openxiangda 1.0.162 → 1.0.164

package/lib/cli.js

@@ -24,6 +24,7 @@ const {
   buildGitBaseSourceArtifacts,
   canonicalJsonSha256,
   clearChangeBaseline,
+  clearChangeBaselineForReconciliation,
   getStoredChangeBaseline,
   isChangeBaselineOwnedByCurrentSession,
   readGitSourceBase,
@@ -52,9 +53,16 @@ const {
   normalizePublishContext,
 } = require('./publish-context');
 const {
+  assertRuntimeSourceClean,
   prepareRuntimeDeployLineage,
   resolveRuntimeRollbackBypass,
 } = require('./runtime-lineage');
+const {
+  assertReleaseSourceIntegrated,
+  assertReleaseSourceRevisionStable,
+  inspectReleaseSourceIntegration,
+  prepareReleaseSourceRevision,
+} = require('./release-mainline');
 const {
   analyzeManifestSourceDependencies,
   getImpactedResourceTargets,
@@ -101,6 +109,7 @@ const {
   getSddChangeScope,
   initSddWorkspace,
   proposeSddChange,
+  recordSddReleaseSourceRevision,
   syncSddChange,
   verifySddChange,
 } = require('./sdd');
@@ -202,7 +211,7 @@ Usage:
   openxiangda open-api credential list|get|create|update|rotate-secret [id] [--profile name] [--show-secret] [--yes] [--json]
   openxiangda design gates|template|review [--topic code] [--json]
   openxiangda sdd init|migrate|propose|quick|approve|status|context|verify|sync|archive [change] [--change id] [--json]
-  openxiangda release begin|status|renew|end [--change id] [--profile name] [--json]
+  openxiangda release begin|status|integration-status|renew|end [--change id] [--profile name] [--json]
   openxiangda release backend-head|backend-list|backend-detail|backend-diff|backend-rollback|backend-abort|backend-retry [releaseId] [--profile name] [--json]
   openxiangda release app-capture|app-head|app-list|app-detail|app-diff|app-prepare|app-verify|app-activate|app-finalize|app-rollback|app-abort [releaseId] [--staged-resources-json <JSON|file>] [--activate-staged-children] [--profile name] [--json]
   openxiangda env [--profile name]
@@ -267,12 +276,14 @@ Usage:
 
 OpenXiangda 应用开发使用普通用户登录 token，不需要 AK/SK；外部后端集成使用 open-api skill 与 AK/SK。
 所有直接配置写入必须携带 --change <id>，或先执行 release begin --change <id>；dry-run、schema-plan、validate、query/invoke 等只读/数据面命令不会获取发布租约。
+正式发布会冻结 clean committed HEAD；上线后必须将该 SHA merge/fast-forward 并 push 到权威远端主分支，integration-status 通过后 normal release end 才会清理会话。
 表单页、流程表单页和代码页的主链路是 sy-lowcode-app-workspace + openxiangda workspace publish。
 新 React SPA 公开访问使用 public-access 命令和 src/resources/public-access；settings public-access 仅用于旧表单公开设置兼容/修复。
 JS_CODE V2 使用 trusted_node；AI 源码必须写在 src/js-code-nodes/<scriptCode>/index.ts，代码自动化源码写在 src/automations/<resourceCode>/index.ts。definition-json 中的 sourceFile.localPath 会在 validate/create/publish 时先 TS 校验、再构建并上传为快照。`);
 }
 
 const SUBCOMMAND_BOOLEAN_FLAGS = new Set([
+  '--check',
   '--all',
   '--activate',
   '--dry-run',
@@ -631,6 +642,7 @@ async function sdd(args) {
       '  - 在 Codex 中 propose/quick/context 会按 CODEX_THREAD_ID 占用当前 worktree；其他任务必须切换到独立 worktree。',
       '  - quick 仅用于 L1 精确小改动；Function quick 还必须提供完整 --risk-json，不能用 riskTier 标签绕过。',
       '  - verify stage 可选 implementation、prepublish、postpublish、archive；不传保持旧版全量校验。',
+      '  - 新 release 会把实际 publish HEAD 写入 release.json；archive（包括 --force）要求该 SHA 已进入权威远端主分支。',
     ].join('\n'));
     return;
   }
@@ -837,13 +849,14 @@ async function release(args) {
   const { flags, positional } = parseArgs(rest);
   if (wantsSubcommandHelp(subcommand, flags)) {
     print([
-      '用法: openxiangda release begin|status|renew|end [--change id] [--profile name] [--json]',
+      '用法: openxiangda release begin|status|integration-status|renew|end [--change id] [--profile name] [--json]',
       '      openxiangda release backend-head|backend-list|backend-detail|backend-diff|backend-rollback|backend-abort|backend-retry [releaseId] [--profile name] [--json]',
       '      openxiangda release app-capture|app-head|app-list|app-detail|app-diff|app-prepare|app-verify|app-activate|app-finalize|app-rollback|app-abort [releaseId] [--staged-resources-json <JSON|file>] [--activate-staged-children] [--profile name] [--json]',
       '常用流程:',
       '  openxiangda release begin --change <id> --profile <name>',
       '  openxiangda resource publish function --only <code> --change <id> --profile <name>',
       '  openxiangda runtime deploy --change <id> --profile <name>',
+      '  openxiangda release integration-status --profile <name>',
       '  openxiangda release end --profile <name>',
       '  openxiangda release backend-head --profile <name>',
       '  openxiangda release backend-diff <fromReleaseId> <toReleaseId> --profile <name>',
@@ -854,6 +867,11 @@ async function release(args) {
       '  - 带 --change 的 resource/runtime 写命令在没有本地 lease 时会自动 begin，并在后续命令复用。',
       '  - 子 Runtime/Page/Backend/Form Release 默认先 stage；app-finalize 用 --staged-resources-json 覆盖 capture 中的 changed children，并在同一事务中原子激活。',
       '  - 默认 TTL 为 1800 秒；长异步发布每 30 秒检查并在到期前自动续租，续租失败会以 PUBLISH_LEASE_LOST 阻断后续写入。',
+      '  - begin 冻结 clean committed HEAD，并要求它包含权威远端主分支；发布期间 HEAD/源码不可变化。',
+      '  - 发布后先把冻结提交以保留 SHA 的 merge/fast-forward 合并并 push 到主分支；end 会在线验证后才清理会话。',
+      '  - integration-status --check 可作为 CI 门禁；尚未回合时返回非零。',
+      '  - 主线目标只能来自权威 Git remote 的实时默认 main/master；参数和环境变量不能改写。',
+      '  - 租约过期也会保留待回合证据；完成 merge/push 后仍可执行 end 清理。',
       '  - 同步本地构建会先续到平台最大 TTL，构建后再次校验；流程结束后显式 end。',
     ].join('\n'));
     return;
@@ -887,18 +905,26 @@ async function release(args) {
 
   if (subcommand === 'status') {
     const local = getStoredPublishLease(target);
+    const baseline = getStoredChangeBaseline(target, {
+      access: 'reconciliation-read',
+    });
     const clientSessionId =
       (local && isPublishLeaseOwnedByCurrentSession(local)
         ? local.clientSessionId
-        : null) || createPublishClientSessionId();
-    const remote = await requestWithAuth(
+        : null) ||
+      baseline?.clientSessionId ||
+      createPublishClientSessionId();
+    const remote = await fetchPublishLeaseStatus(
       config,
-      target.profileName,
-      `${publishLeaseApiPath(target, '/status')}?clientSessionId=${encodeURIComponent(clientSessionId)}`
+      target,
+      clientSessionId
     );
     const result = {
       remote,
       local,
+      releaseSourceRevision: baseline?.releaseSourceRevision || null,
+      integration: null,
+      integrationCheckRequired: Boolean(baseline?.releaseSourceRevision),
       localOwnedByCurrentSession: local
         ? isPublishLeaseOwnedByCurrentSession(local)
         : null,
@@ -908,6 +934,28 @@ async function release(args) {
     return;
   }
 
+  if (subcommand === 'integration-status') {
+    const baseline = getStoredChangeBaseline(target, {
+      access: 'reconciliation-read',
+    });
+    const sourceRevision = baseline?.releaseSourceRevision;
+    if (!sourceRevision) {
+      fail(
+        'RELEASE_SOURCE_LINEAGE_REQUIRED: 当前 release 没有冻结的 releaseSourceRevision，不能证明发布提交已回到权威主分支'
+      );
+    }
+    const result = inspectReleaseSourceIntegration(
+      sourceRevision,
+      { cwd: process.cwd() }
+    );
+    if (flags.check && !result.integrated) {
+      assertReleaseSourceIntegrated(sourceRevision, { cwd: process.cwd() });
+    }
+    if (flags.json) return writeJson(result);
+    printReleaseIntegrationStatus(result);
+    return;
+  }
+
   if (subcommand === 'begin' || subcommand === 'acquire') {
     const changeId = positional[0] || readStringFlag(flags, 'change');
     if (!changeId) {
@@ -922,8 +970,13 @@ async function release(args) {
         `本工作区已有 change ${existing.changeId || '-'} 的发布租约，请先执行 openxiangda release end`
       );
     }
+    const pendingBaseline = getStoredChangeBaseline(target);
     const clientSessionId =
       existing?.clientSessionId ||
+      (pendingBaseline?.changeId === changeId &&
+      isChangeBaselineOwnedByCurrentSession(pendingBaseline)
+        ? pendingBaseline.clientSessionId
+        : null) ||
       readStringFlag(flags, 'client-session-id') ||
       createPublishClientSessionId();
     const baseline = await ensureChangeBaseline(
@@ -933,21 +986,29 @@ async function release(args) {
       flags,
       clientSessionId
     );
-    const lease = existing
-      ? await renewPublishLease(config, target, existing, flags)
-      : await acquirePublishLease(config, target, changeId, {
-          ...flags,
-          'client-session-id': clientSessionId,
-        });
+    let lease;
+    try {
+      lease = existing
+        ? await renewPublishLease(config, target, existing, flags)
+        : await acquirePublishLease(config, target, changeId, {
+            ...flags,
+            'client-session-id': clientSessionId,
+          });
+    } catch (error) {
+      clearRejectedPendingBaseline(target, baseline, error);
+      throw error;
+    }
+    const finalizedBaseline = finalizeReleaseBaseline(target, baseline);
     const result = {
       ...lease,
-      baselineId: baseline?.baselineId,
-      baselineHeadDigest: baseline?.headDigest,
-      sourceBase: baseline?.sourceBase,
+      baselineId: finalizedBaseline?.baselineId,
+      baselineHeadDigest: finalizedBaseline?.headDigest,
+      sourceBase: finalizedBaseline?.sourceBase,
+      releaseSourceRevision: finalizedBaseline?.releaseSourceRevision,
     };
     if (flags.json) return writeJson(result);
     print(
-      `应用发布租约与变更基线已获取: ${target.appType} change=${lease.changeId || changeId} baseline=${baseline?.baselineId || '-'} expiresAt=${lease.expiresAt}`
+        `应用发布租约与变更基线已获取: ${target.appType} change=${lease.changeId || changeId} baseline=${finalizedBaseline?.baselineId || '-'} publishSource=${String(finalizedBaseline?.releaseSourceRevision?.baseCommit || '-').slice(0, 12)} main=${finalizedBaseline?.releaseSourceRevision?.remoteName ? `${finalizedBaseline.releaseSourceRevision.remoteName}/` : ''}${finalizedBaseline?.releaseSourceRevision?.mainBranch || '-'} expiresAt=${lease.expiresAt}`
     );
     return;
   }
@@ -961,6 +1022,10 @@ async function release(args) {
     });
     const leaseId = leaseIdFromArgs || stored?.leaseId;
     if (!leaseId) fail('当前工作区没有发布租约，请先执行 openxiangda release begin --change <id>');
+    const baseline = getStoredChangeBaseline(target);
+    assertReleaseSourceRevisionStable(baseline?.releaseSourceRevision, {
+      cwd: process.cwd(),
+    });
     const lease = await renewPublishLease(
       config,
       target,
@@ -974,6 +1039,40 @@ async function release(args) {
 
   if (subcommand === 'end' || subcommand === 'release') {
     const stored = getStoredPublishLease(target);
+    const baseline = getStoredChangeBaseline(target, {
+      access: 'reconciliation-read',
+    });
+    if (
+      leaseIdFromArgs &&
+      stored?.leaseId &&
+      leaseIdFromArgs !== stored.leaseId
+    ) {
+      fail(
+        `RELEASE_LEASE_ID_MISMATCH: 显式 leaseId ${leaseIdFromArgs} 与本地冻结 lease ${stored.leaseId} 不一致；未清理任何发布证据`
+      );
+    }
+    const reconciliationOnly = Boolean(
+      (baseline && !isChangeBaselineOwnedByCurrentSession(baseline)) ||
+      (stored && !isPublishLeaseOwnedByCurrentSession(stored))
+    );
+    if (reconciliationOnly) {
+      if (!baseline?.releaseSourceRevision) {
+        fail(
+          'RELEASE_SOURCE_LINEAGE_REQUIRED: 外来 release 缺少冻结 source lineage，禁止接管或清理'
+        );
+      }
+      const result = await reconcileInactiveRelease({
+        config,
+        target,
+        stored,
+        baseline,
+      });
+      if (flags.json) return writeJson(result);
+      print(
+        `过期 release 已完成只读回合清理: ${target.appType} source=${String(result.integration.sourceCommit || '').slice(0, 12)}`
+      );
+      return;
+    }
     if (!leaseIdFromArgs) assertLocalPublishLeaseOwnership(stored);
     assertOrClaimWorktreeOwner({
       cwd: process.cwd(),
@@ -981,37 +1080,147 @@ async function release(args) {
     });
     const leaseId = leaseIdFromArgs || stored?.leaseId;
     if (!leaseId) {
-      const result = { active: false, appType: target.appType, local: false };
-      clearChangeBaseline(target);
+      const integration = baseline?.releaseSourceRevision
+        ? assertReleaseSourceIntegrated(baseline.releaseSourceRevision, {
+            cwd: process.cwd(),
+          })
+        : null;
+      if (baseline && !integration) {
+        fail(
+          'RELEASE_SOURCE_LINEAGE_REQUIRED: 本地仍有发布基线，但缺少可验证的 releaseSourceRevision；禁止无证据清理'
+        );
+      }
+      const result = {
+        active: false,
+        appType: target.appType,
+        local: false,
+        integration,
+      };
+      if (baseline) clearChangeBaseline(target, baseline.baselineId);
       releaseWorktreeOwner({ cwd: process.cwd() });
       if (flags.json) return writeJson(result);
       print(`当前工作区没有活动发布租约: ${target.appType}`);
       return;
     }
+    const integration = assertReleaseSourceIntegrated(
+      baseline?.releaseSourceRevision,
+      { cwd: process.cwd() }
+    );
     try {
-      const result = await requestWithAuth(
+      const remoteResult = await requestWithAuth(
         config,
         target.profileName,
         publishLeaseApiPath(target, `/${encodeURIComponent(leaseId)}/release`),
-        { method: 'POST' }
+        {
+          method: 'POST',
+          body: {
+            completion: 'mainline-integrated',
+            sourceCommit: integration.sourceCommit,
+            mainBranch: integration.mainBranch,
+            mainTipCommit: integration.mainTipCommit,
+          },
+        }
       );
       clearPublishLease(target, leaseId);
       clearChangeBaseline(target);
       releaseWorktreeOwner({ cwd: process.cwd() });
+      const result = {
+        ...(remoteResult && typeof remoteResult === 'object' ? remoteResult : {}),
+        integration,
+      };
       if (flags.json) return writeJson(result);
-      print(`应用发布租约已释放: ${target.appType}`);
+      print(
+        `应用发布租约已释放，发布提交已进入 ${integration.remoteName}/${integration.mainBranch}: ${target.appType}`
+      );
       return;
     } catch (error) {
-      if (['PUBLISH_LEASE_EXPIRED', 'PUBLISH_LEASE_INVALID'].includes(error?.code)) {
+      if (
+        stored?.leaseId === leaseId &&
+        ['PUBLISH_LEASE_EXPIRED', 'PUBLISH_LEASE_INVALID'].includes(error?.code)
+      ) {
         clearPublishLease(target, leaseId);
-        clearChangeBaseline(target);
+        if (baseline) clearChangeBaseline(target, baseline.baselineId || baseline.id);
         releaseWorktreeOwner({ cwd: process.cwd() });
       }
       throw error;
     }
   }
 
-  fail('用法: openxiangda release begin|status|renew|end|backend-*|app-* [--change id] [--profile name]');
+  fail('用法: openxiangda release begin|status|integration-status|renew|end|backend-*|app-* [--change id] [--profile name]');
+}
+
+async function fetchPublishLeaseStatus(config, target, clientSessionId) {
+  return await requestWithAuth(
+    config,
+    target.profileName,
+    `${publishLeaseApiPath(target, '/status')}?clientSessionId=${encodeURIComponent(clientSessionId || createPublishClientSessionId())}`
+  );
+}
+
+async function reconcileInactiveRelease({ config, target, stored, baseline }) {
+  const integration = assertReleaseSourceIntegrated(
+    baseline.releaseSourceRevision,
+    { cwd: process.cwd() }
+  );
+  const remote = await fetchPublishLeaseStatus(
+    config,
+    target,
+    baseline.clientSessionId
+  );
+  if (remote?.active !== false) {
+    const error = new Error(
+      'RELEASE_RECONCILIATION_REMOTE_ACTIVE: 原任务的远端 publish lease 仍为 active；新任务只能查看回合状态，不能续租、写入、释放或覆盖'
+    );
+    error.code = 'RELEASE_RECONCILIATION_REMOTE_ACTIVE';
+    throw error;
+  }
+
+  const expectedOwnerThreadId = String(
+    baseline.workspace?.threadId || stored?.workspace?.threadId || ''
+  ).trim();
+  const ownerStatus = getWorktreeOwnerStatus({ cwd: process.cwd() });
+  if (
+    ownerStatus.owner &&
+    (!expectedOwnerThreadId || ownerStatus.owner.threadId !== expectedOwnerThreadId)
+  ) {
+    fail(
+      'RELEASE_RECONCILIATION_OWNER_CHANGED: worktree owner 已不再对应冻结 release；保留发布证据且禁止清理新任务 owner'
+    );
+  }
+  const evidenceCleared = clearChangeBaselineForReconciliation(
+    target,
+    {
+      ...baseline,
+      leaseId: stored?.leaseId || null,
+    }
+  );
+  if (!evidenceCleared) {
+    fail(
+      'RELEASE_RECONCILIATION_STATE_CHANGED: 本地 lease/baseline 与冻结证据不再精确一致；未清理任何发布证据'
+    );
+  }
+  releaseWorktreeOwner({
+    cwd: process.cwd(),
+    force: true,
+    expectedThreadId: expectedOwnerThreadId || undefined,
+    expectedChangeId: baseline.changeId || undefined,
+    reason: [
+      'inactive release reconciliation',
+      `baseline=${baseline.baselineId || baseline.id}`,
+      `change=${baseline.changeId}`,
+      `source=${baseline.releaseSourceRevision.baseCommit}`,
+      'remoteLease=inactive',
+      'mainline=integrated',
+    ].join(' '),
+  });
+  return {
+    active: false,
+    appType: target.appType,
+    local: false,
+    reconciliationOnly: true,
+    remote,
+    integration,
+  };
 }
 
 function backendReleaseApiPath(target, suffix = '') {
@@ -1730,22 +1939,38 @@ async function ensureChangeBaseline(
     clientSessionId ||
     readStringFlag(flags, 'client-session-id') ||
     createPublishClientSessionId();
-  const sourceBase = resolveChangeSourceBase(changeId, flags);
   const stored = getStoredChangeBaseline(target);
   if (stored && !isChangeBaselineOwnedByCurrentSession(stored)) {
     fail(
       `当前工作区的变更基线由另一个任务持有 (${stored.workspace?.threadId || stored.clientSessionId || 'another-session'})`
     );
   }
-  if (
-    stored?.baselineId &&
-    stored.changeId === changeId &&
-    stored.clientSessionId === sessionId &&
-    stored.sourceBase?.baseCommit === sourceBase.baseCommit &&
-    stored.sourceBase?.treeHash === sourceBase.treeHash
-  ) {
+  if (stored) {
+    if (!stored.releaseSourceRevision) {
+      fail(
+        'RELEASE_SOURCE_LINEAGE_REQUIRED: 已存在的发布基线缺少 releaseSourceRevision，禁止覆盖；请先人工核对线上状态'
+      );
+    }
+    if (stored.changeId !== changeId) {
+      fail(
+        `RELEASE_RECONCILIATION_REQUIRED: change ${stored.changeId || '-'} 的发布提交仍待回合主分支，不能被 ${changeId} 覆盖；请先 merge/push 并执行 release end`
+      );
+    }
+    if (stored.clientSessionId && stored.clientSessionId !== sessionId) {
+      fail(
+        `RELEASE_RECONCILIATION_REQUIRED: change ${changeId} 必须复用已冻结的 clientSessionId，禁止创建新会话覆盖发布义务`
+      );
+    }
+    assertReleaseSourceRevisionStable(stored.releaseSourceRevision, {
+      cwd: process.cwd(),
+    });
     return stored;
   }
+  const activeLease = getUsableStoredPublishLease(target);
+  const sourceBase = resolveChangeSourceBase(changeId, flags);
+  const releaseSourceRevision = prepareReleaseSourceRevision({
+    cwd: process.cwd(),
+  });
 
   const data = await requestWithAuth(
     config,
@@ -1764,12 +1989,52 @@ async function ensureChangeBaseline(
       },
     }
   );
-  return saveChangeBaseline(target, {
+  const baseline = saveChangeBaseline(target, {
     ...data,
     changeId,
     clientSessionId: sessionId,
     sourceBase,
+    releaseSourceRevision,
+    lifecycleState: activeLease ? 'active' : 'pending-lease',
   });
+  Object.defineProperty(baseline, '__createdForAcquire', {
+    value: true,
+    configurable: true,
+    enumerable: false,
+  });
+  return baseline;
+}
+
+function finalizeReleaseBaseline(target, baseline) {
+  if (!baseline?.releaseSourceRevision) {
+    fail('RELEASE_SOURCE_LINEAGE_REQUIRED: 无法激活缺少 releaseSourceRevision 的发布基线');
+  }
+  const finalized = saveChangeBaseline(target, {
+    ...baseline,
+    lifecycleState: 'active',
+  });
+  try {
+    recordSddReleaseSourceRevision({
+      cwd: process.cwd(),
+      changeId: finalized.changeId,
+      releaseSourceRevision: finalized.releaseSourceRevision,
+    });
+  } catch (error) {
+    if (!/change 不存在|SDD 未初始化|ENOENT/i.test(String(error?.message || ''))) {
+      throw error;
+    }
+  }
+  return finalized;
+}
+
+function clearRejectedPendingBaseline(target, baseline, error) {
+  if (
+    baseline?.__createdForAcquire &&
+    baseline.lifecycleState === 'pending-lease' &&
+    error?.code === 'PUBLISH_LEASE_HELD'
+  ) {
+    clearChangeBaseline(target, baseline.baselineId);
+  }
 }
 
 async function acquirePublishLease(config, target, changeId, flags = {}) {
@@ -1819,7 +2084,14 @@ async function acquirePublishLease(config, target, changeId, flags = {}) {
       },
     }
   );
-  return savePublishLease(target, { ...data, clientSessionId });
+  return savePublishLease(target, {
+    ...data,
+    clientSessionId,
+    workspace: buildReleaseLeaseWorkspace(
+      baseline.releaseSourceRevision,
+      target
+    ),
+  });
 }
 
 async function renewPublishLease(config, target, lease, flags = {}) {
@@ -1859,13 +2131,14 @@ async function resolvePublishLeaseForWrite(config, target, flags = {}) {
       getStoredChangeBaseline(target)?.clientSessionId ||
       createPublishClientSessionId();
     if (changeId) {
-      await ensureChangeBaseline(
+      const baseline = await ensureChangeBaseline(
         config,
         target,
         changeId,
         flags,
         clientSessionId
       );
+      finalizeReleaseBaseline(target, baseline);
     }
     const explicitLease = {
       leaseId: explicitLeaseId,
@@ -1886,22 +2159,33 @@ async function resolvePublishLeaseForWrite(config, target, flags = {}) {
   let lease = getUsableStoredPublishLease(target);
   if (stored && !lease) {
     clearPublishLease(target, stored.leaseId);
-    clearChangeBaseline(target);
   }
   if (!lease && changeId) {
+    const pendingBaseline = getStoredChangeBaseline(target);
     const clientSessionId =
-      readStringFlag(flags, 'client-session-id') || createPublishClientSessionId();
-    await ensureChangeBaseline(
+      readStringFlag(flags, 'client-session-id') ||
+      (pendingBaseline?.changeId === changeId &&
+      isChangeBaselineOwnedByCurrentSession(pendingBaseline)
+        ? pendingBaseline.clientSessionId
+        : null) ||
+      createPublishClientSessionId();
+    const baseline = await ensureChangeBaseline(
       config,
       target,
       changeId,
       flags,
       clientSessionId
     );
-    lease = await acquirePublishLease(config, target, changeId, {
-      ...flags,
-      'client-session-id': clientSessionId,
-    });
+    try {
+      lease = await acquirePublishLease(config, target, changeId, {
+        ...flags,
+        'client-session-id': clientSessionId,
+      });
+    } catch (error) {
+      clearRejectedPendingBaseline(target, baseline, error);
+      throw error;
+    }
+    finalizeReleaseBaseline(target, baseline);
   }
   if (!lease) return null;
   if (changeId && lease.changeId !== changeId) {
@@ -1910,14 +2194,19 @@ async function resolvePublishLeaseForWrite(config, target, flags = {}) {
     );
   }
   if (changeId) {
-    await ensureChangeBaseline(
+    const baseline = await ensureChangeBaseline(
       config,
       target,
       changeId,
       flags,
       lease.clientSessionId
     );
+    finalizeReleaseBaseline(target, baseline);
   }
+  const baseline = getStoredChangeBaseline(target);
+  assertReleaseSourceRevisionStable(baseline?.releaseSourceRevision, {
+    cwd: process.cwd(),
+  });
   activatePublishRequestContext(target, lease);
   const heartbeat = await activatePublishLeaseHeartbeat(
     config,
@@ -2122,6 +2411,33 @@ function publishLeaseApiPath(target, suffix) {
   return `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/publish-lease${suffix}`;
 }
 
+function buildReleaseLeaseWorkspace(sourceRevision, target) {
+  if (!sourceRevision || typeof sourceRevision !== 'object') return undefined;
+  return {
+    cwd: path.resolve(target?.cwd || process.cwd()),
+    branch: sourceRevision.branch || '',
+    commit: sourceRevision.baseCommit || '',
+    treeHash: sourceRevision.treeHash || '',
+    worktreeRoot: sourceRevision.worktreeRoot || '',
+    remoteName: sourceRevision.remoteName || null,
+    remoteUrlHash: sourceRevision.remoteUrlHash || null,
+    mainBranch: sourceRevision.mainBranch || null,
+    mainTipCommit: sourceRevision.mainTipCommit || null,
+  };
+}
+
+function printReleaseIntegrationStatus(result) {
+  print(
+    [
+      `发布提交: ${result.sourceCommit || '-'}`,
+      `来源分支: ${result.sourceBranch || '-'}`,
+      `权威主分支: ${result.remoteName ? `${result.remoteName}/` : ''}${result.mainBranch}`,
+      `主分支提交: ${result.mainTipCommit}`,
+      `已回合并推送: ${result.integrated ? 'yes' : 'no'}`,
+    ].join('\n')
+  );
+}
+
 function normalizePublishLeaseTtl(value) {
   if (value === undefined || value === null || value === '') {
     return DEFAULT_CLI_PUBLISH_LEASE_TTL_SECONDS;
@@ -2141,6 +2457,9 @@ function printPublishLeaseStatus(result) {
       `应用发布租约: ${remote.appType || local?.appType || '-'}`,
       `remote: ${remote.active ? `active holder=${remote.holder} expiresAt=${remote.expiresAt}` : 'inactive'}`,
       `local: ${local ? `leaseId=${local.leaseId} change=${local.changeId || '-'} expiresAt=${local.expiresAt}` : 'none'}`,
+      result.releaseSourceRevision
+        ? `pending mainline: ${String(result.releaseSourceRevision.baseCommit || '').slice(0, 12)} -> ${result.releaseSourceRevision.remoteName}/${result.releaseSourceRevision.mainBranch}（运行 release integration-status）`
+        : 'pending mainline: none',
     ].join('\n')
   );
 }
@@ -3653,9 +3972,10 @@ Usage:
   openxiangda workspace publish --profile <name> [--changed [--since ref]|--form code|--page code|--only list] [--dry-run] [--force] [--resources|--skip-resources] [--prune] [--sdd-bypass --reason text]
 
 React SPA:
-  openxiangda workspace publish --profile <name> --form <formCode>   # sync form schema only
-  openxiangda resource publish --profile <name>
-  openxiangda runtime deploy --profile <name>
+  openxiangda workspace publish --change <change> --profile <name> --form <formCode>   # sync form schema only
+  openxiangda resource publish <type> --only <codes> --change <change> --profile <name>
+  openxiangda runtime deploy --no-activate --change <change> --profile <name>
+  # After activation, merge/push the frozen SHA, then release integration-status + release end.
 
 Options:
   --runtime legacy|react-spa       Workspace template/runtime mode.
@@ -6931,7 +7251,7 @@ async function resource(args) {
       '  - publish --dry-run 等价于发布前计划，不会写平台资源。',
       '  - 在线 publish 必须用 --only/--code 精确选择；真正全量发布必须显式 --all --reason，SDD bypass 不能绕过此范围门。',
       '  - 源码依赖触发的 Function/Automation 更新默认只替换 source snapshot，保留线上 bindings/schema/metadata；显式替换 manifest 必须加 --replace-manifest --reason。',
-      '  - --only/--code 在读取 manifest 后立即按逻辑资源 code 过滤；也支持 function:foo 这类带类型 selector。',
+      '  - --only/--code 会在读取/分析 manifest 与构建源码前按逻辑资源 code 早期收窄；也支持 function:foo 这类带类型 selector。',
       '  - type 可选: workflow, notification, route, menu, role, permission, data-view, function, connector 等。',
       '  - plan/publish 会在 stderr 输出阶段进度，超过 15 秒持续心跳；JSON 结果包含 timings，不污染 stdout。',
       '  - plan/publish --dry-run 严格只允许 GET/HEAD；READ_ONLY_AUTH_REQUIRED 时先执行 auth refresh 或重新登录。',
@@ -7199,7 +7519,7 @@ async function runtime(args) {
       '用法: openxiangda runtime deploy|releases|activate [--profile name] [--json]',
       '常用流程:',
       '  npm run build',
-      '  openxiangda runtime deploy --profile <name> --json',
+      '  openxiangda runtime deploy --no-activate --change <change> --profile <name> --json',
       '  openxiangda runtime releases --profile <name>',
       '说明:',
       '  - deploy 上传当前工作区 dist/ 并激活 React SPA runtime release。',
@@ -7209,6 +7529,7 @@ async function runtime(args) {
       '  - runtime 只发布前端产物；表单、流程、通知等资源仍走 resource publish。',
       '  - deploy/activate 会读取当前 Runtime head 并携带 CAS preconditions；head 已变化时平台返回 409，避免静默覆盖。',
       '  - 所有 deploy（含 --no-activate）先获取应用 publish lease；在任何构建/上传前要求 Git clean committed HEAD，并校验当前 HEAD 继承线上 Runtime 源码血缘。',
+      '  - release begin 还会冻结实际 publish HEAD 并要求它包含当前权威远端主分支；上线后 merge/push 该 SHA，通过 release integration-status 后再 release end。',
       '  - Runtime 同步构建前把 lease 续到平台最大 TTL；构建/上传后每次写入仍会重新校验，失租不会继续激活。',
       '  - build 不能安全前移到 lease 之前：直传模式的 assetBase 由受保护的 upload-plan 返回，不能用 gateway 路径静默替换。',
       '  - deploy 会输出 lease/head/preflight/build/upload/activate 阶段进度，JSON 结果包含 timings。',
@@ -7304,6 +7625,10 @@ async function runtime(args) {
     );
     const telemetry = createCliReleaseTelemetry('runtime deploy');
     try {
+    // Preserve Runtime's dedicated dirty-source contract before the generic
+    // frozen-release revision check runs inside lease resolution. The release
+    // freeze and clean-HEAD gates still run immediately afterwards.
+    assertRuntimeSourceClean(process.cwd());
     // Keep build after lease acquisition. In direct-storage modes the build
     // embeds the provider-specific assetBaseUrl returned by the protected
     // upload plan; substituting the gateway URL would change chunk/publicPath
@@ -8155,7 +8480,7 @@ async function commands(args) {
       'open-api credential list|get|create|update|rotate-secret [id]',
       'design gates|template|review [--topic code]',
       'sdd init|migrate|propose|approve|status|context|verify|sync|archive',
-      'release begin|status|renew|end|backend-head|backend-list|backend-detail|backend-diff|backend-rollback|backend-abort|backend-retry|app-capture|app-head|app-list|app-detail|app-diff|app-prepare|app-verify|app-activate|app-finalize|app-rollback|app-abort',
+      'release begin|status|integration-status|renew|end|backend-head|backend-list|backend-detail|backend-diff|backend-rollback|backend-abort|backend-retry|app-capture|app-head|app-list|app-detail|app-diff|app-prepare|app-verify|app-activate|app-finalize|app-rollback|app-abort',
       'env',
       'workspace init|bind|plan|check|publish [--app-name] [--changed|--since|--form|--page|--only|--dry-run|--force|--resources|--skip-resources|--prune]',
       'app list|create|snapshot',
@@ -8190,6 +8515,7 @@ async function commands(args) {
       'settings public-access is legacy form public-access compatibility/repair and should not be used for new React SPA apps.',
       'Direct live mutation commands should use --dry-run first and --write-manifest when the repository should remain source of truth.',
       'OpenXiangda native SDD uses openspec/ records; high-risk publishes require an approved change with coverage.json/release.json verification unless --sdd-bypass --reason is used.',
+      'A formal release freezes the clean publish HEAD separately from the change base; after activation merge/fast-forward and push that exact SHA to the authoritative default branch, verify release integration-status, then run release end.',
     ],
   };
   if (flags.json) return writeJson(manifest);
@@ -9539,6 +9865,12 @@ function resourceCodeSelectorMatches(selector, resourceKey, item) {
   return getResourceItemCode(item) === selector.code;
 }
 
+function resourceCodeSelectorAppliesToKey(selector, resourceKey) {
+  if (selector.key) return selector.key === resourceKey;
+  if (selector.keys) return selector.keys.includes(resourceKey);
+  return true;
+}
+
 function normalizeResourceTypeAlias(value) {
   return String(value || '')
     .trim()
@@ -9569,21 +9901,40 @@ function loadWorkspaceResources(options = {}) {
         }
       : {}),
   };
+  if (codeFilters) {
+    Object.defineProperty(manifest, '__resourceCodeSelectors', {
+      value: codeFilters,
+      configurable: true,
+      enumerable: false,
+      writable: false,
+    });
+  }
   for (const spec of RESOURCE_SPECS) {
-    const items = !typeFilters || typeFilters.has(spec.key)
-      ? readResourceItems(baseDir, spec)
-      : [];
-    manifest[spec.key] = codeFilters
-      ? items.filter(item => {
-          let matched = false;
-          for (let index = 0; index < codeFilters.length; index += 1) {
-            if (!resourceCodeSelectorMatches(codeFilters[index], spec.key, item)) continue;
-            matchedCodeFilters.add(index);
-            matched = true;
-          }
-          return matched;
-        })
-      : items;
+    if (typeFilters && !typeFilters.has(spec.key)) {
+      manifest[spec.key] = [];
+      continue;
+    }
+    if (!codeFilters) {
+      manifest[spec.key] = readResourceItems(baseDir, spec);
+      continue;
+    }
+
+    const selectorEntries = codeFilters
+      .map((selector, index) => ({ selector, index }))
+      .filter(({ selector }) => resourceCodeSelectorAppliesToKey(selector, spec.key));
+    if (selectorEntries.length === 0) {
+      manifest[spec.key] = [];
+      continue;
+    }
+    manifest[spec.key] = readResourceItems(baseDir, spec, {
+      selectorEntries,
+      matchedCodeFilters,
+      // Composite menu/notification files may expose several logical codes
+      // whose children cannot be located from the filename alone. They still
+      // filter before validation/source analysis; exact Function/Automation
+      // manifests use the fail-safe early file path below.
+      selectorFileScope: !['menus', 'notifications'].includes(spec.key),
+    });
   }
   if (codeFilters) {
     manifest.unmatchedResourceCodeFilters = codeFilters
@@ -9593,19 +9944,63 @@ function loadWorkspaceResources(options = {}) {
   return manifest;
 }
 
-function readResourceItems(baseDir, spec) {
+function readResourceItems(baseDir, spec, options = {}) {
   const items = [];
+  const selectorEntries = options.selectorEntries || null;
+  const matchedSelectorIndexes = new Set();
+  const visitedFiles = new Set();
+  const appendFile = filePath => {
+    if (visitedFiles.has(filePath)) return;
+    visitedFiles.add(filePath);
+    const fileItems = readResourceItemsFromFile(filePath, spec);
+    if (!selectorEntries) {
+      items.push(...fileItems);
+      return;
+    }
+    for (const item of fileItems) {
+      let matched = false;
+      for (const { selector, index } of selectorEntries) {
+        if (!resourceCodeSelectorMatches(selector, spec.key, item)) continue;
+        options.matchedCodeFilters?.add(index);
+        matchedSelectorIndexes.add(index);
+        matched = true;
+      }
+      if (matched) items.push(item);
+    }
+  };
   for (const relativeFile of spec.topFiles || []) {
     const filePath = path.join(baseDir, relativeFile);
     if (fs.existsSync(filePath)) {
-      items.push(...readResourceItemsFromFile(filePath, spec));
+      appendFile(filePath);
     }
   }
 
   const dirPath = path.join(baseDir, spec.dir);
   if (fs.existsSync(dirPath)) {
-    for (const filePath of listResourceJsonFiles(dirPath, spec)) {
-      items.push(...readResourceItemsFromFile(filePath, spec));
+    if (selectorEntries && options.selectorFileScope !== false) {
+      const remaining = () => selectorEntries.filter(
+        ({ index }) => !matchedSelectorIndexes.has(index)
+      );
+      for (const filePath of listSelectedResourceJsonFiles(
+        dirPath,
+        spec,
+        remaining().map(({ selector }) => selector.code)
+      )) {
+        appendFile(filePath);
+      }
+      if (remaining().length > 0) {
+        // A direct path is only a hint. The file may declare another explicit
+        // code, while the requested logical resource lives in an arbitrarily
+        // named legacy bundle. Fall back only when no selected item actually
+        // matched, preserving the standard-layout fast path.
+        for (const filePath of listResourceJsonFiles(dirPath, spec)) {
+          appendFile(filePath);
+        }
+      }
+    } else {
+      for (const filePath of listResourceJsonFiles(dirPath, spec)) {
+        appendFile(filePath);
+      }
     }
   }
   return items;
@@ -9754,6 +10149,36 @@ function listResourceJsonFiles(dirPath, spec) {
   );
 }
 
+function listSelectedResourceJsonFiles(dirPath, spec, selectedCodes = []) {
+  const codeSet = new Set(selectedCodes.map(code => String(code || '').trim()).filter(Boolean));
+  if (codeSet.size === 0) return [];
+
+  const directCandidates = new Set();
+  for (const code of codeSet) {
+    if (
+      code === '.' ||
+      code === '..' ||
+      code.includes('/') ||
+      code.includes('\\')
+    ) {
+      continue;
+    }
+    const directFile = path.join(dirPath, `${code}.json`);
+    if (fs.existsSync(directFile) && fs.statSync(directFile).isFile()) {
+      directCandidates.add(directFile);
+    }
+    const directDir = path.join(dirPath, code);
+    if (fs.existsSync(directDir) && fs.statSync(directDir).isDirectory()) {
+      for (const filePath of listJsonFiles(directDir)) {
+        if (shouldReadResourceJsonFile(filePath, dirPath, spec)) {
+          directCandidates.add(filePath);
+        }
+      }
+    }
+  }
+  return Array.from(directCandidates).sort();
+}
+
 function shouldReadResourceJsonFile(filePath, dirPath, spec) {
   if (spec.key !== 'workflows') return true;
   const relativeParts = path.relative(dirPath, filePath).split(path.sep);
@@ -10987,7 +11412,7 @@ async function publishResourcesForWorkspace(config, profileName, options = {}) {
 
 async function buildResourcePlan(config, target, manifest) {
   return await withReadOnlyHttpGuard('resource plan', async () => {
-  prepareManifestJsCodeBundlesForPlan(manifest);
+  await prepareManifestJsCodeBundlesForPlan(manifest);
   const existing = await fetchExistingResourceMaps(config, target, manifest);
   const actions = [];
   addPlanActions(actions, 'role', manifest.roles, existing.roles, roleEquals);
@@ -11024,7 +11449,7 @@ async function buildResourcePlan(config, target, manifest) {
   });
 }
 
-function prepareManifestJsCodeBundlesForPlan(manifest) {
+async function prepareManifestJsCodeBundlesForPlan(manifest) {
   const targetsByWorkspace = new Map();
   const seenObjects = new Set();
 
@@ -11079,21 +11504,45 @@ function prepareManifestJsCodeBundlesForPlan(manifest) {
   };
 
   for (const spec of RESOURCE_SPECS) {
-    visit(manifest[spec.key] || [], manifest.baseDir);
+    const selectors = manifest.__resourceCodeSelectors || null;
+    const items = selectors
+      ? (manifest[spec.key] || []).filter(item =>
+          selectors.some(selector =>
+            resourceCodeSelectorMatches(selector, spec.key, item)
+          )
+        )
+      : manifest[spec.key] || [];
+    visit(items, manifest.baseDir);
   }
 
   for (const [workspaceRoot, sourceMap] of targetsByWorkspace.entries()) {
     const sourceInfos = Array.from(sourceMap.values());
     if (sourceInfos.length === 0) continue;
-    const result = runWorkspaceJsCodeBuildBatch(
+    let result = runWorkspaceJsCodeBuildBatch(
       workspaceRoot,
       sourceInfos.map(item => ({
         sourceKind: item.sourceKind,
         scriptCode: item.scriptCode,
       }))
     );
-    if (result.stdout) process.stderr.write(result.stdout);
-    if (result.stderr) process.stderr.write(result.stderr);
+    if (result.status !== 0) {
+      const legacyFallback = result.openxiangdaBuildMode === 'workspace-script'
+        ? await tryBuildFunctionSourcesWithLegacyWorkspaceBuilder(
+            workspaceRoot,
+            sourceInfos
+          )
+        : { ok: false, result: null };
+      if (legacyFallback.ok) {
+        result = { status: 0, stdout: '', stderr: '' };
+      } else {
+        const failure = legacyFallback.result || result;
+        if (failure.stdout) process.stderr.write(failure.stdout);
+        if (failure.stderr) process.stderr.write(failure.stderr);
+      }
+    } else {
+      if (result.stdout) process.stderr.write(result.stdout);
+      if (result.stderr) process.stderr.write(result.stderr);
+    }
     if (result.status !== 0) {
       fail(
         `JS_CODE batch bundle构建失败，无法生成资源计划: ${sourceInfos
@@ -11112,6 +11561,48 @@ function prepareManifestJsCodeBundlesForPlan(manifest) {
   }
 }
 
+async function tryBuildFunctionSourcesWithLegacyWorkspaceBuilder(
+  workspaceRoot,
+  sourceInfos
+) {
+  if (
+    sourceInfos.length === 0 ||
+    sourceInfos.some(item => item.sourceKind !== 'functions')
+  ) {
+    return { ok: false, result: null };
+  }
+
+  let usedLegacyBuilder = false;
+  for (const sourceInfo of sourceInfos) {
+    const result = runWorkspaceJsCodeBuild(
+      workspaceRoot,
+      sourceInfo.scriptCode,
+      sourceInfo.sourceKind
+    );
+    if (result.status === 0) {
+      usedLegacyBuilder = true;
+      if (result.stdout) process.stderr.write(result.stdout);
+      if (result.stderr) process.stderr.write(result.stderr);
+      continue;
+    }
+    if (!isUnsupportedFunctionsBuildScript(result)) {
+      return { ok: false, result };
+    }
+    warn(
+      `当前工作区 scripts/build-js-code.mjs 不支持 App Function source=functions，已使用 openxiangda 内置构建器兼容构建 ${sourceInfo.scriptCode}`
+    );
+    await buildFunctionSourceWithBundledEsbuild(
+      sourceInfo.entryPath,
+      workspaceRoot,
+      sourceInfo.scriptCode
+    );
+  }
+  if (usedLegacyBuilder) {
+    warn('当前工作区 build-js-code 不支持批量 --scripts，已兼容使用逐 Function 构建');
+  }
+  return { ok: true, result: null };
+}
+
 function buildResourcePlanActionIndex(actions = []) {
   const index = new Map();
   for (const action of actions || []) {
@@ -17034,6 +17525,7 @@ function getJsCodeSourceInfoForPlan(localPath) {
     workspaceRoot,
     sourceKind,
     scriptCode,
+    entryPath: localPath,
     bundlePath: path.join(workspaceRoot, 'dist', sourceKind, scriptCode, 'index.cjs'),
   };
 }