Task: 诊断新版发布错误投影

Identity

Read: required entry docs, active task record, current-state, system overview, source/integration task records, commitments and stale items.
Project goal: Main-owned 本地构建并安全投影发布状态；Renderer 不接触路径/归档/凭据。
Current focus: exact snapshot preflight + source/built/contract upload; server independently validates bytes.
Active constraints: Vite config/plugins run with desktop authority; client preflight is bypassable; error messages must remain fixed and non-sensitive.
Decisions affecting task: old sandbox/browser errors are historical; new protocol errors must distinguish upgrade/re-submit from transient retry.
Evidence/commitments: client focused tests/runtime verifier passed; real production protocol deployment remained unverified.
Likely modules: electron/api/routes/works.ts, src/lib/works-project-publish.ts, route and projection tests.
Unknowns/conflicts: user supplied only rendered text, not raw code, request ID, or client/API image version.
Gate result: Passed.

Find the exact projection entry and all raw codes that reach this message.
Run the smallest deterministic unit/route test that reproduces the rendered symptom.
Cross-check server rejection conditions and deployment-version mismatch hypotheses.
Report confirmed cause or the precise redacted evidence needed; do not implement without authorization.

已确认用户给出的三句中文精确来自 5b44864 之前的 Makelore SOURCE_PACKAGE_REJECTED 映射；当前 main 已使用新的本次构建结果/协议升级文案。
进程与安装产物只读核验显示当前运行路径为 D:\Tools\泥土\niancode\Makelore\Makelore.exe，FileVersion/ProductVersion 均为 1.0.0；其 resources/app.asar 包含该旧文案和旧上传逻辑。
旧 Main 不解析 upload 失败响应 body，只上传 source archive，会把新版服务端的 HTTP 400 CLIENT_BUILD_PROTOCOL_REQUIRED 丢失并降级为 SOURCE_PACKAGE_REJECTED。因此本次最可能且有版本证据支持的根因是旧客户端与新版服务端协议不匹配，而不是项目依赖、入口或敏感文件错误。
当前 main 会上传 archive、built_archive 与 artifact_contract，并专门投影 CLIENT_BUILD_PROTOCOL_REQUIRED；核心 contract 与服务端一致。
现有 release/Makelore-2.0.0-win-x64.exe 是早于本次实现的陈旧文件，摘要不等于本次曾验证的安装器，不能作为修复包分发。未修改或安装任何二进制文件。

历史真实函数反馈循环：SOURCE_PACKAGE_REJECTED、无 code + HTTP 400、无 code + HTTP 422 均稳定输出用户给出的旧文案。
pnpm exec vitest run tests/unit/works-project-publish.test.ts --reporter=verbose：1 file / 21 tests passed。
当前运行进程可执行文件版本：1.0.0；安装 app.asar 二进制检索命中旧文案。
git log -S 确认旧文案在提交 5b44864 中被新协议文案替换。
check_project_docs.py、task-aware check_doc_drift.py 与 git diff --check：通过。
未抓取真实生产 API response body；由于旧 Main 从未保存响应 body，这次历史请求的原始 stable code 无法从客户端 UI/日志恢复。

从当前 main 重新生成 Windows 安装器，完成 packaged runtime verifier 与摘要记录后，再由用户安装并重新提交项目。
扩展 Host 安全白名单，保留 ARTIFACT_CONTRACT_INVALID/MISMATCH、SOURCE_DIGEST_MISMATCH、BUILT_ARCHIVE_DIGEST_MISMATCH、OUTPUT_INVALID/LIMIT_EXCEEDED 与 PROJECT_RELEASE_REQUEST_TOO_LARGE 等稳定 code，并为用户显示脱敏 code 或 request-id。
与服务端统一 50 MiB built ZIP 原始字节和解压产物上限语义。