docs: update planning artifacts for platform challenge handling

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

progress.md

@@ -1,5 +1,48 @@
 # Progress Log
 
+## 2026-07-14T18:45:00+08:00 - Local same-platform challenge circuit breaker started
+
+- User screenshot disproved the previous end-to-end assumption: after `monitoring_collect:7995` hit `doubao_challenge_required`, later Doubao task `7989` still attempted collection on the same single account.
+- Added Phases 66-68 to reproduce the local queue race, add a platform circuit breaker, and verify it without changing other-platform scheduling or multi-account failover.
+- Initial direction: cancel/remove already leased or queued same-platform work locally as soon as the last usable account becomes challenged; do not wait for server bulk status propagation.
+- Refined the screenshot diagnosis: later Doubao row `7989` has attempt 0, so it was not proven to reach the adapter; it was bulk-marked failed with the original challenge error, which is still the wrong cancellation state.
+- Added two red regressions. Desktop scheduler fails because no platform-level pending-task removal function exists; server test fails because later tasks are explicitly set to `failed` with no `skip_reason`.
+- Phase 66 is complete and Phase 67 implementation is in progress.
+- Desktop scheduler/runtime circuit-breaker changes applied successfully. The first combined server patch failed context verification and made no server edits; implementation continues with smaller exact-context patches.
+- Scheduler/account-pool focused tests now pass. First typecheck found one redundant event payload field; the server regression reached the new `skipped` SQL and now only needs updated argument assertions.
+- Implemented local platform circuit breaking, atomic same-platform pending-task removal, manual probe/rebind recovery, model-wide monitor cancellation across account targets, canceled lifecycle events, and skipped monitoring follow-ups.
+- Focused desktop tests pass (3 files / 12 tests), desktop typecheck passes, focused server authorization-cancellation tests pass, and `git diff --check` passes.
+- Full verification passes: desktop 31 files / 213 tests, desktop typecheck, desktop production build, and server-wide `go test ./...`.
+- Final diff review found no debug instrumentation, whitespace errors, or unintended projection changes.
+- Phase 68 is complete. Live captcha triggering was not repeated against the user's account; the screenshot sequence is covered deterministically at the local scheduler and server terminal-state boundaries.
+- Root cause: follow-up tasks were already prevented from adapter execution in the shown case (`attempt 0`) but were bulk-recorded as failed with the original challenge message, and the client lacked immediate platform-wide queue purging. The fix addresses both the misleading state and the local race.
+- Planning completion check still reports historical unfinished phases 11/12, 17, and 48/49 from earlier roadmap work; current follow-up phases 66-68 are complete and unrelated roadmap state was preserved.
+
+## 2026-07-14T00:00:00+08:00 - Human-verification failover and alert hardening started
+
+- Added Phases 63-65 for challenge reproduction, account-scoped failover, model-level cancellation, and desktop system notifications.
+- Recovered the latest multi-account context: same-platform account pooling already exists, while Doubao challenge handling currently blocks the platform at admission and surfaces only activity/page state rather than a guaranteed OS notification.
+- Added `runtime-system-notification.test.ts` for danger alerts, forced account-challenge alerts, per-account deduplication, and notification failure isolation.
+- Red test confirmed the missing seam: Vitest fails because `runtime-system-notification` does not exist yet.
+- Implemented the Electron-free notification policy/sink with 30-second per-error deduplication and exception isolation.
+- Wired all `danger` runtime activities plus challenge/risk-control account transitions into the sink.
+- Added native delivery through Windows tray Toast and Electron notifications on macOS/Linux, configured once during desktop bootstrap.
+- Focused notification/account-pool tests pass (2 files, 8 tests); desktop Vue/TypeScript typecheck passes.
+- Added a direct server regression test for final `doubao_challenge_required` handling. It verifies same-tenant/date/model/client scoping, current-task exclusion, terminal source statuses, bound arguments, and the authorization-block payload.
+- The focused server test set passes, including existing non-retryable and target-client precedence checks.
+- Full verification passes: desktop 31 files / 212 tests, desktop typecheck, desktop production build, server `internal/tenant/app` tests, and `git diff --check`.
+- Final diff review confirmed ordinary recoverable warnings stay in the activity feed, while `danger` errors and account challenge/risk-control transitions produce native system notifications.
+- Phase 65 is complete. Automated coverage cannot click the host OS notification center, but the Electron native notification path passes typecheck and production bundling.
+- The planning skill completion check reports historical unfinished phases 11/12, 17, and 48/49 from earlier work; current request phases 63-65 are all complete and were not used to rewrite unrelated roadmap state.
+- Files changed for this scope:
+  - `apps/desktop-client/src/main/runtime-system-notification.ts` (created)
+  - `apps/desktop-client/src/main/runtime-system-notification.test.ts` (created)
+  - `apps/desktop-client/src/main/runtime-controller.ts`
+  - `apps/desktop-client/src/main/bootstrap.ts`
+  - `apps/desktop-client/src/main/tray.ts`
+  - `server/internal/tenant/app/monitoring_callback_service_test.go`
+  - planning files
+
 ## Session: 2026-04-30
 
 ### Phase 37: k3s Deployment Foundation