docs: record remote main integration

.project-docs/30-worklog/current-state.md

@@ -4,6 +4,22 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 ## Integrated Through
 
+- Hosted Game Resource Plugin source `fe656dd865f1941f1dc2d369ce3bb09efb955fd8`
+  and verification record `421c8254d51318355faec3ae94f8e1cfd4d054c5`
+  from task `20260831-meowa-hosted-plugin-client-8d3a5b72` are integrated with
+  fetched `origin/main` `38f85f6b5e4dc4e2c5e5b9f8f4506554cfd578f5`
+  in merge `372b5345dae57ce19d2630b24277596db284194c` by task
+  `20260831-integrate-remote-main-6b3d9e1a`. MakeLore now supports generic
+  schema-2 `platform_hosted` Marketplace packages and a provider-neutral
+  `makelore.game-resource` adapter. Its Skill and tools enter only an installed,
+  enabled, assigned, admitted parent Pi logical thread; child and ineligible
+  threads receive no projection. Hosted mutations require explicit confirmation,
+  keep stable logical operation identity across uncertain results, and travel only
+  through Electron Main to fixed Works Square routes. The old always-mounted Meowa
+  tools, direct proxy, local credential configuration, and package-time credential
+  path are removed. Production activation remains held until the official signing
+  key, rotated server credential, positive Token Point pricing, and server Admission
+  gates are ready and verified.
 - Local source snapshot `33fb31fb285b5cfb00d194a036aaf6e21cf8c5a1`,
   based on the prior local delivery `48a9189`, is integrated over fetched upstream
   `62304dc85b3c1069cd656dfacb61ee820e216fa2` in merge commit
@@ -26,9 +42,10 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
   projections without receiving credentials, paths, Admissions, or signed URLs.
   Data Service remains system-included and consumes zero Token Points. R7 Standards
   and Spec reviews passed with zero findings, and XMA-01 passed all twelve live groups
-  against real PostgreSQL and a signed-in packaged Windows client. Production trust
-  activation remains HOLD until the official Ed25519 public key is built in; Release B
-  and hosted Provider runtime remain closed.
+  against real PostgreSQL and a signed-in packaged Windows client. The later
+  `platform_hosted` client runtime is integrated above; production package trust and
+  real Provider activation remain held behind the official signing key and the
+  separate server, pricing, credential-rotation, and Admission gates.
 - AI Design Living Form V2 client source
   `b0b5a602b501308a23eb27e2f51a5169b9e46b1e` is integrated with matching Works
   Square server source `b5351d54f595ce8eb873593e462e4a556bea0b05` by task
@@ -198,6 +215,14 @@ Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选
 
 ## Recently Completed
 
+- 2026-08-31: Integrated the provider-neutral `makelore.game-resource` hosted Plugin
+  client with fetched `origin/main`. Generic schema-2 `platform_hosted` packages now
+  materialize frozen Skill/tool snapshots only for eligible parent Pi logical threads;
+  paid operations require explicit confirmation and stable logical identity, while
+  Electron Main alone owns the fixed Works transport. Legacy always-mounted Meowa
+  tools and client credential paths are removed. Focused/full unit tests, typecheck,
+  lint and Vite/Electron builds passed; production signing, pricing, credential
+  rotation, real Provider acceptance, push, deployment, and publication remain open.
 - 2026-08-31: Integrated the occupied local source snapshot over upstream Marketplace Release A and AI Design Living Form V2. Makelore Code now amortizes parent Pi startup through one long-lived Agent Server while preserving isolated per-Conversation logical runtimes, sessions, credentials, extensions and channels; child Agents remain independent processes. ADR-006 and current architecture now use `.makelore` as the sole project configuration source and explicitly reject legacy metadata reads or migration.
 - 2026-08-26: Fast-forwarded the complete Pi hard-cutover and installed-package resilience chain into local `main`, including per-Conversation workers/Snapshot projection, extension/subagents, bounded process/write/background ownership and the deterministic Works user-context Provider-auth correction. The final Windows installer, packaged Pi runtime, extension/child, 4+4 pressure, uncertainty/late-settle and zero-lingering-process proofs passed. Real Provider turns are explicitly waived rather than passed; macOS and native non-WSL Linux remain release evidence gaps.
 - 2026-08-20: Replaced AI Learning's course generation/player stack with the curated project catalog defined by ADR-005. The authenticated/module-gated client now renders project cards and safe README detail, loads validated credential-free HTTPS Markdown images directly, and saves verified ZIP archives through the native dialog. Old course/runtime/player packaging was removed; server/client regressions and full suites passed, while production deployment and real-account package smoke remain pending.