merge: integrate remote project scaffold updates

.project-docs/30-worklog/current-state.md

@@ -36,6 +36,48 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
   tests, typecheck, full unit 1,844 with 3 skips plus pressure 1/1, production build,
   targeted Electron 8/8, and full Electron 33/33 with 1 platform skip. Lint reported
   0 errors and only existing warnings in current source and a historical worktree.
+- Unified Plugin workspace bundled-delivery fix source
+  `6bd9287c879dca93da11e17533f84e3535fc656a` from task
+  `20260905-plugin-download-action-6c8e4a21` is integrated onto local `main` as
+  `6d102b2`. Code-owned bundled official Plugins, including
+  `makelore.project-scaffold`, now show `随应用提供` when no device-package record
+  exists instead of falsely showing `未下载官方包`. This is presentation-only:
+  bundled Plugins still have no device download/update/uninstall flow, and the existing
+  server-authoritative `免费获取` action remains required before project enablement.
+  Focused Plugin tests, typecheck, scoped lint, and all Vite targets passed; the ordinary
+  full unit run had one unrelated Pi real-process two-second timing miss among 1,887
+  passing tests and 2 skips, and that exact test passed 6/6 in isolation with the
+  pressure suite passing 1/1. The production Marketplace currently returns
+  `404 plugin_not_found` for Project Scaffold and still requires deployment of the
+  current server plus migration through `20260904_project_scaffold_0085`; no deployment
+  or production database change is claimed here.
+- Interactive AI application source `959b633` and official Marketplace packaging
+  source `ddb678b46ff10a28e04beeafcfc00c8c8a23ff9f` are integrated through merges
+  `4bc3e0ea5331a7d3f3576768c0119c02c0f0f952` and
+  `2bc3e4420852388ce46841e05c1cbf49e80b250c`, then canonically reconciled by tasks
+  `20260904-reconcile-project-scaffold-f7b4d2a9` and
+  `20260904-project-scaffold-integration-client-4f2a8c71`; verified integration head
+  `b92e7ba5bbde186626d93787ca358fbf4c2523a3` was landed on local `main` by task
+  `20260904-project-scaffold-main-merge-e7b4c291`. New projects use one
+  `interactive_ai_app` / “交互式 AI 应用” type or `custom`; historical `mini_game`
+  and `mini_program` values normalize at the read boundary without a batch rewrite.
+  Project creation owns only `.makelore/project.json` and `knowledge/`. The official
+  code-owned bundled Marketplace Plugin `makelore.project-scaffold` version `1.0.0`
+  provides the explicit `makelore-project-scaffold` Skill, a non-overwriting fixed
+  six-file Vite starter, and read-only publication-readiness guidance; it does not
+  install, build, upload, submit, or approve. Its `.mjs` uses the non-overridable
+  application Node exposed as `MAKELORE_NODE_EXECUTABLE` and is executable only because
+  it ships in the fixed signed-client resource root. Downloadable Marketplace artifacts
+  remain text/image-only and reject `.mjs`; acquisition, project enablement, Agent
+  assignment, and immutable bundled Release/Admission remain distinct. Main and Works
+  Square retain build, preflight, artifact,
+  upload, immutable Release, and review authority. Exact integration verification passed
+  the 12-test scaffold suite, 123 focused Vitest tests, typecheck, scoped ESLint, and the
+  Renderer/Main/Preload/utility Vite build. Source evidence additionally includes the
+  project-configuration Electron flow, real scaffold-to-locked-Vite build, plugin/Skill
+  validation and bundled resource loading. A packaged-app smoke plus installed Windows,
+  signed macOS, and native Linux proof remain pending; no live Marketplace migration,
+  production upload, approval, deployment, or remote push is claimed.
 - AI Design streamed-reply diagnosis
   `229b1b1ce39b7f1541a93ea3c980ab82b6d6266c` and client fix
   `23f96a523eb37d8397bb3766ce95a59d56e59225` from tasks
@@ -621,7 +663,7 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 ## Current Focus
 
-客户端面向非专业用户提供“创建小游戏或小程序 → 项目配置中一键提交 → Main 本地 npm/Vite 构建 → Electron 双视口预检最终产物 → 上传 source+built 双归档与 contract → 运营审核”的唯一创建者链路。Main 对安全源码快照运行安装包内固定 npm 11.6.2 的 `npm ci --ignore-scripts`，再显式调用项目 `package-lock.json` 锁定的 Vite；Vite config/plugins 以当前桌面用户权限执行，因此只适用于用户信任的本地项目，不是 sandbox。预检由 Main 以临时 loopback origin 和 Electron WebContents/CDP 检查与最终 `built_archive` 相同的内存文件字节，覆盖桌面/移动视口、运行错误、白屏和外域访问；不使用 Playwright。该检查仍可由非官方客户端绕过，不产生可信 receipt，也不复刻生产 opaque-origin。服务端不再替客户端运行项目 Vite，而是把源码、构建归档和 contract 视为不可信输入，逐字节重算与校验并固化不可变 Release；人工审核仍不可绕过。自定义和缺少类型字段的旧项目不提供该入口。已发布作品优先使用安全投影后的 `play_url`，`runtime_url` 仅保留一个客户端版本的兼容回退。
+客户端面向非专业用户提供“创建交互式 AI 应用 → 明确调用官方 bundled Project Scaffold Skill 生成起步文件 → 项目配置中一键提交 → Main 本地 npm/Vite 构建 → Electron 双视口预检最终产物 → 上传 source+built 双归档与 contract → 运营审核”的唯一创建者链路。项目创建只生成 `.makelore/project.json` 和 `knowledge/`；`makelore.project-scaffold` 只负责不覆盖的固定起步树与只读发布准备度说明，不能安装、构建、上传、提审或批准。其 `.mjs` 只从签名客户端固定资源加载，Marketplace 下载 artifact 仍拒绝脚本。Main 对安全源码快照运行安装包内固定 npm 11.6.2 的 `npm ci --ignore-scripts`，再显式调用项目 `package-lock.json` 锁定的 Vite；Vite config/plugins 以当前桌面用户权限执行，因此只适用于用户信任的本地项目，不是 sandbox。预检由 Main 以临时 loopback origin 和 Electron WebContents/CDP 检查与最终 `built_archive` 相同的内存文件字节，覆盖桌面/移动视口、运行错误、白屏和外域访问；不使用 Playwright。该检查仍可由非官方客户端绕过，不产生可信 receipt，也不复刻生产 opaque-origin。服务端不再替客户端运行项目 Vite，而是把源码、构建归档和 contract 视为不可信输入，逐字节重算与校验并固化不可变 Release；人工审核仍不可绕过。`custom` 和缺少类型字段的旧项目不提供该入口；历史 `mini_game` / `mini_program` 只在读取边界归一为规范 `interactive_ai_app`。已发布作品优先使用安全投影后的 `play_url`，`runtime_url` 仅保留一个客户端版本的兼容回退。
 
 AI Design Canvas 现在默认以对话和一张持续可见的“我的创作”卡服务 8-16 岁创作者；专业字段矩阵收进按需打开的“精细调整”，移动端保持对话优先并只挂载一个卡片/底部面板。Creation Card、精细调整、Quote、Task 与结果提示都只投影权威状态，已知问题按 code 转成通俗中文，未知服务端或 Provider 文本不会直接显示。一个 Workspace 仍只公开一个 current Direction、一个 persistent Agent Session 和一个 Current Specification；conversation timeline 只记录交互历史。Chat、direct edits、decision responses、proposal acceptance、locks、Asset binding 与 restore 都通过 `design.input.apply` 进入同一服务端 reducer，Renderer drafts 在 accepted 前保持本地。Main 持有 Works Token、stream ticket、WebSocket、request deadline、stable command/operation IDs 与错误脱敏；unknown result 只能复用原 identity，结构化业务错误不得重放。Generation 由服务端对 exact Specification revision 编译 immutable Quote，客户端只展示 public output plan、warnings、expiry 与 Token Points，并以 Quote ID 调用 `design.generation.confirm`；Provider Prompt、model、route、storage 和 billing atoms 不进入 Renderer。Task/Asset events 独立收敛 Workspace resources，不改写 Living Form。Development 与 packaged builds 均使用 Works Square V2，V1 DTO、local semantic adapter、mutable Quote PATCH 与 editable provider Prompt 已移除。
 
@@ -740,7 +782,7 @@ Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选
 
 ## In Progress
 
-- 成组集成服务端 source+built+contract 校验、OSS immutable Release、CDN/Edge 与 App 消费链后，使用真实账号和生产配置执行客户端提交到作品播放的整链验收。
+- 先部署支持规范 `interactive_ai_app` 与历史别名的服务端，再安装匹配客户端；随后成组验证显式 Scaffold Skill、source+built+contract 校验、OSS immutable Release、运营审核、CDN/Edge 与 App 消费链。
 
 ## Next Recommended Steps
 
@@ -765,7 +807,7 @@ Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选
 - `/api/works/projects/publish-source` 必须在读取凭据和项目文件前校验 Renderer capability；Host token/base 不能替代该 UI 边界。
 - `works-cloud-deploy.json` 仅是已安装数据的兼容文件名，不代表客户端仍拥有自动部署协调器；旧中间态不得恢复为后台任务。
 - 刷新凭据、发布 Token、ZIP、幂等键和重试只能由 Electron Main 持有。
-- 本地 `projectType` 只决定产品分流和模板选择，不得作为授权依据或替代 Main/服务端的包体校验。
+- 本地 `projectType` 只决定产品分流和显式 Scaffold Skill 选择，Skill 的静态检测也只提供准备度证据；两者都不得作为授权依据或替代 Main/服务端的构建、包体校验和审核。
 - 本地构建必须使用安装版 Electron Node、固定 npm 11.6.2 和项目 `package-lock.json` 锁定的 Vite，不得回退到全局 PATH、已有 `node_modules` 或未验证的 npm 闭包；依赖安装需要网络。
 - 项目 Vite config/plugins 以桌面用户权限执行，不能称为 sandbox；此风险边界必须在发布说明中保留。
 - AI Design 的 Current Specification 是唯一语义权威。Direction events 必须按 Workspace/Direction/revision/operation identity 收敛；assistant delta、event cursor、Task progress 和 Asset updates 不得改写 Living Form。

.project-docs/30-worklog/task-history.md

@@ -4,6 +4,9 @@
 
 | Date | Task | Outcome | Docs Updated |
 |---|---|---|---|
+| 2026-09-04 | Land official Project Scaffold Plugin on local main | Fast-forwarded verified integration head `b92e7ba` onto local `main` while preserving three explicitly adopted historical task documents unchanged; no package, publication, deployment, or push was performed | current-state, landing task |
+| 2026-09-04 | Official Marketplace Project Scaffold integration | 将 `makelore.project-scaffold` 作为代码所有、随签名客户端交付的 bundled `skill_only` Plugin 接入 Account Library/项目启用/Agent 分配；官方 `.mjs` 不经过下载 artifact，下载包仍保持文本/图片 P0 限制 | ADR-008、current-state、architecture、domain、success criteria、integration task |
+| 2026-09-04 | 交互式 AI 应用与显式 Scaffold Skill 集成 | 合并小游戏/小程序为规范 `interactive_ai_app`，项目创建保持最小边界，独立 Skill 生成固定起步树并说明发布要求；Main/Works 继续拥有发布权威 | ADR-008、current-state、architecture、domain、commitments |
 | 2026-08-07 | 客户端登录七天滑动续期 | Main-owned 刷新凭据与真实活动续期 | README、current-state |
 | 2026-08-08 | Makelore 一键提交审核 | 项目配置单入口，Main 安全打包与幂等提交 | README、architecture、domain |
 | 2026-08-08 | 项目真机预览 | 待审 Owner preview 与精确已发布 Runtime | README、architecture、domain |

.project-docs/30-worklog/tasks/20260904-project-scaffold-main-merge-e7b4c291.md

@@ -0,0 +1,42 @@
+# Task: Land official project scaffold plugin on main
+
+## Identity
+
+- Task ID: 20260904-project-scaffold-main-merge-e7b4c291
+- Mode: Integration
+- Branch: main
+- Worktree: D:\Datas\OthersProjects\makelore
+- Base commit: 336e0bb0caf24537b7b0f350aba3e04a37f5544c
+- Owner: codex
+- Status: Ready for Integration
+
+## Scope
+
+- Fast-forward the verified integration commit `b92e7ba5bbde186626d93787ca358fbf4c2523a3` onto local `main`.
+- Record final default-branch landing evidence while preserving the three explicitly adopted historical task documents unchanged and uncommitted.
+
+## Intent And Constraints
+
+- Preserve the accepted official bundled-plugin boundary: only the fixed code-owned resource root may execute `scaffold.mjs`; downloadable Marketplace artifacts continue to reject scripts.
+- Preserve normal ancestry and do not package, publish, deploy, push, or alter the adopted historical task documents.
+
+## Outcome
+
+- Fast-forwarded local `main` from `336e0bb0caf24537b7b0f350aba3e04a37f5544c` to verified integration head `b92e7ba5bbde186626d93787ca358fbf4c2523a3`.
+- Local `main` now contains the unified `interactive_ai_app` type and the official bundled Marketplace Plugin `makelore.project-scaffold`, including its Skill, templates, publication guidance, and `scaffold.mjs`.
+- Preserved the three explicitly adopted historical task documents byte-for-byte and left them uncommitted.
+- Excluded the completed source integration task record from the final default-branch tree; it remains reachable on its preserved source branch and commit.
+
+## Verification
+
+- The fast-forward completed without conflicts and `b92e7ba5bbde186626d93787ca358fbf4c2523a3` is an ancestor of local `main`.
+- The exact landed integration head had already passed Plugin and Skill validators, 88 focused Vitest tests, 12 scaffold Node tests, TypeScript typecheck, Git whitespace checks, and project-document gates.
+- The task-aware drift check passed while confirming all adopted historical documents remained unchanged.
+
+## Follow-ups
+
+- Packaging, installed-client smoke, live Marketplace publication, deployment, and remote push remain separate authorized operations.
+
+## Promotion Candidates
+
+- None. This task landed the already accepted and verified integration result.

.project-docs/30-worklog/tasks/20260905-plugin-bundled-status-integration-8f2c5a41.md

@@ -0,0 +1,60 @@
+# Task: Integrate bundled official Plugin device-status fix
+
+## Identity
+
+- Task ID: 20260905-plugin-bundled-status-integration-8f2c5a41
+- Mode: Integration
+- Branch: main
+- Worktree: D:\Datas\OthersProjects\makelore
+- Base commit: 9ed9bf4a715e300420e7a764a4cf576a6dfc4938
+- Owner: codex-root
+- Status: Ready for Integration
+
+## Scope
+
+- Integrate feature commit `6bd9287c879dca93da11e17533f84e3535fc656a`
+  onto local `main` from its exact parent `9ed9bf4a715e300420e7a764a4cf576a6dfc4938`.
+- Reconcile the source outcome into current state and remove only the duplicate source
+  task record from the default-branch checkpoint.
+
+## Intent And Constraints
+
+- Concurrent Task Gate: Passed after releasing the completed prior integration lock and
+  claiming this exact root/main worktree in Integration mode.
+- Planning Gate: Passed after reading the source task outcome, ADR-008, current Plugin
+  architecture/business rules, current state, and the prior scaffold landing record.
+- Preserve the three explicitly adopted historical task records byte-for-byte and
+  uncommitted; do not stash, reset, clean, move, or delete them.
+- Preserve the accepted boundary: Project Scaffold ships in the signed client, has no
+  device download action, and still requires server-authoritative free account
+  acquisition before project enablement.
+
+## Outcome
+
+- Cherry-picked feature source `6bd9287c879dca93da11e17533f84e3535fc656a`
+  onto local `main` as product commit `6d102b2` without conflict.
+- Removed only the duplicate source task record from the default-branch documentation
+  checkpoint; it remains intact on the source branch and commit.
+- Updated current state with the accepted presentation correction and the separate
+  production server deployment/migration requirement.
+- Preserved all three adopted historical task records byte-for-byte and uncommitted.
+
+## Verification
+
+- Source evidence: focused Plugin page/model 35 passed; typecheck and scoped ESLint
+  passed; all Vite targets passed; isolated Pi timing rerun 6/6 and pressure 1/1 passed.
+- Source commit and landed product commit have the exact same tree
+  `1976d2f27f239dead6d26f99131182c7c657a9db`.
+- Root replay was not claimed because the root checkout has no installed Vitest or
+  TypeScript executables; no dependency mutation was performed there.
+- Local server evidence remains separate: Project Scaffold Marketplace tests 2/2 and
+  sole migration head `20260904_project_scaffold_0085`.
+
+## Follow-ups
+
+- Deploy the current Works Square server and migrate production through 0085 so the
+  public catalog can authorize and expose `免费获取`.
+
+## Promotion Candidates
+
+- None recorded.