docs(project): record marketplace client remediation

.project-docs/30-worklog/tasks/20260828-marketplace-mlm06-remediation-6d3a9c82.md

@@ -1,255 +0,0 @@
-# Task: Marketplace MLM-06 fixed-range remediation
-
-## Identity
-
-- Task ID: 20260828-marketplace-mlm06-remediation-6d3a9c82
-- Mode: Feature
-- Branch: codex/20260828-marketplace-mlm06-remediation-6d3a9c82-marketplace-mlm06-remediation
-- Worktree: D:\Datas\OthersProjects\makelore-plugin-marketplace-client-mlm06-remediation-6d3a9c82
-- Base commit: 8dfa5428606076b847966750134061de6fbe91ba
-- Owner: marketplace-mlm06-remediator
-- Status: Ready for Integration
-
-## Scope
-
-- Implement the sole MLM-06 fixed-range remediation from the exact reviewed
-  client head `8dfa5428606076b847966750134061de6fbe91ba`.
-- Close all 11 deduplicated actionable roots from the Standards and Spec reviews:
-  skill/package-root pairing; explicit device uninstall; packaged trust proof;
-  precise package-store orphan recovery; same-account Library read ordering;
-  README architecture/product synchronization; whole-response Marketplace
-  deadlines; cached-release rollback current selection; cross-plugin mutation
-  intent ordering; explicit-beta Main/My Plugins action; and bounded yanked,
-  incompatible, signature, and unavailable projections.
-- Own only the remediation seams and their focused tests: `electron/coding-plugins`
-  registry/resource loading, Package Store/account cache/marketplace client and
-  lifecycle seams; the packaged artifact verifier and proof; Main Marketplace
-  beta/status projection; Renderer Marketplace/My Plugins stores/facades/pages;
-  `README.md`; and this task record. Preserve all unrelated changes already in
-  the coordinator product head.
-
-## Intent And Constraints
-
-- Use one isolated feature worktree and one source commit. The source commit must
-  have sole parent `8dfa5428606076b847966750134061de6fbe91ba`, be clean, and end
-  in `READY_FOR_INTEGRATION` after task documentation gates.
-- Keep every mutation behind the existing Main Host API and closed DTOs. Do not
-  add Provider/hosted runtime, billing, Token Point, arbitrary code/MCP/hooks,
-  project schema changes, or XMA-01/live/deployment work.
-- Preserve the single frozen effective snapshot. Every Skill entry must remain
-  paired with its verified package root through resource loading, bridge, CLI,
-  and lifecycle consumers; no compatibility union or first-match root fallback.
-- Explicit device uninstall is distinct from Library remove: it may remove an
-  unprotected installed package, while active workers and account snapshots keep
-  their releases protected and Library rows remain intact.
-- Packaged trust proof must inspect the actual packaged `app.asar`/build artifact
-  trust source and prove no private key; checkout source files are not evidence.
-- Orphan recovery may reuse/remove only the exact, fully validated matching
-  plugin/release package left by the interrupted rename/index sequence.
-- Same-account Library reads use current selection intent/generation; the
-  different-plugin mutation race uses its own request intent/epoch allocated
-  before the request. Account A/B isolation, duplicate coalescing, and explicit
-  beta/current-versus-stable semantics remain intact.
-- Request deadlines cover both Marketplace response headers and body consumption
-  under one overall Abort/deadline. Rollback changes the Package Store current
-  selection while retaining immutable releases and active-worker freeze.
-- UI changes stay in the existing light design system, use bounded user copy and
-  explicit transitions/hit targets, and record Before/After interface impact in
-  this task record. Keep the official platform public-key production activation
-  hold explicit.
-
-## Project Context Loaded
-
-Task context:
-- Task ID: `20260828-marketplace-mlm06-remediation-6d3a9c82`
-- Mode: Feature
-- Branch: `codex/20260828-marketplace-mlm06-remediation-6d3a9c82-marketplace-mlm06-remediation`
-- Worktree: `D:\Datas\OthersProjects\makelore-plugin-marketplace-client-mlm06-remediation-6d3a9c82`
-- Base commit: `8dfa5428606076b847966750134061de6fbe91ba`
-- Other active local tasks: Marketplace coordinator; earlier MLM-01 through
-  MLM-05 records/worktrees; MLM-06 Standards and Spec fixed-range review records.
-- Overlap or semantic-conflict assessment: Overlap is intentional and limited to
-  the listed review-accepted seams. No peer may write this remediation worktree,
-  and no semantic conflict remains with the accepted Release A boundary. The
-  same-account Library read race and different-plugin mutation race are separate
-  state-intent problems with separate tests and guards. User root worktrees and
-  all server/Operations worktrees remain out of scope.
-
-Read:
-- `C:\Users\7brot\.agents\skills\implement-spec\SKILL.md`
-- `C:\Users\7brot\.codex\skills\maintain-project-docs\SKILL.md`
-- `C:\Users\7brot\.codex\skills\make-interfaces-feel-better\SKILL.md` and
-  `typography.md`, `surfaces.md`, `animations.md`, `performance.md`
-- `D:\Datas\OthersProjects\makelore\AGENTS.md`, project-memory startup set,
-  architecture/domain/evidence/reflection/commitment/stale indexes, and peer
-  task records
-- canonical Marketplace implementation spec, ticket graph, and accepted design
-  proposal in `D:\Datas\PythonProjects\works-square-server-plugin-marketplace-spec-7c2e9a41`
-
-Relevant understanding:
-- Main owns authentication, filesystem, Marketplace access, package trust,
-  install paths, release/admission authority, and bounded error projection;
-  Renderer consumes closed safe projections only.
-- Release A separates Operations publication, account Library, device install,
-  project selection, Agent assignment, runtime authorization, and billing.
-  Acquire/download/install/update/enable/assignment never write Token Points.
-- Schema-v1 bundled Data Service and schema-v2 declarative `skill_only` remain
-  the only active runtime paths. Release B Provider/hosted/charges is closed.
-- The coordinator head already passed the first fixed-range reviews except the
-  listed review roots. This task must preserve its single effective resolver,
-  frozen worker snapshots, account isolation, and current UI contract.
-
-Gate result:
-- Concurrent Task Gate: Passed. `check_project_docs.py` passed; task-context
-  ownership exactly matches the task ID, owner, feature mode, branch, isolated
-  worktree, and exact base.
-- Planning Gate: Passed. Required memory/spec/design/peer scope was read; the
-  accepted review findings provide disjoint, explicit ownership and no unresolved
-  semantic conflict blocks the remediation plan.
-
-## Implementation Plan
-
-1. Add failing tests for each accepted root at its existing seam, including
-   duplicate relative Skill paths, install/delete protection states, app.asar
-   trust proof, exact orphan recovery, header/body timeout, rollback projection,
-   same-account read intent, cross-plugin mutation epochs, explicit beta/status
-   projections, and bounded UI copy/routes.
-2. Implement the smallest cohesive fixes in registry/resource loader, package
-   store/account cache/marketplace client, verifier, Main projection, and
-   Renderer store/pages. Keep immutable release and account/admission boundaries.
-3. Run focused and adjacent unit suites after each red/green seam, then typecheck,
-   lint, Vite build, Marketplace E2E, Windows Electron/package/artifact proof,
-   and document drift. Record unrelated baseline failures without widening scope.
-4. Update outcome/verification and complete task-context only after a clean single
-   source commit with the exact sole parent.
-
-## Outcome
-
-- Implemented the complete MLM-06 fixed-range remediation in the isolated client
-  worktree without changing the coordinator or user root worktrees. The single
-  frozen effective snapshot now preserves each marketplace Skill with its
-  verified package root, and the same pairing flows through resource loading,
-  Extension Host registration, CLI/context, and lifecycle consumers. Package
-  Store state now has an explicit current-release selection, exact orphan
-  recovery, explicit device uninstall, active-worker protection, and account
-  resolve-cache invalidation without changing Library membership. Marketplace
-  body and header reads share one bounded deadline; Main exposes the explicit
-  beta action and bounded release/library/runtime errors; Renderer state keeps
-  same-account reads and cross-plugin mutations ordered by their own intent
-  generations. The packaged proof reads the actual app.asar trust seam and
-  records a code-owned, empty, fail-closed trust table with no private-key or
-  runtime-key override. README now documents the Marketplace/My Plugins/Project
-  Plugins separation and Main/Package Store/effective-runtime architecture.
-
-### Fixed-range roots
-
-1. Skill/package-root pairing: effective snapshot entries retain the verified
-   package root; resource loading no longer selects the first matching root, and
-   collision coverage proves two same-relative-path Skills stay isolated.
-2. Device uninstall: explicit uninstall removes only the unprotected device
-   package and its account resolve-cache entry; Library rows remain, active
-   workers and snapshots remain protected, and a later resolve can reinstall.
-3. Packaged trust proof: verifier reads compiled JavaScript from the actual
-   app.asar, recognizes the code-owned provenance marker plus empty frozen
-   table, and rejects environment/private-key material. The official production
-   Ed25519 public key is still an explicit activation HOLD.
-4. Orphan recovery: a crash left between release-directory rename and index
-   write recovers only the exact plugin/release directory with its matching
-   archive and fully validated descriptor/artifact/signature/compatibility;
-   unrelated or incomplete directories remain conflicts.
-5. Same-account Library reads: generation and mutation-epoch guards prevent an
-   older response from replacing a newer read intent while preserving duplicate
-   request coalescing.
-6. Documentation: README covers Marketplace, My Plugins, Project Plugins,
-   Main, Package Store, effective snapshots, skill-only scope, and production
-   key activation HOLD.
-7. Request deadline: Marketplace headers and bounded body consumption execute
-   under one Abort/deadline, including never-body response coverage.
-8. Rollback selection: cached immutable releases switch an explicit Package
-   Store current pointer; projections and next workers use that pointer rather
-   than installed-time ordering, while active workers stay frozen.
-9. Library mutation ordering: each mutation allocates its request intent before
-   sending; stale responses cannot overwrite newer different-plugin mutations,
-   with both completion orders and account A/B isolation covered.
-10. Explicit beta: Main has a real beta route/facade and My Plugins exposes a
-    user-triggered Beta action only; beta never follows stable rollout buckets
-    or auto-acquires a release.
-11. Bounded status projection: yanked, incompatible, signature, artifact,
-    runtime-suspended, library-required, and backend-unavailable results remain
-    distinct through Main/Host/Renderer routes and bounded My Plugins copy,
-    including cached/unavailable Library entries.
-
-### Interface impact
-
-- Before: My Plugins and Project Plugins could expose stale or ambiguous
-  installation state, and release errors collapsed into generic unavailable
-  messages; Marketplace requests could hang after headers; Beta had no explicit
-  Main action.
-- After: the existing light design system presents explicit Beta, install,
-  unavailable, and rollback-aware states with bounded Chinese copy, stable hit
-  targets, and independent loading/mutation transitions. No new authority,
-  account identity, filesystem path, or open-ended runtime payload crosses into
-  Renderer.
-
-## Verification
-
-- Planning/concurrency gates: `check_project_docs.py` passed; task-context
-  identity matched task ID, owner, feature mode, branch, isolated worktree, and
-  exact base `8dfa5428606076b847966750134061de6fbe91ba`.
-- First natural RED: the five review-targeted suites reported **33 passed / 9
-  failed**; failures covered unpaired same-entryPath Skill roots, uninstall
-  remaining kept, missing packaged trust reader, never-body deadline, and stale
-  intent commits. No source implementation was treated as green before these
-  failures were observed.
-- Focused GREEN checkpoints: initial package/resource seams **18 + 8 passed**;
-  final fixed-range focused run **8 files / 82 passed**; post-marker trust and
-  contract run **2 files / 30 passed**; the broader focused checkpoint was **9
-  files / 101 passed**. Adjacent Marketplace/Pi/Host/Package Store suites were
-  **13 files / 66 passed**.
-- `pnpm exec vitest run --exclude tests/unit/coding-chat-pressure.test.tsx
-  --maxWorkers=1`: **208 files / 1779 passed / 2 skipped**. The repository
-  `pnpm test` 4-worker attempt reached **207 files / 1769 passed / 2 skipped**
-  before one Vitest worker exited unexpectedly without an assertion failure;
-  the serial rerun is the final full-unit evidence.
-- `pnpm exec vitest run tests/unit/coding-chat-pressure.test.tsx
-  --maxWorkers=1`: **1 file / 1 passed**.
-- `pnpm run typecheck`: passed after the final trust-marker change.
-  `pnpm run lint:check`: **0 errors**, five existing warnings in
-  `src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`.
-- `pnpm run build:vite`: passed for Renderer, Main, Preload, and utility
-  bundles; only existing dynamic-import/chunk-size warnings. The final
-  `pnpm run package:stage:win-x64` also passed with **130 packages / 6 assets**.
-- `pnpm run test:e2e`: **27 passed / 1 failed**. Marketplace catalog/detail
-  flow and Project Plugins passed. The one unchanged baseline failure is
-  `tests/e2e/pi-coding-first-chat.spec.ts:539`: the existing `当前对话模型`
-  combobox remained disabled during `selectOption` until its 30-second timeout;
-  no Marketplace test failed.
-- `pnpm run test:electron:windows`: **2 files / 6 passed**.
-- `pnpm run package:win`: Python win32-x64 and x64 staging were successful, but
-  the required win32-arm64 uv download from GitHub failed with
-  `UND_ERR_CONNECT_TIMEOUT`; this is recorded as an environment deviation and
-  is not claimed as a full package:win pass. Direct Electron Builder then
-  produced the x64 unpacked/NSIS artifact successfully.
-- `pnpm run verify:artifact:pi`: passed against the actual fresh Windows
-  `app.asar`; Marketplace proof reports
-  `official-key-absent-fail-closed`, `productionKeyIds=[]`, and
-  `privateKeyMaterialInTrustSource=false`, with packaged Pi closure, bundled
-  Data Service resources, extension markers, and runtime probe passing. The
-  verifier no longer reads checkout `trusted-keys.ts`.
-- Pre-commit source checks: `git diff --check` and the fixed-range forbidden
-  source scan passed. No Provider/hosted runtime, billing, Token Point,
-  arbitrary code/MCP/hooks, publication, XMA-01, push, PR, or deploy was added.
-
-## Follow-ups
-
-- Official platform Ed25519 public key material has not been supplied; keep
-  production activation on HOLD. Tests use only injected temporary key stores,
-  and no production private key was generated or committed.
-- The full multi-architecture `package:win` remains dependent on the external
-  GitHub win32-arm64 uv download; x64 artifact evidence is separate and
-  complete. Keep the known disabled-model-combobox E2E baseline visible until
-  its owning runtime test is fixed.
-
-## Promotion Candidates
-
-- None recorded.

.project-docs/30-worklog/tasks/20260828-plugin-marketplace-client-5f8b3d72.md

@@ -112,6 +112,12 @@
   commit `3ab257d3f0226ecba40166f306b939319061e551` was integrated without
   conflict as coordinator product commit
   `43c464a556d32a1ac564a5bb79f92741c4d9d635`.
+- MLM-06 fixed-range Standards and Spec review found eleven deduplicated roots.
+  The sole remediation task `20260828-marketplace-mlm06-remediation-6d3a9c82`
+  completed from exact frontier `8dfa5428606076b847966750134061de6fbe91ba`
+  as source commit `291b64ab0ef4779a44e09a386de31332abe1f57b` and was integrated
+  without conflict as coordinator product commit
+  `1614f7efc1fc81efc3b4d1c80827948976f1427b`.
 
 ## Outcome
 
@@ -148,6 +154,13 @@
   unknown project IDs, typed Data Service settings, account/project generation, and
   mutation epochs are bounded in Renderer state. No account, filesystem path,
   Release Admission, token, or signed URL authority enters Renderer.
+- MLM-06 remediation paired every frozen Skill with its verified package root,
+  separated explicit device uninstall from Library removal, added exact Package
+  Store orphan recovery and current-Release selection, bounded whole-response
+  deadlines, and serialized same-account reads and cross-Plugin mutations by intent.
+  It also exposed explicit beta and bounded unavailable states through Main/Renderer,
+  made the packed trust proof read the real `app.asar`, and synchronized README.
+  Official-key absence remains a fail-closed production activation hold.
 
 ## Verification
 
@@ -198,6 +211,18 @@
   found schema-2 `skill_only`, unknown-key fail-closed, Library/install/update/
   effective routes, Renderer assets, and no private-key/runtime-key override.
   Official public-key production trust remains HOLD.
+- MLM-06 verification passed focused 82 tests, trust/contract 30 tests, adjacent 66
+  tests, complete single-worker Vitest `1779 passed, 2 skipped`, the pressure case,
+  typecheck, lint with zero errors and five unchanged warnings, Vite build, six
+  Windows Electron tests, and Marketplace E2E. Full E2E passed 27 of 28; the only
+  failure remained the unchanged disabled-model-combobox timeout. The four-worker
+  unit run reached 207/208 files and 1769 passes before one assertion-free worker
+  exit; the complete one-worker rerun is the product result. Windows x64 staging and
+  building passed; the aggregate `package:win` arm64 uv download hit an external
+  GitHub connect timeout. Both Pi and Windows artifact verifiers passed on the clean
+  final source commit, with embedded `gitCommit` and `verificationHead` equal to
+  `291b64a...`; the real packed trust source contains no private key and fails closed
+  while the official public key is absent.
 
 ## Follow-ups