merge: integrate remote project scaffold updates

.project-docs/30-worklog/current-state.md

@@ -36,6 +36,48 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
   tests, typecheck, full unit 1,844 with 3 skips plus pressure 1/1, production build,
   targeted Electron 8/8, and full Electron 33/33 with 1 platform skip. Lint reported
   0 errors and only existing warnings in current source and a historical worktree.
+- Unified Plugin workspace bundled-delivery fix source
+  `6bd9287c879dca93da11e17533f84e3535fc656a` from task
+  `20260905-plugin-download-action-6c8e4a21` is integrated onto local `main` as
+  `6d102b2`. Code-owned bundled official Plugins, including
+  `makelore.project-scaffold`, now show `随应用提供` when no device-package record
+  exists instead of falsely showing `未下载官方包`. This is presentation-only:
+  bundled Plugins still have no device download/update/uninstall flow, and the existing
+  server-authoritative `免费获取` action remains required before project enablement.
+  Focused Plugin tests, typecheck, scoped lint, and all Vite targets passed; the ordinary
+  full unit run had one unrelated Pi real-process two-second timing miss among 1,887
+  passing tests and 2 skips, and that exact test passed 6/6 in isolation with the
+  pressure suite passing 1/1. The production Marketplace currently returns
+  `404 plugin_not_found` for Project Scaffold and still requires deployment of the
+  current server plus migration through `20260904_project_scaffold_0085`; no deployment
+  or production database change is claimed here.
+- Interactive AI application source `959b633` and official Marketplace packaging
+  source `ddb678b46ff10a28e04beeafcfc00c8c8a23ff9f` are integrated through merges
+  `4bc3e0ea5331a7d3f3576768c0119c02c0f0f952` and
+  `2bc3e4420852388ce46841e05c1cbf49e80b250c`, then canonically reconciled by tasks
+  `20260904-reconcile-project-scaffold-f7b4d2a9` and
+  `20260904-project-scaffold-integration-client-4f2a8c71`; verified integration head
+  `b92e7ba5bbde186626d93787ca358fbf4c2523a3` was landed on local `main` by task
+  `20260904-project-scaffold-main-merge-e7b4c291`. New projects use one
+  `interactive_ai_app` / “交互式 AI 应用” type or `custom`; historical `mini_game`
+  and `mini_program` values normalize at the read boundary without a batch rewrite.
+  Project creation owns only `.makelore/project.json` and `knowledge/`. The official
+  code-owned bundled Marketplace Plugin `makelore.project-scaffold` version `1.0.0`
+  provides the explicit `makelore-project-scaffold` Skill, a non-overwriting fixed
+  six-file Vite starter, and read-only publication-readiness guidance; it does not
+  install, build, upload, submit, or approve. Its `.mjs` uses the non-overridable
+  application Node exposed as `MAKELORE_NODE_EXECUTABLE` and is executable only because
+  it ships in the fixed signed-client resource root. Downloadable Marketplace artifacts
+  remain text/image-only and reject `.mjs`; acquisition, project enablement, Agent
+  assignment, and immutable bundled Release/Admission remain distinct. Main and Works
+  Square retain build, preflight, artifact,
+  upload, immutable Release, and review authority. Exact integration verification passed
+  the 12-test scaffold suite, 123 focused Vitest tests, typecheck, scoped ESLint, and the
+  Renderer/Main/Preload/utility Vite build. Source evidence additionally includes the
+  project-configuration Electron flow, real scaffold-to-locked-Vite build, plugin/Skill
+  validation and bundled resource loading. A packaged-app smoke plus installed Windows,
+  signed macOS, and native Linux proof remain pending; no live Marketplace migration,
+  production upload, approval, deployment, or remote push is claimed.
 - AI Design streamed-reply diagnosis
   `229b1b1ce39b7f1541a93ea3c980ab82b6d6266c` and client fix
   `23f96a523eb37d8397bb3766ce95a59d56e59225` from tasks
@@ -621,7 +663,7 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 ## Current Focus
 
-客户端面向非专业用户提供“创建小游戏或小程序 → 项目配置中一键提交 → Main 本地 npm/Vite 构建 → Electron 双视口预检最终产物 → 上传 source+built 双归档与 contract → 运营审核”的唯一创建者链路。Main 对安全源码快照运行安装包内固定 npm 11.6.2 的 `npm ci --ignore-scripts`，再显式调用项目 `package-lock.json` 锁定的 Vite；Vite config/plugins 以当前桌面用户权限执行，因此只适用于用户信任的本地项目，不是 sandbox。预检由 Main 以临时 loopback origin 和 Electron WebContents/CDP 检查与最终 `built_archive` 相同的内存文件字节，覆盖桌面/移动视口、运行错误、白屏和外域访问；不使用 Playwright。该检查仍可由非官方客户端绕过，不产生可信 receipt，也不复刻生产 opaque-origin。服务端不再替客户端运行项目 Vite，而是把源码、构建归档和 contract 视为不可信输入，逐字节重算与校验并固化不可变 Release；人工审核仍不可绕过。自定义和缺少类型字段的旧项目不提供该入口。已发布作品优先使用安全投影后的 `play_url`，`runtime_url` 仅保留一个客户端版本的兼容回退。
+客户端面向非专业用户提供“创建交互式 AI 应用 → 明确调用官方 bundled Project Scaffold Skill 生成起步文件 → 项目配置中一键提交 → Main 本地 npm/Vite 构建 → Electron 双视口预检最终产物 → 上传 source+built 双归档与 contract → 运营审核”的唯一创建者链路。项目创建只生成 `.makelore/project.json` 和 `knowledge/`；`makelore.project-scaffold` 只负责不覆盖的固定起步树与只读发布准备度说明，不能安装、构建、上传、提审或批准。其 `.mjs` 只从签名客户端固定资源加载，Marketplace 下载 artifact 仍拒绝脚本。Main 对安全源码快照运行安装包内固定 npm 11.6.2 的 `npm ci --ignore-scripts`，再显式调用项目 `package-lock.json` 锁定的 Vite；Vite config/plugins 以当前桌面用户权限执行，因此只适用于用户信任的本地项目，不是 sandbox。预检由 Main 以临时 loopback origin 和 Electron WebContents/CDP 检查与最终 `built_archive` 相同的内存文件字节，覆盖桌面/移动视口、运行错误、白屏和外域访问；不使用 Playwright。该检查仍可由非官方客户端绕过，不产生可信 receipt，也不复刻生产 opaque-origin。服务端不再替客户端运行项目 Vite，而是把源码、构建归档和 contract 视为不可信输入，逐字节重算与校验并固化不可变 Release；人工审核仍不可绕过。`custom` 和缺少类型字段的旧项目不提供该入口；历史 `mini_game` / `mini_program` 只在读取边界归一为规范 `interactive_ai_app`。已发布作品优先使用安全投影后的 `play_url`，`runtime_url` 仅保留一个客户端版本的兼容回退。
 
 AI Design Canvas 现在默认以对话和一张持续可见的“我的创作”卡服务 8-16 岁创作者；专业字段矩阵收进按需打开的“精细调整”，移动端保持对话优先并只挂载一个卡片/底部面板。Creation Card、精细调整、Quote、Task 与结果提示都只投影权威状态，已知问题按 code 转成通俗中文，未知服务端或 Provider 文本不会直接显示。一个 Workspace 仍只公开一个 current Direction、一个 persistent Agent Session 和一个 Current Specification；conversation timeline 只记录交互历史。Chat、direct edits、decision responses、proposal acceptance、locks、Asset binding 与 restore 都通过 `design.input.apply` 进入同一服务端 reducer，Renderer drafts 在 accepted 前保持本地。Main 持有 Works Token、stream ticket、WebSocket、request deadline、stable command/operation IDs 与错误脱敏；unknown result 只能复用原 identity，结构化业务错误不得重放。Generation 由服务端对 exact Specification revision 编译 immutable Quote，客户端只展示 public output plan、warnings、expiry 与 Token Points，并以 Quote ID 调用 `design.generation.confirm`；Provider Prompt、model、route、storage 和 billing atoms 不进入 Renderer。Task/Asset events 独立收敛 Workspace resources，不改写 Living Form。Development 与 packaged builds 均使用 Works Square V2，V1 DTO、local semantic adapter、mutable Quote PATCH 与 editable provider Prompt 已移除。
 
@@ -740,7 +782,7 @@ Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选
 
 ## In Progress
 
-- 成组集成服务端 source+built+contract 校验、OSS immutable Release、CDN/Edge 与 App 消费链后，使用真实账号和生产配置执行客户端提交到作品播放的整链验收。
+- 先部署支持规范 `interactive_ai_app` 与历史别名的服务端，再安装匹配客户端；随后成组验证显式 Scaffold Skill、source+built+contract 校验、OSS immutable Release、运营审核、CDN/Edge 与 App 消费链。
 
 ## Next Recommended Steps
 
@@ -765,7 +807,7 @@ Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选
 - `/api/works/projects/publish-source` 必须在读取凭据和项目文件前校验 Renderer capability；Host token/base 不能替代该 UI 边界。
 - `works-cloud-deploy.json` 仅是已安装数据的兼容文件名，不代表客户端仍拥有自动部署协调器；旧中间态不得恢复为后台任务。
 - 刷新凭据、发布 Token、ZIP、幂等键和重试只能由 Electron Main 持有。
-- 本地 `projectType` 只决定产品分流和模板选择，不得作为授权依据或替代 Main/服务端的包体校验。
+- 本地 `projectType` 只决定产品分流和显式 Scaffold Skill 选择，Skill 的静态检测也只提供准备度证据；两者都不得作为授权依据或替代 Main/服务端的构建、包体校验和审核。
 - 本地构建必须使用安装版 Electron Node、固定 npm 11.6.2 和项目 `package-lock.json` 锁定的 Vite，不得回退到全局 PATH、已有 `node_modules` 或未验证的 npm 闭包；依赖安装需要网络。
 - 项目 Vite config/plugins 以桌面用户权限执行，不能称为 sandbox；此风险边界必须在发布说明中保留。
 - AI Design 的 Current Specification 是唯一语义权威。Direction events 必须按 Workspace/Direction/revision/operation identity 收敛；assistant delta、event cursor、Task progress 和 Asset updates 不得改写 Living Form。