merge: require cover for first project submission

.project-docs/30-worklog/tasks/20260813-sync-push-main-9c2f71.md

@@ -309,6 +309,10 @@ Gate result:
 
 ## Outcome
 
+- Prepared a normal no-ff merge of project-cover source `145a6ce571d646325092d1e722282babea503954` onto local `main` `da376b0bf37cdd0b5eabe7efc9f1141ae5645411` with no textual conflicts; the source feature task record remains only on the source branch.
+- Reconciled the obsolete coverless-first-create rule into required first-cover atomic submission while retaining existing-project version-only behavior and the unfulfilled conditional metadata-editing commitment.
+- Final project-cover merge commit is pending independent read-only review.
+
 - Created local main merge commit `3b37ac318782de5ee6f3338c9744ec66df14f674` with exact parents `7e8d9e38114158992c03e589de32535274796d04` and reviewed source `55e61b7d8f9caccdad54dc9a42092fc7960fb394`. The source is now a `main` ancestor, and its task record remains absent from the integrated tree.
 - On 2026-08-17, staged a normal no-ff merge of reviewed macOS Robot hotspot source `55e61b7` onto clean local `main` at `7e8d9e3`; Git reported no textual conflicts. The source task record remains reachable on its source commit/branch and is excluded from the integrated tree.
 - The staged tree performs exactly one 250 ms worker-thread rescan when the first macOS CoreWLAN result is empty or every returned SSID is unavailable. A recovered candidate continues through the unchanged open/printable `Xiaozhi-*` Module filter; two empty scans remain an empty result; a second non-empty fully redacted result becomes the existing fixed permission error.
@@ -326,7 +330,7 @@ Gate result:
 - Added a real Electron Learning navigation smoke and corrected three OpenCode slash-command E2E setup races by entering Code through the module chooser after setup. Production behavior was unchanged by the OpenCode test correction.
 - Fixed the repository E2E script to invoke the declared `@playwright/test@1.59.0` CLI directly. The prior `pnpm playwright test` path selected a transitive alpha `playwright` CLI from `@playwright/mcp`, producing a false version-mismatch failure.
 - The first independent final Learning merge review returned `FAIL` on four P1, three P2 and one P3 findings: Renderer-self-asserted course identity, account-switch token TOCTOU, old player/progress/form reuse, same-origin navigation bridge recovery, overlay-only profile gating, non-authoritative published status, premature documentation claims, and direct Renderer event IPC. The merge now revalidates installed/registered course identity in Main, threads captured binding guards through token/fetch/401 boundaries, closes and rotates player sessions, partitions/clears Renderer state, permanently disables a navigated iframe bridge, blocks Learning Outlet execution until profile readiness, re-reads strict project status after 409, corrects canonical nonce wording, and routes events through an allowlisted API-client seam.
-- The second independent Learning merge review returned `FAIL` on two P1 and four P2 findings: Agent/runtime could register the requested course before checking active-player identity; executable same-origin course assets could message before a second iframe load; profile sync errors could leave an empty deep link; Works cover/metadata lacked atomic concurrency; material-generation IPC was not fully strict; and canonical evidence overclaimed closure. The final code separates side-effect-free `resolveClassroom` from explicit player registration, validates pre-existing active registration before Agent/runtime resolution, restricts course media to exact passive MIME/extension pairs with nosniff/sandbox CSP, renders a retryable profile error gate, strictly projects generation upload DTOs before auth/network, and adopts an honest coverless-first-create / existing-version-only Works workflow whose races fail closed without cover or PATCH side effects.
+- The second independent Learning merge review returned `FAIL` on two P1 and four P2 findings: Agent/runtime could register the requested course before checking active-player identity; executable same-origin course assets could message before a second iframe load; profile sync errors could leave an empty deep link; Works cover/metadata lacked atomic concurrency; material-generation IPC was not fully strict; and canonical evidence overclaimed closure. The final code separates side-effect-free `resolveClassroom` from explicit player registration, validates pre-existing active registration before Agent/runtime resolution, restricts course media to exact passive MIME/extension pairs with nosniff/sandbox CSP, renders a retryable profile error gate, strictly projects generation upload DTOs before auth/network, and at that checkpoint adopted a coverless-first-create / existing-version-only Works workflow whose races failed closed without cover or PATCH side effects. The current project-cover resumption supersedes only that coverless-first-create checkpoint.
 - The third independent Learning merge review returned `FAIL` on one P2 integration mismatch: the package consumer admitted `fonts/*`, while the player server only routed `audio|media`, so a declared playable font would install and then 404. Consumer and server now share the exact root/module `audio|media|fonts` directory contract and passive extension/MIME set; unsupported directories fail installation/HTTP lookup, and real registered ZIP-to-HTTP tests verify root WOFF and module WOFF2 with the expected MIME and security headers.
 - The fourth independent Learning merge review returned `FAIL` on one remaining P2 composition bug: allowing a manifest-relative `modules/<id>/...` path caused the authoritative module root to be prepended twice. Manifest media paths now begin only with relative `audio|media|fonts`; the module prefix comes solely from `location.root`. A consumer-to-classroom-URL-to-registered-ZIP-to-real-HTTP test proves exactly one module prefix, correct WOFF2 bytes/MIME/security headers, and rejection of manifest-supplied `modules/` or other directories.
 - The fifth and final independent Learning merge review returned `PASS` on Standards and Spec with no P0-P3 findings. It confirmed the consumer-generated modular font URL traverses the registered ZIP and real player HTTP response with one module prefix, and found no regression in registration, media safety, profile recovery, Works version-only behavior, generation DTOs, identity guards, canonical documents, packaging, Robot/Canvas, or the lock graph.
@@ -442,6 +446,10 @@ Gate result:
 
 ## Verification
 
+- Project-cover source verification: 3 focused Vitest files / 76 tests, typecheck, scoped ESLint, Vite production build, focused Electron E2E 1/1, and cross-repository Sol review all passed.
+- Project-cover merged tree: 3 focused Vitest files / 76 tests, `tsc --noEmit`, scoped ESLint, Renderer/Main/Preload Vite production build, and focused Electron E2E 1/1 all passed; build emitted only the existing dynamic-import and chunk-size warnings.
+- `check_project_docs.py`, task-aware `check_doc_drift.py`, and `git diff --cached --check` passed for the prepared project-cover merge.
+
 - Post-commit topology confirms merge `3b37ac3` has exact parents `7e8d9e3` and `55e61b7`, the source tip is a `main` ancestor, the source task record is absent from `main`, and the product worktree was clean before this evidence-only documentation update.
 - 2026-08-17 independent final macOS Robot hotspot staged-merge review — Standards `PASS`, Spec `PASS`, overall `PASS`, with no P0-P3 findings. It confirmed exact staged topology/scope, source-record exclusion, bounded worker-only retry, retained 8s abort/termination, unchanged filtering/connect contracts, and honest signed-macOS physical-smoke residual risk.
 - 2026-08-17 macOS Robot hotspot staged-merge regression — `tests/unit/robot-hotspot-module.test.ts` passed 14/14, covering first-scan recovery, persistent SSID redaction, bounded double-empty behavior, security filtering, RSSI/current-SSID projection, worker termination, candidate expiry, exclusivity, and exact-current-SSID verification.
@@ -589,7 +597,7 @@ Gate result:
 
 - Before releasing the per-user module-entry policy, deploy the Works `module_access` migration and `/api/auth/me` contract, build and install a new Makelore package, then use a real account to disable Code, Canvas, Learning and Robot one at a time and smoke chooser/root/deep/alias behavior, global settings, terminal `401`, and independent server-side API authorization.
 - Before releasing Learning, run a real Works account through catalog, generation/material/cancel-resume, bounded download, offline multi-module playback, progress, Agent, ASR and PBL/scoring using the exact production Stage artifact. Validate packaged loopback cookie/nonce behavior on Windows and a signed macOS build; current automation is not that acceptance.
-- Before restoring project cover upload or editing metadata on an existing draft/published project, add and verify a server-owned revision/ETag plus draft-only conditional write and atomic cover attachment or cleanup. Until then the client intentionally creates new projects without a cover and treats existing projects as version-only.
+- First-project cover upload is implemented by client source `145a6ce` and server source `407c883` / local merge `0cedfc4`; before release, deploy the server, package the client, and verify a real account/object-store flow including create conflict, cover failure, and version-upload blocking. Editing metadata on an existing draft/published project still requires a server-owned revision/ETag plus draft-only conditional write; until then existing projects remain version-only.
 - Complete the visible Git Credential Manager/PowerShell authentication prompt, then fetch and verify `origin/main` equals the local tip before recording push completion and releasing this Integration task.
 - Packaging audit follow-ups outside this merge remain: verify macOS/Linux OpenCode multi-architecture staging, remove any unsupported Windows ARM64 advertising, pin the uv installer by digest, and replace unauthenticated curl-style installer paths before those release lanes are trusted.
 - Before releasing Prompt Museum and the expanded Canvas deletion/repricing workflow, use a real Works account to validate Museum list/detail/pagination/attribution/CDN content, latest Quote pricing/confirmation, project soft-delete visibility, queued reservation release, and running-task settlement. Client tests do not prove the content backend or production billing/deletion semantics are deployed.