merge: isolate concurrent OpenCode chat runs

.project-docs/30-worklog/tasks/20260813-sync-push-main-9c2f71.md

@@ -12,6 +12,7 @@
 
 ## Scope
 
+- On 2026-08-17, resume the existing Integration owner after the user's explicit takeover authorization to merge reviewed AI Programming multi-Session/runtime-readiness source `6504073` into local `main`, preserve existing project-cover work, promote only the implemented application-isolation and no-automatic-runtime-refresh facts, run merged-tree verification and independent review, and keep remote push outside this resumption.
 - On 2026-08-17, resume the existing Integration owner to merge the reviewed first-submission project-cover source from task `20260817-project-cover-upload-a6a98e56` into local `main` after its matching server contract is integrated, replace only the obsolete coverless-first-create limitation, preserve existing-project version-only behavior and Main-owned publishing boundaries, and keep remote push outside this resumption.
 - On 2026-08-17, resume the existing Integration owner to merge reviewed macOS Robot hotspot scan source `55e61b7` into local `main`, preserve the firmware/open-SSID/Main-owned boundaries, retain signed-package physical smoke as a release gate, and keep remote push outside this resumption.
 - On 2026-08-17, resume the existing Integration owner at the user's request to merge reviewed AI Programming fresh-Agent voice-input source `b6148a5` into local `main`, preserve lazy first-session creation and existing voice guards, run merged-tree verification and independent review, and keep remote push outside this resumption.
@@ -59,6 +60,7 @@
 - The 2026-08-17 takeover confirmation authorizes continuing this existing Integration owner while preserving its uncommitted task history. For module access, source-task records remain read-only; the policy is a client entry/initialization gate rather than API authorization, and release acceptance requires the matching Works migration/API, a newly packaged client, and real-account four-module smoke.
 - The fresh-Agent voice-input request authorizes a local `main` merge only. It does not authorize remote push, Canvas voice enablement, eager OpenCode runtime/session creation, or changes to the existing Renderer -> Host API -> Electron Main -> Works Square speech boundary.
 - The project-cover request authorizes a local `main` merge only. It does not authorize remote push, client packaging, production deployment, metadata editing for existing projects, or weakening the Renderer -> Host API -> Electron Main ownership boundary.
+- The multi-Session request authorizes local `main` integration of application-side Session isolation and runtime/Agent acceptance. It does not authorize a remote push, paid-provider traffic, a claim that bundled OpenCode/provider executes two model turns simultaneously, or automatic shared-runtime restart/reload/dispose. Source task records remain on feature history only.
 
 ## Project Context Loaded
 
@@ -106,6 +108,14 @@ Relevant understanding:
 Gate result:
 - Passed.
 
+### 2026-08-17 AI Programming Multi-Session Runtime Integration Resume
+
+- Reused the existing Integration owner after the user explicitly authorized adoption of its existing changes. Registry status confirms task `20260813-sync-push-main-9c2f71`, mode `integration`, branch `main`, worktree `D:\Datas\OthersProjects\makelore`, and the repository integration lock.
+- Verified feature task `20260817-multichat-runtime-fix-f3a91c` is `ready_for_integration`, its worktree is clean, source commit `65040730ec229436b27e0e1a34ca16599b534996` is present, and its seventh independent Sol review returned Standards/Spec `PASS` after full unit, typecheck, lint, build and focused Electron E2E validation.
+- Read the source outcome, follow-ups and promotion candidate against current AI Programming first-send, compaction and Main-owned runtime boundaries. No accepted ADR or peer source requires a reply-duration global lock, automatic runtime disposal, or same-id Agent freshness; the source strengthens existing Session isolation without changing product direction.
+- Started a normal `--no-ff --no-commit` merge of `6504073` onto clean local `main` `b734867`; Git reported no textual conflicts. The source task record remains reachable on its source branch and is excluded from the integrated `main` tree.
+- Gate result: Passed for local no-ff merge, semantic canonical promotion, proportionate merged-tree verification and independent final review. Remote push and real provider/runtime concurrency smoke remain outside this resumption.
+
 ### 2026-08-17 Fresh-Agent Voice Input Integration Resume
 
 - Reused the existing Integration owner because it still exclusively owns clean local `main` at `9fd9a7761d3872f25e853ac1b059e55251c6ae8f`; `task_context.py touch` refreshed the reservation and registry doctor passed.
@@ -216,6 +226,13 @@ Gate result:
 
 ## Plan
 
+### 2026-08-17 AI Programming Multi-Session Runtime Integration Plan
+
+1. Merge reviewed source commit `6504073` into local `main` with a normal no-ff merge while preserving the current project-cover history and excluding the source-owned task record.
+2. Promote the implemented per-Session startup/terminalization, Main runtime/Agent readiness, no-auto-replay and no-automatic-shared-runtime-refresh boundaries into current state, architecture, evidence and commitments without claiming upstream provider concurrency.
+3. Run the focused AI Programming/Main/Renderer regression selection, full unit suite, typecheck, lint, Vite production build, focused Electron E2E, project-document gates and topology/whitespace checks.
+4. Obtain an independent read-only Sol PASS/FAIL review, commit only after PASS, verify exact merge parents and keep remote push outside this request.
+
 ### 2026-08-17 macOS Robot Hotspot Scan Integration Plan
 
 1. Merge reviewed source `55e61b7` into local `main` with a normal no-ff merge, preserving source history while excluding the source-owned task record from the final tree.
@@ -309,6 +326,10 @@ Gate result:
 
 ## Outcome
 
+- Prepared a normal no-ff merge of reviewed AI Programming source `65040730ec229436b27e0e1a34ca16599b534996` onto local `main` `b734867`; Git reported no textual conflicts, current project-cover behavior remains present, and the source task record remains only on feature history.
+- Integrated application-side per-Session run/error/queue isolation, an independent hard 10-second startup acknowledgement deadline, typed pre-send runtime/Agent pending responses, generation/fingerprint Agent readiness, bounded manager/project FIFO acceptance and timeout lease revocation. Ordinary message/command/summarize/background sync does not automatically restart, reload or dispose the shared runtime.
+- Promoted the source architecture candidate into current state, data flow and module ownership, and recorded verified evidence plus the still-pending real bundled OpenCode/provider two-Session smoke. No claim of upstream simultaneous model execution was added.
+
 - Prepared a normal no-ff merge of project-cover source `145a6ce571d646325092d1e722282babea503954` onto local `main` `da376b0bf37cdd0b5eabe7efc9f1141ae5645411` with no textual conflicts; the source feature task record remains only on the source branch.
 - Reconciled the obsolete coverless-first-create rule into required first-cover atomic submission while retaining existing-project version-only behavior and the unfulfilled conditional metadata-editing commitment.
 - Created normal no-ff merge commit `a5f0cf7fc4d18ee1d46aef6c177ffb4433039a4a` with project-cover integration-plan commit `da376b0bf37cdd0b5eabe7efc9f1141ae5645411` as first parent and reviewed source `145a6ce571d646325092d1e722282babea503954` as second parent.
@@ -446,6 +467,14 @@ Gate result:
 
 ## Verification
 
+- Source closeout before integration: Main focused 164/164, full unit 176 files / 2100 tests, typecheck, full lint with zero errors and seven pre-existing warnings, `build:vite`, focused Electron E2E 1/1, project-document gates and seventh independent Sol Standards/Spec review all passed.
+- Multi-Session staged merged-tree high-risk selection: 13 files / 490 tests passed, including OpenCode routes/store/panel/run-machine/client/manager, provider routes/store/settings, project config/Agent readiness, Makelore background sync and login regression coverage.
+- Multi-Session staged merged-tree full unit suite: 176 files / 2106 tests passed with four workers; the additional mainline project-cover regressions remain green.
+- Multi-Session staged merged-tree `pnpm run typecheck` and `pnpm run lint:check` passed; lint reported zero errors and the same seven pre-existing warnings.
+- Multi-Session staged merged-tree `pnpm run build:vite` passed for Renderer, Electron Main and Preload; only existing mixed-import and chunk-size warnings remain.
+- Focused Electron E2E `tests/e2e/opencode-multichat-runtime.spec.ts` passed 1/1 through the built Main/Renderer Host stub, preserving Session A busy state while Session B terminates independently without retry.
+- Independent final staged-merge Sol review returned Standards `PASS`, Spec `PASS`, overall `PASS`, with no blocking findings. It independently reran 13 files / 490 tests, confirmed exact `HEAD=b734867` / `MERGE_HEAD=6504073` topology, source-task-record exclusion, no unmerged or unstaged changes, preserved project-cover behavior, canonical document consistency, and the explicit non-claim for real provider concurrency.
+
 - Project-cover source verification: 3 focused Vitest files / 76 tests, typecheck, scoped ESLint, Vite production build, focused Electron E2E 1/1, and cross-repository Sol review all passed.
 - Project-cover merged tree: 3 focused Vitest files / 76 tests, `tsc --noEmit`, scoped ESLint, Renderer/Main/Preload Vite production build, and focused Electron E2E 1/1 all passed; build emitted only the existing dynamic-import and chunk-size warnings.
 - `check_project_docs.py`, task-aware `check_doc_drift.py`, and `git diff --cached --check` passed for the prepared project-cover merge.
@@ -596,6 +625,9 @@ Gate result:
 
 ## Follow-ups
 
+- Before claiming true simultaneous model execution, run the opt-in real bundled OpenCode two-Session smoke with an explicitly configured test provider. Current automation proves application isolation, bounded failure and no replay, not provider/runtime concurrency.
+- If runtime Agent edits must apply immediately, first add an upstream directory-scoped invalidation API or authoritative whole-instance quiescence oracle. Until then, retain manual restart after active replies finish and do not infer dispose/reload safety from `/session/status`.
+
 - Before releasing the per-user module-entry policy, deploy the Works `module_access` migration and `/api/auth/me` contract, build and install a new Makelore package, then use a real account to disable Code, Canvas, Learning and Robot one at a time and smoke chooser/root/deep/alias behavior, global settings, terminal `401`, and independent server-side API authorization.
 - Before releasing Learning, run a real Works account through catalog, generation/material/cancel-resume, bounded download, offline multi-module playback, progress, Agent, ASR and PBL/scoring using the exact production Stage artifact. Validate packaged loopback cookie/nonce behavior on Windows and a signed macOS build; current automation is not that acceptance.
 - First-project cover upload is implemented by client source `145a6ce` and server source `407c883` / local merge `0cedfc4`; before release, deploy the server, package the client, and verify a real account/object-store flow including create conflict, cover failure, and version-upload blocking. Editing metadata on an existing draft/published project still requires a server-owned revision/ETag plus draft-only conditional write; until then existing projects remain version-only.
@@ -622,6 +654,8 @@ Gate result:
 
 ## Promotion Candidates
 
+- The `6504073` candidate is promoted into current state, module map, data flow, evidence and commitments: per-Session run/error/startup state, hard 10-second explicit startup acknowledgement, no uncertain replay, Main-owned generation/fingerprint Agent readiness, typed pre-send runtime/config pending, bounded manager/project acceptance and no ordinary-path shared-runtime restart/reload/dispose. Real provider concurrency and immediate Agent hot reload remain explicit pending validations rather than integrated claims.
+
 - The `3b799af` module-access candidate is promoted into current state, architecture/data flow, business rules, success criteria, evidence and commitments: Electron Main projects only four booleans from `/api/auth/me`; missing values are enabled, server `design` maps to client `painting`, disabled card/root/deep/alias entry stops before layout/module initialization, Code provider waits for policy hydration, terminal `401` clears both session layers, and `/settings` remains global. This is a client entry policy, not API authorization; deployment/package/real-account validation remains pending.
 - Remote `01bee31` facts and the reviewed merge hardening were promoted into README, AGENTS, success criteria, current state, architecture/data flow, business rules, glossary, evidence and commitments: Learning is enabled but remains Main-owned, account-partitioned, bounded, artifact-verified and pending real Works/signed-package acceptance; `game-engine` is removed and planning files belong in the project root.
 - Remote `26b52d7` facts were promoted into current state, architecture, domain rules, glossary, evidence, README, and release commitments: Prompt Museum remains read-only/server-driven, Quote pricing is service-owned, Canvas deletion is an explicit Workspace mutation, development is cloud-default, UI language is Chinese-only, and `game-engine` is an optional bundled Skill. Production Museum content and real-account billing/deletion acceptance remain pending commitments rather than completed evidence.