merge: integrate upstream main with local Makelore changes

.project-docs/30-worklog/current-state.md

@@ -4,6 +4,17 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 ## Integrated Through
 
+- Local source snapshot `33fb31fb285b5cfb00d194a036aaf6e21cf8c5a1`,
+  based on the prior local delivery `48a9189`, is integrated over fetched upstream
+  `62304dc85b3c1069cd656dfacb61ee820e216fa2` by task
+  `20260831-merge-upstream-main-7c3a91f2`. The integration preserves Plugin
+  Marketplace Release A and AI Design Living Form V2 while adopting one long-lived
+  parent Pi Agent Server with isolated per-Conversation logical Runtime, Session,
+  credential store, extension context, generation and JSONL channel. Parent logical
+  turns remain capped at 4, warm idle threads at 8, and independent child processes
+  at 4 against the FIFO process budget of 8. `.makelore/project.json` and
+  `.makelore/conversations.json` are authoritative; current code does not read or
+  migrate project metadata from `.niancode` or `.opencode`.
 - MakeLore curated Plugin Marketplace Release A source
   `40df677a31ff7651f962151eb84b925987781c03` from task
   `20260828-plugin-marketplace-client-5f8b3d72` is integrated by task
@@ -38,13 +49,15 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
   `20260826-integrate-pi-provider-fix-6e4c2a91`. The strict 101-commit
   fast-forward replaces OpenCode with pinned Pi `0.84.2` as Makelore Code's
   sole production runtime, adds schema-v2 project/Agent/Conversation storage,
-  persistent per-Conversation workers, product Snapshot/Patch contracts,
+  the predecessor persistent per-Conversation worker topology, product Snapshot/Patch contracts,
   `/api/coding/*`, Provider/resource isolation, extension/subagents, process
   and write budgets, and background-run uncertainty ownership. Implementation
   `a098266` additionally validates/persists an unresolved Conversation model
   before first prepare and converts the exact Works missing user-context
   response into a non-replayed Provider-auth failure after expiring the cached
-  gateway credential. The final Windows installer and final packaged Pi proof
+  gateway credential. Task `20260831-merge-upstream-main-7c3a91f2` supersedes
+  only that parent-process topology with the shared Agent Server described above.
+  The final Windows installer and final packaged Pi proof
   passed; real Provider turns remain explicitly waived with
   `realTurnVerified=false`, while macOS x64/arm64 and native non-WSL Linux
   remain unverified. Older OpenCode entries below are retained only as
@@ -176,7 +189,7 @@ Makelore 在会话恢复、登录和刷新后由 Electron Main 请求 Works `/ap
 
 AI 学习现在是已启用的运营精选项目目录，并继续受登录和 `module_access.learning` 控制。Renderer 通过 Main-owned Host API 获取分页项目卡片和 README 详情；Markdown 支持 GFM、禁用原始 HTML。服务端发布时只校验图片 URL 为无凭据、默认端口、无 fragment 且当前 DNS 结果全部为公网地址的 HTTPS URL，保留地址而不下载、识别格式、转码或镜像；客户端仅为 README 图片节点启用直连，因此 SVG 和 Electron 支持的其他格式可直接显示，单图失败不阻断详情。封面和历史发布媒体继续走受控路径。详情页的下载按钮打开系统保存对话框；Main 将 ZIP 流式写入临时文件，只允许最多五跳同 Works origin 重定向，不校验 `Content-Length`、`archiveBytes`、实际流字节数或客户端大小上限，校验 SHA-256 和 ZIP 签名后原子保存，Renderer 只接收 `saved` 或 `cancelled`。课程生成、进度、本地课程库、OpenMAIC player、Agent、ASR、课堂 runtime、Learning IPC 和 player artifact 打包已删除且没有兼容读取路径；历史课程数据保留但不再读取。服务端和客户端源码契约已完成，不代表生产部署或真实账号安装包联调已经完成。
 
-AI 编程已经硬切到精确 pin 的 Pi `0.84.2`，不存在 OpenCode fallback 或双 runtime。project、Agent 与 Conversation 采用本地 schema v2；旧 OpenCode 会话只做备份，不继续执行。每条 active/warm Conversation 拥有独立 persistent worker/session、generation/seq、Snapshot/Patch、model/thinking、队列、interaction 与错误状态，Composer 在 lazy prepare 期间仍可编辑。Renderer 只通过 `/api/coding/*` 和 Snapshot-first/`patch-batch` SSE 消费产品中立合同；gap/reconnect 只恢复目标 Conversation，accepted/uncertain mutation 不自动重放。未解析 Conversation 第一次选模先 validate 并持久化 resolved metadata，再 prepare；同账号模型切换使用 target `set_model`，跨账号只重建目标 worker。top-level/child 并发分别为 4，共享总进程预算 8，warm idle LRU 4；coding child 与 parent 共用项目 write lease。prompt/compact confirmation timeout 后仍保留 run/process/background ownership，迟到 success/failure/exit/abort 单调且 exactly-once 收敛，页面隐藏不会停止 active/uncertain run。Pi `0.84.2` 手动 compact 不发 `agent_settled`，由 correlated compact RPC 结果终结。Provider credential 只进入选中 worker env；确定性的 Works user-context 缺失会失效 gateway credential、fail fast、不重放并投影固定 Provider-auth 错误，不归类为 Pi worker crash。真实 Provider 验证仍为用户明确接受的未验证风险，macOS x64/arm64 与 native non-WSL Linux 也未通过平台发布门禁。
+AI 编程已经硬切到精确 pin 的 Pi `0.84.2`，不存在 OpenCode fallback 或双 runtime。project、Agent 与 Conversation 只在 `.makelore/project.json` 和 `.makelore/conversations.json` 使用本地 schema v2；当前客户端不从 `.niancode` 或 `.opencode` 读取、迁移或删除项目元数据。Electron Main 按需启动一个长驻父 Agent Server，每条 active/warm Conversation 在其中拥有独立 Runtime/Session/channel、credential store、extension context、generation/seq、Snapshot/Patch、model/thinking、队列、interaction 与错误状态，Composer 在 lazy prepare 期间仍可编辑。Renderer 只通过 `/api/coding/*` 和 Snapshot-first/`patch-batch` SSE 消费产品中立合同；gap/reconnect 只恢复目标 Conversation，accepted/uncertain mutation 不自动重放。未解析 Conversation 第一次选模先 validate 并持久化 resolved metadata，再 prepare；同账号模型切换使用 target `set_model`，跨账号只重建目标逻辑线程。top-level 逻辑 turn 并发为 4，warm idle logical-thread LRU 为 8；independent child 进程并发为 4 并使用 FIFO 进程预算 8；coding child 与 parent 共用项目 write lease。prompt/compact confirmation timeout 后仍保留 run/Agent-Server-or-child-process/background ownership，迟到 success/failure/exit/abort 单调且 exactly-once 收敛，页面隐藏不会停止 active/uncertain run。线程级替换只使目标 generation 失效；整个 Agent Server 退出会统一使所有旧 channel 失效，但 Main/Renderer 存活且下次恢复只重启一个 Server。Pi `0.84.2` 手动 compact 不发 `agent_settled`，由 correlated compact RPC 结果终结。父 Provider credential 只进入选中逻辑线程的内存 credential store，child 凭据只进入该短命进程；确定性的 Works user-context 缺失会失效 gateway credential、fail fast、不重放并投影固定 Provider-auth 错误，不归类为 Pi crash。真实 Provider 验证仍为用户明确接受的未验证风险，macOS x64/arm64 与 native non-WSL Linux 也未通过平台发布门禁。
 
 Updater 仍由 Electron Main 选择目标 feed、记录原始诊断并保持失败语义。正式稳定源缺少对应平台 manifest 时，设置页只显示一条简洁中文提示并允许重试，不把缺包误报为已是最新版，也不向普通界面暴露堆栈、URL、路径或错误码；签名产物发布和真实升级安装仍属于外部 Release Gate。
 
@@ -184,6 +197,7 @@ Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选
 
 ## Recently Completed
 
+- 2026-08-31: Integrated the occupied local source snapshot over upstream Marketplace Release A and AI Design Living Form V2. Makelore Code now amortizes parent Pi startup through one long-lived Agent Server while preserving isolated per-Conversation logical runtimes, sessions, credentials, extensions and channels; child Agents remain independent processes. ADR-006 and current architecture now use `.makelore` as the sole project configuration source and explicitly reject legacy metadata reads or migration.
 - 2026-08-26: Fast-forwarded the complete Pi hard-cutover and installed-package resilience chain into local `main`, including per-Conversation workers/Snapshot projection, extension/subagents, bounded process/write/background ownership and the deterministic Works user-context Provider-auth correction. The final Windows installer, packaged Pi runtime, extension/child, 4+4 pressure, uncertainty/late-settle and zero-lingering-process proofs passed. Real Provider turns are explicitly waived rather than passed; macOS and native non-WSL Linux remain release evidence gaps.
 - 2026-08-20: Replaced AI Learning's course generation/player stack with the curated project catalog defined by ADR-005. The authenticated/module-gated client now renders project cards and safe README detail, loads validated credential-free HTTPS Markdown images directly, and saves verified ZIP archives through the native dialog. Old course/runtime/player packaging was removed; server/client regressions and full suites passed, while production deployment and real-account package smoke remain pending.
 - 2026-08-19: Integrated native password/SMS login, the temporary HTTP/2-disabled diagnostic bootstrap, and the AI Design freeze fix. Workspace JSON calls and shared token refresh now settle within 30 seconds, transport abort is paired with deterministic rejection, and implicit Electron-to-Node fallback no longer replays mutation requests. Installed-client Quote retry/confirm smoke and the final HTTP/2 policy decision remain pending.
@@ -251,11 +265,11 @@ Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选
 - 客户端对最终构建字节的 loopback 检查没有可信 receipt，且不复刻生产 opaque-origin；服务端必须独立重算 source/built/contract、校验不可变 Release，人工审核仍不可绕过。如未来需要不可绕过的 runtime gate，必须引入可信 verifier 并绑定精确构建产物。
 - Pi RPC confirmation timeout 是不确定性边界，不是释放 run permit、process ownership 或 Main background lease 的依据；accepted/uncertain mutation 不得自动重放，迟到 terminal 必须 exactly-once 收敛。隐藏/显示、abort、recover、replacement 与 app quit 都必须保留可解释 reason 并最终清零 ownership。
 - Pi `0.84.2` 手动 compact 不发 `agent_settled`。只有 correlated compact RPC success 或权威 compaction failure 可以结束 compact；普通 prompt 仍需自己的 terminal/settled 语义，不能相互释放 lease。
-- 本地 provider-shaped loopback 和 4+4 process proof 证明客户端序列化、调度与隔离 seam，不证明真实 Provider 会并发、不会限流或正确隔离账号凭据。真实认证、endpoint/proxy/rate-limit、协议和图片差异仍为 `Explicitly Waived / Accepted Risk`，`realTurnVerified=false`。
-- Provider/resource freshness 属于目标 Conversation worker generation。idle stale 在下一 prompt 前重建，running stale 在 settled 后重建；同账号 refresh single-flight 且最多一次 reopen。确定性 Works user-context 缺失必须失效缓存凭据并 fail fast，不能触发无限 Pi 重试、自动 replay 或把 Provider 故障写成 runtime crash。
+- 本地 provider-shaped loopback 和单一 Agent Server 内 4 条重叠父逻辑线程 + 4 child process proof 证明客户端序列化、调度与隔离 seam，不证明真实 Provider 会并发、不会限流或正确隔离账号凭据。真实认证、endpoint/proxy/rate-limit、协议和图片差异仍为 `Explicitly Waived / Accepted Risk`，`realTurnVerified=false`。
+- Provider/resource freshness 属于目标 Conversation logical-thread generation。idle stale 在下一 prompt 前重建，running stale 在 settled 后重建；同账号 refresh single-flight 且最多一次 reopen。确定性 Works user-context 缺失必须失效缓存凭据并 fail fast，不能触发无限 Pi 重试、自动 replay 或把 Provider 故障写成 runtime crash。
 - AI Design 图片/视频引用必须以 typed Asset binding 写入 Specification，不能从本地化 quick reply、V1 Brief 或本地路径推断 action/purpose。
 - Updater 源码错误提示不能代替发布正式签名产物；稳定 feed 缺 manifest 必须保持失败，Renderer 不得展示原始堆栈、URL、路径或错误码。升级链只有在旧版本完成发现、下载、重启和安装 smoke 后才可视为生产就绪。
 
 ## Last Updated
 
-2026-08-30
+2026-08-31

.project-docs/30-worklog/tasks/20260831-merge-upstream-main-7c3a91f2.md

@@ -0,0 +1,81 @@
+# Task: Merge upstream updates into main
+
+## Identity
+
+- Task ID: 20260831-merge-upstream-main-7c3a91f2
+- Mode: Integration
+- Branch: codex/20260831-merge-upstream-main-7c3a91f2-merge-upstream-main
+- Worktree: /Users/inmanx/Documents/makelore-merge-upstream-main-7c3a91f2
+- Base commit: 62304dc85b3c1069cd656dfacb61ee820e216fa2
+- Owner: codex
+- Status: Ready for Integration
+
+## Scope
+
+- Integrate the occupied local `main` worktree's tracked source changes and intentional source/test additions, based on `48a9189`, onto fetched `origin/main` at `62304dc`.
+- Preserve the upstream Plugin Marketplace Release A and AI Design Living Form V2 integrations while resolving overlapping local Code, auth, navigation, Canvas utility, project-data, and documentation changes semantically.
+- Exclude the untracked generated `resources/learning-player/` artifact from Git without deleting it locally.
+- Promote the verified integration result to the local `main` branch; do not push to the remote.
+
+## Intent And Constraints
+
+- Capture the dirty source work as a non-destructive snapshot commit before attempting a three-way merge.
+- Do not overwrite the tree with either side wholesale. Preserve Main-owned runtime, authentication, project-data, cloud Canvas, Marketplace trust, and packaging boundaries.
+- Treat the user's explicit instruction to merge the local changes into `main` as confirmation to adopt the local single-Agent-Server parent-process topology and reconcile ADR-006/current architecture accordingly.
+- Keep source task records read-only. Record integration decisions and verification only in this integration task record and canonical Integration-Gate documents.
+- Do not commit dependencies, downloaded runtimes, generated build output, reports, caches, secrets, or local user data.
+
+## Outcome
+
+- Captured the occupied local source tree without mutating it as commit
+  `33fb31fb285b5cfb00d194a036aaf6e21cf8c5a1` on
+  `codex/local-main-snapshot-20260831-7c3a91f2`. The generated 93 MiB
+  `resources/learning-player/` directory was deliberately excluded from Git and
+  remains in the original worktree.
+- Merged that snapshot into upstream `62304dc85b3c1069cd656dfacb61ee820e216fa2`
+  with semantic conflict resolution. Plugin Marketplace Release A, Data Service,
+  AI Design Living Form V2, cloud-only Canvas, project identity, module access,
+  local voice input, conversation navigation, and the local `.makelore`-only
+  project-data boundary are all retained.
+- Adopted one long-lived parent Pi Agent Server with isolated per-Conversation
+  Runtime, Session, credential store, extension context, generation and JSONL
+  channel. Thread configuration is supplied by a per-thread extension factory
+  closure rather than process-global environment mutation or late CLI flag
+  injection. Child Agents remain independent short-lived processes.
+- Reconciled ADR-006, the decision index, architecture maps, domain rules, success
+  criteria, current-state memory, README, release runbook and tests with the new
+  topology and `.makelore` authority. Plugin selection now persists at
+  `.makelore/plugins.json`; no project metadata is read or migrated from
+  `.niancode` or `.opencode`.
+- Promoted the streaming-preview behavior into the canonical README while leaving
+  its source task record unchanged on source snapshot `33fb31fb`; the Integration
+  Gate intentionally does not copy task-owned source records into the integration
+  result.
+- Ready to commit the merge result and fast-forward the occupied local `main`;
+  no remote push is in scope.
+
+## Verification
+
+- `pnpm install --frozen-lockfile` with exact `pnpm@10.33.4`: passed.
+- `pnpm run typecheck`: passed.
+- Merge-focused Vitest set: 14 files / 121 tests passed.
+- `pnpm test`: 212 files / 1,726 tests passed; 3 staged-runtime-only tests skipped.
+- `pnpm run lint:check`: passed with zero errors and five existing warnings
+  (`Home/index.tsx` hook dependency and four `Makelore/index.tsx` Fast Refresh warnings).
+- `pnpm run build:vite`: passed for Renderer, Electron Main, Preload and utility worker;
+  existing dynamic-import and large-chunk warnings remain non-fatal.
+- Focused `pnpm run test:e2e` for app smoke, main navigation, Pi first chat,
+  project configuration Skills and Coding project identity: 13/13 passed.
+- `git diff --check`: passed; unresolved merge path count is zero.
+
+## Follow-ups
+
+- Existing release gates remain unchanged: official Marketplace Ed25519 trust-key
+  activation, real Provider validation, macOS x64/arm64 and native non-WSL Linux
+  packaged evidence are not promoted to Pass by this merge.
+
+## Promotion Candidates
+
+- The final integration merge commit on
+  `codex/20260831-merge-upstream-main-7c3a91f2-merge-upstream-main`, after the
+  project-doc drift gate passes.