merge: reconcile latest main changes

.project-docs/20-architecture/data-flow.md

@@ -21,6 +21,7 @@
 | 可信发布门禁 | source+built+artifact contract | 服务端逐字节重算/合同校验 → 不可变 Release 固化 → 人工审核 | 服务端不运行项目 Vite；仍是不可绕过权威，未来 runtime 强门禁需可信 verifier |
 | AI 编程 Conversation 创建与准备 | 当前 project / Agent / 本地 Conversation | Renderer 本地创建 → `/api/coding/*` → Main `.makelore` schema-v2 store → shared Agent Server 内 target logical Runtime/Session lazy prepare | Composer 与逻辑线程准备解耦；首次 Conversation 可立即编辑。未解析模型必须先验证并持久化，再打开首个逻辑线程；`.niancode` / `.opencode` 项目元数据不读取、不迁移 |
 | AI 编程 prompt 与流式投影 | 当前 Conversation draft / attachment refs | Renderer mutation → Host `202` acceptance/dedupe → Main target Agent Server channel → Pi events → Snapshot + `patch-batch` SSE → Renderer reducer | 每个 Conversation 独立 Runtime/Session/credential/extension context/generation/seq；gap 只恢复目标 Conversation。accepted/uncertain mutation 不自动重放，权威 Snapshot 到达前保留相同 optimistic node identity |
+| AI 编程前台状态收敛 | Main `lifecycle:sleep`、编程视图挂载/项目上下文变化、页面重新可见或窗口 focus | Renderer 关闭旧 SSE → 静默读取当前选中 Conversation 的 Main-owned Snapshot → target-only reducer | 已选 Conversation 即使身份未变也会与后台 terminal 状态收敛；selection key 防止选择渲染自身造成重复 hydration。该流程只读 Snapshot，绝不重放 accepted/uncertain mutation |
 | AI 编程模型与思考强度切换 | 当前 Conversation | Renderer → `/api/coding/conversations/{id}` → Main validate/persist → target logical Runtime | 同账号已解析模型复用 `set_model`；跨账号模型等 active run settled 后只重建目标逻辑线程，旧凭据不会进入新 generation；切换失败不销毁可继续使用的旧线程 |
 | AI 编程上下文压缩 | Renderer compact action / Pi compaction events | correlated compact RPC → target projector → Snapshot/Patch timeline | Pi `0.84.2` 的手动 compact 不发 `agent_settled`；RPC success 或权威 compaction failure 终结 compact 并 exactly-once 释放对应 ownership，不提前结算普通 prompt |
 | AI 编程 Provider 错误 | Pi logical-thread Provider 请求 | selected thread-local credential store → Main AI proxy → Works 模型上游 → projector safe error | 确定性的 Works user-context 缺失使缓存 gateway credential 过期、返回非重试认证失败且不重放请求；Renderer 只看到固定 Provider-auth 提示，不能把它解释为 Pi 崩溃 |
@@ -54,7 +55,7 @@
 - Development 与 packaged Canvas 都使用 Main-owned Works Square V2 adapter。V1 DTO/local semantic adapter 与 local/cloud mode switches 已删除，不存在失败回退。
 - 注销和退出关闭本地 event stream、清除 drafts/pending state 和凭据；服务端 current Direction Session 与 semantic history 保持持久化。
 - project、Agent、Conversation schema v2 与每条 Conversation 的 opaque Pi session binding 由 Main 在 `.makelore/project.json` 和 `.makelore/conversations.json` 原子持久化。当前客户端不读取、迁移或删除 `.niancode` / `.opencode` 项目元数据。
-- Renderer Store 只拥有产品中立 Snapshot、Patch、optimistic request 与 project-scoped metadata。每条 Conversation 的 generation/seq 独立；stale generation 丢弃，gap/reconnect 只为目标 Conversation 取 Snapshot 并重放严格连续的缓冲 tail，不重放 mutation。
+- Renderer Store 只拥有产品中立 Snapshot、Patch、optimistic request 与 project-scoped metadata。每条 Conversation 的 generation/seq 独立；stale generation 丢弃，gap/reconnect/foreground reconciliation 只为目标 Conversation 取 Snapshot 并应用严格连续的缓冲 tail，不重放 mutation。隐藏 Conversation 的红点只表示新出现的 pending interaction，或当前 run 新进入 completed/failed/aborted terminal；流式助手文字、thinking、工具过程和单个工具失败本身不触发红点。
 - Main 以一个长驻 Agent Server 承载每条 active/warm Conversation 的隔离 Pi Runtime/Session/channel、Provider/resource revision 和 thread-local credential store。运行中 stale revision 保留本 run snapshot，settled 后只重建目标逻辑线程；整个 Server 退出则使所有旧 channel 失效，下次恢复只启动一个新 Server。
 - top-level 逻辑 turn 并发上限 4、warm idle logical-thread LRU 上限 8、child 并发上限 4，child 使用 FIFO process budget 8；shared parent 线程不各占一个 process lease。同项目 coding mutation 共用 write lease；read-only child 可旁路写锁。
 - prompt/compact 的 RPC confirmation timeout 只进入 uncertain，不能释放 run permit、process ownership 或 Main background lease。迟到 success/failure/exit/abort 必须单调且 exactly-once 收敛；隐藏页面超过 grace 也不得停止 active/uncertain run。
@@ -79,4 +80,4 @@
 
 ## Last Updated
 
-2026-08-31
+2026-09-03

.project-docs/20-architecture/module-map.md

@@ -22,13 +22,13 @@
 | `electron/services/project-packager.ts` | 受控项目扫描、静态 ZIP 生成和敏感/历史控制文件排除 | 只允许可发布 `ProjectType`，不提供 Compose 或手工 ZIP 路径 |
 | `electron/services/works-submission-binding.ts` | submission binding v2 持久化与旧 schema 迁移 | 旧中间态终止为 `legacy_retired`；文件名暂作安装兼容 |
 | `electron/api/works-play-url.ts` | 公共播放 URL 的共享安全校验 | 公共 `play_url` 必须同源 HTTPS 且精确匹配 App 路径 |
-| `src/pages/Chat/CodingChatPanel.tsx` / `CodingConversationTimeline.tsx` / `CodingComposer.tsx` | Agent/Conversation 选择、Snapshot-first 时间线、prompt/steer/follow-up、交互、压缩、分支与附件 UI | Composer 不等待 worker 准备；时间线初始渲染最近 120 个节点并按 100 个节点向前扩展、保持滚动锚点；折叠过程预览固定首个可见块/首个非空行；所有异步结果按 project/Agent/Conversation 所有权隔离，Renderer 不导入 Pi wire 类型 |
-| `src/stores/coding-conversations.ts` / `coding-workspace.ts` | per-Conversation Snapshot/Patch、乐观提交、gap recovery 与项目级元数据 | generation/seq 严格递增；只恢复目标 Conversation，SSE 重连不重放 mutation |
+| `src/pages/Chat/CodingChatPanel.tsx` / `CodingConversationTimeline.tsx` / `CodingComposer.tsx` | Agent/Conversation 选择、Snapshot-first 时间线、prompt/steer/follow-up、交互、压缩、分支与附件 UI | Composer 不等待 worker 准备；`lifecycle:sleep` 关闭旧 SSE，视图挂载、项目上下文变化、页面可见或窗口 focus 静默刷新已选 Snapshot；时间线初始渲染最近 120 个节点并按 100 个节点向前扩展、保持滚动锚点；所有异步结果按 project/Agent/Conversation 所有权隔离，Renderer 不导入 Pi wire 类型 |
+| `src/stores/coding-conversations.ts` / `coding-workspace.ts` | per-Conversation Snapshot/Patch、乐观提交、gap/foreground recovery 与项目级元数据 | generation/seq 严格递增；只恢复目标 Conversation，SSE 重连与前台刷新不重放 mutation；隐藏红点只响应新的 pending interaction 或 run terminal transition，不响应普通助手/工具过程 |
 | `shared/coding-conversation-*.ts` / `coding-project-contracts.ts` | Main/Renderer 共用的产品中立 Conversation、project tool、subagent 与 reducer 合同 | 这是唯一公共实现；Pi 事件、RPC 与 Provider 形状保持 Main-private |
 | `electron/api/coding-composition.ts` / `electron/api/routes/coding-*.ts` | 唯一 Main-owned Coding composition 与 `/api/coding/*` Host API | 管理 project/Agent/Conversation、SSE、附件、文件、命令、交互和安全诊断；mutation 返回 202 acceptance 且按 request id 去重 |
 | `electron/coding-projects/` | `.makelore/project.json` 与 `.makelore/conversations.json` schema-v2 项目/Agent/Conversation 数据、原子持久化与项目文件能力 | 不读取或迁移 `.niancode` / `.opencode` 项目元数据；legacy 内容保持 inert 且不删除 |
 | `electron/coding-runtime/conversation-service.ts` | 产品级 Conversation orchestration、模型/思考强度、fork/archive/recover 与运行时门禁 | unresolved Conversation 先验证并持久化模型再首次 prepare；已解析 Conversation 的模型切换复用 target runtime seam |
-| `electron/coding-runtime/pi/{agent-server-process,worker-pool,worker-process,rpc-client,session-registry,event-projector,session-projector}.ts` / `resources/pi-agent-server.mjs` | 一个长驻父 Agent Server 内的 per-Conversation 逻辑 Runtime/Session/channel、严格 LF JSONL RPC、generation recovery 与 Snapshot/Patch 投影 | top-level logical-turn cap 4、warm idle LRU 8；Session hydration 保留完整 active-branch 可见历史并把 compaction summary 留在 Main-private 模型上下文；线程级替换只使目标 generation 失效，Server 退出使所有旧 channel 失效并在下次恢复时只重启一个 Server |
+| `electron/coding-runtime/pi/{agent-server-process,worker-pool,worker-process,rpc-client,session-registry,event-projector,session-projector}.ts` / `resources/pi-agent-server.mjs` | 一个长驻父 Agent Server 内的 per-Conversation 逻辑 Runtime/Session/channel、严格 LF JSONL RPC、generation recovery 与 Snapshot/Patch 投影 | top-level logical-turn cap 4、warm idle LRU 8；Session hydration 保留完整 active-branch 可见历史并把 compaction summary 留在 Main-private 模型上下文；正式包按 staged `pi-runtime` 的 manifest/root 解析并校验 Pi 包入口；线程级替换只使目标 generation 失效，Server 退出使所有旧 channel 失效并在下次恢复时只重启一个 Server |
 | `electron/coding-runtime/pi/{provider-config,provider-refresh,provider-failure,resource-loader}.ts` / `electron/api/routes/ai-proxy.ts` | Main-owned Provider catalog、secret/env 投影、资源 revision、一次凭据刷新与上游错误分类 | secret 不进入 argv/catalog/Renderer；确定性的 Works user-context 缺失使缓存凭据过期并 fail fast，不自动重放 mutation；精确 Token Point exhaustion 被窄化为安全、不可重试、可持久恢复的产品错误，不透传原始上游正文 |
 | `electron/coding-runtime/pi/{extension-host,subagent,write-lease}.ts` / `electron/main/background-lifecycle.ts` | 唯一显式 Makelore extension、交互、子 Agent、同项目写租约与后台运行租约 | child 并发 4、单次最多 8、禁止递归；active/uncertain run 不因页面隐藏或确认超时被回收，所有 stop/replacement 必须有原因 |
 | `electron/main/updater.ts` | 目标 feed 解析、electron-updater 生命周期与原始诊断 | 缺少稳定 manifest 保持错误；事件/Promise 重复失败按检查实例去重 |
@@ -91,4 +91,4 @@
 
 ## Last Updated
 
-2026-08-31
+2026-09-03

.project-docs/20-architecture/system-overview.md

@@ -18,9 +18,9 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展
 | Play URL Projection | 校验服务端公共播放地址 | 只接受同源 HTTPS 和精确 `/apps/{app_id}/`；优先 `play_url`，`runtime_url` 仅一版本回退 |
 | Built Artifact Preflight | 在上传前对最终 built snapshot 做桌面/移动 UX fail-fast | Main 使用临时 loopback origin 与 Electron WebContents/CDP；不使用 Playwright、不生成可信证明 |
 | App Updater | Main 选择平台/架构 feed、驱动 electron-updater 并记录原始诊断 | Renderer 只接收状态和脱敏后的单条用户提示；稳定源缺包保持错误 |
-| Makelore Code Workspace | project/Agent/Conversation schema v2、产品中立 Snapshot/Patch、Composer 与时间线 | Conversation 本地创建且不等待 worker；旧 OpenCode 会话备份后不再继续，Renderer 不导入 Pi RPC/event 类型 |
+| Makelore Code Workspace | project/Agent/Conversation schema v2、产品中立 Snapshot/Patch、Composer 与时间线 | Conversation 本地创建且不等待 worker；sleep 关闭旧 SSE，视图挂载、项目切换、visibility/focus 会静默刷新已选 Snapshot；旧 OpenCode 会话备份后不再继续，Renderer 不导入 Pi RPC/event 类型 |
 | Coding Host API & Composition | 唯一 `/api/coding/*` composition、202 acceptance/dedupe、SSE、附件/文件/交互/诊断 | Electron Main 拥有 project/Conversation 服务、选中目标、认证和错误脱敏；SSE 公开面只有 Snapshot 与 `patch-batch` |
-| Pi Conversation Runtime | 一个长驻 Pi `0.84.2` Agent Server 承载每条 active/warm Conversation 的隔离逻辑 Runtime/Session/JSONL channel | 严格 LF JSONL RPC、generation recovery、Snapshot hydration；top-level 逻辑 turn 并发 4、warm idle LRU 8；Server 退出统一使旧 channel 失效并按需单实例重启 |
+| Pi Conversation Runtime | 一个长驻 Pi `0.84.2` Agent Server 承载每条 active/warm Conversation 的隔离逻辑 Runtime/Session/JSONL channel | 严格 LF JSONL RPC、generation recovery、Snapshot hydration；正式包从 staged `pi-runtime` manifest/root 定位并校验 Pi 包入口；top-level 逻辑 turn 并发 4、warm idle LRU 8；Server 退出统一使旧 channel 失效并按需单实例重启 |
 | Pi Provider & Managed Resources | Provider catalog、thread-local secret projection、model/resource revision、Prompt/Skill/extension materialization、selected-model tools | 父凭据只进入选中逻辑线程的内存 credential store，child 凭据只进入该短命进程；Works `model_capabilities` 由 Main 严格归一化并作为安全 Provider metadata 持久化。Web Search 仅在精确 capability 存在时随冻结的 selected model/provider/credential 进入 parent tool catalog，并走普通模型计费；不回退 `agent_browser` 或独立 Hosted Provider。服务端 reasoning levels 优先于本地 profile，缺字段则清理 override 并回退；不扫描项目或用户的 `.pi/.agents/.codex`，不把 secret 或原始响应放进 argv、catalog 或 Renderer |
 | Pi Extension, Subagents & Lifecycle | 唯一显式 Makelore extension、UI interaction、ephemeral child、write lease 与 background run lease | child 并发 4、单次最多 8、禁止递归；active/uncertain run 不因页面隐藏或 confirmation timeout 被停止，replacement/stop 必须可解释并清理所有 ownership |
 | Official Hosted Plugins | Acquired code-owned bundled Game Resource package → effective parent snapshot → code-owned Main adapter → fixed Works Square hosted route | 无设备下载、更新、Beta 或签名步骤；Renderer/Package/Pi 不持有 Provider key、model 或 URL。每次计费操作要求显式确认，child 不继承 hosted tool。历史 Hosted Web Search 不再进入当前客户端。 |
@@ -57,6 +57,8 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展
 - Makelore Code 的唯一 production runtime 是精确 pin 的 Pi `0.84.2`；不得恢复 OpenCode fallback、双 runtime、兼容执行路径或 Renderer 直连本地 runtime。上游 `@earendil-works/pi-ai` 内名称含 `opencode` 的静态 Provider adapter 不属于产品旧 runtime。
 - Renderer 只消费共享的产品中立 project/Conversation/Snapshot/Patch DTO，并经 `src/lib/host-api.ts` 或 `src/lib/api-client.ts` 访问 Main。Pi RPC、event、Provider credential 和本地 runtime 路径保持 Main-private。
 - accepted/uncertain Coding mutation 不得自动重放；RPC confirmation timeout 后仍保留 target run permit、process ownership 和 background lease，直到迟到 success/failure/exit/abort 权威收敛。其他 Conversation 必须继续可用。
+- Main 发出 `lifecycle:sleep` 时 Coding 页面必须关闭旧事件流；编程视图挂载、项目上下文变化、页面重新可见或窗口 focus 时必须从 Main 静默刷新已选 Conversation 的权威 Snapshot。该只读收敛不得转化为 prompt/interaction 的自动重放。隐藏 Conversation 红点只代表新的 pending interaction 或新的 completed/failed/aborted terminal transition。
+- 正式包中的 Agent Server 必须以显式 staged `pi-runtime` 的 manifest/root 解析 Pi 依赖，校验导入入口未逃逸对应包目录；不得依赖脚本相邻目录、应用 `node_modules` 或系统包解析作为 fallback。
 - selected Provider credential 只投影到目标父逻辑线程的内存 credential store 或目标 child 进程；跨账号模型变化必须重建目标逻辑线程。确定性 Works user-context 缺失是 Provider-auth failure：失效缓存 credential、fail fast、固定脱敏提示，不得归类为 Pi crash。
 - Works 下发的 per-model reasoning capability 是可选 Main-owned metadata，不是
   Renderer 或 one-api 的权威。存在时只接受受支持的安全形状并覆盖目标模型的
@@ -98,4 +100,4 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展
 
 ## Last Updated
 
-2026-09-01
+2026-09-03

.project-docs/30-worklog/current-state.md

@@ -4,6 +4,32 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 ## Integrated Through
 
+- Integration task `20260903-integrate-latest-6f2c8e1a` preserves the divergent
+  local and remote mainline histories with normal merge `d25ed08`: fetched
+  `origin/main` frontier `28e1690` and local frontier `301c149` are both ancestors
+  of the integrated tree. It also reviewed every local worktree/branch; historical
+  Learning Player source `b1f51be` remains intentionally excluded under ADR-005,
+  rather than being mistaken for current product work. No history rewrite or
+  force-push is part of this integration.
+- Packaged Pi runtime-root source `5d7a235` from task
+  `20260902-build-unsigned-mac-9d7e4a2c` is integrated through merge `4babd6d`.
+  `resources/pi-agent-server.mjs` now anchors `@earendil-works/pi-ai` discovery to
+  the staged `pi-runtime` package manifest, selects its import entry, and rejects
+  entries escaping the package root. The corrected local-only unsigned arm64 DMG
+  passed exact mounted-image initialize/shutdown with SHA-256
+  `6d0216da6c30f7fed537041b37c69811b8e025af3e9cccf85a64c690e29ecb7b`;
+  it is not signed, notarized, published, or cross-platform release evidence.
+- Conversation-attention source `f2c3755` from task
+  `20260902-conversation-badge-a7c49e` is integrated through merge `bbfe16d`.
+  Hidden Conversation red markers now represent only a newly pending interaction
+  or a newly completed/failed/aborted run; assistant/thinking/tool progress and an
+  individual tool failure remain visible without becoming attention notifications.
+- Foreground-reconciliation source `7aa118b` from task
+  `20260903-diagnose-recurring-stall-a83f5c21` is integrated through merge
+  `04320dd`. Coding closes its old event stream on `lifecycle:sleep` and silently
+  reloads the selected Main-owned Snapshot on view/project context, visibility,
+  or focus transitions. A stale Renderer `live` state can therefore converge to
+  an already persisted terminal state without replaying an accepted mutation.
 - Bash tool-bridge source `49112b6` from task
   `20260902-fix-bash-tool-bridge-9c4e7a12` is integrated through merge
   `55bf80e` by task `20260902-integrate-bash-tool-bridge-e81a5c6d`.
@@ -53,8 +79,8 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
   Package tests, typecheck, scoped lint, production build, and 2 Electron E2E flows.
   The Electron run also exposed and closed an existing current-frontier startup crash:
   the ESM-only Pi package manager is now loaded only when remote Device Package
-  installation needs it. No package, deployment, publication, push, or paid request
-  is claimed.
+  installation needs it. At that source-task checkpoint no package, deployment,
+  publication, remote push, or paid request was claimed.
 - Model Tools and Device Packages client cutover is implemented by task
   `20260902-model-tools-client-integration-5d8b2f73`. Web Search is now a parent-only
   core tool of the frozen selected model/provider/credential; it no longer depends on
@@ -66,8 +92,9 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
   automatically while active workers switch after settlement; child workers remain
   empty. My Plugins now separates Official Plugins from Device Installed packages and
   exposes no visible install picker. Packaged Skill/Pi-extension installation and real
-  selected-model search remain external acceptance gates; no paid Provider request,
-  production install, publish, push, or PR is claimed.
+  selected-model search remain external acceptance gates. This integration promotes
+  the source only; it does not claim a paid Provider request, production install,
+  package publication, deployment, or PR.
 - Windows titlebar Logo-overlap correction source
   `99a210e244731d1cdc923e9dd4adf6e09e64c2a4` from task
   `20260901-windows-titlebar-logo-overlap-5100e298` is integrated onto local
@@ -195,7 +222,7 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
   rendered exactly Data Service, Game Resource, and Web Search without the unavailable
   catalog error. At that checkpoint Game Resource and Web Search still showed no stable
   Release; the official bundled cutover recorded above supersedes that delivery model.
-- Packaged Pi Agent Server resolver fix source `7df245af5a04f62be48980831ff41987ba686009`
+- Earlier packaged Pi Agent Server resolver source `7df245af5a04f62be48980831ff41987ba686009`
   from task `20260901-local-runtime-unavailable-8b42c7f1` is promoted to local
   `main` by task `20260901-promote-local-runtime-main-a7c4e291` through verified
   integration candidate `42ea83c0cbad52432eca99e4161e0360bef3e219` and source merge
@@ -206,8 +233,10 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
   A production-shaped sibling-layout test reproduces the installed failure before the
   fix and initializes successfully through Electron Node after it; Pi remains pinned at
   `0.84.2`, and no bundle layout, Provider, Renderer, or recovery contract changed.
-  The currently installed application predates this source integration; a rebuilt and
-  verified Windows artifact plus first-Conversation acceptance remain pending.
+  This flag-only resolver was later superseded by source `5d7a235` above, which
+  explicitly resolves the package manifest and entry from the staged runtime root and
+  has mounted-image macOS arm64 evidence. A signed/notarized artifact, Windows rebuild,
+  and installed first-Conversation acceptance remain pending.
 - Native Web Search client tickets MLW-01 through MLW-03 are integrated by source
   coordinator `20260831-web-search-client-integration-7d2f5b94` and promoted to local
   `main` by task `20260901-web-search-client-main-merge-5a9d3b82` from reviewed
@@ -444,7 +473,7 @@ Makelore 在会话恢复、登录和刷新后由 Electron Main 请求 Works `/ap
 
 AI 学习现在是已启用的运营精选项目目录，并继续受登录和 `module_access.learning` 控制。Renderer 通过 Main-owned Host API 获取分页项目卡片和 README 详情；Markdown 支持 GFM、禁用原始 HTML。服务端发布时只校验图片 URL 为无凭据、默认端口、无 fragment 且当前 DNS 结果全部为公网地址的 HTTPS URL，保留地址而不下载、识别格式、转码或镜像；客户端仅为 README 图片节点启用直连，因此 SVG 和 Electron 支持的其他格式可直接显示，单图失败不阻断详情。封面和历史发布媒体继续走受控路径。详情页的下载按钮打开系统保存对话框；Main 将 ZIP 流式写入临时文件，只允许最多五跳同 Works origin 重定向，不校验 `Content-Length`、`archiveBytes`、实际流字节数或客户端大小上限，校验 SHA-256 和 ZIP 签名后原子保存，Renderer 只接收 `saved` 或 `cancelled`。课程生成、进度、本地课程库、OpenMAIC player、Agent、ASR、课堂 runtime、Learning IPC 和 player artifact 打包已删除且没有兼容读取路径；历史课程数据保留但不再读取。服务端和客户端源码契约已完成，不代表生产部署或真实账号安装包联调已经完成。
 
-AI 编程已经硬切到精确 pin 的 Pi `0.84.2`，不存在 OpenCode fallback 或双 runtime。project、Agent 与 Conversation 只在 `.makelore/project.json` 和 `.makelore/conversations.json` 使用本地 schema v2；当前客户端不从 `.niancode` 或 `.opencode` 读取、迁移或删除项目元数据。Electron Main 按需启动一个长驻父 Agent Server，每条 active/warm Conversation 在其中拥有独立 Runtime/Session/channel、credential store、extension context、generation/seq、Snapshot/Patch、model/thinking、队列、interaction 与错误状态，Composer 在 lazy prepare 期间仍可编辑。Renderer 只通过 `/api/coding/*` 和 Snapshot-first/`patch-batch` SSE 消费产品中立合同；gap/reconnect 只恢复目标 Conversation，accepted/uncertain mutation 不自动重放。Session hydration 沿完整 active branch 投影可见历史，Pi compaction 只改变模型上下文并保持 summary 私有；Renderer 首次挂载最近 120 个节点，向上滚动时按 100 个节点追加更早内容并补偿新增高度以保持阅读锚点。折叠的 thinking、助手过程说明与工具输出固定展示第一条可见内容和首个非空行，横向偏移保持为零，展开后仍显示完整内容。未解析 Conversation 第一次选模先 validate 并持久化 resolved metadata，再 prepare；同账号模型切换使用 target `set_model`，跨账号只重建目标逻辑线程。top-level 逻辑 turn 并发为 4，warm idle logical-thread LRU 为 8；independent child 进程并发为 4 并使用 FIFO 进程预算 8；coding child 与 parent 共用项目 write lease。同一助手工具批次内，内置 `bash`/`edit`/`write` 与声明需要该 write lease 的动态产品工具按顺序执行，避免 Pi 在批量 prepare 阶段形成租约自锁；纯只读工具批次仍可并行。prompt/compact confirmation timeout 后仍保留 run/Agent-Server-or-child-process/background ownership，迟到 success/failure/exit/abort 单调且 exactly-once 收敛，页面隐藏不会停止 active/uncertain run。线程级替换只使目标 generation 失效；整个 Agent Server 退出会统一使所有旧 channel 失效，但 Main/Renderer 存活且下次恢复只重启一个 Server。Pi `0.84.2` 手动 compact 不发 `agent_settled`，由 correlated compact RPC 结果终结。父 Provider credential 只进入选中逻辑线程的内存 credential store，child 凭据只进入该短命进程；确定性的 Works user-context 缺失会失效 gateway credential、fail fast、不重放并投影固定 Provider-auth 错误，不归类为 Pi crash。精确的 `403 token_point_balance_exhausted` / `词元点数余额不足` 上游响应会在 Main 内归类为不可重试的配额耗尽，Renderer 只收到稳定 `CODING_PROVIDER_QUOTA_EXHAUSTED` 与安全中文提示；重开会话仍保留该提示，不暴露上游 request id 或原始错误正文。真实 Provider 验证仍为用户明确接受的未验证风险，macOS x64/arm64 与 native non-WSL Linux 也未通过平台发布门禁。
+AI 编程已经硬切到精确 pin 的 Pi `0.84.2`，不存在 OpenCode fallback 或双 runtime。project、Agent 与 Conversation 只在 `.makelore/project.json` 和 `.makelore/conversations.json` 使用本地 schema v2；当前客户端不从 `.niancode` 或 `.opencode` 读取、迁移或删除项目元数据。Electron Main 按需启动一个长驻父 Agent Server，每条 active/warm Conversation 在其中拥有独立 Runtime/Session/channel、credential store、extension context、generation/seq、Snapshot/Patch、model/thinking、队列、interaction 与错误状态，Composer 在 lazy prepare 期间仍可编辑；正式包从 staged `pi-runtime` manifest/root 定位并校验 Pi 包入口，不从脚本目录或应用 `node_modules` 回退。Renderer 只通过 `/api/coding/*` 和 Snapshot-first/`patch-batch` SSE 消费产品中立合同；gap/reconnect 只恢复目标 Conversation，accepted/uncertain mutation 不自动重放。`lifecycle:sleep` 会关闭旧事件流，视图挂载、项目上下文变化、页面重新可见或窗口 focus 会静默刷新已选 Snapshot，使后台 terminal 状态收敛且不重放 mutation。隐藏 Conversation 的红点只在新 pending interaction 或新 completed/failed/aborted terminal transition 出现，不由助手/thinking/工具过程或单个工具失败触发。Session hydration 沿完整 active branch 投影可见历史，Pi compaction 只改变模型上下文并保持 summary 私有；Renderer 首次挂载最近 120 个节点，向上滚动时按 100 个节点追加更早内容并补偿新增高度以保持阅读锚点。折叠的 thinking、助手过程说明与工具输出固定展示第一条可见内容和首个非空行，横向偏移保持为零，展开后仍显示完整内容。未解析 Conversation 第一次选模先 validate 并持久化 resolved metadata，再 prepare；同账号模型切换使用 target `set_model`，跨账号只重建目标逻辑线程。Web Search 只作为所选模型 capability 进入父 worker 并使用相同 model/provider/credential 与普通模型计费，不经过 Marketplace/Hosted client/Plugin Charge 或浏览器 fallback；child 不继承。Conversation 工具可检查并在独立确认后安装 npm、Git、本地 Plugin 目录或 loose `SKILL.md` 为 Main-owned immutable Device Package；不运行生命周期脚本，可执行 extension 具有桌面用户权限，新/idle parent 自动刷新，active parent 结算后刷新，child 为空。top-level 逻辑 turn 并发为 4，warm idle logical-thread LRU 为 8；independent child 进程并发为 4 并使用 FIFO 进程预算 8；coding child 与 parent 共用项目 write lease。同一助手工具批次内，内置 `bash`/`edit`/`write` 与声明需要该 write lease 的动态产品工具按顺序执行，避免 Pi 在批量 prepare 阶段形成租约自锁；纯只读工具批次仍可并行。prompt/compact confirmation timeout 后仍保留 run/Agent-Server-or-child-process/background ownership，迟到 success/failure/exit/abort 单调且 exactly-once 收敛，页面隐藏不会停止 active/uncertain run。线程级替换只使目标 generation 失效；整个 Agent Server 退出会统一使所有旧 channel 失效，但 Main/Renderer 存活且下次恢复只重启一个 Server。Pi `0.84.2` 手动 compact 不发 `agent_settled`，由 correlated compact RPC 结果终结。父 Provider credential 只进入选中逻辑线程的内存 credential store，child 凭据只进入该短命进程；确定性的 Works user-context 缺失会失效 gateway credential、fail fast、不重放并投影固定 Provider-auth 错误，不归类为 Pi crash。精确的 `403 token_point_balance_exhausted` / `词元点数余额不足` 上游响应会在 Main 内归类为不可重试的配额耗尽，Renderer 只收到稳定 `CODING_PROVIDER_QUOTA_EXHAUSTED` 与安全中文提示；重开会话仍保留该提示，不暴露上游 request id 或原始错误正文。真实 Provider 验证仍为用户明确接受的未验证风险；macOS arm64 仅有本地未签名 mounted-image initialize/shutdown 证据，签名/公证/完整 process-enumeration、macOS x64 与 native non-WSL Linux 仍未通过平台发布门禁。
 
 Updater 仍由 Electron Main 选择目标 feed、记录原始诊断并保持失败语义。正式稳定源缺少对应平台 manifest 时，设置页只显示一条简洁中文提示并允许重试，不把缺包误报为已是最新版，也不向普通界面暴露堆栈、URL、路径或错误码；签名产物发布和真实升级安装仍属于外部 Release Gate。
 
@@ -452,6 +481,20 @@ Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选
 
 ## Recently Completed
 
+- 2026-09-03: Reconciled fetched `origin/main` with the complete local mainline and
+  integrated the three cleanly owned latest source tasks through normal merge
+  commits. The result contains Model Tools/Device Packages, youth-facing Canvas,
+  packaged Pi runtime-root resolution, foreground Conversation reconciliation,
+  and attention-only unread markers without rewriting either mainline history.
+- 2026-09-03: Corrected packaged Pi dependency discovery to resolve the package
+  manifest and entry from staged `pi-runtime`. A local-only unsigned macOS arm64
+  DMG passed mounted-image Agent Server initialize/shutdown; signing, notarization,
+  full macOS process proof, other architectures, publication, and installation of
+  this corrected build remain outside that evidence.
+- 2026-09-03: Integrated Renderer foreground recovery and Conversation attention
+  semantics. Returning to a selected Conversation now refreshes its authoritative
+  terminal Snapshot after lifecycle sleep without prompt replay, while hidden red
+  markers are reserved for new interactions and terminal task outcomes.
 - 2026-09-02: Integrated the Pi write-leased tool-batch correction. Multiple
   Bash/edit/write or lease-requiring product tools emitted by one assistant
   response now execute sequentially instead of waiting on a lease before any
@@ -553,4 +596,4 @@ Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选
 
 ## Last Updated
 
-2026-09-02
+2026-09-03

.project-docs/30-worklog/tasks/20260903-integrate-latest-6f2c8e1a.md

@@ -0,0 +1,117 @@
+# Task: Integrate latest changes into main
+
+## Identity
+
+- Task ID: 20260903-integrate-latest-6f2c8e1a
+- Mode: Integration
+- Branch: codex/20260903-integrate-latest-6f2c8e1a-integrate-latest
+- Worktree: /Users/inmanx/Documents/makelore-integrate-latest-6f2c8e1a
+- Base commit: 301c1496b0a3a1af3b9443a68a67de8dfea45749
+- Owner: codex
+- Status: Checkpointed for final gate
+
+## Scope
+
+- Merge fetched `origin/main` with the 34 local-only `main` commits without
+  dropping either side's product changes or task-scoped project memory.
+- Integrate the three completed, worktree-owned change sets that remain
+  uncommitted: packaged Pi Agent Server resolution, Conversation unread-marker
+  semantics, and foreground authoritative Snapshot reconciliation.
+- Reconcile accepted promotion candidates into canonical project memory, run
+  the repository's required verification, promote the verified integration tip
+  to local `main`, and push it to `origin/main`.
+- Audit all local branches and worktrees; retain the explicitly excluded
+  historical Learning Player branch outside the merge.
+
+## Intent And Constraints
+
+- Preserve both divergent mainline histories with a normal merge; do not
+  rewrite or force-push remote history.
+- Preserve ADR-005's retired Learning Player boundary and ADR-006's Pi-only,
+  Main-owned, no-mutation-replay architecture.
+- Treat source task records and their promotion candidates as authoritative for
+  scope; resolve shared project-memory conflicts semantically rather than with
+  blanket `ours`/`theirs` rules.
+- Keep generated installers, release output, caches, dependencies, secrets, and
+  local user data out of Git.
+- Use pinned pnpm 10.33.4 and run typecheck, focused tests, the full unit suite,
+  lint, and the Vite/Electron production build before pushing.
+
+## Outcome
+
+- Fetched remote frontier `28e1690` and preserved it together with the 34
+  local-only main commits through normal history merge `d25ed08`; no rebase,
+  history rewrite, or force-push was used.
+- Committed each fully owned source worktree without altering its implementation:
+  packaged Pi runtime resolution as `5d7a235`, attention-only Conversation badges
+  as `f2c3755`, and foreground authoritative Snapshot reconciliation as `7aa118b`.
+- Integrated those sources through merges `4babd6d`, `bbfe16d`, and `04320dd`.
+  Semantic conflict resolution retained Project Configuration as the only visible
+  Plugin Services navigation while including remote Model Tools, Device Packages,
+  and youth-facing Canvas behavior. The merged Electron EventSource/Snapshot
+  fixtures retain both attention-badge and foreground-reconciliation coverage;
+  the badge fixture now emits the authoritative worker generation so the newly
+  required foreground Snapshot refresh does not correctly discard its later
+  synthetic events as stale.
+- Reconciled accepted promotion candidates into README, current state, architecture,
+  business rules, evidence, and commitments. The explicit staged-runtime package
+  resolver supersedes the earlier flag-only packaged resolver without overstating
+  the local unsigned macOS artifact as signed-release readiness.
+- Audited all local branches. Only source `b1f51be` is not merged; it is the retired
+  OpenMAIC Learning Player implementation explicitly excluded by ADR-005.
+- The task-aware drift check cannot treat task records introduced by source merge
+  commits as read-only: because this task was claimed before those merges, it reports
+  every newly merged source task record as a foreign edit even though their blobs were
+  not modified. The fully verified tree is therefore checkpointed here; final gate
+  task `20260903-finalize-main-integration-b7e2c4a9` will claim this exact clean HEAD
+  as its base, repeat the drift/completion gate, and perform the main push.
+
+## Verification
+
+- Planning and integration ownership gates passed.
+- Fetched `origin/main`; divergence is 51 remote-only / 34 local-only commits
+  from merge base `bf32fecd6013101485434b1977a73beb8b6a1fe3`.
+- All registered peer task records were reviewed; no semantic conflict exists
+  among the three pending source tasks.
+- `corepack pnpm exec vitest run tests/unit/plugin-marketplace-pages.test.tsx
+  tests/unit/pi-managed-worker-opener.test.ts
+  tests/unit/pi-agent-server-process-real.test.ts --maxWorkers=1`: passed,
+  3 files / 20 tests after the remote/local history merge.
+- `corepack pnpm exec vitest run tests/unit/pi-agent-server-process-real.test.ts
+  --maxWorkers=1`: passed, 1 file / 5 tests after the runtime-root source merge.
+- `corepack pnpm exec vitest run tests/unit/coding-conversations-store.test.tsx
+  tests/unit/coding-chat-panel.test.tsx --maxWorkers=1`: passed,
+  2 files / 49 tests after the badge and foreground source merges.
+- `corepack pnpm run typecheck`: passed on the fully merged source tree.
+- Final focused Vitest: 5 files / 70 tests passed, covering Marketplace navigation,
+  managed-worker startup, packaged Agent Server, Conversation reducer, and Coding
+  Chat foreground behavior.
+- `corepack pnpm exec playwright test tests/e2e/pi-coding-first-chat.spec.ts`:
+  passed, 4/4 after rebuilding the final Electron bundles. The first attempt used
+  stale pre-merge ignored build output and timed out during Electron launch; after
+  `build:vite`, one fixture generation mismatch was exposed and corrected before
+  the final all-green run.
+- `corepack pnpm test`: passed; functional stage 223 files / 1,832 passed / 3
+  skipped, isolated pressure stage 1 file / 1 passed.
+- Final `corepack pnpm run typecheck`: passed.
+- `corepack pnpm run lint:check`: passed with 0 errors and 5 pre-existing warnings.
+  An earlier concurrent lint run raced a Marketplace test's temporary-directory
+  teardown and returned `ENOENT`; the required standalone rerun passed.
+- `corepack pnpm run build:vite`: passed for Renderer, Electron Main, Preload, and
+  utility outputs with only existing Browserslist, chunk-size, and dynamic-import
+  warnings.
+
+## Follow-ups
+
+- Final gate task `20260903-finalize-main-integration-b7e2c4a9` must start from this
+  clean checkpoint, verify remote ancestry has not advanced, pass project-doc drift,
+  update local `main`, and push normally to `origin/main`.
+- Signed/notarized macOS release evidence, the actual corrected-app reinstall and
+  first-Conversation smoke, full macOS process enumeration, other architecture
+  gates, packaged Device Package acceptance, and real selected-model paid search
+  remain tracked external acceptance work; none blocks source integration.
+
+## Promotion Candidates
+
+- None. Accepted source-task promotion candidates were reconciled directly into
+  canonical memory by this integration task.

.project-docs/40-domain/business-rules.md

@@ -84,8 +84,11 @@
 - Makelore Code 的唯一 production runtime 是精确 pin 的 Pi `0.84.2`。不得恢复 OpenCode fallback、RPC/SDK 双轨、兼容执行路径或 Renderer runtime 直连；产品公共合同必须保持 project/Agent/Conversation/Snapshot/Patch 中立，Pi wire 只属于 Main。
 - project、Agent、Conversation 使用 `.makelore/project.json` 与 `.makelore/conversations.json` schema v2。Agent id、名称、原始 prompt、Skills 与 archive 状态必须稳定保存；不得从 `.niancode` 或 `.opencode` 读取或迁移项目元数据，也不得作为顺带清理删除这些用户内容。
 - 每条 active/warm Conversation 在同一个长驻父 Agent Server 内绑定独立 Pi Runtime/Session/channel。首次本地 Conversation 创建和 Composer 编辑不得等待逻辑线程；未解析 Conversation 第一次选模必须先验证模型、持久化 resolved metadata，再 prepare。已解析且同账号的模型变化复用 target `set_model`，跨账号变化等 active run settled 后只重建目标逻辑线程。
+- 正式包中的父 Agent Server 必须从显式 staged `pi-runtime` manifest/root 定位 Pi 包及其导入入口，并验证入口仍位于目标包目录内；不得从脚本相邻资源目录、应用 `node_modules`、系统 npm 或网络下载回退解析。
 - prompt、steer、follow-up、compact 等 mutation 必须先获得目标 Conversation 的 `202` acceptance/dedupe 结果。confirmation timeout 只表示 uncertain，不得自动重发，也不得释放 run permit、Agent Server/child process ownership 或 Main background lease；迟到 success/failure/exit/abort 必须单调、exactly-once 收敛。线程级失败只影响目标 Conversation；整个 Agent Server 退出时所有旧父 channel 一起 fail closed，但 Main/Renderer 继续存活且下次恢复只启动一个新 Server。
 - Renderer 只消费 Snapshot-first 与 `patch-batch` SSE。每条 Conversation 的 generation/seq 独立；stale generation 丢弃，gap/reconnect 只恢复目标 Snapshot 并应用严格连续的缓冲 tail，不重放 mutation，也不改变乐观消息的 UI identity。
+- `lifecycle:sleep` 必须关闭旧 Coding SSE；编程视图挂载、项目上下文变化、页面重新可见或窗口 focus 必须静默刷新已选 Conversation 的 Main-owned Snapshot，即使 Conversation id 没有变化。该流程只协调权威状态，绝不重放 accepted/uncertain mutation。
+- 隐藏 Conversation 的红色注意标记只可由新的 pending interaction，或当前 run 新进入 completed、failed、aborted terminal 触发；助手流式文字、thinking、工具过程、单个工具失败以及已经见过的相同 interaction/terminal 更新不得创建或重新创建标记。
 - top-level 逻辑 turn 并发上限 4、warm idle logical-thread LRU 上限 8、child 并发上限 4，child 使用 FIFO process budget 8；shared parent 逻辑线程不各占一个 process lease。单次 subagent dispatch 最多 8 个 child 且禁止递归；coding child 与 parent 共用同项目 write lease，父 abort/crash/generation 失效必须清理所有 child、permit 与 process lease。
 - Provider Account、credential、custom header 和 proxy token 只可投影到选中父逻辑线程的内存 credential store 或选中 child 进程，不能进入 argv、catalog、Renderer 或 sibling thread。确定性的 Works user-context 缺失必须使缓存 gateway credential 过期、fail fast 且不重放 mutation，并向产品投影固定的 `CODING_PROVIDER_AUTH_REQUIRED`；不能把它解释为 Pi 崩溃。
 - Provider/resource revision 在 idle 逻辑线程下一 prompt 前应用；running 线程使用当前 run snapshot，settled 后重建。同账号 refresh single-flight 且最多一次 auth refresh/reopen。真实 Provider 认证、endpoint/proxy/rate-limit、协议差异、真实并发和共享 Agent Server 内跨线程凭据隔离由用户明确豁免并接受风险，`realTurnVerified=false`，不得写成 Pass。
@@ -134,8 +137,8 @@
 - Prompt Museum 客户端契约和页面完成不等于 Works Square 内容后台、审核数据或 CDN 已部署；上线前需以真实登录账号验证列表、详情、署名链接、分页、图片和 Prompt 回填。
 - Learning 客户端集成不等于 Works Square 运营后台、对象存储或项目 API 已部署；上线前需先部署服务端合同，再以真实账号验证发布/下架、分页、远程 HTTPS README 图片（含 SVG 与失败隔离）、保存取消、缺失或错误 `Content-Length` 的 ZIP、摘要/签名错误以及 Windows/签名 macOS 安装包。
 - 四模块入口策略上线前需确认 Works `module_access` migration/API 已部署，安装包包含对应客户端，并用真实账号逐一关闭四个模块验证卡片、根/深层/别名路由和独立 API 授权。
-- Makelore Code 当前只有 Windows x64 最终安装包和 WSL2/WSLg Linux 证据。macOS x64/arm64 与 native non-WSL Linux desktop/compositor 尚未验收；在补齐前不得宣称 cross-platform release-ready。真实 Provider 风险虽经用户明确豁免，但仍不得从 loopback/provider-shaped smoke 推断为真实 Provider Pass。
+- Makelore Code 已有 Windows x64 最终安装包证据、WSL2/WSLg Linux 证据，以及 macOS arm64 本地未签名 DMG 的 mounted-image Agent Server initialize/shutdown 证据。macOS arm64 的签名/公证与完整 process-enumeration gate、macOS x64、native non-WSL Linux desktop/compositor 仍未验收；在补齐前不得宣称 cross-platform release-ready。真实 Provider 风险虽经用户明确豁免，但仍不得从 loopback/provider-shaped smoke 推断为真实 Provider Pass。
 
 ## Last Reviewed
 
-2026-08-31
+2026-09-03

.project-docs/50-evidence/evidence-index.md

@@ -4,6 +4,8 @@ Use this index for searchable, traceable evidence records.
 
 | Date | Topic | Status | Source | Detail |
 |---|---|---|---|---|
+| 2026-09-03 | Packaged Pi runtime-root resolver and local unsigned macOS arm64 artifact | Integrated locally; exact mounted-image bootstrap passed; signed release gate remains open | Source `5d7a235`, merge `4babd6d`, task `20260902-build-unsigned-mac-9d7e4a2c` | Node 24 did not honor the parent URL previously passed to `import.meta.resolve`, so an installed Agent Server searched beside the product resource script instead of staged `pi-runtime`. The replacement uses `findPackageJSON` from the explicit runtime manifest, selects the package import entry, rejects path escape, and imports the exact file URL. Focused real-process, full unit, typecheck, lint and Vite build passed at source. The corrected local-only unsigned DMG is 315,653,270 bytes with SHA-256 `6d0216da6c30f7fed537041b37c69811b8e025af3e9cccf85a64c690e29ecb7b`; direct initialize/shutdown passed both unpacked and from a read-only mounted image. It is not signed, notarized, published, or complete cross-platform evidence. |
+| 2026-09-03 | Makelore Code foreground Snapshot reconciliation and attention-only Conversation markers | Integrated locally; installed-app cause correlated and source regression suites passed | Foreground source `7aa118b` / merge `04320dd`, badge source `f2c3755` / merge `bbfe16d`, tasks `20260903-diagnose-recurring-stall-a83f5c21` and `20260902-conversation-badge-a7c49e` | The diagnosed installed run had already persisted an aborted terminal and Main had completed it with `project_deactivated`; no tool child or network work remained, while Renderer retained a cached `live` Snapshot. Coding now closes stale SSE on `lifecycle:sleep` and refreshes the selected Main-owned Snapshot on view/project context, visibility, and focus without replaying any mutation. Hidden red markers now arise only for a new pending interaction or a new completed/failed/aborted run, not assistant/thinking/tool progress or an individual tool failure. Source verification covered 45 focused foreground tests, 28 focused badge-store tests, full suites, typecheck, lint, production builds, and real Electron regressions. |
 | 2026-09-02 | Makelore Code Pi write-leased tool-batch deadlock fix | Integrated locally; source and production-build verification passed; no installer produced | Source `49112b6`, merge `55bf80e`, source task `20260902-fix-bash-tool-bridge-9c4e7a12`, integration task `20260902-integrate-bash-tool-bridge-e81a5c6d` | Live evidence showed every assistant response emitting two Bash calls; Pi prepared both hooks before execution, so the first acquired the project write lease and the second waited before the first could run or release it. The five-minute delay was the managed-extension HTTP idle timeout, not a missing dependency. Built-in `bash`/`edit`/`write` and dynamically declared lease-requiring tools are now sequential within a batch while read-only batches remain parallel. The pre-fix real-process regression reproduced `fetch failed`; the source passed 3 focused files / 9 tests, 213 full files / 1,733 tests with 3 skipped, typecheck, lint with 0 errors / 5 existing warnings, and the Renderer/Main/Preload/utility production build. |
 | 2026-09-02 | Makelore Code missing terminal-settlement recovery | Integrated locally; live pre-fix stall diagnosed and automated regression coverage passed | Source `f1fd13a`, merge `e76a1e1`, source task `20260901-fix-session-settlement-a47d2e91`, integration task `20260902-integrate-session-settlement-6e41c8b2` | Live evidence showed Pi had persisted its final assistant response while Main retained run ownership because no effective `agent_settled` arrived. The fix preserves normal settlement authority and no-replay semantics, reports post-accept prompt rejection, and after a bounded grace period probes only the target thread: exact idle evidence hydrates and settles once; contradictory state fails that target explicitly. The source passed 68 focused tests, 1,732 full tests / 3 skipped, typecheck, lint, and Vite build; the integrated tree repeated focused runtime/process tests, typecheck, and Vite build. |
 | 2026-09-01 | Makelore Code packaged Agent Server Pi AI resolver fix | Integrated on local `main`; rebuilt Windows artifact and installed-client acceptance pending | Source `7df245a`, source task `20260901-local-runtime-unavailable-8b42c7f1`, merge `9640255`, verified candidate `42ea83c`, main promotion task `20260901-promote-local-runtime-main-a7c4e291` | The installed Electron Node process reproduced `ERR_MODULE_NOT_FOUND` for the present `@earendil-works/pi-ai@0.84.2` because the optional `import.meta.resolve` parent URL was inactive and lookup began beside `resources/resources/pi-agent-server.mjs`. Enabling that capability only for the Main-owned Agent Server made the exact differential pass without changing the runtime closure. A production-shaped sibling-layout Electron test went red before and green after; 24 focused tests, 1,761 full unit tests / 2 conditional skips, typecheck, lint with 0 errors, and Renderer/Main/Preload/utility build passed. This does not claim that the currently installed old package is fixed or that a rebuilt final artifact has passed release proof. |

.project-docs/80-commitments/commitments.md

@@ -13,12 +13,12 @@ Track future-facing memory: promised follow-ups, unfinished loops, timed checks,
 | 2026-08-16 | 验收 Prompt Museum 与 Canvas 删除/重报价的真实服务端链路 | 发布包含 `26b52d7` Canvas 行为的安装包前 | 客户端/服务端集成 | Pending | 使用真实 Works 账号核对 Museum 列表/详情/分页/筛选/署名/CDN/Prompt 回填，并确认固定相对媒体路径可经 Main Bearer 代理、401 刷新、10 MiB/可信 raster MIME 边界后在 Renderer 展示；核对最终 Prompt/options 重报价和确认设计点；删除 Workspace 后确认软删除可见性、未提交任务取消/预留积分释放、已运行任务结算。保留 Main 错误脱敏和严格 DTO/HTTPS 投影，不以客户端回归替代服务端验收 |
 | 2026-08-16 | 验收 default-on Robot Guided Hotspot Binding 的 Windows/macOS 真实设备链路 | 下一份包含页面内热点连接行为的安装包发布前 | 客户端/硬件/服务端集成 | Pending | 核对精确出货固件与固定 Portal、六位码发行/消费语义；执行 Windows Robot 真机扫描/连接、签名 macOS x64/arm64 CoreLocation/CoreWLAN/worker/ASAR/Koffi smoke，以及真实 Host/native Electron 端到端配网+Binding；保留 `NIANCODE_AI_HARDWARE_GUIDED_HOTSPOT_BINDING=0` 回滚并记录支持矩阵 |
 | 2026-08-10 | 完成客户端提交到 App `play_url` 播放的真实生产整链验收 | source+built+contract 服务端协议、OSS immutable Release、CDN/Edge 与 App 消费链成组集成后 | 客户端/服务端集成 | Pending | 使用真实账号执行小游戏和小程序创建、客户端本地构建与同字节预检、双归档提交、服务端逐字节校验/不可变 Release 固化、运营批准、CDN 发布、App 播放与监控核对；如需不可绕过 runtime gate，另行设计可信 verifier |
-| 2026-08-12 | Windows 发布流水线保留固定 npm/Pi 运行时产物门禁 | 每次生成正式 Windows 安装器时 | 客户端发布 | Pending | 运行 `pnpm verify:publish-runtime`、`pnpm verify:artifact:win`、`pnpm verify:artifact:pi` 与 final packaged proof；启动最终 `resources/resources/pi-agent-server.mjs` 并确认它从相邻 `pi-runtime` 初始化，再用安装后的首个 Conversation 确认不出现 runtime-unavailable 投影。当前 208,162,564-byte / SHA-256 `A02F79FCD3273FB0B013450492DC788B6E5ED7BBC1007468FB83BE949B8CB30D` 安装器早于 `7df245a` 修复，为本地未签名历史证据，尚未 push、发布或安装。 |
+| 2026-08-12 | 发布流水线保留固定 npm/Pi 运行时产物门禁 | 每次生成正式 Windows 或 macOS 安装器时 | 客户端发布 | Partial / Pending | 运行目标平台的 publish-runtime、artifact、Pi 与 final packaged proof；启动最终 Agent Server 并确认它从 staged `pi-runtime` manifest/root 初始化，再用安装后的首个 Conversation 确认不出现 runtime-unavailable 投影。源 `5d7a235` 已通过本地未签名 macOS arm64 DMG 的 read-only mounted-image initialize/shutdown，DMG SHA-256 为 `6d0216da6c30f7fed537041b37c69811b8e025af3e9cccf85a64c690e29ecb7b`；仍需签名/公证、完整 process proof、实际替换安装与首个 Conversation，以及新的 Windows artifact 验收。 |
 | 2026-08-10 | 删除客户端 `runtime_url` 兼容回退 | 一个客户端兼容版本结束，且服务端与存量数据稳定提供 `play_url` | 客户端 | Pending | 删除类型字段、读取分支和对应回归测试 |
 | 2026-08-11 | 部署并验收 AI 绘画多 Conversation 服务端契约 | 发布包含多会话客户端之前 | 客户端/服务端集成 | Pending | 确认迁移 `0033`、Conversation list/create/read/turn/confirm API、持久 Agent Session 与事件字段已上线 |
 | 2026-08-12 | 复核 AI 编程 Provider 错误与重试投影 | 升级 Pi、Works gateway 或上游 Provider 错误格式时 | 客户端/Pi/provider 集成 | Pending | 重新验证确定性 Works user-context 缺失仍会 expire credential、非重试 fail fast、固定脱敏为 `CODING_PROVIDER_AUTH_REQUIRED`，并且不会被后续 `agent_settled` 改写为 completed；不得把其他 401/429/5xx 扩大归类。 |
 | 2026-08-15 | 复核 AI 编程 Pi 上下文压缩事件契约 | 升级锁定的 Pi `0.84.2` 或模型上下文配置时 | 客户端/Pi 集成 | Pending | 运行长上下文与 manual compact smoke，确认新版本是否仍缺 `agent_settled`；保持 correlated compact RPC terminal、Snapshot completed 单调、普通 prompt 独立 settled、late result exactly-once 和 lease 清零。 |
-| 2026-08-26 | 补齐 Makelore Code 跨平台最终产物验收 | 对外宣称 cross-platform release-ready 或发布对应平台安装包前 | 客户端发布 | Pending | 在 macOS x64、macOS arm64 与 native non-WSL Linux desktop/compositor 上执行最终 artifact、Pi closure、extension/subagent、4+4、SSE/UI/performance、abort/uncertainty/cleanup 验收。Windows Pass 与 WSL2/WSLg 证据不得替代这些平台结果；失败时回到对应实现修复，不恢复 OpenCode fallback。 |
+| 2026-08-26 | 补齐 Makelore Code 跨平台最终产物验收 | 对外宣称 cross-platform release-ready 或发布对应平台安装包前 | 客户端发布 | Partial / Pending | macOS arm64 已有源 `5d7a235` 的本地未签名 DMG、Pi closure 与 mounted-image initialize/shutdown 证据，但 process enumeration 不支持，且未签名/公证、未完成安装后 UI/首会话及完整 extension/subagent、4+4、SSE/performance、abort/uncertainty/cleanup 门禁。继续补齐这些 arm64 门禁，并在 macOS x64 与 native non-WSL Linux desktop/compositor 执行完整验收；Windows 与 WSL2/WSLg 证据不得替代其他平台，失败时不恢复 OpenCode fallback。 |
 | 2026-08-13 | 将 AI 绘画素材选择 quick reply 升级为结构化 action/purpose | 新增第三种素材输入用途、调整本地化文案或重构 Design Message 协议时 | 客户端/服务端集成 | Pending | 用 `select_image_asset` + `image_reference | video_first_frame` 等稳定字段替代精确中文字符串匹配，并覆盖延迟 Brief 快照兼容 |
 | 2026-08-13 | 完成图生图客户端与服务端生产整链 smoke | 相匹配客户端与服务端部署后 | 客户端/服务端集成 | Pending | 用当前 Workspace 已完成作品与本地上传各执行一次图生图，核对 Asset 所有权、Quote、任务创建、结果展示与下载；不以本地单测替代付费 Provider 验收 |
 | 2026-08-13 | 发布并验收 Makelore 稳定更新链 | 权威版本对齐且 Windows/macOS 正式产物已签名/公证后 | 客户端发布 | Pending | 将 updater-role 产物 inactive-first 发布到 Works Square，核对 manifest/签名/架构后激活，并从旧稳定版执行发现、下载、重启、安装与版本确认 smoke；源码错误文案不替代该验收 |