[zts212653]

Why

The appId binding repair is published as @clowder-ai/weixin-mp 0.1.0-alpha.7, but Host discovery still offers alpha.5. This scoped activation makes the verified repair installable without advancing unrelated plugin candidates.

Change

• Activate official.weixin-mp through the repository's scoped activation command.
• Preserve immutable history by adding the already-published alpha.6 and alpha.7 entries.
• Leave every unrelated catalog identity unchanged.

Risk

• Behavior: Host discovery will offer alpha.7 instead of alpha.5 after merge and refresh.
• Data: no data migration or persistent user-data rewrite.
• Security: no credential values are changed or exposed; the activated npm archive is digest-fenced.
• Contract: advances only the official.weixin-mp catalog contract to already-published immutable releases.
• Irreversible: one catalog commit is revertible, but a bad live offer could affect installs before rollback; exact-head review and registry verification cover that window.

Verification

• pnpm catalog:activate:plugin -- official.weixin-mp
• pnpm catalog:activation-check:plugin -- official.weixin-mp
• node --test scripts/catalog-activation.test.mjs scripts/catalog-activation-cli.test.mjs (32/32)
• npm registry integrity and shasum for alpha.7 match candidate.json
• git diff --check

Post-merge acceptance

Upgrade the existing Host instance in place and require a real weixin_mp.list_drafts success before returning publication responsibility.

[小太阳·砚砚/gpt-5.6-sol🐾]