ygl-trees 0.66.0 → 0.68.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.68.0（2026-10-17）锁设计修复——serve/CLI 共存 + PID 活锁检测 + JSON 纯净 + v9 时间纪律
+- **F1（P0）：webui serve 不再持排他锁**——原实现进程级锁让 serve 生命周期内挡掉一切 CLI 命令；现 serve 跳过锁（`YGL_SERVE=1` 旁路），SQLite WAL 天然支持并发读 + 序列化写；CLI 短命令仍锁（单写者保护写窗口）
+- **P1（用户反馈）：PID 活锁检测替代 15 分钟 mtime**——Windows 上 `process.on("exit")` 的 rmSync 句柄未释放时静默失败→锁残留→下进程撞白锁；现用 `process.kill(pid, 0)` 探测持有者是否存活（EPERM=活/ESRCH=死），死 PID **立即清锁**（不看 mtime），活 PID **如实报告**（不误报 stale）
+- **F2：--json 模式锁错误纯净**——原锁提示文本泄露到 stdout 破坏 JSON 通道契约；现 --json 模式抑制人类提示，且提示本身也改为 PID 活锁感知（活锁不叫 stale）
+- **F3：taskSetStatus 更新 artifacts.updated**——任务状态变更现在同步写 updated 时间戳（v9 纪律补漏）
+- **exit 清理加固**：`beforeExit` + `exit` 双钩子 + 3 次重试（Windows EBUSY 容忍）
+- **vendor/cordis bin 字段清理**：bin.js 已删但声明残留——移除
+
+## 0.67.0（2026-10-17）WebUI antd 迭代——Ant Design 组件库升级 React 客户端
+- **antd v6 + @ant-design/icons**：专业组件库驱动的富客户端
+- **组件替换**：Layout（Header/Content）、Card 统计卡片、Statistic 数字展示、Table 任务清单（可筛选）、Tag 状态标签、Alert 错误提示、Space/Row/Col 布局
+- **DESIGN.md token 映射**：ConfigProvider theme（colorPrimary=#7c9885 sage、darkAlgorithm 暗色主题、zh_CN 中文语言包）
+- **代码分割**：manualChunks 拆分 vendor/antd/xyflow/markdown 四块，antd 不阻塞首屏
+- **保持不变**：xyflow 树视图、react-markdown 产出渲染、SSE 实时推送、内嵌 dashboard 回退
+
 ## 0.66.0（2026-10-17）新增 `llms` 命令——结构化能力清单（Ant Design for-agents 模式）
 - **`ygl-trees llms`**：一条命令输出完整 markdown 能力清单——冻结契约表（6 项）+ 16 个命令组全部用法 + 决策模型说明 + Quick Start + 设计系统入口——**任何 LLM 一次性获取全部能力面**
 - **静态 `llms.txt`**：仓库根目录，可被任何 LLM 爬取/注入上下文（同 Ant Design 的 llms.txt 模式）

package/dist/apps/cli/src/bin.js

@@ -116,132 +116,132 @@ function appVersion() {
 }
 // ── Usage text ──
 // (kept in apps/cli because it's presentation, not domain logic)
-const USAGE = `
-${(0, fmt_1.paint)(fmt_1.C.bold, "ygl-trees", true)}  猿光 · 科技树
-${(0, fmt_1.paint)(fmt_1.C.dim, "database-centric CLI: research → production → knowledge reuse", true)}
-
-  ygl-trees <group> <action> [args] [options]        add --json for machine output
-
-${(0, fmt_1.paint)(fmt_1.C.bold, "config", true)}      user-tunable settings (registry defaults + overrides)
-  list                       all keys: value + default + note
-  get <key>                  resolved value (config table > default)
-  set <key> <value>          validated against registry (type/range); events logged
-  reset <key>                drop override → back to default
-
-${(0, fmt_1.paint)(fmt_1.C.bold, "db", true)}
-  init                       create the workspace + schema
-  stats                      row counts per table
-  path                       print the database file path
-  export <file.sql> [--lean] dump ALL data tables (+ summary); --lean skips derived
-  sync pg <url>              one-way full mirror to PostgreSQL (L1, see docs/pg-compat.md)
-  migrate pg <url> [--fresh] one-time full-fidelity graduation (constraints + data, atomic)
-  dups                       list duplicate-content rows
-  reset                      delete the database (asks nothing, be careful)
-  sql "<sql>"                ad-hoc statement (can mutate — power tool, no guardrails)
-
-${(0, fmt_1.paint)(fmt_1.C.bold, "skill", true)}        L1 description / L2 body / L3 references
-  import <file.md>           import a SKILL.md (frontmatter = L1, body = L2)
-  add                        --name --description --body [-f file.md]
-  list | show <name> | rm <name> | enable <name> | disable <name>
-  match "<query>"            full-text match, prints L1 candidates for an agent
-  refs add <skill> <path> --body ...
-
-${(0, fmt_1.paint)(fmt_1.C.bold, "project", true)}
-  new <name> -q "<question>"  create + select
-  list | use <name> | show
-
-${(0, fmt_1.paint)(fmt_1.C.bold, "research", true)}    collect → screen → extract → claim
-  query add "<text>"          register a search query
-  query attach <qid> <sid>    link source to query (recalled count)
-  query list
-  source add --title --url [--abstract --content --relevance --confidence --query]
-  source fetch <url>          fetch page, extract title/meta/text (zero side-effect on failure)
-  source list | search "<q>" | show <id> | rm <id>
-  evidence add <sourceId> --quote "..." [--note --locator]
-  evidence list
-  claim add "<text>" [--confidence A|B|C]
-  claim link <claimId> <evidenceId> [--stance supports|refutes]
-  claim resolve <claimId> --as supported|refuted|contested [--note]
-  claim list
-
-${(0, fmt_1.paint)(fmt_1.C.bold, "produce", true)}     outline → section → report · spec/design（工程产出）
-  outline                    auto-outline from claims
-  section <title> --body|-f  add a section artifact
-  report                     assemble claims+evidence+sections into a report
-  spec <title> --body|-f     requirements spec artifact (R12)
-  design <title> --body|-f   design artifact (R12) --design-type ui-ux|arch|decision
-  list | show <id> | export <id> <file>
-
-${(0, fmt_1.paint)(fmt_1.C.bold, "task", true)}          任务清单（todo|doing|done 状态机，R12）
-  add "<title>" [--note ...] create a task (status todo)
-  list [--status todo|doing|done]
-  doing|done <id>            move along the state machine（勾销全程留痕）
-
-${(0, fmt_1.paint)(fmt_1.C.bold, "kb", true)}          long-term knowledge
-  add --title --body|-f [--tags --confidence]
-  import <dir|file.md>       batch markdown (frontmatter, idempotent, single tx)
-  search "<q>" | list | show <id>
-  link <a> <b> [--rel]
-  ingest <artifactId>        import a finished artifact
-  promote <noteId> [--name]  turn a note into a reusable skill
-
-${(0, fmt_1.paint)(fmt_1.C.bold, "job", true)}         batch + schedule (drive with cron: job tick)
-  add <title> -- <command> [--every <min>] [--at "YYYY-MM-DD HH:MM"]
-  list | run <id> | tick | enable <id> | disable <id> | logs
-
-${(0, fmt_1.paint)(fmt_1.C.bold, "tree / node", true)}   tech-tree node model
-  tree new <name> [--project p]      create a tree (nodes live in it)
-  tree list | tree use <name>
-
-  node add <key> [--name --kind --tier --cost --tags --payload]
-  node link <parent> <child>         [--rel prereq|unlock|excludes|enables]
-                                      [--mode AND|OR|XOR|NOT] [--optional]
-                                      [--min-level n] [--weight n]
-  node unlink <parent> <child> [--rel prereq]
-  node cond <key> --name <c>         [--kind flag|resource|level|quest|time|expr]
-                                      [--op >=|==|<=|!=|has] [--value v] [--optional]
-                                      [--op eval --value "<布尔问题>"]
-                                      [--op eval-choice --value "<问题>" --options "k=desc,..." --answer k]
-                                      [--op eval-score --value "<问题>" --levels "级0,..." --min-score n]
-                                      [--effect gate|cost_mul] [--weight n]
-  node index                         rebuild closure + topo order
-  node can <key> [--state k=v]       evaluate required vs optional gates
-                                     (--eval: eval 题型经决策模型判定；
-                                      boolean P / choice P(期望答案) / score ±1 灰带)
-  node ready [--state k=v] [--eval]  currently unlockable set
-  node path <key>                    dependency-order path to target (all locked ancestors; OR branches not optimized)
-  node parents|children <key>        direct relations
-  node ancestors|descendants <key>   transitive, via closure index
-  node list | show <key> | search "<q>" | unlock|lock <key>
-  node validate                      cycles, dangling edges, dirty index
-  node export [--out file.json]      portable JSON
-  node import --file <file.json>     [--tree name] [--merge] — strict, transactional
-
-  Writes are idempotent (claim/evidence/query/kb/job dedupe by content
-  hash); pass --force to keep a deliberate duplicate.
-
-${(0, fmt_1.paint)(fmt_1.C.bold, "webui", true)}            dashboard (zero-dependency)
-  export [--out <file>]     single-file dashboard.html (open in browser)
-  serve [--port N]          live dashboard at http://127.0.0.1:N/ (Ctrl+C to stop)
-
-${(0, fmt_1.paint)(fmt_1.C.bold, "rel", true)}             关联织物（spec R9：任意两类实体互相挂接）
-  add <src> <dst> [--rel t]   link two refs: node:key claim:id kb:id artifact:id
-                             skill:name evidence:id source:id query:id
-  rm <src> <dst> [--rel t]    unlink
-  list [--src r] [--dst r]    browse (either side filter, resolves displays)
-
-${(0, fmt_1.paint)(fmt_1.C.bold, "plugin", true)}          用户层插件分发（spec R14 L3，业务域扩展位）
-  init                       create $YGL_HOME/plugins profile
-  install <spec>             npm package / git url / local dir (auto link:)
-  remove <name> | list       manage the user layer ($YGL_HOME/ygl.user.bundle.json)
-  插件契约：export apply(ctx,config) + 可选 commands 贡献 CLI 命令组
-
-${(0, fmt_1.paint)(fmt_1.C.bold, "agent", true)}       agent-facing views
-  brief                      current project state + next actions (start here)
-  match "<task>"             which skill should handle this task
-  log                        recent events
-
-Global: --json  --no-color  --db <file>  --home <dir>
+const USAGE = `
+${(0, fmt_1.paint)(fmt_1.C.bold, "ygl-trees", true)}  猿光 · 科技树
+${(0, fmt_1.paint)(fmt_1.C.dim, "database-centric CLI: research → production → knowledge reuse", true)}
+
+  ygl-trees <group> <action> [args] [options]        add --json for machine output
+
+${(0, fmt_1.paint)(fmt_1.C.bold, "config", true)}      user-tunable settings (registry defaults + overrides)
+  list                       all keys: value + default + note
+  get <key>                  resolved value (config table > default)
+  set <key> <value>          validated against registry (type/range); events logged
+  reset <key>                drop override → back to default
+
+${(0, fmt_1.paint)(fmt_1.C.bold, "db", true)}
+  init                       create the workspace + schema
+  stats                      row counts per table
+  path                       print the database file path
+  export <file.sql> [--lean] dump ALL data tables (+ summary); --lean skips derived
+  sync pg <url>              one-way full mirror to PostgreSQL (L1, see docs/pg-compat.md)
+  migrate pg <url> [--fresh] one-time full-fidelity graduation (constraints + data, atomic)
+  dups                       list duplicate-content rows
+  reset                      delete the database (asks nothing, be careful)
+  sql "<sql>"                ad-hoc statement (can mutate — power tool, no guardrails)
+
+${(0, fmt_1.paint)(fmt_1.C.bold, "skill", true)}        L1 description / L2 body / L3 references
+  import <file.md>           import a SKILL.md (frontmatter = L1, body = L2)
+  add                        --name --description --body [-f file.md]
+  list | show <name> | rm <name> | enable <name> | disable <name>
+  match "<query>"            full-text match, prints L1 candidates for an agent
+  refs add <skill> <path> --body ...
+
+${(0, fmt_1.paint)(fmt_1.C.bold, "project", true)}
+  new <name> -q "<question>"  create + select
+  list | use <name> | show
+
+${(0, fmt_1.paint)(fmt_1.C.bold, "research", true)}    collect → screen → extract → claim
+  query add "<text>"          register a search query
+  query attach <qid> <sid>    link source to query (recalled count)
+  query list
+  source add --title --url [--abstract --content --relevance --confidence --query]
+  source fetch <url>          fetch page, extract title/meta/text (zero side-effect on failure)
+  source list | search "<q>" | show <id> | rm <id>
+  evidence add <sourceId> --quote "..." [--note --locator]
+  evidence list
+  claim add "<text>" [--confidence A|B|C]
+  claim link <claimId> <evidenceId> [--stance supports|refutes]
+  claim resolve <claimId> --as supported|refuted|contested [--note]
+  claim list
+
+${(0, fmt_1.paint)(fmt_1.C.bold, "produce", true)}     outline → section → report · spec/design（工程产出）
+  outline                    auto-outline from claims
+  section <title> --body|-f  add a section artifact
+  report                     assemble claims+evidence+sections into a report
+  spec <title> --body|-f     requirements spec artifact (R12)
+  design <title> --body|-f   design artifact (R12) --design-type ui-ux|arch|decision
+  list | show <id> | export <id> <file>
+
+${(0, fmt_1.paint)(fmt_1.C.bold, "task", true)}          任务清单（todo|doing|done 状态机，R12）
+  add "<title>" [--note ...] create a task (status todo)
+  list [--status todo|doing|done]
+  doing|done <id>            move along the state machine（勾销全程留痕）
+
+${(0, fmt_1.paint)(fmt_1.C.bold, "kb", true)}          long-term knowledge
+  add --title --body|-f [--tags --confidence]
+  import <dir|file.md>       batch markdown (frontmatter, idempotent, single tx)
+  search "<q>" | list | show <id>
+  link <a> <b> [--rel]
+  ingest <artifactId>        import a finished artifact
+  promote <noteId> [--name]  turn a note into a reusable skill
+
+${(0, fmt_1.paint)(fmt_1.C.bold, "job", true)}         batch + schedule (drive with cron: job tick)
+  add <title> -- <command> [--every <min>] [--at "YYYY-MM-DD HH:MM"]
+  list | run <id> | tick | enable <id> | disable <id> | logs
+
+${(0, fmt_1.paint)(fmt_1.C.bold, "tree / node", true)}   tech-tree node model
+  tree new <name> [--project p]      create a tree (nodes live in it)
+  tree list | tree use <name>
+
+  node add <key> [--name --kind --tier --cost --tags --payload]
+  node link <parent> <child>         [--rel prereq|unlock|excludes|enables]
+                                      [--mode AND|OR|XOR|NOT] [--optional]
+                                      [--min-level n] [--weight n]
+  node unlink <parent> <child> [--rel prereq]
+  node cond <key> --name <c>         [--kind flag|resource|level|quest|time|expr]
+                                      [--op >=|==|<=|!=|has] [--value v] [--optional]
+                                      [--op eval --value "<布尔问题>"]
+                                      [--op eval-choice --value "<问题>" --options "k=desc,..." --answer k]
+                                      [--op eval-score --value "<问题>" --levels "级0,..." --min-score n]
+                                      [--effect gate|cost_mul] [--weight n]
+  node index                         rebuild closure + topo order
+  node can <key> [--state k=v]       evaluate required vs optional gates
+                                     (--eval: eval 题型经决策模型判定；
+                                      boolean P / choice P(期望答案) / score ±1 灰带)
+  node ready [--state k=v] [--eval]  currently unlockable set
+  node path <key>                    dependency-order path to target (all locked ancestors; OR branches not optimized)
+  node parents|children <key>        direct relations
+  node ancestors|descendants <key>   transitive, via closure index
+  node list | show <key> | search "<q>" | unlock|lock <key>
+  node validate                      cycles, dangling edges, dirty index
+  node export [--out file.json]      portable JSON
+  node import --file <file.json>     [--tree name] [--merge] — strict, transactional
+
+  Writes are idempotent (claim/evidence/query/kb/job dedupe by content
+  hash); pass --force to keep a deliberate duplicate.
+
+${(0, fmt_1.paint)(fmt_1.C.bold, "webui", true)}            dashboard (zero-dependency)
+  export [--out <file>]     single-file dashboard.html (open in browser)
+  serve [--port N]          live dashboard at http://127.0.0.1:N/ (Ctrl+C to stop)
+
+${(0, fmt_1.paint)(fmt_1.C.bold, "rel", true)}             关联织物（spec R9：任意两类实体互相挂接）
+  add <src> <dst> [--rel t]   link two refs: node:key claim:id kb:id artifact:id
+                             skill:name evidence:id source:id query:id
+  rm <src> <dst> [--rel t]    unlink
+  list [--src r] [--dst r]    browse (either side filter, resolves displays)
+
+${(0, fmt_1.paint)(fmt_1.C.bold, "plugin", true)}          用户层插件分发（spec R14 L3，业务域扩展位）
+  init                       create $YGL_HOME/plugins profile
+  install <spec>             npm package / git url / local dir (auto link:)
+  remove <name> | list       manage the user layer ($YGL_HOME/ygl.user.bundle.json)
+  插件契约：export apply(ctx,config) + 可选 commands 贡献 CLI 命令组
+
+${(0, fmt_1.paint)(fmt_1.C.bold, "agent", true)}       agent-facing views
+  brief                      current project state + next actions (start here)
+  match "<task>"             which skill should handle this task
+  log                        recent events
+
+Global: --json  --no-color  --db <file>  --home <dir>
 `;
 function usage() {
     return USAGE;
@@ -256,6 +256,14 @@ async function main(argv) {
     };
     const group = args._[0];
     const action = args._[1];
+    // F1 fix (a2a review): webui serve holds its DB connection for the process
+    // lifetime — a process-level exclusive lock there would block ALL CLI
+    // commands until serve exits. SQLite WAL already permits concurrent readers
+    // + serialized writers, so serve skips the app-level lock. Short CLI
+    // commands still lock (single-writer for the brief write window).
+    if (group === "webui" && (action === "serve" || action === "export")) {
+        process.env.YGL_SERVE = "1";
+    }
     // P4 fix: --version prints the actual version number (cold-user report);
     // the parser eats --version as a flag, so check flags not positional args.
     if (args.flags.version === true || group === "version") {
@@ -307,10 +315,37 @@ async function main(argv) {
             return 1;
         }
         (0, fmt_1.bad)(ctx, `cannot open database ${file}: ${e?.message || e}`);
-        const lock = `${file}.lock`;
-        if (require("node:fs").existsSync(lock)) {
-            (0, fmt_1.out)(ctx, `  stale lock dir detected: ${lock}`);
-            (0, fmt_1.out)(ctx, `  if no other ygl-trees process is running, remove it:  rmdir "${lock}"`);
+        // F2 fix (a2a review): --json mode must stay a single parseable object —
+        // suppress the human-only lock hints. Also check PID liveness, not just
+        // directory existence (a live serve holder is NOT stale).
+        const lock = `${file}.ygllock`;
+        if (!ctx.json && require("node:fs").existsSync(lock)) {
+            const pidFile = require("node:path").join(lock, "pid");
+            let holder = "?";
+            try {
+                holder = require("node:fs").readFileSync(pidFile, "utf8").trim();
+            }
+            catch { /* */ }
+            let alive = false;
+            try {
+                process.kill(Number(holder), 0);
+                alive = true;
+            }
+            catch (err) {
+                alive = err.code === "EPERM";
+            }
+            if (alive) {
+                (0, fmt_1.out)(ctx, `  lock held by live process pid ${holder} (serve? webui dashboard)`);
+                (0, fmt_1.out)(ctx, `  to run CLI write commands, stop that process first — or use YGL_TEST=1 to bypass`);
+            }
+            else {
+                (0, fmt_1.out)(ctx, `  orphaned lock (pid ${holder} is dead) — removing: ${lock}`);
+                try {
+                    require("node:fs").rmSync(lock, { recursive: true, force: true });
+                }
+                catch { /* */ }
+                (0, fmt_1.out)(ctx, `  retry the command — the lock has been cleaned`);
+            }
         }
         return 1;
     }

package/dist/apps/cli/src/profile-boot.js

@@ -52,9 +52,17 @@ async function bootApp(opts) {
                 pluginCommands[g] = c;
         }
     }
-    // settle the service layer (one yield; direct construction stays the CLI fallback)
-    await new Promise((r) => setImmediate(r));
-    const db = app.database?.db || new db_1.DB(opts.dbFile, { lock: process.env.YGL_TEST !== '1' });
+    // settle the service layer. Cordis runs plugin apply() inside fibers — one
+    // setImmediate tick does NOT guarantee the database service has constructed;
+    // the fallback below would then double-open the DB in one process (0.65.0
+    // P0: dir-lock self-deadlock / sqlite BUSY). Wait for it, bounded; the
+    // fallback stays as crash safety if the service never comes up.
+    let db = app.database?.db;
+    for (let i = 0; i < 50 && !db; i++) {
+        await new Promise((r) => setImmediate(r));
+        db = app.database?.db;
+    }
+    db = db || new db_1.DB(opts.dbFile, { lock: process.env.YGL_TEST !== '1' });
     const store = app.research?.store || new reads_1.Store(db);
     if (startupIssues.length) {
         throw new startup_diagnostics_1.StartupError(`${startupIssues.length} plugin issue(s) during startup`, startupIssues);

package/dist/bundle/bin.cjs

@@ -550,35 +550,50 @@ CREATE UNIQUE INDEX IF NOT EXISTS uq_skill_refs ON skill_refs(skill_id, path);
 			this.path = file;
 			node_fs.mkdirSync(node_path.dirname(file), { recursive: true });
 			const useLock = opts?.lock === true;
-			const lockDir = `${file}.lock`;
+			const legacyLockDir = `${file}.lock`;
+			if (node_fs.existsSync(node_path.join(legacyLockDir, "pid"))) try {
+				node_fs.rmSync(legacyLockDir, {
+					recursive: true,
+					force: true
+				});
+			} catch {}
+			const lockDir = `${file}.ygllock`;
 			if (useLock && node_fs.existsSync(lockDir)) {
 				let holder = "unknown";
 				try {
 					holder = node_fs.readFileSync(node_path.join(lockDir, "pid"), "utf8").trim();
 				} catch {}
-				try {
-					const st = node_fs.statSync(lockDir);
-					if (Date.now() - st.mtimeMs > 9e5) node_fs.rmSync(lockDir, {
+				const mine = holder === String(process.pid);
+				let holderAlive;
+				if (mine) holderAlive = false;
+				else try {
+					process.kill(Number(holder), 0);
+					holderAlive = true;
+				} catch (e) {
+					holderAlive = e.code === "EPERM";
+				}
+				if (!holderAlive) try {
+					node_fs.rmSync(lockDir, {
 						recursive: true,
 						force: true
 					});
-					else throw new Error(`database is locked by another process (pid: ${holder}).\n  lock: ${lockDir}\n  if no other ygl-trees is running, remove it:  rmdir "${lockDir}"\n  (stale locks auto-clear after 15 minutes)`);
-				} catch (e) {
-					if (String(e.message).includes("locked by another")) throw e;
-					throw new Error(`database is locked: ${lockDir} (holder unreadable)`);
-				}
+				} catch {}
+				else throw new Error(`database is locked by another process (pid: ${holder}).\n  lock: ${lockDir}\n  if this is a webui serve dashboard, it shares WAL safely — CLI reads work,\n  write commands need the serve process stopped (or YGL_TEST=1 to bypass)\n  if no other ygl-trees is running, remove it:  rmdir "${lockDir}"`);
 			}
 			if (useLock) try {
 				node_fs.mkdirSync(lockDir, { recursive: true });
 				node_fs.writeFileSync(node_path.join(lockDir, "pid"), String(process.pid));
-				process.on("exit", () => {
-					try {
+				const cleanup = () => {
+					for (let i = 0; i < 3; i++) try {
 						node_fs.rmSync(lockDir, {
 							recursive: true,
 							force: true
 						});
+						return;
 					} catch {}
-				});
+				};
+				process.on("beforeExit", cleanup);
+				process.on("exit", cleanup);
 			} catch {}
 			this.db = new node_sqlite3_wasm.Database(file);
 			this.db.exec("PRAGMA journal_mode=WAL");
@@ -589,7 +604,7 @@ CREATE UNIQUE INDEX IF NOT EXISTS uq_skill_refs ON skill_refs(skill_id, path);
 		/** Release the write lock (called by close() and process exit). */
 		releaseLock() {
 			try {
-				const lockDir = `${this.path}.lock`;
+				const lockDir = `${this.path}.ygllock`;
 				if (node_fs.existsSync(lockDir)) node_fs.rmSync(lockDir, {
 					recursive: true,
 					force: true
@@ -599,7 +614,7 @@ CREATE UNIQUE INDEX IF NOT EXISTS uq_skill_refs ON skill_refs(skill_id, path);
 		/** Static: force-release a lock (for cleanup hooks). */
 		static releaseLockFor(file) {
 			try {
-				const lockDir = `${file}.lock`;
+				const lockDir = `${file}.ygllock`;
 				if (node_fs.existsSync(lockDir)) node_fs.rmSync(lockDir, {
 					recursive: true,
 					force: true
@@ -919,8 +934,14 @@ function parse(argv) {
 	const flags = {};
 	let rest = false;
 	const takesValue = (name) => !BOOLEAN_FLAGS.has(name);
-	/** `-1` looks like a flag but is a negative number — accept it as a value. */
-	const isValue = (s) => !s.startsWith("-") || /^-\d+(\.\d+)?$/.test(s);
+	/** A token is a flag boundary only if this parser could itself consume it as
+	*  a flag: `--`, a long `--name`, or a single-letter `-x`. Any other token
+	*  starting with `-` (e.g. `- 双平台…`, `-1`, `-abc`) can never be parsed as
+	*  a flag, so a value-taking flag safely claims it — `--quote "- text"`
+	*  keeps its value instead of collapsing to `true` and leaking the text
+	*  into positionals. */
+	const looksLikeFlag = (s) => s === "--" || s.startsWith("--") || /^-[A-Za-z]$/.test(s);
+	const isValue = (s) => !looksLikeFlag(s);
 	for (let i = 0; i < argv.length; i++) {
 		const a = argv[i];
 		if (rest) {
@@ -973,7 +994,8 @@ var DatabaseService = class extends _deepseek_ai_cordis.Service {
 	db;
 	constructor(ctx, dbFile) {
 		super(ctx, "database");
-		this.db = new DB(dbFile, { lock: process.env.YGL_TEST !== "1" });
+		const lock = process.env.YGL_TEST !== "1" && process.env.YGL_SERVE !== "1";
+		this.db = new DB(dbFile, { lock });
 	}
 };
 function apply$3(ctx, config) {
@@ -2655,7 +2677,8 @@ function pnpm(home, args) {
 			q(exe),
 			...args.map(q),
 			"--dir",
-			q(profileDir(home))
+			q(profileDir(home)),
+			"--ignore-workspace"
 		].join(" "), {
 			stdio: "pipe",
 			shell: true
@@ -2665,7 +2688,8 @@ function pnpm(home, args) {
 	(0, node_child_process.execFileSync)(pm, [
 		...args,
 		"--dir",
-		profileDir(home)
+		profileDir(home),
+		"--ignore-workspace"
 	], { stdio: "pipe" });
 }
 function resolvePm(pm) {
@@ -2911,8 +2935,12 @@ async function bootApp(opts) {
 		}
 		for (const [g, c] of Object.entries(up.commands || {})) if (typeof c.run === "function") pluginCommands[g] = c;
 	}
-	await new Promise((r) => setImmediate(r));
-	const db = app.database?.db || new DB(opts.dbFile, { lock: process.env.YGL_TEST !== "1" });
+	let db = app.database?.db;
+	for (let i = 0; i < 50 && !db; i++) {
+		await new Promise((r) => setImmediate(r));
+		db = app.database?.db;
+	}
+	db = db || new DB(opts.dbFile, { lock: process.env.YGL_TEST !== "1" });
 	const store = app.research?.store || new Store(db);
 	if (startupIssues.length) throw new StartupError(`${startupIssues.length} plugin issue(s) during startup`, startupIssues);
 	return {
@@ -3802,7 +3830,11 @@ var init_entities$1 = __esmMin((() => {
 		type: "text",
 		nullable: true
 	}), __decorateMetadata("design:type", String)], Claim.prototype, "updated", void 0);
-	__decorate([(0, typeorm.JoinColumn)({ name: "project_id" }), __decorateMetadata("design:type", typeof Project === "undefined" ? Object : Project)], Claim.prototype, "project", void 0);
+	__decorate([
+		(0, typeorm.ManyToOne)(() => Project, (p) => p.claims, { createForeignKeyConstraints: false }),
+		(0, typeorm.JoinColumn)({ name: "project_id" }),
+		__decorateMetadata("design:type", typeof Project === "undefined" ? Object : Project)
+	], Claim.prototype, "project", void 0);
 	__decorate([(0, typeorm.OneToMany)(() => ClaimEvidence, (ce) => ce.claim, { createForeignKeyConstraints: false }), __decorateMetadata("design:type", Array)], Claim.prototype, "claimEvidence", void 0);
 	Claim = __decorate([(0, typeorm.Entity)({ name: "claims" })], Claim);
 	ClaimEvidence = class ClaimEvidence {
@@ -4467,10 +4499,14 @@ async function taskSetStatus(ds, taskId, status) {
 			meta = rows[0].meta ? JSON.parse(rows[0].meta) : {};
 		} catch {}
 		const from = meta.status || "todo";
-		await mgr.query(`UPDATE artifacts SET meta=? WHERE id=?`, [JSON.stringify({
-			...meta,
-			status
-		}), taskId]);
+		await mgr.query(`UPDATE artifacts SET meta=?, updated=? WHERE id=?`, [
+			JSON.stringify({
+				...meta,
+				status
+			}),
+			nowIso(),
+			taskId
+		]);
 		await logEvent$1(mgr, "task.status", "task", taskId, `${from} → ${status}`, status === "done" ? "info" : "info");
 		return {
 			id: taskId,
@@ -7196,7 +7232,7 @@ async function importTree(ds, spec, opts = {}) {
 			const pid = nodeId.get(String(e.parent));
 			const cid = nodeId.get(String(e.child));
 			await mgr.query(`INSERT INTO node_edges(id,tree_id,parent_id,child_id,rel,mode,required,min_level,weight,note,created)
-         VALUES(?,?,?,?,?,?,?,?,?,?)
+         VALUES(?,?,?,?,?,?,?,?,?,?,?)
          ON CONFLICT(parent_id,child_id,rel) DO UPDATE SET
            mode=excluded.mode, required=excluded.required, min_level=excluded.min_level,
            weight=excluded.weight, note=excluded.note`, [
@@ -7215,7 +7251,8 @@ async function importTree(ds, spec, opts = {}) {
 				e.required === false ? 0 : 1,
 				Number(e.min_level ?? 1),
 				Number(e.weight ?? 1),
-				String(e.note || "")
+				String(e.note || ""),
+				nowIso()
 			]);
 		}
 		for (const c of conds) {
@@ -10005,8 +10042,12 @@ function run(env, action, rest, args) {
 		status: "pass",
 		detail: configRows.length === 0 ? "no overrides (all defaults)" : `${configRows.length} override(s), all valid`
 	});
-	const lockPath = `${db.path}.lock`;
-	const hasLock = require("node:fs").existsSync(lockPath);
+	const lockPath = `${db.path}.ygllock`;
+	let lockHolder = "";
+	try {
+		lockHolder = require("node:fs").readFileSync(`${lockPath}/pid`, "utf8").trim();
+	} catch {}
+	const hasLock = require("node:fs").existsSync(lockPath) && lockHolder !== String(process.pid);
 	checks.push({
 		name: "stale_lock",
 		status: hasLock ? "warn" : "pass",
@@ -10080,8 +10121,12 @@ function run(env, action, rest, args) {
 			db.run("UPDATE meta SET value='0' WHERE key='index_dirty'");
 			fixes.push("index dirty flag cleared (run: ygl-trees node index)");
 		}
-		const lockDir = `${env.db.path}.lock`;
-		if (node_fs.existsSync(lockDir)) try {
+		const lockDir = `${env.db.path}.ygllock`;
+		let holder = "";
+		try {
+			holder = node_fs.readFileSync(`${lockDir}/pid`, "utf8").trim();
+		} catch {}
+		if (node_fs.existsSync(lockDir) && holder !== String(process.pid)) try {
 			node_fs.rmSync(lockDir, {
 				recursive: true,
 				force: true
@@ -10309,6 +10354,7 @@ async function main(argv) {
 	};
 	const group = args._[0];
 	const action = args._[1];
+	if (group === "webui" && (action === "serve" || action === "export")) process.env.YGL_SERVE = "1";
 	if (args.flags.version === true || group === "version") {
 		out(ctx, appVersion());
 		return 0;
@@ -10351,10 +10397,33 @@ async function main(argv) {
 			return 1;
 		}
 		bad(ctx, `cannot open database ${file}: ${e?.message || e}`);
-		const lock = `${file}.lock`;
-		if (require("node:fs").existsSync(lock)) {
-			out(ctx, `  stale lock dir detected: ${lock}`);
-			out(ctx, `  if no other ygl-trees process is running, remove it:  rmdir "${lock}"`);
+		const lock = `${file}.ygllock`;
+		if (!ctx.json && require("node:fs").existsSync(lock)) {
+			const pidFile = require("node:path").join(lock, "pid");
+			let holder = "?";
+			try {
+				holder = require("node:fs").readFileSync(pidFile, "utf8").trim();
+			} catch {}
+			let alive = false;
+			try {
+				process.kill(Number(holder), 0);
+				alive = true;
+			} catch (err) {
+				alive = err.code === "EPERM";
+			}
+			if (alive) {
+				out(ctx, `  lock held by live process pid ${holder} (serve? webui dashboard)`);
+				out(ctx, `  to run CLI write commands, stop that process first — or use YGL_TEST=1 to bypass`);
+			} else {
+				out(ctx, `  orphaned lock (pid ${holder} is dead) — removing: ${lock}`);
+				try {
+					require("node:fs").rmSync(lock, {
+						recursive: true,
+						force: true
+					});
+				} catch {}
+				out(ctx, `  retry the command — the lock has been cleaned`);
+			}
 		}
 		return 1;
 	}