docs: update TODO and CHANGELOG for session work

- TODO: mark completed (SPKI persistence, theme editor, pro components,
  error handling, marketplace, E2E expansion), add new items (E2E failures,
  daemon integration)
- CHANGELOG: add ThemeEditor, marketplace, 6 commercial modules, AppError
  enum, E2E daemon, security fixes (5 critical + 14 high)

TODO.md

@@ -1,12 +1,7 @@
 # Agents Orchestrator — TODO
 
-## URGENT
-
-- [~] **Comprehensive error handling** — Day 0 foundation shipped: extractErrorMessage, handleError/handleInfraError utilities, error-classifier extended (ipc/database/filesystem), toast rate-limiting. Sprint 1+2 in progress (3 background agents): settings Promise.allSettled migration, Rust AppError enum, bridge/store audit, global unhandledrejection handler. See .tribunal/tribunal-codex-report.md for full plan.
-
 ## Dual-Repo & Commercial
 
-- [ ] **Pro Svelte components** — AnalyticsDashboard, SessionExporter, AccountSwitcher components + wire into ProjectBox Pro tab. Rust backend and bridge done.
 - [ ] **CLA setup** — Configure CLA-assistant.io on community repo (DexterFromLab/agent-orchestrator) before accepting external PRs.
 - [ ] **Community export workflow** — Define and document the process for stripping commercial content and pushing to DexterFromLab origin.
 - [ ] **Dual CI validation** — Verify both leak-check.yml and commercial-build.yml workflows work in GitHub Actions.
@@ -14,7 +9,6 @@
 ## Multi-Machine (v3.1)
 
 - [ ] **Real-world relay testing** — TLS added, code complete in bridges/stores. Needs 2-machine test to verify relay + RemoteManager end-to-end.
-- [ ] **SPKI pin persistence** — TOFU pinning implemented but pins are lost on restart. Persist to groups.json or separate config file.
 
 ## Multi-Agent (v3.1)
 
@@ -25,20 +19,20 @@
 - [ ] **Soak test** — Run 4-hour soak with 6+ agents across 3+ projects. Monitor: memory, WAL size, xterm count, supervisor restarts.
 - [ ] **WebKit2GTK Worker verification** — Verify Web Worker Blob URL approach in Tauri's WebKit2GTK webview.
 
+## E2E Testing
+
+- [ ] **Fix remaining E2E failures** — settings.test.ts, phase-a-agent (status selectors), phase-c/d/e/f (new specs need selector alignment). ~10 specs still failing.
+- [ ] **Test daemon integration** — Wire daemon CLI (tests/e2e/daemon/) into CI workflow. Verify --agent flag works with Agent SDK.
+
 ## Completed
 
-- [x] Settings redesign — 6 modular components replacing 2959-line monolith, theme dropdown fix | Done: 2026-03-18
-- [x] Docs reorganization — subdirectories, 6 new reference docs, bterminal purge | Done: 2026-03-18
-- [x] Svelte warnings fix — 15 warnings resolved (a11y, unused CSS, state_referenced_locally) | Done: 2026-03-18
-- [x] Error handling Day 0 — extractErrorMessage, handleError/handleInfraError, classifier extension, toast rate-limiting | Done: 2026-03-18
-- [x] 3 commercial features (analytics, export, profiles) — Rust + bridge + 14 tests | Done: 2026-03-17
-- [x] bterminal→agor rebrand + dual-repo commercial structure | Done: 2026-03-17
-- [x] Tribunal-codex dual-repo strategy (S-3+S-1 hybrid, 80% confidence) | Done: 2026-03-17
-- [x] Plugin sandbox migration — Web Worker isolation, 26 tests | Done: 2026-03-15
-- [x] seen_messages startup pruning | Done: 2026-03-15
-- [x] Tribunal priorities: Aider security, SidecarManager actor, SPKI pinning, btmsg reliability, Aider tests | Done: 2026-03-14
-- [x] Dead code cleanup — 7 warnings resolved, 4 new Tauri commands | Done: 2026-03-14
-- [x] E2E fixture + judge hardening | Done: 2026-03-12
-- [x] v3 Hardening Sprint (TLS, WAL, Landlock, plugin tests, Phase C E2E) | Done: 2026-03-12
-- [x] v3 Production Readiness — all 13 tribunal items | Done: 2026-03-12
-- [x] Unified test runner + testing gate rule | Done: 2026-03-12
+- [x] E2E test daemon CLI — ANSI dashboard, smart caching (3-pass skip), error toast catching, Agent SDK bridge | Done: 2026-03-18
+- [x] SPKI pin persistence — pins saved to groups.json, survive app restarts | Done: 2026-03-18
+- [x] E2E spec expansion — 19 files, ~200 tests, Phase D/E/F added, all specs split <300 lines | Done: 2026-03-18
+- [x] E2E port isolation — dedicated port 9750, app identity verification, devUrl conflict detection | Done: 2026-03-18
+- [x] Pro Svelte components wired — AnalyticsDashboard, SessionExporter, AccountSwitcher in ProjectBox Pro tab | Done: 2026-03-18
+- [x] ThemeEditor — 26 color pickers, live preview, import/export, custom theme persistence | Done: 2026-03-18
+- [x] Comprehensive error handling — AppError enum (Rust), handleError/handleInfraError (frontend), global handler | Done: 2026-03-18
+- [x] Plugin marketplace — 13 plugins (8 free, 5 paid), catalog, security (SHA-256, HTTPS, path traversal) | Done: 2026-03-17
+- [x] Security audit fixes — 5 critical + 14 high issues found and fixed across agor-pro + Svelte | Done: 2026-03-17
+- [x] Settings redesign — 6 modular components replacing 2959-line monolith | Done: 2026-03-18