chore(coding): record ML-09 remediation merge

.project-docs/30-worklog/tasks/20260826-makelore-data-service-client-b72e4c19.md

@@ -8,7 +8,7 @@
 - Worktree: D:\Datas\OthersProjects\makelore-data-service-client-b72e4c19
 - Base commit: f2456039230f68e3ecb2c8653fc3379c23bbe5ce
 - Owner: codex-root
-- Status: In Progress (ML-01 through ML-08 integrated; ML-09/X-01 pending)
+- Status: In Progress (ML-01 through ML-09 integrated; review/X-01 pending)
 
 ## Scope
 
@@ -162,6 +162,19 @@
   changes. The five required verification commands and their one known E2E
   failure are recorded below. The product HEAD immediately before this
   documentation update was `a981b07faaa64b20bf9aef6353218fef26695ca2`.
+- Integrated ML-09 remediation source commit
+  `b5060f254bfdb3a748739b74b1f583cc0236fa7c` from its exact parent
+  `239e20d2cf2242d636f9d42684f76f5777d9d1ee` as coordinator product commit
+  `38843e091fbbe68ec934336b8ed3a08c955afb28`, with no cherry-pick conflict.
+  The eight accepted review findings are all represented in the coordinator:
+  normal Pi parent Data Service allowlisting; camelCase Skill input;
+  credential-free HTTP/HTTPS loopback Origins; browser-generation lifecycle
+  fencing; README/Skill workflow documentation; narrow shared route parsers;
+  removal of the unused Agent Browser `onLifecycle` option; and removal of the
+  unused `handleDataServiceRoute` alias. The foreign ML-09 task record was
+  deleted from this coordinator while its source record remains in
+  `D:\Datas\OthersProjects\makelore-ml09-data-service-remediation-5e7c2a91`.
+  The product frontier after this merge is `38843e091fbbe68ec934336b8ed3a08c955afb28`.
 
 ## Verification
 
@@ -382,6 +395,48 @@
   20260826-makelore-data-service-client-b72e4c19` check passed using the
   configured bundled Python runtime. Test/build output remained ignored and
   the worktree was clean before this task-record update.
+- ML-09 precondition: coordinator was clean at exact ML-08 HEAD
+  `239e20d2cf2242d636f9d42684f76f5777d9d1ee`; the remediation source parent
+  matched that HEAD exactly and cherry-pick produced product commit
+  `38843e091fbbe68ec934336b8ed3a08c955afb28`.
+- ML-09 focused remediation ledger: the 10-file equivalent set
+  (`data-service-sdk-assets`, `data-service-server-registration`,
+  `pi-rpc-foundation`, `pi-worker-process-real`, `preview-data-session`,
+  `agent-browser-core`, `agent-browser-routes`, `data-service-routes`,
+  `pi-extension-bundle`, and `pi-extension-ui-projector`) passed with 142
+  tests and 2 skipped; Vitest reported 16.45s.
+- ML-09 adjacent regressions covering tool profile, Data Service client/routes,
+  preview/browser adapter, Skill resource, and Pi host paths: 8 files / 77
+  tests passed; Vitest reported 6.75s.
+- ML-09 `pnpm typecheck`: exit 0, passed, approximately 5.31s.
+- ML-09 `pnpm lint:check`: exit 0, passed with 0 errors and the same 5
+  existing warnings in `src/pages/Home/index.tsx` and
+  `src/pages/Makelore/index.tsx`.
+- ML-09 `pnpm build`: exit 0, passed through Vite, staged Pi runtime, and
+  Windows Electron/NSIS packaging. Existing dynamic-import/chunk-size,
+  optional-resource, npm shell deprecation, absent optional resource, and
+  non-fatal NSIS patch/signing warnings remained visible.
+- ML-09 `pnpm test:electron:windows`: exit 0, 2 files / 4 tests passed
+  (Vitest 1.04s; command approximately 2.28s).
+- ML-09 affected E2E `pnpm exec playwright test
+  tests/e2e/project-configuration-skills.spec.ts --config=playwright.config.ts`:
+  exit 0, 1 test passed (2.9s).
+- ML-09 affected Pi E2E `pnpm exec playwright test
+  tests/e2e/pi-coding-first-chat.spec.ts --config=playwright.config.ts`:
+  exit 1, 1 test passed and 1 failed (33.8s). The known failure remains at
+  `tests/e2e/pi-coding-first-chat.spec.ts:575`: `当前对话模型` resolves to a
+  disabled combobox and `selectOption` times out after 30s. It is not counted
+  as an E2E pass and no remediation diff evidence connects it to ML-09.
+- ML-09 eight-item boundary checks all passed: the exact ten Data Service
+  names are used by the normal Pi parent default while child profiles remain
+  explicit and Data Service-free; Skill input uses only `injectProjectData`;
+  loopback Origin and generation guards are present; README/Skill docs are
+  present; both route modules use the narrow parser module while retaining
+  route-specific failures; `subscribeLifecycle` remains without
+  `onLifecycle`; and only `handleDataServiceRoutes` remains. The merged path
+  audit matched the expected 15 source paths with no extra or missing path,
+  and the added-lines scope scan found no Firebase, Redis, retry/cache, or
+  published-runtime expansion.
 
 ## Follow-ups
 
@@ -395,13 +450,13 @@
   and ML-07 consumes only that local capability while keeping ordinary
   arbitrary URL opens data-free.
 - The broader ML-00 through ML-09 coordinator task remains in progress; this
-  record now has ML-08 command verification but does not claim ML-09 review,
-  release proof, or live acceptance. The client/server draft PR promotion is
-  externally blocked in this environment because GitLab HTTPS credentials are
-  unavailable non-interactively and `gh`/`glab` are not installed; no draft PR
-  is claimed from this worktree.
-- ML-09 remains pending for repository-local review and one remediation
-  implementer if findings require it. X-01 remains a TODO after both reviews:
+  record now has ML-08 and ML-09 verification but does not claim review
+  closure, release proof, or live acceptance. The client/server draft PR
+  promotion is externally blocked in this environment because GitLab HTTPS
+  credentials are unavailable non-interactively and `gh`/`glab` are not
+  installed; no draft PR is claimed from this worktree.
+- ML-09 remediation is integrated; review closure remains pending, including
+  the known Pi model-combobox E2E deviation. X-01 remains a TODO after review:
   exercise real PostgreSQL with a signed-in MakeLore preview and record live
   acceptance separately; repository E2E results cannot substitute for it.