docs: record model capability integration

.project-docs/20-architecture/system-overview.md

@@ -21,7 +21,7 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展
 | Makelore Code Workspace | project/Agent/Conversation schema v2、产品中立 Snapshot/Patch、Composer 与时间线 | Conversation 本地创建且不等待 worker；旧 OpenCode 会话备份后不再继续，Renderer 不导入 Pi RPC/event 类型 |
 | Coding Host API & Composition | 唯一 `/api/coding/*` composition、202 acceptance/dedupe、SSE、附件/文件/交互/诊断 | Electron Main 拥有 project/Conversation 服务、选中目标、认证和错误脱敏；SSE 公开面只有 Snapshot 与 `patch-batch` |
 | Pi Conversation Runtime | 一个长驻 Pi `0.84.2` Agent Server 承载每条 active/warm Conversation 的隔离逻辑 Runtime/Session/JSONL channel | 严格 LF JSONL RPC、generation recovery、Snapshot hydration；top-level 逻辑 turn 并发 4、warm idle LRU 8；Server 退出统一使旧 channel 失效并按需单实例重启 |
-| Pi Provider & Managed Resources | Provider catalog、thread-local secret projection、model/resource revision、Prompt/Skill/extension materialization | 父凭据只进入选中逻辑线程的内存 credential store，child 凭据只进入该短命进程；不扫描项目或用户的 `.pi/.agents/.codex`，不把 secret 放进 argv、catalog 或 Renderer |
+| Pi Provider & Managed Resources | Provider catalog、thread-local secret projection、model/resource revision、Prompt/Skill/extension materialization | 父凭据只进入选中逻辑线程的内存 credential store，child 凭据只进入该短命进程；Works `model_capabilities` 由 Main 严格归一化并作为安全 Provider metadata 持久化，服务端 reasoning levels 优先于本地 profile，缺字段则清理 override 并回退；不扫描项目或用户的 `.pi/.agents/.codex`，不把 secret 或原始响应放进 argv、catalog 或 Renderer |
 | Pi Extension, Subagents & Lifecycle | 唯一显式 Makelore extension、UI interaction、ephemeral child、write lease 与 background run lease | child 并发 4、单次最多 8、禁止递归；active/uncertain run 不因页面隐藏或 confirmation timeout 被停止，replacement/stop 必须可解释并清理所有 ownership |
 | Native Web Search Plugin | Signed Marketplace Package → effective parent snapshot → code-owned Main adapter → fixed Works Square Web Search route | Renderer/Package/Pi 不持有 Provider key、model 或 URL；每次搜索要求显式确认，closed receipt 与 result-less uncertain state 由 Main 投影，child 不继承 hosted tool |
 | AI Design Workspace & Living Form | 一个 Workspace 的当前 Direction、Current Specification、持久 Agent Session、conversation timeline、Tasks 与 Assets | Living Form 是服务端 Current Specification 的投影；Renderer 只持有草稿和已接受投影 |
@@ -57,6 +57,11 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展
 - Renderer 只消费共享的产品中立 project/Conversation/Snapshot/Patch DTO，并经 `src/lib/host-api.ts` 或 `src/lib/api-client.ts` 访问 Main。Pi RPC、event、Provider credential 和本地 runtime 路径保持 Main-private。
 - accepted/uncertain Coding mutation 不得自动重放；RPC confirmation timeout 后仍保留 target run permit、process ownership 和 background lease，直到迟到 success/failure/exit/abort 权威收敛。其他 Conversation 必须继续可用。
 - selected Provider credential 只投影到目标父逻辑线程的内存 credential store 或目标 child 进程；跨账号模型变化必须重建目标逻辑线程。确定性 Works user-context 缺失是 Provider-auth failure：失效缓存 credential、fail fast、固定脱敏提示，不得归类为 Pi crash。
+- Works 下发的 per-model reasoning capability 是可选 Main-owned metadata，不是
+  Renderer 或 one-api 的权威。存在时只接受受支持的安全形状并覆盖目标模型的
+  本地 effort map；缺失时移除旧 override 并使用已验证本地 profile。`off` 在 Pi
+  wire 上表示 `thinking.type=disabled` 且不发送 `reasoning_effort`，启用档位保持
+  provider 原生值，当前 DeepSeek 产品投影为 `off`/`low`/`high`/`max`。
 - Guided Hotspot Binding is implemented behind a Main-owned capability that is true by default; exact `NIANCODE_AI_HARDWARE_GUIDED_HOTSPOT_BINDING=0` disables it, while capability-read failure falls back to direct six-digit Binding. The guided state is process-local, opener failures expose only the same fixed address for manual copy, and Binding conflicts refresh the safe account overview.
 - Robot hotspot scanning and connection are local Main operations that return before Works credentials/upstream access. Renderer may submit only an opaque candidate ID from the latest bounded scan; Main alone filters open printable `Xiaozhi-*` SSIDs, performs platform association, and verifies the exact current SSID.
 - Hotspot discovery and connection do not authenticate a Robot. BSSID, interface/profile details, native diagnostics, location data, and Wi-Fi credentials never cross the Main boundary; permission or platform failure keeps the system-settings/manual path available.

.project-docs/30-worklog/current-state.md

@@ -4,6 +4,21 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 ## Integrated Through
 
+- Works-provisioned model-reasoning capability source
+  `ae7936174208a1d13cdfd260d5c6f2b70b450b60` from task
+  `20260901-server-model-capabilities-9e31b6c4` is merged into local `main` as
+  `6a8ebe1b671ca24150c2226b9111b9d07174e37b` by task
+  `20260901-integrate-model-capabilities-9b3e7c1a`, paired with Works Square source
+  `9e1b6886b360175f1ca1596fb07f71e3bf86c894`. Electron Main now strictly
+  normalizes and persists the optional safe `model_capabilities` metadata, removes a
+  stale override when the field is absent, and includes it in Provider runtime-shape
+  invalidation. Server levels override the verified local reasoning map; old servers
+  and direct Providers retain the local fallback. DeepSeek exposes
+  `off`/`low`/`high`/`max`: Pi disables thinking without `reasoning_effort` for
+  `off`, and sends the exact enabled effort otherwise. Native `max` reaches project
+  persistence, Snapshot/Patch, Host API, runtime, and the composer label `最高`.
+  Pi remains `0.84.2`; no one-api, dependency, package, deployment, or real Provider
+  acceptance is claimed.
 - Marketplace weak-ETag interoperability fix source
   `b3cfe7e1ceb7da65ccc99214db09102b4fc1cace` from task
   `20260901-plugin-catalog-load-client-7d4a8c21` is promoted to local `main` by
@@ -359,4 +374,4 @@ Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选
 
 ## Last Updated
 
-2026-08-31
+2026-09-01

.project-docs/30-worklog/tasks/20260901-integrate-model-capabilities-9b3e7c1a.md

@@ -0,0 +1,84 @@
+# Task: Integrate model reasoning capabilities
+
+## Identity
+
+- Task ID: 20260901-integrate-model-capabilities-9b3e7c1a
+- Mode: Integration
+- Branch: main
+- Worktree: D:\Datas\OthersProjects\makelore
+- Base commit: a30053c30e48a0da8639f13e117168f5afd7532e
+- Owner: codex
+- Status: Completed
+
+## Scope
+
+- Merge exact source commit `ae7936174208a1d13cdfd260d5c6f2b70b450b60`
+  into local `main` without changing the reviewed product behavior.
+- Promote the paired Works-to-Main capability normalization and Pi precedence
+  contract into canonical architecture/current state memory.
+- Do not package, deploy, push, change Pi/one-api dependencies, or add a second
+  runtime or compatibility layer.
+
+## Intent And Constraints
+
+- Electron Main remains the sole owner of Works model config, Provider metadata,
+  credentials, and Pi wire values; Renderer receives only product-neutral levels.
+- Server capability metadata overrides the verified local reasoning map when present;
+  an older server falls back locally, and persisted user choice remains intact.
+- Integrate only the reviewed source commit. Any merge conflict or semantic conflict
+  with current `main` stops integration for explicit reconciliation.
+- Pair the client merge with Works Square source
+  `9e1b6886b360175f1ca1596fb07f71e3bf86c894`; no one-api change is required.
+
+## Plan
+
+1. Verify source identity, worktree cleanliness, and a conflict-free merge tree.
+2. Merge the exact source branch into `main` with a merge commit.
+3. Promote the Main-owned capability normalization/precedence boundary into canonical
+   project memory.
+4. Run focused serializer/UI/contract tests, typecheck, lint, Vite build, diff checks,
+   and documentation drift checks.
+5. Commit the integration record, complete the task, and release ownership only from
+   a clean `main` worktree.
+
+## Outcome
+
+- Merged exact reviewed source `ae7936174208a1d13cdfd260d5c6f2b70b450b60`
+  into local `main` as merge commit
+  `6a8ebe1b671ca24150c2226b9111b9d07174e37b`; the merge was conflict-free.
+- Promoted the Main-owned Works capability normalization/persistence/precedence and
+  Pi wire boundary into canonical current-state and architecture memory.
+- Confirmed paired Works Square source
+  `9e1b6886b360175f1ca1596fb07f71e3bf86c894` is merged into local server `master` as
+  `ef73b9c97997942996ddd3ed3cd3bf4e29120bd0`.
+- Kept the reviewed scope: Pi remains `0.84.2`; no one-api, dependency, package,
+  deployment, push, second runtime, or compatibility layer was added.
+
+## Verification
+
+- `git merge-tree --write-tree` returned conflict-free tree
+  `94c573f77dd11931750a255d537c800c6f5d09c9` before merge.
+- Focused merged-tree Vitest run: 8 files / 111 tests passed, covering Works
+  capability import and cleanup, model/profile precedence, project/Snapshot/route/UI
+  `max` propagation, Pi runtime behavior, and actual off/low/high/max serializer output.
+- `pnpm run typecheck`: passed.
+- `pnpm run lint:check`: passed with zero errors and the repository's existing five
+  warnings.
+- `pnpm run build:vite`: passed for Renderer, Electron Main, Preload, and utility
+  output; existing Browserslist, dynamic-import, and chunk-size warnings remain.
+- `git diff --check`: passed.
+- Paired server merged-tree verification passed 11 focused tests and focused Ruff.
+
+## Follow-ups
+
+- Release the paired Works Square API and Makelore client when release owners are
+  ready. Deployment order remains tolerant: an older server uses the local DeepSeek
+  profile and an older client ignores the optional server field. Real Provider and
+  final installed-package acceptance remain separate release evidence.
+
+## Promotion Candidates
+
+- Resolved: promoted the safe Works-to-Provider metadata contract, missing-field
+  cleanup/fallback, server-over-local precedence, and Pi `off`/enabled wire behavior
+  into `.project-docs/20-architecture/system-overview.md`; recorded the integration
+  in `.project-docs/30-worklog/current-state.md`.

.project-docs/30-worklog/tasks/20260901-server-model-capabilities-9e31b6c4.md

@@ -1,84 +0,0 @@
-# Task: Consume server model reasoning capabilities
-
-## Identity
-
-- Task ID: 20260901-server-model-capabilities-9e31b6c4
-- Mode: Feature
-- Branch: codex/20260901-server-model-capabilities-9e31b6c4-server-model-capabilities
-- Worktree: D:\w\makelore-model-capabilities-9e31b6c4
-- Base commit: 850947c092892cb647c4191b6d8bbf37a763e1ad
-- Owner: codex
-- Status: Ready for integration
-
-## Scope
-
-- Consume per-model reasoning capabilities from Works Square model config and persist
-  them on the imported Main-owned Provider account.
-- Make server metadata override the local Pi reasoning map for server-provisioned
-  models while retaining the local verified profile as an old-server/direct-provider
-  fallback.
-- Add native `max` to the product-neutral thinking-level contract and composer menu so
-  DeepSeek exposes off/low/high/max without relabeling provider values.
-- Keep one-api and Pi `0.84.2` unchanged.
-
-## Intent And Constraints
-
-- Electron Main remains the sole Works/model-config, Provider, credential, and Pi-wire
-  owner. Renderer receives only safe product-neutral levels.
-- Strictly normalize the trusted response shape; a missing capability field means an
-  older server and falls back to the local profile.
-- Preserve persisted user choices and all non-Works Provider behavior.
-- Do not restore OpenCode, add a second runtime, or expose Provider credentials or raw
-  response data.
-- Feature mode may update only product code, focused tests, and this task record.
-
-## Plan
-
-1. Add failing tests for Works capability import, Provider metadata persistence,
-   server-over-local Pi mapping, and native `max` menu/contract acceptance.
-2. Implement the typed response parser, Provider metadata projection, capability-map
-   precedence, local DeepSeek fallback, and minimal `max` propagation through existing
-   product validators/UI.
-3. Run focused unit tests, typecheck, scoped lint, Vite/Main build, and the project-docs
-   completion gate.
-
-## Outcome
-
-- Parsed and normalized Works Square `model_capabilities`, stored the safe result on
-  the managed Provider account, removed stale overrides when the optional server field
-  disappears, and included the metadata in Provider runtime-shape invalidation.
-- Server-provided efforts now override the local Pi reasoning/thinking-level map while
-  preserving verified local modalities, token limits, and wire-format compatibility.
-  A capability for a future model without a local profile enables standard
-  `reasoning_effort` serialization automatically.
-- Updated the verified DeepSeek fallback to expose only off/low/high/max. Pi sends
-  `thinking.type=disabled` with no `reasoning_effort` for off, and sends the exact
-  low/high/max effort for enabled requests.
-- Added native `max` to the product contract, snapshot validation, project persistence,
-  Host route, Pi runtime, and composer UI where it is labelled `最高`.
-- Kept Pi at 0.84.2 and made no one-api, dependency, README, or second-runtime change.
-
-## Verification
-
-- Focused final Vitest combination: 8 files and 102/102 tests passed, including actual
-  Pi `streamSimple` payload checks for off and each of low/high/max.
-- `pnpm run typecheck`: passed.
-- `pnpm run lint:check`: passed with the repository's existing five warnings and no
-  errors; a separate scoped ESLint run over every changed TypeScript/TSX file passed.
-- `pnpm run build:vite`: passed; only existing Browserslist, dynamic-import, and chunk
-  size warnings were emitted.
-- `git diff --check`: passed.
-
-## Follow-ups
-
-- Integrate with the paired Works Square API change. Deployment order is tolerant:
-  a client talking to an older server uses the corrected local DeepSeek profile, and
-  older clients ignore the new server response member.
-- Verify future server model entries against their provider's exact effort vocabulary
-  before publishing them; no one-api change is required while it remains transparent.
-
-## Promotion Candidates
-
-- Promote the Main-owned capability normalization/precedence rule and the safe
-  server-to-Provider metadata contract into canonical architecture documentation after
-  the paired server and client branches are integrated.