merge: integrate remote main

.project-docs/30-worklog/current-state.md

@@ -4,6 +4,15 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 ## Integrated Through
 
+- Integration task `20260903-complete-remote-merge-b41e7c92` combines local
+  parent `7a37593e4be3c39a9782975de53f56a76dd53ef0` and fetched
+  `origin/main` parent `8e947b4f0e1ff0409e52a9d528ae3bb240ceb687` through a normal
+  two-parent merge. The later reviewed unified `/plugins` workspace remains
+  authoritative, while the remote runtime-root, Conversation reconciliation,
+  history, quota, tool-batch, and settlement corrections are retained. The
+  superseded Project Configuration Plugin Services sheet is not restored; no
+  rebase, history rewrite, force-push, package, deployment, or publication is
+  part of this integration.
 - Unified Plugin workspace product head
   `d7058e6383f1e9dd72c32570cf83b9f439d91033` is integrated on local `main` by
   task `20260903-plugin-navigation-integration-4f7c2a96` after fixed-range R4
@@ -38,6 +47,72 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
   across the two source tasks. The currently installed 1.2.6 client was not
   replaced; rebuilt exact-main installation and live prepare/confirm/activation
   remain release acceptance work.
+- Integration task `20260903-integrate-latest-6f2c8e1a` preserves the divergent
+  local and remote mainline histories with normal merge `d25ed08`: fetched
+  `origin/main` frontier `28e1690` and local frontier `301c149` are both ancestors
+  of the integrated tree. It also reviewed every local worktree/branch; historical
+  Learning Player source `b1f51be` remains intentionally excluded under ADR-005,
+  rather than being mistaken for current product work. No history rewrite or
+  force-push is part of this integration.
+- Packaged Pi runtime-root source `5d7a235` from task
+  `20260902-build-unsigned-mac-9d7e4a2c` is integrated through merge `4babd6d`.
+  `resources/pi-agent-server.mjs` now anchors `@earendil-works/pi-ai` discovery to
+  the staged `pi-runtime` package manifest, selects its import entry, and rejects
+  entries escaping the package root. The corrected local-only unsigned arm64 DMG
+  passed exact mounted-image initialize/shutdown with SHA-256
+  `6d0216da6c30f7fed537041b37c69811b8e025af3e9cccf85a64c690e29ecb7b`;
+  it is not signed, notarized, published, or cross-platform release evidence.
+- Conversation-attention source `f2c3755` from task
+  `20260902-conversation-badge-a7c49e` is integrated through merge `bbfe16d`.
+  Hidden Conversation red markers now represent only a newly pending interaction
+  or a newly completed/failed/aborted run; assistant/thinking/tool progress and an
+  individual tool failure remain visible without becoming attention notifications.
+- Foreground-reconciliation source `7aa118b` from task
+  `20260903-diagnose-recurring-stall-a83f5c21` is integrated through merge
+  `04320dd`. Coding closes its old event stream on `lifecycle:sleep` and silently
+  reloads the selected Main-owned Snapshot on view/project context, visibility,
+  or focus transitions. A stale Renderer `live` state can therefore converge to
+  an already persisted terminal state without replaying an accepted mutation.
+- Reconciliation checkpoint `cdbc262` was verified by final-gate task
+  `20260903-finalize-main-integration-b7e2c4a9`: focused Vitest passed 5 files /
+  70 tests, Electron Coding E2E passed 4/4, full Vitest passed 1,832 with 3
+  skips plus pressure 1/1, typecheck passed, lint reported 0 errors and 5 existing
+  warnings, and Renderer/Main/Preload/utility production build passed. A fresh
+  fetch found the checkpoint 42 commits ahead / 0 behind `origin/main` before
+  promotion.
+- Bash tool-bridge source `49112b6` from task
+  `20260902-fix-bash-tool-bridge-9c4e7a12` is integrated through merge
+  `55bf80e` by task `20260902-integrate-bash-tool-bridge-e81a5c6d`.
+  Pi's prepare-all behavior can no longer deadlock two tools against Makelore's
+  same-project write lease before either tool starts: built-in `bash`, `edit`,
+  and `write`, plus dynamically declared product tools that acquire that lease,
+  execute sequentially within an assistant tool batch. Read-only batches retain
+  parallel execution, and Bash command timeout remains authoritative once its
+  child process starts.
+- Coding terminal-settlement source `f1fd13a` from task
+  `20260901-fix-session-settlement-a47d2e91` is integrated through merge
+  `e76a1e1` by task `20260902-integrate-session-settlement-6e41c8b2`.
+  Normal prompt completion still uses authoritative `agent_settled`; when that
+  handshake is missing after Pi has terminalized, Main probes only the accepted
+  target thread after a bounded 30-second grace period. Exact idle evidence
+  hydrates the persisted final assistant response and releases ownership once;
+  contradictory state becomes an explicit target-only protocol failure. Accepted
+  or uncertain mutations are never replayed, and sibling Conversations remain
+  available.
+- Plugin-navigation sources `b3f4166` and `e237941` from task
+  `20260831-consolidate-plugin-navigation-3d9a6c71` are integrated through
+  merge `a278ca3`. Coding history/quota source `d523b72` from task
+  `20260831-fix-history-quota-errors-6c2a91e4` is integrated through merge
+  `69832e0`, and assistant progress-preview source `8d878eb` from task
+  `20260831-show-progress-messages-a14f9c2d` is integrated through merge
+  `a8fd95f`. At that source frontier, Project Configuration owned the visible
+  Plugin Services surface; Pi compaction no longer removes visible active-branch history;
+  recognized Token Point exhaustion remains safely actionable after reopen;
+  and collapsed process previews remain anchored to their first displayable
+  line. Those predecessor Project Configuration Plugin surfaces are superseded by
+  the reviewed unified `/plugins` workspace above and are not restored. Historical
+  source `b1f51be` remains explicitly excluded because
+  ADR-005 continues to retire the OpenMAIC Learning Player packaging chain.
 - Youth-facing AI Design client source
   `0fd32a2d49045a8f9e7f2e19ba6477f48f93e30c` is integrated over Model Tools
   frontier `7552cf59526449c29d663a769c0fb62d84a1a759` through merge
@@ -56,8 +131,8 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
   Package tests, typecheck, scoped lint, production build, and 2 Electron E2E flows.
   The Electron run also exposed and closed an existing current-frontier startup crash:
   the ESM-only Pi package manager is now loaded only when remote Device Package
-  installation needs it. No package, deployment, publication, push, or paid request
-  is claimed.
+  installation needs it. At that source-task checkpoint no package, deployment,
+  publication, remote push, or paid request was claimed.
 - Model Tools and Device Packages client cutover is implemented by task
   `20260902-model-tools-client-integration-5d8b2f73`. Web Search is now a parent-only
   core tool of the frozen selected model/provider/credential; it no longer depends on
@@ -200,7 +275,7 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
   rendered exactly Data Service, Game Resource, and Web Search without the unavailable
   catalog error. At that checkpoint Game Resource and Web Search still showed no stable
   Release; the official bundled cutover recorded above supersedes that delivery model.
-- Packaged Pi Agent Server resolver fix source `7df245af5a04f62be48980831ff41987ba686009`
+- Earlier packaged Pi Agent Server resolver source `7df245af5a04f62be48980831ff41987ba686009`
   from task `20260901-local-runtime-unavailable-8b42c7f1` is promoted to local
   `main` by task `20260901-promote-local-runtime-main-a7c4e291` through verified
   integration candidate `42ea83c0cbad52432eca99e4161e0360bef3e219` and source merge
@@ -211,8 +286,10 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
   A production-shaped sibling-layout test reproduces the installed failure before the
   fix and initializes successfully through Electron Node after it; Pi remains pinned at
   `0.84.2`, and no bundle layout, Provider, Renderer, or recovery contract changed.
-  The currently installed application predates this source integration; a rebuilt and
-  verified Windows artifact plus first-Conversation acceptance remain pending.
+  This flag-only resolver was later superseded by source `5d7a235` above, which
+  explicitly resolves the package manifest and entry from the staged runtime root and
+  has mounted-image macOS arm64 evidence. A signed/notarized artifact, Windows rebuild,
+  and installed first-Conversation acceptance remain pending.
 - Native Web Search client tickets MLW-01 through MLW-03 are integrated by source
   coordinator `20260831-web-search-client-integration-7d2f5b94` and promoted to local
   `main` by task `20260901-web-search-client-main-merge-5a9d3b82` from reviewed
@@ -444,9 +521,11 @@ Canvas 侧栏提供“获取灵感”进入 Prompt Museum。列表、筛选、
 
 Makelore 在会话恢复、登录和刷新后由 Electron Main 请求 Works `/api/auth/me`，Renderer 只获得 Code、Canvas、Learning、Robot 四个布尔权限。缺失 `module_access` 或任一字段时默认开启；服务端 `design` 显式映射客户端 `painting`。被关闭的模块卡片置灰且不可点击，根路由、深层路由和别名路由均在 `MainLayout` 或模块初始化前阻断。Code provider 等待认证权限加载完成；权限查询返回终止性 `401` 时同时清理 Main 和 Renderer 会话。`/settings` 是全局设置，不受 Code 入口策略阻断。该机制只是客户端入口策略，不代替服务端 API 授权。
 
+插件在编程侧栏只有一个“插件”入口，`/plugins` 是唯一产品页面，并以统一列表投影 Marketplace、账号 Library、官方设备状态、本机 Device Packages、当前项目状态与 retained IDs；旧 `/plugin-marketplace`、`/my-plugins` 与 `/project-plugins` 路由只做确定性筛选重定向。获取、设备安装、项目启用、Agent Skill 分配、运行授权和计费仍是独立生命周期，不因界面统一而自动推进；原生 selected-model Web Search 不进入插件列表。
+
 AI 学习现在是已启用的运营精选项目目录，并继续受登录和 `module_access.learning` 控制。Renderer 通过 Main-owned Host API 获取分页项目卡片和 README 详情；Markdown 支持 GFM、禁用原始 HTML。服务端发布时只校验图片 URL 为无凭据、默认端口、无 fragment 且当前 DNS 结果全部为公网地址的 HTTPS URL，保留地址而不下载、识别格式、转码或镜像；客户端仅为 README 图片节点启用直连，因此 SVG 和 Electron 支持的其他格式可直接显示，单图失败不阻断详情。封面和历史发布媒体继续走受控路径。详情页的下载按钮打开系统保存对话框；Main 将 ZIP 流式写入临时文件，只允许最多五跳同 Works origin 重定向，不校验 `Content-Length`、`archiveBytes`、实际流字节数或客户端大小上限，校验 SHA-256 和 ZIP 签名后原子保存，Renderer 只接收 `saved` 或 `cancelled`。课程生成、进度、本地课程库、OpenMAIC player、Agent、ASR、课堂 runtime、Learning IPC 和 player artifact 打包已删除且没有兼容读取路径；历史课程数据保留但不再读取。服务端和客户端源码契约已完成，不代表生产部署或真实账号安装包联调已经完成。
 
-AI 编程已经硬切到精确 pin 的 Pi `0.84.2`，不存在 OpenCode fallback 或双 runtime。project、Agent 与 Conversation 只在 `.makelore/project.json` 和 `.makelore/conversations.json` 使用本地 schema v2；当前客户端不从 `.niancode` 或 `.opencode` 读取、迁移或删除项目元数据。Electron Main 按需启动一个长驻父 Agent Server，每条 active/warm Conversation 在其中拥有独立 Runtime/Session/channel、credential store、extension context、generation/seq、Snapshot/Patch、model/thinking、队列、interaction 与错误状态，Composer 在 lazy prepare 期间仍可编辑。Renderer 只通过 `/api/coding/*` 和 Snapshot-first/`patch-batch` SSE 消费产品中立合同；gap/reconnect 只恢复目标 Conversation，accepted/uncertain mutation 不自动重放。未解析 Conversation 第一次选模先 validate 并持久化 resolved metadata，再 prepare；同账号模型切换使用 target `set_model`，跨账号只重建目标逻辑线程。Main-selected Device Package generation 把所有显式安装且当前启用的 Skill 路径和 extension 路径交给未来或空闲 parent；生成的 Makelore bridge 始终是必需的首个 extension，其余全部经 `additionalExtensionPaths` 加载，同时保持 ambient discovery 关闭。active parent 在 turn settled 后刷新，child 始终为空。top-level 逻辑 turn 并发为 4，warm idle logical-thread LRU 为 8；independent child 进程并发为 4 并使用 FIFO 进程预算 8；coding child 与 parent 共用项目 write lease。prompt/compact confirmation timeout 后仍保留 run/Agent-Server-or-child-process/background ownership，迟到 success/failure/exit/abort 单调且 exactly-once 收敛，页面隐藏不会停止 active/uncertain run。线程级替换只使目标 generation 失效；整个 Agent Server 退出会统一使所有旧 channel 失效，但 Main/Renderer 存活且下次恢复只重启一个 Server。Pi `0.84.2` 手动 compact 不发 `agent_settled`，由 correlated compact RPC 结果终结。父 Provider credential 只进入选中逻辑线程的内存 credential store，child 凭据只进入该短命进程；确定性的 Works user-context 缺失会失效 gateway credential、fail fast、不重放并投影固定 Provider-auth 错误，不归类为 Pi crash。真实 Provider 验证仍为用户明确接受的未验证风险，macOS x64/arm64 与 native non-WSL Linux 也未通过平台发布门禁。
+AI 编程已经硬切到精确 pin 的 Pi `0.84.2`，不存在 OpenCode fallback 或双 runtime。project、Agent 与 Conversation 只在 `.makelore/project.json` 和 `.makelore/conversations.json` 使用本地 schema v2；当前客户端不从 `.niancode` 或 `.opencode` 读取、迁移或删除项目元数据。Electron Main 按需启动一个长驻父 Agent Server，每条 active/warm Conversation 在其中拥有独立 Runtime/Session/channel、credential store、extension context、generation/seq、Snapshot/Patch、model/thinking、队列、interaction 与错误状态，Composer 在 lazy prepare 期间仍可编辑；正式包从 staged `pi-runtime` manifest/root 定位并校验 Pi 包入口，不从脚本目录或应用 `node_modules` 回退。Renderer 只通过 `/api/coding/*` 和 Snapshot-first/`patch-batch` SSE 消费产品中立合同；gap/reconnect 只恢复目标 Conversation，accepted/uncertain mutation 不自动重放。`lifecycle:sleep` 会关闭旧事件流，视图挂载、项目上下文变化、页面重新可见或窗口 focus 会静默刷新已选 Snapshot，使后台 terminal 状态收敛且不重放 mutation。隐藏 Conversation 的红点只在新 pending interaction 或新 completed/failed/aborted terminal transition 出现，不由助手/thinking/工具过程或单个工具失败触发。Session hydration 沿完整 active branch 投影可见历史，Pi compaction 只改变模型上下文并保持 summary 私有；Renderer 首次挂载最近 120 个节点，向上滚动时按 100 个节点追加更早内容并补偿新增高度以保持阅读锚点。折叠的 thinking、助手过程说明与工具输出固定展示第一条可见内容和首个非空行，横向偏移保持为零，展开后仍显示完整内容。未解析 Conversation 第一次选模先 validate 并持久化 resolved metadata，再 prepare；同账号模型切换使用 target `set_model`，跨账号只重建目标逻辑线程。Web Search 只作为所选模型 capability 进入父 worker 并使用相同 model/provider/credential 与普通模型计费，不经过 Marketplace/Hosted client/Plugin Charge 或浏览器 fallback；child 不继承。Conversation 工具可检查并在独立确认后安装 npm、Git、本地 Plugin 目录或 loose `SKILL.md` 为 Main-owned immutable Device Package；不运行生命周期脚本，可执行 extension 具有桌面用户权限，新/idle parent 自动刷新，active parent 结算后刷新，child 为空。每个 Main-selected generation 都保留全部显式安装且当前启用的 Skill 路径；生成的 Makelore bridge 是必需的首个 extension，其余 extension 全部经 `additionalExtensionPaths` 加载，并继续关闭 ambient discovery。top-level 逻辑 turn 并发为 4，warm idle logical-thread LRU 为 8；independent child 进程并发为 4 并使用 FIFO 进程预算 8；coding child 与 parent 共用项目 write lease。同一助手工具批次内，内置 `bash`/`edit`/`write` 与声明需要该 write lease 的动态产品工具按顺序执行，避免 Pi 在批量 prepare 阶段形成租约自锁；纯只读工具批次仍可并行。prompt/compact confirmation timeout 后仍保留 run/Agent-Server-or-child-process/background ownership，迟到 success/failure/exit/abort 单调且 exactly-once 收敛，页面隐藏不会停止 active/uncertain run。线程级替换只使目标 generation 失效；整个 Agent Server 退出会统一使所有旧 channel 失效，但 Main/Renderer 存活且下次恢复只重启一个 Server。Pi `0.84.2` 手动 compact 不发 `agent_settled`，由 correlated compact RPC 结果终结。父 Provider credential 只进入选中逻辑线程的内存 credential store，child 凭据只进入该短命进程；确定性的 Works user-context 缺失会失效 gateway credential、fail fast、不重放并投影固定 Provider-auth 错误，不归类为 Pi crash。精确的 `403 token_point_balance_exhausted` / `词元点数余额不足` 上游响应会在 Main 内归类为不可重试的配额耗尽，Renderer 只收到稳定 `CODING_PROVIDER_QUOTA_EXHAUSTED` 与安全中文提示；重开会话仍保留该提示，不暴露上游 request id 或原始错误正文。真实 Provider 验证仍为用户明确接受的未验证风险；macOS arm64 仅有本地未签名 mounted-image initialize/shutdown 证据，签名/公证/完整 process-enumeration、macOS x64 与 native non-WSL Linux 仍未通过平台发布门禁。
 
 Updater 仍由 Electron Main 选择目标 feed、记录原始诊断并保持失败语义。正式稳定源缺少对应平台 manifest 时，设置页只显示一条简洁中文提示并允许重试，不把缺包误报为已是最新版，也不向普通界面暴露堆栈、URL、路径或错误码；签名产物发布和真实升级安装仍属于外部 Release Gate。
 
@@ -454,6 +533,12 @@ Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选
 
 ## Recently Completed
 
+- 2026-09-03: Reconciled local `main@7a37593` with fetched
+  `origin/main@8e947b4` through a normal two-parent merge. The result keeps the
+  reviewed single `/plugins` workspace and Device Package multi-extension
+  activation while integrating the remote Pi runtime-root, Conversation
+  foreground/history/quota, tool-batch, and settlement corrections; the
+  predecessor Project Configuration Plugin Services sheet remains retired.
 - 2026-09-03: Integrated the paired Device Package prepare and activation fixes.
   Packaged Main now resolves package inspection from the physical bundled Pi
   runtime, and the parent Agent Server loads the required generated Makelore
@@ -463,6 +548,40 @@ Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选
   extension commands, full unit/pressure, typecheck, lint, build, Windows
   packaging, and artifact checks. The installed 1.2.6 client is unchanged, so
   exact-main rebuild/install and live activation are still pending.
+- 2026-09-03: Reconciled fetched `origin/main` with the complete local mainline and
+  integrated the three cleanly owned latest source tasks through normal merge
+  commits. The result contains Model Tools/Device Packages, youth-facing Canvas,
+  packaged Pi runtime-root resolution, foreground Conversation reconciliation,
+  and attention-only unread markers without rewriting either mainline history.
+- 2026-09-03: Corrected packaged Pi dependency discovery to resolve the package
+  manifest and entry from staged `pi-runtime`. A local-only unsigned macOS arm64
+  DMG passed mounted-image Agent Server initialize/shutdown; signing, notarization,
+  full macOS process proof, other architectures, publication, and installation of
+  this corrected build remain outside that evidence.
+- 2026-09-03: Integrated Renderer foreground recovery and Conversation attention
+  semantics. Returning to a selected Conversation now refreshes its authoritative
+  terminal Snapshot after lifecycle sleep without prompt replay, while hidden red
+  markers are reserved for new interactions and terminal task outcomes.
+- 2026-09-02: Integrated the Pi write-leased tool-batch correction. Multiple
+  Bash/edit/write or lease-requiring product tools emitted by one assistant
+  response now execute sequentially instead of waiting on a lease before any
+  command can start; read-only batches remain parallel. A real Agent Server
+  regression covers two Bash calls, a command-level timeout, and rejection of
+  the former HTTP-idle-timeout `fetch failed` path.
+- 2026-09-02: Integrated bounded recovery for a missing Pi prompt settlement.
+  A final persisted assistant response can no longer leave the Composer permanently
+  processing merely because `agent_settled` was lost: Main waits for the normal
+  handshake, then uses exact target-thread idle evidence to hydrate and settle once,
+  or emits a safe target-only protocol failure. Focused runtime/process tests,
+  typecheck, and the Vite/Electron production build passed on the integrated tree.
+- 2026-09-01: Integrated the predecessor Plugin navigation work plus complete
+  active-branch Coding history with scroll-anchor preservation, narrow Token Point
+  quota feedback, and stable first-line process previews. The predecessor
+  Project Configuration sheet is superseded by the reviewed unified `/plugins`
+  workspace and is not present in the current product. Combined typecheck,
+  focused/full unit tests, lint, Vite/Electron builds, and five focused Electron
+  E2E scenarios passed. The obsolete Learning Player packaging branch remains
+  excluded by explicit human confirmation and ADR-005 remains authoritative.
 - 2026-08-31: Integrated the provider-neutral `makelore.game-resource` hosted Plugin
   client with fetched `origin/main`. Generic schema-2 `platform_hosted` packages now
   materialize frozen Skill/tool snapshots only for eligible parent Pi logical threads;