feat: Pipeline Settings M4 — generation history list + per-step I/O drill-down (v0.26.0)

CEO ask #5 complete: browsable paginated run list + full input/output inspection
per pipeline stage.

## What was built

### Generations list (prautoblogger-gen-history)
Hidden admin page (options.php-parent, priority 14) showing all pipeline runs newest
first, 20 per page. Each row: article title (linked to dossier when a post exists),
start date, status chip, distinct model(s), settled cost, duration. Queries bounded
(LIMIT/OFFSET) — no unbounded SELECT *.

New files:
- includes/admin/class-gen-history-query.php — paginated run list + per-run I/O queries
- includes/admin/class-gen-history-page.php  — hidden admin page + asset enqueue
- assets/css/gen-history.css, assets/js/gen-history.js — table + drill-down UI
- templates/admin/gen-history-page.php       — HTML template

### Per-step input + output drill-down (Stage I/O)
'Stage I/O' toggle opens an AJAX-loaded inline panel. For each generation_log stage:
  - input_system: system-role message content from generation_log.request_json
  - input_user: last user-role message from request_json (rendered instruction)
  - output: model response from run_stages.meta_json.output
  - output_pruned: true when meta_json present but output key absent (retention prune)

New AJAX endpoint: prautoblogger_gen_run_io (manage_options + nonce)
New file: includes/ajax/class-gen-run-io-handler.php

### gen-log INPUT/OUTPUT coverage verified
- INPUT: generation_log.request_json stores the chat body WITHOUT the Authorization
  header (Request_Recorder captures body after build_body(), before headers are added).
  System + user message content extracted and surfaced.
- OUTPUT: run_stages.meta_json.output is the LLM response text (Run_Stage_State::done()).
  Image/log-only stages (image_a, image_b, llm_research, image_prompt_rewrite) have no
  run_stages row; output is null, NOT pruned. Pruned outputs are flagged honestly.

### Dossier as entry point
Runs with a linked post show a 'Dossier' button deep-linking into the existing dossier
(which renders full per-stage I/O with editorial context). Stage I/O is complementary —
works for failed/orphan runs and provides the same data in a lighter inline UI.

### Stage-list-driven
Stage labels via Stage_Display_Map::label() — Phase 2b curate/seo appear automatically.

### Dead prautoblogger_pipeline_history endpoint
Not dead — it IS used by pipeline-settings.js for prompt version history (M3 feature).
Left in place. No dangling endpoint.

## M3 P2 sweep
- Removed dead data-preview-nonce and data-diff-nonce HTML attrs from
  pipeline-settings-prompt-panel.php (JS uses prabPipeline.*Nonce from
  wp_localize_script, not data-* attrs — confirmed by grep).
- Removed 3 redundant wp_create_nonce() calls from class-pipeline-settings-renderer.php
  (preview_nonce, history_nonce, diff_nonce keys that fed the now-removed dead attrs).
- Updated CONTEXT.md: added M3 + M4 terminology tables.
- Updated ARCHITECTURE.md: added ajax/ section to file tree; M3/M4 design notes.
- Updated INFORMATION-ARCHITECTURE.md: prautoblogger-gen-history entry.

## Security
- manage_options cap + prautoblogger_gen_run_io nonce on the AJAX endpoint.
- All output esc_html()/esc_url() server-side before JSON-encoding.
- JS renders prompt/response text via textContent — never innerHTML.
- No writes from history UI; request_json never contains auth headers.

## Version: v0.25.0 → v0.26.0

Agent-Session: pipeline-settings-m4

ARCHITECTURE.md

@@ -165,7 +165,15 @@ prautoblogger/
 │   │   ├── class-metrics-page.php     # Admin page for cost dashboard and content scores
 │   │   ├── class-ideas-browser.php    # Browse all analysis results (article ideas)
 │   │   ├── class-review-queue.php     # Approve/edit/reject queue for generated drafts
-│   │   └── class-log-viewer.php       # Activity log viewer with level filtering
+│   │   ├── class-log-viewer.php       # Activity log viewer with level filtering
+│   │   ├── class-gen-history-page.php # M4: Generation History hidden page (options.php parent, priority 14)
+│   │   └── class-gen-history-query.php # M4: Paginated run list + per-run I/O extraction queries
+│   │
+│   ├── ajax/
+│   │   ├── class-model-registry-refresh.php # AJAX: refresh OpenRouter model registry (manual trigger)
+│   │   ├── class-pipeline-preview-handler.php # M3: assembled-instructions preview from last-run gen_log (v0.25.0)
+│   │   ├── class-pipeline-history-handler.php # M3: prompt version list + LCS diff (history + diff actions) (v0.25.0)
+│   │   └── class-gen-run-io-handler.php # M4: per-run stage I/O drill-down (prautoblogger_gen_run_io) (v0.26.0)
 │   │
 │   ├── core/
 │   │   ├── class-scheduler.php        # WP-Cron / Action Scheduler job management
@@ -924,6 +932,30 @@ an LCS-based inline diff (added/removed/context/omitted lines, 3-line context wi
 keys validated against `Step_Map::allowed_prompt_keys()`. Preview returned as `esc_html`
 server-side; diff text inserted via `textContent` (not innerHTML) in JS.
 
+**M4 (v0.26.0 — Generation History: run list + per-step I/O drill-down):**
+A new hidden admin page (`prautoblogger-gen-history`) lists all pipeline runs newest-first
+(20 per page). Each row links to the Article Dossier (for runs with a linked post) and
+exposes a "Stage I/O" toggle. The toggle opens an inline AJAX-loaded panel showing every
+generation_log stage's full INPUT (system + user message content from `request_json`) and
+OUTPUT (model response from `run_stages.meta_json.output`). Log-only stages (image_a, image_b,
+llm_research, image_prompt_rewrite) have no run_stages row; their output is reported as null
+(not pruned). Pruned outputs (meta_json present, output key absent) are flagged explicitly.
+Stage labels come from `Stage_Display_Map::label()` — Phase 2b stages appear automatically.
+
+**M4 new files:** `admin/class-gen-history-query.php`, `admin/class-gen-history-page.php`,
+`ajax/class-gen-run-io-handler.php`, `templates/admin/gen-history-page.php`,
+`assets/css/gen-history.css`, `assets/js/gen-history.js`.
+
+**Security (M4):** `prautoblogger-gen-history` page requires `manage_options`. The
+`prautoblogger_gen_run_io` AJAX action requires `manage_options` + nonce
+(`prautoblogger_gen_run_io`). All output escaped via `esc_html()`/`esc_url()` server-side;
+JS renders prompt/response text via `textContent` (never `innerHTML`). Read-only — no writes.
+
+**M3 P2 sweep (v0.26.0):** Removed dead `data-preview-nonce` and `data-diff-nonce` HTML
+attributes from `pipeline-settings-prompt-panel.php`. The JS reads nonces from
+`prabPipeline.*Nonce` (via `wp_localize_script`), not from `data-*` attrs. Removed 3
+redundant `wp_create_nonce()` calls from the renderer.
+
 
 ---