docs: integrate permanent point wallet into main

.project-docs/30-worklog/current-state.md

@@ -4,6 +4,17 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 ## Integrated Through
 
+- 2026-09-22：任务 `20260922-integrate-permanent-points-client-38f5b921` 经用户授权交接主目录登记，
+  将永久词元点数客户端源 `a1cce428afcca9b7e32ef043705a25a4685fbbdd` 从 `2f82b9f` 无冲突快进合入本地 `main`。
+  账号菜单改为个人余额、充值、订单及点数流水，移除会员、订阅、周额度与重置卡。
+  新注册一次赠送 100 点，存量账号不补送、不折算，1 元兑 50 点且永不过期；资格与入账均由服务端决定。
+  本人余额精确可见，另一付款方的钱包只显示可用性；AI 编程明确选择付款来源，云智能体创建者付费和 Plugin 个人付款保持。
+  Main 持有认证、固定账务路由及安全投影；模糊支付结果复用原请求身份，已有订单恢复不重新下单，只有服务端确认才显示到账。
+  主目录 103 项相关单测及 Renderer 类型检查通过；产品树与源一致，沿用源 scoped lint、Vite 全目标构建、Windows Electron 充值恢复与实际后端内存库契约验证。
+  源全量测试的 Pi v6/v7 旧断言、一次隔离复跑通过的时序失败及 67 项既有 Main 类型诊断保持记录，不宣称全量通过。
+  三份原有未跟踪文档保持；未推送、打包、安装或部署，真实支付与配套 API/0094 迁移仍须发布验收。
+  详见[集成记录](tasks/20260922-integrate-permanent-points-client-38f5b921.md)及[永久点数规则](../40-domain/business-rules.md#permanent-token-points)。下方旧会员/重置卡条目仅保留历史事实。
+
 - 2026-09-21：任务 `20260921-integrate-game-audio-client-a6c8f241` 集成 Game Audio
   产品源 `09e0ce5cf3d113b3bb7b128b2b04bc355d16173b` 与证据 HEAD
   `938c4b1ed306fa7a45241534cd44817c775cca13`，保留 `b5907e8` 主线的模型切换及项目重开修复。
@@ -979,6 +990,8 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 ## Current Focus
 
+账号现采用永久词元点数钱包：真实新注册一次赠送 100 点，存量权益取消且不补送、不折算，充值 1 元兑 50 点、永不过期。账号菜单提供本人余额、充值、订单恢复及流水；付款来源的精确/粗粒度展示与服务端资格保持一致。旧会员、订阅、周额度及重置卡入口已移除，当前规则见[永久点数规则](../40-domain/business-rules.md#permanent-token-points)。
+
 客户端面向非专业用户提供“选择目录创建交互式 AI 应用 → 直接进入聊天 → 按项目需要可选调用官方 bundled Project Scaffold Skill → 项目配置中一键提交 → Main 本地 npm/Vite 构建 → Electron 双视口预检最终产物 → 上传 source+built 双归档与 contract → 运营审核”的唯一创建者链路。普通新建不展示类型、模板、原始 UUID、绑定或独立副本选项；Renderer 写入内部默认 `interactive_ai_app`，Main 生成 UUID，并只创建 `.makelore/project.json` 与 `knowledge/`。有效旧配置仅缺 `projectId` 时由 Main 串行补齐；旧 `initialized` 仅保留兼容，不再阻断导航、聊天或首个 Agent。既有 `custom` 和历史类型继续兼容，但不作为普通新建选择。`makelore.project-scaffold` 不是创建前置条件，只负责不覆盖的固定起步树与只读发布准备度说明，不能安装、构建、上传、提审或批准；其 `.mjs` 只从签名客户端固定资源加载，Marketplace 下载 artifact 仍拒绝脚本。Main 对安全源码快照运行安装包内固定 npm 11.6.2 的 `npm ci --ignore-scripts`，再显式调用项目 `package-lock.json` 锁定的 Vite；Vite config/plugins 以当前桌面用户权限执行，因此只适用于用户信任的本地项目，不是 sandbox。预检由 Main 以临时 loopback origin 和 Electron WebContents/CDP 检查与最终 `built_archive` 相同的内存文件字节，覆盖桌面/移动视口、运行错误、白屏和外域访问；不使用 Playwright。该检查仍可由非官方客户端绕过，不产生可信 receipt，也不复刻生产 opaque-origin。服务端把源码、构建归档和 contract 视为不可信输入，逐字节重算与校验并固化不可变 Release；人工审核仍不可绕过。历史 `mini_game` / `mini_program` 只在读取边界归一为规范 `interactive_ai_app`。已发布作品优先使用安全投影后的 `play_url`，`runtime_url` 仅保留一个客户端版本的兼容回退。
 
 AI Design Canvas 现在以中央 conversation timeline 加唯一 active 制作方案、右侧 320–340 px 全高 Works rail 的两区布局服务创作者；Canvas 路由不挂载全局左栏，紧凑宽度把同一 Works rail 放进右侧 Sheet。Active 方案的 `content.concept` 直接作为可编辑“创作提示词”，类型、画幅、视频时长和数量保持紧凑直控；已提交、运行中或终止方案折叠进对话历史。Reference 使用稳定 reference ID、真实 Workspace Asset binding 与连续 `@图片N` alias；Prompt 是用途的唯一可见表达，binding row 只管理缩略图、文件、alias、替换与删除。未绑定 alias 提供定点上传并阻止 Quote，Prompt/reference/参数变更产生新 Specification revision 和新 immutable Quote。一个 Workspace 仍只公开一个 current Direction、一个 persistent Agent Session 和一个 Current Specification；conversation timeline 只记录交互历史。Chat、direct edits、decision responses、proposal acceptance、locks、Asset binding 与 restore 都通过 `design.input.apply` 进入同一服务端 reducer，Renderer drafts 在 accepted 前保持本地。Main 持有 Works Token、stream ticket、WebSocket、request deadline、stable command/operation IDs 与错误脱敏；unknown result 只能复用原 identity，结构化业务错误不得重放。Generation 由服务端对 exact Specification revision 编译 immutable Quote，客户端只展示 public output plan、warnings、expiry 与 Token Points，并以 Quote ID 调用 `design.generation.confirm`；Provider Prompt、model、route、storage 和 billing atoms 不进入 Renderer。Task/Asset events 独立收敛 Workspace resources，不改写 Living Form。Development 与 packaged builds 均使用 Works Square V2，V1 DTO、local semantic adapter、mutable Quote PATCH 与 editable provider Prompt 已移除。
@@ -1148,4 +1161,4 @@ Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选
 
 ## Last Updated
 
-2026-09-15
+2026-09-22

.project-docs/30-worklog/tasks/20260922-integrate-permanent-points-client-38f5b921.md

@@ -0,0 +1,57 @@
+# Task: Integrate permanent point wallet into MakeLore main
+
+## Identity
+
+- Task ID: 20260922-integrate-permanent-points-client-38f5b921
+- Mode: Integration
+- Branch: main
+- Worktree: D:\Datas\OthersProjects\makelore
+- Base commit: 2f82b9f79cf72873d75c17a48853292323aa5df5
+- Owner: codex
+- Status: Ready for Integration
+
+## Scope
+
+- Fast-forward MakeLore main from 2f82b9f to the completed permanent-point wallet source a1cce428afcca9b7e32ef043705a25a4685fbbdd, then promote its accepted account rules and Main-owned billing data flow into canonical project memory.
+
+## Intent And Constraints
+
+- User explicitly authorized handing off the completed 20260921-integrate-game-audio-client-a6c8f241 registration and merging a1cce42. Official release/start/status succeeded; this task owns primary main in integration mode with the integration lock.
+- Preserve the three pre-existing untracked package-122, package-123 and client-hang-diagnosis task documents exactly; their approved adopted states remain outside this commit. Source task records and other worktrees are read-only.
+- Concurrent Task Gate and Planning Gate Passed. Read entry/own task, memory index, positioning, current state, decisions/auth ADR, architecture/module/data-flow, domain/glossary/success criteria and relevant evidence/reflection/commitment/stale context. Canonical memory is unchanged from the source base; reuse the source task's prior context and inspect the account sections being promoted.
+- Assessed 122 peer scopes, intents and promotion candidates. Historical undefined scopes remain unknown/read-only. The isolated coding-teacher task may overlap Sidebar/README but does not contradict the wallet behavior; preserve that task for its later integration. Old membership/reset-card policy is superseded by the user's explicit accepted change.
+- Confirmed policy: genuine registration 100 points once, no old-account gift/conversion, CNY 1 = 50 permanent points, parent recharges only their own wallet, youth own balance exact and another payer's balance coarse. Explicit AI-programming funding selection, cloud creator-pays and Plugin personal-payer boundaries remain.
+- Preserve Code/Canvas/Robot/cloud Agents, Main-owned authentication and existing module restrictions. No subagents, push, packaging, installation, deployment or real payment. Merge consent does not authorize worktree removal.
+
+## Plan
+
+1. Fast-forward the verified source into main without altering product files or source records.
+2. Replace superseded account rules and architecture descriptions, recording the exact source under Integrated Through.
+3. Verify source parity, focused tests and Renderer typecheck in primary; reuse unchanged-source lint/build/Electron and baseline evidence where applicable.
+4. Record the result, run the official documentation gate, commit integration documentation and complete task registration. Offer eligible source worktree cleanup separately.
+
+## Outcome
+
+- Fast-forwarded main from 2f82b9f79cf72873d75c17a48853292323aa5df5 to a1cce428afcca9b7e32ef043705a25a4685fbbdd with no conflicts. Product files and the imported source task record are unchanged from that source.
+- Promoted the user-confirmed permanent-point policy into current-state, business-rules and decision-index; replaced obsolete membership/reset-card descriptions in system-overview, module-map and data-flow. Recorded actual source provenance under Integrated Through; historical task records remain intact.
+- Official drift validation confirms the three adopted foreign task documents remain at their approved original states. They remain untracked and excluded from the integration commit.
+- Source worktree remains clean, managed and ready_for_integration, with its latest a1cce42 included in main. Only that just-integrated source is eligible for the required separate cleanup offer; primary and other task worktrees are retained.
+- Local merge only: no push, packaging, installation, deployment, real payment or subagent use.
+
+## Verification
+
+- In primary main after the merge: 8 focused files / 103 tests passed; pnpm run typecheck passed (Renderer). These cover billing auth/capability/privacy, stable payment intent, pending/review order recovery, frozen prices, own/family/youth balance contracts, account switching, menu refresh and retained Works routes.
+- Product parity: git diff a1cce42 -- src electron shared tests README.md package.json pnpm-lock.yaml was empty. The integration changed only canonical documentation and this task record; source record provenance is preserved.
+- Reused the identical source's passing scoped ESLint, Vite Renderer/Main/Preload/utility build, Windows Electron wallet E2E and actual backend in-memory API contract acceptance. The Electron flow verifies zero balance, original pending-order recovery after reload/repricing, exactly one POST and server-confirmed credit/ledger; it is not a real payment.
+- Source limitations remain: full suite had the unchanged Pi runtime-v6 assertion against runtime-v7 and a timing failure that passed in isolation; extended Main typecheck has the same 67 baseline diagnostics, with no added/removed diagnostics. No claim that all repository tests or Main type checks pass.
+- Reviewed source-to-main diff and canonical rule changes; git diff --check and official task-aware check_doc_drift passed before the final documentation commit.
+
+## Follow-ups
+
+- Source checkout cleanup awaiting explicit confirmation: task 20260922-permanent-points-client-7f4c9a2e at D:\Datas\OthersProjects\.codex-worktrees\makelore\20260922-permanent-points-client-7f4c9a2e, branch codex/20260922-permanent-points-client-7f4c9a2e-permanent-points-client. If approved, use official retire from primary; preserve the branch/commit. Merge/handoff consent does not cover removal. No response keeps the worktree and does not block the completed merge.
+- Before release, deploy matching Works Square permanent-points API / 0094 migration and verify genuine registration, actual payment callbacks and configured desktop payment payload. PostgreSQL upgrade/concurrency and non-Windows packaged acceptance remain release work.
+- Track the existing Pi v6/v7 test assertion and Main typecheck baseline independently.
+
+## Promotion Candidates
+
+- Accepted source promotions were applied to current-state, business-rules, decision-index, system-overview, module-map and data-flow under this integration lock. No unresolved semantic conflict or additional product decision remains.