docs(integration): record Square auth lifecycle merge

.project-docs/30-worklog/current-state.md

@@ -4,6 +4,14 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 ## Integrated Through
 
+- Square-auth lifecycle source commit `dc776ff` from feature task
+  `20260819-square-auth-proxy-client-8c4f2a` is integrated on the candidate `main`
+  tree through merge `f52c2c8`. Desktop login, refresh, and logout now use fixed
+  Works Square endpoints; Electron Main remains the sole token owner, persists
+  rotated credentials before exposing the refreshed session, and keeps the
+  existing seven-day inactivity boundary. The client no longer embeds a
+  confidential OAuth client secret or refreshes directly against the custom
+  identity service. The matching Square service change must be deployed first.
 - AI Design request-freeze source commit `87e4140` from feature task
   `20260819-design-freeze-live-6e2c` is integrated on `main` through `5bff5d3`
   by promotion task `20260819-promote-design-freeze-main-91c2e4`. Main-owned Workspace JSON

.project-docs/30-worklog/tasks/20260819-integrate-square-auth-client-2f7c9a.md

@@ -0,0 +1,45 @@
+# Task: Integrate Square auth proxy into Makelore main
+
+## Identity
+
+- Task ID: 20260819-integrate-square-auth-client-2f7c9a
+- Mode: Integration
+- Branch: codex/20260819-integrate-square-auth-client-2f7c9a-integrate-square-auth-client
+- Worktree: D:\Datas\OthersProjects\makelore-integrate-square-auth-2f7c9a
+- Base commit: 1907924203a1a998182c8e44e8884682ef216d95
+- Owner: codex-root
+- Status: In Progress
+
+## Scope
+
+- Integrate feature commit `dc776ff` from task `20260819-square-auth-proxy-client-8c4f2a` into `main` based at `1907924`.
+- Promote the desktop authentication lifecycle boundary into canonical project memory.
+- Re-run merged-tree authentication and static verification before attempting a default-branch fast-forward.
+
+## Intent And Constraints
+
+- Keep Renderer credential-free and Electron Main as the sole owner of access/refresh token persistence and idle-session cleanup.
+- Route login, refresh, and logout through fixed Works Square endpoints; do not restore the embedded OAuth client secret or direct custom-service refresh.
+- Preserve the unrelated untracked task record in the primary `main` worktree; do not adopt or overwrite another task's work without explicit authorization.
+
+## Outcome
+
+- Merged source commit `dc776ff` into the isolated candidate integration branch as merge commit `f52c2c8` without conflicts.
+- Promoted the Square-owned desktop authentication lifecycle boundary into the canonical current state, architecture flow, system boundary, decision index, and ADR-004.
+- The candidate tree is verified, but local `main` still points to `1907924`: its primary worktree contains the unrelated untracked task record `.project-docs/30-worklog/tasks/20260819-package-learning-off-115-9c4d.md`, which this task is not authorized to adopt or overwrite.
+
+## Verification
+
+- `pnpm exec vitest run tests/unit/works-square-session.test.ts tests/unit/auth-routes.test.ts`: 56 passed.
+- `pnpm exec vitest run`: 184 test files and 2,190 tests passed.
+- `pnpm run typecheck`: passed.
+- `git diff --check`: passed before task-record finalization.
+
+## Follow-ups
+
+- Obtain explicit ownership/adoption of the existing primary-worktree task record, or have its owner clean/release the `main` worktree, then fast-forward `main` to this candidate integration branch.
+- Deploy and smoke-test the matching Works Square server endpoints before releasing a desktop build.
+
+## Promotion Candidates
+
+- None; the accepted boundary is already promoted in this integration worktree.

.project-docs/30-worklog/tasks/20260819-square-auth-proxy-client-8c4f2a.md

@@ -1,57 +0,0 @@
-# Task: Route Makelore auth lifecycle through Works Square
-
-## Identity
-
-- Task ID: 20260819-square-auth-proxy-client-8c4f2a
-- Mode: Feature
-- Branch: codex/20260819-square-auth-proxy-client-8c4f2a-square-auth-proxy-client
-- Worktree: D:\Datas\OthersProjects\makelore-square-auth-proxy-8c4f2a
-- Base commit: 1907924203a1a998182c8e44e8884682ef216d95
-- Owner: codex-root
-- Status: Ready for Integration
-
-## Scope
-
-- Route Works Square access-token refresh through `POST /api/auth/refresh` instead of calling the one-feel OAuth endpoint from Electron Main.
-- Route remote logout through `POST /api/auth/logout` on Works Square while preserving Main-owned session cleanup behavior.
-- Update focused session and auth-route regression tests, including rotated refresh-token persistence.
-
-## Intent And Constraints
-
-- Login, refresh, and logout must share the Works Square authentication boundary.
-- Do not embed the deployed `custom` OAuth client secret in Makelore.
-- Preserve Main ownership of tokens, the seven-day inactivity policy, refresh single-flight behavior, fail-closed persistence semantics, and local runtime cleanup.
-- Do not change unrelated browser/OAuth-provider integrations.
-
-## Outcome
-
-- Electron Main now refreshes managed Works Square sessions with `POST https://square.nianxx.cn/api/auth/refresh` and a JSON refresh-token payload. It no longer sends an OAuth Basic credential or calls the one-feel token endpoint directly.
-- Main-owned logout now calls `POST https://square.nianxx.cn/api/auth/logout` with the current Main access token, while retaining the existing local session, secure persistence, event-session, provider-key, and runtime cleanup behavior.
-- Removed the now-unused Electron auth configuration module that embedded the legacy `app` client secret and password encryption key.
-- Preserved refresh-token rotation, single-flight behavior, terminal 400/401 clearing, transient-error retention, and persistence-before-return semantics.
-
-## Verification
-
-- Red phase: focused tests failed in five expected places because refresh and logout still targeted `biz.nianxx.cn` with the legacy method/credential contract.
-- `pnpm exec vitest run tests/unit/works-square-session.test.ts tests/unit/auth-routes.test.ts`: 56 passed.
-- Focused session/auth compatibility suite: 86 passed across five test files.
-- Full `pnpm exec vitest run`: 184 test files and 2190 tests passed.
-- `pnpm run typecheck`: passed.
-- `pnpm run lint:check`: passed with 0 errors and 7 pre-existing React warnings in unrelated files.
-- `pnpm run build:vite`: passed for Renderer, Electron Main, preload, and utility worker.
-- Full `pnpm run build` stopped before compilation because the required Learning Player artifact/source was not supplied; the subsequent direct Vite production build passed.
-- `git diff --check`: passed. Source scan found no direct one-feel refresh/logout URL, Basic auth header, embedded client secret, or deleted auth-config import under `electron/`.
-
-## Follow-ups
-
-- Deploy the Works Square refresh/logout endpoints before distributing a Makelore build containing this client change.
-- Supply the separately managed Learning Player artifact when producing the final packaged installer.
-
-## Promotion Candidates
-
-- Target canonical document: `.project-docs/20-architecture/data-flow.md` and the authentication decision index.
-  Proposal: record Works Square as the required boundary for the complete desktop authentication lifecycle (login, refresh, and logout), with confidential OAuth clients owned only by Works Square.
-  Evidence: focused request-contract tests, full 2190-test client suite, typecheck, lint, and production Vite build.
-  Future impact: new desktop authentication operations must be added to Square rather than embedding service credentials or direct one-feel calls in Makelore.
-  Semantic conflicts: none; this completes the proxy work explicitly deferred by the integrated native-login task.
-  Human confirmation required: no; the user explicitly selected the unified Square boundary.