merge: sync remote main and preserve local integrations

.project-docs/20-architecture/system-overview.md

@@ -21,6 +21,8 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展
 | AI Design Conversation | 保存消息、Brief、Quote、`turnRevision` 与服务端 Agent Session 绑定 | 同一 Workspace 内互相隔离；Session 由服务端持久化 |
 | AI Design Image Source Picker | 当前 Workspace 已完成图片或本地上传 | 图片 Brief 绑定图生图参考图；视频 Brief 绑定首帧；提交一个真实 Asset ID |
 | AI Design Gateway Routing | Main 云端适配器 ↔ Conversation WebSocket；Main → Host API/SSE → Renderer store | 命令、Run 与设计事件共用双向 WebSocket；Conversation 更新按 Workspace + Conversation 路由，任务更新按 Workspace 归并 |
+| AI Design Quote & Task Controls | 当前 Conversation Quote 与 Workspace 任务 | 最终 Prompt/generation options 每次修改由服务端重新计价；任务结果在详情中预览并经 Main-owned asset download 保存 |
+| Prompt Museum | Canvas “获取灵感”页面 → Main Host API → Works Square | 服务端驱动的审核内容、筛选和分页；Renderer 不持有 Works Token 或内置数据集，“使用此 Prompt”只回填输入框 |
 
 | Robot Workspace | Account-scoped agent configuration, device activation/binding, assignment, and credential-recovery UI | Renderer receives only safe Works Square projections. Configuration choices come from the USER-scoped safe catalog; unavailable current values remain editable without exposing provider credentials or configuration internals. |
 | AI Hardware Main Route | Fixed `/api/works/ai-hardware` Host API to Works Square proxy | Main owns Bearer auth, stable operation IDs, bounded retry, ETag/If-Match, request/response limits, error redaction, and the fixed no-store configuration-catalog proxy. Versioned responses accept only canonical strong or weak numeric ETags that equal the DTO revision; mutations always emit strong `If-Match`. It never forwards Renderer authorization headers. |
@@ -30,6 +32,9 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展
 ## Important Boundaries
 
 - Robot is the single enabled hardware product module; there is no separate Hardware card. Learning remains disabled.
+- Product UI language is Chinese-only. Unsupported system or persisted language values normalize to `zh`; removed locale files are not runtime fallbacks.
+- Packaged Canvas remains cloud-only with no local fallback. `pnpm run dev` now uses the cloud adapter; the local Workspace adapter requires the explicit development command and remains unpackaged-only.
+- Prompt Museum is a read-only curated inspiration surface, not a user-content community. Main owns Works authentication and forwards only the bounded list/detail routes; the client never bundles museum content or automatically submits a selected Prompt.
 - AI hardware network access is Main-owned. Renderer cannot hold Works Square or Xiaozhi credentials and cannot select arbitrary upstream paths or headers.
 - Robot model, language, and voice choices are dynamically projected from the Xiaozhi USER catalog through Works Square and Electron Main; the catalog is bounded, account-scoped, and `private, no-store` at each public hop.
 - One local account maps to one server-side Xiaozhi account binding. Agents and devices are resources beneath that account binding, not separate Xiaozhi users.
@@ -58,6 +63,8 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展
 - 确认生成按 Quote 对账 Workspace 任务。任务事务已提交但 Run 随后失败时可通过 REST 恢复任务可见性；内部任务对账失败不写当前 Conversation 的用户错误，任务恢复也不授权旧请求回写已切换的 Conversation 或清理新 pending turn。
 - Updater feed 选择、原始错误日志、下载和安装生命周期只属于 Electron Main。Renderer 不得把缺失稳定 manifest 投影为“已是最新版”，也不得显示原始堆栈、URL、路径或错误码；并发检查共享同一错误事件时只发送一次错误状态，后续独立重试仍可重新报告。
 - 图片与视频复用同一个单图来源选择器。图片 Brief 可从当前 Workspace 的已完成作品或本地上传中选择一张参考图继续生成；视频 Brief 使用同一入口绑定首帧。两条路径都必须通过现有 Workspace Asset 上传/选择契约提交一个真实 `attachmentAssetIds`，不得用本地路径或自然语言描述代替资产身份。
+- Canvas generation confirmation must use the latest server Quote after final Prompt or generation-option edits; the client displays server pricing and submits parameter values but does not derive provider dimensions, supplier pricing, or design-point cost.
+- Canvas project deletion is an explicit destructive Workspace mutation guarded by exact project-name confirmation. Renderer clears the deleted Workspace's local state and selects the most recently updated remaining Workspace; upstream hiding, cancellation, reservation release, and settlement remain service-owned behavior.
 - 当前兼容协议仍通过精确 quick reply `从作品列表选择图片` 打开选择器，并由当前 Brief medium 区分用途；仅 `medium === image` 使用图生图语义，`video`、null 或缺失 medium 保持视频首帧语义。该展示文案耦合不得扩散到更多用途，后续应升级为结构化 action/purpose。
 
 ## Related Decisions