docs: record youth design client integration

.project-docs/30-worklog/current-state.md

@@ -4,6 +4,26 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 ## Integrated Through
 
+- Youth-facing AI Design client source
+  `0fd32a2d49045a8f9e7f2e19ba6477f48f93e30c` is integrated over Model Tools
+  frontier `7552cf59526449c29d663a769c0fb62d84a1a759` through merge
+  `16157388afc2f6103aaee0bfd3c4e4e80c8fec48` with startup correction
+  `c5447ae90c434c06dbafa724b229d8459cb829d0` by task
+  `20260902-design-youth-client-integration-7a6d3c92`. Canvas now defaults to
+  conversation plus one compact “我的创作” card for creators aged 8-16, with
+  contextual “精细调整” instead of an always-visible professional field matrix.
+  The card remains a pure projection of the canonical V2 Current Specification;
+  direct choices use typed commands, Quote blockers follow Specification revision,
+  terminal blocked Quotes settle pending operations, and code-based Chinese copy
+  prevents raw compiler/Provider text from reaching the youth UI. Video editing
+  preserves stable canonical Shot identities and all hidden production metadata for
+  up to 24 Shots. No database, DTO/API, pricing, Provider route, or compatibility
+  path changed. Integration verification passed 40 focused youth tests, 5 Device
+  Package tests, typecheck, scoped lint, production build, and 2 Electron E2E flows.
+  The Electron run also exposed and closed an existing current-frontier startup crash:
+  the ESM-only Pi package manager is now loaded only when remote Device Package
+  installation needs it. No package, deployment, publication, push, or paid request
+  is claimed.
 - Model Tools and Device Packages client cutover is implemented by task
   `20260902-model-tools-client-integration-5d8b2f73`. Web Search is now a parent-only
   core tool of the frozen selected model/provider/credential; it no longer depends on
@@ -379,7 +399,7 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 客户端面向非专业用户提供“创建小游戏或小程序 → 项目配置中一键提交 → Main 本地 npm/Vite 构建 → Electron 双视口预检最终产物 → 上传 source+built 双归档与 contract → 运营审核”的唯一创建者链路。Main 对安全源码快照运行安装包内固定 npm 11.6.2 的 `npm ci --ignore-scripts`，再显式调用项目 `package-lock.json` 锁定的 Vite；Vite config/plugins 以当前桌面用户权限执行，因此只适用于用户信任的本地项目，不是 sandbox。预检由 Main 以临时 loopback origin 和 Electron WebContents/CDP 检查与最终 `built_archive` 相同的内存文件字节，覆盖桌面/移动视口、运行错误、白屏和外域访问；不使用 Playwright。该检查仍可由非官方客户端绕过，不产生可信 receipt，也不复刻生产 opaque-origin。服务端不再替客户端运行项目 Vite，而是把源码、构建归档和 contract 视为不可信输入，逐字节重算与校验并固化不可变 Release；人工审核仍不可绕过。自定义和缺少类型字段的旧项目不提供该入口。已发布作品优先使用安全投影后的 `play_url`，`runtime_url` 仅保留一个客户端版本的兼容回退。
 
-AI Design Canvas 现在是持续可见的双栏 Living Form 工作区。一个 Workspace 公开一个 current Direction、一个 persistent Agent Session 和一个 Current Specification；conversation timeline 只记录交互历史。Chat、direct edits、decision responses、proposal acceptance、locks、Asset binding 与 restore 都通过 `design.input.apply` 进入同一服务端 reducer，Renderer drafts 在 accepted 前保持本地。Main 持有 Works Token、stream ticket、WebSocket、request deadline、stable command/operation IDs 与错误脱敏；unknown result 只能复用原 identity，结构化业务错误不得重放。Generation 由服务端对 exact Specification revision 编译 immutable Quote，客户端只展示 public output plan、warnings、expiry 与 Token Points，并以 Quote ID 调用 `design.generation.confirm`；Provider Prompt、model、route、storage 和 billing atoms 不进入 Renderer。Task/Asset events 独立收敛 Workspace resources，不改写 Living Form。Development 与 packaged builds 均使用 Works Square V2，V1 DTO、local semantic adapter、mutable Quote PATCH 与 editable provider Prompt 已移除。
+AI Design Canvas 现在默认以对话和一张持续可见的“我的创作”卡服务 8-16 岁创作者；专业字段矩阵收进按需打开的“精细调整”，移动端保持对话优先并只挂载一个卡片/底部面板。Creation Card、精细调整、Quote、Task 与结果提示都只投影权威状态，已知问题按 code 转成通俗中文，未知服务端或 Provider 文本不会直接显示。一个 Workspace 仍只公开一个 current Direction、一个 persistent Agent Session 和一个 Current Specification；conversation timeline 只记录交互历史。Chat、direct edits、decision responses、proposal acceptance、locks、Asset binding 与 restore 都通过 `design.input.apply` 进入同一服务端 reducer，Renderer drafts 在 accepted 前保持本地。Main 持有 Works Token、stream ticket、WebSocket、request deadline、stable command/operation IDs 与错误脱敏；unknown result 只能复用原 identity，结构化业务错误不得重放。Generation 由服务端对 exact Specification revision 编译 immutable Quote，客户端只展示 public output plan、warnings、expiry 与 Token Points，并以 Quote ID 调用 `design.generation.confirm`；Provider Prompt、model、route、storage 和 billing atoms 不进入 Renderer。Task/Asset events 独立收敛 Workspace resources，不改写 Living Form。Development 与 packaged builds 均使用 Works Square V2，V1 DTO、local semantic adapter、mutable Quote PATCH 与 editable provider Prompt 已移除。
 
 Canvas 侧栏提供“获取灵感”进入 Prompt Museum。列表、筛选、分页、详情、作者/来源/许可证和图片地址全部由服务端经 Main-owned Host API 提供，客户端不打包静态数据集；服务端相对媒体只允许固定 `/api/image-prompt-museum/{entry}/media/{thumbnail|number}` 形状，并由 Main 注入 Works Bearer、执行一次 401 刷新、可信 raster MIME 与 10 MiB 上限后转为 Renderer data URL；credential-free HTTPS CDN 图片保持直连。图片失败只显示卡片内占位，不阻断卡片或详情；缺少来源 URL 时显示纯文本。“使用此 Prompt”只把原文带回当前 Canvas 输入框，不自动发送。该模块不是投稿、点赞、评论或排行榜社区。客户端契约已就绪，但不据此宣称 Works Square 内容后台和生产数据已经部署。`pnpm run dev` 现在默认使用云端 Canvas 适配器，本地适配器只能通过显式开发命令启用；产品 UI 只保留中文。