④段整套同步（六节 ＋ P/S/F/J ＋ 模板）＋ open-design 移到技能根

一、④段整套同步（用户选候选 A）
- 新增 `references/stage-proto-doc/assets/产品文档模板.html`（16 KB／247 行，从备份拷、转 LF）。
- ④段 SKILL.md 换成备份 15:28 那版，并按模板口径改齐：
  · 「产品文档框架」从「四块＋一附录」改成**六节** —— 页面结构／功能清单／使用场景／操作流程／
    跨页与界面状态／待确认与偏离；与模板同构，⛔ 不从空白页重写结构。
  · 编号从 R/S/F 改成 **P 页面／S 场景／F 功能／J 二级功能**，各自唯一、按展示顺序通排。
  · 保留旧版有价值的要求：每项功能补齐 做什么／入口在哪／输入边界／异常与恢复；重点功能三处标红；
    横向流程图每步写清页面／功能／操作／完成判据。
  · 完成标准「七节」→「六节」，自查清单同步换掉「需求」那批条目，补模板与配图两条。
  · 路径 `designs/<项目>/` → `docs/pm/<项目>/ui/`（2 处）。
  · 补回本机那条「每份产出文档开头都要有一张图」的引用（指向主 skill，段内不复述）。
- 主 skill 同步：四段结构表④行、④段沿革、画图小节（④段画页面结构图 ＋ 用户路径）。

二、open-design 移到技能根（用户选候选 A）
- `git mv product-planning/references/stage-delivery/assets/open-design → open-design/`（4178 文件）。
- `.gitignore` 白名单加 `!/open-design/` —— 否则移出去就不再纳入版本控制。
- 引用改 11 处：路径形态 `assets/open-design/...` → `<技能根>/open-design/...`；
  「随段携带的自带件」改称「同根技能」；「路径怎么找」那条改成自带件（段内相对路径）与
  同根技能（`<技能根>/<技能名>/`）两类分开写。
- open-design 自己的 ATTRIBUTION.md 两处同步（它现在与 oil-ui-pro 同层）。
- 副作用（有益）：命名闸门读数由 2063 降到 225 —— 此前它把 open-design 里 919 个第三方 md
  当成规则一起扫了；现在只扫本包 23 个 md。已确认④段的 H1 与 4a/4b/4c 子步仍在检查范围内。

三、验收
- check_naming.py --ws E:/ProgramData/AIProject/contentm_agent ＝ 通过 225 / 失败 0 / 提示 27。
- 活文件里 `assets/open-design` 残留 0；工作区 CRLF 文件 0。

open-design/design-templates/live-artifact/references/artifact-schema.md

@@ -0,0 +1,99 @@
+# Live Artifact Schema Reference
+
+Live artifacts are stored as daemon-owned project files under `.live-artifacts/<artifactId>/`. Agents author the source files, then register them through daemon tooling. The daemon assigns IDs, project scope, timestamps, run scope, and refresh status.
+
+## Source files
+
+| File | Owner | Purpose |
+| --- | --- | --- |
+| `artifact.json` | agent-authored input, daemon-validated | Artifact metadata, preview settings, document metadata, and source descriptors. Must not contain daemon-owned fields. |
+| `template.html` | agent-authored | `html_template_v1` template used to render the preview. |
+| `data.json` | agent-authored then refresh-runner-updated | Canonical preview data. API `document.dataJson` is only a derived cache. |
+| `provenance.json` | agent-authored then refresh-runner-updated | Source summary and generation notes. |
+| `index.html` | daemon-derived | Generated preview output. Do not treat as source of truth. |
+
+## Create/update input
+
+`artifact.json` should match `LiveArtifactCreateInput` or `LiveArtifactUpdateInput` from `packages/contracts/src/api/live-artifacts.ts`.
+
+Allowed agent-owned top-level fields:
+
+- `title`
+- `slug`
+- `sessionId`
+- `pinned`
+- `status`
+- `preview`
+- `document`
+
+Daemon-owned fields are rejected in agent input:
+
+- `id`
+- `projectId`
+- `createdAt`
+- `updatedAt`
+- `createdByRunId`
+- `schemaVersion`
+- `refreshStatus`
+- `lastRefreshedAt`
+
+## HTML document contract
+
+MVP documents use `html_template_v1`:
+
+```json
+{
+  "format": "html_template_v1",
+  "templatePath": "template.html",
+  "generatedPreviewPath": "index.html",
+  "dataPath": "data.json",
+  "dataJson": {}
+}
+```
+
+`template.html + data.json` is rendered by the daemon into `index.html` and the preview route.
+
+### Binding rules
+
+- Use escaped interpolation: `{{data.path.to.value}}`.
+- Paths must start with `data` and use dot-separated keys; numeric array indexes are allowed as path segments.
+- Supported structural directive: `data-od-repeat="item in data.items"` for one-level array repeats.
+- Nested repeats, conditionals, filters, helper functions, partials, and expression evaluation are not supported.
+- Raw HTML insertion is forbidden: no triple braces, ampersand interpolation, `data-od-html`, `data-od-raw`, or equivalent.
+- Interpolation in text and ordinary attributes is HTML-escaped by default.
+- Do not interpolate inside tag names, attribute names, comments, `<script>`, `<style>`, `<iframe srcdoc>`, event-handler attributes, or unsupported URL-bearing attributes.
+
+## Bounded JSON limits
+
+All persisted JSON values must fit the shared bounded JSON envelope:
+
+| Limit | Value |
+| --- | ---: |
+| Maximum object/array depth | 8 |
+| Maximum keys per object | 100 |
+| Maximum array length | 500 |
+| Maximum string length | 16 KiB |
+| Maximum serialized JSON size | 256 KiB |
+
+Forbidden keys anywhere in persisted JSON include `raw`, `rawResponse`, `payload`, `body`, `headers`, `cookie`, `authorization`, `token`, `secret`, `credential`, and `password`.
+
+## Minimal static artifact input
+
+```json
+{
+  "title": "Release Status",
+  "preview": { "type": "html", "entry": "index.html" },
+  "document": {
+    "format": "html_template_v1",
+    "templatePath": "template.html",
+    "generatedPreviewPath": "index.html",
+    "dataPath": "data.json",
+    "dataJson": {
+      "summary": {
+        "title": "Release Status",
+        "status": "On track"
+      }
+    }
+  }
+}
+```