fix(pi): recover from Works prompt rejection

.project-docs/30-worklog/tasks/20260825-pi-submit-rejected-hotfix-9f3c7a62.md

@@ -0,0 +1,125 @@
+# Task: Fix Pi Works submit rejection and retry lock
+
+## Identity
+
+- Task ID: 20260825-pi-submit-rejected-hotfix-9f3c7a62
+- Mode: Feature
+- Branch: codex/20260825-pi-submit-rejected-hotfix-9f3c7a62-pi-submit-rejected-hotfix
+- Worktree: D:\Datas\OthersProjects\makelore-pi-submit-rejected-hotfix-9f3c7a62
+- Base commit: 4580568384f5391f2030bde57c63ff90891172b3
+- Owner: codex-root
+- Status: Verifying
+
+## Scope
+
+- Fix the installed Windows Pi path where the Works Square OpenAI-completions
+  endpoint rejects Pi's leading `developer` message, by projecting the pinned
+  Pi `supportsDeveloperRole: false` compatibility only for the actual Works
+  gateway/proxy managed-model account modes.
+- Make a definite prompt submission rejection restore the target Conversation's
+  draft and attachments as a retryable submission error that clears when the
+  user edits/retries, without poisoning persistent runtime preparation state.
+- Add focused provider/Renderer isolation and no-replay regressions, then build
+  and verify a new Windows x64 NSIS through final packaged Main/UI proof.
+
+## Intent And Constraints
+
+- Keep the Pi hard cutover, Pi `0.84.2`, Main-owned Provider/secret boundary,
+  existing Host proxy body forwarding, and one runtime path. Do not add an
+  OpenCode fallback, compatibility dual track, generic body rewrite, Provider
+  watchdog, or Pi upgrade.
+- Verify the actual Provider catalog before selecting account kinds. Preserve
+  built-in/direct/custom OpenAI-compatible auto-detection and do not alter
+  OpenAI Responses, Anthropic, Google, local Provider, image, tool, session, or
+  child behavior.
+- A definite rejection is target-scoped submission feedback. Preserve genuine
+  runtime/session/preparation errors and their Recover semantics; preserve
+  uncertain request reconciliation and never automatically replay an accepted
+  or uncertain prompt.
+- Error text must be stable, actionable Chinese and must not expose upstream
+  body, prompt, headers, credentials, session content, or complete paths.
+- Do not modify the read-only diagnostic worktree, dirty/occupied `main`, the
+  previous cumulative worktree, or the user's installed application under
+  `D:\Tools\泥土\niancode\Makelore`. Do not use subagents.
+- Real external Provider verification remains `Explicitly Waived / Accepted
+  Risk` with `realTurnVerified=false`; the controlled Works-shaped endpoint is
+  not a full Provider-matrix Pass.
+
+## Project Context Loaded
+
+- Concurrent Task Gate passed: task ID, feature mode, branch, absolute worktree,
+  base commit, task record, ownership, and reservation match the local registry.
+- Base `4580568384f5391f2030bde57c63ff90891172b3` is both the cumulative delivery
+  HEAD and the diagnostic HEAD, so the implementation loses no prior Pi hotfix.
+- Planning Gate passed after reading entry/memory/current-state, positioning,
+  decisions, architecture/data-flow, domain/success, evidence/reflection,
+  commitments/stale records, the Pi cutover and resilience contracts, cumulative
+  Pi tasks, and planning peer scopes.
+- Shared integrated memory predates the Pi chain and retains older OpenCode
+  wording. Current source, the cumulative Pi task/spec, and the read-only
+  diagnostic record are authoritative for this hotfix. The entry document's
+  shorthand paths for memory/current-state are stale; the actual files are under
+  `05-agent-entry` and `30-worklog`.
+- The diagnostic task is the only directly overlapping peer and explicitly owns
+  evidence/red tests, not product implementation. Other planning tasks are
+  isolated, older, unrelated, or have undefined scope; no unresolved semantic
+  conflict changes this repair.
+- Source verification confirmed exactly two managed Works credential modes:
+  `works_square_ai_gateway` and `works_square_ai_gateway_proxy`; both use
+  OpenAI Completions. Direct/custom accounts retain Pi auto-detection.
+- The locked Pi `0.84.2` models schema accepts `supportsDeveloperRole`, and its
+  OpenAI Completions adapter selects `system` when the explicit value is false.
+- Gate result: Passed.
+
+## Plan
+
+1. Inspect the diagnostic red-test diff and actual Provider catalog, DTO,
+   managed-model projection, Renderer submission state, and packaged proof seam.
+2. Recreate the two red regressions in this task and add direct/custom,
+   cross-Conversation, second-submit, and uncertain no-replay coverage.
+3. Implement the smallest Works-only compat projection and target-scoped
+   definite-rejection cleanup; do not modify Host proxy bodies or runtime errors.
+4. Run frozen install, focused tests, typecheck, lint, full unit, production
+   build, and Windows Electron E2E; fix only task-caused failures.
+5. Commit a clean candidate, run formal Windows packaging and artifact closure
+   checks, then prove final-ASAR Works-shaped reject/system acceptance and real
+   UI reject/edit/retry/settle/cleanup with `realTurnVerified=false`.
+6. Record exact commits, changed files, verification, installer size/hash,
+   packaged evidence, waivers, registry status, and clean state; complete the
+   Task Documentation Gate.
+
+## Outcome
+
+- Implemented the Works-only managed-model compat override after imported model
+  capability merging, so both gateway paths materialize
+  `supportsDeveloperRole: false` without changing direct/custom or other APIs.
+- Definite and uncertain submission failures remain request/submission state;
+  they restore the target draft without writing the Conversation entry's
+  persistent preparation error. Existing runtime/session recovery state remains
+  reserved for preparation, hydration, worker, and session failures.
+- Extended the final packaged proof with a Works-shaped endpoint role canary and
+  a real Renderer reject/edit/retry/settle flow. The extension and proxy proof
+  provider modes are protected by a focused wiring regression.
+- Packaging and final artifact/product proof remain pending.
+
+## Verification
+
+- `corepack pnpm install --frozen-lockfile` — Pass; pnpm `10.33.4`, Pi `0.84.2`.
+- Initial diagnostic red command — Expected fail: 2 files / 2 tests failed,
+  23 passed; missing compat and permanently disabled retry reproduced.
+- Focused regressions — Pass: 4 files / 49 tests, including proof wiring.
+- `corepack pnpm run typecheck` — Pass (rerun after proof wiring correction).
+- `corepack pnpm run lint:check` — Pass with five pre-existing warnings and no
+  errors.
+- `corepack pnpm test` — Pass: 180 files; 1523 passed, 2 skipped.
+- `corepack pnpm run build:vite` — Pass; Renderer/Main/Preload/utility built,
+  with existing chunk/dynamic-import warnings.
+- `corepack pnpm run test:electron:windows` — Pass: 2 files / 4 tests.
+
+## Follow-ups
+
+- None recorded.
+
+## Promotion Candidates
+
+- None recorded.