docs(coding): record ML-07 remediation

.project-docs/30-worklog/tasks/20260827-makelore-plugin-client-7d3a91c4.md

@@ -8,7 +8,7 @@
 - Worktree: D:\Datas\OthersProjects\makelore-plugin-client-7d3a91c4
 - Base commit: eb5d15d68470b30ec181164f08f0d7b027ef0006
 - Owner: codex-root
-- Status: In Progress (ML-00 through ML-06 complete; ML-07 fixed-range review pending)
+- Status: In Progress (ML-07 remediation integrated; repeat fixed-range review pending)
 
 ## Scope
 
@@ -135,6 +135,14 @@
   core coding resources, and final Pi runtime artifact. The implementation range
   contains no arbitrary plugin execution, generic invoke/config/ledger,
   marketplace, publication coupling, `plugin_charges`, Plugin Credits, or P1 code.
+- The first ML-07 fixed-range review over exact `eb5d15d...9407c67` returned
+  Standards FAIL and Spec FAIL. Ten independent accepted root causes were assigned
+  to one isolated remediation owner; the package-parser duplication finding was
+  reported by both axes and counted once. Source remediation commit
+  `2492f8af5ba27d914b2c0b2789b46f78305c924d` had exact parent
+  `9407c67df21c2f0f50bb0362c826fcff643d9d5f` and was integrated without conflict
+  as coordinator product commit `cf13aa7`. The foreign remediation task record is
+  removed from this coordinator while remaining in its source worktree.
 
 ## Verification
 
@@ -348,6 +356,30 @@
   generic ledger/config/invoke, marketplace/publication coupling, checksums, or
   P1 implementation.
 
+## ML-07 First Review And Remediation
+
+- Fixed range `eb5d15d68470b30ec181164f08f0d7b027ef0006` through
+  `9407c67df21c2f0f50bb0362c826fcff643d9d5f`: Standards FAIL and Spec FAIL.
+  Accepted issues were production package-parser/static-definition duplication,
+  disabled Skill implicit activation, missing preview/exact operation policy join,
+  the direct Pi Data Service fallback, missing request/fault evidence, unbounded
+  policy fetch/body, ready-enable settings loss, unsafe Skill-ID typing,
+  out-of-order project-load commits, and stale README inventory.
+- The sole remediation commit makes the parsed frozen package definitions the Main
+  authority; projects three capabilities/fourteen exact operations while keeping
+  preview non-tool; removes the second Pi direct path; makes disabled retained Skill
+  availability explicit; bounds policy refresh; preserves ready settings on enable;
+  uses `CodingSkillId`; guards A/B loads; and updates README.
+- Source verification: focused 10 files / 60 tests; full 202 files / 1,680 passed /
+  2 staged-runtime skips; typecheck passed; ESLint 0 errors with the same 5 existing
+  warnings; full Windows build/NSIS passed; Pi artifact proof passed with four core
+  Skills plus the package-owned Data Service. Stable replay and one-401-refresh
+  request identity remains `pi:run-a:resource-a`; all ten tools traverse the real
+  adapter/registry/conversation parser with bounded quota, size, revision, and
+  Retry-After contexts.
+- Repeat Standards and Spec review must use the unchanged base `eb5d15d...` and the
+  post-remediation coordinator documentation checkpoint as its exact head.
+
 ## Follow-ups
 
 - ML-07 must review the fixed committed range from exact