merge: 集成 AI 设计生成任务修复

.project-docs/20-architecture/data-flow.md

@@ -15,9 +15,9 @@
 | AI 编程模型代理错误 | OpenCode provider 请求 | Main Host AI proxy → Works 模型上游 | 配额耗尽保持独立终止态；只有明确的分组上游饱和才投影为 OpenCode 终止状态，通用限速仍保留 `429` |
 | 客户端更新检查 | 设置页 | Renderer update store → IPC → Main AppUpdater → 目标 feed | Main 记录并重抛原始错误；Renderer 只显示去重、脱敏的单条提示，稳定源缺包不伪装为最新版 |
 | 设计会话创建/切换 | AI 绘画页面或侧栏 | Renderer API → Main → Workspace Conversation API | 新会话属于现有 Workspace；读取独立消息、Brief、Quote 和 `turnRevision` |
-| 设计消息与确认 | 当前 Conversation | Main → 持久 Agent Gateway Session → Conversation 快照 | 请求和流式结果同时绑定 Workspace + Conversation |
+| 设计消息与确认 | 当前 Conversation | Main ↔ 持久 Agent Gateway Session WebSocket → Conversation 快照 | `command.submit`、Run 与设计事件共用连接；传输失败才以同一幂等 ID 回退 REST；结构化业务错误不重试且未知文本由 Main 脱敏；请求和流式结果同时绑定 Workspace + Conversation |
 | 设计单图来源选择 | 当前 Workspace 已完成图片 / 本地图片 | 现有 Asset 上传或选择 → `attachmentAssetIds` → 当前 Conversation Turn | 图片 Brief 用作图生图参考图；视频 Brief 用作首帧；只提交一个真实 Workspace Asset ID |
-| 设计任务同步 | 任一 Conversation 的事件流 / REST | Renderer Workspace 任务列表 | Task 和 Asset 按 Workspace 归并，切换 Conversation 后仍可见 |
+| 设计任务同步 | 任一 Conversation 的事件流 / Quote REST 对账 | Renderer Workspace 任务列表 | Task 和 Asset 按 Workspace 归并；任务已落库但 Run 失败时恢复可见性，内部对账失败不覆盖新会话错误，切换 Conversation 后仍同步任务但不回写旧会话 |
 
 ## State Ownership
 
@@ -41,8 +41,8 @@
 - 本机 Host API 的 OpenCode session、history 与 prompt 路由，以及 Main-owned AI 模型代理。
 - Main-owned electron-updater IPC 与 Works Square 平台/架构稳定 feed；正式安装产物发布不由 Renderer 控制。
 - 服务端安全投影后的公共 `play_url`；只接受同源 HTTPS、精确 App 路径和可信版本状态。
-- Works Square Workspace/Conversation API、每个 Conversation 的 Agent Gateway Session 与单次 WebSocket ticket。
+- Works Square Workspace/Conversation API、每个 Conversation 的持久 Agent Gateway Session、单次 WebSocket ticket、双向命令/事件帧与幂等 REST 传输回退。
 
 ## Last Updated
 
-2026-08-13
+2026-08-14

.project-docs/20-architecture/module-map.md

@@ -23,9 +23,9 @@
 | `src/components/settings/UpdateSettings.tsx` | 更新状态、重试与用户可读错误展示 | 只显示一条简洁中文提示；技术诊断统一回退到本地化通用文案 |
 | `shared/image-workspace.ts` | AI 绘画 Workspace、Conversation、Task、Asset 与事件共享契约 | Conversation 状态与 Workspace 任务归属必须分离 |
 | `electron/api/routes/image-workspace.ts` | AI 绘画 Host API 与本地事件流投影 | Renderer 只通过该路由访问 Main-owned workspace adapter |
-| `electron/image-workspace/works-square-workspace.ts` | Works Square 多 Conversation 云端适配器与 Gateway 事件映射 | 使用服务端持久 Session；本地清理不 DELETE 远端 Session |
+| `electron/image-workspace/works-square-workspace.ts` | Works Square 多 Conversation 云端适配器与双向 Gateway 命令/事件映射 | 使用服务端持久 Session；WebSocket 传输故障才以同一幂等 ID 回退 REST；未知 Gateway 错误文本不得穿透安全投影；本地清理不 DELETE 远端 Session |
 | `electron/image-workspace/local-workspace.ts` | 未打包开发模式的本地 Workspace 适配器和 v2→v3 迁移 | 仅开发使用，不得成为打包回退 |
-| `src/stores/image-workspace.ts` | 当前 Workspace/Conversation、项目任务及流式更新状态 | 异步结果按 Workspace + Conversation generation/revision 防护 |
+| `src/stores/image-workspace.ts` | 当前 Workspace/Conversation、项目任务及流式更新状态 | Quote/task 按 Workspace 无 UI 错误副作用地对账；Conversation 写入按 Workspace-load + Conversation-selection generation/revision 防护 |
 | `src/pages/ImageCanvas/index.tsx` | Conversation 对话、Quote 确认、统一任务列表、新会话入口与单图来源选择器 | 图片 Brief 选择/上传图生图参考图；视频 Brief 绑定首帧；均提交一个 Workspace Asset ID |
 | `src/components/layout/ImageWorkspaceSidebar.tsx` | Workspace 与近期 Conversation 切换/创建 | 切换会话不清空项目级任务 |
 
@@ -46,9 +46,10 @@
 - `ai-proxy.ts` 的上游饱和状态投影依赖当前固定 OpenCode 的重试语义和窄化错误文案；升级 runtime 或调整上游错误格式时必须复核，不能把所有 `429` 统一终止。
 - `electron/main/updater.ts` 的稳定源错误归一化必须保持窄化：只识别 Works Square 对应 manifest 的 404，不得吞掉其他 feed/网络/签名错误；Renderer 的脱敏边界不能取代 Main 原始日志。
 - 多 Conversation 事件处理必须区分对话快照与 Workspace 任务更新；不得用任务时间戳推进 Conversation 流水位，也不得让旧会话的迟到流覆盖当前会话。
+- Gateway 命令的 REST fallback 只处理 WebSocket 发送、断连和 ACK 超时，必须复用 `client_command_id`；业务错误回退会造成重复提交。Quote 任务恢复只更新 Workspace 所有的任务，不能覆盖当前 Conversation。
 - `closeEventSessions` 只负责本地流和缓存生命周期；远端 Conversation Session 是服务端持久资源。
 - 单图来源选择器当前仍由精确中文 quick reply 触发，并以 Brief medium 判断图生图或视频首帧用途；扩展更多输入用途前应先把消息协议升级为结构化 action/purpose，避免展示文案与行为继续耦合。
 
 ## Last Updated
 
-2026-08-13
+2026-08-14

.project-docs/20-architecture/system-overview.md

@@ -20,7 +20,7 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展
 | AI Design Workspace | 保存项目身份、Conversation 列表、生成任务和资产 | 任务和资产在切换 Conversation 后继续可见 |
 | AI Design Conversation | 保存消息、Brief、Quote、`turnRevision` 与服务端 Agent Session 绑定 | 同一 Workspace 内互相隔离；Session 由服务端持久化 |
 | AI Design Image Source Picker | 当前 Workspace 已完成图片或本地上传 | 图片 Brief 绑定图生图参考图；视频 Brief 绑定首帧；提交一个真实 Asset ID |
-| AI Design Event Routing | Main 云端适配器 → Host API/SSE → Renderer store | Conversation 更新按 Workspace + Conversation 路由；任务更新按 Workspace 归并 |
+| AI Design Gateway Routing | Main 云端适配器 ↔ Conversation WebSocket；Main → Host API/SSE → Renderer store | 命令、Run 与设计事件共用双向 WebSocket；Conversation 更新按 Workspace + Conversation 路由，任务更新按 Workspace 归并 |
 
 | Robot Workspace | Account-scoped agent configuration, device activation/binding, assignment, and credential-recovery UI | Renderer receives only safe Works Square projections; credentials, activation-code history, and upstream error bodies remain outside durable UI state. |
 | AI Hardware Main Route | Fixed `/api/works/ai-hardware` Host API to Works Square proxy | Main owns Bearer auth, stable operation IDs, bounded retry, ETag/If-Match, request/response limits, and error redaction. It never forwards Renderer authorization headers. |
@@ -45,7 +45,9 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展
 - 落盘文件名 `works-cloud-deploy.json` 仅为已安装客户端的数据兼容；领域模型和代码接口是 submission binding，不表示仍存在 cloud deployment coordinator。
 - AI 绘画中，一个 Workspace 可包含多条 Conversation；消息、Brief、Quote 和 `turnRevision` 属于 Conversation，生成任务和资产属于 Workspace。新建 Conversation 不得隐式创建新 Workspace。
 - 每条 Conversation 复用服务端持久 Agent Gateway Session。客户端不得在注销或退出时 DELETE 该 Session；只关闭本地事件流并清除本机 Session-id 缓存，重新访问时从 Conversation API 刷新。
+- 已连接的 Conversation Session 通过同一 WebSocket 提交 `command.submit` 并接收 `command.accepted`、Run 与设计事件。只有发送失败、连接关闭或 ACK 超时属于可回退的传输故障，REST 必须复用同一 `client_command_id`；结构化 Gateway 业务错误不得再次提交，未知上游错误文本不得穿透 Main 安全投影。
 - Renderer 的异步与流式状态必须同时校验 Workspace + Conversation 身份；项目任务事件只按 Workspace 归并，避免切换会话时丢失任务或接收迟到消息。
+- 确认生成按 Quote 对账 Workspace 任务。任务事务已提交但 Run 随后失败时可通过 REST 恢复任务可见性；内部任务对账失败不写当前 Conversation 的用户错误，任务恢复也不授权旧请求回写已切换的 Conversation 或清理新 pending turn。
 - Updater feed 选择、原始错误日志、下载和安装生命周期只属于 Electron Main。Renderer 不得把缺失稳定 manifest 投影为“已是最新版”，也不得显示原始堆栈、URL、路径或错误码；并发检查共享同一错误事件时只发送一次错误状态，后续独立重试仍可重新报告。
 - 图片与视频复用同一个单图来源选择器。图片 Brief 可从当前 Workspace 的已完成作品或本地上传中选择一张参考图继续生成；视频 Brief 使用同一入口绑定首帧。两条路径都必须通过现有 Workspace Asset 上传/选择契约提交一个真实 `attachmentAssetIds`，不得用本地路径或自然语言描述代替资产身份。
 - 当前兼容协议仍通过精确 quick reply `从作品列表选择图片` 打开选择器，并由当前 Brief medium 区分用途；仅 `medium === image` 使用图生图语义，`video`、null 或缺失 medium 保持视频首帧语义。该展示文案耦合不得扩散到更多用途，后续应升级为结构化 action/purpose。
@@ -56,4 +58,4 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展
 
 ## Last Updated
 
-2026-08-13
+2026-08-14

.project-docs/30-worklog/current-state.md

@@ -4,6 +4,7 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 ## Integrated Through
 
+- `22378efcee07e7fb80b651e65e3202f1a1dfea1d`: AI Canvas bidirectional Agent WebSocket commands, idempotent transport fallback, and Quote-based generation-task recovery.
 - `aba5cae286807093cf4ef643fe9f498050985c31`: Robot / AI hardware module, Main-owned Works Square proxy, and cross-repository wire contract.
 - `86ece3a` / `4dde8f3`：客户端登录七天滑动续期及集成提交。
 - `724290e` / `dcc92fc`：Main-owned 一键打包提交审核及集成提交。
@@ -21,7 +22,7 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 客户端面向非专业用户提供“创建小游戏或小程序 → 项目配置中一键提交 → Main 本地 npm/Vite 构建 → Electron 双视口预检最终产物 → 上传 source+built 双归档与 contract → 运营审核”的唯一创建者链路。Main 对安全源码快照运行安装包内固定 npm 11.6.2 的 `npm ci --ignore-scripts`，再显式调用项目 `package-lock.json` 锁定的 Vite；Vite config/plugins 以当前桌面用户权限执行，因此只适用于用户信任的本地项目，不是 sandbox。预检由 Main 以临时 loopback origin 和 Electron WebContents/CDP 检查与最终 `built_archive` 相同的内存文件字节，覆盖桌面/移动视口、运行错误、白屏和外域访问；不使用 Playwright。该检查仍可由非官方客户端绕过，不产生可信 receipt，也不复刻生产 opaque-origin。服务端不再替客户端运行项目 Vite，而是把源码、构建归档和 contract 视为不可信输入，逐字节重算与校验并固化不可变 Release；人工审核仍不可绕过。自定义和缺少类型字段的旧项目不提供该入口。已发布作品优先使用安全投影后的 `play_url`，`runtime_url` 仅保留一个客户端版本的兼容回退。
 
-AI 绘画的一个 Workspace 可包含多条 Conversation。消息、Brief、Quote 和 `turnRevision` 随 Conversation 隔离；生成任务和资产保持 Workspace 级共享。图片 Brief 支持文生图，以及从当前项目已完成作品或本地上传中选择一张参考图继续生成；视频复用同一选择器绑定首帧。两条路径都通过现有 Workspace Asset 契约提交一个真实 Asset ID。每条 Conversation 使用服务端持久 Agent Gateway Session，切换会话只重连对应事件流。
+AI 绘画的一个 Workspace 可包含多条 Conversation。消息、Brief、Quote 和 `turnRevision` 随 Conversation 隔离；生成任务和资产保持 Workspace 级共享。图片 Brief 支持文生图，以及从当前项目已完成作品或本地上传中选择一张参考图继续生成；视频复用同一选择器绑定首帧。两条路径都通过现有 Workspace Asset 契约提交一个真实 Asset ID。每条 Conversation 使用服务端持久 Agent Gateway Session；连接正常时命令、Run 与设计事件共用双向 WebSocket，只有发送、断连或 ACK 超时等传输故障才以同一 `client_command_id` 回退 REST，结构化业务错误不重复提交且未知上游文本由 Main 脱敏。确认生成会按 Quote 对账 Workspace 任务；任务已经落库但 Run 随后失败时仍恢复任务列表，内部对账失败不覆盖当前 UI 错误，同时 Conversation 写入继续受 Workspace-load 与 Conversation-selection generation 保护。
 
 AI 编程首次发送在新建 OpenCode session 已知为空时不再等待冗余历史读取，prompt 可直接进入 Host API；普通历史会话仍刷新消息。Main AI proxy 只把明确的上游分组饱和投影为当前 OpenCode 的终止状态，配额耗尽保持独立终止态，通用限速继续保留 `429`。
 
@@ -29,6 +30,7 @@ Updater 仍由 Electron Main 选择目标 feed、记录原始诊断并保持失
 
 ## Recently Completed
 
+- 2026-08-14: AI Canvas Agent 命令与流式事件改为共用双向 Conversation WebSocket，并保留仅面向传输故障的幂等 REST 回退；结构化 Gateway 错误不重试且未知文本脱敏；确认生成按 Quote 恢复已落库任务，切换 Conversation 后仍同步 Workspace 任务且不覆盖新会话状态或错误。
 - 2026-08-13: Integrated the enabled `Makelore Robot` top-level module at `/ai-hardware`. Renderer uses typed safe DTOs while Electron Main owns Works Square authentication, idempotency identities, ETag/If-Match forwarding, response projection, limits, timeouts, and credential recovery. Robot and Canvas routes no longer initialize AI Programming projects/providers. No production deployment or real activation-code smoke is claimed.
 - 2026-08-08：合并登录续期和一键发布；发布成功后保存精确 app/version/review 映射，Renderer 不接触 Token、ZIP 或本地路径。
 - 2026-08-08：补齐跨平台 Electron E2E fixture、Windows ZIP 预检和异常成功响应安全投影。
@@ -66,6 +68,7 @@ Updater 仍由 Electron Main 选择目标 feed、记录原始诊断并保持失
 - 本地构建必须使用安装版 Electron Node、固定 npm 11.6.2 和项目 `package-lock.json` 锁定的 Vite，不得回退到全局 PATH、已有 `node_modules` 或未验证的 npm 闭包；依赖安装需要网络。
 - 项目 Vite config/plugins 以桌面用户权限执行，不能称为 sandbox；此风险边界必须在发布说明中保留。
 - AI 绘画消息、Brief、Quote 和 `turnRevision` 必须按 Workspace + Conversation 隔离；任务事件仍按 Workspace 归并，迟到的异步结果不得污染已切换的会话。
+- AI 绘画 WebSocket 命令只能在传输发送、连接关闭或 ACK 超时时回退到 REST，并必须复用原 `client_command_id`；Gateway 结构化业务错误不得触发重复提交，未知错误文本不得进入 Renderer。确认后的任务恢复必须按不可变 Quote 身份归并到 Workspace，不能用任务恢复放宽 Conversation generation 门禁或覆盖新会话错误。
 - 服务端持久 Conversation Session 不由客户端在注销或退出时删除；Main 只关闭本地流、清除本机缓存并撤销本地凭据。
 - 客户端对最终构建字节的 loopback 检查没有可信 receipt，且不复刻生产 opaque-origin；服务端必须独立重算 source/built/contract、校验不可变 Release，人工审核仍不可绕过。如未来需要不可绕过的 runtime gate，必须引入可信 verifier 并绑定精确构建产物。
 - AI proxy 的明确饱和 `429 → 400` 是与当前 OpenCode 重试契约匹配的内部投影；升级 OpenCode 或上游饱和错误文案变化时必须复核。不得把通用 `429` 或仅含 `rate_limit_exceeded` 的响应误分类为终止饱和。
@@ -74,4 +77,4 @@ Updater 仍由 Electron Main 选择目标 feed、记录原始诊断并保持失
 
 ## Last Updated
 
-2026-08-13
+2026-08-14

.project-docs/30-worklog/tasks/20260813-sync-push-main-9c2f71.md

@@ -12,6 +12,7 @@
 
 ## Scope
 
+- On 2026-08-14, resume the existing Integration owner to merge reviewed AI Canvas source commit `22378efcee07e7fb80b651e65e3202f1a1dfea1d` into local `main` and promote its accepted project-memory candidates.
 - Resume the existing integration owner to fast-forward the completed Robot / AI hardware source commit into local `main` after verifying the current remote `main` tip.
 - Fetch the authoritative remote `main`, inspect all commits not present in the
   local branch, and merge them into the reviewed local `main` without rewriting
@@ -35,6 +36,7 @@
   semantic reconciliation.
 - Push only after the merge result is clean, verified, and independently
   reviewed. Never use `--force`.
+- The 2026-08-14 user request authorizes the local `main` merge only. It does not expand this resumption into a remote push; the existing authentication blocker remains a separate follow-up.
 
 ## Project Context Loaded
 
@@ -82,16 +84,22 @@ Relevant understanding:
 Gate result:
 - Passed.
 
+### 2026-08-14 AI Canvas Integration Resume
+
+- Reused the same Integration owner because it still exclusively owns `main` and the repository integration lock; `task_context.py touch` refreshed the existing reservation.
+- Verified the main worktree was clean at `88f9ee8708beeb1ab45ca741807f6cca0f075ac9` before merging.
+- `git fetch origin main --prune` confirmed `origin/main` is also `88f9ee8708beeb1ab45ca741807f6cca0f075ac9`.
+- Source `22378efcee07e7fb80b651e65e3202f1a1dfea1d` is exactly one commit ahead of `main`, with `88f9ee8` as merge base; no remote-only or unrelated main commit exists.
+- Read the source task, ADR-001, canonical AI Canvas architecture/domain memory, and all registry-owned peer task Scope / Intent / Promotion Candidate sections. The source preserves Workspace-owned tasks and Conversation-owned state; no semantic conflict requires human resolution.
+- Gate result: Passed for the local AI Canvas merge. Remote push remains outside this resumption.
+
 ## Plan
 
-1. Commit this integration ownership record, fetch `origin/main`, and inspect
-   remote-only commits, paths, and topology.
-2. Merge `origin/main` normally with local `main` as first parent; resolve any
-   conflict semantically and inspect the combined tree.
-3. Run focused/full checks required by the fetched changes plus project-document
-   gates, then obtain a final independent Sol PASS/FAIL review.
-4. Complete documentation, push `main` without force, verify local/remote tip
-   equality, and release the clean integration task.
+1. Fetch `origin/main` and verify local `main`, the remote tip, and reviewed AI Canvas source commit topology.
+2. Merge `22378ef` normally into local `main` without rebase/reset, and retain the source commit as a dedicated second parent.
+3. Promote the bidirectional Gateway and Quote-reconciliation facts into canonical project memory.
+4. Re-run focused/full checks, production build, project-document gates, and independent Sol review.
+5. Commit the verified local merge; do not push unless the user separately requests it and authentication is available.
 
 ## Outcome
 
@@ -149,6 +157,13 @@ Gate result:
 - Completion is blocked only on the user authenticating this machine for
   `git.nianxx.cn`. Keep this integration task owned and do not release it until
   a normal push succeeds and `origin/main` is verified equal to local `HEAD`.
+- On 2026-08-14, the user requested a local-main merge of reviewed AI Canvas source `22378ef`. A fresh fetch verified local and remote `main` were both `88f9ee8`, and the source was exactly one descendant commit with no unrelated overlap.
+- Started a normal `--no-ff --no-commit` merge of `22378ef`; Git reported no textual conflict. The source task record remains intact on source commit `22378ef` and its feature branch, and is excluded from the `main` result to preserve task-document ownership boundaries.
+- Promoted the accepted source facts into canonical current-state, architecture, data-flow, business-rule, evidence, and commitment records: connected Conversation commands/events are bidirectional over WebSocket; REST fallback is transport-only and idempotent; Quote task recovery remains Workspace-owned while Conversation writes retain generation guards.
+- Merge validation exposed a pre-existing AI Hardware test race: the edit button is rendered disabled while configuration loads, but four tests clicked it after waiting only for existence. Under full-suite load the browser correctly ignored the disabled click. The tests now wait for the button to become enabled and for the dialog heading; production Robot behavior is unchanged.
+- The first independent AI Canvas merge review returned `FAIL` on two integration gaps and one safety subfinding: stale confirmation task-refresh errors could overwrite a newer Conversation error, top-level structured WebSocket command errors lacked focused coverage, and unknown Gateway messages could expose upstream details. Confirmation reconciliation now uses an internal task refresh without UI-error side effects; explicit user refreshes retain their error behavior. Matching WebSocket errors are tested as non-retryable, and unknown codes project a fixed Chinese fallback instead of the server message.
+- The second independent Sol review returned `PASS` with no blocking findings after those corrections. The verified no-ff merge is ready to commit with `88f9ee8` as first parent and `22378ef` as second parent.
+- This resumption intentionally does not push. The previous remote authentication follow-up remains unchanged and does not block completion of the user's requested local merge.
 
 ## Verification
 
@@ -172,6 +187,19 @@ Gate result:
 - Merge topology — verified first parent `1c85bc0`, second parent `f4113a8`.
 - Push — attempted normally, rejected before ref update because remote
   authentication is unavailable on this machine.
+- 2026-08-14 AI Canvas focused selection — 3 files / 74 tests passed on the merged `main` tree.
+- AI Hardware readiness regression — full `ai-hardware-page.test.tsx` passed 24/24 after replacing existence-only clicks with enabled/dialog readiness waits.
+- `pnpm test` — the original full-suite loop failed twice at the same disabled-button race before the test hardening; the post-fix run passed 156 files / 1687 tests.
+- `pnpm run typecheck` — passed after the integration test hardening.
+- `pnpm run lint:check` — passed with 0 errors and 6 unchanged warnings outside the merge paths.
+- `pnpm run build:vite` — Renderer, Electron Main, and Preload production builds passed; existing chunk-size and mixed-import warnings remain.
+- Post-review focused checks — Works Square adapter 27/27 and Image Workspace Store coverage passed, including top-level WebSocket errors, unknown-message redaction, A→B task-refresh failure isolation, and explicit-refresh error reporting.
+- Final post-review `pnpm test` — 156 files / 1691 tests passed.
+- Final post-review `pnpm run typecheck` — passed.
+- Final post-review `pnpm run lint:check` — passed with 0 errors and the same 6 warnings outside the merge paths.
+- Final post-review `pnpm run build:vite` — Renderer, Electron Main, and Preload passed; only the existing mixed-import and chunk-size warnings remain.
+- Second independent final review — `PASS`; it re-ran 4 files / 102 tests plus typecheck, found no unmerged entries or unstaged changes, and confirmed the previous state-isolation, structured-error coverage, and redaction findings are closed.
+- Final project-document ownership drift, structure checks, and staged/unstaged whitespace checks — passed before the merge commit.
 
 ## Follow-ups
 

.project-docs/40-domain/business-rules.md

@@ -24,6 +24,8 @@
 - Conversation 持有消息、Brief、Quote 和 `turnRevision`；生成任务和资产属于 Workspace，切换 Conversation 后必须继续可见。
 - 每条 Conversation 使用服务端持久 Agent Gateway Session。客户端注销或退出时只关闭本地流并清除本机 Session-id 缓存，不删除服务端 Session。
 - Conversation 异步与流式更新必须同时核对 Workspace 和 Conversation 身份；任务事件按 Workspace 归并。
+- 已连接的 Conversation Agent 命令、Run 和设计事件共用 WebSocket。只有命令发送失败、连接关闭或 ACK 超时可用同一 `client_command_id` 回退 REST；Gateway 结构化业务错误不得重复提交。Main 只向 Renderer 投影已知错误码的固定中文提示，未知上游错误文本必须脱敏为通用提示。
+- 确认生成后按 Quote 对账 Workspace 任务。任务已经落库但 Run 随后失败时应恢复右侧任务列表；切换 Conversation 后仍同步 Workspace 任务，但旧确认不得覆盖当前 Conversation、清除其 pending turn，或用任务对账失败覆盖新会话错误。
 - 图片生成支持无参考图的文生图和单参考图图生图；参考图必须来自当前 Workspace 的已完成图片 Asset，或先通过现有 Workspace 上传接口把本地图片转成 Asset，再随当前 Conversation Turn 提交唯一 Asset ID。
 - 视频首帧与图生图参考图复用单图选择器，但用途由当前 Brief medium 决定：只有明确 `image` 使用图生图语义，`video`、null 或缺失值保持视频首帧兼容语义。选择作品或上传成功后应关闭弹窗。
 - 当前 quick reply 文案匹配只是兼容契约；新增更多素材输入用途前，应改为结构化 action/purpose，不得继续依赖本地化展示字符串推断行为。
@@ -36,7 +38,8 @@
 - 多 Conversation 客户端发布前需确认服务端迁移 `0033`、Conversation API 与持久 Session 契约已经部署。
 - 图生图随客户端发布前，需确认相匹配的服务端 `image_to_image` Brief/Quote/Task 冻结、私有源图复核与 Bailian edit 执行链已部署，并使用真实 Workspace Asset 完成生产 smoke。
 - Updater 生产恢复仍需对齐权威版本、发布正式签名/公证的平台产物，并从旧安装版本执行发现、下载、重启和安装 smoke；源码提示修复本身不构成发布链恢复。
+- AI Canvas 双向 Gateway 与 Quote 任务恢复仍需真实账号执行一次生产确认 smoke，核对 WebSocket 不产生 `/runs/{run_id}` 轮询、任务按 Quote 出现在 Workspace 列表，并区分真正的 `agent_runtime_unavailable` worker 故障。
 
 ## Last Reviewed
 
-2026-08-13
+2026-08-14

.project-docs/50-evidence/evidence-index.md

@@ -11,6 +11,7 @@ Use this index for searchable, traceable evidence records.
 | 2026-08-12 | AI 编程首次会话等待与上游饱和重试 | 本地功能验证通过；真实冷启动各阶段耗时尚未遥测 | 源任务 `20260812-first-chat-fix-b84fd29c`、`08da976`、`0ee5254` | 4 个相关单测文件 228/228、typecheck、scoped lint、Vite build 与真实 Electron E2E 通过；全量单测的 3 个失败与 `main` 基线一致，修复证明 prompt 不等待已知空历史，但不宣称消除所有 runtime 冷启动耗时 |
 | 2026-08-13 | AI 绘画单参考图图生图客户端 | 本地功能验证通过；未执行安装包或真实 Provider smoke | 源任务 `20260812-design-image-to-image-client-c91e`、`809364e`、集成 `88281b8`、兼容修复 `7a807a2` | 25 项页面回归覆盖图片作品选择、本地上传、视频首帧及 null-medium 兼容；22 项云端适配器回归覆盖 REST/WebSocket 缺失 medium 归一化与非法值拒绝；typecheck、scoped lint 与 Vite build 通过，生产部署与付费生成另行验收 |
 | 2026-08-13 | Makelore Updater 稳定源诊断与错误展示 | 本地功能与构建验证通过；未发布或安装正式包 | `30-worklog/tasks/20260813-makelore-updater-client-7d3a9c.md`、`f05b9d4` | 4 files / 37 focused tests、typecheck、scoped lint 与 `build:vite` 通过；并发共享错误只投影一次，设置页不显示技术诊断。可用本地产物未签名，真实升级链仍待 Release Owner 验收 |
+| 2026-08-14 | AI Canvas 双向 Gateway 与确认任务恢复 | 本地功能验证通过；未执行真实账号付费生成 smoke | 源任务 `20260814-design-generation-runtime-7d3a`、源提交 `22378ef` | 3 files / 74 focused tests、156 files / 1687 full tests、typecheck、lint、Renderer/Main/Preload build 与独立 Sol review 通过；覆盖 WebSocket 命令关联、幂等传输回退、Quote 任务恢复、Conversation 切换与 ABA，生产 worker 故障仍需真实环境区分 |
 
 ## When To Add Evidence
 

.project-docs/80-commitments/commitments.md

@@ -12,6 +12,7 @@ Track future-facing memory: promised follow-ups, unfinished loops, timed checks,
 | 2026-08-13 | 将 AI 绘画素材选择 quick reply 升级为结构化 action/purpose | 新增第三种素材输入用途、调整本地化文案或重构 Design Message 协议时 | 客户端/服务端集成 | Pending | 用 `select_image_asset` + `image_reference | video_first_frame` 等稳定字段替代精确中文字符串匹配，并覆盖延迟 Brief 快照兼容 |
 | 2026-08-13 | 完成图生图客户端与服务端生产整链 smoke | 相匹配客户端与服务端部署后 | 客户端/服务端集成 | Pending | 用当前 Workspace 已完成作品与本地上传各执行一次图生图，核对 Asset 所有权、Quote、任务创建、结果展示与下载；不以本地单测替代付费 Provider 验收 |
 | 2026-08-13 | 发布并验收 Makelore 稳定更新链 | 权威版本对齐且 Windows/macOS 正式产物已签名/公证后 | 客户端发布 | Pending | 将 updater-role 产物 inactive-first 发布到 Works Square，核对 manifest/签名/架构后激活，并从旧稳定版执行发现、下载、重启、安装与版本确认 smoke；源码错误文案不替代该验收 |
+| 2026-08-14 | 验收 AI Canvas 双向 Gateway 与 Quote 任务恢复 | 匹配客户端与服务端部署后 | 客户端/服务端集成 | Pending | 用真实账号确认一次图片生成，核对连接期间命令/Run/设计事件共用 WebSocket、无 `/runs/{run_id}` 轮询、任务按 Quote 出现在 Workspace 列表；若无任务且返回 `agent_runtime_unavailable`，检查 Gateway Run/worker traceback 与关联日志 |
 
 ## Use