merge: integrate per-user module access

.project-docs/30-worklog/tasks/20260813-sync-push-main-9c2f71.md

@@ -12,6 +12,7 @@
 
 ## Scope
 
+- On 2026-08-17, resume the existing Integration owner after the user's explicit takeover authorization to preserve the task's existing uncommitted record, merge reviewed Makelore module-access source tip `3b799af` into local `main`, promote its accepted per-user entry-policy facts, run merged-tree verification and independent review, and keep remote push outside this resumption unless separately authorized.
 - On 2026-08-16, resume the existing Integration owner after the user restored remote credentials: fetch authoritative `origin/main`, complete the already-started merge of remote tip `26b52d7`, preserve both remote Canvas/Prompt Museum work and local Robot hotspot work, run merged-tree verification and independent review, then perform a normal non-forced push and verify remote-tip equality.
 - On 2026-08-16, resume the existing Integration owner to merge reviewed cross-platform in-app Robot hotspot connection source `c1326a2` into local `main`, supersede only ADR-002's manual operating-system hotspot-selection step, preserve firmware/credential/Binding boundaries, and keep remote push outside this resumption.
 - On 2026-08-16, resume the existing Integration owner to merge reviewed default-on Guided Hotspot Binding source `b78fc07` into local `main`, accept the user's explicit reversal of the prior default-off policy, preserve exact environment value `0` as rollback, and keep firmware edits and remote push outside this resumption.
@@ -52,6 +53,7 @@
 - The user's latest instruction explicitly authorizes default-on and supersedes only the earlier default-off/capability-not-enabled constraint. It does not authorize firmware changes, automatic discovery/claim claims, arbitrary portal URLs, Wi-Fi credential handling, or remote push. Missing installed-Electron/physical-device evidence remains an explicit residual release risk, not completed evidence.
 - The user has now explicitly authorized page-owned selection and connection of nearby open `Xiaozhi-*` provisioning hotspots on both Windows and macOS. This supersedes only manual operating-system hotspot selection; discovery remains unauthenticated convenience, Main remains the sole native-network owner, and signed macOS plus physical-Robot smoke remain release gates.
 - The latest instruction explicitly authorizes fetching, semantically resolving conflicts, and pushing `main`. Use the existing merge topology; do not rebase, reset, stash, discard remote/local commits, or force-push. Preserve remote Prompt Museum/Canvas/Chinese-only/Skill behavior alongside the already reviewed local Robot native hotspot path and `koffi` packaging.
+- The 2026-08-17 takeover confirmation authorizes continuing this existing Integration owner while preserving its uncommitted task history. For module access, source-task records remain read-only; the policy is a client entry/initialization gate rather than API authorization, and release acceptance requires the matching Works migration/API, a newly packaged client, and real-account four-module smoke.
 
 ## Project Context Loaded
 
@@ -99,6 +101,14 @@ Relevant understanding:
 Gate result:
 - Passed.
 
+### 2026-08-17 Per-User Module Access Integration Resume
+
+- Reused the existing Integration owner after the user explicitly authorized takeover while preserving its uncommitted record. Registry status still identifies task `20260813-sync-push-main-9c2f71`, mode `integration`, branch `main`, and worktree `D:\Datas\OthersProjects\makelore`; no new task context was created.
+- Verified source task `20260817-makelore-module-access-6f2a91c4` is `ready_for_integration`, source tip `3b799af` is present as the current `MERGE_HEAD`, and the no-ff/no-commit merge stages the reviewed product changes. Its task record remains read-only on the source branch and is deliberately excluded from the integrated `main` tree.
+- Read the source outcome, verification, follow-up and promotion candidate against the Main-owned Works Session boundary and current four-module model. No accepted ADR or peer source contradicts default-open compatibility, `design` → `painting`, pre-layout route blocking, global `/settings`, terminal `401` session cleanup, or the explicit non-authorization boundary.
+- Integration outcome remains pending until canonical reconciliation, merged-tree checks, independent final review and the final merge commit complete. The final merge SHA does not yet exist and must not be invented.
+- Gate result: Passed for canonical promotion and merged-tree verification. Works migration/API deployment, a newly built client package, real-account four-module smoke and server-side API authorization validation remain release commitments.
+
 ### 2026-08-16 Remote `26b52d7` Synchronization Resume
 
 - Reused the existing Integration owner and refreshed its reservation. Local `main` entered this resumption at `9af6c526a9500a0dbfb88e39ba0dee1eb7e1d097`; the worktree already contained an unfinished merge whose `MERGE_HEAD` was `26b52d76e3dedd754ca1b1c428abaa074b7f98da`.
@@ -255,6 +265,7 @@ Gate result:
 
 ## Outcome
 
+- 2026-08-17 module-access staged integration passed merged-tree verification and independent final review and is ready for its merge commit. Canonical reconciliation records the source tip `3b799af`, Main-owned four-boolean projection, default-open compatibility, `design` → `painting`, disabled card/root/deep/alias guards before initialization, Code policy hydration, terminal `401` dual-session cleanup, global `/settings`, and the client-entry-only security boundary; the exact merge SHA will be recorded only after Git creates it.
 - A mandatory pre-push fetch found authoritative `origin/main` had advanced to `01bee3188be4b03b6b358c2da60f1f9ed22d707f`, so no stale push was attempted. Started a second normal `--no-ff --no-commit` merge with reviewed local merge `bb16c1d12a24b2957149db960edba6e6660691aa` as first parent and `01bee31` as second parent; README was the only textual conflict and was reconciled to preserve both the enabled Learning module and the detailed Robot hotspot flow.
 - Preserved the remote Learning product scope, four-module navigation, profile reuse, removal of `game-engine`, and project-root `planning-with-files` output. The merged tree no longer depends on a sibling OpenMAIC checkout: CI/release packaging requires the fixed manifest artifact, while an explicit local source remains development-only.
 - Closed merge-audit security/correctness findings across Learning: strict Host/service DTO and safe-error projection; bounded Agent/ASR/runtime and ZIP consumption; Main-derived opaque account partitions for generation, local courses, IPC and player registration; fixed-binding checks across token acquisition, fetch and 401 refresh; stale account/epoch result rejection; 512 MiB archives; same-Works-origin redirects with a 5-hop cap and no resource Bearer; a nonce-protected account-bound player HTTP session; and an exact-source/origin single-document iframe bridge.
@@ -378,6 +389,11 @@ Gate result:
 
 ## Verification
 
+- 2026-08-17 module-access merged-tree focused Vitest — 4 files / 69 tests passed.
+- 2026-08-17 module-access merged-tree full Vitest — 175 files / 2047 tests passed.
+- 2026-08-17 merged-tree TypeScript `tsc --noEmit` and scoped ESLint on all changed TypeScript/TSX files — passed.
+- 2026-08-17 merged-tree Renderer/Electron Main/Preload `pnpm run build:vite` — passed; only the existing chunk-size and mixed static/dynamic import warnings remain.
+- 2026-08-17 independent staged-merge Sol review — `PASS`, no blocking Standards or Spec findings. It independently reran 69 focused tests, typecheck, scoped ESLint, `build:vite`, document drift, registry doctor and diff checks, and confirmed the intended two-parent topology and source-task-record exclusion.
 - Remote `01bee31` merged-tree `pnpm install --frozen-lockfile` passed with the package-pinned pnpm 10.33.4; Electron 40.10.6 was restored with `pnpm rebuild electron` before desktop smoke.
 - Learning/Robot/Canvas/publish/OpenCode focused selection — 26 files / 418 tests passed.
 - Bounded full unit suite — 175 files / 1944 tests passed.
@@ -503,6 +519,7 @@ Gate result:
 
 ## Follow-ups
 
+- Before releasing the per-user module-entry policy, deploy the Works `module_access` migration and `/api/auth/me` contract, build and install a new Makelore package, then use a real account to disable Code, Canvas, Learning and Robot one at a time and smoke chooser/root/deep/alias behavior, global settings, terminal `401`, and independent server-side API authorization.
 - Before releasing Learning, run a real Works account through catalog, generation/material/cancel-resume, bounded download, offline multi-module playback, progress, Agent, ASR and PBL/scoring using the exact production Stage artifact. Validate packaged loopback cookie/nonce behavior on Windows and a signed macOS build; current automation is not that acceptance.
 - Before restoring project cover upload or editing metadata on an existing draft/published project, add and verify a server-owned revision/ETag plus draft-only conditional write and atomic cover attachment or cleanup. Until then the client intentionally creates new projects without a cover and treats existing projects as version-only.
 - Complete the visible Git Credential Manager/PowerShell authentication prompt, then fetch and verify `origin/main` equals the local tip before recording push completion and releasing this Integration task.
@@ -528,6 +545,7 @@ Gate result:
 
 ## Promotion Candidates
 
+- The `3b799af` module-access candidate is promoted into current state, architecture/data flow, business rules, success criteria, evidence and commitments: Electron Main projects only four booleans from `/api/auth/me`; missing values are enabled, server `design` maps to client `painting`, disabled card/root/deep/alias entry stops before layout/module initialization, Code provider waits for policy hydration, terminal `401` clears both session layers, and `/settings` remains global. This is a client entry policy, not API authorization; deployment/package/real-account validation remains pending.
 - Remote `01bee31` facts and the reviewed merge hardening were promoted into README, AGENTS, success criteria, current state, architecture/data flow, business rules, glossary, evidence and commitments: Learning is enabled but remains Main-owned, account-partitioned, bounded, artifact-verified and pending real Works/signed-package acceptance; `game-engine` is removed and planning files belong in the project root.
 - Remote `26b52d7` facts were promoted into current state, architecture, domain rules, glossary, evidence, README, and release commitments: Prompt Museum remains read-only/server-driven, Quote pricing is service-owned, Canvas deletion is an explicit Workspace mutation, development is cloud-default, UI language is Chinese-only, and `game-engine` is an optional bundled Skill. Production Museum content and real-account billing/deletion acceptance remain pending commitments rather than completed evidence.
 - The default-on candidate from `b78fc07` was promoted into ADR-002, current state, decision/success criteria, Robot architecture/domain/glossary, README, and a concrete release-validation commitment. No unresolved canonical candidate remains; the missing native/physical evidence is tracked as a pending commitment rather than overclaimed.