@@ -27,9 +27,9 @@ OpenBitFun Playbook currently contains **23 features**, **21 settings pages**, a
 - Generated per-item interaction audit: `docs/interactive-capabilities/technical/product-control-open-audit.json`
 - Generated low-level audit map: `docs/interactive-capabilities/technical/tauri-command-map.json`
 
-说明书、网站、搜索和智能体只看“功能 + 设置 + 子能力”。每项子能力都必须引用已注册 Tauri Command 或可解析的源码标记；这些证据不会进入公开目录。当前 **692** 个 Tauri 命令只用于实现覆盖审计。产品 UI 交互源码会在生成和检查时扫描并校验，但不会保存成随普通 UI 改动频繁变化的版本化快照。
+说明书、网站、搜索和智能体只看“功能 + 设置 + 子能力”。每项子能力都必须引用已注册 Tauri Command 或可解析的源码标记；这些证据不会进入公开目录。当前 **693** 个 Tauri 命令只用于实现覆盖审计。产品 UI 交互源码会在生成和检查时扫描并校验，但不会保存成随普通 UI 改动频繁变化的版本化快照。
 
-Docs, website, search, and agents see only features, settings, and documented sub-capabilities. Every sub-capability must reference a registered Tauri command or a resolvable source marker; evidence is stripped from public projections. The **692** Tauri commands remain implementation-audit evidence only. Product UI interaction sources are scanned and validated during generation and checks, but are not stored as a versioned snapshot that churns with ordinary UI changes.
+Docs, website, search, and agents see only features, settings, and documented sub-capabilities. Every sub-capability must reference a registered Tauri command or a resolvable source marker; evidence is stripped from public projections. The **693** Tauri commands remain implementation-audit evidence only. Product UI interaction sources are scanned and validated during generation and checks, but are not stored as a versioned snapshot that churns with ordinary UI changes.
 
 ## 控制边界 / Control boundary
 
 
@@ -2,12 +2,12 @@
   "schemaVersion": 2,
   "generatedFrom": "src/shared/interactive-capabilities/catalog.json",
   "catalogDigest": "05afb29f354928738ed26d4275819bbe3c165c7878bb24996b5169639ba03330",
-  "commandCount": 692,
+  "commandCount": 693,
   "coverage": {
-    "commandCount": 692,
+    "commandCount": 693,
     "documentedCommandCount": 642,
-    "implementationCommandCount": 50,
-    "implementationDigest": "1dc90be1a699f521e7faee78c128d6332ef0806daccb389b288fbe2fa3fd3c2c"
+    "implementationCommandCount": 51,
+    "implementationDigest": "b9ffc435b3b60049737b988fa48409ec88e570fcf52eb71a79d75ce13877086f"
   },
   "commands": [
     {
@@ -5615,6 +5615,20 @@
       "signature": "fn load_acp_json_config(state: State<'_, AppState>) -> Result<String, String>",
       "remoteWorkspacePolicy": "LegacyUnaudited"
     },
+    {
+      "id": "load_agent_companion_pet_spritesheet",
+      "moduleId": "commands",
+      "capabilityId": "feature.projects",
+      "capabilityIds": [
+        "feature.projects"
+      ],
+      "documentedItemIds": [],
+      "visibility": "implementation",
+      "rustPath": "load_agent_companion_pet_spritesheet",
+      "sourceFile": "src/apps/desktop/src/api/commands.rs",
+      "signature": "fn load_agent_companion_pet_spritesheet( state: State<'_, AppState>, request: LoadAgentCompanionPetSpritesheetRequest, ) -> Result<tauri::ipc::Response, String>",
+      "remoteWorkspacePolicy": "LocalOnly"
+    },
     {
       "id": "load_canvas_artifact",
       "moduleId": "canvas",
 
@@ -518,6 +518,12 @@ pub struct ListAgentCompanionPetsRequest {
     pub builtin_import_version: Option<u32>,
 }
 
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct LoadAgentCompanionPetSpritesheetRequest {
+    pub spritesheet_path: String,
+}
+
 #[derive(Debug, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct ListAgentCompanionPetsResponse {
@@ -2609,6 +2615,48 @@ mod pet_package_tests {
             .contains("reviewed fingerprint"));
     }
 
+    #[test]
+    fn pet_spritesheet_read_is_confined_to_the_companion_directory() {
+        let temp = tempfile::tempdir().unwrap();
+        let root = temp.path().join("agent-companions");
+        let pet_dir = root.join("pet-abc");
+        std::fs::create_dir_all(&pet_dir).unwrap();
+        let spritesheet = pet_dir.join("spritesheet.webp");
+        std::fs::write(&spritesheet, [1u8, 2, 3]).unwrap();
+
+        assert_eq!(
+            read_agent_companion_pet_spritesheet(&root, &spritesheet).unwrap(),
+            vec![1, 2, 3]
+        );
+
+        let outside = temp.path().join("credentials.txt");
+        std::fs::write(&outside, b"secret").unwrap();
+        let error = read_agent_companion_pet_spritesheet(&root, &outside).unwrap_err();
+        assert!(
+            error.contains("outside the companion pet directory"),
+            "{error}"
+        );
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn pet_spritesheet_read_rejects_a_symlinked_escape() {
+        let temp = tempfile::tempdir().unwrap();
+        let root = temp.path().join("agent-companions");
+        let pet_dir = root.join("pet-abc");
+        std::fs::create_dir_all(&pet_dir).unwrap();
+        let outside = temp.path().join("credentials.txt");
+        std::fs::write(&outside, b"secret").unwrap();
+        let link = pet_dir.join("spritesheet.webp");
+        std::os::unix::fs::symlink(&outside, &link).unwrap();
+
+        let error = read_agent_companion_pet_spritesheet(&root, &link).unwrap_err();
+        assert!(
+            error.contains("outside the companion pet directory"),
+            "{error}"
+        );
+    }
+
     #[test]
     #[ignore = "Imports installed Codex pets into an isolated temporary directory"]
     fn installed_builtin_pets_can_be_previewed_and_imported() {
@@ -2825,6 +2873,77 @@ pub(crate) async fn list_agent_companion_pets_impl(
     })
 }
 
+/// Upper bound for a single pet spritesheet. A spritesheet is a small sprite
+/// atlas, so a larger file is not a pet package asset and must not be buffered
+/// through the IPC channel.
+const MAX_AGENT_COMPANION_SPRITESHEET_BYTES: u64 = 16 * 1024 * 1024;
+
+/// Reads a user pet spritesheet through the host.
+///
+/// The webview used to read this file with the filesystem plugin, whose scope
+/// requires a literal leading dot on unix. Every XDG directory starts with a
+/// dot, so a Linux install could never resolve a spritesheet that lives under
+/// the app data directory; the read always failed with `forbidden path`
+/// (#3370). The host performs the read instead and keeps it confined to the
+/// managed companion directory, which is the only place a user pet package can
+/// be imported to.
+#[tauri::command]
+pub async fn load_agent_companion_pet_spritesheet(
+    state: State<'_, AppState>,
+    request: LoadAgentCompanionPetSpritesheetRequest,
+) -> Result<tauri::ipc::Response, String> {
+    let packages_root = companion_user_packages_dir(&state);
+    let spritesheet_path = request.spritesheet_path;
+    let bytes = tokio::task::spawn_blocking(move || {
+        read_agent_companion_pet_spritesheet(&packages_root, Path::new(&spritesheet_path))
+    })
+    .await
+    .map_err(|e| e.to_string())??;
+    Ok(tauri::ipc::Response::new(bytes))
+}
+
+fn read_agent_companion_pet_spritesheet(
+    packages_root: &Path,
+    spritesheet_path: &Path,
+) -> Result<Vec<u8>, String> {
+    let root = packages_root.canonicalize().map_err(|error| {
+        format!(
+            "Companion pet directory is unavailable ({}): {}",
+            packages_root.display(),
+            error
+        )
+    })?;
+    let requested = spritesheet_path.canonicalize().map_err(|error| {
+        format!(
+            "Failed to resolve {}: {}",
+            spritesheet_path.display(),
+            error
+        )
+    })?;
+    if !requested.starts_with(&root) {
+        return Err(format!(
+            "Refused to read {} outside the companion pet directory",
+            spritesheet_path.display()
+        ));
+    }
+    let metadata = std::fs::metadata(&requested)
+        .map_err(|error| format!("Failed to read {}: {}", requested.display(), error))?;
+    if !metadata.is_file() {
+        return Err(format!(
+            "Not a companion pet spritesheet file: {}",
+            requested.display()
+        ));
+    }
+    if metadata.len() > MAX_AGENT_COMPANION_SPRITESHEET_BYTES {
+        return Err(format!(
+            "Companion pet spritesheet is too large: {} bytes",
+            metadata.len()
+        ));
+    }
+    std::fs::read(&requested)
+        .map_err(|error| format!("Failed to read {}: {}", requested.display(), error))
+}
+
 #[tauri::command]
 pub async fn import_agent_companion_pet_package(
     state: State<'_, AppState>,
 
@@ -978,6 +978,20 @@ fn resize_agent_companion_window(
     }
 }
 
+/// Re-asserts the pet stacking hint after the native window is mapped.
+///
+/// GTK applies keep-above on map, and a reused window may have been raised
+/// behind the main window while it was hidden, so both show paths re-apply it.
+#[cfg(target_os = "linux")]
+fn enforce_agent_companion_window_stacking(window: &tauri::WebviewWindow) {
+    if let Err(error) = window.set_always_on_top(true) {
+        warn!(
+            "Failed to re-apply Agent companion always-on-top: {}",
+            error
+        );
+    }
+}
+
 #[tauri::command]
 pub async fn show_agent_companion_desktop_pet(app: tauri::AppHandle) -> Result<(), String> {
     let started_at = Instant::now();
@@ -997,6 +1011,8 @@ pub async fn show_agent_companion_desktop_pet(app: tauri::AppHandle) -> Result<(
             error!("Failed to show Agent companion window: {}", e);
             format!("Failed to show Agent companion window: {}", e)
         })?;
+        #[cfg(target_os = "linux")]
+        enforce_agent_companion_window_stacking(&window);
         debug!(
             "Agent companion window reused: total_duration_ms={}",
             started_at.elapsed().as_millis()
@@ -1042,6 +1058,22 @@ pub async fn show_agent_companion_desktop_pet(app: tauri::AppHandle) -> Result<(
 
     builder = builder.disable_drag_drop_handler();
 
+    // Wayland compositors drop GTK's keep-above request, so the only stacking
+    // relationship the platform can still guarantee is "above its parent".
+    // Attaching the pet to the main window keeps the app's own page from covering
+    // it there, while `always_on_top` keeps floating it above other applications
+    // on X11, where the window manager honors the hint.
+    #[cfg(target_os = "linux")]
+    if let Some(main_window) = app.get_webview_window("main") {
+        match main_window.gtk_window() {
+            Ok(parent) => builder = builder.transient_for_raw(&parent),
+            Err(error) => warn!(
+                "Failed to read the main window GTK handle for Agent companion stacking: {}",
+                error
+            ),
+        }
+    }
+
     let build_started_at = Instant::now();
     let window = builder.build().map_err(|e| {
         error!(
@@ -1064,6 +1096,8 @@ pub async fn show_agent_companion_desktop_pet(app: tauri::AppHandle) -> Result<(
         error!("Failed to show Agent companion window: {}", e);
         format!("Failed to show Agent companion window: {}", e)
     })?;
+    #[cfg(target_os = "linux")]
+    enforce_agent_companion_window_stacking(&window);
     debug!(
         "Agent companion window shown: show_duration_ms={} total_duration_ms={}",
         show_started_at.elapsed().as_millis(),
 
@@ -1486,6 +1486,7 @@ pub async fn run() {
             desktop_cards::commands::desktop_card_set_checklist_item,
             desktop_cards::commands::desktop_card_set_always_on_top,
             list_agent_companion_pets,
+            load_agent_companion_pet_spritesheet,
             import_agent_companion_pet_package,
             delete_agent_companion_pet_package,
             read_file_content,
 
@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "digest": "fnv1a64:bbd47100ae85c396",
+  "digest": "fnv1a64:ddf61f87bff00c48",
   "retiredCommandPrefixes": [
     {
       "prefix": "lsp_",
@@ -4417,6 +4417,18 @@
         "reason": "the CLI peer host has no handler for this command"
       }
     },
+    {
+      "id": "load_agent_companion_pet_spritesheet",
+      "surface": "tauri_command",
+      "remoteWorkspace": "LocalOnly",
+      "peer": {
+        "kind": "controller_local"
+      },
+      "cliPeer": {
+        "kind": "unsupported",
+        "reason": "the controller keeps this command; peer hosts refuse it before dispatch"
+      }
+    },
     {
       "id": "load_canvas_artifact",
       "surface": "tauri_command",
 
@@ -456,6 +456,7 @@ pub(super) const OPERATIONS: &[OperationDefinition] = &[
     op("list_subscription_accounts",                                 LocalOnly,   Proxied,          CLI_NOT_IMPLEMENTED),
     op("list_visible_subagents",                                     Routed,      Proxied,          HANDLED),
     op("load_acp_json_config",                                       Unaudited,   Proxied,          CLI_NOT_IMPLEMENTED),
+    op("load_agent_companion_pet_spritesheet",                       LocalOnly,   ControllerLocal,  REFUSED),
     op("load_canvas_artifact",                                       Agnostic,    Proxied,          CLI_NOT_IMPLEMENTED),
     op("load_canvas_state",                                          Agnostic,    Proxied,          CLI_NOT_IMPLEMENTED),
     op("load_git_repo_history",                                      Unaudited,   Proxied,          CLI_NOT_IMPLEMENTED),
 
@@ -254,6 +254,7 @@
     "fileTransferPrimitives": [
       "local_file_download",
       "export_local_file_to_path",
+      "load_agent_companion_pet_spritesheet",
       "paste_files",
       "workspace_file_upload"
     ],
 
@@ -1,6 +1,6 @@
 // Generated by scripts/generate-interactive-capabilities.mjs; do not edit.
 // Source: openbitfun_product_domains::remote_surface (Product Operation Registry).
-export const REMOTE_SURFACE_REGISTRY_DIGEST = "fnv1a64:bbd47100ae85c396" as const;
+export const REMOTE_SURFACE_REGISTRY_DIGEST = "fnv1a64:ddf61f87bff00c48" as const;
 
 /**
  * Registered Tauri commands the Peer Device controller keeps on the controller
@@ -101,6 +101,7 @@ export const PEER_CONTROLLER_LOCAL_COMMANDS: ReadonlySet<string> = new Set([
   "install_pending_update",
   "install_update",
   "list_agent_companion_pets",
+  "load_agent_companion_pet_spritesheet",
   "load_insights_report",
   "local_file_download",
   "mark_openbitfun_control_surface_ready",
 
@@ -1,8 +1,7 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
-const { invoke, readFile } = vi.hoisted(() => ({ invoke: vi.fn(), readFile: vi.fn() }));
+const { invoke } = vi.hoisted(() => ({ invoke: vi.fn() }));
 vi.mock('@/infrastructure/api/service-api/ApiClient', () => ({ api: { invoke } }));
-vi.mock('@tauri-apps/plugin-fs', () => ({ readFile }));
 vi.mock('@/infrastructure/runtime', () => ({ isTauriRuntime: () => true }));
 
 import { resolveAgentCompanionPet } from './AgentCompanionPetService';
@@ -13,36 +12,57 @@ const legacy: AgentCompanionPetSelection = {
   spritesheetPath: '/pets/sample/spritesheet.webp', spritesheetMimeType: 'image/webp',
 };
 
+/**
+ * The host answers both the pet enumeration and the spritesheet read, so the
+ * mock dispatches by command instead of returning one fixed value.
+ */
+function mockHost(petsResponse: unknown): void {
+  invoke.mockImplementation((command: string) => {
+    if (command === 'list_agent_companion_pets') return Promise.resolve(petsResponse);
+    if (command === 'load_agent_companion_pet_spritesheet') {
+      return Promise.resolve(new Uint8Array([0]).buffer);
+    }
+    return Promise.reject(new Error(`unexpected command: ${command}`));
+  });
+}
+
+function invokedCommands(): string[] {
+  return invoke.mock.calls.map(([command]) => command as string);
+}
+
 describe('saved pet version recovery', () => {
   afterEach(() => vi.unstubAllGlobals());
   beforeEach(() => {
     vi.clearAllMocks();
-    readFile.mockResolvedValue(new Uint8Array([0]));
     vi.stubGlobal('URL', { createObjectURL: vi.fn(() => 'blob:pet'), revokeObjectURL: vi.fn() });
   });
 
   it('recovers v2 from an already imported package without writing settings', async () => {
-    invoke.mockResolvedValue({ pets: [{ ...legacy, spriteVersionNumber: 2 }] });
+    mockHost({ pets: [{ ...legacy, spriteVersionNumber: 2 }] });
     const resolved = await resolveAgentCompanionPet(legacy);
     expect(resolved.layout.rows).toBe(11);
-    expect(invoke.mock.calls).toEqual([['list_agent_companion_pets']]);
+    expect(invokedCommands()).toEqual([
+      'list_agent_companion_pets',
+      'load_agent_companion_pet_spritesheet',
+    ]);
     expect(legacy.spriteVersionNumber).toBeUndefined();
   });
 
   it('retains legacy manifests returned by an older host', async () => {
-    invoke.mockResolvedValue({ pets: [legacy] });
+    mockHost({ pets: [legacy] });
     expect((await resolveAgentCompanionPet(legacy)).layout.rows).toBe(9);
   });
 
   it('does not require package enumeration for explicit v1 or v2 selections', async () => {
+    mockHost({ pets: [legacy] });
     for (const version of [1, 2]) {
       expect((await resolveAgentCompanionPet({ ...legacy, spriteVersionNumber: version })).layout.version).toBe(version);
     }
-    expect(invoke).not.toHaveBeenCalled();
+    expect(invokedCommands()).not.toContain('list_agent_companion_pets');
   });
 
   it('retains an unavailable selection and reports failure instead of guessing v1', async () => {
-    invoke.mockResolvedValue({ pets: [] });
+    mockHost({ pets: [] });
     await expect(resolveAgentCompanionPet(legacy)).rejects.toThrow('unavailable');
     invoke.mockRejectedValue(new Error('Host unavailable'));
     await expect(resolveAgentCompanionPet(legacy)).rejects.toThrow('Host unavailable');