merge: reconcile latest main changes

.project-docs/30-worklog/current-state.md

@@ -4,6 +4,32 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 ## Integrated Through
 
+- Integration task `20260903-integrate-latest-6f2c8e1a` preserves the divergent
+  local and remote mainline histories with normal merge `d25ed08`: fetched
+  `origin/main` frontier `28e1690` and local frontier `301c149` are both ancestors
+  of the integrated tree. It also reviewed every local worktree/branch; historical
+  Learning Player source `b1f51be` remains intentionally excluded under ADR-005,
+  rather than being mistaken for current product work. No history rewrite or
+  force-push is part of this integration.
+- Packaged Pi runtime-root source `5d7a235` from task
+  `20260902-build-unsigned-mac-9d7e4a2c` is integrated through merge `4babd6d`.
+  `resources/pi-agent-server.mjs` now anchors `@earendil-works/pi-ai` discovery to
+  the staged `pi-runtime` package manifest, selects its import entry, and rejects
+  entries escaping the package root. The corrected local-only unsigned arm64 DMG
+  passed exact mounted-image initialize/shutdown with SHA-256
+  `6d0216da6c30f7fed537041b37c69811b8e025af3e9cccf85a64c690e29ecb7b`;
+  it is not signed, notarized, published, or cross-platform release evidence.
+- Conversation-attention source `f2c3755` from task
+  `20260902-conversation-badge-a7c49e` is integrated through merge `bbfe16d`.
+  Hidden Conversation red markers now represent only a newly pending interaction
+  or a newly completed/failed/aborted run; assistant/thinking/tool progress and an
+  individual tool failure remain visible without becoming attention notifications.
+- Foreground-reconciliation source `7aa118b` from task
+  `20260903-diagnose-recurring-stall-a83f5c21` is integrated through merge
+  `04320dd`. Coding closes its old event stream on `lifecycle:sleep` and silently
+  reloads the selected Main-owned Snapshot on view/project context, visibility,
+  or focus transitions. A stale Renderer `live` state can therefore converge to
+  an already persisted terminal state without replaying an accepted mutation.
 - Bash tool-bridge source `49112b6` from task
   `20260902-fix-bash-tool-bridge-9c4e7a12` is integrated through merge
   `55bf80e` by task `20260902-integrate-bash-tool-bridge-e81a5c6d`.
@@ -53,8 +79,8 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
   Package tests, typecheck, scoped lint, production build, and 2 Electron E2E flows.
   The Electron run also exposed and closed an existing current-frontier startup crash:
   the ESM-only Pi package manager is now loaded only when remote Device Package
-  installation needs it. No package, deployment, publication, push, or paid request
-  is claimed.
+  installation needs it. At that source-task checkpoint no package, deployment,
+  publication, remote push, or paid request was claimed.
 - Model Tools and Device Packages client cutover is implemented by task
   `20260902-model-tools-client-integration-5d8b2f73`. Web Search is now a parent-only
   core tool of the frozen selected model/provider/credential; it no longer depends on
@@ -66,8 +92,9 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
   automatically while active workers switch after settlement; child workers remain
   empty. My Plugins now separates Official Plugins from Device Installed packages and
   exposes no visible install picker. Packaged Skill/Pi-extension installation and real
-  selected-model search remain external acceptance gates; no paid Provider request,
-  production install, publish, push, or PR is claimed.
+  selected-model search remain external acceptance gates. This integration promotes
+  the source only; it does not claim a paid Provider request, production install,
+  package publication, deployment, or PR.
 - Windows titlebar Logo-overlap correction source
   `99a210e244731d1cdc923e9dd4adf6e09e64c2a4` from task
   `20260901-windows-titlebar-logo-overlap-5100e298` is integrated onto local
@@ -195,7 +222,7 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
   rendered exactly Data Service, Game Resource, and Web Search without the unavailable
   catalog error. At that checkpoint Game Resource and Web Search still showed no stable
   Release; the official bundled cutover recorded above supersedes that delivery model.
-- Packaged Pi Agent Server resolver fix source `7df245af5a04f62be48980831ff41987ba686009`
+- Earlier packaged Pi Agent Server resolver source `7df245af5a04f62be48980831ff41987ba686009`
   from task `20260901-local-runtime-unavailable-8b42c7f1` is promoted to local
   `main` by task `20260901-promote-local-runtime-main-a7c4e291` through verified
   integration candidate `42ea83c0cbad52432eca99e4161e0360bef3e219` and source merge
@@ -206,8 +233,10 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
   A production-shaped sibling-layout test reproduces the installed failure before the
   fix and initializes successfully through Electron Node after it; Pi remains pinned at
   `0.84.2`, and no bundle layout, Provider, Renderer, or recovery contract changed.
-  The currently installed application predates this source integration; a rebuilt and
-  verified Windows artifact plus first-Conversation acceptance remain pending.
+  This flag-only resolver was later superseded by source `5d7a235` above, which
+  explicitly resolves the package manifest and entry from the staged runtime root and
+  has mounted-image macOS arm64 evidence. A signed/notarized artifact, Windows rebuild,
+  and installed first-Conversation acceptance remain pending.
 - Native Web Search client tickets MLW-01 through MLW-03 are integrated by source
   coordinator `20260831-web-search-client-integration-7d2f5b94` and promoted to local
   `main` by task `20260901-web-search-client-main-merge-5a9d3b82` from reviewed
@@ -444,7 +473,7 @@ Makelore 在会话恢复、登录和刷新后由 Electron Main 请求 Works `/ap
 
 AI 学习现在是已启用的运营精选项目目录，并继续受登录和 `module_access.learning` 控制。Renderer 通过 Main-owned Host API 获取分页项目卡片和 README 详情；Markdown 支持 GFM、禁用原始 HTML。服务端发布时只校验图片 URL 为无凭据、默认端口、无 fragment 且当前 DNS 结果全部为公网地址的 HTTPS URL，保留地址而不下载、识别格式、转码或镜像；客户端仅为 README 图片节点启用直连，因此 SVG 和 Electron 支持的其他格式可直接显示，单图失败不阻断详情。封面和历史发布媒体继续走受控路径。详情页的下载按钮打开系统保存对话框；Main 将 ZIP 流式写入临时文件，只允许最多五跳同 Works origin 重定向，不校验 `Content-Length`、`archiveBytes`、实际流字节数或客户端大小上限，校验 SHA-256 和 ZIP 签名后原子保存，Renderer 只接收 `saved` 或 `cancelled`。课程生成、进度、本地课程库、OpenMAIC player、Agent、ASR、课堂 runtime、Learning IPC 和 player artifact 打包已删除且没有兼容读取路径；历史课程数据保留但不再读取。服务端和客户端源码契约已完成，不代表生产部署或真实账号安装包联调已经完成。
 
-AI 编程已经硬切到精确 pin 的 Pi `0.84.2`，不存在 OpenCode fallback 或双 runtime。project、Agent 与 Conversation 只在 `.makelore/project.json` 和 `.makelore/conversations.json` 使用本地 schema v2；当前客户端不从 `.niancode` 或 `.opencode` 读取、迁移或删除项目元数据。Electron Main 按需启动一个长驻父 Agent Server，每条 active/warm Conversation 在其中拥有独立 Runtime/Session/channel、credential store、extension context、generation/seq、Snapshot/Patch、model/thinking、队列、interaction 与错误状态，Composer 在 lazy prepare 期间仍可编辑。Renderer 只通过 `/api/coding/*` 和 Snapshot-first/`patch-batch` SSE 消费产品中立合同；gap/reconnect 只恢复目标 Conversation，accepted/uncertain mutation 不自动重放。Session hydration 沿完整 active branch 投影可见历史，Pi compaction 只改变模型上下文并保持 summary 私有；Renderer 首次挂载最近 120 个节点，向上滚动时按 100 个节点追加更早内容并补偿新增高度以保持阅读锚点。折叠的 thinking、助手过程说明与工具输出固定展示第一条可见内容和首个非空行，横向偏移保持为零，展开后仍显示完整内容。未解析 Conversation 第一次选模先 validate 并持久化 resolved metadata，再 prepare；同账号模型切换使用 target `set_model`，跨账号只重建目标逻辑线程。top-level 逻辑 turn 并发为 4，warm idle logical-thread LRU 为 8；independent child 进程并发为 4 并使用 FIFO 进程预算 8；coding child 与 parent 共用项目 write lease。同一助手工具批次内，内置 `bash`/`edit`/`write` 与声明需要该 write lease 的动态产品工具按顺序执行，避免 Pi 在批量 prepare 阶段形成租约自锁；纯只读工具批次仍可并行。prompt/compact confirmation timeout 后仍保留 run/Agent-Server-or-child-process/background ownership，迟到 success/failure/exit/abort 单调且 exactly-once 收敛，页面隐藏不会停止 active/uncertain run。线程级替换只使目标 generation 失效；整个 Agent Server 退出会统一使所有旧 channel 失效，但 Main/Renderer 存活且下次恢复只重启一个 Server。Pi `0.84.2` 手动 compact 不发 `agent_settled`，由 correlated compact RPC 结果终结。父 Provider credential 只进入选中逻辑线程的内存 credential store，child 凭据只进入该短命进程；确定性的 Works user-context 缺失会失效 gateway credential、fail fast、不重放并投影固定 Provider-auth 错误，不归类为 Pi crash。精确的 `403 token_point_balance_exhausted` / `词元点数余额不足` 上游响应会在 Main 内归类为不可重试的配额耗尽，Renderer 只收到稳定 `CODING_PROVIDER_QUOTA_EXHAUSTED` 与安全中文提示；重开会话仍保留该提示，不暴露上游 request id 或原始错误正文。真实 Provider 验证仍为用户明确接受的未验证风险，macOS x64/arm64 与 native non-WSL Linux 也未通过平台发布门禁。
+AI 编程已经硬切到精确 pin 的 Pi `0.84.2`，不存在 OpenCode fallback 或双 runtime。project、Agent 与 Conversation 只在 `.makelore/project.json` 和 `.makelore/conversations.json` 使用本地 schema v2；当前客户端不从 `.niancode` 或 `.opencode` 读取、迁移或删除项目元数据。Electron Main 按需启动一个长驻父 Agent Server，每条 active/warm Conversation 在其中拥有独立 Runtime/Session/channel、credential store、extension context、generation/seq、Snapshot/Patch、model/thinking、队列、interaction 与错误状态，Composer 在 lazy prepare 期间仍可编辑；正式包从 staged `pi-runtime` manifest/root 定位并校验 Pi 包入口，不从脚本目录或应用 `node_modules` 回退。Renderer 只通过 `/api/coding/*` 和 Snapshot-first/`patch-batch` SSE 消费产品中立合同；gap/reconnect 只恢复目标 Conversation，accepted/uncertain mutation 不自动重放。`lifecycle:sleep` 会关闭旧事件流，视图挂载、项目上下文变化、页面重新可见或窗口 focus 会静默刷新已选 Snapshot，使后台 terminal 状态收敛且不重放 mutation。隐藏 Conversation 的红点只在新 pending interaction 或新 completed/failed/aborted terminal transition 出现，不由助手/thinking/工具过程或单个工具失败触发。Session hydration 沿完整 active branch 投影可见历史，Pi compaction 只改变模型上下文并保持 summary 私有；Renderer 首次挂载最近 120 个节点，向上滚动时按 100 个节点追加更早内容并补偿新增高度以保持阅读锚点。折叠的 thinking、助手过程说明与工具输出固定展示第一条可见内容和首个非空行，横向偏移保持为零，展开后仍显示完整内容。未解析 Conversation 第一次选模先 validate 并持久化 resolved metadata，再 prepare；同账号模型切换使用 target `set_model`，跨账号只重建目标逻辑线程。Web Search 只作为所选模型 capability 进入父 worker 并使用相同 model/provider/credential 与普通模型计费，不经过 Marketplace/Hosted client/Plugin Charge 或浏览器 fallback；child 不继承。Conversation 工具可检查并在独立确认后安装 npm、Git、本地 Plugin 目录或 loose `SKILL.md` 为 Main-owned immutable Device Package；不运行生命周期脚本，可执行 extension 具有桌面用户权限，新/idle parent 自动刷新，active parent 结算后刷新，child 为空。top-level 逻辑 turn 并发为 4，warm idle logical-thread LRU 为 8；independent child 进程并发为 4 并使用 FIFO 进程预算 8；coding child 与 parent 共用项目 write lease。同一助手工具批次内，内置 `bash`/`edit`/`write` 与声明需要该 write lease 的动态产品工具按顺序执行，避免 Pi 在批量 prepare 阶段形成租约自锁；纯只读工具批次仍可并行。prompt/compact confirmation timeout 后仍保留 run/Agent-Server-or-child-process/background ownership，迟到 success/failure/exit/abort 单调且 exactly-once 收敛，页面隐藏不会停止 active/uncertain run。线程级替换只使目标 generation 失效；整个 Agent Server 退出会统一使所有旧 channel 失效，但 Main/Renderer 存活且下次恢复只重启一个 Server。Pi `0.84.2` 手动 compact 不发 `agent_settled`，由 correlated compact RPC 结果终结。父 Provider credential 只进入选中逻辑线程的内存 credential store，child 凭据只进入该短命进程；确定性的 Works user-context 缺失会失效 gateway credential、fail fast、不重放并投影固定 Provider-auth 错误，不归类为 Pi crash。精确的 `403 token_point_balance_exhausted` / `词元点数余额不足` 上游响应会在 Main 内归类为不可重试的配额耗尽，Renderer 只收到稳定 `CODING_PROVIDER_QUOTA_EXHAUSTED` 与安全中文提示；重开会话仍保留该提示，不暴露上游 request id 或原始错误正文。真实 Provider 验证仍为用户明确接受的未验证风险；macOS arm64 仅有本地未签名 mounted-image initialize/shutdown 证据，签名/公证/完整 process-enumeration、macOS x64 与 native non-WSL Linux 仍未通过平台发布门禁。
 
 Updater 仍由 Electron Main 选择目标 feed、记录原始诊断并保持失败语义。正式稳定源缺少对应平台 manifest 时，设置页只显示一条简洁中文提示并允许重试，不把缺包误报为已是最新版，也不向普通界面暴露堆栈、URL、路径或错误码；签名产物发布和真实升级安装仍属于外部 Release Gate。
 
@@ -452,6 +481,20 @@ Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选
 
 ## Recently Completed
 
+- 2026-09-03: Reconciled fetched `origin/main` with the complete local mainline and
+  integrated the three cleanly owned latest source tasks through normal merge
+  commits. The result contains Model Tools/Device Packages, youth-facing Canvas,
+  packaged Pi runtime-root resolution, foreground Conversation reconciliation,
+  and attention-only unread markers without rewriting either mainline history.
+- 2026-09-03: Corrected packaged Pi dependency discovery to resolve the package
+  manifest and entry from staged `pi-runtime`. A local-only unsigned macOS arm64
+  DMG passed mounted-image Agent Server initialize/shutdown; signing, notarization,
+  full macOS process proof, other architectures, publication, and installation of
+  this corrected build remain outside that evidence.
+- 2026-09-03: Integrated Renderer foreground recovery and Conversation attention
+  semantics. Returning to a selected Conversation now refreshes its authoritative
+  terminal Snapshot after lifecycle sleep without prompt replay, while hidden red
+  markers are reserved for new interactions and terminal task outcomes.
 - 2026-09-02: Integrated the Pi write-leased tool-batch correction. Multiple
   Bash/edit/write or lease-requiring product tools emitted by one assistant
   response now execute sequentially instead of waiting on a lease before any
@@ -553,4 +596,4 @@ Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选
 
 ## Last Updated
 
-2026-09-02
+2026-09-03