merge: integrate remote and local main histories

# Conflicts:
#	.project-docs/20-architecture/module-map.md
#	.project-docs/30-worklog/current-state.md
#	.project-docs/50-evidence/evidence-index.md
#	src/pages/MyPlugins/index.tsx
#	tests/unit/pi-agent-server-process-real.test.ts
#	tests/unit/pi-managed-worker-opener.test.ts
#	tests/unit/plugin-marketplace-pages.test.tsx

.project-docs/30-worklog/current-state.md

@@ -35,6 +35,198 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
   and collapsed process previews remain anchored to their first displayable
   line. Historical source `b1f51be` remains explicitly excluded because
   ADR-005 continues to retire the OpenMAIC Learning Player packaging chain.
+- Youth-facing AI Design client source
+  `0fd32a2d49045a8f9e7f2e19ba6477f48f93e30c` is integrated over Model Tools
+  frontier `7552cf59526449c29d663a769c0fb62d84a1a759` through merge
+  `16157388afc2f6103aaee0bfd3c4e4e80c8fec48` with startup correction
+  `c5447ae90c434c06dbafa724b229d8459cb829d0` by task
+  `20260902-design-youth-client-integration-7a6d3c92`. Canvas now defaults to
+  conversation plus one compact “我的创作” card for creators aged 8-16, with
+  contextual “精细调整” instead of an always-visible professional field matrix.
+  The card remains a pure projection of the canonical V2 Current Specification;
+  direct choices use typed commands, Quote blockers follow Specification revision,
+  terminal blocked Quotes settle pending operations, and code-based Chinese copy
+  prevents raw compiler/Provider text from reaching the youth UI. Video editing
+  preserves stable canonical Shot identities and all hidden production metadata for
+  up to 24 Shots. No database, DTO/API, pricing, Provider route, or compatibility
+  path changed. Integration verification passed 40 focused youth tests, 5 Device
+  Package tests, typecheck, scoped lint, production build, and 2 Electron E2E flows.
+  The Electron run also exposed and closed an existing current-frontier startup crash:
+  the ESM-only Pi package manager is now loaded only when remote Device Package
+  installation needs it. No package, deployment, publication, push, or paid request
+  is claimed.
+- Model Tools and Device Packages client cutover is implemented by task
+  `20260902-model-tools-client-integration-5d8b2f73`. Web Search is now a parent-only
+  core tool of the frozen selected model/provider/credential; it no longer depends on
+  Marketplace acquisition, Release, Admission, the hosted client, or Plugin Token Point
+  receipts, and it never falls back to `agent_browser`. Electron Main also owns a
+  conversation-only Device Package manager for npm, Git, local Plugin directories, and
+  loose `SKILL.md` sources. Preview and a distinct confirmation turn precede immutable
+  local commit; lifecycle scripts stay disabled; new and idle parent workers refresh
+  automatically while active workers switch after settlement; child workers remain
+  empty. My Plugins now separates Official Plugins from Device Installed packages and
+  exposes no visible install picker. Packaged Skill/Pi-extension installation and real
+  selected-model search remain external acceptance gates; no paid Provider request,
+  production install, publish, push, or PR is claimed.
+- Windows titlebar Logo-overlap correction source
+  `99a210e244731d1cdc923e9dd4adf6e09e64c2a4` from task
+  `20260901-windows-titlebar-logo-overlap-5100e298` is integrated onto local
+  `main` through product commit `e800d42595484389432fd08b11c2202074a7009e`
+  by task `20260902-windows-titlebar-integration-afc9e259`. The shared
+  `ProductTitleBar` now uses one 148 px Windows caption-control region (three
+  44 px buttons plus 8 px padding on each side) both to size the control wrapper
+  and to inset the Makelore Logo. Canvas and Coding Electron geometry checks
+  confirm that the Logo ends before the minimize button; macOS keeps its zero
+  inset and native traffic-light behavior. Focused 11-test, full 1,788-test plus
+  pressure, typecheck, scoped/full lint, Vite build, and two Electron E2E checks
+  passed. No package, deployment, publication, backend contract, or unrelated
+  product layout changed.
+- Web Search unavailable-Release diagnostic correction source
+  `2e093bd22c0a3c46cc08b8eede8c1bc02afd690b` from task
+  `20260901-web-search-runtime-stale-r2-6f4a2d91` is integrated on local `main`
+  through product commit `93e3143` by task
+  `20260902-web-search-client-integration-a4c8e291`. When the server resolve API
+  explicitly returns `action='unavailable'` for `plugin_release_not_ready` or
+  `plugin_client_incompatible`, Electron Main now preserves the existing typed
+  `plugin_release_unavailable` result instead of mislabeling it as the unrelated
+  frozen-worker `plugin_runtime_stale` error. Exact Release, Account/project, policy,
+  Admission, Provider, confirmation, billing, and child-isolation gates are unchanged.
+  The current installed client still predates this diagnostic correction, and actual
+  usability still requires Works Square to deploy/apply the missing official bundled
+  Release and compatibility migrations; no package, restart, deployment, publication,
+  or paid Provider request occurred.
+- Web Search frozen-worker stale-Library correction source
+  `3620cdc277fa0a99757c57a549008f9ecd380558` from task
+  `20260901-web-search-stale-resources-8b4e2c71` is integrated onto local `main`
+  through product commit `40e1912` by task
+  `20260901-web-search-stale-integration-9c5f3d82`. Live client evidence showed an
+  eligible parent worker with the official Web Search Skill, tool, Release and policy
+  failing `409 plugin_runtime_stale` because invocation re-ran full materialization and
+  treated one transient Account Library refresh as permanent worker invalidation. New
+  workers still require a current Library; a previously frozen worker may now use the
+  last verified Library projection only long enough to obtain the server-owned exact
+  Release Admission. Account/session change, project disable, acquisition removal,
+  runtime suspension, Release/version change, policy/billing gates and child isolation
+  remain fail closed. Focused 19, adjacent 55, full 1,786 plus pressure, typecheck and
+  scoped lint passed. The currently running installed binary predates this source fix;
+  no restart, package, deploy, publication or paid Provider call was performed.
+- Web Search Agent-assignment catalog fix source
+  `612794463de1b14fd748202a00115c6f93c7346b` from task
+  `20260901-web-search-tool-routing-fix-6f9d3b82` is integrated onto local `main`
+  through product commit `adc28db7855f8b1770f1c1d46af77b7cc88cfa1a` by task
+  `20260901-web-search-tool-routing-integration-7a4e1c93`. The unscoped partner
+  Skill picker now lists every project-enabled Plugin Skill before first assignment
+  and does not invoke runtime Admission resolution; Agent-scoped/runtime projections
+  still use only the resolver-approved effective subset. This closes the confirmed
+  circular state where an enabled Web Search Skill was hidden until already assigned,
+  leaving the actual Pi worker with only `agent_browser`. Focused 45-test, full
+  1,785-test plus pressure, typecheck, and scoped-lint verification passed. Existing
+  workers remain frozen; the affected local Agent assignment was corrected separately
+  and takes effect on a new Conversation.
+- Official bundled Plugin client cutover is integrated on local `main` through product
+  commit `1530ac774091c7083dbff19e0fbd69e929ac8718` by task
+  `20260901-official-bundled-plugins-client-integration-b8d5f3a2`. Game Resource and
+  Web Search now ship as exact schema-2 resource packages with MakeLore; their acquired
+  Library entries resolve through the server Admission path without Package Store
+  download, update, Beta, signature, or device-uninstall state. Project enablement,
+  Agent assignment, parent-only materialization, Provider policy, confirmation, and
+  Token Point billing remain enforced. The verified Windows installer embeds source
+  `b1657300f29f9744551f31029eb192ee82f01b92`, is 208,297,578 bytes, and has SHA-256
+  `449288AF079E030F3F700F0FF1701971F7AB4806E0366CE989F4E8F2FE33ACA3`.
+- Conversation abort reconciliation source
+  `d2ef37bc4d7d3609cec0a55c4ae8ffb2734696d5` from task
+  `20260901-conversation-abort-stall-6f4c2a91` is merged into local `main` as
+  `85900717906713d8343c2087eade904aead8f111` through verified candidate
+  `599d1847f73a590690cbac2ee1c5bf36e8cd83f1` by task
+  `20260901-merge-abort-main-a83d4c71`.
+  Both visible abort actions now call the Main-owned abort route and then silently
+  reload only the target Conversation's authoritative Snapshot. This closes the
+  installed 1.2.1 case where Pi had already recorded bash results and a final
+  assistant `stop`, but Renderer missed the terminal SSE patch and a later valid
+  abort no-op left the UI showing an executing turn. Pi `0.84.2`, Host API,
+  replay, recovery, and background-lifecycle contracts are unchanged. Focused
+  35-test, 1,780-test full-suite plus pressure, typecheck, lint, production-build,
+  and Electron E2E verification passed. The existing 1.2.1 artifact predates this
+  fix; a newly versioned package and installed-client acceptance remain pending.
+- Agent Server background-sleep race fix source
+  `12d7588b3ebd4d192c2e14ae285d4f6ddebeeb42` from task
+  `20260901-agent-received-stall-8b6d4c21` is merged into local `main` as
+  `c2137c9f3f2e05441064cc90bfeed115363ac04e` by task
+  `20260901-integrate-agent-stall-4f2c8a91`. Background sleep now rechecks
+  active Coding work after asynchronous worker cleanup before stopping the shared
+  Agent Server, and a server start racing an in-flight stop waits for that stop and
+  creates one fresh process. This closes the confirmed lifecycle windows that can
+  leave a locally accepted prompt optimistic with no live Agent Server or Pi session
+  write; accepted/uncertain prompts are still never auto-replayed. Source tests and
+  a real Electron-Node Agent Server race test pass. The currently installed binary
+  predates this integration; a rebuilt/reinstalled Windows package and repetition of
+  the reported interaction remain pending release evidence.
+- Works-provisioned model-reasoning capability source
+  `ae7936174208a1d13cdfd260d5c6f2b70b450b60` from task
+  `20260901-server-model-capabilities-9e31b6c4` is merged into local `main` as
+  `6a8ebe1b671ca24150c2226b9111b9d07174e37b` by task
+  `20260901-integrate-model-capabilities-9b3e7c1a`, paired with Works Square source
+  `9e1b6886b360175f1ca1596fb07f71e3bf86c894`. Electron Main now strictly
+  normalizes and persists the optional safe `model_capabilities` metadata, removes a
+  stale override when the field is absent, and includes it in Provider runtime-shape
+  invalidation. Server levels override the verified local reasoning map; old servers
+  and direct Providers retain the local fallback. DeepSeek exposes
+  `off`/`low`/`high`/`max`: Pi disables thinking without `reasoning_effort` for
+  `off`, and sends the exact enabled effort otherwise. Native `max` reaches project
+  persistence, Snapshot/Patch, Host API, runtime, and the composer label `最高`.
+  Pi remains `0.84.2`; no one-api, dependency, package, deployment, or real Provider
+  acceptance is claimed.
+- Marketplace weak-ETag interoperability fix source
+  `b3cfe7e1ceb7da65ccc99214db09102b4fc1cace` from task
+  `20260901-plugin-catalog-load-client-7d4a8c21` is promoted to local `main` by
+  task `20260901-plugin-catalog-main-integration-8e5c2a91` through product commit
+  `38f2358`. The Main-owned Marketplace client now accepts both strong and valid
+  weak composite catalog ETags, preserves the exact received validator for the next
+  `If-None-Match`, and retains catalog-generation and Token Point pricing identity
+  checks. This closes the installed-client failure where the production gateway's
+  compressed `W/"plugins-..."` response was incorrectly surfaced as
+  `plugin_backend_unavailable`; it does not add a local fallback catalog or change
+  server, Provider, trust, pricing, or billing authority. The rebuilt Windows 1.2.0
+  installer embeds verification head `6083de6aee8942a78191ed18a00bfd9f4ba0902d`,
+  is 294,864,542 bytes with SHA-256
+  `1301AE189BCBD44AA0E373982981E80B324EC45CDDF8F30415C2810F68319C06`,
+  and was installed over the prior 1.2.0 at the existing user-selected location.
+  The signed-in installed client then loaded the deployed generation-2 catalog and
+  rendered exactly Data Service, Game Resource, and Web Search without the unavailable
+  catalog error. At that checkpoint Game Resource and Web Search still showed no stable
+  Release; the official bundled cutover recorded above supersedes that delivery model.
+- Packaged Pi Agent Server resolver fix source `7df245af5a04f62be48980831ff41987ba686009`
+  from task `20260901-local-runtime-unavailable-8b42c7f1` is promoted to local
+  `main` by task `20260901-promote-local-runtime-main-a7c4e291` through verified
+  integration candidate `42ea83c0cbad52432eca99e4161e0360bef3e219` and source merge
+  `96402551f46d875ba3db0a2f625397aba2f332fb`. Electron Main now starts only the
+  shared Agent Server with Node's `import.meta.resolve` parent-URL capability enabled,
+  so the unchanged server script resolves `@earendil-works/pi-ai` from the explicit
+  packaged `pi-runtime` root instead of the sibling `resources/resources` directory.
+  A production-shaped sibling-layout test reproduces the installed failure before the
+  fix and initializes successfully through Electron Node after it; Pi remains pinned at
+  `0.84.2`, and no bundle layout, Provider, Renderer, or recovery contract changed.
+  The currently installed application predates this source integration; a rebuilt and
+  verified Windows artifact plus first-Conversation acceptance remain pending.
+- Native Web Search client tickets MLW-01 through MLW-03 are integrated by source
+  coordinator `20260831-web-search-client-integration-7d2f5b94` and promoted to local
+  `main` by task `20260901-web-search-client-main-merge-5a9d3b82` from reviewed
+  coordinator closure `ae81949a49d7df3be4859e6c111235a991a504e4` through product commit
+  `49de82c4860fd0b377070279b6411237dc6b9564`; the final fixed-range Standards and
+  Spec reviews passed at `4de3feefe451dc34dc46b323e2ea5e0b4e4840e8` with zero
+  actionable findings, against frozen Works Square DTO frontier
+  `a49c696ebc4213e3d62ece780961efbe17576f8e`. MakeLore now reuses the shared
+  hosted Admission resolver, calls the single fixed Web Search typed route from
+  Electron Main, materializes the signed Marketplace Skill/tool only in an eligible
+  frozen parent Pi snapshot, and renders the closed billing receipt without parsing
+  Web Search payloads in Renderer. The packaged Windows app proves that the route
+  and receipt parser are main-reachable while OpenAI Provider authority is absent.
+  The exact reviewed Windows package passed artifact verification; installer SHA-256
+  is `2492F88BB6F813834ECD24B392EB8337220E131E746547851393E4885C4B5BEF` and
+  `app.asar` SHA-256 is `27EFABBB741F0A62CB58452801DD1D8893B8E5131EA1D30F74D610DEAD3F7A1D`.
+  Real PostgreSQL and paid OpenAI acceptance remain external HOLDs; production
+  activation still requires the official Ed25519 key, OpenAI key/model, price, and
+  privacy copy. No deployment, publication, push, or PR occurred.
 - Human-authorized takeover task `20260831-promote-main-merge-5e9c7a31` completed
   the already-started local `main` merge as
   `03a9e866d4366e0a1cb416e26b424fe981071310`, recorded the transfer in
@@ -240,7 +432,7 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 客户端面向非专业用户提供“创建小游戏或小程序 → 项目配置中一键提交 → Main 本地 npm/Vite 构建 → Electron 双视口预检最终产物 → 上传 source+built 双归档与 contract → 运营审核”的唯一创建者链路。Main 对安全源码快照运行安装包内固定 npm 11.6.2 的 `npm ci --ignore-scripts`，再显式调用项目 `package-lock.json` 锁定的 Vite；Vite config/plugins 以当前桌面用户权限执行，因此只适用于用户信任的本地项目，不是 sandbox。预检由 Main 以临时 loopback origin 和 Electron WebContents/CDP 检查与最终 `built_archive` 相同的内存文件字节，覆盖桌面/移动视口、运行错误、白屏和外域访问；不使用 Playwright。该检查仍可由非官方客户端绕过，不产生可信 receipt，也不复刻生产 opaque-origin。服务端不再替客户端运行项目 Vite，而是把源码、构建归档和 contract 视为不可信输入，逐字节重算与校验并固化不可变 Release；人工审核仍不可绕过。自定义和缺少类型字段的旧项目不提供该入口。已发布作品优先使用安全投影后的 `play_url`，`runtime_url` 仅保留一个客户端版本的兼容回退。
 
-AI Design Canvas 现在是持续可见的双栏 Living Form 工作区。一个 Workspace 公开一个 current Direction、一个 persistent Agent Session 和一个 Current Specification；conversation timeline 只记录交互历史。Chat、direct edits、decision responses、proposal acceptance、locks、Asset binding 与 restore 都通过 `design.input.apply` 进入同一服务端 reducer，Renderer drafts 在 accepted 前保持本地。Main 持有 Works Token、stream ticket、WebSocket、request deadline、stable command/operation IDs 与错误脱敏；unknown result 只能复用原 identity，结构化业务错误不得重放。Generation 由服务端对 exact Specification revision 编译 immutable Quote，客户端只展示 public output plan、warnings、expiry 与 Token Points，并以 Quote ID 调用 `design.generation.confirm`；Provider Prompt、model、route、storage 和 billing atoms 不进入 Renderer。Task/Asset events 独立收敛 Workspace resources，不改写 Living Form。Development 与 packaged builds 均使用 Works Square V2，V1 DTO、local semantic adapter、mutable Quote PATCH 与 editable provider Prompt 已移除。
+AI Design Canvas 现在默认以对话和一张持续可见的“我的创作”卡服务 8-16 岁创作者；专业字段矩阵收进按需打开的“精细调整”，移动端保持对话优先并只挂载一个卡片/底部面板。Creation Card、精细调整、Quote、Task 与结果提示都只投影权威状态，已知问题按 code 转成通俗中文，未知服务端或 Provider 文本不会直接显示。一个 Workspace 仍只公开一个 current Direction、一个 persistent Agent Session 和一个 Current Specification；conversation timeline 只记录交互历史。Chat、direct edits、decision responses、proposal acceptance、locks、Asset binding 与 restore 都通过 `design.input.apply` 进入同一服务端 reducer，Renderer drafts 在 accepted 前保持本地。Main 持有 Works Token、stream ticket、WebSocket、request deadline、stable command/operation IDs 与错误脱敏；unknown result 只能复用原 identity，结构化业务错误不得重放。Generation 由服务端对 exact Specification revision 编译 immutable Quote，客户端只展示 public output plan、warnings、expiry 与 Token Points，并以 Quote ID 调用 `design.generation.confirm`；Provider Prompt、model、route、storage 和 billing atoms 不进入 Renderer。Task/Asset events 独立收敛 Workspace resources，不改写 Living Form。Development 与 packaged builds 均使用 Works Square V2，V1 DTO、local semantic adapter、mutable Quote PATCH 与 editable provider Prompt 已移除。
 
 Canvas 侧栏提供“获取灵感”进入 Prompt Museum。列表、筛选、分页、详情、作者/来源/许可证和图片地址全部由服务端经 Main-owned Host API 提供，客户端不打包静态数据集；服务端相对媒体只允许固定 `/api/image-prompt-museum/{entry}/media/{thumbnail|number}` 形状，并由 Main 注入 Works Bearer、执行一次 401 刷新、可信 raster MIME 与 10 MiB 上限后转为 Renderer data URL；credential-free HTTPS CDN 图片保持直连。图片失败只显示卡片内占位，不阻断卡片或详情；缺少来源 URL 时显示纯文本。“使用此 Prompt”只把原文带回当前 Canvas 输入框，不自动发送。该模块不是投稿、点赞、评论或排行榜社区。客户端契约已就绪，但不据此宣称 Works Square 内容后台和生产数据已经部署。`pnpm run dev` 现在默认使用云端 Canvas 适配器，本地适配器只能通过显式开发命令启用；产品 UI 只保留中文。