refactor(miniapp): move builtin contracts to product domains

docs/architecture/core-decomposition.md

@@ -70,7 +70,7 @@ Rust 编译和链接面。
 | `bitfun-tool-packs` | 由 feature group 隔离的具体工具实现 | target/scaffold：仅提供 basic / git / mcp / browser-web / computer-use / image-analysis / miniapp / agent-control feature-group 元数据，不得声明 concrete tools 已迁移 |
 | `bitfun-services-core` | Config、session、workspace、storage、filesystem、system services | partial：部分 pure helper 已迁出；config/workspace/filesystem runtime 多数仍在 core |
 | `bitfun-services-integrations` | Git、MCP、remote SSH、remote connect、file watch integrations | partial：MCP runtime 已迁入；remote SSH 仍只迁移低风险 contracts/helpers；remote-connect 已拥有 wire DTO、request builder、tracker state / registry lifecycle 与 tracker event reduction，dispatcher/product execution 仍在 core |
-| `bitfun-product-domains` | Miniapp 和 function-agent 产品子域 | partial：pure decision、port、storage layout 可迁入；IO、worker、Git/AI service runtime 仍在 core |
+| `bitfun-product-domains` | Miniapp 和 function-agent 产品子域 | partial：pure decision、port、storage/builtin contract 可迁入；IO、worker、built-in asset seeding、Git/AI service runtime 仍在 core |
 | `terminal-core` | 已有 terminal package，移动到 workspace 顶层 `src/crates/terminal` 路径 | done：已在 workspace 顶层 |
 | `tool-runtime` | 已有 tool runtime，移动到 workspace 顶层路径 | done：已在 workspace 顶层 |
 
@@ -187,11 +187,12 @@ owner 边界，否则不要把一个 feature group 继续拆成更小的 crate
     仍由 `product-full` 启用、把只依赖 port 的 helper 迁入 owner crate。
   - 当前 `product-domains` 可继续承载 MiniApp runtime search plan、worker install 命令选择、
     package.json storage-shape helper、lifecycle / revision helper、host routing / allowlist helper、
-    customization metadata / permission diff 等纯决策 / 解析逻辑；实际 runtime detection、worker pool、
+    customization metadata / permission diff、built-in MiniApp bundle/hash/marker/source payload
+    seed-decision contract 等纯决策 / 解析逻辑；实际 runtime detection、worker pool、
     storage IO、PathManager、进程执行、host dispatch 执行、customization draft 存储 / 应用与 builtin
-    asset seeding 仍留在 core product runtime。最新内置 PR Review MiniApp 依赖 core
-    `BuiltinApp` seed、content hash、install marker 与 customized update metadata；这些不是
-    `product-domains` runtime owner 已迁移的证据。
+    asset include / seeding / marker IO / recompile 仍留在 core product runtime。最新内置 PR Review
+    MiniApp 依赖 core asset include、user-data seed、customized update runtime 与 source-hash input
+    lookup；这些不是 `product-domains` runtime owner 已迁移的证据。
   - `product-domains` 可以先定义 MiniApp runtime/storage 与 function-agent Git/AI 的 port
     contract，并承载 function-agent 的纯 prompt / AI response parsing policy；core-owned adapter
     只能在不改变执行路径的前提下委托现有 service，并先补等价测试。IO/进程/AI/Git 执行 owner
@@ -205,9 +206,12 @@ owner 边界，否则不要把一个 feature group 继续拆成更小的 crate
     migration-before snapshots for core-owned MiniApp import / sync / recompile /
     rollback / dependency state paths and function-agent Git / AI response
     boundaries. Core still owns MiniApp filesystem IO, worker process execution,
-    built-in asset seeding/source-hash lookup, host-dispatch execution,
+    built-in asset seeding/source-hash input lookup, host-dispatch execution,
     `PathManager` integration, function-agent Git/AI calls, prompt templates,
-    JSON extraction, and error mapping.
+    JSON extraction, and error mapping. The built-in MiniApp bundle/hash/marker/source payload
+    seed-decision contract can live in `bitfun-product-domains`, but bundled
+    asset includes, marker IO, customized update runtime, and recompile
+    orchestration remain core-owned.
   - 高风险：`ToolUseContext`、product tool registry / runtime manifest assembly / `GetToolSpec` 执行 owner 化、
     MCP concrete tool integration、remote-connect、remote SSH runtime、miniapp / function-agent runtime、
     agent registry、`bitfun-core default = []`
@@ -261,7 +265,7 @@ owner 边界，否则不要把一个 feature group 继续拆成更小的 crate
   adapter 接入该 facade；Startchat 接线必须保留 legacy git-state、git-diff fallback、
   `analyze_git=false` time-info 与 `analyzed_at` 时序。
   core 仍持有 MiniApp filesystem IO、compiler 调度、worker process、host dispatch、
-  built-in seed/update，以及 function-agent Git/AI service adapter、prompt template、
+  built-in asset include / seed / marker IO / recompile，以及 function-agent Git/AI service adapter、prompt template、
   JSON extraction 和 error mapping。
 
 ## 产品表面边界（Product Surface Boundary）

docs/plans/core-decomposition-plan.md

@@ -1128,8 +1128,9 @@ product-full = ["miniapp", "function-agents"]
 - 2026-05-18 update: MiniApp draft manifest/response DTO, draft/customization storage path helpers, import layout / fallback payload contracts, manager lifecycle state-transition helpers, runtime executable search-plan helpers, customization draft-apply metadata policy, and built-in update/decline metadata decisions have been moved to `bitfun-product-domains::miniapp`; core continues to own draft/import filesystem IO, compile orchestration, built-in asset seeding/source-hash lookup, host dispatch execution, `PathManager` integration, worker process execution, and compatibility facades. The current PR also records core-owned MiniApp import / sync / recompile / rollback / dependency-state behavior as migration-before tests, including the existing `sync_from_fs` snapshot boundary.
 - 已迁移到 `bitfun-product-domains::function_agents`：公共 `common` 类型、git/startchat function-agent 的纯 DTO 类型、git function-agent 的纯路径 / 变更分类 / commit summary / message assembly / prompt format / commit type parser / AI response parsing policy、startchat prompt / action / AI response parsing policy / git porcelain / diff combine / time-of-day helper、Git/AI port contract，以及只读本地文件的 project context analyzer；core-owned Git snapshot adapter 已由等价测试覆盖，AI client、Git service、prompt template、AI request、JSON extraction、错误映射与分析运行逻辑仍留在 core。
 - 2026-05-18 update: Git function-agent diff truncation and commit prompt preparation are now owner-crate helpers used by core; AI client calls, prompt template ownership, JSON extraction, error mapping, and runtime analysis execution remain core-owned. The current PR adds focused core snapshots for staged-only Git commit diff collection and AI response JSON extraction / error mapping before any Git/AI runtime migration.
-- 2026-05-19 update: `bitfun-product-domains` now owns port-backed MiniApp runtime-state and function-agent runtime facades. Core delegates only MiniApp storage-backed lifecycle persistence through the MiniApp facade; compilation, source reads, storage IO adapter, worker process execution, host dispatch, built-in seeding, prompt templates, JSON extraction, and concrete error mapping remain core-owned. The Git commit-message and Startchat work-state product paths now route through the function-agent facade using core-owned Git/AI adapters; Startchat wiring is guarded by focused tests for legacy git-state, no-HEAD git-diff fallback, and `analyze_git=false` time-info, while core keeps the previous post-analysis `analyzed_at` assignment.
-- boundary check 已补充 product-domain owner anchor：`MiniAppStoragePort` / `MiniAppRuntimePort` 的 core adapter、MiniApp host/customization 纯 contract、MiniApp manager preflight tests、function-agent Git adapter 与 AI response parsing helper 必须存在，防止把 port contract 或 pure parser 误读成 storage IO、worker process、host dispatch、customization draft runtime、Git/AI service runtime 已完成迁移。
+- 2026-05-19 update: `bitfun-product-domains` now owns port-backed MiniApp runtime-state and function-agent runtime facades. Core delegates only MiniApp storage-backed lifecycle persistence through the MiniApp facade; compilation, source reads, storage IO adapter, worker process execution, host dispatch, built-in asset include / seed / marker IO / recompile, prompt templates, JSON extraction, and concrete error mapping remain core-owned. The Git commit-message and Startchat work-state product paths now route through the function-agent facade using core-owned Git/AI adapters; Startchat wiring is guarded by focused tests for legacy git-state, no-HEAD git-diff fallback, and `analyze_git=false` time-info, while core keeps the previous post-analysis `analyzed_at` assignment.
+- 2026-05-19 built-in MiniApp contract update: built-in bundle shape, install marker DTO, content-hash helper, source/placeholder/package payload helpers, and seed-decision policy now live in `bitfun-product-domains::miniapp::builtin`; core still owns the bundled asset includes, user-data filesystem IO, marker read/write, customization metadata IO, source-hash input lookup, and recompile orchestration.
+- boundary check 已补充 product-domain owner anchor：`MiniAppStoragePort` / `MiniAppRuntimePort` 的 core adapter、MiniApp host/customization/builtin 纯 contract、MiniApp manager preflight tests、function-agent Git adapter 与 AI response parsing helper 必须存在，防止把 port contract 或 pure parser 误读成 storage IO、worker process、host dispatch、customization draft runtime、builtin asset seeding runtime、Git/AI service runtime 已完成迁移。
 - miniapp runtime/storage/manager/host dispatch/exporter/builtin 与 function-agent 运行逻辑继续迁移前，需要先确认 agent/tool/provider port 和 Git/AI service 边界。
 
 **验证：**
@@ -1543,7 +1544,7 @@ cargo check --workspace
 - 未声明完成的 P2/后续剩余部分：remote-ssh runtime、remote-connect 等重 service 迁移、`ToolUseContext` 外移、runtime manifest assembly / `GetToolSpec` 执行 owner 化、concrete tool implementation 迁移、product registry / provider assembly、miniapp/function-agent 运行逻辑迁移。这些会触碰 `PathManager`、`ToolUseContext`、workspace service、snapshot wrapper、prompt-visible tool catalog、`AgentSubmissionPort` 或 AI service 边界，需要在继续前显式确认。
 - 本次 rebase 后重新核对最新主干 Deep Review capacity/cost/queue、context profile、evidence ledger 与 session manifest 变更：当前 PR 已完成 Git feature group 的 owner crate 归属迁移，但未改动这些 Deep Review 行为路径；后续迁移必须补端口设计和等价测试后再推进。
 - 本次 rebase 后重新核对最新主干 tool 变更：on-demand tool spec discovery 新增 collapsed/expanded manifest、`GetToolSpec`、context-aware schema/description 与 unlock state。这不要求回退当前 P2 已完成内容，但要求后续 tool/provider 迁移先补 manifest / catalog / unlock 等价保护，且不得和 PR5 product-domain runtime 收口混合。
-- PR5 已先推进低风险 product-domain slice：MiniApp 纯 compiler、export/runtime/worker DTO、runtime search plan、worker install 命令选择、package.json storage-shape helper、import layout / fallback payload contract、lifecycle / revision helper、manager 纯状态转换 helper、host routing string / allowlist policy helper、customization metadata / permission diff、runtime/storage port contract，以及 git/startchat function-agent 纯 utils / commit summary / message assembly / prompt format / commit prompt preparation / AI response parsing policy / action normalization / git porcelain / diff combine / time-of-day / Git/AI port contract / project context analyzer 已移入 `bitfun-product-domains`，core 保留原路径兼容 wrapper；core 只保留 AI client 调用、JSON 提取、错误映射、Git service adapter 和原路径 facade。已新增 core-owned Git snapshot、MiniApp storage/runtime port adapter 等价测试，并补齐 MiniApp manager import/sync/recompile/rollback/deps state 与 function-agent staged diff / AI response error mapping 的迁移前快照。PathManager、Git/AI service、prompt template、builtin asset seeding、host dispatch 执行、customization draft 存储 / 应用、worker pool / storage IO 执行逻辑和任何 tool runtime 仍未迁移。
+- PR5 已先推进低风险 product-domain slice：MiniApp 纯 compiler、export/runtime/worker DTO、runtime search plan、worker install 命令选择、package.json storage-shape helper、import layout / fallback payload contract、lifecycle / revision helper、manager 纯状态转换 helper、host routing string / allowlist policy helper、customization metadata / permission diff、built-in bundle/hash/marker/source payload seed-decision contract、runtime/storage port contract，以及 git/startchat function-agent 纯 utils / commit summary / message assembly / prompt format / commit prompt preparation / AI response parsing policy / action normalization / git porcelain / diff combine / time-of-day / Git/AI port contract / project context analyzer 已移入 `bitfun-product-domains`，core 保留原路径兼容 wrapper；core 只保留 AI client 调用、JSON 提取、错误映射、Git service adapter 和原路径 facade。已新增 core-owned Git snapshot、MiniApp storage/runtime port adapter 等价测试，并补齐 MiniApp manager import/sync/recompile/rollback/deps state、built-in asset seeding decision 等价测试与 function-agent staged diff / AI response error mapping 的迁移前快照。PathManager、Git/AI service、prompt template、builtin asset includes / seed / marker IO / recompile、host dispatch 执行、customization draft 存储 / 应用、worker pool / storage IO 执行逻辑和任何 tool runtime 仍未迁移。
 - 本次 P2 后续复核结论：上述高耦合剩余项不是纯文件搬迁；若继续迁移会改变依赖方向或需要新增 port/provider 行为合约。因此当前 PR 将它们显式保留为 core-owned runtime，只完成低风险 owner container 化，并通过 boundary check 防止已拆 owner crate 回流依赖 core。
 
 **后续风险重排（2026-05-13）：**
@@ -1669,7 +1670,7 @@ P2 后产品表面契约轨道（contract-only）：
 - 最新主干的 Web 启动性能优化新增 startup trace、deferred background scheduler、narrow tool initializer、Monaco warmup 与历史会话非阻塞 hydrate；这些属于 web app / Flow Chat product surface，不是 core service 迁移前置条件。后续只能通过 web product checks 验证，不得把 `startupTrace`、`backgroundTaskScheduler`、history hydration 或 tool warmup 下沉到 core-types / runtime-ports / agent-tools。
 - 最新主干的 CLI 重构主要新增 TUI/theme/selector/dialog/chat-state 等 app-layer 代码，后续又收敛预置 theme、增加 mode-aware subagent management，并补充 desktop companion pet resize / Windows UX；这些当前没有改变 `services-integrations` 的迁移归属。后续若调整 shared crate 边界，必须继续把 `bitfun-cli`、`ratatui`、`crossterm`、`arboard`、`syntect-tui` 等 CLI-only 依赖限制在 app adapter / presentation layer，desktop / web-ui presentation 修复也不应被误判为 core service 迁移前置条件。
 - 最新 desktop close button 默认最小化到 system tray 属于 desktop lifecycle surface；后续 desktop app lifecycle / window state 调整只能通过 desktop product check 验证，不作为 core service owner 外移前置条件。
-- 最新主干的内置 PR Review MiniApp 通过 core `BuiltinApp` asset bundle、content hash、install marker、customization metadata 与 update marker seed 到用户数据目录；它可以复用 `product-domains` 的 MiniApp 纯 contract，但 builtin asset seeding / customized update runtime 仍显式 core-owned，迁移前必须保留这些行为的等价测试。
+- 最新主干的内置 PR Review MiniApp 通过 core asset include、customization metadata IO、marker IO 与 update marker seed 到用户数据目录；它复用 `product-domains` 的 built-in bundle/hash/marker seed-decision contract，但 builtin asset seeding / customized update runtime / recompile orchestration 仍显式 core-owned，迁移前必须保留这些行为的等价测试。
 - P2 后产品表面策略要求“surface divergence, capability convergence”：CLI `/diff`、Desktop 快捷键/面板、Remote card、ACP method 可以映射到同一 capability contract，但不能为了复用把 surface command 或 UI rendering 下沉到 contract crate。
 - `ToolUseContext` 的 shared-context / evidence checkpoint hook、`TaskTool` / `CodeReviewTool` 的 Deep Review capacity flow、session manifest/cache persistence、rollback persisted-turn cleanup、search fallback chain 与 stream finish/tool-call contract 不能在 P3 中只通过 re-export 消失；如果外移，需要先补 boundary contract、旧路径兼容和对应 regression。
 - P3 的闭环检查应同时覆盖 Rust crate graph 与产品 runtime 行为：边界脚本只证明依赖方向，不能替代 Deep Review、MCP dynamic tools、tool manifest / `GetToolSpec`、remote connect、snapshot wrapping、miniapp/function-agent 的产品等价性验证。