docs(marketplace): record client r3 integration

.project-docs/30-worklog/tasks/20260828-marketplace-mlm06-r3-remediation-9e4c2a71.md

@@ -1,201 +0,0 @@
-# Task: Marketplace MLM-06 R3 fixed-range remediation
-
-## Identity
-
-- Task ID: 20260828-marketplace-mlm06-r3-remediation-9e4c2a71
-- Mode: Feature
-- Branch: codex/20260828-marketplace-mlm06-r3-remediation-9e4c2a71-marketplace-mlm06-r3-remediation
-- Worktree: D:\Datas\OthersProjects\makelore-plugin-marketplace-mlm06-r3-remediation-9e4c2a71
-- Base commit: 57962591de71fc0a9f142dbcd130e3308754e423
-- Owner: marketplace-client-coordinator-r3-remediator
-- Status: Ready for Integration
-
-## Scope
-
-- Sole MLM-06 R3 fixed-range remediation over the eight accepted actionable roots
-  handed off from exact client frontier
-  `57962591de71fc0a9f142dbcd130e3308754e423`. Product/test changes stay in this
-  isolated MakeLore worktree and are limited to the assigned resolver, Package
-  Store/archive validation, Renderer Marketplace store/My Plugins, project
-  projection, packaged artifact verifier, focused tests/E2E, and this task record.
-- Preserve Marketplace Release A only. Data Service remains bundled,
-  system-included, typed, and zero Token Point; hosted Provider/Release B,
-  arbitrary local code/MCP/hooks, generic invoke/config/ledger, XMA-01,
-  deployment, publication, push, and PR creation are outside this task.
-- Deliver one source commit containing this task record, with sole parent
-  `57962591de71fc0a9f142dbcd130e3308754e423`, a clean worktree, and
-  `READY_FOR_INTEGRATION` task-context completion.
-
-## Intent And Constraints
-
-- Human-confirmed recovery was required because the original implementation owner
-  stopped responding while leaving a known dirty worktree. The coordinator
-  interrupted that writer, ran `release --force`, reversibly backed up its untracked
-  task record, and successfully reclaimed this exact task/worktree with
-  `--adopt-existing`. The eight existing product/test paths were never stashed,
-  reset, cleaned, deleted, or moved. This owner is now the sole writer.
-- Concurrent Task Gate passed after recovery: project-doc structure is valid and
-  task-context status matches this task ID, feature mode, owner, absolute worktree,
-  branch, and exact base. The coordinator, user root, server repository, and prior
-  review/source worktrees remain read-only.
-- Planning Gate passed after reading the required project-memory startup set,
-  relevant peer records, implementation spec, ticket graph, accepted design, and
-  ADR-006. Canonical integrated memory predates Marketplace; the frozen spec/design,
-  coordinator ledger, and R3 fixed-range findings are the current authority.
-- Implement test-first at each public seam. Do not add compatibility layers,
-  arbitrary prefixes, hidden request chaining, account/Library conflation, broad
-  archive-security frameworks, fabricated yanked fields, runtime key overrides, or
-  unrelated UI redesign. Explicit device uninstall remains distinct from Library
-  removal and background cleanup.
-- Production Ed25519 activation remains HOLD. Tests may inject ephemeral keys only;
-  no production private key or arbitrary runtime trust source may be generated,
-  read, or committed.
-
-## Project Context Loaded
-
-- Task identity: `20260828-marketplace-mlm06-r3-remediation-9e4c2a71`, feature
-  mode, branch
-  `codex/20260828-marketplace-mlm06-r3-remediation-9e4c2a71-marketplace-mlm06-r3-remediation`,
-  worktree
-  `D:\Datas\OthersProjects\makelore-plugin-marketplace-mlm06-r3-remediation-9e4c2a71`,
-  owner `marketplace-client-coordinator-r3-remediator`, exact base
-  `57962591de71fc0a9f142dbcd130e3308754e423`.
-- Other active Marketplace owners are completed source/remediation tasks,
-  read-only fixed-range reviewers, or the coordinator. No owner has write authority
-  in this worktree and no unresolved semantic conflict changes the eight-root plan.
-- Main owns account, package, trust, filesystem, and effective-runtime authority;
-  Renderer consumes bounded projections. Account Library, Device Installation,
-  Project Selection, Agent assignment, authorization, and billing remain separate.
-- The accepted eight roots are: bundled Skill collision reservation; pre-queue
-  account binding; independent same-plugin Library/device intents; explicit
-  uninstall versus cleanup; reachable packaged markers; canonical archive
-  validation; `client_incompatible` Project Plugins projection; and no-version My
-  Plugins presentation.
-- Gate result: Passed. Project positioning is still a placeholder and shared
-  integrated memory predates Marketplace, both explicitly recorded as stale context
-  rather than silently treated as current authority.
-
-## Fixed-Range Ownership / Red Plan
-
-1. Reserve every non-Marketplace bundled Skill ID, including Data Service, and
-   reject conflicting Marketplace resources without rewriting configuration.
-2. Capture the current account binding before queued Package Store work and verify
-   it before execution and completion so A-originated work cannot execute as B.
-3. Split same-plugin Renderer Library and device intents while retaining latest-only
-   ordering within each domain and merging independent successful results.
-4. Separate explicit uninstall from background cleanup; remove all unprotected
-   current/old releases and report `kept` only for actual protections.
-5. Bind Marketplace artifact proof to the real packaged `package.json.main`
-   reachability graph and reject disconnected marker strings.
-6. Enforce the canonical archive allowlist, extension/UTF-8 rules, and 256 KiB
-   manifest/Skill limits before atomic install, without adding a generic framework.
-7. Project `client_incompatible` as bounded Project Plugins unavailable state.
-8. Render no-version unavailable installation projections as not installed and not
-   deletable; keep versioned incompatible packages present and removable.
-
-## Implementation Plan
-
-1. Review the preserved dirty diff against all eight accepted roots and existing
-   focused tests; retain correct work and identify still-missing paths without
-   rewriting completed slices.
-2. For each missing root, add an exact red test, apply the smallest green change,
-   and run the focused public-boundary regression with a stated failure consequence.
-3. Run affected Marketplace/Pi/Data Service regressions, full unit/pressure,
-   typecheck, lint, Vite build, Windows Electron, Marketplace E2E, x64 packaging,
-   and the real artifact verifier. Record exact baseline/environment deviations.
-4. Update this record with the recovery and RED→GREEN ledger, run diff/doc gates,
-   create the single source commit with the exact parent, complete task_context, and
-   verify a clean handoff.
-
-## Outcome
-
-- Recovered and completed the preserved implementation without resetting, stashing,
-  cleaning, or replacing any predecessor work. The only discarded filesystem data
-  was the trace CLI's own temporary extraction directory after diagnosis.
-- Reserved every bundled/non-Marketplace Skill owner, so a signed Marketplace
-  package can no longer shadow the bundled Data Service Skill or another package's
-  Skill root. Project and Agent assignments remain unchanged and regain effect if
-  the original package returns.
-- Bound Package Store sync/install/uninstall operations to the account captured
-  before queueing, with execution- and completion-time rechecks. Explicit uninstall
-  now removes every unprotected Release, while background cleanup may retain the
-  selected current Release; account snapshots and active workers remain protected.
-- Split Renderer Library and device mutation intent per plugin/domain. Independent
-  successful operations merge instead of one domain silently suppressing the other.
-- Hardened Release A archive admission to the canonical Skill-only tree, server-
-  aligned text/image extensions, fatal UTF-8 manifests/text, declared Skill roots,
-  and 256 KiB manifest/Skill limits. Script/native payloads and undeclared assets
-  fail before the atomic install write.
-- Project Plugins maps `client_incompatible` to the bounded unavailable state. My
-  Plugins treats a no-version unavailable projection as not downloaded and not
-  deletable, while an incompatible versioned package remains visible/removable.
-- Packaged proof now walks only files reachable from `package.json.main`, including
-  Main imports/requires, minified static ESM imports, dynamic Renderer chunks, and
-  HTML assets. Disconnected marker strings cannot satisfy trust or Marketplace
-  coverage. Test ASAR creation waits for the returned WritableStream `finish`
-  signal, eliminating partial archive reads without adding a production retry.
-- Stabilized the Marketplace Electron test at its real bootstrap boundary: the
-  initial module-selection screen must be ready before replacing Main's Host API
-  handler and reloading with persisted auth. This removes an old-page/new-page auth
-  initialization race without changing production authentication.
-- No hosted Provider, charging/Token Point path, arbitrary code/MCP/hooks, generic
-  invoke/config/ledger, publication, deployment, XMA-01, production key material,
-  or server change was introduced.
-
-## Verification
-
-- Recovery baseline: the inherited focused set produced 43 passes / 15 failures.
-  Thirteen failures were an expired fixed Admission fixture; the remaining product
-  reds proved the missing archive rejection, Project `client_incompatible` state,
-  and no-version My Plugins action. Correcting the fixture and implementing the
-  owned seams turned those boundaries green.
-- Explicit uninstall edge RED: when an old Release was protected but current was
-  not, the old implementation returned `kept` and retained current. The focused
-  regression is green after explicit/background cleanup separation.
-- Direct final focused: 6 files / 73 tests passed.
-- Marketplace/Pi/Project Plugins/Data Service adjacent regression: 28 files / 229
-  tests passed.
-- Full unit run: 208 files / 1,799 passed / 2 skipped; dedicated pressure run 1/1
-  passed.
-- `pnpm typecheck`: passed.
-- `pnpm run lint:check`: 0 errors; exactly five pre-existing out-of-scope warnings
-  remain (`Home` one hook warning, `Makelore` four Fast Refresh warnings).
-- `pnpm run build:vite`: passed (Renderer 2,261 modules; Main 193; Preload 1;
-  utility worker 9). Existing dynamic-import and chunk-size warnings remain.
-- The first clean-source `pnpm run package:win` passed through Python/uv staging,
-  Pi runtime bundling, win-unpacked, and NSIS. The first real
-  `verify:artifact:pi` correctly went RED because Vite's minified
-  `import{...}from"..."` edge was not traversed and the reachable graph could not
-  prove Renderer catalog/Library markers. A matching realistic ASAR unit fixture
-  failed 1/13; after accepting minified static ESM syntax it passed 13/13 and the
-  same real app.asar verifier returned overall `result: pass`, Marketplace
-  `result: pass`, Data Service 10 tools, Pi 0.84.2 closure complete, and only the
-  inherited real-Provider/cross-platform `partial-pass` waivers.
-- `pnpm run test:electron:windows`: 2 files / 6 tests passed.
-- Marketplace E2E bootstrap diagnosis: the original focused scenario failed 3/5,
-  and the direct-localStorage hypothesis failed 4/5 and was reverted. Waiting for
-  initial Renderer bootstrap before handler replacement passed 5/5; the original
-  Marketplace + Project Plugins target then passed 3/3.
-- Full Electron E2E: 28 passed / 1 known baseline failure. The sole failure remains
-  `tests/e2e/pi-coding-first-chat.spec.ts:575`, where the current-conversation model
-  combobox is disabled and `selectOption` times out; both Marketplace tests and the
-  Project Plugins test pass in the same run.
-- `git diff --check`: passed before documentation finalization.
-- After the source commit is amended with the minified-ESM regression, the client
-  coordinator reruns clean-HEAD `package:win`, `verify:artifact:pi`,
-  `verify:artifact:win`, and `verify:publish-runtime` so embedded Git evidence names
-  the final source. Exact hashes belong to the repository-local integration
-  checkpoint and remain a handoff condition.
-
-## Follow-ups
-
-- The client coordinator must integrate only the single source commit, record the
-  clean-HEAD Windows/package verifier ledger, then start fresh fixed-range R4
-  Standards and Spec reviews. XMA-01 stays closed until both repositories pass.
-- Production Marketplace activation remains on hold until the official Ed25519
-  public key is supplied. Release B remains deferred until a named Provider contract
-  exists.
-
-## Promotion Candidates
-
-- None recorded.

.project-docs/30-worklog/tasks/20260828-plugin-marketplace-client-5f8b3d72.md

@@ -126,6 +126,15 @@
   conflict as coordinator product commit
   `11d0af01663ad5b35a86fbe037c9277a5283f9a3`; the source/product trees are
   identical after excluding the task-scoped handoff record.
+- MLM-06 R3 review found eight actionable roots. After the user explicitly approved
+  recovery of the unresponsive owner, the coordinator force-released that owner and
+  adopted the existing task/worktree without stash, reset, clean, branch replacement,
+  or loss of its intermediate diff. Task
+  `20260828-marketplace-mlm06-r3-remediation-9e4c2a71` completed from exact frontier
+  `57962591de71fc0a9f142dbcd130e3308754e423` as sole source commit
+  `34341b932ac3a74788658bc0ed0a2732e140f72e`. It was integrated without
+  conflict as coordinator product commit
+  `3df794c2e736bde2c797c99aa8ad55b967e89ea6`.
 
 ## Outcome
 
@@ -177,6 +186,15 @@
   the current channel version, Renderer reports a truthful channel-change/unavailable
   state without inventing a yanked field. Unknown assignments and incompatible packages
   remain persisted but do not enter a new effective worker snapshot.
+- MLM-06 R3 remediation reserves bundled Data Service and all other non-Marketplace
+  Skill IDs before Marketplace resolution; binds queued Package Store work to the
+  originating account; separates Library/device Renderer intents; distinguishes
+  explicit uninstall from background cleanup; enforces the canonical Skill-only
+  archive contract; projects client incompatibility and no-version unavailable
+  installations truthfully; and binds packed proof to package-main-reachable Main,
+  HTML, minified ESM, dynamic Renderer, and Marketplace chunks. No config/assignment
+  rewrite, hidden acquisition/enablement, Token Point path, Release B runtime, or
+  production trust override was added.
 
 ## Verification
 
@@ -248,10 +266,41 @@
   through the real Windows app.asar with native entry separators; Marketplace trust
   remains official-key-absent fail-closed with no private-key material. XMA-01 was not
   run and no full-E2E pass beyond the targeted Marketplace file is claimed here.
+- MLM-06 R3 source verification passed six focused files / 73 tests, 28 adjacent
+  files / 229 tests, full Vitest `1799 passed, 2 skipped` plus pressure `1 passed`,
+  typecheck, lint with zero errors and five unchanged warnings, Vite builds, six
+  Windows Electron tests, and Marketplace/Project Plugins E2E 3/3. Full E2E passed
+  28/29; the sole failure is the same unchanged
+  `pi-coding-first-chat.spec.ts:575` disabled-model-combobox timeout. The Marketplace
+  auth test's own old-page/new-page bootstrap race was diagnosed from a 3/5 failing
+  loop and stabilized to 5/5 before the original target reran.
+- The first real package proof exposed a genuine verifier gap: Vite's
+  `import{...}from"..."` edge was missing from the reachable graph. A realistic
+  ASAR unit went red 1/13 and green 13/13; the same real app.asar then verified
+  Marketplace trust/routes/Renderer assets successfully. Final x64 staging and
+  electron-builder/NSIS ran from clean source HEAD. The aggregate download wrapper
+  was retried after GitHub `ECONNRESET` and connect timeout; already verified x64
+  Python/uv were restored from the first successful package, then final x64 staging
+  and builder passed without changing tracked files.
+- Final `verify:artifact:pi` passed with Marketplace `result: pass`, Data Service ten
+  tools, Pi 0.84.2, no closure gaps, and only the inherited real-Provider/cross-
+  platform partial-pass waivers. `verify:artifact:win` embedded exact source
+  `gitCommit`/`verificationHead`
+  `34341b932ac3a74788658bc0ed0a2732e140f72e`; installer size is 208,238,894
+  bytes and SHA-256 is
+  `1531A3ACA2AB3387870606ADA54EE40DA9079DB9E2864DE7B8FFEBAF47A453D3`.
+  Python, uv 0.10.0, npm 11.6.2, native addons, Unicode copy, and publish-runtime all
+  passed. The official Ed25519 public key is still absent, so production activation
+  remains fail-closed HOLD rather than a claimed production release.
 
 ## Follow-ups
 
-- None recorded.
+- Run fresh fixed-range MLM-06 R4 Standards and Spec reviews from the post-R3
+  coordinator documentation checkpoint. Use one remediation owner only if a
+  supported Release A finding remains.
+- Keep XMA-01, production activation, deployment, publication, push/PR, and every
+  Release B/Provider/hosted ticket closed until both repository reviews pass and the
+  required external inputs exist.
 
 ## Promotion Candidates