duaer-spec 0.27.0 → 0.27.2

package/bin/live-repo-path.mjs

@@ -4,7 +4,7 @@
 
 import { existsSync, mkdirSync, statSync } from "node:fs";
 import { homedir } from "node:os";
-import { basename, isAbsolute, join, parse, resolve } from "node:path";
+import { basename, isAbsolute, parse, resolve } from "node:path";
 
 /**
  * @param {string} repoPath
@@ -53,9 +53,98 @@ export function resolveProductRepoPath(repoPath, opts = {}) {
   return resolve(parent, raw);
 }
 
+/**
+ * Create mode: only a single short folder name under the product parent.
+ * Absolute paths and nested paths are refused so parent + name stay one story.
+ * @param {string} folderName
+ * @param {{ projectsRoot?: string, home?: string }} [opts]
+ */
+export function resolveCreateProductRepoPath(folderName, opts = {}) {
+  const raw = String(folderName || "")
+    .trim()
+    .replace(/[\\/]+$/, "");
+  if (!raw) {
+    const e = new Error("请填写要新建的目录短名");
+    e.code = "EMPTY_PATH";
+    throw e;
+  }
+  if (isAbsolute(raw) || /[\\/]/.test(raw) || raw === "." || raw === "..") {
+    const e = new Error(
+      "新建只能填目录短名（如 my-app），不要填绝对路径。目录将建在产品父目录下；已有项目请从下方列表打开或点「浏览…」",
+    );
+    e.code = "NEED_SHORT_NAME";
+    throw e;
+  }
+  const projectsRoot = String(opts.projectsRoot || "").trim();
+  if (!projectsRoot) {
+    const e = new Error("新建前请先选择产品父目录");
+    e.code = "NEED_PROJECTS_ROOT";
+    throw e;
+  }
+  return resolveProductRepoPath(raw, opts);
+}
+
+/**
+ * Create mode must not reuse an on-disk folder (would clobber the prior project).
+ * @param {string} absPath
+ */
+export function assertProductDirFreeForCreate(absPath) {
+  const abs = resolve(String(absPath || ""));
+  if (!abs) {
+    const e = new Error("请填写仓库绝对路径，或项目名（需先设置产品父目录）");
+    e.code = "EMPTY_PATH";
+    throw e;
+  }
+  if (existsSync(abs)) {
+    const e = new Error(
+      `项目目录已存在：${abs}。请换一个目录名，或从「已有项目」打开。`,
+    );
+    e.code = "PATH_EXISTS";
+    e.path = abs;
+    throw e;
+  }
+  return abs;
+}
+
+/**
+ * Create mode must not reuse a registered project path or display title.
+ * @param {{ path: string, title?: string }} want
+ * @param {Array<{ path?: string, title?: string, name?: string }>} repos
+ */
+export function assertProjectIdentityFreeForCreate(want, repos = []) {
+  const abs = resolve(String(want?.path || ""));
+  const title = String(want?.title || "")
+    .trim()
+    .toLowerCase();
+  const list = Array.isArray(repos) ? repos : [];
+  for (const r of list) {
+    const p = resolve(String(r?.path || ""));
+    if (p && abs && p === abs) {
+      const e = new Error(
+        `项目已存在：${abs}。请换一个目录名，或从「已有项目」打开。`,
+      );
+      e.code = "PROJECT_EXISTS";
+      e.path = abs;
+      throw e;
+    }
+    const other = String(r?.title || r?.name || "")
+      .trim()
+      .toLowerCase();
+    if (title && other && title === other) {
+      const e = new Error(
+        `已有同名项目「${r.title || r.name}」。请换一个项目名称，或从「已有项目」打开。`,
+      );
+      e.code = "TITLE_EXISTS";
+      e.path = p || undefined;
+      throw e;
+    }
+  }
+  return abs;
+}
+
 /**
  * Create missing directory (recursive). Refuses FS root and $HOME itself.
- * @returns {{ path: string, created: boolean }}
+ * @returns {{ path: string, created: boolean, name?: string }}
  */
 export function ensureProductDir(absPath, opts = {}) {
   const abs = resolve(String(absPath || ""));

package/docs/agent/branching-and-release.md

@@ -140,6 +140,22 @@ develop is green / accepted for release
 Never merge a random `feat/*` straight into `main` for a normal feature.
 Features land on **`develop` first**, then ride a promotion to **`main`**.
 
+### Version number (fast iteration)
+
+This repo ships often. The default bump is the **patch** (the last number):
+
+```text
+0.27.0 → 0.27.1 → 0.27.2 → …
+```
+
+The next release after `0.27.1` is **`0.27.2`**. Do not jump to `0.28.0` just
+because features landed. Bump the minor or major only when the user asks for
+that cut, or when the change breaks adopters (`duaer init` / public CLI).
+
+Set `package.json` `version`, move `CHANGELOG.md` `Unreleased` under that
+version, tag `vX.Y.Z`, and publish the GitHub Release (npm Trusted Publishing
+follows the release).
+
 ---
 
 ## 4. Flows by problem type

package/docs/agent/e2e-test-plan.md

@@ -176,6 +176,15 @@ the table for their app.
 | E2E-204 | FDE-02: feature confirm requires apiContract; path injects pool tasks; no-HTTP opt-out skips pool tasks | `npm test` + `npm run test:live` |
 | E2E-205 | Desk refresh restores device matrix, critical paths, exception cases, and API contract on the confirm card | `npm test` + `npm run test:live` |
 | E2E-206 | FDE-07: feature exception cases must cover empty, failure, permission, timeout, and retry; a contract path also needs an error code; kickoff adds UAT tasks | `npm test` + `npm run test:live` |
+| E2E-207 | FDE-04: device matrix needs two named targets, screenshot or cloud evidence, and a fallback; kickoff adds a compat task | `npm test` + `npm run test:live` |
+| E2E-208 | FDE-03: environment checklist needs DNS, TLS, CORS, auth, and third-party reachability passed, or a no-customer opt-out; a failed probe blocks confirm; kickoff adds a probe task before implement | `npm test` + `npm run test:live` |
+| E2E-209 | FDE-06: data precheck needs a field mapping, an import failure list, and an export, or a no-import opt-out; kickoff adds the precheck before implement | `npm test` + `npm run test:live` |
+| E2E-210 | FDE-05: external dependencies need a blocker, SLA, backup mock, and parallel path, or a no-dependency opt-out; kickoff adds the board before implement | `npm test` + `npm run test:live` |
+| E2E-211 | FDE-08: performance budget needs LCP, INP, bundle size, virtualized long lists, a weak-network check, and a large-data check, or a no-page-performance opt-out; a vague speed line fails; kickoff adds the budget before implement | `npm test` + `npm run test:live` |
+| E2E-212 | Creating a new project refuses when the target directory already exists; open from the project list still works | `npm test` + `npm run test:live` |
+| E2E-213 | Create project accepts only a short folder name under the parent; absolute paths, duplicate folders, and duplicate titles are refused | `npm test` + `npm run test:live` |
+| E2E-214 | Architecture edges that would cross unrelated boxes get a clear corridor via; vertical labels use gap `labelAt`; Archify render succeeds | `npm test` |
+| E2E-215 | Bottom-via edge labels stay under the floor (`labelAt` on via) so they do not overlap mid-row boxes (e.g. 改稿 / artifact) | `npm test` |
 
 | E2E-156 | Accepted chat bubble preview URL is a clickable `<a>` (http(s) or /api/…) | `npm test` + `npm run test:live` |
 | E2E-157 | `http://host/api/result/…` chat links render as one clean `<a>` (no nested HTML garble) | `npm test` |
@@ -417,4 +426,5 @@ the table for their app.
 | E2E-204 | `266-fde02-api-contract` | API contract gate + pool tasks |
 | E2E-205 | `267-baseline-restore` | refresh keeps baseline confirm fields |
 | E2E-206 | `268-fde07-uat` | UAT pack on exception cases + kickoff |
+| E2E-207 | `271-fde04-compat` | browser matrix evidence + kickoff |
 

package/docs/agent/live-desk.md

@@ -80,7 +80,32 @@ registry linking into the requirements document (no duplicate full cards).
    Exception cases are an FDE-07 UAT pack (empty, failure, permission, timeout,
    retry). A declared contract path also requires an error code or HTTP status
    in that text. Kickoff adds a UAT task per confirmed module.
-   Refreshing the desk restores those four fields from the saved session.
+   The device matrix is an FDE-04 compat pack: at least two named browsers or
+   domestic clients, screenshot or cloud evidence, and a polyfill or fallback.
+   Kickoff adds a compat-evidence task per confirmed module.
+   The environment checklist is an FDE-03 probe pack: DNS, TLS, CORS, auth,
+   and third-party reachability must all be recorded as passed, or the card
+   states that there is no customer environment. A failed probe blocks
+   confirm. Kickoff adds an environment-probe task before implement when a
+   customer environment is declared. The desk does not scan that network.
+   The data precheck is an FDE-06 import pack: a field mapping, an import
+   failure list, and an export the business can clean. Or the card states
+   that this module has no import. Kickoff adds that precheck before
+   implement, after the environment probe when both exist. The desk does
+   not scan the customer database.
+   External dependencies are an FDE-05 board: a blocker, an SLA, a backup
+   mock, and a parallel path. Or the card states that this module has no
+   external dependency. Kickoff adds that board before implement, after
+   the environment probe and data precheck when those exist. The desk does
+   not call the vendor.
+   The performance budget is an FDE-08 gate: LCP, INP, bundle size,
+   virtualized long lists, a weak-network check, and a large-data check.
+   A vague speed line such as "pretty fast" fails. Or the card states that
+   this module has no page performance requirement. Kickoff adds that
+   budget before implement, after the environment probe, data precheck, and
+   external-dependency board when those exist. The desk does not run a
+   customer performance lab.
+   Refreshing the desk restores those baseline fields from the saved session.
 3. Confirm locks **that module only**. It does **not** call `writeBrief` and does
    **not** start Terminal workers.
 4. When all relevant modules are confirmed, the desk unlocks architecture
@@ -93,9 +118,14 @@ registry linking into the requirements document (no duplicate full cards).
    Architecture chat may claim the diagram is ready before IR arrives; if the
    middle panel has no diagram, the **same** chat bubble is rewritten to offer
    Regenerate diagram (it must not leave a false “diagram ready” line).
-   Before Archify deliver, `routeCrossingEdges` adds a bottom `via` detour for
-   long same-row edges that would pass through unrelated components
-   (`clean-flow/edge-through-node`).
+   Before Archify deliver, `routeCrossingEdges` picks a clear corridor
+   (`via` + sides) for edges that would pass through unrelated components:
+   same-row edges prefer a bottom/top wrap; stacked or diagonal edges try
+   gutters and outer sides, keeping every segment clear of other boxes
+   (`clean-flow/edge-through-node`). Edge labels on bottom/top vias use
+   `labelAt` on the via corridor (not a negative `labelDy` that pulls them
+   into mid-row boxes). Vertical stacked edges use `labelAt` in the gap
+   between boxes.
 
 ## Bug dispatch (defect path)
 

package/docs/agent/workflow.md

@@ -65,6 +65,8 @@ handling. They cannot be relaxed without explicit human override.
   delete the short branch.
 - Push only when the user explicitly requests remote publishing.
 - Promote **`develop` → `main`** only when the user explicitly asks to go online.
+- Fast iteration: the default version bump is the patch. Next after `0.27.1`
+  is `0.27.2`. Do not bump the minor on every ship.
 
 Full matrix by issue type:
 [branching-and-release](branching-and-release.md).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "duaer-spec",
-  "version": "0.27.0",
+  "version": "0.27.2",
   "description": "Norms → satisfactory delivery: digital employees for Cursor and Claude Code — talk in plain language, no Spec workflow required",
   "type": "module",
   "bin": {

package/web/live-dev/app.js

@@ -257,6 +257,18 @@ const el = {
   apiContract: document.getElementById("apiContract"),
   apiContractView: document.getElementById("apiContractView"),
   apiContractField: document.getElementById("apiContractField"),
+  envChecklist: document.getElementById("envChecklist"),
+  envChecklistView: document.getElementById("envChecklistView"),
+  envChecklistField: document.getElementById("envChecklistField"),
+  dataPrecheck: document.getElementById("dataPrecheck"),
+  dataPrecheckView: document.getElementById("dataPrecheckView"),
+  dataPrecheckField: document.getElementById("dataPrecheckField"),
+  externalDeps: document.getElementById("externalDeps"),
+  externalDepsView: document.getElementById("externalDepsView"),
+  externalDepsField: document.getElementById("externalDepsField"),
+  perfBudget: document.getElementById("perfBudget"),
+  perfBudgetView: document.getElementById("perfBudgetView"),
+  perfBudgetField: document.getElementById("perfBudgetField"),
   lblDevice: document.getElementById("lblDevice"),
   lblPaths: document.getElementById("lblPaths"),
   lblExceptions: document.getElementById("lblExceptions"),
@@ -937,6 +949,10 @@ function cardValues() {
     criticalPaths: (el.criticalPaths?.value || "").trim(),
     exceptionCases: (el.exceptionCases?.value || "").trim(),
     apiContract: (el.apiContract?.value || "").trim(),
+    envChecklist: (el.envChecklist?.value || "").trim(),
+    dataPrecheck: (el.dataPrecheck?.value || "").trim(),
+    externalDeps: (el.externalDeps?.value || "").trim(),
+    perfBudget: (el.perfBudget?.value || "").trim(),
   };
 }
 
@@ -986,6 +1002,10 @@ function applyActiveModuleToFields() {
   if (el.criticalPaths) el.criticalPaths.value = c.criticalPaths || "";
   if (el.exceptionCases) el.exceptionCases.value = c.exceptionCases || "";
   if (el.apiContract) el.apiContract.value = c.apiContract || "";
+  if (el.envChecklist) el.envChecklist.value = c.envChecklist || "";
+  if (el.dataPrecheck) el.dataPrecheck.value = c.dataPrecheck || "";
+  if (el.externalDeps) el.externalDeps.value = c.externalDeps || "";
+  if (el.perfBudget) el.perfBudget.value = c.perfBudget || "";
   syncReqSections();
 }
 
@@ -1057,6 +1077,10 @@ function mergeModulesFromChatPayload(data) {
       criticalPaths: String(data.criticalPaths || data.modules?.[0]?.card?.criticalPaths || activeModule()?.card?.criticalPaths || ""),
       exceptionCases: String(data.exceptionCases || data.modules?.[0]?.card?.exceptionCases || activeModule()?.card?.exceptionCases || ""),
       apiContract: String(data.apiContract || data.modules?.[0]?.card?.apiContract || activeModule()?.card?.apiContract || ""),
+      envChecklist: String(data.envChecklist || data.modules?.[0]?.card?.envChecklist || activeModule()?.card?.envChecklist || ""),
+      dataPrecheck: String(data.dataPrecheck || data.modules?.[0]?.card?.dataPrecheck || activeModule()?.card?.dataPrecheck || ""),
+      externalDeps: String(data.externalDeps || data.modules?.[0]?.card?.externalDeps || activeModule()?.card?.externalDeps || ""),
+      perfBudget: String(data.perfBudget || data.modules?.[0]?.card?.perfBudget || activeModule()?.card?.perfBudget || ""),
     };
     const prev = activeModule();
     state.modules = [
@@ -1118,6 +1142,30 @@ function mergeModulesFromChatPayload(data) {
             old?.card?.apiContract ||
             "",
         ),
+        envChecklist: String(
+          raw.envChecklist ||
+            raw.card?.envChecklist ||
+            old?.card?.envChecklist ||
+            "",
+        ),
+        dataPrecheck: String(
+          raw.dataPrecheck ||
+            raw.card?.dataPrecheck ||
+            old?.card?.dataPrecheck ||
+            "",
+        ),
+        externalDeps: String(
+          raw.externalDeps ||
+            raw.card?.externalDeps ||
+            old?.card?.externalDeps ||
+            "",
+        ),
+        perfBudget: String(
+          raw.perfBudget ||
+            raw.card?.perfBudget ||
+            old?.card?.perfBudget ||
+            "",
+        ),
       };
       if (old?.status === "confirmed") {
         byId.set(id, {
@@ -1158,6 +1206,10 @@ function mergeModulesFromChatPayload(data) {
     if (data.criticalPaths) m.card.criticalPaths = data.criticalPaths;
     if (data.exceptionCases) m.card.exceptionCases = data.exceptionCases;
     if (data.apiContract) m.card.apiContract = data.apiContract;
+    if (data.envChecklist) m.card.envChecklist = data.envChecklist;
+    if (data.dataPrecheck) m.card.dataPrecheck = data.dataPrecheck;
+    if (data.externalDeps) m.card.externalDeps = data.externalDeps;
+    if (data.perfBudget) m.card.perfBudget = data.perfBudget;
     if (data.ready) m.status = "ready";
   }
   applyActiveModuleToFields();
@@ -1961,6 +2013,10 @@ function setConfirmFieldsReadonly(ro) {
     "criticalPaths",
     "exceptionCases",
     "apiContract",
+    "envChecklist",
+    "dataPrecheck",
+    "externalDeps",
+    "perfBudget",
   ]) {
     if (el[id]) el[id].readOnly = Boolean(ro);
   }
@@ -1985,6 +2041,10 @@ function restoreConfirmCardFromOriginal() {
   if (el.criticalPaths) el.criticalPaths.value = c.criticalPaths || "";
   if (el.exceptionCases) el.exceptionCases.value = c.exceptionCases || "";
   if (el.apiContract) el.apiContract.value = c.apiContract || "";
+  if (el.envChecklist) el.envChecklist.value = c.envChecklist || "";
+  if (el.dataPrecheck) el.dataPrecheck.value = c.dataPrecheck || "";
+  if (el.externalDeps) el.externalDeps.value = c.externalDeps || "";
+  if (el.perfBudget) el.perfBudget.value = c.perfBudget || "";
   syncReqSections();
 }
 
@@ -2002,6 +2062,10 @@ function applyConfirmCardChrome() {
   if (el.criticalPathsField) el.criticalPathsField.hidden = bug;
   if (el.exceptionCasesField) el.exceptionCasesField.hidden = bug;
   if (el.apiContractField) el.apiContractField.hidden = bug;
+  if (el.envChecklistField) el.envChecklistField.hidden = bug;
+  if (el.dataPrecheckField) el.dataPrecheckField.hidden = bug;
+  if (el.externalDepsField) el.externalDepsField.hidden = bug;
+  if (el.perfBudgetField) el.perfBudgetField.hidden = bug;
   if (el.confirm && !modulesAllConfirmedLocal()) {
     el.confirm.textContent = t(bug ? "card.bugConfirm" : "card.confirm");
   }
@@ -2212,6 +2276,10 @@ function cardFingerprint(v) {
     criticalPaths: String(v.criticalPaths || "").trim(),
     exceptionCases: String(v.exceptionCases || "").trim(),
     apiContract: String(v.apiContract || "").trim(),
+    envChecklist: String(v.envChecklist || "").trim(),
+    dataPrecheck: String(v.dataPrecheck || "").trim(),
+    externalDeps: String(v.externalDeps || "").trim(),
+    perfBudget: String(v.perfBudget || "").trim(),
   });
 }
 
@@ -2312,7 +2380,7 @@ function syncAutoHandleButtons() {
 function confirmFieldsOk(v = cardValues()) {
   if (!v.goal || !v.acceptance) return false;
   if (state.deskKind === "bug") return true;
-  return Boolean(v.deviceMatrix && v.criticalPaths && v.exceptionCases && v.apiContract);
+  return Boolean(v.deviceMatrix && v.criticalPaths && v.exceptionCases && v.apiContract && v.envChecklist && v.dataPrecheck && v.externalDeps && v.perfBudget);
 }
 
 function validationAllowsSend(kind) {
@@ -2640,7 +2708,7 @@ function applyCardChrome() {
   syncConfirmEnabled();
 }
 
-["goal", "outOfScope", "acceptance", "assumptions", "deviceMatrix", "criticalPaths", "exceptionCases", "apiContract"].forEach((id) => {
+["goal", "outOfScope", "acceptance", "assumptions", "deviceMatrix", "criticalPaths", "exceptionCases", "apiContract", "envChecklist", "dataPrecheck", "externalDeps", "perfBudget"].forEach((id) => {
   if (!el[id]) return;
   el[id].addEventListener("input", () => {
     autoGrowTextarea(el[id]);
@@ -2975,6 +3043,10 @@ function applySavedCardFields(card, reviseCard) {
   if (el.criticalPaths) el.criticalPaths.value = c.criticalPaths || "";
   if (el.exceptionCases) el.exceptionCases.value = c.exceptionCases || "";
   if (el.apiContract) el.apiContract.value = c.apiContract || "";
+  if (el.envChecklist) el.envChecklist.value = c.envChecklist || "";
+  if (el.dataPrecheck) el.dataPrecheck.value = c.dataPrecheck || "";
+  if (el.externalDeps) el.externalDeps.value = c.externalDeps || "";
+  if (el.perfBudget) el.perfBudget.value = c.perfBudget || "";
   const r = reviseCard || {};
   if (el.revGoal) el.revGoal.value = r.goal || "";
   if (el.revOut) el.revOut.value = r.outOfScope || "";
@@ -4816,6 +4888,10 @@ async function applyConfirmSuccess(data) {
         criticalPaths: String(m.card?.criticalPaths || m.criticalPaths || ""),
         exceptionCases: String(m.card?.exceptionCases || m.exceptionCases || ""),
         apiContract: String(m.card?.apiContract || m.apiContract || ""),
+        envChecklist: String(m.card?.envChecklist || m.envChecklist || ""),
+        dataPrecheck: String(m.card?.dataPrecheck || m.dataPrecheck || ""),
+        externalDeps: String(m.card?.externalDeps || m.externalDeps || ""),
+        perfBudget: String(m.card?.perfBudget || m.perfBudget || ""),
       },
       dependsOn: Array.isArray(m.dependsOn) ? m.dependsOn.map(String) : [],
     }));
@@ -4836,6 +4912,10 @@ async function applyConfirmSuccess(data) {
         criticalPaths: data.card.criticalPaths || "",
         exceptionCases: data.card.exceptionCases || "",
         apiContract: data.card.apiContract || "",
+        envChecklist: data.card.envChecklist || "",
+        dataPrecheck: data.card.dataPrecheck || "",
+        externalDeps: data.card.externalDeps || "",
+        perfBudget: data.card.perfBudget || "",
       };
     }
     applyActiveModuleToFields();
@@ -6237,6 +6317,10 @@ const REQ_FIELD_PAIRS = [
   { ta: "criticalPaths", view: "criticalPathsView", emptyKey: "card.pathsPh" },
   { ta: "exceptionCases", view: "exceptionCasesView", emptyKey: "card.exceptionsPh" },
   { ta: "apiContract", view: "apiContractView", emptyKey: "card.apiContractPh" },
+  { ta: "envChecklist", view: "envChecklistView", emptyKey: "card.envChecklistPh" },
+  { ta: "dataPrecheck", view: "dataPrecheckView", emptyKey: "card.dataPrecheckPh" },
+  { ta: "externalDeps", view: "externalDepsView", emptyKey: "card.externalDepsPh" },
+  { ta: "perfBudget", view: "perfBudgetView", emptyKey: "card.perfBudgetPh" },
   { ta: "revGoal", view: "revGoalView", emptyKey: "revise.goalPh" },
   { ta: "revOut", view: "revOutView", emptyKey: "revise.outPh" },
   { ta: "revAccept", view: "revAcceptView", emptyKey: "revise.acceptPh" },
@@ -6263,6 +6347,11 @@ function isReqReadonly(taId) {
       "deviceMatrix",
       "criticalPaths",
       "exceptionCases",
+      "apiContract",
+      "envChecklist",
+    "dataPrecheck",
+    "externalDeps",
+    "perfBudget",
     ].includes(taId)
   ) {
     return Boolean(state.locked || el[taId]?.readOnly);
@@ -8820,6 +8909,7 @@ async function activateProjectPath(pathOrName, meta = {}) {
     return;
   }
   const requireMeta = meta.requireMeta !== false;
+  const create = meta.create === true;
   const title = String(meta.title ?? "").trim();
   const description = String(meta.description ?? "").trim();
   if (requireMeta) {
@@ -8841,6 +8931,7 @@ async function activateProjectPath(pathOrName, meta = {}) {
     if (requireMeta || title) body.title = title;
     if (requireMeta || description) body.description = description;
     if (requireMeta) body.requireMeta = true;
+    if (create) body.create = true;
     const res = await fetch("/api/projects/activate", {
       method: "POST",
       headers: { "content-type": "application/json" },
@@ -9085,6 +9176,7 @@ el.projectActivate?.addEventListener("click", () => {
     title: (el.projectTitle?.value || "").trim(),
     description: (el.projectDescription?.value || "").trim(),
     requireMeta: true,
+    create: true,
   });
 });
 
@@ -9113,6 +9205,7 @@ el.projectBrowse?.addEventListener("click", async () => {
         title,
         description,
         requireMeta: true,
+        create: false,
       });
     }
   } catch (err) {

package/web/live-dev/baseline.mjs

@@ -54,6 +54,10 @@ export function baselineFingerprint(modules) {
       criticalPaths: String(m.card?.criticalPaths || "").trim(),
       exceptionCases: String(m.card?.exceptionCases || "").trim(),
       apiContract: String(m.card?.apiContract || "").trim(),
+      envChecklist: String(m.card?.envChecklist || "").trim(),
+      dataPrecheck: String(m.card?.dataPrecheck || "").trim(),
+      externalDeps: String(m.card?.externalDeps || "").trim(),
+      perfBudget: String(m.card?.perfBudget || "").trim(),
     }))
     .sort((a, b) => a.id.localeCompare(b.id));
   return JSON.stringify(confirmed);

package/web/live-dev/compat-matrix.mjs

@@ -0,0 +1,38 @@
+/**
+ * FDE-04: a browser matrix is not done until it names real targets,
+ * evidence, and a fallback.
+ */
+
+const NAMED_TARGETS = [
+  /chrome/i,
+  /safari/i,
+  /firefox/i,
+  /\bedge\b/i,
+  /\bie\s*11\b|\bie11\b|\binternet explorer\b/i,
+  /麒麟|统信|\buos\b|360|qq\s*浏览器|微信|鸿蒙|android|\bios\b|iphone|国产/i,
+  /手机/,
+];
+
+function namedTargetCount(text) {
+  const t = String(text || "");
+  return NAMED_TARGETS.filter((re) => re.test(t)).length;
+}
+
+export function missingCompatMatrix(text) {
+  const t = String(text || "").trim();
+  const missing = [];
+  const vagueOnly =
+    /^(主流浏览器|现代浏览器|主流终端|modern browsers|all browsers)[.。!！\s]*$/i.test(
+      t,
+    );
+  if (vagueOnly || namedTargetCount(t) < 2) {
+    missing.push("至少两个具体浏览器或国产终端");
+  }
+  if (!/截图|录屏|云测|真机|证据|screenshot|recording|browserstack|compat\//i.test(t)) {
+    missing.push("截图/录屏或云测证据");
+  }
+  if (!/降级|polyfill|不支持|fallback|垫片|提示升级|upgrade notice/i.test(t)) {
+    missing.push("降级或 Polyfill");
+  }
+  return missing;
+}

package/web/live-dev/confirm-card.mjs

@@ -15,5 +15,9 @@ export function restoreConfirmCard(source) {
     criticalPaths: pick("criticalPaths"),
     exceptionCases: pick("exceptionCases"),
     apiContract: pick("apiContract"),
+    envChecklist: pick("envChecklist"),
+    dataPrecheck: pick("dataPrecheck"),
+    externalDeps: pick("externalDeps"),
+    perfBudget: pick("perfBudget"),
   };
 }

package/web/live-dev/data-precheck.mjs

@@ -0,0 +1,35 @@
+/**
+ * FDE-06: dirty rows and bad field maps must not reach the page.
+ * The confirm card records a mapping, an import precheck failure list,
+ * and that the list can be exported for cleanup. The desk does not scan
+ * the customer database.
+ */
+
+const PARTS = [
+  { label: "字段映射", re: /字段映射|欄位映射|映射表|field mapping/i },
+  { label: "导入预检失败清单", re: /预检|預檢|precheck|失败清单|失敗清單|failure list/i },
+  { label: "可导出", re: /导出|導出|匯出|\bexport\b/i },
+];
+
+export function dataPrecheckDeclaresNoImport(text) {
+  return /本模块无导入|本模組無導入|无数据导入|無資料匯入|無數據導入|no import/i.test(
+    String(text || ""),
+  );
+}
+
+export function missingDataPrecheck(text) {
+  const t = String(text || "").trim();
+  if (dataPrecheckDeclaresNoImport(t)) return [];
+  const missing = [];
+  for (const part of PARTS) {
+    if (!part.re.test(t)) missing.push(part.label);
+  }
+  return missing;
+}
+
+/** Kickoff schedules the precheck only when an import was declared. */
+export function dataPrecheckNeedsTask(text) {
+  const t = String(text || "").trim();
+  if (!t || dataPrecheckDeclaresNoImport(t)) return false;
+  return true;
+}

package/web/live-dev/env-check.mjs

@@ -0,0 +1,41 @@
+/**
+ * FDE-03: joint debug does not start until the customer environment
+ * checklist records DNS, TLS, CORS, auth, and third-party reachability
+ * as passed. The desk does not scan the customer network.
+ */
+
+const PROBES = [
+  { label: "DNS", re: /\bdns\b|域名解析/i },
+  { label: "TLS", re: /\btls\b|证书|憑證|\bhttps\b/i },
+  { label: "CORS", re: /\bcors\b/i },
+  { label: "鉴权", re: /鉴权|鑑權|认证|認證|\bauth(?:entication|n|z)?\b|\bsso\b|登录态|登入態/i },
+  { label: "第三方可达", re: /第三方|third[- ]party/i },
+];
+
+const FAIL_RE = /失败|失敗|不通|未通过|未通過|不可达|不可達|blocked|\bfail(?:ed|ure)?\b/i;
+const PASS_RE = /通过|通過|已探测|已探測|全绿|全綠|\bpass(?:ed)?\b|reachable/i;
+
+export function envChecklistDeclaresNoCustomer(text) {
+  return /无客户联调|無客戶聯調|无客户环境|無客戶環境|no customer environment/i.test(
+    String(text || ""),
+  );
+}
+
+export function missingEnvChecklist(text) {
+  const t = String(text || "").trim();
+  if (envChecklistDeclaresNoCustomer(t)) return [];
+  const missing = [];
+  for (const probe of PROBES) {
+    if (!probe.re.test(t)) missing.push(probe.label);
+  }
+  if (FAIL_RE.test(t)) missing.push("存在未通过项，不能开工");
+  else if (!PASS_RE.test(t)) missing.push("探测结果（通过）");
+  return missing;
+}
+
+/** Kickoff schedules a probe only when a customer environment was declared. */
+export function envChecklistNeedsProbe(text) {
+  const t = String(text || "").trim();
+  if (!t || envChecklistDeclaresNoCustomer(t)) return false;
+  return true;
+}

package/web/live-dev/external-deps.mjs

@@ -0,0 +1,35 @@
+/**
+ * FDE-05: a third-party, ERP, or SSO dependency must not silently own
+ * the schedule. The confirm card records a blocker, an SLA, a backup
+ * mock, and a parallel path. The desk does not call the vendor.
+ */
+
+const PARTS = [
+  { label: "阻塞项", re: /阻塞|blocker/i },
+  { label: "SLA", re: /\bsla\b/i },
+  { label: "备用 Mock", re: /\bmock\b|备用|備用/i },
+  { label: "并行路径", re: /并行|並行|parallel/i },
+];
+
+export function externalDepsDeclaresNone(text) {
+  return /本模块无外部依赖|本模組無外部依賴|无第三方依赖|無第三方依賴|no external dependency/i.test(
+    String(text || ""),
+  );
+}
+
+export function missingExternalDeps(text) {
+  const t = String(text || "").trim();
+  if (externalDepsDeclaresNone(t)) return [];
+  const missing = [];
+  for (const part of PARTS) {
+    if (!part.re.test(t)) missing.push(part.label);
+  }
+  return missing;
+}
+
+/** Kickoff schedules the board only when an external dependency was declared. */
+export function externalDepsNeedsTask(text) {
+  const t = String(text || "").trim();
+  if (!t || externalDepsDeclaresNone(t)) return false;
+  return true;
+}