changes, push, deployment, payment or worktree deletion.
+- Decisions: parents recharge while logged into the child's account; permanent manual per-child points; child-initiated publication; no institution labels in ordinary community; no client course UI/context/deep links/learningOrigins. These user decisions supersede the old design's pending recharge choice and client task entry; no new product decision needed. Source verification remains applicable because application code will remain unchanged.
+- Implementation plan after gates: merge the retained WS/LMS design commits into the new integration branches, reconcile canonical text with actual feature contracts, verify source-code equality and unchanged imported task records, check edited links and documentation boundaries, then commit and complete the integration records. Makelore needs only canonical creation/recharge boundaries and status.
+
+## Outcome
+
+- Promoted implemented D01 and the explicitly confirmed creation-only client boundary from source 0d442ce into community-collaboration, positioning, architecture/module/data-flow, permanent-point rules, success criteria, indexes, evidence and current state. Removed obsolete parent-only recharge and client course assumptions. Preserved teachers/agents and retired Learning data rules; no application change.
+- All code, tests, deployment configuration and dependencies match the verified implementation source. This is a local isolated integration branch, not a main-branch promotion, deployment or client release. Shared state records exact Integrated Through source commits and keeps real-world acceptance gaps explicit. All original worktrees, branches and uncommitted files retained.
+
+## Verification
+
+- PASS: git diff from the recorded source base excluding Markdown is empty; untracked files are Markdown only. This proves application/configuration/test equality with the source and avoids repeating unaffected application tests.
+- PASS: 12 added local document links resolve; no missing targets. 0 imported source task/proposal records compare unchanged to the retained design commit. git diff --check (working/staged) and check_project_docs.py passed; canonical text no longer presents implemented collaboration or client courses as pending design.
+- PASS: official check_doc_drift.py after integration commit 12af6aed5d076bd0168d23469cfa2675ff639594 validates canonical ownership and unchanged source imports through shared ancestry. The pre-commit WS check could not yet prove the five staged imports; after recording the real merge parents it passes without adoption, source edits or bypass. All three check_project_docs.py/drift gates passed. Original WS/LMS design checkouts retain their exact HEAD/branch and clean state; original Makelore main retains its HEAD and same three untracked documents.
+- Task Documentation Gate complete: reviewed source-base-to-integrated changes, recorded actual outcomes/verification/remaining rollout work and exact sources, retained all directories/branches, and prepared this final Ready for Integration record. No main-branch merge occurred, so no cleanup action or new cleanup permission is needed.
+
+## Follow-ups
+
+- Promote the completed integration branches to the main branches in a separately coordinated step; preserve the foreign changes already present in the original WS/Makelore checkouts and the LMS feature owner. No main worktree was claimed or switched here.
+- Real institution/course pilot, production OSS/long-video/network, actual payment provider/settlement, native devices and WeChat tool pages remain acceptance work. Automatic adoption receipts are unimplemented; Operations records actual delivery manually. Do not revive cancelled Makelore course features or repeat completed D06/D07 work.
+
+## Promotion Candidates
+
+- Promoted the user-confirmed community/institution/client boundaries and implemented contracts into canonical documents. Exact feature and retained design sources are in current-state Integrated Through. Old historical records stay read-only; current-account recharge and no-course-client policy derive from explicit user decisions, not inferred timestamps. No further product decision or ownership handoff is required for this integration.
+
+## Remaining-work review · 2026-10-09
+
+- Same-task follow-up requested by the user: compare the approved detailed design and later scope decisions with current code, branch delivery and acceptance evidence. Official start/status and Planning Gate passed; peer records are unchanged since integration. Status audit only; no application edits, merge, deployment, real payment or workspace deletion. Findings follow after source inspection.
+
+- Findings: Confirmed D01 source 281e6dc remains implemented and formally documented. No further course work is pending: user's explicit instruction cancelled it. main remains fe1a3775; current-account recharge code and canonical documentation are on the retained integration branch. Matching installed build, actual payment provider and child-account credit acceptance remain unverified.
+- Cross-project follow-ups: main-branch delivery, coordinated migrations/API/clients, real OSS/media/package/network, institution/course pilot, actual payment and selected native/WeChat/installed-client acceptance. Real course, institution, support/commercial terms and public-display/promotion-use authorization remain business inputs; no new scope inferred from historical pending bullets.
+- Verification for this status review: inspected original approved design, current canonical/ordinary docs, relevant source/configuration, main branch refs and source-to-integrated application equality. Application code unchanged; existing phase-specific test evidence retained rather than rerun. Only own task records and WS task-owned evidence are updated; no main merge, push, deployment, payment, subagent or cleanup.
+
+- PASS: source-to-integrated non-Markdown diff is empty; current edits remain task-owned documentation only. Official project-docs structure and task drift gates passed for all three repositories; six evidence-report links resolve. Task Documentation Gate completed for this status follow-up.

.project-docs/30-worklog/tasks/20261009-merge-product-dd0461f9.md

@@ -0,0 +1,42 @@
+# Task: Merge approved product integration into main branch
+
+## Identity
+
+- Task ID: 20261009-merge-product-dd0461f9
+- Mode: Integration
+- Branch: main
+- Worktree: D:\Datas\OthersProjects\makelore
+- Base commit: fe1a3775c5f785adaa6372bd7ea3102c79331656
+- Owner: codex
+- Status: Ready for Integration
+
+## Scope
+
+- Fast-forward approved integration source 35e2a9149aed7d918176f00369cee6528505cdb8 into local main; update current canonical delivery status and preserve all source records, branches and worktrees.
+
+## Intent And Constraints
+
+- User explicitly requested main-branch merge. WS/Makelore adoption of the five named foreign documents was separately confirmed; they remain unchanged and excluded from commits. LMS primary checkout was clean; released this conversation's completed implementation/source integration ownership normally before claiming main.
+- Official check/start/status and Concurrent/Planning/Integration Gates Passed. Exact task, integration mode, branch, absolute worktree and base match. Entry, own record, required current memory and source outcome/candidates loaded; source decisions already approved. WS 277/LMS 25/Makelore 146 peer records unchanged. Historical WS Gateway missing Intent has no relevant dependency.
+- Community owns courses/self-study/works/points/support; institutions own teaching with optional LMS; Makelore stays course-free. Retain permanent manual per-child points and current-child-account recharge. No new product scope, subagents, remote push, deployment, payments or deletion.
+- Plan: fast-forward the fixed reviewed source, verify source ancestry/application equality and original foreign bytes, reconcile only current main-branch status, run task-aware documentation checks, commit the integration record and complete. Keep all worktrees by existing user instruction; do not ask again for cleanup.
+
+## Outcome
+
+- Fast-forwarded fe1a3775c5f785adaa6372bd7ea3102c79331656 to approved source 35e2a9149aed7d918176f00369cee6528505cdb8 on local main, without conflicts. Application, tests, configuration and dependencies are unchanged from the verified source. Updated current canonical status and main delivery pointers; imported source records remain unchanged.
+- 3 original foreign documents remain byte-for-byte unchanged and excluded from this commit. All source worktrees and branches retained as explicitly requested; no cleanup question repeated. No push, deployment, production migration, payment, packaging or installation.
+
+## Verification
+
+- PASS: source clean; main base is an ancestor of the exact source; fast-forward succeeded. Source-to-main non-Markdown diff is empty, including working changes. Existing source phase-specific test evidence remains applicable; no unaffected business suite was rerun.
+- PASS: original foreign document bytes unchanged; their paths do not overlap this merge. Source task/proposal imports preserved through real ancestry. Official check_project_docs.py and task-aware check_doc_drift.py passed for all three repositories.
+- Reviewed base-to-integrated changes and the current status-only edits; current task record records actual scope, outcome, verification and follow-ups. Task Documentation Gate complete; Ready for Integration retains the primary checkout for future same-task work.
+
+## Follow-ups
+
+- Real institution/course, OSS/media/network, payment and selected native/WeChat/installed-client acceptance remain separate. Course-package default limits still need real-pilot configuration; no optional receipt/mobile/multi-media expansion is included.
+- Retain all worktrees and branches by user instruction, including ignored output and dependencies; do not delete.
+
+## Promotion Candidates
+
+- Promoted exact source under Integrated Through and updated current pending-main wording in canonical designs, memory/evidence/commitment entry points and applicable root documents. Dated source records and historical entries remain read-only. No business decision changed.

.project-docs/30-worklog/tasks/20261010-integrate-makelore-platform-sso-9c2d.md

@@ -0,0 +1,46 @@
+# Task: Integrate Makelore platform SSO
+
+## Identity
+
+- Task ID: 20261010-integrate-makelore-platform-sso-9c2d
+- Mode: Integration
+- Branch: main
+- Worktree: D:\Datas\OthersProjects\makelore
+- Base commit: 87d3f03d751b93b607e56d3667c3655f2a03a792
+- Owner: codex-client-integrations
+- Status: Ready for Integration
+
+## Scope
+
+- Integrate source task `20261010-makelore-platform-sso-a1b2` at `7236def07d6a9a5cfde70c3239c6ac53764bcd7d` into local `main`; the source registration correction is `86216b8458db9a2c58850a6835fd1a76cee5a846`.
+- Reconcile the platform OIDC client boundary across the Makelore system overview, data flow, ADR-004, decision index, and current state. Preserve the existing Works Square password/mobile facade and the unchanged LMS/payment boundary.
+- Preserve the three adopted untracked documents byte-for-byte and exclude them from this integration commit: `30-worklog/tasks/20260901-package-122-c5e8.md`, `30-worklog/tasks/20260901-package-123-d7f3.md`, and `30-worklog/tasks/20260902-client-hang-diagnosis-a47c9e2b.md`.
+
+## Intent And Constraints
+
+- Electron Main owns the system-browser OIDC Authorization Code + PKCE flow, token exchange, refresh, and logout projection; require state, nonce, PKCE S256, and exact `niancode://auth/callback`.
+- Use the configured platform issuer and stable identity `issuer + sub=platform:<UUID>`; do not rebind by username, email, or legacy `auth_user_id`. Makelore's registered audience remains `works-square-api`.
+- Keep confidential OAuth secrets out of the Renderer and packaged public client. Do not call the custom one-feel identity service directly from the client. Do not deploy, push, migrate real accounts, or alter LMS/payment behavior.
+- Integration mode owns canonical project-memory reconciliation; the imported source task record remains source evidence and is not rewritten from this task.
+
+## Outcome
+
+- Source implementation and its corrected Ready for Integration registration are fast-forwarded into `main`.
+- Canonical architecture and decision records now describe platform OIDC PKCE alongside the retained Works Square legacy authentication facade.
+- The three adopted foreign documents remain unchanged and untracked; none is staged by this task.
+
+## Verification
+
+- `check_project_docs.py` passed before planning; Concurrent Task Gate and Planning Gate passed for this integration task.
+- Source evidence reused: 65 focused Makelore tests, `pnpm run typecheck`, and scoped lint passed at source `7236def`; no duplicate full suite or package build was needed for this documentation-only reconciliation.
+- Fast-forward merge and source task drift passed; final integration runs `git diff --check` and `check_doc_drift.py --task-id 20261010-integrate-makelore-platform-sso-9c2d`.
+- No deployment, provider/real-account validation, push, package release, LMS change, payment change, or real-data migration was performed.
+
+## Follow-ups
+
+- Deployment must provide `PLATFORM_AUTH_ISSUER`, the registered Makelore public client, exact `niancode://auth/callback` redirect, and the configured `works-square-api` audience before packaged platform login is released.
+- Cleanup completed after the authorized official retire attempt: `D:\Datas\OthersProjects\.codex-worktrees\makelore\20261010-makelore-platform-sso-a1b2` was removed, its Git branch `codex/20261010-makelore-platform-sso-a1b2-20261010-makelore-platform-sso-a1b2` and source commit `86216b8458db9a2c58850a6835fd1a76cee5a846` were preserved, and the stale ownership record was cleared with the official `release-missing --force` recovery after Windows left ignored dependency residue. No production migration is implied.
+
+## Promotion Candidates
+
+- None pending; the OIDC boundary is recorded in ADR-004, `system-overview.md`, `data-flow.md`, and `current-state.md`.

.project-docs/30-worklog/tasks/20261010-makelore-platform-sso-a1b2.md

@@ -0,0 +1,53 @@
+# Task: Makelore platform SSO client integration
+
+## Identity
+
+- Task ID: 20261010-makelore-platform-sso-a1b2
+- Mode: Feature
+- Branch: codex/20261010-makelore-platform-sso-a1b2-20261010-makelore-platform-sso-a1b2
+- Worktree: D:\Datas\OthersProjects\.codex-worktrees\makelore\20261010-makelore-platform-sso-a1b2
+- Base commit: 87d3f03d751b93b607e56d3667c3655f2a03a792
+- Owner: codex-client-integrations
+- Status: Ready for Integration
+
+## Scope
+
+- Replace the Makelore client’s direct one-feel password/mobile proxy as the primary sign-in path with a platform OIDC Authorization Code flow using PKCE S256.
+- Keep the flow in Electron Main: generate state and verifier, open the system browser, accept only an authorization code on `niancode://auth/callback`, exchange it against the platform token endpoint, and keep refresh credentials in Main’s existing secure session store.
+- Project the platform identity (`sub=platform:<UUID>`, `user_id=<platform UUID>`, issuer/audience) into the existing Renderer auth state without copying browser refresh credentials or changing LMS, payment, or server migration behavior.
+- Add focused Main/deep-link/session tests and update the owning product documentation for the new login boundary.
+
+## Intent And Constraints
+
+- The parent platform contract is authoritative: issuer comes from `platform_auth_issuer`; discovery, JWKS, authorize, token, userinfo, and revoke use the standard `/api/auth/oauth/*` paths; Makelore audience defaults to `works-square-api`.
+- The desktop client uses the system browser and PKCE S256. Client secrets, if the registered desktop client requires one, remain Main-owned and are read from OS-protected configuration; Renderer never receives them.
+- A callback carries `code` and `state` only. Access/refresh tokens in a deep-link are rejected. State is single-use and bound to the generated verifier and redirect URI.
+- Existing Main session refresh, account partitioning, logout, and Renderer capability projection remain the owners of local session behavior.
+- Do not infer identity by username, email, or legacy `auth_user_id`; preserve any legacy identifiers only as opaque migration metadata. Do not deploy, migrate real data, or modify the LMS.
+- Other active Makelore tasks concern marketplace, fullscreen, teacher concurrency, WeChat diagnosis, or review-only work; none owns auth routes, deep-link parsing, or session storage. Gate result: Passed.
+
+## Outcome
+
+- Added a Main-owned platform OIDC Authorization Code + PKCE flow. Main discovers the platform authorization and token endpoints, generates one-time state/nonce/verifier values, opens the system browser through the renderer-safe Host API route, accepts the registered `niancode://auth/callback` code/state redirect, cleans the previous local runtime, and persists the returned Works Square session. The callback correlates by state because the platform redirect does not append the legacy desktop `request_id`; legacy request-id-only links remain accepted for compatibility.
+- Added explicit `/api/auth/platform/start` Host API routing, a platform login action on the native login page, and renderer account rehydration from `/api/auth/me` after Main commits the callback session. Access/refresh credentials remain Main-owned.
+- Updated the product README and added focused tests for callback parsing, discovery/PKCE/replay, route projection, and login-page browser launch.
+
+## Verification
+
+- Planning gate passed after reading the project positioning, current state, decision index, system overview, data flow, module map, business rules, stale-items, commitments, and peer task records.
+- `pnpm exec vitest run tests/unit/app-deep-link.test.ts tests/unit/platform-auth.test.ts tests/unit/auth-routes.test.ts tests/unit/login-page.test.tsx --maxWorkers=1` (65 tests passed).
+- `pnpm run typecheck` passed.
+- `pnpm run lint:check -- electron/main/app-deep-link.ts electron/services/platform-auth.ts electron/api/routes/auth.ts electron/main/index.ts src/App.tsx src/pages/Login/index.tsx tests/unit/app-deep-link.test.ts tests/unit/platform-auth.test.ts tests/unit/auth-routes.test.ts tests/unit/login-page.test.tsx` passed with eight pre-existing warnings outside the changed files and no errors.
+- Production deployment, real-account migration, and LMS changes were not performed.
+
+## Follow-ups
+
+- The platform issuer/client configuration must be supplied in the packaged deployment (`PLATFORM_AUTH_ISSUER`, with optional `PLATFORM_AUTH_CLIENT_ID`/`PLATFORM_AUTH_SCOPE`); this local task intentionally does not deploy or register clients.
+
+## Promotion Candidates
+
+- None. The product README documents the implemented client behavior; shared architecture promotion remains owned by the parent integration task.
+
+## Status
+
+Ready for Integration

.project-docs/30-worklog/tasks/20261011-integrate-makelore-rollback-b8f41a62.md

@@ -0,0 +1,42 @@
+# Task: Integrate Makelore identity rollback
+
+## Identity
+
+- Task ID: 20261011-integrate-makelore-rollback-b8f41a62
+- Mode: Integration
+- Branch: main
+- Worktree: D:\Datas\OthersProjects\makelore
+- Base commit: f2a0eefc9ec5dfc2a09c15745b4786bc61682968
+- Owner: Codex
+- Status: Ready for Integration
+
+## Scope
+
+- Merge rollback source 658bf7d and prepared canonical integration 9949328 into local main, preserving the three known foreign task documents.
+
+## Intent And Constraints
+
+- User explicitly approved rollback and main ownership handoff with preserved dirty documents. The prior worker released the old main owner and prepared an isolated integration; its completed clean lock was normally released without deleting that checkout. Official start --mode integration --adopt-existing and status established this exact primary owner.
+- Project Context Loaded / Planning Gate Passed: entry, own task, memory, positioning, current state, decisions, architecture, evidence/reflection/commitments and both ready source records read; reuse unchanged peer assessment from this same rollback. User request resolves the OIDC direction conflict. Historical source records are read-only; no push, deployment or real provider operation.
+
+## Outcome
+
+- Fast-forwarded main to 658bf7d, then merged prepared canonical integration 9949328 as 5ae6ffd204e4d5e0f8546544fa8fc8cc3e1c51f1. Product/test/README bytes equal the verified rollback source. Both source records remain unchanged; current canonical authentication again uses Electron Main and the Works Square one-feel facade.
+- All three preexisting untracked task records remain untracked and unchanged. No dependency or build files are staged.
+
+## Verification
+
+- Cleanup continuation: resumed the same primary integration with matching official ownership and preserved approved foreign content; reused unchanged project/peer context, re-read entry and task/source scope, and passed Planning Gate. Rechecked the exact resolved source path, clean managed ready state, committed ready record and latest-source ancestry before retire. Product tests are not repeated for checkout cleanup and task-record-only changes.
+
+- Source evidence: 60 focused tests, typecheck and scoped lint passed; renderer-only Vite output to C: passed after the standard D: build ran out of disk space. Reused these results because integration changes only documentation.
+- Verified non-document equality to 658bf7d, merge/source ancestry, unchanged source records, adopted foreign states, whitespace and task-aware documentation boundaries.
+
+## Follow-ups
+
+- Match the platform rollback release before deploying this client; production login/payment and packaged callbacks are not tested here.
+- User approved source-worktree cleanup on 2026-10-11. Official retire passed eligibility but Git removal failed with Directory not empty. Git unregistered the linked checkout and removed its .git file; residual directory D:\Datas\OthersProjects\.codex-worktrees\makelore\20261011-rollback-makelore-platform-auth-7c4e9a2b and its task ownership remain. A command to inspect and finish removal of only this approved residue, then use official release-missing, was rejected by automatic approval with blocked by policy before execution. Cleanup remains incomplete; no bypass was attempted. Branch codex/20261011-rollback-makelore-platform-auth-7c4e9a2b-rollback-makelore-platform-auth and commit 658bf7d remain preserved.
+- The released preparation checkout C:\Users\7brot\.codex-worktrees\makelore\20261011-integrate-rollback-makelore-c9d8e7f6 remains on disk and is not an automatic retire candidate.
+
+## Promotion Candidates
+
+- Accepted the prepared canonical rollback in 9949328 under the explicit user instruction; no new product decision or unresolved promotion remains.

.project-docs/30-worklog/tasks/20261011-integrate-rollback-makelore-c9d8e7f6.md

@@ -0,0 +1,98 @@
+# Task: Integrate Makelore platform SSO rollback
+
+## Identity
+
+- Task ID: 20261011-integrate-rollback-makelore-c9d8e7f6
+- Mode: Integration
+- Branch: codex/20261011-integrate-rollback-makelore-c9d8e7f6-integrate-makelore-rollback-c9d8e7f6
+- Worktree: C:\Users\7brot\.codex-worktrees\makelore\20261011-integrate-rollback-makelore-c9d8e7f6
+- Base commit: f2a0eefc9ec5dfc2a09c15745b4786bc61682968
+- Owner: codex
+- Status: Ready for Integration
+
+## Scope
+
+- Integrate the completed Makelore rollback commit `e28beff` from
+  `20261011-rollback-makelore-platform-auth-7c4e9a2b` onto the local `main`
+  baseline `f2a0eefc9ec5dfc2a09c15745b4786bc61682968`.
+- Reconcile the canonical OIDC claims in ADR-004, the decision index, data
+  flow, system overview, and current state so they describe the restored
+  Works Square legacy login boundary after this rollback.
+- Preserve the original SSO source and former integration task records as
+  historical evidence. The three known primary-checkout task documents are
+  outside this worktree and must remain byte-for-byte unchanged and excluded
+  from the integration commit.
+
+## Intent And Constraints
+
+- The user explicitly authorized the account-iteration rollback and local
+  integration. This task changes only the Makelore client rollback and its
+  canonical project-memory reconciliation; it does not touch one-feel,
+  Yuxi, LMS, payment behavior, real accounts, deployment, or remotes.
+- Source task records and peer worktrees are read-only. Do not reset, delete
+  branches, clean unknown files, or alter the Makelore primary checkout.
+- Keep the existing Works Square password/mobile facade, refresh, logout, and
+  remembered-password boundary as the current desktop authentication contract.
+
+## Project Context Loaded
+
+- Concurrent Task Gate: Passed. `check_project_docs.py` passed; this task
+  owns the isolated managed worktree and the integration lock.
+- Planning Gate: Passed after reading `read-before-planning.md`,
+  `memory-index.md`, this task record, project positioning, current state,
+  decision index, system overview, and the completed rollback source record.
+- Relevant peer scope: the rollback source is ready for integration and its
+  only canonical conflict is the now-stale platform OIDC description. Other
+  active Makelore tasks concern unrelated product areas and do not overlap
+  these authentication or canonical-memory paths.
+
+## Implementation Plan
+
+1. Cherry-pick the completed rollback commit and confirm only the documented
+   client, test, and README paths are reversed.
+2. Restore the canonical authentication description to the pre-OIDC
+   Works Square boundary, then add a current-state entry for this rollback
+   with source, verification, and the unresolved future SSO decision.
+3. Run whitespace, project-document drift, and focused regression checks that
+   distinguish restored legacy authentication from removed platform OIDC.
+4. Record the integration outcome, verification, preserved primary contents,
+   and follow-ups in this task record; complete the integration registration.
+
+## Outcome
+
+- Cherry-picked rollback commit `e28beff` as `45198ae`; the Makelore client
+  application, focused tests, and README now match the pre-SSO code baseline.
+- Reconciled ADR-004, the decision index, data flow, system overview, and
+  current state to make the Works Square legacy password/mobile login,
+  refresh, and logout boundary current again. The prior OIDC records remain
+  historical source evidence and are explicitly marked as superseded in the
+  current-state entry.
+- The Makelore primary checkout was not edited by this task. Its three known
+  untracked project task documents remain preserved and excluded from this
+  integration.
+
+## Verification
+
+- Concurrent and Planning Gates passed.
+- Source verification is recorded in
+  `20261011-rollback-makelore-platform-auth-7c4e9a2b`: 60 focused tests,
+  typecheck, scoped lint, `git diff --check`, and a renderer-only Vite build
+  passed; the normal D: output build was blocked by `ENOSPC`.
+- Integration verification passed: `git diff --name-status
+  87d3f03d751b93b607e56d3667c3655f2a03a792 HEAD -- .` excluding
+  `.project-docs/**` returned no paths, `git diff --check` passed, and
+  `check_doc_drift.py --task-id 20261011-integrate-rollback-makelore-c9d8e7f6`
+  passed. The isolated integration worktree has no dependency installation,
+  so the source test evidence was reused rather than rerunning the same suite.
+
+## Follow-ups
+
+- A future platform SSO implementation requires a new explicit design and
+  integration decision; this rollback leaves the client on the legacy path.
+- Re-run a normal Vite output build when D: has sufficient free space.
+
+## Promotion Candidates
+
+- None pending; the accepted rollback reconciliation is recorded in the
+  canonical documents above. The historical OIDC source and prior integration
+  task remain read-only evidence.

.project-docs/30-worklog/tasks/20261011-rollback-makelore-platform-auth-7c4e9a2b.md

@@ -0,0 +1,121 @@
+# Task: Rollback Makelore platform SSO integration
+
+## Identity
+
+- Task ID: 20261011-rollback-makelore-platform-auth-7c4e9a2b
+- Mode: Feature
+- Branch: codex/20261011-rollback-makelore-platform-auth-7c4e9a2b-rollback-makelore-platform-auth
+- Worktree: D:\Datas\OthersProjects\.codex-worktrees\makelore\20261011-rollback-makelore-platform-auth-7c4e9a2b
+- Base commit: f2a0eefc9ec5dfc2a09c15745b4786bc61682968
+- Owner: Codex
+- Status: Ready for Integration
+
+## Scope
+
+- Roll back the Makelore platform OIDC/SSO implementation introduced by
+  source commit `7236def` while leaving the main checkout and unrelated
+  product work untouched.
+- Reverse only the application code, tests, and README changes from that
+  source commit. Preserve all `.project-docs` source and integration history,
+  including the records for the original SSO work.
+- Keep the existing legacy Makelore login boundary and its current payment,
+  LMS, and local session behavior.
+
+## Intent And Constraints
+
+- Work only in this isolated feature worktree based on `f2a0eef`; do not
+  reset, delete branches, push, deploy, or modify the Makelore primary
+  checkout.
+- The rollback must not discard subsequent unrelated product changes or any
+  pre-existing primary-checkout content.
+- The canonical `.project-docs` files are shared project memory and remain
+  read-only in this feature task. Any semantic reconciliation after removing
+  the runtime implementation is a follow-up for an authorized integration
+  task.
+
+## Project Context Loaded
+
+Read:
+- `.project-docs/05-agent-entry/read-before-planning.md`
+- `.project-docs/05-agent-entry/memory-index.md`
+- `.project-docs/00-brief/project-positioning.md`
+- `.project-docs/30-worklog/current-state.md`
+- `.project-docs/10-decisions/decision-index.md`
+- `.project-docs/20-architecture/system-overview.md`
+- Relevant peer records `20261010-makelore-platform-sso-a1b2` and
+  `20261010-integrate-makelore-platform-sso-9c2d`
+- Repository `AGENTS.md`
+
+Relevant understanding:
+- `7236def` is the only source commit adding the Makelore platform OIDC
+  runtime, focused tests, and README behavior; `86216b8`, `afaefdc`, and
+  `f2a0eef` are project-memory records.
+- The rollback overlaps the prior SSO task by design, but no peer owns this
+  isolated worktree. Other active Makelore tasks concern unrelated product
+  areas.
+
+Gate result:
+- Passed
+
+## Implementation Plan
+
+1. Compare the source and current commit ranges and identify the exact
+   non-`.project-docs` paths introduced by `7236def`.
+2. Reverse those runtime, test, and README changes while retaining
+   `.project-docs` from the current base.
+3. Run focused legacy authentication tests, type checking, linting, and
+   whitespace/document drift checks.
+4. Record the committed rollback and leave the isolated branch ready for the
+   parent integration task.
+
+## Outcome
+
+- Created rollback commit `e28beff` by reversing the runtime, renderer,
+  deep-link, focused-test, and README changes from `7236def`.
+- Preserved the original SSO source task, integration task, and all other
+  `.project-docs` content from the current base. The non-`.project-docs`
+  tree now matches the pre-SSO baseline `87d3f03`.
+- No primary checkout, branch, remote, deployment, account, or provider state
+  was changed.
+
+## Verification
+
+- `git diff --name-status 87d3f03 HEAD -- . ':(exclude).project-docs/**'`
+  returned no paths, confirming the application/test/README rollback matches
+  the pre-SSO code baseline.
+- `git diff --check` passed.
+- Focused Vitest: 3 files / 60 tests passed.
+- `pnpm run typecheck` passed.
+- Scoped ESLint for the restored authentication paths passed.
+- `pnpm run build:vite` reached module transformation but failed while
+  writing ignored build output because D: had no free space (`ENOSPC`).
+- A renderer-only Vite build then passed with
+  `NIANCODE_RENDERER_ONLY=1 pnpm exec vite build --outDir
+  C:\Users\7brot\AppData\Local\Temp\codex-makelore-vite-rollback-20261011`.
+  It emitted 131 files (about 6.96 MB); only the existing dynamic-import and
+  large-chunk warnings were reported.
+- Read-only primary-worktree snapshot: the owner is integration task
+  `20261010-integrate-makelore-platform-sso-9c2d`, mode `integration`,
+  status `ready_for_integration`, on `main`. The primary has no staged or
+  modified tracked files and has exactly three pre-existing untracked task
+  records under `.project-docs/30-worklog/tasks/`.
+
+## Follow-ups
+
+- Reconcile the canonical `.project-docs` OIDC claims in a separately
+  authorized integration task before presenting the rollback as the current
+  product architecture.
+- Re-run the Vite build after dependency/build-output space is available.
+
+## Promotion Candidates
+
+- Target: canonical SSO architecture and current-state records.
+  Proposal: mark the platform OIDC client rollback and restore the legacy
+  Makelore login boundary.
+  Evidence: rollback commit `e28beff` and the exact no-diff comparison to
+  `87d3f03`.
+  Future impact: packaged clients continue using the legacy login route until
+  a replacement SSO implementation is explicitly approved.
+  Semantic conflict: current canonical project memory still records the
+  integrated OIDC design; an integration task must resolve that conflict.
+  Human confirmation: required before changing canonical project memory.