fix(corecmd): support strongly-typed DTOs in event/auto wait modes

waitResource previously asserted result.Data() to map[string]any, which caused event mode and auto mode to fail with 'data is not an object' when commands returned strongly-typed DTOs (struct or struct pointer). Now normalizes via JSON round-trip for non-map types, preserving the fast path for map[string]any. Added regression tests covering struct values, struct pointers, nested dotted queries, and error cases.
fix: remove stale allowlist entry for drive_tree_list.py
2026-08-19 15:14:22 +08:00 · 2026-08-19 15:02:54 +08:00 · 2026-08-19 14:29:57 +08:00 · 2026-08-19 14:22:29 +08:00 · 2026-08-19 14:17:11 +08:00 · 2026-08-19 11:21:16 +08:00
502 changed files with 10693 additions and 86750 deletions
@@ -25,9 +25,7 @@ category: Added

 发布 beta 时，`scripts/release/prepare-changelog.sh` 会按分类和文件名稳定排序，
 将未归档 fragments 汇总为唯一的版本章节，并移动到
-`.changes/released/<version>/`。beta 发布后若有新 fragments 合入并直接准备 stable，
-stable 封板会把它们追加到明确的 post-beta 小节，并归档到正式版本目录；没有新
-fragments 时仍只生成原有 beta 晋级模板。因此 release-seal PR 是唯一会修改
+`.changes/released/<version>/`。因此 release-seal PR 是唯一会修改
 `CHANGELOG.md` 的 PR；它同时归档已消费的 fragments，供审计追溯。
 归档只能在同一个 release-seal PR 中以原样移动完成；CI 会拒绝直接修改、
 删除或重写已归档文件。
@@ -1,14 +0,0 @@
---
-category: Changed
---
-
- **Attendance and Mail Shortcuts** (#1045) — publishes only capabilities with
-  strict response, identity, pagination, and real-data verification while
-  retaining historical CLI discovery and argument compatibility for commands
-  that remain unavailable to agents. Mailbox auto-resolution now accepts both
-  reviewed string and object response shapes, and Attendance date ranges cover
-  the complete requested end date without dropping cross-midnight punches whose
-  actual check time is inside the requested range. The schedule query remains
-  CLI-compatible but is withheld from the Agent catalog because its downstream
-  service returns a successful process exit with a null body for both populated
-  and empty ranges.
@@ -1,5 +0,0 @@
---
-category: Changed
---
-
- **Chat group roles** (#1058) — exposes the single-value `--role-id` flag for assigning one custom group role while preserving hidden `--role-ids` compatibility.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **招聘职位管理** (#976) — 新增招聘职位列表、详情查询和职位创建命令。
@@ -1,6 +0,0 @@
---
-category: Fixed
---
-
- **Chat user mentions** — preserves literal `<@openDingTalkId>` tokens in current-user Markdown messages and rejects mismatches between message-body mentions and mention flags before sending.
- **Chat direct media** — uses the IM upload target field for current-user direct file, audio, and video uploads, then uses the Chat receiver field for final message delivery.
@@ -1,5 +0,0 @@
---
-category: Changed
---
-
- **CLI compatibility governance** — adds a reviewed two-stage path for hiding retained legacy commands or optional `NoOpt=true` boolean flags from Help and Schema when their activated capability moves to a dedicated command, with legacy-leaf, complete parameter/constant mapping, durable runtime constant evidence, protected framework bridges, dry-run preservation, parameter-collision, and fail-closed required-parameter checks.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **OA admin approval query** — `oa approval list-by-admin` queries approval instances of a template with admin scope, with simple flags and an advanced `--request` mode; `startTime`/`endTime` use `yyyy-MM-dd HH:mm:ss` strings per the 2026-08 MCP contract update (ISO-8601 flag inputs auto-convert), and pageSize/time format are validated client-side with localized errors.
@@ -1,5 +0,0 @@
---
-category: Fixed
---
-
- **Shortcut functional workflows** (#1050) — fixes truthful Drive push/sync previews, strict AITable write verification and deletion accounting, lossless Wiki feeds, and false-success handling across task, Contact, Minutes, and Wiki operations.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **Chat personal emotions** — adds `chat emotion list`, `chat emotion send`, and `chat emotion favorite` for current-user personal favorite emotion listing, sending, and favoriting.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **Minutes, DingTalk tasks, and Wiki parameter aliases** — adds reviewed parameter-name normalization, ambiguity guards, and end-to-end payload coverage for the three products.
@@ -1,7 +0,0 @@
---
-category: Fixed
---
-
- **Calendar empty windows** (#1074) — returns a legitimate empty result when the service emits its exact exhausted empty-event sentinel.
- **Task update verification** (#1074) — compares due-time readback as exact milliseconds so committed updates are no longer reported as failures.
- **Comment reaction validation** (#1074) — narrows accepted reaction input to reviewed DingTalk emoji names and rejects Unicode emoji and unsupported names such as `like` and `heart` before the RPC.
@@ -1,5 +0,0 @@
---
-category: Changed
---
-
- **OA, DING, and Report shortcuts** — hardens response, identity, pagination, and confirmation contracts; publishes verified form search, receiver status, and report read workflows while withholding shortcuts that lack trustworthy downstream evidence.
@@ -1,11 +0,0 @@
---
-category: Fixed
---
-
- **OAuth refresh falls back to the organization mirror** — when the server rejects the
-  current identity's `refresh_token` with the reviewed `invalidParameter.authCode.notFound`
-  business code, `dws` now retries once with the still-valid token mirrored in the same
-  organization's slot (same corp, matching or backfilled user identity) before giving up,
-  and writes the rotated credential back to both the identity and the organization slots so
-  the fallback stays usable on later refreshes. Transient failures and direct-mode HTTP
-  rejections without a reviewed business code do not trigger the fallback.
@@ -1,5 +0,0 @@
---
-category: Changed
---
-
- **Stable release sealing** — directly preparing a stable release now renders and archives release fragments merged after its beta baseline, avoiding a forced extra beta solely to consume pending notes.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **Drive permission get-setting** (#1056) — adds `dws drive permission get-setting --node <ID>` to inspect a document-space node's permission settings (permission mode, share scope, and permission policies) in one call.
@@ -1,6 +0,0 @@
---
-category: Added
---
-
- **Whiteboard shortcuts** (#1082) — adds strict query and confirmed update workflows with stable-target receipts and exact readback verification.
- **Sheet shortcut hardening** (#1082) — makes worksheet listing and cell-range reads fail closed on malformed, ambiguous, or truncated responses, publishes a closed reviewed output shape, and preserves non-executing `--dry-run` previews for range reads.
@@ -1,5 +0,0 @@
---
-category: Changed
---
-
- **AiSearch and Contact shortcuts** (#1083) — adds strict people search and reviewed unified results; people results must use the live-reviewed `person` source, and exact mobile lookups normalize accepted formatting before calling the dedicated mobile interface. Agent/public discovery keeps `contact +list-roles`, `contact +list-roster-fields`, `contact +get-roster`, and incomplete Live routes unavailable rather than publishing ambiguous results, while the historical Contact CLI commands retain legacy MCP execution and real error propagation. The legacy role-list projection preserves the service's reviewed null placeholder without exposing that ambiguous row through Agent Result contracts.
@@ -1,24 +0,0 @@
---
-category: Changed
---
-
- **Permission error guidance and error rendering** (#1085) —
-  permission-denied responses now exit with the `AUTH_PERMISSION_DENIED` code
-  instead of a generic business-error rendering; document/wiki-specific errors
-  (the drive-specific codes `forbidden.accessDenied` / `forbidden.no.auth`,
-  or the role-threshold wording like
-  “需要您具备 MANAGER 及以上角色”) carry apply-permission guidance
-  (`dws drive permission apply-info` / `dws drive permission apply`), while
-  permission failures carrying only generic code names (`FORBIDDEN`,
-  `NO_PERMISSION` — also returned by attendance and event-subscription tools)
-  or other products' wording keep their product-specific or
-  product-neutral suggestion instead of a misleading document-permission hint;
-  member-validation failures such as
-  “用户不存在/不属于当前组织” are classified as tool errors with a
-  `--members`-with-`corpId` suggestion instead of a misleading
-  resource-not-found error; business error output now surfaces the backend
-  message with `code`/`logId` appended for traceability; and the
-  `update_permission` / `remove_permission` / `update_member` /
-  `remove_member` tools — whose servers return a literal `null` on successful
-  no-payload writes — now render `{}` so downstream JSON consumers do not fail
-  parsing `null`; other tools keep raw `null` output unchanged.
@@ -1,22 +0,0 @@
---
-category: Added
---
-
- **Permission and member list pagination** (#1085) — `drive/doc permission
-  list` and `wiki member list` now accept `--next-token` to follow the
-  server-side cursor (output carries `totalCount`/`hasMore`/`nextToken`) and
-  map `--limit` to `pageSize` capped at 50 instead of the rejected `maxResults
-  200` path; `permission add/update/remove` and `wiki member add/update/remove`
-  additionally accept a `--members` JSON array covering USER/DEPT/CONVERSATION/TAG
-  grantee types. The optional `--notify` defaults to `false` and is omitted from
-  the server request unless passed explicitly, so member grants no longer notify
-  recipients by default. These commands also declare cursor pagination
-  (`next-token`) in the Agent schema contract, mirroring the internal CLI parity
-  change. Because a single batch remove can revoke access for up to 30
-  USER/DEPT/CONVERSATION/TAG members — where departments, chats, and role
-  groups can indirectly affect many more users — `drive/doc permission
-  remove` and `wiki member remove` now declare
-  `confirmation=user_required` and gate the actual tool call behind user
-  confirmation (`--yes`, an interactive yes, or `--dry-run` preview); their
-  confirmation-gate failure now also passes through verbatim instead of being
-  reclassified as a permission-denied or unclassified error.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **Agoal scorecard search-entities** — `dws agoal scorecard search-entities` searches scorecard metrics and key items by keyword, returning matching entity info (scorecard ID, entity ID, entity type, title, owning team) with optional `--page`/`--page-size` pagination.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **AITable datasource shortcuts** — adds 7 shortcuts for datasource sync management (`+datasource-create`, `+datasource-update`, `+datasource-sync`, `+datasource-sync-status`, `+datasource-get-config`, `+datasource-list-sources`, `+datasource-get-fields`) and updates the `dingtalk-aitable` skill with routing rules and a new `aitable-datasource.md` reference guide.
@@ -1,13 +0,0 @@
---
-category: Added
---
-
- **Doc public-link and historical-version reads** — `dws doc read` forwards
-  the reviewed `password` (internet-public documents with password protection)
-  and `historyVersion` (read content as of a listed historical version; `0`
-  denotes the document's initial version) parameters on the markdown, JSONML,
-  and scope read paths via `--password` / `--version`; `dws doc +fetch` gains
-  `--password` and `--version` with the same `historyVersion` forwarding, while
-  `--revision` stays rejected with explicit guidance: revision is the document
-  edit revision returned by JSONML reads for `+update --expected-revision`
-  conditional writes, not a historical version number.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **Edu & College vendor extensions** — adds five hidden vendor extension commands for education scenarios: `dws edu-contact` (school/class/family/teacher contact management), `dws edu-group` (student/class group lifecycle), `dws edu-app` (homework, notices, report cards, diplomas, class circles), `dws edu-familygroup` (family group management, child binding, app permissions), and `dws college-contact` (university dept/employee/alumni/graduate management). All route to dedicated MCP servers via `callMCPToolOnServer`.
@@ -1,5 +0,0 @@
---
-category: Fixed
---
-
- **Legacy global slot recovery** — recovers a rejected identity refresh from the legacy global keychain slot when the organization mirror is absent, with strict corp/user matching so blank-user legacy tokens only recover for single-account organizations.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **OA approval attachment upload** — `dws oa approval attachment upload --file <path>` uploads a local file as an approval attachment in one command: it initializes the upload credential (MCP `oa/init_attachment_upload_info`), HTTP PUTs the file to OSS, then commits it (MCP `oa/commit_attachment_upload_info`). `--file-name` defaults to the file's base name and `--md5` is auto-computed when omitted.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **Sheet floating images** — supports creating or replacing a floating image directly from a local file with `create-float-image --file` and `update-float-image --file`, while retaining the existing `--src` workflow.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **Sheet revision changesets** — adds read-only commands for querying the current workbook revision and reviewing Agent-readable changes between revisions, with guidance for distinguishing revisions from saved history versions and safely selecting rollback targets.
@@ -0,0 +1,26 @@
+---
+category: Added
+---
+
+- **Wait framework capability** — adds the reviewed `Contract.Wait`
+  declaration (`contract.WaitSpec`) with three execution modes: `poll`
+  (cadence-poll the leaf's `WaitPoll` hook), `event` (consume the leaf's
+  `WaitEvents` push stream, correlate events to the accepted resource via
+  `match_field`/`resource_query`, apply the same terminal map), and `auto`
+  (event first, fall back to polling when the stream ends or the
+  subscription fails — one deadline spans both phases). Declared commands
+  must use the `ResultInvoke` dispatcher; mode and hooks are paired at
+  construction (poll↔WaitPoll, event↔WaitEvents, auto↔both; surplus hooks
+  are rejected too). Declared commands register `--wait` /
+  `--wait-timeout` (framework-owned flags that never enter MCP toolArgs);
+  undeclared commands reject the flags as unknown. The wait phase closes
+  the unified envelope exactly once: terminal success → `success`,
+  terminal failure → `failure` with new wire-stable `error.type: "wait"`
+  (exit code 8), timeout → `pending` with `meta.operation.timed_out: true`
+  and the last observed state (exit 0). Deadline exhaustion during a poll,
+  during event consumption, or between polls always closes as timed-out
+  pending, never as a poll/stream failure; a correlated event with an
+  unknown status fails closed exactly like a poll. The capability is
+  projected into the Schema catalog (`wait` key) alongside `dry_run`. No
+  business command declares it yet; approval/export/batch adoption lands
+  separately.
@@ -512,12 +512,6 @@ jobs:
        if: steps.classify.outputs.changelog_only != 'true' && steps.classify.outputs.docs_only != 'true'
        run: node .github/reviewer-routing.test.js

-      - name: Test npm installer smoke (prune, backup, publish)
-        if: steps.classify.outputs.changelog_only != 'true' && steps.classify.outputs.docs_only != 'true'
-        env:
-          XDG_CONFIG_HOME: ""
-        run: node test/scripts/install_js_smoke.mjs
-
  test-focused:
    name: "Test (focused: ${{ matrix.shard }})"
    needs: lint
@@ -534,8 +528,7 @@ jobs:
    # where the Schema partition alone owned most of the wall clock. The
    # app-<partition> names are pinned to the helper's partition set by
    # TestCIAppRacePartitionMatrixMatchesHelper, so a partition can never lose
-    # its job silently. The CrossPlatformCoverage-heavy C range is split again
-    # to retain headroom on runners reclaimed near the five-minute mark.
+    # its job silently.
    timeout-minutes: 20
    strategy:
      fail-fast: false
@@ -543,11 +536,7 @@ jobs:
        shard:
          - app-schema
          - app-a-b
-          - app-c-a-l
-          - app-c-m-o
-          - app-c-p-r
-          - app-c-s-z
-          - app-c-other
+          - app-c
          - app-d-r
          - app-s-z-example-fuzz
          - generators
@@ -622,13 +611,7 @@ jobs:

      - name: Install archive tooling
        if: ${{ matrix.shard == 'release-scripts' && steps.select.outputs.affected == 'true' }}
-        run: |
-          if command -v zip >/dev/null && command -v unzip >/dev/null; then
-            echo "zip and unzip are already available"
-          else
-            sudo apt-get update
-            sudo apt-get install -y zip unzip
-          fi
+        run: sudo apt-get update && sudo apt-get install -y zip unzip

      - name: Test shard with Race Detection
        if: ${{ steps.select.outputs.affected == 'true' }}
@@ -683,8 +666,7 @@ jobs:
    # partitions run concurrently and each releases its framework registries
    # when the process exits; cli/smoke need headroom beyond go test -timeout for
    # setup + assembly. The app-<partition> names are pinned to the helper's
-    # partition set by TestCIAppRacePartitionMatrixMatchesHelper. The
-    # CrossPlatformCoverage-heavy C range is split again for runner headroom.
+    # partition set by TestCIAppRacePartitionMatrixMatchesHelper.
    timeout-minutes: 20
    strategy:
      fail-fast: false
@@ -692,11 +674,7 @@ jobs:
        shard:
          - app-schema
          - app-a-b
-          - app-c-a-l
-          - app-c-m-o
-          - app-c-p-r
-          - app-c-s-z
-          - app-c-other
+          - app-c
          - app-d-r
          - app-s-z-example-fuzz
          - generators
@@ -773,13 +751,7 @@ jobs:
          go-version-file: go.mod

      - name: Install archive tooling
-        run: |
-          if command -v zip >/dev/null && command -v unzip >/dev/null; then
-            echo "zip and unzip are already available"
-          else
-            sudo apt-get update
-            sudo apt-get install -y zip unzip
-          fi
+        run: sudo apt-get update && sudo apt-get install -y zip unzip

      - name: Test release scripts
        shell: bash
@@ -1157,13 +1129,7 @@ jobs:
          go-version-file: go.mod

      - name: Install archive tooling
-        run: |
-          if command -v zip >/dev/null && command -v unzip >/dev/null; then
-            echo "zip and unzip are already available"
-          else
-            sudo apt-get update
-            sudo apt-get install -y zip unzip
-          fi
+        run: sudo apt-get update && sudo apt-get install -y zip unzip

      - name: Build
        run: make build
@@ -1214,13 +1180,7 @@ jobs:
          go-version-file: go.mod

      - name: Install archive tooling
-        run: |
-          if command -v zip >/dev/null && command -v unzip >/dev/null; then
-            echo "zip and unzip are already available"
-          else
-            sudo apt-get update
-            sudo apt-get install -y zip unzip
-          fi
+        run: sudo apt-get update && sudo apt-get install -y zip unzip

      - name: Run policy and shortcut coverage
        run: |
@@ -1301,13 +1261,7 @@ jobs:

      - name: Install archive tooling
        if: needs.lint.outputs.full_suite == 'true' && steps.baseline-cache.outputs.cache-hit != 'true'
-        run: |
-          if command -v zip >/dev/null && command -v unzip >/dev/null; then
-            echo "zip and unzip are already available"
-          else
-            sudo apt-get update
-            sudo apt-get install -y zip unzip
-          fi
+        run: sudo apt-get update && sudo apt-get install -y zip unzip

      - name: Run baseline unit tests with coverage
        if: steps.baseline-cache.outputs.cache-hit != 'true'
@@ -1599,10 +1553,7 @@ jobs:
    name: Policy
    needs: lint
    runs-on: ubuntu-latest
-    # Full policy regenerates and validates the runtime Schema several times.
-    # Keep job-level headroom for large reviewed command-surface additions;
-    # individual policy gates retain their own fail-closed checks.
-    timeout-minutes: 15
+    timeout-minutes: 10
    steps:
      - name: Check out repository
        uses: actions/checkout@v4
@@ -14,12 +14,9 @@ jobs:
        uses: actions/github-script@v7
        with:
          script: |
-            const webhooks = [
-              process.env.DINGTALK_WEBHOOK,
-              process.env.DINGTALK_WEBHOOK_SECONDARY
-            ].filter(Boolean);
-            if (webhooks.length === 0) {
-              console.log('⚠️ No DingTalk webhook configured, skipping notification');
+            const webhook = process.env.DINGTALK_WEBHOOK;
+            if (!webhook) {
+              console.log('⚠️ DINGTALK_WEBHOOK not set, skipping notification');
              return;
            }
            
@@ -42,15 +39,12 @@ jobs:
              }
            };
            
-            await Promise.all(webhooks.map(webhook =>
-              fetch(webhook, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify(message)
-              })
-            ));
+            await fetch(webhook, {
+              method: 'POST',
+              headers: { 'Content-Type': 'application/json' },
+              body: JSON.stringify(message)
+            });
            
-            console.log(`✅ DingTalk notification sent to ${webhooks.length} webhook(s)`);
+            console.log('✅ DingTalk notification sent');
        env:
          DINGTALK_WEBHOOK: ${{ secrets.DINGTALK_WEBHOOK }}
-          DINGTALK_WEBHOOK_SECONDARY: ${{ secrets.DINGTALK_WEBHOOK_SECONDARY }}
@@ -2698,11 +2698,9 @@ jobs:
              ;;
            compatibility)
              test -n "$PREVIOUS_STABLE"
-              "$GITHUB_WORKSPACE/tmp/trusted-release-tooling/scripts/release/check-release-compatibility.sh" \
-                --repo-root "$GITHUB_WORKSPACE" \
+              ./scripts/policy/check-command-compatibility.sh \
                --base-ref HEAD \
-                --stable-ref "$PREVIOUS_STABLE" \
-                --candidate-ref HEAD
+                --stable-ref "$PREVIOUS_STABLE"
              ;;
            e2e)
              bash scripts/dev/test-multi-profile-e2e.sh
@@ -74,9 +74,9 @@ coverage is additionally selected for platform-sensitive code.
   `make authoritative-interface-integrity BASE_REF=<merge-base> STABLE_REF=<latest-GA-tag> CANDIDATE_REF=<candidate-sha>`.
   The Make target delegates to the authoritative wrapper; CI does not invoke a
   second comparator or the legacy fixture checker. See
-   [CLI Help / Schema compatibility migration governance](docs/cli-interface-flag-migrations.md)
+   [CLI flag compatibility migration governance](docs/cli-interface-flag-migrations.md)
   for the reviewed two-stage `pending` → `consumed` lifecycle.
-   Agent-visible flag or command-path migrations must also run
+   Agent-visible flag migrations must also run
   `make schema-compatibility BASE_REF=<merge-base> STABLE_REF=<latest-GA-tag> CANDIDATE_REF=<candidate-sha>`;
   it consumes the same base-owned ledger rather than a second exception list.
 5. Run `./scripts/policy/check-generated-drift.sh` when generated artifacts may
@@ -1,33 +1,33 @@
 class DingtalkWorkspaceCliBeta < Formula
  desc "Automate DingTalk workspace tasks from the terminal (beta channel)"
  homepage "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli"
-  version "1.0.60-beta.2"
+  version "1.0.59-beta.3"
  license "Apache-2.0"
  keg_only "it is the beta channel and conflicts with dingtalk-workspace-cli"

  on_macos do
    if Hardware::CPU.arm?
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.60-beta.2/dws-darwin-arm64.tar.gz"
-      sha256 "e7776807f0664cbf0d0728cc236f2415c0981eb8d6557a897d2eeee708641b1d"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.59-beta.3/dws-darwin-arm64.tar.gz"
+      sha256 "9c99adcefd9104368eb443f0a1b4af8e7aceaa1ffdd4462e486854c1692bb6ce"
    else
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.60-beta.2/dws-darwin-amd64.tar.gz"
-      sha256 "3004474df3cfb529719348f02c9f2f39afa88f0fca469fe8303a9ebe0f3a0034"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.59-beta.3/dws-darwin-amd64.tar.gz"
+      sha256 "f5cc8efb1f982d68ae549190fd683292359c2ab542b532fa52bb35e6b5c049af"
    end
  end

  on_linux do
    if Hardware::CPU.arm?
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.60-beta.2/dws-linux-arm64.tar.gz"
-      sha256 "6386885d10f149c8c555031dda4cf07bf34e1e9daad61d4cd948b92d3c7b7bad"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.59-beta.3/dws-linux-arm64.tar.gz"
+      sha256 "7a4efd04b417ce8013b1e431274b396179958da244164f59974358ba327ff093"
    else
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.60-beta.2/dws-linux-amd64.tar.gz"
-      sha256 "5c94c2af269d2fe5a79a400d4fa3af267a86d6ab21b01a24ede1d29514a6eaef"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.59-beta.3/dws-linux-amd64.tar.gz"
+      sha256 "90181e8f2e9010c1943a5773c3d45d7d3ac85d6bc93e18a9aaa7c69909e553d7"
    end
  end

  resource "skills" do
-    url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.60-beta.2/dws-skills.zip"
-    sha256 "c3bd917f1b44a978ba2a9fbe95c5d0910ccf75f870f1c9b0dc356262ab1080c5"
+    url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.59-beta.3/dws-skills.zip"
+    sha256 "e7028914a4a826af9b18ed4922d68fa8f279473817fed4f305465bc8a7aad363"
  end

  def install
@@ -1,33 +1,33 @@
 class DingtalkWorkspaceCli < Formula
  desc "Automate DingTalk workspace tasks from the terminal"
  homepage "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli"
-  version "1.0.59"
+  version "1.0.58"
  license "Apache-2.0"


  on_macos do
    if Hardware::CPU.arm?
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.59/dws-darwin-arm64.tar.gz"
-      sha256 "61135a2a9286204ce060847e653c63c1e9784a0fa631bb7e0563b90628762a35"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.58/dws-darwin-arm64.tar.gz"
+      sha256 "7d98599f90cae9d42b51ff2863efc87dbfb4a3176ff3c84fc2216110c0157a70"
    else
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.59/dws-darwin-amd64.tar.gz"
-      sha256 "fd14b0b1a1475891fb243bf6453857a1044ab5a40bcf7dc1c7c795f57e5b03ba"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.58/dws-darwin-amd64.tar.gz"
+      sha256 "4c12e35e5bf7e0905812cd42dc94a5345068a2c16e306bb50b13c5c78b5cb95d"
    end
  end

  on_linux do
    if Hardware::CPU.arm?
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.59/dws-linux-arm64.tar.gz"
-      sha256 "5bfe9ac7d1798b028f0fad579bbdffec5898e2fb16ee36f5766ab58e208abd50"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.58/dws-linux-arm64.tar.gz"
+      sha256 "5ef6bde24bc3db6a11a0f1d0b3343a048956b2cbcf6cd3409a037fb6ba425489"
    else
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.59/dws-linux-amd64.tar.gz"
-      sha256 "be1eb9a1f8fc5048e578b5b0bde212fc90baca0f289236c7c333d824bd869cf3"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.58/dws-linux-amd64.tar.gz"
+      sha256 "3ccadcc6f070a39d2b2ba20429a4fcdc2f21639bf79f34361dc7d16f501bfda6"
    end
  end

  resource "skills" do
-    url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.59/dws-skills.zip"
-    sha256 "7ce5c3ab6f6a367407f64971bc5ff96cfcdfade2c1a10d326144b17c7b25a57e"
+    url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.58/dws-skills.zip"
+    sha256 "2626debc21c3daadfd155b4c167b2219b97e801398fe4441a8b48138960ab264"
  end

  def install
@@ -10,7 +10,7 @@ SCHEMA_META_INDEX_OUTPUT ?= artifacts/schema_meta_index.gob
 POLICY_ENV = DWS_POLICY_TMPDIR="$(DWS_POLICY_TMPDIR)" GOTMPDIR="$(POLICY_GOTMPDIR)"
 GO_SOURCE_LIST = git ls-files -z --cached --others --exclude-standard -- '*.go'

-.PHONY: all help build rebuild test test-plan test-auth-legacy-compat shortcut-public-e2e-proof lint format-check fmt policy edition-test interface-integrity authoritative-interface-integrity coverage-gate coverage-gate-platform update-interface-baseline reset-interface-baseline schema-compatibility skill-command-integrity skill-context-budget multi-im-skill-chain-integrity cli-smoke mock-mcp-smoke test-schema-agent-examples generate-schema fetch-mcp-metadata generate-schema-catalog package release release-pre release-stable changelog-pre changelog-stable publish-homebrew-formula setup-hooks
+.PHONY: all help build rebuild test test-plan test-auth-legacy-compat lint format-check fmt policy edition-test interface-integrity authoritative-interface-integrity coverage-gate coverage-gate-platform update-interface-baseline reset-interface-baseline schema-compatibility skill-command-integrity skill-context-budget multi-im-skill-chain-integrity cli-smoke mock-mcp-smoke test-schema-agent-examples generate-schema fetch-mcp-metadata generate-schema-catalog package release release-pre release-stable changelog-pre changelog-stable publish-homebrew-formula setup-hooks

 all: setup-hooks fmt lint build test rebuild

@@ -20,7 +20,6 @@ help:
 	@printf "  make test          - Run the Go test suite\n"
 	@printf "  make test-plan     - Verify CI test and full-suite coverage package plans cover their scopes exactly once\n"
 	@printf "  make test-auth-legacy-compat - Run stable legacy authentication compatibility regressions\n"
-	@printf "  make shortcut-public-e2e-proof - Prove every reviewed Devdoc/HRbrain/PAT public Shortcut through exact and owning raw execution\n"
 	@printf "  make lint          - Run formatting checks, go vet, and staticcheck\n"
 	@printf "  make format-check  - Check all repository Go source files with gofmt\n"
 	@printf "  make fmt           - Format all repository Go source files\n"
@@ -63,9 +62,6 @@ test-auth-legacy-compat:
 	@mkdir -p "$(POLICY_GOTMPDIR)"
 	@GO="$(GO)" $(POLICY_ENV) ./scripts/policy/check-auth-legacy-compat.sh

-shortcut-public-e2e-proof: build
-	@GO="$(GO)" DWS_PACKAGE_VERSION="$(DWS_PACKAGE_VERSION)" ./scripts/policy/check-shortcut-public-e2e-proof.sh
-
 lint:
 	@./scripts/dev/lint.sh

@@ -88,7 +84,7 @@ fmt:
 	$(GO_SOURCE_LIST) > "$$go_files"; \
 	xargs -0 sh -c 'if [ "$$#" -gt 0 ]; then exec gofmt -w -- "$$@"; fi' sh < "$$go_files"

-policy: test-auth-legacy-compat shortcut-public-e2e-proof
+policy: test-auth-legacy-compat
 	@mkdir -p "$(POLICY_GOTMPDIR)"
 	@$(POLICY_ENV) ./scripts/policy/check-open-source-assets.sh
 	@$(POLICY_ENV) ./scripts/policy/check-skill-context-budget.sh
@@ -210,7 +210,7 @@ The verifier uses isolated directories and does not replace the `dws` on the cur
 The upgrade process follows a two-phase atomic flow to ensure consistency:

 1. **Prepare** — downloads the platform-specific binary and skill packages to a temporary directory, verifies SHA256 checksums, and extracts/validates all files. If any step fails, the upgrade aborts without modifying the existing installation.
-2. **Apply** — only after all preparations succeed, the binary is replaced and skills are flattened into the canonical `~/.agents/skills` root. Agents classified by the pinned compatibility registry as supporting the universal root read it directly; other detected Agents receive links to the canonical copy, with a direct-copy fallback when links are unavailable. Older DWS-managed agent-specific copies are backed up and retired so the same Skill is not discovered twice.
+2. **Apply** — only after all preparations succeed, the binary is replaced and skills are flattened into detected agent-specific roots (for example `~/.codex/skills/dingtalk-chat`). `~/.agents/skills` is used only when no specific Agent is detected; once a specific root is active, older DWS-managed generic copies are backed up and retired so the same Skill is not discovered twice.

 A backup of the current version is automatically created before each upgrade. Use `dws upgrade --rollback` to restore the previous version if needed.

@@ -405,7 +405,7 @@ After installing, AI tools like Claude Code / Cursor can operate DingTalk direct
 curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install-skills.sh | sh
 ```

-> Installers use `$HOME/.agents/skills/` as the canonical global store, following the universal `.agents/skills` convention. Agents classified by the pinned compatibility registry as universal read that root directly; detected non-universal Agents receive links to it (or copies when links are unavailable). Multi layout is per-product siblings, while mono uses the `dws/` subdirectory.
+> Installers prefer detected agent-specific roots such as `$HOME/.codex/skills/`. They use `.agents/skills/` only as the generic fallback when no specific Agent is detected; multi layout is per-product siblings, while mono uses the `dws/` subdirectory.
 >
 > China users: prefix `DWS_GITEE_REPO` to use the Gitee mirror — see [China mirror](#china-mirror).

@@ -19,7 +19,7 @@
 </p>

 > [!IMPORTANT]
-> **钉钉 DWS CLI 已全面开放，欢迎使用**：本项目涉及钉钉企业数据访问，需企业管理员授权后方可使用。欢迎加入钉钉 DWS 共创群获取支持与最新动态。详见下方 [开始使用](#开始使用)。
+> **共创阶段**：本项目涉及钉钉企业数据访问，需企业管理员授权后方可使用。欢迎加入钉钉 DWS 共创群获取支持与最新动态。详见下方 [开始使用](#开始使用)。
 >
 > <img src="https://img.alicdn.com/imgextra/i1/O1CN01WJyAsJ1prD2ovQACM_!!6000000005413-2-tps-718-720.png" alt="dws 开源沟通群二维码" width="150">

@@ -13,71 +13,13 @@ if (!fs.existsSync(binaryPath)) {
  process.exit(1);
 }

-// Interactive commands must remain in the terminal's foreground session so
-// prompts can use /dev/tty. Non-interactive launches use a separate process
-// group, allowing a signal sent only to this wrapper to reach the full vendor
-// process tree exactly once.
-const isolateVendorProcessGroup = process.platform !== "win32" && !process.stdin.isTTY;
-
-const child = childProcess.spawn(binaryPath, process.argv.slice(2), {
+const result = childProcess.spawnSync(binaryPath, process.argv.slice(2), {
  stdio: "inherit",
-  detached: isolateVendorProcessGroup,
 });

-let spawnFailed = false;
-let forwardedSignal = null;
-const forwardedSignals = ["SIGINT", "SIGTERM"];
-
-function forwardSignal(signal) {
-  forwardedSignal = signal;
-  if (child.exitCode === null && child.signalCode === null) {
-    if (process.platform === "win32") {
-      child.kill(signal);
-      return;
-    }
-    if (!isolateVendorProcessGroup) {
-      // Ctrl-C is generated for the whole foreground process group, including
-      // the vendor. SIGTERM is not terminal-generated and still needs an
-      // explicit handoff when a process manager targets only this wrapper.
-      if (signal === "SIGTERM") {
-        child.kill(signal);
-      }
-      return;
-    }
-    try {
-      // detached makes the vendor PID the leader of its POSIX process group.
-      // Signal the whole group so any subprocesses inherit the same shutdown.
-      process.kill(-child.pid, signal);
-    } catch (error) {
-      // The group may have completed between the state check and kill.
-      if (error.code !== "ESRCH") {
-        throw error;
-      }
-    }
-  }
+if (result.error) {
+  console.error(result.error.message);
+  process.exit(1);
 }

-const signalHandlers = new Map(
-  forwardedSignals.map((signal) => [signal, () => forwardSignal(signal)]),
-);
-for (const signal of forwardedSignals) {
-  process.on(signal, signalHandlers.get(signal));
-}
-
-child.on("error", (error) => {
-  spawnFailed = true;
-  console.error(error.message);
-});
-
-child.on("close", (code, signal) => {
-  for (const forwarded of forwardedSignals) {
-    process.removeListener(forwarded, signalHandlers.get(forwarded));
-  }
-
-  const exitSignal = forwardedSignal || signal;
-  if (exitSignal && process.platform !== "win32") {
-    process.kill(process.pid, exitSignal);
-    return;
-  }
-  process.exitCode = spawnFailed || code === null ? 1 : code;
-});
+process.exit(result.status === null ? 1 : result.status);
@@ -32,6 +32,6 @@
    "README.md"
  ],
  "engines": {
-    "node": ">=16.7.0"
+    "node": ">=16"
  }
 }
@@ -157,16 +157,6 @@ func runCompare(args []string, stdout, stderr io.Writer) (bool, error) {
 		"",
 		"candidate flag migration manifest",
 	)
-	approvedCommandMigrationsPath := flags.String(
-		"approved-command-migrations",
-		"",
-		"merge-base-owned approved command migration manifest",
-	)
-	candidateCommandMigrationsPath := flags.String(
-		"candidate-command-migrations",
-		"",
-		"candidate command migration manifest",
-	)
 	if err := flags.Parse(args); err != nil {
 		return false, err
 	}
@@ -184,13 +174,8 @@ func runCompare(args []string, stdout, stderr io.Writer) (bool, error) {
 			"--approved-flag-migrations and --candidate-flag-migrations must be provided together",
 		)
 	}
-	if (*approvedCommandMigrationsPath == "") != (*candidateCommandMigrationsPath == "") {
-		return false, fmt.Errorf(
-			"--approved-command-migrations and --candidate-command-migrations must be provided together",
-		)
-	}
-	if (*approvedMigrationsPath != "" || *approvedCommandMigrationsPath != "") && (*basePath == "" || *stablePath == "") {
-		return false, fmt.Errorf("migration compare requires both --base and --stable")
+	if *approvedMigrationsPath != "" && (*basePath == "" || *stablePath == "") {
+		return false, fmt.Errorf("flag migration compare requires both --base and --stable")
 	}

 	current, err := readSnapshot(*currentPath)
@@ -212,39 +197,7 @@ func runCompare(args []string, stdout, stderr io.Writer) (bool, error) {
 	}

 	report := interfacesnapshot.CompareAll(current, references)
-	if *approvedCommandMigrationsPath != "" {
-		flagApproved := interfacesnapshot.FlagMigrationManifest{Version: interfacesnapshot.FlagMigrationManifestVersion, Migrations: []interfacesnapshot.FlagMigration{}}
-		flagCandidate := flagApproved
-		if *approvedMigrationsPath != "" {
-			flagApproved, err = readFlagMigrationManifest(*approvedMigrationsPath)
-			if err != nil {
-				return false, fmt.Errorf("read approved flag migrations: %w", err)
-			}
-			flagCandidate, err = readFlagMigrationManifest(*candidateMigrationsPath)
-			if err != nil {
-				return false, fmt.Errorf("read candidate flag migrations: %w", err)
-			}
-		}
-		commandApproved, readErr := readCommandMigrationManifest(*approvedCommandMigrationsPath)
-		if readErr != nil {
-			return false, fmt.Errorf("read approved command migrations: %w", readErr)
-		}
-		commandCandidate, readErr := readCommandMigrationManifest(*candidateCommandMigrationsPath)
-		if readErr != nil {
-			return false, fmt.Errorf("read candidate command migrations: %w", readErr)
-		}
-		report, err = interfacesnapshot.CompareAllWithInterfaceMigrations(
-			current,
-			references,
-			flagApproved,
-			flagCandidate,
-			commandApproved,
-			commandCandidate,
-		)
-		if err != nil {
-			return false, fmt.Errorf("validate interface migration lifecycle: %w", err)
-		}
-	} else if *approvedMigrationsPath != "" {
+	if *approvedMigrationsPath != "" {
 		approved, readErr := readFlagMigrationManifest(*approvedMigrationsPath)
 		if readErr != nil {
 			return false, fmt.Errorf("read approved flag migrations: %w", readErr)
@@ -281,15 +234,6 @@ func readFlagMigrationManifest(path string) (interfacesnapshot.FlagMigrationMani
 	return interfacesnapshot.ReadFlagMigrationManifest(file)
 }

-func readCommandMigrationManifest(path string) (interfacesnapshot.CommandMigrationManifest, error) {
-	file, err := os.Open(filepath.Clean(path))
-	if err != nil {
-		return interfacesnapshot.CommandMigrationManifest{}, err
-	}
-	defer file.Close()
-	return interfacesnapshot.ReadCommandMigrationManifest(file)
-}
-
 func validateHelpRendering(root *cobra.Command, snapshot interfacesnapshot.Snapshot) error {
 	for _, command := range snapshot.Commands {
 		path := strings.TrimPrefix(command.Path, "dws")
@@ -336,5 +280,5 @@ func readSnapshot(path string) (interfacesnapshot.Snapshot, error) {
 func printUsage(w io.Writer) {
 	fmt.Fprintln(w, "usage:")
 	fmt.Fprintln(w, "  interface-snapshot generate [--output FILE]")
-	fmt.Fprintln(w, "  interface-snapshot compare --current FILE [--base FILE] [--stable FILE] [--approved-flag-migrations FILE --candidate-flag-migrations FILE] [--approved-command-migrations FILE --candidate-command-migrations FILE]")
+	fmt.Fprintln(w, "  interface-snapshot compare --current FILE [--base FILE] [--stable FILE] [--approved-flag-migrations FILE --candidate-flag-migrations FILE]")
 }
@@ -166,102 +166,6 @@ func TestCrossPlatformCoverageRunCompareRequiresBothFlagMigrationInputs(t *testi
 	}
 }

-func TestCrossPlatformCoverageRunCompareCommandMigrationInputs(t *testing.T) {
-	dir := t.TempDir()
-	snapshotPath := writeSnapshot(t, dir, "snapshot.json", commandSnapshot("dws"))
-	emptyFlag := writeManifest(t, dir, "empty-flags.json", `{"version":1,"migrations":[]}`)
-	emptyCommand := writeManifest(t, dir, "empty-commands.json", `{"version":1,"migrations":[]}`)
-	invalid := writeManifest(t, dir, "invalid-commands.json", `{`)
-
-	var stdout, stderr bytes.Buffer
-	args := []string{
-		"compare",
-		"--current", snapshotPath,
-		"--base", snapshotPath,
-		"--stable", snapshotPath,
-		"--approved-flag-migrations", emptyFlag,
-		"--candidate-flag-migrations", emptyFlag,
-		"--approved-command-migrations", emptyCommand,
-		"--candidate-command-migrations", emptyCommand,
-	}
-	if exitCode := run(args, &stdout, &stderr); exitCode != 0 {
-		t.Fatalf("combined migration compare exit=%d stderr=%s", exitCode, stderr.String())
-	}
-	for _, test := range []struct {
-		name      string
-		approved  string
-		candidate string
-		want      string
-	}{
-		{"approved flag", invalid, emptyFlag, "read approved flag migrations"},
-		{"candidate flag", emptyFlag, invalid, "read candidate flag migrations"},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			stdout.Reset()
-			stderr.Reset()
-			testArgs := []string{
-				"compare", "--current", snapshotPath, "--base", snapshotPath, "--stable", snapshotPath,
-				"--approved-flag-migrations", test.approved,
-				"--candidate-flag-migrations", test.candidate,
-				"--approved-command-migrations", emptyCommand,
-				"--candidate-command-migrations", emptyCommand,
-			}
-			if exitCode := run(testArgs, &stdout, &stderr); exitCode != 2 || !strings.Contains(stderr.String(), test.want) {
-				t.Fatalf("combined flag error exit=%d stderr=%s", exitCode, stderr.String())
-			}
-		})
-	}
-
-	for _, test := range []struct {
-		name      string
-		approved  string
-		candidate string
-		want      string
-	}{
-		{"approved", invalid, emptyCommand, "read approved command migrations"},
-		{"candidate", emptyCommand, invalid, "read candidate command migrations"},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			stdout.Reset()
-			stderr.Reset()
-			testArgs := []string{
-				"compare", "--current", snapshotPath, "--base", snapshotPath, "--stable", snapshotPath,
-				"--approved-command-migrations", test.approved,
-				"--candidate-command-migrations", test.candidate,
-			}
-			if exitCode := run(testArgs, &stdout, &stderr); exitCode != 2 || !strings.Contains(stderr.String(), test.want) {
-				t.Fatalf("command manifest error exit=%d stderr=%s", exitCode, stderr.String())
-			}
-		})
-	}
-
-	stderr.Reset()
-	if exitCode := run([]string{
-		"compare", "--current", snapshotPath, "--base", snapshotPath,
-		"--approved-command-migrations", emptyCommand,
-	}, &stdout, &stderr); exitCode != 2 || !strings.Contains(stderr.String(), "provided together") {
-		t.Fatalf("one-sided command manifest exit=%d stderr=%s", exitCode, stderr.String())
-	}
-
-	if _, err := readCommandMigrationManifest(filepath.Join(dir, "missing.json")); err == nil {
-		t.Fatal("missing command migration manifest unexpectedly read")
-	}
-	if _, err := readCommandMigrationManifest(invalid); err == nil {
-		t.Fatal("invalid command migration manifest unexpectedly read")
-	}
-
-	pending := writeManifest(t, dir, "pending-command.json", commandMigrationManifestJSON("pending"))
-	consumed := writeManifest(t, dir, "consumed-command.json", commandMigrationManifestJSON("consumed"))
-	stderr.Reset()
-	if exitCode := run([]string{
-		"compare", "--current", snapshotPath, "--base", snapshotPath, "--stable", snapshotPath,
-		"--approved-command-migrations", pending,
-		"--candidate-command-migrations", consumed,
-	}, &stdout, &stderr); exitCode != 2 || !strings.Contains(stderr.String(), "validate interface migration lifecycle") {
-		t.Fatalf("command lifecycle error exit=%d stderr=%s", exitCode, stderr.String())
-	}
-}
-
 func TestCrossPlatformCoverageRunCompareRequiresBothReferencesForFlagMigrations(t *testing.T) {
 	dir := t.TempDir()
 	currentPath := writeSnapshot(t, dir, "current.json", commandSnapshot("dws"))
@@ -663,33 +567,6 @@ func flagMigrationManifestJSON(state string) string {
 }`, "STATE", state, 1)
 }

-func commandMigrationManifestJSON(state string) string {
-	return strings.Replace(`{
-  "version": 1,
-  "migrations": [{
-    "kind": "command_move",
-    "legacy": {
-      "command": "dws chat message old",
-      "before": {"present": true, "runnable": true},
-      "after": {"present": true, "runnable": true, "hidden": true}
-    },
-    "replacement": {
-      "command": "dws chat topic new",
-      "before": {"present": false},
-      "after": {"present": true, "runnable": true}
-    },
-    "schema": {
-      "product_id": "chat",
-      "source_tool_id": "chat.move",
-      "replacement_tool_id": "chat.move",
-      "parameters": []
-    },
-    "state": "STATE",
-    "reason": "reviewed command migration"
-  }]
-}`, "STATE", state, 1)
-}
-
 func hasFlag(flags []interfacesnapshot.Flag, name, flagType string) bool {
 	for _, flag := range flags {
 		if flag.Name == name && flag.Type == flagType {
@@ -184,11 +184,11 @@ candidate SHA。
 `check-interface-baseline.sh` 不再作为本地或 CI 的兼容性审批入口，也不能用于批准
 flag 迁移。

-Schema compatibility 使用同一组 base、stable、candidate refs，以及 base-owned flag
-与 command migration ledgers。merge-base-owned checker 分别规范化 merge-base 与
-stable 的完整 Schema，并让 candidate 对两份历史 contract 独立执行检查；它只把已通过
-Interface lifecycle 的 exact rename、command move 或 flag extraction 规范化到当前历史
-副本，不会维护第二份 allowlist，也不会放宽其他 Schema 历史字段。
+Schema compatibility 使用同一组 base、stable、candidate refs 和同一份 base-owned flag
+migration ledger。merge-base-owned checker 分别规范化 merge-base 与 stable 的完整
+Schema，并让 candidate 对两份历史 contract 独立执行检查；它只把已通过 Interface
+lifecycle 的 exact rename 规范化到当前历史副本，不会维护第二份 allowlist，也不会
+放宽其他 Schema 历史字段。

 For a release-seal branch that archives rendered fragments:

@@ -1,13 +1,6 @@
-# CLI Help / Schema 兼容迁移治理
+# CLI flag 兼容迁移治理

-本文定义两种受控 flag 迁移：
-
-1. `flag_rename`：保留旧 flag 的可执行兼容性，但把它从 Help 与 Agent Schema 中隐藏，并将新的规范 flag 设为唯一可见入口；rename 必须保持原 flag 的 requiredness，optional 只能迁到 optional，required 只能迁到 required。
-2. `requiredness_change`：同一个公开 flag 从 optional 精确提升为 required；flag 的名称、类型、作用域、可见性、shorthand、`no_opt` 与 alias 关系必须保持不变。
-
-两种原语都只放行清单精确登记的变化，不是通用 breaking-change 豁免，也不得在同一 command/flag 上叠加以绕过 rename 的 requiredness 保持规则。
-
-同一套 base-owned lifecycle 也治理两类跨命令迁移：旧命令保留执行能力但从 Help / Schema 导航隐藏，并迁到新的公开命令路径；或把旧命令中的一个可选 flag 拆成新的专用命令。跨命令迁移只允许清单精确声明的 `command_became_hidden` / `flag_became_hidden` 及其 Schema 投影，不是通用 command-path breaking-change 豁免。
+本文定义一种受控迁移：保留旧 flag 的可执行兼容性，但把它从 Help 与 Agent Schema 中隐藏，并将新的规范 flag 设为唯一可见入口。迁移必须保持原 flag 的 requiredness：optional 只能迁到 optional，required 只能迁到 required。它只解决这一种精确变更，不是通用 breaking-change 豁免。

 同名 flag 的精确类型迁移属于另一类评审机制，只能进入
 `internal/interfacesnapshot/reviewed.go` 与 legacy smoke helper 的镜像表；flag rename
@@ -38,7 +31,7 @@ Smoke fixture，不参与迁移审批。
 同时提供 `--base` 与 `--stable`；核心 lifecycle 也拒绝缺失 stable 的非空清单，避免
 调用方因漏传历史参考而提前清理 consumed receipt。

-PR merge-base 同时拥有快照生成器、比较器和已审批清单。门禁用这套 base-owned helper 检查同一个已提交 candidate revision、merge-base 与 stable，candidate 不能通过修改自己的 Go 比较 helper 来放宽规则。candidate 中的清单只参与迁移状态流转，不能批准同一个 PR 引入的接口变化。首次引入 flag 机制时，merge-base 尚无迁移解析器；bootstrap 会用 merge-base 已有的 modern Interface Snapshot 做不带豁免的普通比较，并只接受 candidate 中逐字匹配的空 flag 清单。后续引入 command migration 扩展时，base 已拥有 flag comparator；bootstrap 仍只执行 base-owned 普通比较，不向旧 helper 传入新的 command ledger，因此允许随治理 PR 提交仍处于 before 的 pending 计划，也不会授予任何迁移豁免。bootstrap 无法让旧 helper 证明新治理实现本身正确，因此本治理 PR 的新 parser、lifecycle、launcher 与 hostile tests 仍是必须由真人评审的受保护策略变更；它们合入后才成为后续 PR 的 base-owned authority。
+PR merge-base 同时拥有快照生成器、比较器和已审批清单。门禁用这套 base-owned helper 检查同一个已提交 candidate revision、merge-base 与 stable，candidate 不能通过修改自己的 Go 比较 helper 来放宽规则。candidate 中的清单只参与迁移状态流转，不能批准同一个 PR 引入的接口变化。首次引入本机制时，merge-base 尚无迁移解析器；bootstrap 会用 merge-base 已有的 modern Interface Snapshot 做不带豁免的普通比较，并只接受 candidate 中逐字匹配的空清单，不会让 candidate 新增的 comparator 决定本 PR 是否兼容。bootstrap 无法让旧 helper 证明新治理实现本身正确，因此本治理 PR 的新 parser、lifecycle、launcher 与 hostile tests 仍是必须由真人评审的受保护策略变更；它们合入后才成为后续 PR 的 base-owned authority。

 这条边界保护比较规则和审批数据，不是任意代码沙箱。GitHub workflow / launcher 的变更仍由仓库保护规则和真人评审负责；candidate Cobra 构建也会执行 candidate 代码，因此对同一 runner 上的主动恶意代码，需要独立进程或文件系统隔离，不能把本门禁描述成已经解决。

@@ -46,80 +39,22 @@ PR merge-base 同时拥有快照生成器、比较器和已审批清单。门禁

 ```text
 scripts/policy/interface-migrations/approved-flag-migrations-v1.json
-scripts/policy/interface-migrations/approved-command-migrations-v1.json
 ```

-清单使用严格 JSON 解析：版本、字段名大小写、JSON 值类型、命令路径和 flag 名都必须精确；拒绝重复键、未知键、scalar `null` 与尾随 JSON 值，`reason` 不能为空；禁止 `*`、`?`、前缀规则或其他 wildcard。历史未声明 `kind` 的记录按 `flag_rename` 解释；新增同名 requiredness 迁移必须显式写 `kind: requiredness_change` 和单一 `flag` before/after。清单中的 `pending` 记录只记录已评审计划，并授权其精确列出的后续产品迁移；候选与 merge-base 仍必须精确匹配 `before`，不能授权同一个提交中的接口变化，也不能作为其他命令或参数的通配豁免。
-
-首次引入一个旧 merge-base 不认识的新 `kind` 时，机制 PR 不得同时写入该 kind 的 pending 记录，因为旧的 base-owned 严格解析器会拒绝未知字段。必须先合入 parser、lifecycle、CLI/Schema adapter 与 hostile tests；待这些实现成为新的 merge-base authority 后，再用独立治理审批 PR 新增 pending，最后才由产品 PR 消费。
-
-## 跨命令迁移原语
-
-`approved-command-migrations-v1.json` 只接受两种 `kind`：
-
-| kind | CLI after 状态 | Schema 允许的精确投影 |
-|---|---|---|
-| `command_move` | legacy 命令仍 runnable、由 visible 变 hidden；replacement 由 absent 变 visible runnable | 同一 stable tool identity 的 `primary_cli_path` 改到 replacement；只允许清单列出的参数改名，参数类型、property、requiredness、default 等必须等价 |
-| `flag_extraction` | legacy 命令保持 visible runnable；指定 legacy flag 仍可执行但由 visible 变 hidden；replacement 由 absent 变 visible runnable | source tool 只删除指定参数；replacement tool 必须位于精确的新路径，并保持 source 的 interface 与 safety identity；清单必须完整列出每个 source 参数到 replacement 参数或常量 property 的承接关系 |
-
-`command_move` 只能隐藏没有子命令的 legacy leaf，且 legacy 与 replacement
-不得互为祖先路径；整棵命令树的迁移需要单独设计逐叶治理，不能复用这一原语。
-稳定 Schema tool 可以继续接受普通的 optional 参数新增，但不得借路径迁移引入清单未登记的
-`required`、`cli_required` 或 `required_when` 参数；参数改名的目标也不得与历史
-Schema 中已有的其他参数重名，避免把两个历史参数静默合并。`flag_extraction` 只接受
-optional bool legacy flag，不能隐藏仍由 Cobra hard-required 的参数。它必须对 source tool
-的全部历史参数逐项声明：普通参数使用精确 `from` → `to`（同名也必须显式写出），且恰好
-一个与 legacy flag 同名的 `from` 使用 `replacement_constant`，不得同时声明 `to`；所有
-`from` 与 replacement 参数/property 目标必须唯一。legacy bool flag 的 `no_opt` 必须等于
-常量布尔值的字符串形式。v1 只治理 optional bool flag 的 `NoOpt=true` 激活分支，因此
-`replacement_constant.value` 与 legacy `no_opt` 都必须是 `true`；negative flag、默认即
-`true` 或固定 `false` 的语义不在本轮证明范围，必须另行设计，不能借本清单放行。
-
-如果 `command_move` 的参数 `from` 在更早 stable 中仍使用另一历史名称，Schema adapter
-只能把同一 legacy command 上、已经由 base-owned lifecycle 返回且
-`state=consumed` 的 flag rename 回执作为前驱边。例如
-`group → conversation-id` 与 `conversation-id → open-topic-id` 可以组合，但不能把
-candidate 自增的 pending 记录、其他命令的同名参数、参数概念词典或 CLI alias 当作证据。
-首次消费 pending command 回执时，merge-base 的 normalized Schema 必须真实发布中间参数，
-并逐跳验证参数签名和 constraints；command 回执合入为 consumed 后，中间 Schema 已从 main
-消失，此时保留的两份 consumed 回执可继续对 stable 做受限重放，直到 stable 也达到 after
-并让回执转为惰性记录或由独立 PR 清理。两种阶段都拒绝残留 predecessor/intermediate、字段漂移、环、分叉、
-target 碰撞或 primary path/tool identity 不唯一；positionals 不在该组合授权面内。
-
-`replacement_constant` 不是清单自报即可成立的例外。after 阶段的 Interface Snapshot
-必须从 replacement 命令的同一份框架运行时声明中捕获完全一致的 property/value，缺失、
-值不符或额外常量都会使 lifecycle 落入 partial。对于 #1054，`dws chat topic create`
-必须通过 `NewLeafCommand` 的 `ConstParams` 声明并实际注入
-`convThreadEnabled=true`；手写 `RunE` 固定值、Cobra annotation 或只改清单都不能提供这份
-同源证据，Snapshot 只读取 `corecmd` 包内私有注册表公开的只读副本。第一次向旧快照增加
-bool 常量证据属于 bootstrap；一旦任一历史快照已记录该
-证据，普通 Interface Compare 会持续要求 property/value 集合完全一致，因此 ledger 清理后
-删除、翻转或增加常量仍会阻塞。若 candidate 改动 command ledger，则
-`internal/corecmd/corecmd.go`、`internal/corecmd/interface_const_params.go` 与
-`internal/helpers/leaf.go` 三份执行/证据桥必须保持 base Git blob 不变；框架演进必须先用
-独立 PR 合入，不能和产品消费混在一起。
-
-replacement 必须保留 source 已发布的 dry-run 能力：历史 `dry_run` 非空时不得删除或改值；
-历史未声明时允许 replacement 新增 dry-run。这与普通 Schema 兼容规则保持同一单调边界。
-
-两种迁移都要求旧 argv 继续可执行。删除旧命令、删除旧 flag、把 legacy 改成 non-runnable、改变未登记的历史参数、改变 interface / safety，或只完成部分 before → after 转换都会 fail closed。命令别名会先规范到 reference 的 canonical path，但清单本身仍只能记录精确 canonical 命令，不能用 alias 或前缀扩大授权。
-
-跨命令清单复用下文同一套 `pending → consumed → inert/cleanup` 生命周期。治理 PR 只能新增 `pending` 且产品 surface 必须仍是 before；后续产品 PR 才能一次性切到 after 并改为 `consumed`。candidate 新增的 pending 记录不能批准自己的改动。
-
-当前首批 pending 记录覆盖 `chat topic` 收口：`chat group create --thread` 拆到 `chat topic create`，以及 `chat message list-topic-replies` / `forward-topic` 迁到对应的 `chat topic` 命令。前一条完整登记 `name` / `type` / `users` 的同名承接，以及 `thread` → `convThreadEnabled=true` 的常量承接。产品 PR 消费这些记录时只能把三条 `state` 改为 `consumed`，不得改写其 before、after、Schema mapping、constant 或 reason。
+清单使用严格 JSON 解析：版本、字段名大小写、JSON 值类型、命令路径和 flag 名都必须精确；拒绝重复键、未知键、scalar `null` 与尾随 JSON 值，`reason` 不能为空；禁止 `*`、`?`、前缀规则或其他 wildcard。清单中的 `pending` 记录只记录已评审计划，并授权其精确列出的后续产品迁移；候选与 merge-base 仍必须精确匹配 `before`，不能授权同一个提交中的接口变化，也不能作为其他命令或参数的通配豁免。

 ## 两阶段迁移与回执清理

-rename 以 `(kind, command, legacy flag, canonical flag)` 为唯一精确键；requiredness change 以 `(kind, command, flag)` 为唯一精确键。二者经历同一生命周期：
+每条迁移以 `(command, legacy flag, canonical flag)` 为唯一精确键，并经历以下生命周期：

 | 阶段 | PR 可以做什么 | 必须满足的快照状态 |
 |---|---|---|
 | 1. 治理审批 | 新增 `state: pending` 的精确记录；不得在同一个 PR 修改产品 surface | candidate 和 merge-base 都与记录中的 `before` 完全一致；该记录不改变 stable 的判断 |
-| 2. 产品迁移 | merge-base 已拥有 `pending` 后，按记录一次性切到精确 `after`，并把记录改为 `state: consumed` | rename 的 legacy 仍存在但由 visible 变 hidden，且声明 `alias_of`，canonical requiredness 保持不变；requiredness change 只把同名 flag 从 optional 提升为 required |
+| 2. 产品迁移 | merge-base 已拥有 `pending` 后，按记录一次性切到精确 `after`，并把记录改为 `state: consumed` | legacy 仍存在但由 visible 变 hidden，且声明 `alias_of`；canonical 的 requiredness 与 legacy 迁移前完全一致 |
 | 3. 保留回执 | 产品 PR 合入后，如果 stable 仍是 `before`，继续保留 `consumed` | merge-base 或 stable 仍有任一份尚未达到 `after` |
-| 4. 惰性保留或清理 | 当 merge-base 和 stable 都已经是 `after`，该记录不再提供任何授权；后续 PR 可以原样保留或删除 | 两份参考快照均精确匹配 `after`；保留时仍必须是不可改写的 `consumed`，接口偏离 `after` 继续失败 |
+| 4. 单独清理 | 当 merge-base 和 stable 都已经是 `after`，在后续 PR 删除该记录 | 两份参考快照均精确匹配 `after`；继续保留过期回执会被门禁拒绝 |

-因此，新增 `pending` 和修改产品 surface 不能发生在同一个 PR；candidate 自己新增的记录不能 self-approve。迁移也不能部分执行：legacy、canonical、`alias_of` 或状态只要有一项不匹配，门禁即失败。stable 发布只会让已经追平的 `consumed` 回执变成无授权效果的审计记录，不会在没有代码变更时让后续业务 PR 失去合规性；清理仍可作为独立的账本压缩动作，但不再是下一个 PR 的强制前置条件。
+因此，新增 `pending` 和修改产品 surface 不能发生在同一个 PR；candidate 自己新增的记录不能 self-approve。迁移也不能部分执行：legacy、canonical、`alias_of` 或状态只要有一项不匹配，门禁即失败。

 下面只是清单结构示例，不代表已审批命令；实际字段必须从 Interface Snapshot 核对：

@@ -164,27 +99,6 @@ rename 以 `(kind, command, legacy flag, canonical flag)` 为唯一精确键；r

 产品迁移 PR 必须保持同一条记录的命令、flag、before/after 和 reason 不变，只把 `pending` 改成 `consumed`。

-同名 flag requiredness 迁移的清单结构如下；示例不代表已经审批：
-
-```json
-{
-  "version": 1,
-  "migrations": [
-    {
-      "kind": "requiredness_change",
-      "command": "dws report entry submit",
-      "flag": {
-        "name": "to-user-ids",
-        "before": {"present": true, "type": "string", "scope": "local"},
-        "after": {"present": true, "type": "string", "required": true, "scope": "local"}
-      },
-      "state": "pending",
-      "reason": "Reject report submissions that have no visible recipient."
-    }
-  ]
-}
-```
-
 ## `alias_of` 是框架来源的受评审关系证据

 `alias_of` 不是 Schema 同义词、参数概念词典或任意文字声明。它只能由 `FlagSpec.Aliases` 写入，并与内部 origin `corecmd.flag_spec_aliases.v1` 成对出现；每次 Interface Integrity 都会在已提交的 detached candidate 上执行源码门禁，禁止其他生产文件写入或复刻这些 evidence token。Interface Snapshot 会验证：
@@ -205,11 +119,10 @@ rename 以 `(kind, command, legacy flag, canonical flag)` 为唯一精确键；r

 ## 豁免边界

-一条 base-owned、状态正确且前后快照精确匹配的记录，只会从普通兼容报告中移除以下三类预期 finding：
+一条 base-owned、状态正确且前后快照精确匹配的记录，只会从普通兼容报告中移除以下两类预期 finding：

 1. legacy flag 的 `flag_became_hidden`（visible → hidden）；
 2. required legacy 被新增的 required canonical 替代时产生的 `required_flag_added`；如果 canonical 在 before 阶段只是 hidden 占位符，则允许它在转为公开拼写时继承 legacy 的 requiredness。已有的 visible canonical 不允许借 rename 改变 requiredness。
-3. `requiredness_change` 中同名 flag 从 optional 提升为 required 时产生的 `flag_became_required`。

 以下变化仍按普通兼容规则阻塞，不能被迁移记录掩盖：

@@ -217,7 +130,6 @@ rename 以 `(kind, command, legacy flag, canonical flag)` 为唯一精确键；r
 - flag 类型或迁移记录中的 scope、shorthand、`no_opt` 漂移；
 - `alias_of` 缺失、指向变化或 alias chain；
 - 命令路径及任何无关的阻塞性接口变化；
- requiredness change 同时发生的 rename、隐藏、类型、scope、shorthand、`no_opt` 或 alias 漂移；
 - 不精确、部分完成、超出记录范围的 surface 变化。

 ## Schema 投影边界
@@ -245,12 +157,6 @@ adapter 先构造经过上述验证的历史 contract 副本，再调用原 Sche
 canonical-only `after` 状态时不需要再次投影；adapter 保持 baseline 不变，由原 checker
 验证 candidate 是否仍与该 canonical contract 兼容。

-`requiredness_change` 的 Schema adapter 只把历史同名 parameter 的 `required` 与
-`cli_required` 提升到 candidate 的 `true` 值，并要求 candidate 两者都为 `true`。parameter
-不存在、tool/path 不匹配时不制造 Schema surface；type、property、interface type、default、
-format、enum、`required_when`、constraints、positionals 与 safety 等全部字段仍交给原 checker，
-任何不相干漂移继续阻塞。
-
 ## 本地验证

 先确保 merge-base 和 stable tag 已在本地，然后运行与 CI 相同的权威门禁：
@@ -3,7 +3,7 @@
 Every runtime command the `dws` CLI exposes when loaded with the **pre** environment configuration.

 - **Products**: 13
- **Total commands**: 163
+- **Total commands**: 160
 - **Generated from**: `internal/plugin` command descriptors — the same code path the CLI uses at runtime.

 > Auto-generated. Update plugin descriptors in `internal/plugin/`, not this file.
@@ -33,7 +33,7 @@ Every command inherits these flags (documented here once, not repeated per comma
 - [`dws aitable` — AI Tables](#dws-aitable) · 41 commands
 - [`dws attendance` — Attendance](#dws-attendance) · 4 commands
 - [`dws calendar` — Calendar](#dws-calendar) · 14 commands
- [`dws chat` — Group Chat / IM](#dws-chat) · 26 commands
+- [`dws chat` — Group Chat / IM](#dws-chat) · 23 commands
 - [`dws contact` — Contact Directory](#dws-contact) · 6 commands
 - [`dws devdoc` — Open Platform Docs](#dws-devdoc) · 2 commands
 - [`dws ding` — DING Messages](#dws-ding) · 2 commands
@@ -134,15 +134,12 @@ _Calendar events, participants, meeting rooms, and busy-status queries._

 _Group chats, conversations, messages, and robot/webhook integrations._

-**26 commands**
+**23 commands**

 | Command | Description | When to use |
 |---|---|---|
 | `dws chat bot search` | Search robots (bots) created by the current user by keyword. | When the agent needs to resolve one of its own bots by name to a robot code before sending bot messages. |
 | `dws chat conversation-info` | Retrieve basic metadata for a conversation (single chat or group chat) by conversation ID. | When the agent needs context about a conversation (name, type, member count) before operating on it. |
-| `dws chat emotion favorite` | Add a media ID to the current user's personal favorite emotions. | When the agent needs to save an available mediaId as a reusable personal emotion, optionally preserving source message context. |
-| `dws chat emotion list` | List the current user's personal favorite emotions. | When the agent needs to inspect available personal emotions or resolve an emotionId/mediaId before sending. |
-| `dws chat emotion send` | Send a personal favorite emotion to a group or direct chat as the authenticated user. | When the agent needs to send a known personal emotion mediaId to exactly one group, userId, or openDingTalkId target. |
 | `dws chat group create` | Create a new internal group chat with a set of initial members. | When the agent needs to spin up a dedicated group for a new project, incident, or discussion thread. |
 | `dws chat group members` | List members of a group chat; can also be used against the current user to enumerate their groups' members. | When the agent needs the roster of a group before mentioning, removing, or auditing members. |
 | `dws chat group members add` | Add one or more users to an existing group chat. | When the agent expands a group to include additional participants. |
@@ -1,454 +0,0 @@
-# AI 表格数据源指令使用指南
-
-## 概述
-
-dws 新增了 7 个 AI 表格数据源同步管理指令，用于将外部数据源（一期支持审批数据）接入 AI 表格，实现数据的自动同步。
-
-所有指令均通过 `dws aitable +datasource-*` 前缀调用，操作对象是 AI 表格中的"数据源表"——一种由数据源同步创建的特殊数据表。
-
-## 指令速览
-
-| 指令 | 用途 | 读写 | 风险 |
-|------|------|------|------|
-| `+datasource-list-sources` | 列出数据源类型可用的来源信息（OA 返回 result/processCode、sourceType、sourceUrl） | 读 | low |
-| `+datasource-get-fields` | 获取数据源来源的可同步字段结构 | 读 | low |
-| `+datasource-create` | 创建数据源表并触发首次同步 | 写 | medium |
-| `+datasource-update` | 更新已有数据源表的同步配置 | 写 | medium |
-| `+datasource-sync` | 手动触发一次同步 | 写 | medium |
-| `+datasource-sync-status` | 查询同步任务状态 | 读 | low |
-| `+datasource-get-config` | 查看数据源表配置 | 读 | low |
-
-## 前置条件
-
-1. **登录认证**：执行 `dws auth login` 确保已登录
-2. **获取 Base ID**：通过 `dws aitable +base-list` 或 `dws aitable +base-search --query "关键词"` 获取目标 AI 表格的 Base ID
-
---
-
-## 1. 列出数据源可用来源
-
-```
-dws aitable +datasource-list-sources [flags]
-```
-
-列出指定数据源类型可用的来源信息。OA 审批类型返回当前 Base 可用的审批数据源条目（`sources` 数组，当前通常为单条），用于构造 `+datasource-create` / `+datasource-update` / `+datasource-get-fields` 的 `--source-config`。OA 场景下每条 source 的 `result` 字段是 JSON 字符串，需解析后得到 `approvals` 数组，再从中提取目标模板的 `processCode`、`name`、`iconUrl`、`url`。
-
-### 参数
-
-| 参数 | 类型 | 必填 | 说明 |
-|------|------|------|------|
-| `--base-id` | string | 是 | 目标 Base ID |
-| `--datasource-type` | string | 是 | 数据源类型，目前支持审批（OA） |
-
-### 示例
-
-```bash
-# 列出审批数据源来源，获取 result（JSON，解析后得到 approvals[].processCode）
-dws aitable +datasource-list-sources \
-  --base-id BASE123 \
-  --datasource-type OA
-```
-
-### 返回值
-
-返回 `sources` 数组，每个条目包含：
-
-| 字段 | 说明 |
-|------|------|
-| `result` | OA 审批场景为 JSON 字符串，解析后得到 `approvals` 数组；每个 approval 含 `processCode`、`name`、`iconUrl`、`url` |
-| `sourceType` | 数据源类型编号（OA 对应内部枚举值 2） |
-| `sourceUrl` | 数据源访问链接，可选 |
-
-`result` 本身不是 `processCode`，需要解析出 `approvals` 数组，再取目标模板的 `processCode`、`name`、`iconUrl`、`url` 原样填入 `--source-config`。
-
---
-
-## 2. 获取数据源可同步字段
-
-```
-dws aitable +datasource-get-fields [flags]
-```
-
-获取指定数据源来源（如某个审批模板）的可同步字段列表，包括字段 ID、字段名称、字段类型和是否主键等信息。用于创建数据源前选择需要同步的字段。
-
-### 参数
-
-| 参数 | 类型 | 必填 | 说明 |
-|------|------|------|------|
-| `--base-id` | string | 是 | 目标 Base ID |
-| `--datasource-type` | string | 是 | 数据源类型，目前支持审批（OA） |
-| `--source-config` | string | 是 | 源配置 JSON 字符串，结构同 `+datasource-create` 的 `--source-config` |
-
-### 示例
-
-```bash
-# 获取某审批模板的可同步字段
-dws aitable +datasource-get-fields \
-  --base-id BASE123 \
-  --datasource-type OA \
-  --source-config '{"processCode":"PROC-XXXX","name":"采购申请","dataType":"recent_time","recentDays":"30d","iconUrl":"https://example.com/icon.png","url":"https://example.com/oa"}'
-```
-
-### 返回值
-
-返回可同步字段列表，每个字段包含字段 ID、名称、类型和是否主键。字段 ID 可用于 `+datasource-create` / `+datasource-update` 的 `--field-ids` 参数。
-
---
-
-## 3. 创建数据源表
-
-```
-dws aitable +datasource-create [flags]
-```
-
-为指定 AI 表格创建数据源同步配置，自动创建一张数据源表并触发首次全量同步。
-
-### 参数
-
-| 参数 | 类型 | 必填 | 说明 |
-|------|------|------|------|
-| `--base-id` | string | 是 | 目标 Base ID（通过 `+base-list` / `+base-search` 获取） |
-| `--datasource-type` | string | 是 | 数据源类型，目前支持审批（OA） |
-| `--source-config` | string | 是 | 源配置 JSON 字符串（格式见下方） |
-| `--auto` | bool | 否 | 是否开启自动同步，默认 false；无论是否传入，CLI 都会把该字段下发给下游 |
-| `--auto-sync-setting` | string | 否 | 自动同步频率配置 JSON 字符串，仅在 `--auto=true` 时生效，格式见下方 |
-| `--field-ids` | stringSlice | 否 | 需要同步的字段 ID 列表，不传时同步全部字段 |
-
-### source-config 格式（审批类）
-
-审批数据源的 `--source-config` 是一个 JSON 对象字符串，包含以下字段：
-
-| 字段 | 类型 | 必填 | 说明 |
-|------|------|------|------|
-| `processCode` | string | 是 | 审批模板编码，对应 `+datasource-list-sources` 返回的 `result` |
-| `name` | string | 是 | 数据源展示名称，须从 `+datasource-list-sources` 结果原样透传 |
-| `iconUrl` | string | 是 | OA 审批图标 URL，须从 `+datasource-list-sources` 结果原样透传 |
-| `url` | string | 是 | OA 审批跳转链接，须从 `+datasource-list-sources` 结果原样透传 |
-| `dataType` | string | 是 | 数据时间范围类型：`time_range` / `start_time` / `recent_time` |
-| `recentDays` | string | 当 dataType=recent_time 时必填 | 近 N 天：`7d` / `30d` / `1y` |
-| `startDate` | string | 当 dataType=time_range 或 start_time 时必填 | 起始日期，格式 `yyyy-MM-dd` |
-| `endDate` | string | 当 dataType=time_range 时必填 | 结束日期，格式 `yyyy-MM-dd` |
-| `keepRemovedFields` | bool | 否 | 是否保留已删除字段，默认 false |
-
-> 注：`splitParentTableField`、`enableDataSyncOaDetailList` 等字段为下游内部字段，无需传入，下游自动处理。
-
-按 `dataType` 选择对应的时间参数组合：
-
-| dataType | 需要的时间字段 | 说明 |
-|----------|----------------|------|
-| `recent_time` | `recentDays` | 同步近 N 天数据（7d/30d/1y） |
-| `start_time` | `startDate` | 同步从某日期至今的数据 |
-| `time_range` | `startDate` + `endDate` | 同步指定日期范围内的数据 |
-
-### auto-sync-setting 格式
-
-`--auto-sync-setting` 仅在 `--auto=true` 时生效，用于指定自动同步频率。不传时使用下游默认策略。
-
-| 字段 | 类型 | 必填 | 说明 |
-|------|------|------|------|
-| `syncType` | string | 是 | `hourly`（按小时间隔）/ `scheduled`（定时触发） |
-| `hourlyInterval` | int | hourly 时必填 | 正整数，小时间隔 |
-| `scheduleType` | string | scheduled 时必填 | `daily` / `weekly` / `monthly` |
-| `timeValue` | string | scheduled 时必填 | 触发时间，格式 `HH:mm` |
-| `selectedMonthDays` | int[] | monthly 时必填 | 每月几号触发，1-31 |
-| `selectedWeekdays` | int[] | weekly 时必填 | 每周哪几天触发，1=周一…7=周日 |
-| `skipNonWorkingDay` | bool | 否 | 是否跳过非工作日，默认 false |
-
-示例：`{"syncType":"scheduled","scheduleType":"daily","timeValue":"09:00"}`
-
-### 示例
-
-```bash
-# 基本创建——同步近 30 天审批数据
-dws aitable +datasource-create \
-  --base-id BASE123 \
-  --datasource-type OA \
-  --source-config '{"processCode":"PROC-XXXX","name":"采购申请","dataType":"recent_time","recentDays":"30d","iconUrl":"https://example.com/icon.png","url":"https://example.com/oa"}'
-
-# 指定日期范围创建并开启自动同步
-dws aitable +datasource-create \
-  --base-id BASE123 \
-  --datasource-type OA \
-  --source-config '{"processCode":"PROC-XXXX","name":"采购申请","dataType":"time_range","startDate":"2025-01-01","endDate":"2025-12-31","iconUrl":"https://example.com/icon.png","url":"https://example.com/oa"}' \
-  --auto
-
-# 指定同步字段（仅同步部分字段，field-ids 可通过 +datasource-get-fields 获取）
-dws aitable +datasource-create \
-  --base-id BASE123 \
-  --datasource-type OA \
-  --source-config '{"processCode":"PROC-XXXX","name":"采购申请","dataType":"recent_time","recentDays":"30d","iconUrl":"https://example.com/icon.png","url":"https://example.com/oa"}' \
-  --field-ids fldAAA,fldBBB,fldCCC
-```
-
-### 返回值
-
-创建成功后返回新建数据源表 ID 和同步任务 ID，后续操作需要用到这两个 ID。
-
---
-
-## 4. 更新数据源配置
-
-```
-dws aitable +datasource-update [flags]
-```
-
-更新已有数据源表的同步配置，支持更新源配置、自动同步开关和同步字段选择。更新后会自动触发一次同步。
-
-### 参数
-
-| 参数 | 类型 | 必填 | 说明 |
-|------|------|------|------|
-| `--base-id` | string | 是 | 目标 Base ID |
-| `--table-id` | string | 是 | 已存在的数据源表 ID（由 `+datasource-create` 返回） |
-| `--source-config` | string | 否 | 新的源配置 JSON 字符串，不传时保持原有配置。结构同 `+datasource-create` |
-| `--auto` | bool | 否 | 是否开启自动同步；仅显式设置时下发给下游，省略时保持原有自动同步开关不变 |
-| `--auto-sync-setting` | string | 否 | 自动同步频率配置 JSON 字符串，仅在显式设置 `--auto=true` 时生效；省略时保持原频率配置 |
-| `--field-ids` | stringSlice | 否 | 需要同步的字段 ID 列表，不传时保持现有字段配置 |
-
-### 示例
-
-```bash
-# 更换审批模板并调整时间范围
-dws aitable +datasource-update \
-  --base-id BASE123 \
-  --table-id TBL456 \
-  --source-config '{"processCode":"PROC-YYYY","name":"出差申请","dataType":"recent_time","recentDays":"30d","iconUrl":"https://example.com/icon.png","url":"https://example.com/oa"}'
-
-# 开启自动同步
-dws aitable +datasource-update \
-  --base-id BASE123 \
-  --table-id TBL456 \
-  --auto
-
-# 更新同步字段范围
-dws aitable +datasource-update \
-  --base-id BASE123 \
-  --table-id TBL456 \
-  --field-ids fldAAA,fldDDD
-```
-
-> 注意：`--table-id` 指向的是数据源表（由 `+datasource-create` 创建），不是普通数据表。
-
---
-
-## 5. 触发手动同步
-
-```
-dws aitable +datasource-sync [flags]
-```
-
-对已有数据源表触发一次手动同步。单次最多 5 张表，每张表独立提交，部分失败不影响其他表。
-
-### 参数
-
-| 参数 | 类型 | 必填 | 说明 |
-|------|------|------|------|
-| `--base-id` | string | 是 | 目标 Base ID |
-| `--table-ids` | stringSlice | 是 | 待触发同步的数据源表 ID 列表（1-5 个） |
-
-### 示例
-
-```bash
-# 同步单张表
-dws aitable +datasource-sync \
-  --base-id BASE123 \
-  --table-ids TBL1
-
-# 批量同步多张表（逗号分隔，最多 5 个）
-dws aitable +datasource-sync \
-  --base-id BASE123 \
-  --table-ids TBL1,TBL2,TBL3
-```
-
-### 返回值
-
-返回每个表的同步任务 ID，可通过 `+datasource-sync-status` 查询最终结果。
-
---
-
-## 6. 查询同步状态
-
-```
-dws aitable +datasource-sync-status [flags]
-```
-
-按任务 ID 查询数据源表的同步任务状态。与 `+datasource-sync` / `+datasource-create` / `+datasource-update` 配对使用——这些指令触发同步后返回任务 ID，本指令通过任务 ID 查询最终结果。
-
-### 参数
-
-| 参数 | 类型 | 必填 | 说明 |
-|------|------|------|------|
-| `--base-id` | string | 是 | 目标 Base ID |
-| `--table-id` | string | 是 | 数据源表 ID |
-| `--task-ids` | stringSlice | 是 | 待查询的同步任务 ID 列表（1-5 个） |
-
-### 示例
-
-```bash
-# 按任务 ID 查询（批量，最多 5 个）
-dws aitable +datasource-sync-status \
-  --base-id BASE123 \
-  --table-id TBL456 \
-  --task-ids TASK1,TASK2
-```
-
---
-
-## 7. 获取数据源配置
-
-```
-dws aitable +datasource-get-config [flags]
-```
-
-获取指定数据源表的同步配置信息，包括源配置、同步模式、自动同步开关和同步状态。
-
-### 参数
-
-| 参数 | 类型 | 必填 | 说明 |
-|------|------|------|------|
-| `--base-id` | string | 是 | 目标 Base ID |
-| `--table-id` | string | 是 | 数据源表 ID |
-
-### 示例
-
-```bash
-dws aitable +datasource-get-config \
-  --base-id BASE123 \
-  --table-id TBL456
-```
-
---
-
-## 典型工作流
-
-### 场景一：从零接入审批数据
-
-```bash
-# 0. 获取 Base ID
-dws aitable +base-search --query "我的项目表"
-
-# 1. 列出可用审批数据源来源，解析 result JSON 获取 approvals[].processCode
-dws aitable +datasource-list-sources \
-  --base-id BASE123 \
-  --datasource-type OA
-# → 返回 sources[0].result 为 JSON 字符串，解析后取 approvals[0].processCode=PROC-XXXX
-
-# 2. 查看可同步字段（可选，用于指定 field-ids）
-dws aitable +datasource-get-fields \
-  --base-id BASE123 \
-  --datasource-type OA \
-  --source-config '{"processCode":"PROC-XXXX","name":"采购申请","dataType":"recent_time","recentDays":"30d","iconUrl":"https://example.com/icon.png","url":"https://example.com/oa"}'
-
-# 3. 创建数据源表（创建后自动触发首次同步）
-dws aitable +datasource-create \
-  --base-id BASE123 \
-  --datasource-type OA \
-  --source-config '{"processCode":"PROC-XXXX","name":"采购申请","dataType":"recent_time","recentDays":"30d","iconUrl":"https://example.com/icon.png","url":"https://example.com/oa"}'
-# → 返回 tableId=TBL456, taskId=TASK001
-
-# 4. 查询首次同步是否完成
-dws aitable +datasource-sync-status \
-  --base-id BASE123 \
-  --table-id TBL456 \
-  --task-ids TASK001
-
-# 5. 确认配置
-dws aitable +datasource-get-config \
-  --base-id BASE123 \
-  --table-id TBL456
-```
-
-### 场景二：更换审批模板后重新同步
-
-```bash
-# 1. 更新源配置（更新后自动触发一次同步）
-dws aitable +datasource-update \
-  --base-id BASE123 \
-  --table-id TBL456 \
-  --source-config '{"processCode":"PROC-NEW","name":"新审批模板","dataType":"recent_time","recentDays":"30d","iconUrl":"https://example.com/icon.png","url":"https://example.com/oa"}'
-
-# 2. 查询同步状态（更新后会返回新的 taskId）
-dws aitable +datasource-sync-status \
-  --base-id BASE123 \
-  --table-id TBL456 \
-  --task-ids TASK002
-```
-
-### 场景三：手动触发日常同步
-
-```bash
-# 仅触发同步，不修改配置
-dws aitable +datasource-sync \
-  --base-id BASE123 \
-  --table-ids TBL456
-
-# 查询结果（sync 会返回 taskId）
-dws aitable +datasource-sync-status \
-  --base-id BASE123 \
-  --table-id TBL456 \
-  --task-ids TASK001
-```
-
-### 场景四：开启自动同步后确认
-
-```bash
-# 1. 更新配置，开启自动同步
-dws aitable +datasource-update \
-  --base-id BASE123 \
-  --table-id TBL456 \
-  --auto
-
-# 2. 确认配置已更新
-dws aitable +datasource-get-config \
-  --base-id BASE123 \
-  --table-id TBL456
-# → 返回中应显示 auto=true
-```
-
---
-
-## 通用选项
-
-以下全局选项可在所有指令中使用：
-
-| 选项 | 说明 |
-|------|------|
-| `-f, --format` | 输出格式：json（默认）/ table / raw / pretty / ndjson / csv |
-| `--jq` | jq 表达式过滤输出（如 `.tableId` 或 `.status`） |
-| `--fields` | 筛选输出字段（逗号分隔） |
-| `--dry-run` | 预览操作内容，不实际执行 |
-| `--profile` | 指定组织或账号 |
-| `--timeout` | HTTP 请求超时时间（秒，默认 30） |
-| `--debug` | 显示调试日志 |
-| `-v, --verbose` | 显示详细日志 |
-
-### 输出过滤示例
-
-```bash
-# 只取 tableId
-dws aitable +datasource-create ... --jq '.tableId'
-
-# 只取同步状态
-dws aitable +datasource-sync-status ... --jq '.status'
-
-# table 格式查看
-dws aitable +datasource-get-config ... -f table
-```
-
---
-
-## 注意事项
-
-1. **推荐流程**：先 `+datasource-list-sources` 解析 `result` JSON 获取 `approvals[].processCode`，再 `+datasource-get-fields` 查看可同步字段，最后 `+datasource-create` 创建数据源表。
-
-2. **数据源表 vs 普通数据表**：`+datasource-create` 创建的是"数据源表"，它由数据源同步驱动数据写入。`+datasource-update` 和 `+datasource-sync` 仅适用于数据源表，不可对普通数据表使用。
-
-3. **datasource-type 透传**：CLI 层不对 `--datasource-type` 做枚举校验，目前一期仅支持 `OA`（审批）。后续支持其他类型时由服务端控制，CLI 无需修改。
-
-4. **source-config 格式**：`--source-config` 必须是合法 JSON 字符串。审批数据源需要原样透传 `processCode`（从 `+datasource-list-sources` 返回的 `result` JSON 中解析 `approvals[]` 提取）、`name`、`iconUrl`、`url`，设置 `dataType`（时间范围类型），并按 `dataType` 提供对应的时间参数（`recentDays` / `startDate` / `endDate`）。
-
-5. **同步限制**：`+datasource-sync` 单次最多 5 张表；`+datasource-sync-status` 单次最多查询 5 个任务 ID。
-
-6. **创建即同步**：`+datasource-create` 和 `+datasource-update` 在操作完成后会自动触发一次同步，无需额外调用 `+datasource-sync`。
-
-7. **自动同步**：`--auto` 开启后，数据源表会按 `--auto-sync-setting` 指定的频率自动定期同步；未指定频率时使用服务端默认策略。关闭 `--auto` 后仅能通过 `+datasource-sync` 手动触发。
@@ -23,7 +23,7 @@

 `plan` 是纯只读操作，不创建 tag、预留版本号或生成包。CHANGELOG 合入期间若另一个发布先占用了该版本，`publish` 会重新分配并因 CHANGELOG 章节不匹配而拒绝，需要重新 plan。`publish` 会先再次确认 dispatch SHA 仍是当前 `main`、Code Admission 和平台治理均通过，再由唯一的 write job 使用 GitHub API 原子创建 annotated tag；同一次 run 随即进入既有的跨平台构建、GitHub/npm、可选 OSS/Gitee 发布和 Homebrew 直交付 DAG。内置 `GITHUB_TOKEN` 创建的 tag 不依赖第二条 workflow 被再次触发。

-为缩短封板前后的关键路径，`publish` 的只读版本规划会与平台治理检查并行，seal 仍严格等待二者成功；plan 在 candidate annotated tag 上验证过的 contract 和 stable/beta baseline 会绑定进 seal，并由 seal 后的 tag authority 检查复用。Code Admission 状态与 immutable-releases 治理仍会在 seal 后再次读取，避免 preflight 与发布之间的状态变化被忽略。随后三类只读门禁（release automation、CLI 与 Schema 兼容性、multi-profile E2E）与 GoReleaser 构建并行；Node/archive 等仅供后处理使用的工具也延后到构建完成后安装。并行和已验证结果复用只改变调度，不降低发布门禁：任何一条验证失败都会阻止 GitHub Release、npm、镜像和 Homebrew 发布，delivery proof 也要求三条验证 job 全部成功。
+为缩短封板前后的关键路径，`publish` 的只读版本规划会与平台治理检查并行，seal 仍严格等待二者成功；plan 在 candidate annotated tag 上验证过的 contract 和 stable/beta baseline 会绑定进 seal，并由 seal 后的 tag authority 检查复用。Code Admission 状态与 immutable-releases 治理仍会在 seal 后再次读取，避免 preflight 与发布之间的状态变化被忽略。随后三类只读门禁（release automation、命令兼容性、multi-profile E2E）与 GoReleaser 构建并行；Node/archive 等仅供后处理使用的工具也延后到构建完成后安装。并行和已验证结果复用只改变调度，不降低发布门禁：任何一条验证失败都会阻止 GitHub Release、npm、镜像和 Homebrew 发布，delivery proof 也要求三条验证 job 全部成功。

 OSS 镜像默认不参与发布 DAG，适用于尚未创建 Bucket 的仓库。云端封板会把当时的仓库变量 `ENABLE_OSS_MIRROR=true` 记录为不可变 tag 元数据 `OSS-Mirror: enabled`，否则记录为 `deferred`；后续发布和撤回只读取该 sealed policy，不读取变量的当前值。`enabled` 继续对缺失凭据、无效 Bucket、上传、pointer 和撤回失败保持 fail-closed；`deferred` 明确跳过不存在的渠道。为避免补发后撤回遗漏，deferred 版本暂不接受 `repair_oss_version`，启用 OSS 只影响后续新 tag，直到补齐可审计的不可变 repair 证明。

@@ -102,7 +102,7 @@ fragments，然后停止。审阅生成内容并通过唯一的 release-seal PR
 dws-release v1.2.3-beta.1
 ```

-预检包含测试、策略检查、旧正式版 CLI 与 Schema 双基线兼容检查、全平台打包、npm 安装验证，以及 macOS 环境下的 Homebrew 安装验证。它还会从默认分支触发一次无发布权限的 `Release governance preflight`，用正式流水线相同的身份检查该精确 commit 的九个 Code Admission context 和 immutable releases。通过后回到上述 Actions 页面选择 beta 和 `release_operation=publish`；云端会重新绑定当前 `main`，然后直接进入 beta 自动发布，不需要人工审批或输入确认短语。
+预检包含测试、策略检查、旧正式版命令树兼容检查、全平台打包、npm 安装验证，以及 macOS 环境下的 Homebrew 安装验证。它还会从默认分支触发一次无发布权限的 `Release governance preflight`，用正式流水线相同的身份检查该精确 commit 的九个 Code Admission context 和 immutable releases。通过后回到上述 Actions 页面选择 beta 和 `release_operation=publish`；云端会重新绑定当前 `main`，然后直接进入 beta 自动发布，不需要人工审批或输入确认短语。

 ## 正式发布

@@ -140,19 +140,14 @@ dws-release v1.2.3 --from-beta v1.2.3-beta.1
 `.changes/<unique-name>.md` 中增加一个独立 fragment；格式和允许的分类见
 [`.changes/README.md`](../.changes/README.md)。预发封板时
 `scripts/release/prepare-changelog.sh prerelease <version>` 会稳定排序并汇总所有未归档
-fragment，写入唯一版本章节后移动到 `.changes/released/<version>/`。如果 beta 发布后又有
-带 fragment 的 PR 合入，而维护者决定直接发布 stable，
-`scripts/release/prepare-changelog.sh stable <version> --from-beta <tag>` 会保留 beta 晋级摘要
-模板，并把这些 post-beta fragments 写到明确的 `Changes since <beta>` 边界之后，再移动到
-`.changes/released/<stable-version>/`。没有 active fragment 时，stable 仍只生成原有晋级摘要
-模板。因此并发 PR 不会争用 `CHANGELOG.md`；唯一的 release-seal PR 同时提交生成的章节与
-归档移动，供审计复核。
+fragment，写入唯一版本章节后移动到 `.changes/released/<version>/`。因此并发 PR 不会争用
+`CHANGELOG.md`；唯一的 release-seal PR 同时提交生成的章节与归档移动，供审计复核。

 ## CI/CD 保证

 - 只接受 `vX.Y.Z-beta.N` 和 `vX.Y.Z`，且新版本必须高于上一正式版。这里的“上一正式版”必须同时具备公开非草稿 GitHub Release 和同 tag/commit 的成功 Release workflow；只有 tag、没有交付成功的孤儿版本会阻断后续发布，要求走机器核验恢复补齐。云端 tag 会固定 `Release-Run`、requester、commit 和版本分配指纹，交付验证按该精确 run/attempt 及完整 job graph 取证，不接受任意 `workflow_dispatch`。历史版本若曾通过专用 recovery workflow 完成交付，只能使用仓库内 `delivered-stable-recoveries.json` 中精确到 tag、commit、run、workflow SHA 与 attempt 的 reviewed 证据。
 - tag 必须由云端 seal job 创建为 annotated tag；封板提交必须已通过 PR 合入并包含在远端 `main` 历史中。流水线允许其后 `main` 继续前进，但始终要求封板提交位于 `main` 历史中。
- 日常 CI 和发布前都会对比“最新已交付正式版”的完整 CLI 与 Schema 契约；若长时间预检期间该 baseline 发生变化，会针对新的 baseline 重新比较。
+- 日常 CI 和发布前都会对比“最新已交付正式版”的完整命令树；若长时间预检期间该 baseline 发生变化，会针对新的 baseline 重新比较。
 - GoReleaser 只构建；Darwin 重签、checksums 重算和 npm 安装验证通过后，才统一上传 GitHub Release 的最终产物。
 - 六个平台归档会逐个解包并核验二进制内嵌版本；公开资产集合、checksums 集合和 npm tarball integrity 都必须精确一致。npm tarball 固定由 npm `10.9.2` 打包，避免重跑时因 runner 自带 npm 漂移产生不同字节。
 - stable 发布到 npm `latest`；prerelease 发布到 npm `beta`。启用 `ENABLE_OSS_MIRROR=true` 后，stable 同步 OSS `latest.txt` 和共享安装脚本，prerelease 只同步 OSS `beta.txt`，不会覆盖稳定入口。
@@ -360,6 +360,7 @@ Definition（仅声明；不可编译）
 | | `idempotency` | 评审源（或未来 Contract） | reviewed metadata | 今日非框架声明；不得推断 |
 | | `effect_source` / provenance | 组装派生物 | resolver 写入 `FieldProvenance` | 派生，不手写 |
 | **DryRun** | `preview_kind`, `remote_reads` | 评审源 | `schema_dry_run_capabilities`（正能力声明） | 否；无条目 ≠ 推断「不支持」之外的假能力 |
+| **Wait** | `mode`（`poll`/`event`/`auto`）, `poll_command`, `status_query`, `terminal`（状态→success/failure）, `pending_values`, `event_key`/`match_field`/`resource_query`（event/auto）, `default_timeout_secs` | **声明**（`ContractDecl.Wait` 正能力声明，且必须搭配 ResultInvoke dispatcher + 按模式的 hook：poll↔`WaitPoll`、event↔`WaitEvents`、auto↔两者，构造期配对校验，多余 hook 同样拒绝） | 声明后注册 `--wait`/`--wait-timeout`（框架 flag，不进 toolArgs）；Schema 投影 `wait` 键；auto = 事件优先、流终止/订阅失败回退轮询，一个 deadline 覆盖两阶段并传入 `WaitPoll`/`WaitEvents`（及 `Command().Context()`）；仅 pending 初始结果进入等待，success/failure/partial 原样返回 | 否；未声明命令传 `--wait` = unknown flag。终态失败经统一信封 `error.type: "wait"`（rc=8），超时保持 pending + `meta.operation.timed_out`（rc=0）；轮询间/轮询中/事件消费中超时一律按 pending 关闭 |
 | **Interface** | `interface_mode`, `interface_ref`, `availability`, `reason` | 评审源 | MCP meta + agent metadata 解析 | 否；与 CLI Identity 分离 |
 | **Selection** | `agent_summary`, `use_when`, `avoid_when`, `examples`, `prerequisites`, `tips`, `workflow_refs`, … | 声明（`ContractDecl.Selection` / `ProductDecl`） | `ContractDecl` / `ProductDecl`（`schema_hints/` 已退役） | 可声明；声明载荷**不得携带** `Reviewed`（旧路径专用），携带即组装报错 |
 | **FieldProvenance** | 各字段 winner / candidates | 组装派生物 | Schema 组装器 | 派生；须与 delivered value 一致 |
@@ -54,8 +54,8 @@ DWS 对任何外部实现的持续兼容义务。后续设计以 DWS 自身约

 | 模式 | Agent 目录布局 | 选择方式 |
 |---|---|---|
-| multi（默认） | canonical `~/.agents/skills/dingtalk-*/`；非 universal Agent 使用链接或复制兼容层 | 默认；`dws skill setup --mode multi` |
-| mono（兼容） | canonical `~/.agents/skills/dws/`；非 universal Agent 使用链接或复制兼容层 | `dws skill setup --mode mono` 或安装器的 mono opt-in |
+| multi（默认） | `<agent-home>/dingtalk-*/` 与必选 `dingtalk-shared/` | 默认；`dws skill setup --mode multi` |
+| mono（兼容） | `<agent-home>/dws/` | `dws skill setup --mode mono` 或安装器的 mono opt-in |

 模式切换通过重新执行 setup 完成。安装 multi 前备份并移除 mono 的 `dws/`；安装
 mono 前只备份并移除能够证明由 DWS 管理的 multi 目录。两个方向都不提供隐式、
@@ -140,26 +140,10 @@ Agent 仍只需以 `SKILL.md` 发现和加载 Skill；统一元数据位于 Agen

 ## 8. Upgrade 与恢复语义

-升级器始终先发布 `~/.agents/skills` canonical 集合。固定兼容注册表中被分类为
-universal 的 Agent 不再保留 Agent 私有副本；检测到的
-非 universal Agent（如 Claude、OpenClaw、Hermes、Windsurf）使用指向 canonical
-的目录链接：npm 与 PowerShell 安装器在 Windows 上创建 junction，`dws upgrade` /
-`dws skill setup` 创建符号链接（`os.Symlink`）。链接不可用时回退为内容完整的
-直接复制，包括未开启开发者模式、因而无法创建符号链接的 Windows。
-自定义 `CODEX_HOME`、`CLAUDE_CONFIG_DIR`、`HERMES_HOME`、`AUTOHAND_HOME`、
-`GROK_HOME`、`VIBE_HOME`、`XDG_CONFIG_HOME` 与 OpenClaw 历史目录 `.clawdbot`、
-`.moltbot` 必须按 Agent 实际优先级解析。
+升级器对每个 Agent 目标执行：

-Agent 兼容矩阵以 `vercel-labs/skills` 的 `agents.ts` 与 `installer.ts`（基准提交
-`c6f69c6`）为契约：76 个 ID 必须完整登记，其中 19 个 universal、57 个
-non-universal。`eve`、`promptscript` 没有全局目录，因此全局安装时跳过；多个 Agent
-解析到同一个 XDG 目录时按最终绝对路径去重（Windows 大小写不敏感）。DWS 额外支持
-Qoderwork（按 non-universal Agent 建立兼容链接）；旧版使用的 `.github/skills`、
-`.amp/skills`、`.cline/skills` 与
-`.windsurf/skills` 仅作为可恢复迁移清理目标，不计入上游 Agent 枚举。
-对 universal Agent，上游 installer 的 global 模式明确选择 canonical 并跳过
-Agent 私有 global 目录；注册表中的 `globalSkillsDir` 仍用于识别和退役历史 native
-路径，不作为 universal symlink 模式的发布目标。
+- 先探测具体 Agent home；只在没有任何具体 Agent 时使用 `~/.agents/skills` 通用 fallback；
+- 具体 Agent 安装成功后，将 `~/.agents/skills` 中旧的 DWS 受管副本可恢复地迁入备份，避免 Codex 等同时扫描两个根目录时重复发现同名 Skill；

 1. 只读计算对面布局、过期受管 Skill 和同名官方 Skill；
 2. 在目标文件系统的 staging 中复制完整新集合；
@@ -167,14 +151,6 @@ Agent 私有 global 目录；注册表中的 `globalSkillsDir` 仍用于识别
 4. 逐项发布 staging；任一发布失败时删除已发布的新目录，并逆序恢复该目标的全部旧目录；
 5. 仅在没有目标失败且至少一个目标成功时更新状态快照。

-旧集合可能位于外部卷或自定义 Agent 根，而备份固定写入
-`~/.dws/skill-backups`。因此备份与反向恢复统一采用 rename-first：同卷直接原子
-rename；遇到跨文件系统错误时，在目标所在文件系统创建临时 staging，词法复制并
-保留目录/文件权限、普通文件、符号链接及 dangling symlink，校验路径类型、目录项、
-文件大小与 SHA256、链接目标后，再将 staging 原子 rename 为正式目标。正式目标
-再次校验成功后才删除源路径。复制、校验或发布失败时保留源并清理 staging；源删除
-失败时允许源与正式目标同时存在，但必须返回明确错误，不能报告成功。
-
 Go upgrade 当前提供 **单 Agent 目标级事务恢复**：复制失败发生在旧目录移动前；
 备份中途失败会恢复此前已移动的目录；发布中途失败会恢复该目标的完整旧集合。不同
 Agent 目标仍彼此独立，一个目标失败不会回滚此前已经成功升级的其他目标，这与
@@ -183,31 +159,11 @@ Agent 目标仍彼此独立，一个目标失败不会回滚此前已经成功
 ## 9. 备份合同

 - 路径：`~/.dws/skill-backups/<UTC 时间戳>/...`；
- 主要操作：同一文件系统内使用 rename 移动；跨文件系统使用目标卷 staging 的
-  copy → verify → publish → remove 回退；
+- 主要操作：同一文件系统内使用 rename 移动；
 - 失败语义：备份失败时原目录保持不变，目标安装失败；
- 恢复语义：反向恢复使用相同回退；若删除备份源失败，原路径和备份可同时存在，
-  但恢复必须失败并明确提示两份均被保留；
 - 可见性：计划和执行日志显示原路径与备份路径；
 - 保留策略：自动修剪，仅保留最近 5 批。

-跨卷回退只有 staging → 正式目标的发布 rename 是原子的，整次迁移不是跨文件系统
-原子事务；该边界由“发布前不删源、发布后再次校验、删除失败保留两份”补偿。Shell
-入口继续使用系统 `mv` 的跨文件系统复制/删除能力；Go、npm 与 PowerShell 显式实现
-上述验证和失败合同。
-
-原子 no-replace 发布（Linux `RENAME_NOREPLACE`、Darwin `RENAME_EXCL`）依赖底层文件
-系统支持：`rename(2)` 只列出 ext4、btrfs、tmpfs 与 cifs，因此 NFS、FUSE 与
-overlayfs 家目录会以 `EINVAL` 拒绝该 flag。这些文件系统不得让安装整体失败，而是降级
-为原子占位发布：目录目标用 `mkdir` 认领（已占用即 `EEXIST`，认领期间目标始终被本事务
-持有，源子项逐个移入认领目录，最终以 rename 覆盖仅属于本事务的空认领或直接移入）；
-普通文件目标用硬链接占位（同样以 `EEXIST` 拒绝已占用路径）后删除源。任何一步失败都会
-回迁已移动的子项并只撤销本事务的占位，被并发创建的对象（文件、符号链接或目录）既不会
-被覆盖，也不会被链接进内部。逐子项移动路径不是全量原子可见（降级文件系统上的可接受
-边界），但不覆盖契约在所有平台保持不变。Windows `MoveFile` 本身即拒绝已存在的目标，
-无需降级。npm 与 Shell 安装面遵循同一占位模型：目录用 `mkdir`/子项移动，链接直接在
-目标路径创建（symlink(2) 原子拒绝已占用路径）。
-
 备份是安装安全机制，不等于独立 rollback 产品。需要切回 mono 时重新运行
 `dws skill setup --mode mono`。

@@ -236,7 +192,6 @@ setup 在未显式指定 `--source` 时的本地回退缓存。
 | `scripts/install.ps1` | multi | 任一检测到的目标失败则脚本非零 |
 | `scripts/install-skills.sh` | multi | 任一检测到的目标失败则脚本非零 |
 | npm `install.js` | multi | 任一检测到的目标失败则 postinstall 失败 |
-| `scripts/install-event.sh` / `install-devapp.*` | 产品 multi 子集 | 同样使用 canonical 与 Agent 兼容层 |

 Homebrew 不直接向 Agent home 铺设 Skill；安装 CLI 后由 setup 执行相同流程。

@@ -254,12 +209,6 @@ Homebrew 不直接向 Agent home 铺设 Skill；安装 CLI 后由 setup 执行
 - 复制失败不留下 Agent 可见的残缺官方目录；
 - 普通 upgrade 恢复被删除的预制 Skill，并安装新增官方 Skill；
 - Windows、macOS、Linux 的路径和覆盖率门禁；
- symlinked parent、npm/PowerShell 的 Windows junction、`dws upgrade` /
-  `dws skill setup` 的符号链接、链接失败复制回退与 broken link 修复；
- Claude/Codex/Hermes 自定义根目录及 OpenClaw 历史目录优先级；
- `CLAUDE_CONFIG_DIR`、`HERMES_HOME`、`XDG_CONFIG_HOME` 等自定义根跨文件系统时的
-  正向备份、反向恢复、普通链接及 dangling symlink 词法保留；
- copy、verify、publish、remove 各阶段故障，以及非跨设备权限错误不得进入复制回退；
 - npm、Shell、PowerShell 与包管理器安装冒烟。

 ## 13. 后续演进
@@ -1,17 +1,7 @@
 {
-  "generated_at": "2026-08-24T12:22:05.108140",
-  "count": 426,
+  "generated_at": "2026-08-18T17:38:50.904696",
+  "count": 436,
  "results": [
-    {
-      "suite": "semantic",
-      "service": "aisearch",
-      "command": "+search-person",
-      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "semantic_adapter",
-      "semantic_delta": "对 enterprise_person_search 增加显式 success/result 数组、坏元素、来源类型和稳定人员身份校验；exact live 已同时证明已知非空与 phone 维度不可存在号码的显式零命中。",
-      "availability": "available"
-    },
    {
      "suite": "semantic",
      "service": "aitable",
@@ -282,76 +272,6 @@
      "semantic_delta": "更新仪表盘配置的一对一入口。",
      "availability": "available"
    },
-    {
-      "suite": "semantic",
-      "service": "aitable",
-      "command": "+datasource-create",
-      "risk": "write",
-      "status": "reviewed_available",
-      "disposition": "schema_leaf",
-      "semantic_delta": "为指定 Base 创建数据源表并触发首次全量同步，返回新建表 ID 和同步任务 ID。",
-      "availability": "available"
-    },
-    {
-      "suite": "semantic",
-      "service": "aitable",
-      "command": "+datasource-get-config",
-      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "schema_leaf",
-      "semantic_delta": "读取已有数据源表的同步配置详情（源配置、字段选择、自动同步状态）的一对一入口。",
-      "availability": "available"
-    },
-    {
-      "suite": "semantic",
-      "service": "aitable",
-      "command": "+datasource-get-fields",
-      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "schema_leaf",
-      "semantic_delta": "获取指定数据源来源的可同步字段列表（字段 ID/名称/类型/是否主键），用于决定 field-ids。",
-      "availability": "available"
-    },
-    {
-      "suite": "semantic",
-      "service": "aitable",
-      "command": "+datasource-list-sources",
-      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "schema_leaf",
-      "semantic_delta": "列出指定 Base 下可用的数据源条目（OA 审批模板等），提取 processCode/name/iconUrl/url 用于 sourceConfig。",
-      "availability": "available"
-    },
-    {
-      "suite": "semantic",
-      "service": "aitable",
-      "command": "+datasource-sync",
-      "risk": "write",
-      "status": "reviewed_available",
-      "disposition": "schema_leaf",
-      "semantic_delta": "对已有数据源表触发手动同步（单次最多 5 张），仅触发即返回同步任务 ID。",
-      "availability": "available"
-    },
-    {
-      "suite": "semantic",
-      "service": "aitable",
-      "command": "+datasource-sync-status",
-      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "schema_leaf",
-      "semantic_delta": "批量查询数据源同步任务状态（RUNNING/FINISHED/FAILED），与 sync/create/update 触发后配对使用。",
-      "availability": "available"
-    },
-    {
-      "suite": "semantic",
-      "service": "aitable",
-      "command": "+datasource-update",
-      "risk": "write",
-      "status": "reviewed_available",
-      "disposition": "schema_leaf",
-      "semantic_delta": "更新已有数据源表的同步配置并触发一次同步；不改配置可只切换 auto 开关或 field-ids。",
-      "availability": "available"
-    },
    {
      "suite": "semantic",
      "service": "aitable",
@@ -1013,84 +933,137 @@
      "availability": "available"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
      "service": "attendance",
      "command": "+check-record",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "semantic_adapter",
-      "semantic_delta": "查询原始打卡流水；只有显式成功数组可表示空结果，每条必须有唯一正整数 ID 并绑定请求用户和日期。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
      "service": "attendance",
      "command": "+check-result",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "semantic_adapter",
-      "semantic_delta": "对齐 Lark attendance user_tasks query；严格校验正整数 ID 及请求用户/日期绑定，以 cursor_parameter=offset 将保守续页证据发布到 meta.pagination。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
+      "service": "attendance",
+      "command": "+get-adjustment-rule",
+      "risk": "read",
+      "status": "real-ok"
+    },
+    {
+      "suite": "read",
      "service": "attendance",
      "command": "+get-approve-template",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "semantic_adapter",
-      "semantic_delta": "把补卡、请假、加班、外出、出差映射为审批模板类型；每项以非空唯一 processCode 作为稳定身份，approveType 精确绑定请求且 submitUrl 必须非空，允许同类型返回多个模板。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
+      "service": "attendance",
+      "command": "+get-checkin-record",
+      "risk": "read",
+      "status": "real-ok"
+    },
+    {
+      "suite": "read",
+      "service": "attendance",
+      "command": "+get-leave-records",
+      "risk": "read",
+      "status": "real-ok"
+    },
+    {
+      "suite": "read",
      "service": "attendance",
      "command": "+get-overtime-rule",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "schema_leaf",
-      "semantic_delta": "使用搜索得到的加班规则 ID 读取详情，严格拒绝空 result，且响应 id 必须与请求 overtimeId 精确一致。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
+      "service": "attendance",
+      "command": "+get-schedule",
+      "risk": "read",
+      "status": "real-ok"
+    },
+    {
+      "suite": "read",
+      "service": "attendance",
+      "command": "+get-self-setting",
+      "risk": "read",
+      "status": "real-ok"
+    },
+    {
+      "suite": "read",
+      "service": "attendance",
+      "command": "+get-summary",
+      "risk": "read",
+      "status": "real-ok"
+    },
+    {
+      "suite": "read",
      "service": "attendance",
      "command": "+list-approve",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "semantic_adapter",
-      "semantic_delta": "把审批类型语义映射为业务枚举；每条审批必须有唯一正整数 ID，并精确绑定请求用户、类型与时间范围。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
+      "service": "attendance",
+      "command": "+list-leave-types",
+      "risk": "read",
+      "status": "real-ok"
+    },
+    {
+      "suite": "read",
+      "service": "attendance",
+      "command": "+my-attendance",
+      "risk": "read",
+      "status": "real-ok"
+    },
+    {
+      "suite": "read",
+      "service": "attendance",
+      "command": "+query-report-data",
+      "risk": "read",
+      "status": "real-ok"
+    },
+    {
+      "suite": "read",
      "service": "attendance",
      "command": "+search-adjustment-rule",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "semantic_adapter",
-      "semantic_delta": "严格读取 result.adjustmentList、展开 entityVO、要求稳定规则 ID，并公开分页完整性证据。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
      "service": "attendance",
      "command": "+search-class",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "semantic_adapter",
-      "semantic_delta": "严格读取 result.items、展开 shiftVO、要求唯一正整数 classId，并将无矛盾的 totalCount/totalPage 续页证据发布到 meta.pagination。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
+      "service": "attendance",
+      "command": "+search-group",
+      "risk": "read",
+      "status": "real-ok"
+    },
+    {
+      "suite": "read",
      "service": "attendance",
      "command": "+search-overtime-rule",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "semantic_adapter",
-      "semantic_delta": "严格读取 result.atRuleList、展开 entityVO、要求稳定规则 ID，并公开分页完整性证据。",
-      "availability": "available"
+      "status": "real-ok"
+    },
+    {
+      "suite": "read",
+      "service": "attendance",
+      "command": "+this-month",
+      "risk": "read",
+      "status": "real-ok"
    },
    {
      "suite": "semantic",
@@ -2343,134 +2316,102 @@
      "availability": "available"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
      "service": "contact",
      "command": "+by-mobile",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "primary_smart",
-      "semantic_delta": "使用专用手机号精确查询接口解析稳定 userId；专用接口 success=true 且省略 result 是经真实双层验证的精确零命中编码，未命中返回 typed nonzero；命中后读取并精确核对同一用户详情，null、错型、坏身份或详情 ID 不一致均失败。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
      "service": "contact",
      "command": "+dept-members",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "primary_smart",
-      "semantic_delta": "按部门名唯一解析 deptId 后列直属成员；搜索候选和成员集合均逐项严格校验，绝不猜测多匹配。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
      "service": "contact",
      "command": "+list-dept-members",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "semantic_adapter",
-      "semantic_delta": "按 deptId 列直属成员，严格要求显式 deptUserList、userInfo 对象及稳定 userId；已验证非空与随机零命中。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
      "service": "contact",
      "command": "+list-followings",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "semantic_adapter",
-      "semantic_delta": "严格要求 success、result.models 数组、对象元素、唯一稳定 openDingTalkId；可用 --open-id 做本地精确筛选，exact live 已证明已知非空与保证零命中。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
      "service": "contact",
      "command": "+list-role-members",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "semantic_adapter",
-      "semantic_delta": "按角色列成员，严格要求 success、显式 labelUserList、userInfo 对象及稳定 userId；已验证非空与随机零命中。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
+      "service": "contact",
+      "command": "+list-roles",
+      "risk": "read",
+      "status": "real-ok"
+    },
+    {
+      "suite": "read",
      "service": "contact",
      "command": "+list-sub-depts",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "semantic_adapter",
-      "semantic_delta": "按父部门列直属子部门，严格要求显式 result 数组与有效 deptId；已验证非空与随机零命中。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
      "service": "contact",
      "command": "+lookup",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "primary_smart",
-      "semantic_delta": "按姓名唯一解析稳定 userId 后读取并核对唯一用户详情；零命中和多命中均错误关闭。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
      "service": "contact",
      "command": "+me",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "primary_smart",
-      "semantic_delta": "读取当前用户唯一详情并严格要求 orgEmployeeModel 与稳定 userId，再投影最小自身份字段。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
      "service": "contact",
      "command": "+org",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "primary_smart",
-      "semantic_delta": "按姓名解析用户、核对用户详情与主 deptId，再读取并核对部门详情的稳定身份。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
      "service": "contact",
      "command": "+resolve-dept",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "primary_smart",
-      "semantic_delta": "按名称返回唯一 deptId 或显式候选；严格要求 deptList 数组、有效且不重复的 deptId 与部门名。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
      "service": "contact",
      "command": "+search-mobile",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "semantic_adapter",
-      "semantic_delta": "使用专用手机号精确查询接口取得稳定 userId，并直接投影该接口返回的受审身份字段，不额外依赖用户详情权限；专用接口 success=true 且省略 result 是经真实双层验证的精确零命中编码，null、空对象、数组或坏身份均失败。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
      "service": "contact",
      "command": "+search-user",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "semantic_adapter",
-      "semantic_delta": "按姓名搜索并严格要求 success、显式 result 数组、非空对象和稳定 userId/openDingTalkId；已验证非空与随机零命中。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
      "service": "contact",
      "command": "+team",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "primary_smart",
-      "semantic_delta": "按姓名解析用户和主部门后列直属成员；每一步校验 success、稳定身份及显式成员集合。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
      "suite": "write",
@@ -2606,14 +2547,32 @@
      "status": "real-ok"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
+      "service": "ding",
+      "command": "+list",
+      "risk": "read",
+      "status": "real-ok"
+    },
+    {
+      "suite": "write",
+      "service": "ding",
+      "command": "+recall-personal",
+      "risk": "high-risk-write",
+      "status": "real-ok"
+    },
+    {
+      "suite": "read",
      "service": "ding",
      "command": "+receiver-status",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "semantic_adapter",
-      "semantic_delta": "按稳定 openDingId 精确查询，严格拒绝缺集合、错型、空集合、坏元素与身份不匹配；current HEAD exact Shortcut 与 owning atomic/raw 的请求身份、1 项结果和完整接收行集合一致。",
-      "availability": "available"
+      "status": "real-ok"
+    },
+    {
+      "suite": "write",
+      "service": "ding",
+      "command": "+send-personal",
+      "risk": "write",
+      "status": "real-ok"
    },
    {
      "suite": "semantic",
@@ -3346,84 +3305,74 @@
      "availability": "available"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
+      "service": "mail",
+      "command": "+contact-list",
+      "risk": "read",
+      "status": "real-ok"
+    },
+    {
+      "suite": "read",
      "service": "mail",
      "command": "+find-mail-user",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "primary_smart",
-      "semantic_delta": "面向联系人解析的精简用户搜索；修复零命中被误报为调用失败，并严格验证用户数组、身份和分页。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
      "service": "mail",
      "command": "+folder-list",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "semantic_adapter",
-      "semantic_delta": "只接受显式 folders 数组及稳定 folder ID；缺字段、错型和坏元素不再退化为空列表。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
      "service": "mail",
-      "command": "+message",
+      "command": "+recent-mail",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "primary_smart",
-      "semantic_delta": "对齐 Lark 单封完整读入口；自动解析邮箱，要求顶层 message 非空且返回 ID 与请求 messageId 精确一致。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
-      "service": "mail",
-      "command": "+messages",
-      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "primary_smart",
-      "semantic_delta": "对齐 Lark 多封完整读入口；最多 100 个 ID，保持请求顺序，任何单封缺失、错型或身份不一致都会使整次调用失败。",
-      "availability": "available"
-    },
-    {
-      "suite": "semantic",
+      "suite": "read",
      "service": "mail",
      "command": "+search-mail",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "semantic_adapter",
-      "semantic_delta": "用 KQL 搜索邮件摘要；只接受已观测 messages 数组、稳定 messageId 和完整分页证据，窄化支持 Mail 专属 total=0 占位哨兵。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
      "service": "mail",
-      "command": "+thread",
+      "command": "+tag-list",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "primary_smart",
-      "semantic_delta": "对齐 Lark 完整会话读取；自动解析邮箱并要求 conversation.id 与请求精确一致。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
      "service": "mail",
-      "command": "+triage",
+      "command": "+template-list",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "primary_smart",
-      "semantic_delta": "对齐 Lark triage 任务入口，并超过其显式邮箱要求：可自动解析当前邮箱与收件箱，严格处理邮件搜索的终止游标和零命中哨兵。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
+      "service": "mail",
+      "command": "+thread-list",
+      "risk": "read",
+      "status": "real-ok"
+    },
+    {
+      "suite": "read",
+      "service": "mail",
+      "command": "+unread-mail",
+      "risk": "read",
+      "status": "real-ok"
+    },
+    {
+      "suite": "read",
      "service": "mail",
      "command": "+user-search",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "semantic_adapter",
-      "semantic_delta": "搜索企业邮箱用户并保留 hasMore/nextCursor；显式空数组合法，坏用户或缺稳定 ID 失败。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
      "suite": "semantic",
@@ -3696,84 +3645,81 @@
      "availability": "available"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
+      "service": "oa",
+      "command": "+list-cc",
+      "risk": "read",
+      "status": "real-ok"
+    },
+    {
+      "suite": "read",
+      "service": "oa",
+      "command": "+list-executed",
+      "risk": "read",
+      "status": "real-ok"
+    },
+    {
+      "suite": "read",
+      "service": "oa",
+      "command": "+list-forms",
+      "risk": "read",
+      "status": "real-ok"
+    },
+    {
+      "suite": "read",
+      "service": "oa",
+      "command": "+list-pending",
+      "risk": "read",
+      "status": "real-ok"
+    },
+    {
+      "suite": "read",
+      "service": "oa",
+      "command": "+list-submitted",
+      "risk": "read",
+      "status": "real-ok"
+    },
+    {
+      "suite": "read",
+      "service": "oa",
+      "command": "+my-initiated",
+      "risk": "read",
+      "status": "real-ok"
+    },
+    {
+      "suite": "read",
      "service": "oa",
      "command": "+search-forms",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "semantic_adapter",
-      "semantic_delta": "按关键字搜索可发起审批定义，严格要求显式 result 数组和稳定 processCode；已完成已知非空与保证零命中证明。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
-      "service": "pat",
-      "command": "+browser-policy",
-      "risk": "write",
-      "status": "reviewed_available",
-      "disposition": "primary_smart",
-      "semantic_delta": "在隔离本地策略文件上提供显式确认、无写入请求预览、同目标磁盘读回和不暴露 agent identity 的统一结果；exact 写入与清理已通过。",
-      "availability": "available"
-    },
-    {
-      "suite": "semantic",
+      "suite": "read",
      "service": "report",
      "command": "+inbox-list",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "semantic_adapter",
-      "semantic_delta": "严格验证 success、result.report_list、稳定 reportId 与 hasMore/cursor；current HEAD exact 与 owning atomic 同场景已知页均为 20 项、稳定身份集合和 next cursor 一致，独立未来范围均为 0 且明确终止。终止页回显 cursor 只作已验证收据且不发布 next_token。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
      "service": "report",
      "command": "+outbox-list",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "semantic_adapter",
-      "semantic_delta": "严格验证发件箱集合、稳定 reportId 和分页终止证据；current HEAD exact 与 owning atomic 同场景已知页均为 1 项且身份一致，独立未来范围均为 0 并明确终止。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
-      "service": "report",
-      "command": "+report-latest",
-      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "primary_smart",
-      "semantic_delta": "完整验证默认最近 20 天或显式不超过 20 天的发件箱；current HEAD exact 所选稳定 reportId 与 owning atomic 候选和精确详情身份一致，严格详情字段计数双层均为 3。",
-      "availability": "available"
-    },
-    {
-      "suite": "semantic",
-      "service": "report",
-      "command": "+template-search",
-      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "semantic_adapter",
-      "semantic_delta": "在严格验证完整可用模板集合、稳定 templateId 与名称后执行本地不区分大小写搜索；current HEAD exact 与 owning atomic 完整集合过滤的已知结果均为 1 且身份一致，随机 UUID 查询均为 0。",
-      "availability": "available"
-    },
-    {
-      "suite": "semantic",
+      "suite": "read",
      "service": "sheet",
      "command": "+list-sheets",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "semantic_adapter",
-      "semantic_delta": "严格要求 success=true、显式 sheets 数组、非空且唯一的 sheetId 与标题；提供完整标题本地精确筛选，因此可分别证明已知非空和合法零命中，未知结构绝不降级为空数组。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
-      "suite": "semantic",
+      "suite": "read",
      "service": "sheet",
      "command": "+read",
      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "semantic_adapter",
-      "semantic_delta": "严格校验 success、二维 cells、行列坐标与完成证据；服务返回 hasMore=true 时因没有可执行续页游标而失败关闭，保留 Sheet 读取与 AITable/Base 记录查询的产品边界。",
-      "availability": "available"
+      "status": "real-ok"
    },
    {
      "suite": "semantic",
@@ -3985,26 +3931,6 @@
      "semantic_delta": "更新指定字段后读取详情逐字段核验。",
      "availability": "available"
    },
-    {
-      "suite": "semantic",
-      "service": "whiteboard",
-      "command": "+query",
-      "risk": "read",
-      "status": "reviewed_available",
-      "disposition": "semantic_adapter",
-      "semantic_delta": "严格投影要求 success=true、OpenNodes V1、显式 pages 数组、每页稳定 id 与显式 nodes 数组，并校验跨页节点身份及服务端完整性摘要。",
-      "availability": "available"
-    },
-    {
-      "suite": "semantic",
-      "service": "whiteboard",
-      "command": "+update",
-      "risk": "high-risk-write",
-      "status": "reviewed_available",
-      "disposition": "primary_smart",
-      "semantic_delta": "首次远端调用前完成 OpenNodes V1 校验与用户确认；写后要求 success=true、同一目标、非空终态回执、createdNodeIds/idMap 精确映射，再按真实节点身份独立 query 读回请求关键字段。",
-      "availability": "available"
-    },
    {
      "suite": "semantic",
      "service": "wiki",
@@ -10,7 +10,6 @@ require (
 	github.com/charmbracelet/bubbletea v1.3.6
 	github.com/charmbracelet/huh v1.0.0
 	github.com/charmbracelet/lipgloss v1.1.0
-	github.com/creack/pty v1.1.24
 	github.com/fatih/color v1.18.0
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/websocket v1.5.0
@@ -372,7 +372,7 @@ func TestCrossPlatformCoverageReviewedAmbiguousCommandFallbackNeverDispatches(t
 		{path: "chat +conversation-category-list", candidates: []string{"chat +category-list", "chat +category-list-conversations"}},
 		{path: "chat +conversation-group-list", candidates: []string{"chat +category-list-conversations", "chat +conversation-list"}},
 		{path: "chat +list-my-groups", candidates: []string{"chat +my-groups", "chat +chat-list-mine", "chat +chat-list"}},
-		{path: "oa +list-processes", candidates: []string{"oa +search-forms", "oa approval list-submitted", "oa approval list-initiated"}},
+		{path: "oa +list-processes", candidates: []string{"oa +list-forms", "oa +my-initiated", "oa approval list-initiated"}},
 	}
 	for _, test := range tests {
 		t.Run(test.path, func(t *testing.T) {
@@ -1295,17 +1295,6 @@ func interruptPersonalConsumers(ipcEndpoint string, subscribeIDs []string) error
 }

 func stopPersonalConsumers(w io.Writer, ipcEndpoint string, subscribeIDs []string) error {
-	hasTarget := false
-	for _, id := range subscribeIDs {
-		if strings.TrimSpace(id) != "" {
-			hasTarget = true
-			break
-		}
-	}
-	if !hasTarget {
-		return nil
-	}
-
 	if _, err := personalStopConsumers(ipcEndpoint, subscribeIDs); err == nil {
 		return nil
 	} else if !errors.Is(err, busctl.ErrConsumerStopUnsupported) {
@@ -734,7 +734,7 @@ func TestCrossPlatformCoverageRunPersonalEventConsumeManySetupAndCleanupEdges(t
 	})
 }

-func TestCrossPlatformCoverageStopPersonalConsumersUsesTargetedRPCAndLegacyFallback(t *testing.T) {
+func TestStopPersonalConsumersUsesTargetedRPCAndLegacyFallback(t *testing.T) {
 	oldStop := personalStopConsumers
 	oldQuery := personalQueryStatus
 	oldFind := personalFindProcess
@@ -746,18 +746,6 @@ func TestCrossPlatformCoverageStopPersonalConsumersUsesTargetedRPCAndLegacyFallb
 		personalSignalProcess = oldSignal
 	}()

-	personalStopConsumers = func(string, []string) (transport.ConsumerStopResp, error) {
-		t.Fatal("targeted stop called without a subscribe_id")
-		return transport.ConsumerStopResp{}, nil
-	}
-	personalQueryStatus = func(string) (*transport.StatusResp, error) {
-		t.Fatal("legacy status queried without a subscribe_id")
-		return nil, nil
-	}
-	if err := stopPersonalConsumers(io.Discard, "endpoint", []string{"", "  "}); err != nil {
-		t.Fatalf("empty target stop = %v", err)
-	}
-
 	personalStopConsumers = func(string, []string) (transport.ConsumerStopResp, error) {
 		return transport.ConsumerStopResp{Stopped: []string{"sub-a"}}, nil
 	}
@@ -1,175 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0
-
-package app
-
-import (
-	"testing"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cli"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/shortcut"
-	"github.com/spf13/cobra"
-)
-
-func TestCrossPlatformCoverageSheetWhiteboardMarkdownRoutes(t *testing.T) {
-	root := NewRootCommand()
-	tools := deliverySchemaAllToolsForHelpFlagTest(t, root)
-	assertMarkdownLarkTasksRouteWithoutDuplicateShortcuts(t, root, tools)
-	assertMarkdownDriveRoutesStayCrossProduct(t, root, tools)
-	assertWhiteboardPublicShortcutsStayAvailableInSchema(t, root, tools)
-}
-
-func assertMarkdownLarkTasksRouteWithoutDuplicateShortcuts(t *testing.T, root *cobra.Command, tools map[string]map[string]any) {
-	t.Helper()
-	registered := 0
-	for _, item := range shortcut.All() {
-		if item.Service == "markdown" {
-			registered++
-		}
-	}
-	if registered != 0 {
-		t.Fatalf("registered Markdown Shortcuts=%d, want 0: existing composite leaves own these workflows", registered)
-	}
-
-	type route struct {
-		canonical    string
-		confirmation string
-		flags        []string
-	}
-	routes := map[string]route{
-		"create": {
-			canonical: "markdown.create", confirmation: "not_required",
-			flags: []string{"content", "file", "folder", "name", "space-id", "workspace"},
-		},
-		"fetch": {
-			canonical: "markdown.fetch", confirmation: "not_required",
-			flags: []string{"node", "output", "space-id", "workspace"},
-		},
-		"overwrite": {
-			canonical: "markdown.overwrite", confirmation: "user_required",
-			flags: []string{"content", "dry-run", "file", "name", "node", "space-id", "workspace"},
-		},
-		"patch": {
-			canonical: "markdown.patch", confirmation: "user_required",
-			flags: []string{"content", "dry-run", "node", "pattern", "regex", "space-id", "workspace"},
-		},
-		"diff": {
-			canonical: "markdown.diff", confirmation: "not_required",
-			flags: []string{"context", "file", "node", "version", "version2"},
-		},
-	}
-
-	group := mustFindCommand(t, root, "markdown")
-	children := map[string]bool{}
-	for _, child := range group.Commands() {
-		children[child.Name()] = true
-	}
-	if len(children) != len(routes) {
-		t.Fatalf("Markdown ordinary leaves=%v, want exactly five routed workflows", children)
-	}
-
-	for name, want := range routes {
-		leaf := mustFindCommand(t, root, "markdown", name)
-		if leaf.Hidden || !leaf.Runnable() {
-			t.Errorf("markdown %s hidden/runnable=%v/%v, want false/true", name, leaf.Hidden, leaf.Runnable())
-		}
-		if !children[name] {
-			t.Errorf("markdown %s is not mounted on the ordinary product group", name)
-		}
-		for _, flag := range want.flags {
-			if leaf.Flags().Lookup(flag) == nil {
-				t.Errorf("markdown %s is missing routed flag --%s", name, flag)
-			}
-		}
-		if shortcut.InPublicCatalog("markdown", "+"+name) {
-			t.Errorf("markdown +%s unexpectedly entered the public Shortcut catalog", name)
-		}
-
-		meta, ok := cli.ResolveMeta("markdown " + name)
-		if !ok {
-			t.Errorf("markdown %s missing from assembled Schema", name)
-			continue
-		}
-		if meta.Identity.Canonical != want.canonical || meta.Identity.CLIPath != "markdown "+name {
-			t.Errorf("markdown %s identity=%#v, want canonical=%q cli_path=%q", name, meta.Identity, want.canonical, "markdown "+name)
-		}
-		if meta.Safety.Confirmation != want.confirmation {
-			t.Errorf("markdown %s confirmation=%q, want %q", name, meta.Safety.Confirmation, want.confirmation)
-		}
-
-		tool := tools[want.canonical]
-		if tool == nil {
-			t.Errorf("markdown %s missing from full delivery Schema", name)
-			continue
-		}
-		if got := schemaContractString(tool["availability"]); got != "available" {
-			t.Errorf("markdown %s availability=%q, want available", name, got)
-		}
-		if got := schemaContractString(tool["interface_mode"]); got != "composite" {
-			t.Errorf("markdown %s interface_mode=%q, want composite", name, got)
-		}
-		if got := schemaContractString(tool["interface_reason"]); got == "" {
-			t.Errorf("markdown %s is missing the reviewed composite routing reason", name)
-		}
-	}
-}
-
-func assertMarkdownDriveRoutesStayCrossProduct(t *testing.T, root *cobra.Command, tools map[string]map[string]any) {
-	t.Helper()
-	driveShortcuts := map[string]string{
-		"+copy":             "drive.shortcut_copy",
-		"+delete":           "drive.shortcut_delete",
-		"+find-file":        "drive.shortcut_find_file",
-		"+list":             "drive.shortcut_list",
-		"+move":             "drive.shortcut_move",
-		"+publish-get":      "drive.shortcut_publish_get",
-		"+recycle-restore":  "drive.shortcut_recycle_restore",
-		"+rename":           "drive.shortcut_rename",
-		"+version-download": "drive.shortcut_version_download",
-		"+version-get":      "drive.shortcut_version_get",
-		"+version-history":  "drive.shortcut_version_history",
-		"+version-revert":   "drive.shortcut_version_revert",
-	}
-	for name, canonical := range driveShortcuts {
-		leaf := mustFindCommand(t, root, "drive", name)
-		if leaf.Hidden || !leaf.Runnable() {
-			t.Errorf("drive %s hidden/runnable=%v/%v, want false/true", name, leaf.Hidden, leaf.Runnable())
-		}
-		if !shortcut.InPublicCatalog("drive", name) {
-			t.Errorf("drive %s is not in the public Shortcut catalog", name)
-		}
-		assertMarkdownCrossProductRoute(t, tools, "drive "+name, canonical)
-	}
-
-	ordinaryRoutes := map[string]string{
-		"drive permission list": "drive.list_permission",
-		"drive pull":            "drive.folder_pull",
-		"drive push":            "drive.folder_push",
-		"drive status":          "drive.folder_status",
-		"drive sync":            "drive.folder_sync",
-		"wiki node list":        "wiki.list_nodes",
-	}
-	for cliPath, canonical := range ordinaryRoutes {
-		assertMarkdownCrossProductRoute(t, tools, cliPath, canonical)
-	}
-}
-
-func assertMarkdownCrossProductRoute(t *testing.T, tools map[string]map[string]any, cliPath, canonical string) {
-	t.Helper()
-	meta, ok := cli.ResolveMeta(cliPath)
-	if !ok {
-		t.Errorf("cross-product route %q is missing from assembled Schema", cliPath)
-		return
-	}
-	if meta.Identity.Canonical != canonical || meta.Identity.CLIPath != cliPath {
-		t.Errorf("cross-product route %q identity=%#v, want canonical=%q", cliPath, meta.Identity, canonical)
-	}
-	tool := tools[canonical]
-	if tool == nil {
-		t.Errorf("cross-product route %q is missing from full delivery Schema", cliPath)
-		return
-	}
-	if got := schemaContractString(tool["availability"]); got != "available" {
-		t.Errorf("cross-product route %q availability=%q, want available", cliPath, got)
-	}
-}
@@ -1,35 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0
-
-package app
-
-import (
-	"testing"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/corecmd/contract"
-)
-
-func TestOAFinalSchemaAvailabilityMatchesReviewedExecution(t *testing.T) {
-	snapshot := fullSchemaSnapshotForTest(t)
-	for _, canonical := range []string{
-		"oa.shortcut_approve_by",
-		"oa.shortcut_done_approvals",
-		"oa.shortcut_list_cc",
-		"oa.shortcut_list_executed",
-		"oa.shortcut_list_forms",
-		"oa.shortcut_list_pending",
-		"oa.shortcut_list_submitted",
-		"oa.shortcut_my_initiated",
-		"oa.shortcut_pending",
-		"oa.shortcut_search_forms",
-	} {
-		tool, ok := snapshot.Tools[canonical]
-		if !ok {
-			t.Errorf("final Schema lacks OA tool %s", canonical)
-			continue
-		}
-		if got := tool["availability"]; got != contract.InterfaceAvailable {
-			t.Errorf("%s final availability=%v, want %q", canonical, got, contract.InterfaceAvailable)
-		}
-	}
-}
@@ -68,34 +68,6 @@ func (c *paramAliasCaptureCaller) paramAliasResponseForTool(tool string) string
 		return `{"success":true,"result":[]}`
 	case "list_suggested_event_times":
 		return `{"success":true,"result":{"recommendEventTimes":[]}}`
-	case "list_by_keyword_and_time_range":
-		return `{"success":true,"result":{"itemList":[{"taskUuid":"u1","startTime":1}]}}`
-	case "get_minutes_basic_info":
-		return `{"success":true,"result":{"taskUuid":"u1","title":"Fixture Minutes"}}`
-	case "get_minutes_transcription":
-		return `{"success":true,"result":{"paragraphList":[],"hasNext":false}}`
-	case "create_personal_todo":
-		return `{"success":true,"result":{"taskId":"task-1"}}`
-	case "get_todo_detail":
-		return `{"success":true,"result":{"todoDetailModel":{"taskId":"task-1","subject":"Fixture Todo","isDone":false}}}`
-	case "get_user_todos_in_current_org":
-		return `{"success":true,"result":{"todoCards":[],"hasMore":false}}`
-	case "add_todo_reminder":
-		return `{"success":true}`
-	case "copy_document":
-		return `{"success":true,"nodeId":"copy-1"}`
-	case "move_document", "add_member", "update_member", "remove_member":
-		return `{"success":true}`
-	case "get_document_info":
-		if len(c.calls) > 1 {
-			switch c.calls[len(c.calls)-2].tool {
-			case "copy_document":
-				return `{"success":true,"nodeId":"copy-1","workspaceId":"workspace-1","folderId":"folder-1"}`
-			case "move_document":
-				return `{"success":true,"nodeId":"node-1","workspaceId":"drive-1","folderId":"folder-1"}`
-			}
-		}
-		return `{"success":true,"nodeId":"node-1","workspaceId":"source-1","folderId":"source-folder"}`
 	case "create_calendar_event":
 		return `{"success":true,"result":{"eventId":"event-1"}}`
 	case "update_calendar_event", "delete_calendar_event", "add_calendar_participant", "remove_calendar_participant":
@@ -148,12 +148,12 @@ var paramAliasCompleteCommands = map[string][]string{
 	"contact +resolve-dept":                    {"contact", "+resolve-dept", "--name", "Fixture Dept"},
 	"contact +search-user":                     {"contact", "+search-user", "--query", "Fixture User"},
 	"contact dept list-children":               {"contact", "dept", "list-children", "--dept", "1"},
-	"contact user profile get":                 {"contact", "user", "profile", "get", "--staff-id", "user-1", "--fields", "name,userId"},
+	"contact user profile get":                 {"contact", "user", "profile", "get", "--staff-id", "user-1"},
 	"dev app get":                              {"dev", "app", "get", "--unified-app-id", "app-1"},
 	"devdoc article search":                    {"devdoc", "article", "search", "--query", "fixture", "--page", "2", "--size", "7"},
 	"ding +receiver-status":                    {"ding", "+receiver-status", "--ding-id", "ding-1"},
 	"ding message receiver-status":             {"ding", "message", "receiver-status", "--ding-id", "ding-1"},
-	"ding message send":                        {"ding", "message", "send", "--robot-code", "robot-1", "--content", "fixture", "--users", "user-1"},
+	"ding message send":                        {"ding", "message", "send", "--robot-code", "robot-1", "--content", "fixture", "--users", "user-1", "--yes"},
 	"doc +comment-create":                      {"doc", "+comment-create", "--node", "node-1", "--content", "fixture comment", "--yes"},
 	"doc +comment-list":                        {"doc", "+comment-list", "--node", "node-1", "--limit", "7", "--cursor", "cursor-1"},
 	"doc +comment-reply":                       {"doc", "+comment-reply", "--node", "node-1", "--comment-key", "comment-1", "--content", "fixture reply", "--yes"},
@@ -221,196 +221,21 @@ var paramAliasCompleteCommands = map[string][]string{
 	"drive search":                             {"drive", "search", "--query", "fixture", "--created-from", "1", "--created-to", "2", "--modified-from", "3", "--modified-to", "4", "--creator-uids", "user-1,user-2"},
 	"drive upload":                             {"drive", "upload", "--file", "../../go.mod", "--space-id", "space-1"},
 	"drive upload-info":                        {"drive", "upload-info", "--file-name", "fixture.txt", "--file-size", "7", "--space-id", "space-1"},
-	"mail +find-mail-user":                     {"mail", "+find-mail-user", "--query", "fixture", "--limit", "7", "--cursor", "cursor-1"},
-	"mail folder update":                       {"mail", "folder", "update", "--email", "fixture@example.com", "--id", "folder-1", "--name", "Fixture Folder"},
+	"mail +find-mail-user":                     {"mail", "+find-mail-user", "--query", "fixture", "--limit", "7"},
+	"mail folder update":                       {"mail", "folder", "update", "--email", "fixture@example.com", "--id", "folder-1", "--name", "Fixture Folder", "--yes"},
 	"mail message search":                      {"mail", "message", "search", "--email", "fixture@example.com", "--query", "subject:fixture"},
 	"mail thread list":                         {"mail", "thread", "list", "--email", "fixture@example.com", "--folder", "folder-1", "--limit", "7"},
 	"mail user search":                         {"mail", "user", "search", "--keyword", "fixture"},
+	"oa +list-executed":                        {"oa", "+list-executed", "--limit", "7", "--page", "1"},
 	"oa +search-forms":                         {"oa", "+search-forms", "--query", "fixture"},
 	"oa approval search-forms":                 {"oa", "approval", "search-forms", "--query", "fixture"},
 	"report list":                              {"report", "list", "--start", "2026-03-10T00:00:00+08:00", "--end", "2026-03-10T23:59:59+08:00"},
 }

-// paramAliasCandidateCompleteCommands contains complete invocations for
-// reviewed parameter-concept product drafts. Keeping candidate-only commands
-// in a separate map lets a test change land before a draft replaces the formal
-// param_concepts.json: inactive candidate templates are ignored, while every
-// command becomes mandatory as soon as one of its reviewed aliases is active.
-var paramAliasCandidateCompleteCommands = map[string][]string{
-	"aisearch":                             {"aisearch", "--query", "Fixture User", "--dimension", "name"},
-	"aisearch +search-person":              {"aisearch", "+search-person", "--query", "Fixture User", "--dimensions", "name"},
-	"aisearch behavior":                    {"aisearch", "behavior", "--queries", "fixture", "--types", "im", "--behavior-type", "send", "--chat-scope", "Fixture Group", "--direction", "我->Fixture User", "--time-range", "本周"},
-	"aisearch enterprise":                  {"aisearch", "enterprise", "--queries", "fixture", "--types", "document", "--time-range", "本周"},
-	"aisearch person":                      {"aisearch", "person", "--query", "Fixture User", "--dimension", "name"},
-	"contact +by-mobile":                   {"contact", "+by-mobile", "--mobile", "13800138000"},
-	"contact +list-dept-members":           {"contact", "+list-dept-members", "--depts", "1,2"},
-	"contact +list-followings":             {"contact", "+list-followings", "--open-id", "open-fixture-1"},
-	"contact +list-role-members":           {"contact", "+list-role-members", "--id", "12345"},
-	"contact +lookup":                      {"contact", "+lookup", "--name", "Fixture User"},
-	"contact +org":                         {"contact", "+org", "--name", "Fixture User"},
-	"contact +search-mobile":               {"contact", "+search-mobile", "--mobile", "13800138000"},
-	"contact +team":                        {"contact", "+team", "--name", "Fixture User"},
-	"contact account create":               {"contact", "account", "create", "--login-id", "fixture-login", "--org-user-name", "Fixture User", "--dept-ids", "1,2"},
-	"contact account update":               {"contact", "account", "update", "--user-id", "user-1", "--org-user-name", "Fixture User", "--depts", `[{"deptId":1}]`, "--avatar-file-id", "file-1", "--yes"},
-	"contact dept create":                  {"contact", "dept", "create", "--name", "Fixture Dept", "--parent", "1", "--create-dept-group", "--yes"},
-	"contact dept get-info":                {"contact", "dept", "get-info", "--dept", "1"},
-	"contact dept list-members":            {"contact", "dept", "list-members", "--depts", "1,2"},
-	"contact dept search":                  {"contact", "dept", "search", "--query", "Fixture Dept"},
-	"contact dept update":                  {"contact", "dept", "update", "--dept", "2", "--name", "Fixture Dept", "--parent", "1", "--yes"},
-	"contact label get":                    {"contact", "label", "get", "--names", "Fixture Role"},
-	"contact org create":                   {"contact", "org", "create", "--org-name", "Fixture Org", "--creator-username", "Fixture Creator"},
-	"contact user dismission search":       {"contact", "user", "dismission", "search", "--depts", "1,2", "--start", "2026-03-01", "--end", "2026-03-31", "--page", "2", "--limit", "7"},
-	"contact user get":                     {"contact", "user", "get", "--ids", "user-1,user-2"},
-	"contact user invite":                  {"contact", "user", "invite", "--org-user-mobile", "13800138000", "--org-user-name", "Fixture User", "--depts", `[{"deptId":1}]`},
-	"contact user search":                  {"contact", "user", "search", "--query", "Fixture User"},
-	"contact user search-mobile":           {"contact", "user", "search-mobile", "--mobile", "13800138000"},
-	"contact user update":                  {"contact", "user", "update", "--user-id", "user-1", "--org-user-name", "Fixture User", "--depts", `[{"deptId":1}]`, "--yes"},
-	"contact user update-ownness":          {"contact", "user", "update-ownness", "--user-id", "user-1", "--ownness-text", "Fixture Status", "--yes"},
-	"contact user update-self":             {"contact", "user", "update-self", "--avatar-file-id", "file-1", "--nick", "Fixture Nick", "--yes"},
-	"devdoc +search-docs":                  {"devdoc", "+search-docs", "--query", "fixture", "--page", "2", "--size", "7"},
-	"hrbrain +get-pool":                    {"hrbrain", "+get-pool", "--pool-code", "pool-1"},
-	"hrbrain +list-pool-employees":         {"hrbrain", "+list-pool-employees", "--pool-code", "pool-1", "--page", "2", "--page-size", "7"},
-	"hrbrain +list-pools":                  {"hrbrain", "+list-pools", "--keyword", "fixture", "--labels", "label-a,label-b", "--page", "2", "--page-size", "7"},
-	"hrbrain +profile-career":              {"hrbrain", "+profile-career", "--work-no", "work-1"},
-	"hrbrain +profile-labels":              {"hrbrain", "+profile-labels", "--staff-ids", "work-1,work-2", "--all-label"},
-	"hrbrain +profile-metadata":            {"hrbrain", "+profile-metadata", "--work-no", "work-1"},
-	"hrbrain +profile-performance":         {"hrbrain", "+profile-performance", "--work-no", "work-1"},
-	"hrbrain +query-profile":               {"hrbrain", "+query-profile", "--work-no", "work-1", "--data-queries", `[{"modelCode":"basic","fields":["name"]}]`},
-	"hrbrain +search-employees":            {"hrbrain", "+search-employees", "--keyword", "fixture", "--dept-name", "Fixture Dept", "--position-name", "Engineer", "--job-level", "P7", "--pool-code", "pool-1", "--page", "2", "--page-size", "7"},
-	"hrbrain +search-employees-structured": {"hrbrain", "+search-employees-structured", "--origin-json", `{"rules":[],"combinator":"and"}`, "--fields", `[{"label":"name","value":"name"}]`, "--order-by", "name", "--page", "2", "--page-size", "7"},
-	"hrbrain profile career":               {"hrbrain", "profile", "career", "--work-no", "work-1"},
-	"hrbrain profile labels":               {"hrbrain", "profile", "labels", "--staff-ids", "work-1,work-2", "--all-label"},
-	"hrbrain profile metadata":             {"hrbrain", "profile", "metadata", "--work-no", "work-1"},
-	"hrbrain profile performance":          {"hrbrain", "profile", "performance", "--work-no", "work-1"},
-	"hrbrain profile query":                {"hrbrain", "profile", "query", "--work-no", "work-1", "--data-queries", `[{"modelCode":"basic","fields":["name"]}]`},
-	"hrbrain search employees":             {"hrbrain", "search", "employees", "--keyword", "fixture", "--dept-name", "Fixture Dept", "--position-name", "Engineer", "--job-level", "P7", "--pool-code", "pool-1", "--page", "2", "--page-size", "7"},
-	"hrbrain search employees-structured":  {"hrbrain", "search", "employees-structured", "--origin-json", `{"rules":[],"combinator":"and"}`, "--fields", `[{"label":"name","value":"name"}]`, "--order-by", "name", "--page", "2", "--page-size", "7"},
-	"hrbrain talent-pool detail":           {"hrbrain", "talent-pool", "detail", "--pool-code", "pool-1"},
-	"hrbrain talent-pool employees":        {"hrbrain", "talent-pool", "employees", "--pool-code", "pool-1", "--page", "2", "--page-size", "7"},
-	"hrbrain talent-pool list":             {"hrbrain", "talent-pool", "list", "--keyword", "fixture", "--labels", "label-a,label-b", "--page", "2", "--page-size", "7"},
-	"pat +browser-policy":                  {"pat", "+browser-policy", "--enabled=false", "--agent-code", "fixture-agent", "--dry-run"},
-	"pat browser-policy":                   {"pat", "browser-policy", "--enabled=false", "--agentCode", "fixture-agent"},
-	"pat chmod":                            {"pat", "chmod", "--product", "calendar", "--products", "aitable", "--domain", "chat", "--domains", "mail", "--grant-type", "session", "--session-id", "session-1", "--recommend", "--agentCode", "fixture-agent", "--dry-run"},
-	"attendance +check-record":             {"attendance", "+check-record", "--users", "user-1,user-2", "--start", "2026-03-10 00:00:00", "--end", "2026-03-10 23:59:59"},
-	"attendance +get-adjustment-rule":      {"attendance", "+get-adjustment-rule", "--adjustment-id", "adjustment-1"},
-	"attendance +get-approve-template":     {"attendance", "+get-approve-template", "--type", "leave"},
-	"attendance +get-checkin-record":       {"attendance", "+get-checkin-record", "--operator-corp-id", "corp-1", "--operator-staff-id", "staff-operator", "--staff-ids", "staff-1,staff-2", "--start", "2026-03-10 00:00:00", "--end", "2026-03-10 23:59:59"},
-	"attendance +get-leave-records":        {"attendance", "+get-leave-records", "--user", "user-1", "--start", "2026-03-01", "--end", "2026-03-31", "--leave-code", "annual_leave"},
-	"attendance +get-overtime-rule":        {"attendance", "+get-overtime-rule", "--overtime-id", "overtime-1"},
-	"attendance +get-schedule":             {"attendance", "+get-schedule", "--users", "user-1,user-2", "--start", "2026-03-10", "--end", "2026-03-11"},
-	"attendance +get-self-setting":         {"attendance", "+get-self-setting", "--user", "user-1", "--setting-scene", "checkRemind"},
-	"attendance +get-summary":              {"attendance", "+get-summary", "--user", "user-1", "--date", "2026-03-10", "--stats-type", "week"},
-	"attendance +list-approve":             {"attendance", "+list-approve", "--users", "user-1,user-2", "--types", "leave", "--start", "2026-03-01", "--end", "2026-03-31"},
-	"attendance +query-report-data":        {"attendance", "+query-report-data", "--users", "user-1,user-2", "--columns", "attendance_days,late_count", "--start", "2026-03-01", "--end", "2026-03-31"},
-	"attendance +search-adjustment-rule":   {"attendance", "+search-adjustment-rule", "--query", "fixture", "--page", "2", "--limit", "7"},
-	"attendance +search-class":             {"attendance", "+search-class", "--filter-type", "name", "--query", "fixture"},
-	"attendance +search-group":             {"attendance", "+search-group", "--type", "FIXED"},
-	"attendance +search-overtime-rule":     {"attendance", "+search-overtime-rule", "--query", "fixture", "--page", "2", "--limit", "7"},
-	"ding +list":                           {"ding", "+list", "--cursor", "0", "--type", "ALL"},
-	"ding +recall-personal":                {"ding", "+recall-personal", "--id", "ding-1", "--yes"},
-	"ding +send-personal":                  {"ding", "+send-personal", "--users", appFixtureCurrentDOpenID, "--content", "fixture", "--yes"},
-	"mail +contact-list":                   {"mail", "+contact-list", "--email", "fixture@example.com", "--limit", "7", "--cursor", "cursor-1"},
-	"mail +folder-list":                    {"mail", "+folder-list", "--email", "fixture@example.com", "--folder", "folder-1"},
-	"mail +message":                        {"mail", "+message", "--email", "fixture@example.com", "--id", "message-1"},
-	"mail +messages":                       {"mail", "+messages", "--email", "fixture@example.com", "--ids", "message-1,message-2"},
-	"mail +recent-mail":                    {"mail", "+recent-mail", "--limit", "7", "--cursor", "cursor-1"},
-	"mail +search-mail":                    {"mail", "+search-mail", "--query", "fixture", "--size", "7", "--cursor", "cursor-1"},
-	"mail +template-list":                  {"mail", "+template-list", "--email", "fixture@example.com", "--limit", "7", "--cursor", "cursor-1"},
-	"mail +thread":                         {"mail", "+thread", "--email", "fixture@example.com", "--id", "thread-1"},
-	"mail +thread-list":                    {"mail", "+thread-list", "--email", "fixture@example.com", "--folder", "folder-1", "--cursor", "cursor-1"},
-	"mail +triage":                         {"mail", "+triage", "--query", "fixture", "--limit", "7", "--cursor", "cursor-1"},
-	"mail +unread-mail":                    {"mail", "+unread-mail", "--size", "7", "--cursor", "cursor-1"},
-	"mail +user-search":                    {"mail", "+user-search", "--keyword", "fixture", "--cursor", "cursor-1"},
-	"markdown create":                      {"markdown", "create", "--content", "# Fixture", "--name", "fixture.md", "--space-id", "space-1"},
-	"markdown diff":                        {"markdown", "diff", "--node", "node-1", "--version", "1", "--version2", "2", "--context", "3"},
-	"markdown fetch":                       {"markdown", "fetch", "--node", "node-1", "--space-id", "space-1", "--output", "/tmp/dws-markdown-fixture.md"},
-	"markdown overwrite":                   {"markdown", "overwrite", "--node", "node-1", "--content", "# Fixture", "--name", "fixture.md", "--space-id", "space-1", "--yes"},
-	"markdown patch":                       {"markdown", "patch", "--node", "node-1", "--pattern", "old", "--content", "new", "--regex", "--space-id", "space-1", "--yes"},
-	"oa +list-cc":                          {"oa", "+list-cc", "--page", "2"},
-	"oa +list-executed":                    {"oa", "+list-executed", "--limit", "7", "--page", "2"},
-	"oa +list-forms":                       {"oa", "+list-forms", "--cursor", "2"},
-	"oa +list-pending":                     {"oa", "+list-pending", "--start", "1773072000000", "--end", "1773158399000", "--page", "2"},
-	"oa +list-submitted":                   {"oa", "+list-submitted", "--page", "2"},
-	"oa +my-initiated":                     {"oa", "+my-initiated", "--page", "2"},
-	"report +outbox-list":                  {"report", "+outbox-list", "--size", "7"},
-	"report +report-latest":                {"report", "+report-latest", "--keyword", "Fixture", "--start", "2026-03-01T00:00:00+08:00", "--end", "2026-03-10T00:00:00+08:00"},
-	"report +template-search":              {"report", "+template-search", "--query", "fixture"},
-	"sheet +list-sheets":                   {"sheet", "+list-sheets", "--node", "node-1"},
-	"sheet +read":                          {"sheet", "+read", "--node", "node-1", "--sheet-id", "Sheet1"},
-
-	"minutes +detail":             {"minutes", "+detail", "--ids", "u1,u2"},
-	"minutes +latest":             {"minutes", "+latest", "--keyword", "fixture"},
-	"minutes +list-all":           {"minutes", "+list-all", "--limit", "7"},
-	"minutes +record-pause":       {"minutes", "+record-pause", "--id", "u1", "--yes"},
-	"minutes +replace-batch":      {"minutes", "+replace-batch", "--id", "u1", "--pair", "old=>new", "--yes"},
-	"minutes +search":             {"minutes", "+search", "--query", "fixture", "--cursor", "cursor-1"},
-	"minutes +share":              {"minutes", "+share", "--ids", "u1,u2", "--member-uids", "user-1,user-2", "--permission", "view", "--yes"},
-	"minutes +speaker-replace":    {"minutes", "+speaker-replace", "--id", "u1", "--from", "old", "--to", "new", "--target-uid", "user-1", "--yes"},
-	"minutes +summary":            {"minutes", "+summary", "--id", "u1", "--content", "fixture", "--yes"},
-	"minutes +transcript":         {"minutes", "+transcript", "--keyword", "fixture"},
-	"minutes +upload-and-analyze": {"minutes", "+upload-and-analyze", "--resume-id", "u1", "--yes"},
-	"minutes audio-memo list":     {"minutes", "audio-memo", "list", "--max", "7"},
-	"minutes get batch":           {"minutes", "get", "batch", "--ids", "u1,u2"},
-	"minutes hot-word add":        {"minutes", "hot-word", "add", "--words", "DWS,Minutes"},
-	"minutes list all":            {"minutes", "list", "all", "--end", "2026-03-10T23:59:59+08:00"},
-	"minutes list mine":           {"minutes", "list", "mine", "--start", "2026-03-10T00:00:00+08:00"},
-	"minutes replace-text":        {"minutes", "replace-text", "--id", "u1", "--search", "old", "--replace", "new"},
-	"minutes tag query":           {"minutes", "tag", "query", "--tag-id", "tag-1"},
-	"minutes update title":        {"minutes", "update", "title", "--id", "u1", "--title", "Fixture Minutes"},
-	"minutes upload complete":     {"minutes", "upload", "complete", "--session-id", "session-1"},
-	"todo +assign":                {"todo", "+assign", "--task", "Fixture Todo", "--to", "Fixture User", "--yes"},
-	"todo +assign-multi":          {"todo", "+assign-multi", "--task", "Fixture Todo", "--to", "Fixture User,User Two", "--yes"},
-	"todo +comment":               {"todo", "+comment", "--task-id", "task-1", "--content", "fixture comment", "--yes"},
-	"todo +complete":              {"todo", "+complete", "--task-id", "task-1", "--yes"},
-	"todo +create":                {"todo", "+create", "--title", "Fixture Todo", "--executors", "user-1,user-2", "--due", "2026-03-10T18:00:00+08:00", "--yes"},
-	"todo +due-today":             {"todo", "+due-today", "--role-types", "executor"},
-	"todo +get-my-tasks":          {"todo", "+get-my-tasks", "--role-types", "executor", "--priority", "40", "--page", "2", "--size", "7"},
-	"todo +get-related-tasks":     {"todo", "+get-related-tasks", "--role-types", "creator,executor", "--status", "false"},
-	"todo +list-comment":          {"todo", "+list-comment", "--task-id", "task-1", "--page", "2"},
-	"todo +remind":                {"todo", "+remind", "--task", "Fixture Todo", "--at", "2026-03-10T18:00:00+08:00", "--yes"},
-	"todo +reminder":              {"todo", "+reminder", "--task-id", "task-1", "--base-time", "customTime", "--at", "2026-03-10T18:00:00+08:00", "--yes"},
-	"todo +reopen":                {"todo", "+reopen", "--task-id", "task-1", "--yes"},
-	"todo +search":                {"todo", "+search", "--query", "fixture", "--status", "false"},
-	"todo +todo-done":             {"todo", "+todo-done", "--task", "Fixture Todo", "--yes"},
-	"todo +update":                {"todo", "+update", "--task-id", "task-1", "--title", "Fixture Updated Todo", "--yes"},
-	"todo comment add":            {"todo", "comment", "add", "--task-id", "task-1", "--content", "fixture comment", "--yes"},
-	"todo comment list":           {"todo", "comment", "list", "--task-id", "task-1", "--page", "2", "--size", "7"},
-	"todo task add-executor":      {"todo", "task", "add-executor", "--task-id", "task-1", "--executors", "user-1,user-2", "--yes"},
-	"todo task add-participant":   {"todo", "task", "add-participant", "--task-id", "task-1", "--participants", "user-1,user-2", "--yes"},
-	"todo task add-reminder":      {"todo", "task", "add-reminder", "--task-id", "task-1", "--base-time", "customTime", "--reminder-time-stamp", "2026-03-10T18:00:00+08:00", "--yes"},
-	"todo task create":            {"todo", "task", "create", "--title", "Fixture Todo", "--executors", "user-1,user-2", "--due", "2026-03-10T18:00:00+08:00", "--yes"},
-	"todo task create-sub":        {"todo", "task", "create-sub", "--parent-id", "task-parent", "--title", "Fixture Sub Todo", "--executors", "user-1", "--yes"},
-	"todo task done":              {"todo", "task", "done", "--task-id", "task-1", "--status", "true", "--yes"},
-	"todo task get":               {"todo", "task", "get", "--task-id", "task-1"},
-	"todo task list":              {"todo", "task", "list", "--role-types", "executor", "--page", "2", "--size", "7"},
-	"todo task update":            {"todo", "task", "update", "--task-id", "task-1", "--done", "true", "--yes"},
-	"wiki +member-add":            {"wiki", "+member-add", "--workspace", "workspace-1", "--user", "user-1", "--role", "READER", "--yes"},
-	"wiki +member-remove":         {"wiki", "+member-remove", "--workspace", "workspace-1", "--user", "user-1", "--yes"},
-	"wiki +member-update":         {"wiki", "+member-update", "--workspace", "workspace-1", "--user", "user-1", "--role", "EDITOR", "--yes"},
-	"wiki +move":                  {"wiki", "+move", "--workspace", "workspace-1", "--node", "node-1", "--folder", "folder-1", "--yes"},
-	"wiki +move-to-drive":         {"wiki", "+move-to-drive", "--node", "node-1", "--folder", "folder-1", "--yes"},
-	"wiki +node-copy":             {"wiki", "+node-copy", "--workspace", "workspace-1", "--node", "node-1", "--folder", "folder-1", "--yes"},
-	"wiki +node-delete":           {"wiki", "+node-delete", "--workspace", "workspace-1", "--node", "node-1", "--yes"},
-}
-
 // A command can expose more than one mutually exclusive canonical route. In
 // that case the shared command template above cannot contain every canonical
 // flag at once, so select a fixture-specific complete invocation here.
 var paramAliasCompleteCommandVariants = map[string]map[string][]string{
-	"markdown create": {
-		"file": {"markdown", "create", "--file", "../../README.md", "--name", "fixture.md", "--space-id", "space-1"},
-	},
-	"markdown diff": {
-		"file": {"markdown", "diff", "--node", "node-1", "--file", "../../README.md", "--context", "3"},
-	},
-	"markdown overwrite": {
-		"file":    {"markdown", "overwrite", "--node", "node-1", "--file", "../../README.md", "--name", "fixture.md", "--space-id", "space-1", "--yes"},
-		"dry-run": {"markdown", "overwrite", "--node", "node-1", "--content", "# Fixture", "--name", "fixture.md", "--space-id", "space-1", "--dry-run"},
-	},
-	"markdown patch": {
-		"dry-run": {"markdown", "patch", "--node", "node-1", "--pattern", "old", "--content", "new", "--regex", "--dry-run"},
-	},
-
 	"doc +copy": {
 		"folder":    {"doc", "+copy", "--node", "node-1", "--folder", "folder-1", "--yes"},
 		"workspace": {"doc", "+copy", "--node", "node-1", "--workspace", "workspace-1", "--yes"},
@@ -706,20 +531,6 @@ var paramAliasNewConfirmationCases = []struct {
 	{command: "drive +version-revert", emitted: "version-number", canonical: "version"},
 }

-// Candidate confirmation cases become active with the joint draft. One write
-// workflow per product plus TODO's reminder workflow proves semantic aliasing
-// cannot move execution across the shared --yes barrier.
-var paramAliasCandidateConfirmationCases = []struct {
-	command   string
-	emitted   string
-	canonical string
-}{
-	{command: "minutes +record-pause", emitted: "uuid", canonical: "id"},
-	{command: "todo +create", emitted: "deadline", canonical: "due"},
-	{command: "todo +reminder", emitted: "reminder-time-stamp", canonical: "at"},
-	{command: "wiki +node-copy", emitted: "node-id", canonical: "node"},
-}
-
 // paramAliasRepresentativePayloadCases keeps final transport coverage across
 // old concept aliases, command overrides, native compatibility flags, read and
 // write commands, and different products. Every reviewed alias is still
@@ -789,30 +600,6 @@ var paramAliasRepresentativePayloadCases = map[string]bool{
 	paramAliasPayloadCaseKey("report list", "from-date"):                             true, // date-range concept alias
 }

-// Candidate representatives exercise the final transport boundary for each
-// Minutes/TODO/Wiki alias family. They are required only when the exact fixture
-// exists in the loaded reviewed table, so the tests are mergeable before the
-// joint draft is promoted to internal/cli/param_concepts.json.
-var paramAliasCandidateRepresentativePayloadCases = map[string]bool{
-	paramAliasPayloadCaseKey("minutes +latest", "query"):               true,
-	paramAliasPayloadCaseKey("minutes +transcript", "query"):           true,
-	paramAliasPayloadCaseKey("minutes get batch", "uuids"):             true,
-	paramAliasPayloadCaseKey("minutes update title", "task-uuid"):      true,
-	paramAliasPayloadCaseKey("minutes upload complete", "upload-id"):   true,
-	paramAliasPayloadCaseKey("todo +create", "deadline"):               true,
-	paramAliasPayloadCaseKey("todo +get-my-tasks", "current-page"):     true,
-	paramAliasPayloadCaseKey("todo +reminder", "reminder-time-stamp"):  true,
-	paramAliasPayloadCaseKey("todo comment add", "text"):               true,
-	paramAliasPayloadCaseKey("todo task add-executor", "executor-ids"): true,
-	paramAliasPayloadCaseKey("todo task get", "todo-id"):               true,
-	paramAliasPayloadCaseKey("todo task update", "status"):             true,
-	paramAliasPayloadCaseKey("wiki +member-add", "user-id"):            true,
-	paramAliasPayloadCaseKey("wiki +member-remove", "uid"):             true,
-	paramAliasPayloadCaseKey("wiki +member-update", "user-id"):         true,
-	paramAliasPayloadCaseKey("wiki +move-to-drive", "node-id"):         true,
-	paramAliasPayloadCaseKey("wiki +node-copy", "node-id"):             true,
-}
-
 // paramAliasCalendarPayloadCases keeps the full reviewed Calendar expansion
 // separate from the long-lived app-c race process. Each case still executes
 // both canonical and alias argv through the real PreParse/Cobra path and
@@ -922,7 +709,6 @@ func TestCrossPlatformCoverageReviewedParamAliasesHaveCompleteTemplatesAndRepres
 	}

 	activeCommands := make(map[string]bool)
-	activeFixtureCases := make(map[string]bool)
 	activeCases := 0
 	executedRepresentatives := make(map[string]bool)
 	for _, fixture := range concepts.Fixture {
@@ -931,8 +717,6 @@ func TestCrossPlatformCoverageReviewedParamAliasesHaveCompleteTemplatesAndRepres
 		}
 		activeCommands[fixture.Command] = true
 		activeCases++
-		caseKey := paramAliasPayloadCaseKey(fixture.Command, fixture.Emitted)
-		activeFixtureCases[caseKey] = true
 		complete, ok := paramAliasCompleteCommand(fixture.Command, fixture.Expect)
 		if !ok {
 			t.Errorf("reviewed active fixture %q/%q has no complete-command E2E template", fixture.Command, fixture.Emitted)
@@ -945,7 +729,8 @@ func TestCrossPlatformCoverageReviewedParamAliasesHaveCompleteTemplatesAndRepres
 			continue
 		}

-		if !paramAliasRepresentativePayloadCases[caseKey] && !paramAliasCandidateRepresentativePayloadCases[caseKey] {
+		caseKey := paramAliasPayloadCaseKey(fixture.Command, fixture.Emitted)
+		if !paramAliasRepresentativePayloadCases[caseKey] {
 			continue
 		}
 		executedRepresentatives[caseKey] = true
@@ -957,43 +742,26 @@ func TestCrossPlatformCoverageReviewedParamAliasesHaveCompleteTemplatesAndRepres
 	if activeCases == 0 {
 		t.Fatal("reviewed fixture contains no active alias cases")
 	}
-	templateCommands := make(map[string]bool, len(paramAliasCompleteCommands)+len(paramAliasCandidateCompleteCommands))
 	for command := range paramAliasCompleteCommands {
 		if !activeCommands[command] {
 			t.Errorf("complete-command E2E template %q has no active reviewed fixture", command)
 		}
-		templateCommands[command] = true
-	}
-	for command := range paramAliasCandidateCompleteCommands {
-		if activeCommands[command] {
-			templateCommands[command] = true
-		}
 	}
 	for command := range activeCommands {
-		if !templateCommands[command] {
+		if _, ok := paramAliasCompleteCommands[command]; !ok {
 			t.Errorf("active reviewed command %q has no complete-command E2E template", command)
 		}
 	}
-	if len(activeCommands) != len(templateCommands) {
-		t.Fatalf("complete-command coverage = %d templates for %d active commands (%d active cases)", len(templateCommands), len(activeCommands), activeCases)
+	if len(activeCommands) != len(paramAliasCompleteCommands) {
+		t.Fatalf("complete-command coverage = %d templates for %d active commands (%d active cases)", len(paramAliasCompleteCommands), len(activeCommands), activeCases)
 	}
 	for caseKey := range paramAliasRepresentativePayloadCases {
 		if !executedRepresentatives[caseKey] {
 			t.Errorf("representative final-payload case %q has no active reviewed fixture", caseKey)
 		}
 	}
-	activeRepresentatives := len(paramAliasRepresentativePayloadCases)
-	for caseKey := range paramAliasCandidateRepresentativePayloadCases {
-		if !activeFixtureCases[caseKey] {
-			continue
-		}
-		activeRepresentatives++
-		if !executedRepresentatives[caseKey] {
-			t.Errorf("candidate representative final-payload case %q was not executed", caseKey)
-		}
-	}
-	if len(executedRepresentatives) != activeRepresentatives {
-		t.Fatalf("representative final-payload coverage = %d, want %d", len(executedRepresentatives), activeRepresentatives)
+	if len(executedRepresentatives) != len(paramAliasRepresentativePayloadCases) {
+		t.Fatalf("representative final-payload coverage = %d, want %d", len(executedRepresentatives), len(paramAliasRepresentativePayloadCases))
 	}
 }

@@ -1084,122 +852,6 @@ func assertParamAliasCannotBypassConfirmation(t *testing.T, aliasArgs []string)
 	}
 }

-// TestCrossPlatformCoverageReviewedProductTemplatedParamAliasesCannotBypassConfirmation
-// exercises every distinct reviewed mutating complete-command template in the
-// reviewed product expansions. The fixture gate already proves every
-// alias resolves through PreParse; this gate removes the confirmation flag
-// from one active alias invocation per distinct template and requires the
-// runtime boundary to stop it before the first transport call. An explicit
-// --dry-run is a reviewed preview path and must not carry a bypass flag.
-func TestCrossPlatformCoverageReviewedProductTemplatedParamAliasesCannotBypassConfirmation(t *testing.T) {
-	concepts, err := cli.LoadParamConcepts()
-	if err != nil {
-		t.Fatalf("LoadParamConcepts() error = %v", err)
-	}
-
-	requiredTemplates := make(map[string]bool)
-	coveredTemplates := make(map[string]bool)
-	for _, fixture := range concepts.Fixture {
-		if strings.HasPrefix(fixture.Expect, "did-you-mean:") {
-			continue
-		}
-		product, _, _ := strings.Cut(fixture.Command, " ")
-		switch product {
-		case "attendance", "mail", "oa", "ding", "report", "sheet", "whiteboard", "markdown",
-			"aisearch", "contact", "live", "devdoc", "hrbrain", "pat":
-		default:
-			continue
-		}
-		complete, ok := paramAliasCompleteCommand(fixture.Command, fixture.Expect)
-		if !ok {
-			continue
-		}
-		_, yesCount := removeExactArg(complete, "--yes")
-		_, userSayYesCount := removeExactArg(complete, "--user-say-yes")
-		confirmationCount := yesCount + userSayYesCount
-		confirmationArg := "--yes"
-		if userSayYesCount == 1 {
-			confirmationArg = "--user-say-yes"
-		}
-		_, dryRunCount := removeExactArg(complete, "--dry-run")
-		if dryRunCount > 1 {
-			t.Errorf("template must contain --dry-run at most once: command=%q args=%v", fixture.Command, complete)
-			continue
-		}
-		if meta, exists := cli.ResolveMeta(fixture.Command); exists {
-			switch meta.Safety.Confirmation {
-			case "user_required":
-				if dryRunCount == 1 {
-					if confirmationCount != 0 {
-						t.Errorf("Schema-confirmed dry-run template must not contain a confirmation bypass flag: command=%q args=%v", fixture.Command, complete)
-					}
-					continue
-				}
-				if confirmationCount != 1 {
-					t.Errorf("Schema-confirmed template must contain exactly one reviewed confirmation flag: command=%q confirmation=%q args=%v", fixture.Command, meta.Safety.Confirmation, complete)
-					continue
-				}
-			case "not_required":
-				if confirmationCount != 0 {
-					t.Errorf("Schema-unconfirmed template must not contain a confirmation bypass flag: command=%q confirmation=%q args=%v", fixture.Command, meta.Safety.Confirmation, complete)
-					continue
-				}
-			}
-		}
-		if confirmationCount == 0 {
-			continue
-		}
-		if confirmationCount != 1 {
-			t.Errorf("confirmation template must contain exactly one reviewed confirmation flag: command=%q args=%v", fixture.Command, complete)
-			continue
-		}
-
-		templateKey := fixture.Command + "\x00" + strings.Join(complete, "\x00")
-		requiredTemplates[templateKey] = true
-		if coveredTemplates[templateKey] {
-			continue
-		}
-		aliasArgs, replacements := replaceLongFlag(complete, fixture.Expect, fixture.Emitted)
-		if replacements != 1 {
-			t.Errorf("confirmation template for %q/%q must contain canonical --%s exactly once; replacements=%d args=%v", fixture.Command, fixture.Emitted, fixture.Expect, replacements, complete)
-			continue
-		}
-		coveredTemplates[templateKey] = true
-		t.Run(fixture.Command+"/"+fixture.Emitted, func(t *testing.T) {
-			assertTemplatedParamAliasCannotBypassConfirmation(t, fixture.Command, confirmationArg, aliasArgs)
-		})
-	}
-
-	if len(requiredTemplates) == 0 {
-		t.Fatal("reviewed complete-command templates contain no confirmation cases")
-	}
-	if len(coveredTemplates) != len(requiredTemplates) {
-		t.Fatalf("templated confirmation coverage = %d, want %d", len(coveredTemplates), len(requiredTemplates))
-	}
-}
-
-func assertTemplatedParamAliasCannotBypassConfirmation(t *testing.T, command, confirmationArg string, aliasArgs []string) {
-	t.Helper()
-	unconfirmedArgs, removals := removeExactArg(aliasArgs, confirmationArg)
-	if removals != 1 {
-		t.Fatalf("confirmation template must contain %s exactly once; removals=%d args=%v", confirmationArg, removals, aliasArgs)
-	}
-
-	caller := &paramAliasCaptureCaller{}
-	ctx, err := executeParamAliasPayloadE2E(t, caller, unconfirmedArgs...)
-	if ctx == nil {
-		t.Fatal("unconfirmed alias command skipped PreParse")
-	}
-	var appErr *apperrors.Error
-	if errors.As(err, &appErr) && appErr.Reason == "confirmation_required" {
-		if len(caller.calls) != 0 {
-			t.Fatalf("unconfirmed alias crossed the transport boundary before confirmation: args=%v calls=%#v", unconfirmedArgs, caller.calls)
-		}
-		return
-	}
-	t.Fatalf("unconfirmed alias command error = %#v, want confirmation_required\ncommand=%q args=%v calls=%#v", err, command, unconfirmedArgs, caller.calls)
-}
-
 func assertParamAliasFinalPayloadEquivalent(t *testing.T, command string, canonicalArgs, aliasArgs []string) {
 	t.Helper()
 	canonicalCaller := &paramAliasCaptureCaller{}
@@ -1439,20 +1091,7 @@ func TestCrossPlatformCoverageNewAITableDeleteDisableAliasesPreserveConfirmation
 }

 func TestCrossPlatformCoverageNewParamAliasesCannotBypassConfirmation(t *testing.T) {
-	tests := append([]struct {
-		command   string
-		emitted   string
-		canonical string
-	}{}, paramAliasNewConfirmationCases...)
-	for _, candidate := range paramAliasCandidateConfirmationCases {
-		entry, exists := cli.LookupParamAlias(candidate.command)
-		target, active := entry.ResolveAlias(candidate.emitted)
-		if exists && active && target == candidate.canonical {
-			tests = append(tests, candidate)
-		}
-	}
-
-	for _, test := range tests {
+	for _, test := range paramAliasNewConfirmationCases {
 		test := test
 		t.Run(test.command+"/"+test.emitted, func(t *testing.T) {
 			complete, ok := paramAliasCompleteCommand(test.command, test.canonical)
@@ -1534,10 +1173,6 @@ func paramAliasCompleteCommand(command, canonical string) ([]string, bool) {
 			return variant, true
 		}
 	}
-	if ok {
-		return complete, true
-	}
-	complete, ok = paramAliasCandidateCompleteCommands[command]
 	return complete, ok
 }

@@ -740,7 +740,6 @@ func (r *runtimeRunner) executeInvocation(ctx context.Context, endpoint string,
 			"mcp_tool_error",
 			"MCP tool returned a business error; check tool parameters and refer to skill documentation.",
 			invocation.CanonicalProduct,
-			invocation.Tool,
 			diag,
 		)
 		logBusinessError(r.transport.FileLogger, serverFailureReason(mcpErr, "mcp_tool_error"), invocation, callResult.Content, diag)
@@ -766,7 +765,6 @@ func (r *runtimeRunner) executeInvocation(ctx context.Context, endpoint string,
 			"business_error",
 			"The API returned a business-level error. Check required parameters and values.",
 			invocation.CanonicalProduct,
-			invocation.Tool,
 			diag,
 		)
 		logBusinessError(r.transport.FileLogger, serverFailureReason(classifiedErr, "business_error"), invocation, callResult.Content, diag)
@@ -274,7 +274,6 @@ type agentExampleFiles struct {
 	markdown string
 	json     string
 	batch    string
-	job      string
 	binary   string
 	image    string
 }
@@ -284,14 +283,12 @@ func newAgentExampleFiles(t testing.TB, root string) agentExampleFiles {
 	markdown := filepath.Join(root, "content.md")
 	jsonFile := filepath.Join(root, "report.json")
 	batch := filepath.Join(root, "styles.json")
-	job := filepath.Join(root, "job.json")
 	binary := filepath.Join(root, "report.pdf")
 	image := filepath.Join(root, "chart.png")
 	for path, content := range map[string][]byte{
 		markdown: []byte("# Agent dry-run fixture\n\nNo business call is allowed.\n"),
 		jsonFile: []byte(`[{"content":"Agent dry-run fixture","sort":"0","key":"fixture","contentType":"markdown","type":"1"}]`),
 		batch:    []byte(`[{"sheetId":"Sheet1","range":"A1:B2","fontWeight":"bold"}]`),
-		job:      []byte(`{"name":"Java 工程师","description":"服务端开发","jobNature":"FULL-TIME","requiredEdu":6,"minSalary":20000,"maxSalary":35000,"extData":{"headCount":1,"fullTimeExtData":{"salaryMonth":12}},"creatorUserId":"creator-user-id","ownerUserIds":["owner-user-id"]}`),
 		binary:   []byte("%PDF-1.4\n%%EOF\n"),
 		image:    {0x89, 'P', 'N', 'G', '\r', '\n', 0x1a, '\n'},
 	} {
@@ -304,7 +301,6 @@ func newAgentExampleFiles(t testing.TB, root string) agentExampleFiles {
 		markdown: "./" + filepath.Base(markdown),
 		json:     "./" + filepath.Base(jsonFile),
 		batch:    "./" + filepath.Base(batch),
-		job:      "./" + filepath.Base(job),
 		binary:   "./" + filepath.Base(binary),
 		image:    "./" + filepath.Base(image),
 	}
@@ -355,10 +351,6 @@ func materializeAgentExampleArgv(argv []string, files agentExampleFiles) []strin
 			replacement = files.markdown
 		case "contents-file":
 			replacement = files.json
-		case "from":
-			if strings.HasSuffix(strings.ToLower(value), "job.json") {
-				replacement = files.job
-			}
 		case "batch":
 			if strings.HasSuffix(strings.ToLower(value), "styles.json") {
 				replacement = files.batch
@@ -72,9 +72,6 @@ func missingChatCatalogCoveragePaths() []string {
 		"chat clear-messages",
 		"chat clear-red-point",
 		"chat data-auth cross-org",
-		"chat emotion favorite",
-		"chat emotion list",
-		"chat emotion send",
 		"chat group audit-join-validation",
 		"chat group list-all",
 		"chat group list-join-validations",
@@ -136,53 +136,6 @@ func TestCrossPlatformCoverageOAAttachmentDeliveredSchemaMatchesExecutableHelp(t
 	}
 }

-// TestCrossPlatformCoverageOAAttachmentUploadDeliversCompositeSchema 验证合并后的
-// upload 命令以 composite 接口模式交付：它内部串联 init/commit 两个 RPC 与本地 HTTP PUT，
-// 无法绑定单一 interface_ref，因此不进入上面按 mcp 模式断言的表驱动用例。
-func TestCrossPlatformCoverageOAAttachmentUploadDeliversCompositeSchema(t *testing.T) {
-	snapshot := fullSchemaSnapshotForTest(t)
-	tool := snapshot.Tools["oa.attachment_upload"]
-	if tool == nil {
-		t.Fatal("oa.attachment_upload is missing from final Schema")
-	}
-	if got := schemaContractString(tool["primary_cli_path"]); got != "oa approval attachment upload" {
-		t.Fatalf("primary_cli_path = %q, want oa approval attachment upload", got)
-	}
-	if got := schemaContractString(tool["interface_mode"]); got != "composite" {
-		t.Fatalf("interface_mode = %q, want composite", got)
-	}
-	if got := schemaContractString(tool["availability"]); got != "available" {
-		t.Fatalf("availability = %q, want available", got)
-	}
-	if got := schemaContractString(tool["interface_reason"]); got == "" {
-		t.Fatal("composite upload command must document an interface reason")
-	}
-	if got := schemaContractString(tool["effect"]); got != "write" {
-		t.Fatalf("effect = %q, want write", got)
-	}
-	if got := schemaContractString(tool["risk"]); got != "low" {
-		t.Fatalf("risk = %q, want low", got)
-	}
-	if got := schemaContractString(tool["confirmation"]); got != "not_required" {
-		t.Fatalf("confirmation = %q, want not_required", got)
-	}
-	parameters := schemaContractMap(tool["parameters"])
-	for _, flag := range []string{"file", "file-name", "md5"} {
-		if parameters[flag] == nil {
-			t.Fatalf("upload --%s is missing from final Schema", flag)
-		}
-	}
-	if required, _ := parameters["file"]["required"].(bool); !required {
-		t.Fatalf("upload --file required = %#v, want true", parameters["file"]["required"])
-	}
-	result := schemaContractMap(tool["result"])
-	dataSchema := schemaContractMap(result["data_schema"])
-	properties := schemaContractMap(dataSchema["properties"])
-	if properties["fileId"] == nil {
-		t.Fatal("upload Result data_schema is missing fileId")
-	}
-}
-
 func oaAttachmentResultContract(t *testing.T, tool map[string]any, resultType string, fields map[string]string, sensitivePaths []string) map[string]any {
 	t.Helper()
 	result, ok := tool["result"].(map[string]any)
@@ -1,74 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-
-package app
-
-import (
-	"bytes"
-	"encoding/json"
-	"reflect"
-	"testing"
-)
-
-func recruitSchemaLeaf(t *testing.T, canonical string, compact bool) map[string]any {
-	t.Helper()
-	root := NewRootCommand()
-	var stdout, stderr bytes.Buffer
-	root.SetOut(&stdout)
-	root.SetErr(&stderr)
-	args := []string{"schema", canonical, "--format", "json"}
-	if compact {
-		args = append(args, "--compact")
-	}
-	root.SetArgs(args)
-	if err := root.Execute(); err != nil {
-		t.Fatalf("execute schema %s compact=%v: %v; stderr=%s", canonical, compact, err, stderr.String())
-	}
-	var payload map[string]any
-	if err := json.Unmarshal(stdout.Bytes(), &payload); err != nil {
-		t.Fatalf("decode schema %s compact=%v: %v", canonical, compact, err)
-	}
-	return payload
-}
-
-func TestRecruitDeliveredSchemaPublishesResultAndPagination(t *testing.T) {
-	for _, canonical := range []string{"recruit.list_jobs", "recruit.get_job_detail", "recruit.create_job"} {
-		t.Run(canonical, func(t *testing.T) {
-			full := recruitSchemaLeaf(t, canonical, false)
-			compact := recruitSchemaLeaf(t, canonical, true)
-			if full["result"] == nil || compact["result"] == nil {
-				t.Fatalf("result missing: full=%#v compact=%#v", full["result"], compact["result"])
-			}
-			if !reflect.DeepEqual(full["result"], compact["result"]) {
-				t.Fatalf("full/compact result mismatch\nfull=%#v\ncompact=%#v", full["result"], compact["result"])
-			}
-			if canonical == "recruit.list_jobs" {
-				if full["pagination"] == nil || compact["pagination"] == nil {
-					t.Fatalf("list pagination missing: full=%#v compact=%#v", full["pagination"], compact["pagination"])
-				}
-				if !reflect.DeepEqual(full["pagination"], compact["pagination"]) {
-					t.Fatalf("full/compact pagination mismatch\nfull=%#v\ncompact=%#v", full["pagination"], compact["pagination"])
-				}
-				parameters, _ := full["parameters"].(map[string]any)
-				cursor, _ := parameters["cursor"].(map[string]any)
-				if cursor["type"] != "string" || cursor["interface_type"] != "number" {
-					t.Fatalf("cursor contract = %#v, want CLI string converted to MCP number", cursor)
-				}
-				size, _ := parameters["size"].(map[string]any)
-				if required, _ := size["required"].(bool); required {
-					t.Fatalf("size required = true, want false: %#v", size)
-				}
-				if size["default"] != "20" {
-					t.Fatalf("size default = %#v, want 20", size["default"])
-				}
-				compactParameters, _ := compact["parameters"].(map[string]any)
-				compactSize, _ := compactParameters["size"].(map[string]any)
-				if compactRequired, _ := compactSize["required"].(bool); compactRequired || compactSize["default"] != "20" {
-					t.Fatalf("compact size contract = %#v, want required=false default=20", compactSize)
-				}
-			} else if full["pagination"] != nil || compact["pagination"] != nil {
-				t.Fatalf("non-list pagination must be absent: full=%#v compact=%#v", full["pagination"], compact["pagination"])
-			}
-		})
-	}
-}
@@ -1,70 +0,0 @@
-package app
-
-import (
-	"testing"
-)
-
-func TestSheetFloatImageLocalFileFinalSchema(t *testing.T) {
-	payload := schemaContractPayloadForBoundCanonicals(t, NewRootCommand(),
-		"sheet.create_float_image",
-		"sheet.update_float_image",
-	)
-
-	create := payload.Tools["sheet.create_float_image"]
-	if create == nil {
-		t.Fatal("missing sheet.create_float_image")
-	}
-	if create["interface_mode"] != "mcp" {
-		t.Fatalf("create interface mode = %#v", create["interface_mode"])
-	}
-	createRef, _ := create["interface_ref"].(map[string]any)
-	if createRef["product_id"] != "sheet" || createRef["rpc_name"] != "create_float_image" {
-		t.Fatalf("create interface ref = %#v", createRef)
-	}
-	createDryRun, _ := create["dry_run"].(map[string]any)
-	if createDryRun["preview_kind"] != "request" {
-		t.Fatalf("create dry-run = %#v", createDryRun)
-	}
-	if remoteReads, exists := createDryRun["remote_reads"]; exists && remoteReads != false {
-		t.Fatalf("create dry-run remote_reads = %#v", remoteReads)
-	}
-	createParameters, _ := create["parameters"].(map[string]any)
-	file, _ := createParameters["file"].(map[string]any)
-	src, _ := createParameters["src"].(map[string]any)
-	if file["required"] != false || file["required_when"] != "exactly one of --file or --src must be provided" {
-		t.Fatalf("create --file metadata = %#v", file)
-	}
-	if schemaContractString(file["property"]) != "" {
-		t.Fatalf("create --file leaked an RPC property: %#v", file["property"])
-	}
-	if src["required"] != false || schemaContractString(src["required_when"]) != "" || src["property"] != "src" {
-		t.Fatalf("create --src compatibility metadata = %#v", src)
-	}
-	assertSchemaContractConstraintGroup(t, create, "mutually_exclusive", []string{"file", "src"})
-	assertSchemaContractConstraintGroup(t, create, "require_one_of", []string{"file", "src"})
-
-	update := payload.Tools["sheet.update_float_image"]
-	if update == nil {
-		t.Fatal("missing sheet.update_float_image")
-	}
-	updateDryRun, _ := update["dry_run"].(map[string]any)
-	if update["interface_mode"] != "mcp" || updateDryRun["preview_kind"] != "request" {
-		t.Fatalf("update interface/dry-run = %#v/%#v", update["interface_mode"], updateDryRun)
-	}
-	updateParameters, _ := update["parameters"].(map[string]any)
-	updateFile, _ := updateParameters["file"].(map[string]any)
-	if schemaContractString(updateFile["property"]) != "" {
-		t.Fatalf("update --file leaked an RPC property: %#v", updateParameters["file"])
-	}
-	assertSchemaContractConstraintGroup(t, update, "mutually_exclusive", []string{"file", "src"})
-	assertSchemaContractConstraintGroup(t, update, "require_one_of", []string{"file", "src", "range", "width", "height", "offset-x", "offset-y"})
-
-	root := NewRootCommand()
-	for _, cliPath := range []string{"sheet create-float-image", "sheet update-float-image"} {
-		command := exactCommandForTest(root, cliPath)
-		if command == nil || command.Flags().Lookup("file") == nil {
-			t.Fatalf("%s has no executable --file flag", cliPath)
-		}
-	}
-
-}
@@ -16,12 +16,12 @@ import (
 )

 const (
-	publicShortcutCount = 425
+	publicShortcutCount = 435
 	// schemaPublishedShortcutCount counts every delivered *.shortcut_* tool,
-	// including reviewed hidden compatibility and unavailable contracts.
-	schemaPublishedShortcutCount = 482
+	// including the hidden historical minutes.shortcut_minutes_search contract.
+	schemaPublishedShortcutCount = 438
 	// publiclyDeliveredShortcutCount is the public-catalog subset of that surface.
-	publiclyDeliveredShortcutCount = 425
+	publiclyDeliveredShortcutCount = 435
 )

 func TestDeliverySchemaCoversOrExactlyExcludesEveryPublicShortcutContract(t *testing.T) {
@@ -114,7 +114,7 @@ func TestDeliveryShortcutProgressiveQueriesReturnCompleteContracts(t *testing.T)

 	product := executeShortcutSchemaQuery(t, "chat")
 	productPayload, _ := product["product"].(map[string]any)
-	if got, want := int(product["count"].(float64)), 220; got != want {
+	if got, want := int(product["count"].(float64)), 217; got != want {
 		t.Fatalf("schema chat count = %d, want %d", got, want)
 	}
 	summaries := schemaContractObjectSlice(productPayload["tools"])
@@ -140,57 +140,6 @@ func TestDeliveryShortcutProgressiveQueriesReturnCompleteContracts(t *testing.T)
 	assertChatCatalogCompleteLeafContracts(t)
 }

-func TestChatPersonalEmotionSchemaDeclaresUnpinnedIMAdapter(t *testing.T) {
-	for _, tc := range []struct {
-		cliPath string
-		params  map[string]string
-	}{
-		{
-			cliPath: "chat emotion list",
-		},
-		{
-			cliPath: "chat emotion send",
-			params: map[string]string{
-				"media-id":         "mediaId",
-				"emotion-id":       "emotionId",
-				"group":            "openConversationId",
-				"open-dingtalk-id": "receiverOpenDingTalkId",
-				"idempotency-key":  "uuid",
-			},
-		},
-		{
-			cliPath: "chat emotion favorite",
-			params: map[string]string{
-				"media-id":               "mediaId",
-				"name":                   "name",
-				"source-conversation-id": "sourceConversationId",
-				"source-message-id":      "sourceMessageId",
-			},
-		},
-	} {
-		t.Run(tc.cliPath, func(t *testing.T) {
-			leaf := executeShortcutSchemaQuery(t, "--cli-path", tc.cliPath)
-			if got := schemaContractString(leaf["interface_mode"]); got != "composite" {
-				t.Fatalf("%s interface_mode = %q, want composite", tc.cliPath, got)
-			}
-			reason := schemaContractString(leaf["interface_reason"])
-			if !strings.Contains(reason, "Reviewed unpinned remote adapter") {
-				t.Fatalf("%s interface_reason = %q", tc.cliPath, reason)
-			}
-			parameters := schemaContractMap(leaf["parameters"])
-			for name, want := range tc.params {
-				parameter := parameters[name]
-				if parameter == nil {
-					t.Fatalf("%s missing --%s parameter: %#v", tc.cliPath, name, parameters)
-				}
-				if got := schemaContractString(parameter["property"]); got != want {
-					t.Fatalf("%s --%s property = %q, want %q", tc.cliPath, name, got, want)
-				}
-			}
-		})
-	}
-}
-
 func TestCrossPlatformCoverageAITableTableBootstrapPublishesResultContract(t *testing.T) {
 	leaf := executeShortcutSchemaQuery(t, "--cli-path", "aitable +table-bootstrap")
 	result, _ := leaf["result"].(map[string]any)
@@ -271,60 +220,6 @@ func TestAllShortcutsWikiSchemaExamplesIncludeRequiredParameters(t *testing.T) {
 	}
 }

-func TestAllShortcutsAITableDatasourceExamplesSourceConfigHasRequiredMembers(t *testing.T) {
-	tools := deliverySchemaAllToolsForHelpFlagTest(t, NewRootCommand())
-	requiredSourceConfigMembers := []string{"processCode", "name", "iconUrl", "url"}
-	checked := 0
-	for _, declared := range shortcut.All() {
-		if declared.Service != "aitable" || declared.UserDefined || !shortcut.InPublicCatalog(declared.Service, declared.Command) {
-			continue
-		}
-		if !strings.HasPrefix(declared.Command, "+datasource-") {
-			continue
-		}
-		if declared.Command != "+datasource-create" && declared.Command != "+datasource-update" && declared.Command != "+datasource-get-fields" {
-			continue
-		}
-		checked++
-		canonical := shortcutSchemaCanonical(declared)
-		tool := tools[canonical]
-		if tool == nil {
-			t.Fatalf("delivery schema --all is missing %s", canonical)
-		}
-		examples := schemaContractStringSlice(tool["examples"])
-		if len(examples) == 0 {
-			t.Fatalf("%s has no delivered examples", canonical)
-		}
-		for _, example := range examples {
-			if !strings.Contains(example, "--source-config") {
-				continue
-			}
-			argv, err := cli.ParseAgentExampleArgv(example)
-			if err != nil {
-				t.Fatalf("%s example %q is not valid argv: %v", canonical, example, err)
-			}
-			sourceConfig := schemaExampleFlagValue(argv, "source-config")
-			if sourceConfig == "" {
-				t.Errorf("%s example %q contains --source-config but has no value", canonical, example)
-				continue
-			}
-			var cfg map[string]any
-			if err := json.Unmarshal([]byte(sourceConfig), &cfg); err != nil {
-				t.Errorf("%s example %q has invalid source-config JSON: %v", canonical, example, err)
-				continue
-			}
-			for _, member := range requiredSourceConfigMembers {
-				if _, ok := cfg[member]; !ok {
-					t.Errorf("%s example %q source-config is missing required member %q", canonical, example, member)
-				}
-			}
-		}
-	}
-	if checked != 3 {
-		t.Fatalf("checked aitable datasource source-config examples = %d, want 3", checked)
-	}
-}
-
 func schemaExampleHasLongFlag(argv []string, names ...string) bool {
 	for _, argument := range argv {
 		for _, name := range names {
@@ -336,25 +231,6 @@ func schemaExampleHasLongFlag(argv []string, names ...string) bool {
 	return false
 }

-func schemaExampleFlagValue(argv []string, name string) string {
-	prefix := "--" + name + "="
-	for _, argument := range argv {
-		if argument == "--"+name {
-			continue
-		}
-		if strings.HasPrefix(argument, prefix) {
-			return strings.TrimPrefix(argument, prefix)
-		}
-	}
-	// Value may be in the next argv entry: `--flag value` form.
-	for i := 0; i < len(argv)-1; i++ {
-		if argv[i] == "--"+name {
-			return argv[i+1]
-		}
-	}
-	return ""
-}
-
 func assertSchemaSummarySafety(
 	t testing.TB,
 	summaries map[string]map[string]any,
@@ -20,50 +20,18 @@ import (
 )

 type serverFailureClass struct {
-	message   string
-	reason    string
-	origin    string
-	stage     string
-	hint      string
-	actions   []string
-	operation string
-	retryable *bool
+	message string
+	reason  string
+	origin  string
+	stage   string
+	hint    string
+	actions []string
 }

-func classifyServerFailure(message, serverKey, tool string, diag apperrors.ServerDiagnostics) (serverFailureClass, bool) {
+func classifyServerFailure(message string, diag apperrors.ServerDiagnostics) (serverFailureClass, bool) {
 	code := strings.ToUpper(strings.TrimSpace(diag.ServerErrorCode))
 	detail := strings.ToLower(strings.TrimSpace(diag.TechnicalDetail))
 	text := strings.ToLower(strings.TrimSpace(message))
-	combined := text + " " + detail
-
-	if code == "999" &&
-		(strings.Contains(combined, "nullpointerexception") || strings.Contains(combined, "system error")) {
-		classified := serverFailureClass{
-			message: message,
-			reason:  "upstream_internal_error",
-			origin:  "dingtalk_api",
-			stage:   "upstream_execution",
-			hint:    "上游服务发生内部异常；请保留 Trace ID 和 Server Code，确认操作结果后再决定是否重试。",
-			actions: []string{
-				"检查目标资源的当前状态，确认本次操作是否已经生效",
-				"状态未确认前不要直接重试写操作",
-				"持续失败时携带 Trace ID 和 Server Code 联系服务端排查",
-			},
-		}
-		if strings.EqualFold(strings.TrimSpace(serverKey), "todo") &&
-			strings.EqualFold(strings.TrimSpace(tool), "create_personal_todo") {
-			retryable := false
-			classified.operation = "todo/create_personal_todo"
-			classified.retryable = &retryable
-			classified.hint = "待办服务发生内部异常，创建结果未知；请先查询是否已创建相同待办，再决定是否重试。"
-			classified.actions = []string{
-				"查询近期由自己创建的待办，核对标题、执行人和截止时间",
-				"确认没有创建成功后再重新提交",
-				"持续失败时携带 Trace ID 和 Server Code 联系服务端排查",
-			}
-		}
-		return classified, true
-	}

 	if code == "NETWORK_ERROR" ||
 		strings.Contains(detail, "statuscode.unavailable") ||
@@ -106,7 +74,6 @@ func newServerFailureAPIError(
 	fallbackReason string,
 	fallbackHint string,
 	serverKey string,
-	tool string,
 	diag apperrors.ServerDiagnostics,
 ) error {
 	opts := []apperrors.Option{
@@ -117,7 +84,7 @@ func newServerFailureAPIError(
 		apperrors.WithActions("运行 dws doctor 检查登录态、网络和本地环境；持续失败时保留 Trace ID 和 Server Code"),
 		apperrors.WithServerDiag(diag),
 	}
-	if classified, ok := classifyServerFailure(message, serverKey, tool, diag); ok {
+	if classified, ok := classifyServerFailure(message, diag); ok {
 		message = classified.message
 		opts = append(opts,
 			apperrors.WithReason(classified.reason),
@@ -126,12 +93,6 @@ func newServerFailureAPIError(
 			apperrors.WithHint(classified.hint),
 			apperrors.WithActions(classified.actions...),
 		)
-		if classified.operation != "" {
-			opts = append(opts, apperrors.WithOperation(classified.operation))
-		}
-		if classified.retryable != nil {
-			opts = append(opts, apperrors.WithRetryable(*classified.retryable))
-		}
 	}
 	return apperrors.NewAPI(message, opts...)
 }
@@ -34,7 +34,6 @@ func TestCrossPlatformCoverageServerFailureClassifierBackendMetadataUnavailable(
 		"business_error",
 		"check parameters",
 		"im",
-		"list_conversations",
 		apperrors.ServerDiagnostics{
 			TraceID:         "trace-local",
 			ServerErrorCode: "NETWORK_ERROR",
@@ -67,7 +66,6 @@ func TestCrossPlatformCoverageServerFailureClassifierRequiredConversationID(t *t
 		"business_error",
 		"check parameters",
 		"chat",
-		"send_message",
 		apperrors.ServerDiagnostics{ServerErrorCode: "1001"},
 	)
 	var typed *apperrors.Error
@@ -82,74 +80,12 @@ func TestCrossPlatformCoverageServerFailureClassifierRequiredConversationID(t *t
 	}
 }

-func TestCrossPlatformCoverageServerFailureClassifierTodoCreateUpstreamInternalError(t *testing.T) {
-	serverSaysRetryable := true
-	err := newServerFailureAPIError(
-		"[UNCLASSIFIED] system error: java.lang.NullPointerException (operation: todo/create_personal_todo)",
-		"business_error",
-		"The API returned a business-level error. Check required parameters and values.",
-		"todo",
-		"create_personal_todo",
-		apperrors.ServerDiagnostics{
-			TraceID:         "trace-todo-create",
-			ServerErrorCode: "999",
-			ServerRetryable: &serverSaysRetryable,
-		},
-	)
-
-	var typed *apperrors.Error
-	if !errors.As(err, &typed) {
-		t.Fatalf("error = %T, want *errors.Error", err)
-	}
-	if typed.Reason != "upstream_internal_error" || typed.Origin != "dingtalk_api" || typed.FailureStage != "upstream_execution" {
-		t.Fatalf("classification = reason %q origin %q stage %q", typed.Reason, typed.Origin, typed.FailureStage)
-	}
-	if typed.Operation != "todo/create_personal_todo" {
-		t.Fatalf("operation = %q, want todo/create_personal_todo", typed.Operation)
-	}
-	if typed.ExecutionStarted != nil {
-		t.Fatalf("execution_started = %v, want unknown", typed.ExecutionStarted)
-	}
-	if !typed.RetryableSet || typed.Retryable {
-		t.Fatalf("retryability = (%v, %v), want explicit false", typed.RetryableSet, typed.Retryable)
-	}
-	if typed.ServerDiag.TraceID != "trace-todo-create" || typed.ServerDiag.ServerErrorCode != "999" {
-		t.Fatalf("diagnostics = %#v", typed.ServerDiag)
-	}
-	if strings.Contains(strings.ToLower(typed.Hint), "parameter") || !strings.Contains(typed.Hint, "创建结果未知") {
-		t.Fatalf("hint = %q", typed.Hint)
-	}
-	for _, action := range typed.Actions {
-		if strings.Contains(action, "dws doctor") || strings.Contains(action, "登录") || strings.Contains(action, "网络") {
-			t.Fatalf("misleading action = %q", action)
-		}
-	}
-
-	payload := multiProfileErrorPayload(err)
-	for key, want := range map[string]any{
-		"reason":            "upstream_internal_error",
-		"origin":            "dingtalk_api",
-		"stage":             "upstream_execution",
-		"retryable":         false,
-		"trace_id":          "trace-todo-create",
-		"server_error_code": "999",
-	} {
-		if got := payload[key]; got != want {
-			t.Errorf("payload[%q] = %#v, want %#v", key, got, want)
-		}
-	}
-	if _, ok := payload["execution_started"]; ok {
-		t.Fatalf("payload must keep execution_started unknown: %#v", payload)
-	}
-}
-
 func TestCrossPlatformCoverageServerFailureClassifierUnknownFallsBack(t *testing.T) {
 	err := newServerFailureAPIError(
 		"business error: success=false",
 		"business_error",
 		"check parameters",
 		"im",
-		"list_conversations",
 		apperrors.ServerDiagnostics{},
 	)
 	var typed *apperrors.Error
@@ -170,7 +106,6 @@ func TestCrossPlatformCoverageServerFailureReasonUsesTypedClassification(t *test
 		"business_error",
 		"check parameters",
 		"im",
-		"list_conversations",
 		apperrors.ServerDiagnostics{ServerErrorCode: "NETWORK_ERROR"},
 	)
 	if got := serverFailureReason(err, "business_error"); got != "backend_dependency_unavailable" {
@@ -188,7 +123,6 @@ func TestCrossPlatformCoverageMultiProfileErrorPayloadPreservesFailureSemantics(
 		"business_error",
 		"check parameters",
 		"im",
-		"list_conversations",
 		apperrors.ServerDiagnostics{
 			TraceID:         "trace-multi",
 			ServerErrorCode: "NETWORK_ERROR",
@@ -290,58 +224,3 @@ func TestCrossPlatformCoverageExecuteInvocationClassifiesObservedMCPMetadataFail
 		t.Fatalf("execution_started must remain unknown: %v", typed.ExecutionStarted)
 	}
 }
-
-func TestCrossPlatformCoverageExecuteInvocationClassifiesTodoCreateUpstreamInternalError(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		var request struct {
-			ID int `json:"id"`
-		}
-		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
-			t.Errorf("decode request: %v", err)
-		}
-		_ = json.NewEncoder(w).Encode(map[string]any{
-			"jsonrpc": "2.0",
-			"id":      request.ID,
-			"result": map[string]any{
-				"structuredContent": map[string]any{
-					"success":  false,
-					"code":     "999",
-					"trace_id": "trace-todo-replay",
-					"errorMsg": "[UNCLASSIFIED] system error: java.lang.NullPointerException (operation: todo/create_personal_todo)",
-				},
-			},
-		})
-	}))
-	defer server.Close()
-
-	client := transport.NewClient(server.Client())
-	client.TrustedDomains = []string{strings.TrimPrefix(server.URL, "http://")}
-	runner := &runtimeRunner{
-		transport:   client,
-		globalFlags: &GlobalFlags{Token: "local-test-token"},
-	}
-	_, err := runner.executeInvocation(context.Background(), server.URL, executor.Invocation{
-		CanonicalProduct: "todo",
-		Tool:             "create_personal_todo",
-		CanonicalPath:    "todo.create_personal_todo",
-		Params: map[string]any{
-			"PersonalTodoCreateVO": map[string]any{
-				"subject":     "fixture",
-				"executorIds": []string{"user-1"},
-			},
-		},
-	})
-	var typed *apperrors.Error
-	if !errors.As(err, &typed) {
-		t.Fatalf("executeInvocation() error = %T %v, want typed API error", err, err)
-	}
-	if typed.Reason != "upstream_internal_error" || typed.Operation != "todo/create_personal_todo" {
-		t.Fatalf("classification = reason %q operation %q", typed.Reason, typed.Operation)
-	}
-	if !typed.RetryableSet || typed.Retryable || typed.ExecutionStarted != nil {
-		t.Fatalf("failure semantics = retryable(%v,%v) execution_started=%v", typed.RetryableSet, typed.Retryable, typed.ExecutionStarted)
-	}
-	if typed.ServerDiag.TraceID != "trace-todo-replay" || typed.ServerDiag.ServerErrorCode != "999" {
-		t.Fatalf("diagnostics = %#v", typed.ServerDiag)
-	}
-}
@@ -117,114 +117,38 @@ type CliSkillDTO struct {
 // (skill_setup.go) MUST have a matching path value here — enforced by
 // TestAgentSkillPathsCoversSetupHomes.
 var agentSkillPaths = map[string]string{
-	// Universal agents. Those without an independent global directory map
-	// directly to the canonical ~/.agents/skills store.
-	"agents":          ".agents/skills",
-	"amp":             filepath.Join(".config", "agents", "skills"),
-	"antigravity":     ".gemini/antigravity/skills",
-	"antigravity-cli": ".gemini/antigravity-cli/skills",
-	"codex":           ".codex/skills",
-	"cursor":          ".cursor/skills",
-	"deepagents":      ".deepagents/agent/skills",
-	"firebender":      ".firebender/skills",
-	"gemini-cli":      ".gemini/skills",
-	"github-copilot":  ".copilot/skills",
-	"opencode":        filepath.Join(".config", "opencode", "skills"),
-	"replit":          filepath.Join(".config", "agents", "skills"),
-	"universal":       filepath.Join(".config", "agents", "skills"),
-	"cline":           ".agents/skills",
-	"dexto":           ".agents/skills",
-	"kimi-code-cli":   ".agents/skills",
-	"loaf":            ".agents/skills",
-	"warp":            ".agents/skills",
-	"zed":             ".agents/skills",
-
-	// Non-universal agents with global Skill directories.
-	"aider-desk":     ".aider-desk/skills",
-	"astrbot":        ".astrbot/data/skills",
-	"autohand-code":  ".autohand/skills",
-	"augment":        ".augment/skills",
-	"bob":            ".bob/skills",
-	"claude-code":    ".claude/skills",
-	"openclaw":       ".openclaw/skills",
-	"codearts-agent": ".codeartsdoer/skills",
-	"codebuddy":      ".codebuddy/skills",
-	"codemaker":      ".codemaker/skills",
-	"codestudio":     ".codestudio/skills",
-	"command-code":   ".commandcode/skills",
-	"continue":       ".continue/skills",
-	"cortex":         ".snowflake/cortex/skills",
-	"crush":          filepath.Join(".config", "crush", "skills"),
-	"devin":          filepath.Join(".config", "devin", "skills"),
-	"droid":          ".factory/skills",
-	"forgecode":      ".forge/skills",
-	"goose":          filepath.Join(".config", "goose", "skills"),
-	"grok":           ".grok/skills",
-	"hermes-agent":   ".hermes/skills",
-	"inference-sh":   ".inferencesh/skills",
-	"jazz":           ".jazz/skills",
-	"junie":          ".junie/skills",
-	"iflow-cli":      ".iflow/skills",
-	"kilo":           ".kilocode/skills",
-	"kimchi":         filepath.Join(".config", "kimchi", "harness", "skills"),
-	"kiro-cli":       ".kiro/skills",
-	"kode":           ".kode/skills",
-	"lingma":         ".lingma/skills",
-	"mcpjam":         ".mcpjam/skills",
-	"minimax-code":   ".minimax/skills",
-	"mistral-vibe":   ".vibe/skills",
-	"moxby":          ".moxby/skills",
-	"mux":            ".mux/skills",
-	"openhands":      ".openhands/skills",
-	"ona":            ".ona/skills",
-	"pi":             ".pi/agent/skills",
-	"qoder":          ".qoder/skills",
-	"qoder-cn":       ".qoder-cn/skills",
-	"qwen-code":      ".qwen/skills",
-	"reasonix":       ".reasonix/skills",
-	"rovodev":        ".rovodev/skills",
-	"roo":            ".roo/skills",
-	"tabnine-cli":    ".tabnine/agent/skills",
-	"terramind":      ".terramind/skills",
-	"tinycloud":      ".tinycloud/skills",
-	"trae":           ".trae/skills",
-	"trae-cn":        ".trae-cn/skills",
-	"windsurf":       ".codeium/windsurf/skills",
-	"zcode":          ".zcode/skills",
-	"zencoder":       ".zencoder/skills",
-	"zenflow":        ".zencoder/skills",
-	"neovate":        ".neovate/skills",
-	"pochi":          ".pochi/skills",
-	"adal":           ".adal/skills",
-
-	// DWS compatibility aliases and DWS-only integrations.
-	"claude":    ".claude/skills",
-	"gemini":    ".gemini/skills",
-	"github":    ".copilot/skills",
-	"hermes":    ".hermes/skills",
-	"kiro":      ".kiro/skills",
+	// `agents` is the generic-agent sentinel: install scripts and `setup`
+	// special-case ~/.agents/skills as a no-checks-required fallback so a
+	// fresh machine without any IDE/agent registry still gets skills.
+	"agents":    ".agents/skills",
+	"qoder":     ".qoder/skills",
 	"qoderwork": ".qoderwork/skills",
-}
-
-// Eve has project-scoped Skill directories but no upstream globalSkillsDir.
-// Keep it in the advertised enumeration while failing explicitly instead of
-// pretending that a global install configured Eve.
-var unsupportedGlobalAgentTargets = map[string]string{
-	"eve":          "Eve 不支持全局 Skill 安装，请在 Eve 项目内配置 agent/skills",
-	"promptscript": "PromptScript 不支持全局 Skill 安装，请在项目内使用 .agents/skills",
+	"claude":    ".claude/skills",
+	"cursor":    ".cursor/skills",
+	"codex":     ".codex/skills",
+	"zcode":     ".zcode/skills",
+	"opencode":  filepath.Join(".config", "opencode", "skills"),
+	// IDE / agent registries also probed by `dws skill setup --target all`.
+	"gemini":   ".gemini/skills",
+	"github":   ".github/skills",
+	"windsurf": ".windsurf/skills",
+	"augment":  ".augment/skills",
+	"cline":    ".cline/skills",
+	"amp":      ".amp/skills",
+	"kiro":     ".kiro/skills",
+	"trae":     ".trae/skills",
+	"openclaw": ".openclaw/skills",
+	"hermes":   ".hermes/skills",
 }

 // supportedTargets returns a sorted, comma-separated list of supported
 // targets. Sorted so help text and error messages stay stable across runs
 // (Go map iteration order is intentionally randomized).
 func supportedTargets() string {
-	targets := make([]string, 0, len(agentSkillPaths)+len(unsupportedGlobalAgentTargets)+1)
+	targets := make([]string, 0, len(agentSkillPaths)+1)
 	for target := range agentSkillPaths {
 		targets = append(targets, target)
 	}
-	for target := range unsupportedGlobalAgentTargets {
-		targets = append(targets, target)
-	}
 	sort.Strings(targets)
 	targets = append(targets, ".")
 	return strings.Join(targets, ", ")
@@ -258,28 +182,11 @@ func formatAgentSkillPathsForHelp() string {
 	sort.Strings(names)
 	var b strings.Builder
 	for _, n := range names {
-		installPath := agentSkillPaths[n]
-		if isUniversalSkillInstallTarget(n) {
-			installPath = ".agents/skills"
-		}
-		fmt.Fprintf(&b, "  %-*s -> ~/%s/\n", maxWidth, n, installPath)
+		fmt.Fprintf(&b, "  %-*s -> ~/%s/\n", maxWidth, n, agentSkillPaths[n])
 	}
 	return b.String()
 }

-// Universal Agents discover the shared ~/.agents/skills store directly. A
-// marketplace install addressed to one of those Agent IDs must therefore
-// publish to canonical instead of recreating an Agent-private duplicate.
-func isUniversalSkillInstallTarget(target string) bool {
-	rel, ok := agentSkillPaths[target]
-	if !ok {
-		return false
-	}
-	base := filepath.Join("__home__", rel)
-	canonical := filepath.Join("__home__", ".agents", "skills")
-	return sameSkillSetupPath(base, canonical) || isUniversalSkillSetupBase(base)
-}
-
 func buildSkillCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:               "skill",
@@ -578,13 +485,8 @@ func resolveSkillTargetPath(target string) (string, error) {
 		return os.Getwd()
 	}

-	target = strings.ToLower(target)
-	if reason, unsupported := unsupportedGlobalAgentTargets[target]; unsupported {
-		return "", errors.New(reason)
-	}
-
-	// Look up predefined agent paths.
-	_, ok := agentSkillPaths[target]
+	// Look up predefined agent paths
+	relPath, ok := agentSkillPaths[strings.ToLower(target)]
 	if !ok {
 		return "", fmt.Errorf("unsupported target")
 	}
@@ -594,11 +496,7 @@ func resolveSkillTargetPath(target string) (string, error) {
 		return "", fmt.Errorf("failed to get home directory: %w", err)
 	}

-	destination := resolveSkillSetupBase(homeDir, target)
-	if isUniversalSkillInstallTarget(target) {
-		destination = filepath.Join(homeDir, ".agents", "skills")
-	}
-	return destination, nil
+	return filepath.Join(homeDir, relPath), nil
 }

 // fetchSkillDownloadInfo calls the download API to get the skill download URL.
@@ -28,7 +28,6 @@ import (
 	"time"

 	authpkg "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/testseam"
 )

 func TestResolveSkillTargetPath(t *testing.T) {
@@ -58,19 +57,19 @@ func TestResolveSkillTargetPath(t *testing.T) {
 		{
 			name:       "cursor target",
 			target:     "cursor",
-			wantSuffix: filepath.Join(".agents", "skills"),
+			wantSuffix: filepath.Join(".cursor", "skills"),
 			wantErr:    false,
 		},
 		{
 			name:       "codex target",
 			target:     "codex",
-			wantSuffix: filepath.Join(".agents", "skills"),
+			wantSuffix: filepath.Join(".codex", "skills"),
 			wantErr:    false,
 		},
 		{
 			name:       "opencode target",
 			target:     "opencode",
-			wantSuffix: filepath.Join(".agents", "skills"),
+			wantSuffix: filepath.Join(".config", "opencode", "skills"),
 			wantErr:    false,
 		},
 		{
@@ -119,37 +118,6 @@ func TestResolveSkillTargetPath(t *testing.T) {
 	}
 }

-func TestCrossPlatformCoverageUniversalSkillInstallTargetsUseCanonical(t *testing.T) {
-	home := t.TempDir()
-	testseam.Swap(t, &skillUserHomeDir, func() (string, error) { return home, nil })
-	if isUniversalSkillInstallTarget("missing-agent") {
-		t.Fatal("unknown Agent target classified as universal")
-	}
-	for _, target := range []string{
-		"amp", "antigravity", "antigravity-cli", "cline", "codex", "cursor",
-		"deepagents", "dexto", "firebender", "gemini", "gemini-cli", "github",
-		"github-copilot", "kimi-code-cli", "loaf", "opencode", "replit",
-		"universal", "warp", "zed",
-	} {
-		got, err := resolveSkillTargetPath(target)
-		if err != nil {
-			t.Fatalf("resolve %s: %v", target, err)
-		}
-		if want := filepath.Join(home, ".agents", "skills"); got != want {
-			t.Errorf("resolve %s = %s, want canonical %s", target, got, want)
-		}
-	}
-	for target, want := range map[string]string{
-		"claude": filepath.Join(home, ".claude", "skills"),
-		"qoder":  filepath.Join(home, ".qoder", "skills"),
-		"zcode":  filepath.Join(home, ".zcode", "skills"),
-	} {
-		if got, err := resolveSkillTargetPath(target); err != nil || got != want {
-			t.Errorf("resolve non-universal %s = %s, %v; want %s", target, got, err, want)
-		}
-	}
-}
-
 func TestResolveSkillTargetPathCurrentDir(t *testing.T) {
 	// Test "." target returns current working directory
 	cwd, err := os.Getwd()
@@ -509,12 +477,8 @@ func TestAgentSkillPathsCoversSetupHomes(t *testing.T) {
 	for _, p := range agentSkillPaths {
 		paths[p] = true
 	}
-	legacyCleanupOnly := map[string]bool{
-		".github/skills": true, ".windsurf/skills": true,
-		".cline/skills": true, ".amp/skills": true,
-	}
 	for _, home := range skillSetupAgentHomes {
-		if !paths[home] && !legacyCleanupOnly[home] {
+		if !paths[home] {
 			t.Errorf("skillSetupAgentHomes entry %q has no matching agentSkillPaths value — "+
 				"add it to agentSkillPaths so users can address it via --target <name>", home)
 		}
@@ -6,7 +6,6 @@ import (
 	"io"
 	"os"
 	"path/filepath"
-	"runtime"
 	"sort"
 	"strings"
 	"time"
@@ -24,77 +23,22 @@ import (
 // agree on the install footprint.
 var skillSetupAgentHomes = []string{
 	".agents/skills",
-	".config/agents/skills",
-	".gemini/antigravity/skills",
-	".gemini/antigravity-cli/skills",
-	".deepagents/agent/skills",
-	".firebender/skills",
-	".copilot/skills",
-	".config/opencode/skills",
-	".aider-desk/skills",
-	".astrbot/data/skills",
-	".autohand/skills",
-	".augment/skills",
-	".bob/skills",
 	".claude/skills",
-	".openclaw/skills",
-	".codeartsdoer/skills",
-	".codebuddy/skills",
-	".codemaker/skills",
-	".codestudio/skills",
-	".commandcode/skills",
-	".continue/skills",
-	".snowflake/cortex/skills",
-	".config/crush/skills",
-	".config/devin/skills",
-	".factory/skills",
-	".forge/skills",
-	".config/goose/skills",
-	".grok/skills",
-	".hermes/skills",
-	".inferencesh/skills",
-	".jazz/skills",
-	".junie/skills",
-	".iflow/skills",
-	".kilocode/skills",
-	".config/kimchi/harness/skills",
-	".kiro/skills",
-	".kode/skills",
-	".lingma/skills",
-	".mcpjam/skills",
-	".minimax/skills",
-	".vibe/skills",
-	".moxby/skills",
-	".mux/skills",
-	".openhands/skills",
-	".ona/skills",
-	".pi/agent/skills",
-	".qoder/skills",
-	".qoder-cn/skills",
-	".qwen/skills",
-	".reasonix/skills",
-	".rovodev/skills",
-	".roo/skills",
-	".tabnine/agent/skills",
-	".terramind/skills",
-	".tinycloud/skills",
-	".trae/skills",
-	".trae-cn/skills",
-	".codeium/windsurf/skills",
-	".zcode/skills",
-	".zencoder/skills",
-	".neovate/skills",
-	".pochi/skills",
-	".adal/skills",
-	".qoderwork/skills",
-	// beta.6 compatibility roots: cleanup only.
 	".cursor/skills",
+	".qoder/skills",
+	".qoderwork/skills",
 	".gemini/skills",
 	".codex/skills",
+	".zcode/skills",
 	".github/skills",
 	".windsurf/skills",
+	".augment/skills",
 	".cline/skills",
 	".amp/skills",
+	".kiro/skills",
+	".trae/skills",
+	".openclaw/skills",
+	".hermes/skills",
 }

 const (
@@ -121,20 +65,15 @@ var (
 	skillSetupInteractive     = isInteractiveTerminal
 	skillSetupReadDir         = os.ReadDir
 	skillSetupStat            = os.Stat
-	skillSetupLstat           = os.Lstat
-	skillSetupGetenv          = os.Getenv
-	skillSetupSymlink         = os.Symlink
 	skillSetupExecutable      = os.Executable
 	skillSetupGetwd           = os.Getwd
 	skillSetupUserHomeDir     = os.UserHomeDir
 	skillSetupRemoveAll       = os.RemoveAll
 	skillSetupBackupAndRemove = upgrade.BackupAndRemoveSkillDir
-	skillSetupRestoreBackup   = upgrade.RestoreSkillPath
 	skillSetupMkdirAll        = os.MkdirAll
 	skillSetupWalk            = filepath.Walk
 	skillSetupRel             = filepath.Rel
 	skillSetupReadlink        = os.Readlink
-	skillSetupEvalSymlinks    = filepath.EvalSymlinks
 	skillSetupOpen            = os.Open
 	skillSetupOpenFile        = os.OpenFile
 	skillSetupWriteFile       = os.WriteFile
@@ -143,10 +82,7 @@ var (
 	skillSetupReadState       = skillstate.Read
 	skillSetupWriteState      = skillstate.Write
 	skillSetupRemoveState     = skillstate.Remove
-	skillSetupPublishPath     = upgrade.PublishSkillPathNoReplace
-	skillSetupRollbackPaths   = upgrade.RollbackSkillPathPublications
 	skillSetupNow             = time.Now
-	skillSetupFoldPathCase    = runtime.GOOS == "windows"
 )

 type skillSetupBackup struct {
@@ -155,11 +91,9 @@ type skillSetupBackup struct {
 }

 type skillSetupTargetPlan struct {
-	Destination   string
-	CanonicalBase string
-	Backups       []skillSetupBackup
-	CleanupOnly   bool
-	LinkCanonical bool
+	Destination string
+	Backups     []skillSetupBackup
+	CleanupOnly bool
 }

 type skillSetupPlan struct {
@@ -215,9 +149,8 @@ multi 模式支持按产品挑选：
    备份失败时保留原目录并跳过该目标，绝不静默删除。
  · 所有将被移除的目录都会在确认前逐条列出。

-不带 --mode 时进入交互式询问；Skill 统一安装到 ~/.agents/skills。
-DWS 会自动适配本机上检测到的 Agent；共享安装方式不可用时会自动改用兼容安装，
-无需用户手动处理，也不会让同一个 Skill 重复出现。
+不带 --mode 时进入交互式询问；不带 --target 时铺到检测到的具体 Agent 目录；
+未检测到具体 Agent 时才回退到 ~/.agents/skills，避免同一 Agent 扫描两份 Skill。
 skill 源默认取二进制内嵌的版本（升级二进制即升级 skill）；--source / DWS_SKILL_SOURCE 可显式覆盖。`,
 		Example: `  dws skill setup --mode multi --target claude --dry-run
  dws skill setup --mode multi --target claude`,
@@ -310,6 +243,7 @@ func runSkillSetup(cmd *cobra.Command, _ []string) error {
 			}
 		}
 	}
+
 	// filtered 决定 multi 安装的清理语义：带 -s/--skill 或 -x/--exclude
 	// 时保持 additive（不动未列出的 sibling）；全量安装与 install.sh /
 	// install.js 对齐，清掉不在 bundle 内且有明确 DWS 所有权记录的过期 Skill。
@@ -382,17 +316,6 @@ func runSkillSetup(cmd *cobra.Command, _ []string) error {
 	if err != nil {
 		return err
 	}
-	if mode == skillSetupModeMulti && len(migrateEventMiscTargets) > 0 {
-		retiredNames := append([]string(nil), multiSkillNames...)
-		if installsEventMiscCompanion && !containsSkillName(retiredNames, multiMiscSkill) {
-			retiredNames = append(retiredNames, multiMiscSkill)
-		}
-		if retireErr := retireMigratedUniversalSkills(migrateEventMiscTargets, retiredNames, out); retireErr != nil {
-			// Retiring an obsolete universal copy installs nothing; report it and
-			// keep the successful installation rather than failing the run.
-			fmt.Fprintf(errOut, "  ⚠️  %v\n", retireErr)
-		}
-	}
 	if skipped > 0 {
 		return fmt.Errorf(
 			"Skill 安装不完整（mode=%s, installed=%d, skipped=%d）；修复失败原因后请重试 setup，或运行普通 upgrade 全量刷新预制 Skill",
@@ -427,9 +350,7 @@ func runSkillSetup(cmd *cobra.Command, _ []string) error {
 		}
 	}
 	fmt.Fprintf(out, "\n✅ Skill 安装完成（mode=%s, installed=%d, skipped=%d）\n", mode, installed, skipped)
-	fmt.Fprintln(out, "   统一安装位置：~/.agents/skills")
-	fmt.Fprintln(out, "   已自动适配本机上检测到的 Agent")
-	fmt.Fprintln(out, "ℹ️  下一步：请重启已打开的 Agent，使新 Skills 生效。")
+	fmt.Fprintln(out, "ℹ️  若 Agent 会话已打开，请重启 Agent 或重新加载 Skills 后再验证路由。")
 	return nil
 }

@@ -989,9 +910,8 @@ func isSkillSourceRoot(path, mode string) bool {
 }

 // resolveSkillSetupTargets returns the list of absolute Agent home destinations.
-// The canonical ~/.agents/skills destination is always first. If target ==
-// "all", detected concrete Agent roots follow it. A specific target follows
-// canonical as well so unknown/future Agents retain the universal copy.
+// If target == "all", returns every agent home whose parent directory exists.
+// Otherwise returns the single matching home (whether or not it currently exists).
 //
 // 末段约定：
 //   - mono  → <agent-home>/dws   （单 skill，整个 src 拷成一个 dws 目录）
@@ -1003,88 +923,15 @@ func resolveSkillSetupTargets(target, mode string) ([]string, error) {
 	}

 	target = strings.ToLower(strings.TrimSpace(target))
-	canonical := agentHomeForMode(filepath.Join(home, skillSetupAgentHomes[0]), mode)
 	if target == "" || target == "all" {
 		return detectExistingAgentHomes(home, mode), nil
 	}

-	if reason, unsupported := unsupportedGlobalAgentTargets[target]; unsupported {
-		return nil, errors.New(reason)
-	}
-	_, ok := agentSkillPaths[target]
+	rel, ok := agentSkillPaths[target]
 	if !ok {
 		return nil, fmt.Errorf("不支持的 --target 值: %s（可选 all, %s）", target, supportedTargets())
 	}
-	dest := agentHomeForMode(resolveSkillSetupBase(home, target), mode)
-	if sameSkillSetupPath(dest, canonical) {
-		return []string{canonical}, nil
-	}
-	return []string{canonical, dest}, nil
-}
-
-func resolveOpenClawSetupBase(home string) string {
-	for _, name := range []string{".openclaw", ".clawdbot", ".moltbot"} {
-		base := filepath.Join(home, name)
-		if info, err := skillSetupStat(base); err == nil && info.IsDir() {
-			return filepath.Join(base, "skills")
-		}
-	}
-	return filepath.Join(home, ".openclaw", "skills")
-}
-
-func resolveSkillSetupBase(home, target string) string {
-	switch target {
-	case "claude", "claude-code":
-		if custom := strings.TrimSpace(skillSetupGetenv("CLAUDE_CONFIG_DIR")); custom != "" {
-			return filepath.Join(custom, "skills")
-		}
-	case "codex":
-		if custom := strings.TrimSpace(skillSetupGetenv("CODEX_HOME")); custom != "" {
-			return filepath.Join(custom, "skills")
-		}
-	case "hermes", "hermes-agent":
-		if custom := strings.TrimSpace(skillSetupGetenv("HERMES_HOME")); custom != "" {
-			return filepath.Join(custom, "skills")
-		}
-	case "autohand-code":
-		if custom := strings.TrimSpace(skillSetupGetenv("AUTOHAND_HOME")); custom != "" {
-			return filepath.Join(custom, "skills")
-		}
-	case "grok":
-		if custom := strings.TrimSpace(skillSetupGetenv("GROK_HOME")); custom != "" {
-			return filepath.Join(custom, "skills")
-		}
-	case "mistral-vibe":
-		if custom := strings.TrimSpace(skillSetupGetenv("VIBE_HOME")); custom != "" {
-			return filepath.Join(custom, "skills")
-		}
-	case "openclaw":
-		return resolveOpenClawSetupBase(home)
-	case "opencode", "amp", "replit", "universal", "crush", "devin", "goose", "kimchi":
-		configHome := strings.TrimSpace(skillSetupGetenv("XDG_CONFIG_HOME"))
-		if configHome == "" {
-			configHome = filepath.Join(home, ".config")
-		}
-		switch target {
-		case "opencode":
-			return filepath.Join(configHome, "opencode", "skills")
-		case "amp", "replit", "universal":
-			return filepath.Join(configHome, "agents", "skills")
-		case "crush":
-			return filepath.Join(configHome, "crush", "skills")
-		case "devin":
-			return filepath.Join(configHome, "devin", "skills")
-		case "goose":
-			return filepath.Join(configHome, "goose", "skills")
-		case "kimchi":
-			return filepath.Join(configHome, "kimchi", "harness", "skills")
-		}
-	case "github", "github-copilot":
-		return filepath.Join(home, ".copilot", "skills")
-	case "windsurf":
-		return filepath.Join(home, ".codeium", "windsurf", "skills")
-	}
-	return filepath.Join(home, agentSkillPaths[target])
+	return []string{agentHomeForMode(filepath.Join(home, rel), mode)}, nil
 }

 // agentHomeForMode appends the mode-specific tail segment to an agent home base.
@@ -1096,141 +943,79 @@ func agentHomeForMode(base, mode string) string {
 }

 func detectExistingAgentHomes(home, mode string) []string {
-	canonical := agentHomeForMode(filepath.Join(home, skillSetupAgentHomes[0]), mode)
-	dests := []string{canonical}
-	canonicalKey := skillSetupPathKey(canonical)
-	seen := map[string]bool{canonicalKey: true}
-	addDetected := func(rel, base string) {
-		detectedDir := filepath.Dir(base)
-		switch filepath.ToSlash(filepath.Clean(rel)) {
-		case ".config/kimchi/harness/skills", ".tabnine/agent/skills":
-			detectedDir = filepath.Dir(filepath.Dir(base))
-		case ".zcode/skills":
-			// Application bundles are machine-scoped detection signals. Keep this
-			// independent of HOME so setup matches npm, Shell, and PowerShell.
-			if info, err := skillSetupStat(filepath.Join(string(filepath.Separator), "Applications", "ZCode.app")); err == nil && info.IsDir() {
-				detectedDir = ""
-			}
-		case ".minimax/skills":
-			if info, err := skillSetupStat(filepath.Join(string(filepath.Separator), "Applications", "MiniMax Code.app")); err == nil && info.IsDir() {
-				detectedDir = ""
-			}
-		}
-		if detectedDir != "" {
-			if info, err := skillSetupStat(detectedDir); err != nil || !info.IsDir() {
-				return
-			}
-		}
-		dest := agentHomeForMode(base, mode)
-		key := skillSetupPathKey(dest)
-		if !seen[key] {
-			seen[key] = true
-			dests = append(dests, dest)
-		}
-	}
+	var specific []string
 	for i, rel := range skillSetupAgentHomes {
 		if i == 0 {
 			continue
 		}
 		base := filepath.Join(home, rel)
-		switch filepath.ToSlash(filepath.Clean(rel)) {
-		case ".claude/skills":
-			base = resolveSkillSetupBase(home, "claude-code")
-		case ".codex/skills":
-			base = resolveSkillSetupBase(home, "codex")
-		case ".hermes/skills":
-			base = resolveSkillSetupBase(home, "hermes-agent")
-		case ".autohand/skills":
-			base = resolveSkillSetupBase(home, "autohand-code")
-		case ".grok/skills":
-			base = resolveSkillSetupBase(home, "grok")
-		case ".vibe/skills":
-			base = resolveSkillSetupBase(home, "mistral-vibe")
-		case ".openclaw/skills":
-			base = resolveSkillSetupBase(home, "openclaw")
-		case ".config/opencode/skills":
-			base = resolveSkillSetupBase(home, "opencode")
-		case ".config/agents/skills":
-			base = resolveSkillSetupBase(home, "amp")
-		case ".config/crush/skills":
-			base = resolveSkillSetupBase(home, "crush")
-		case ".config/devin/skills":
-			base = resolveSkillSetupBase(home, "devin")
-		case ".config/goose/skills":
-			base = resolveSkillSetupBase(home, "goose")
-		case ".config/kimchi/harness/skills":
-			base = resolveSkillSetupBase(home, "kimchi")
+		parent := filepath.Dir(base)
+		if info, err := skillSetupStat(parent); err != nil || !info.IsDir() {
+			continue
 		}
-		addDetected(rel, base)
+		specific = append(specific, agentHomeForMode(base, mode))
 	}
-	for _, target := range []string{"github-copilot", "windsurf"} {
-		addDetected(agentSkillPaths[target], resolveSkillSetupBase(home, target))
+	if len(specific) > 0 {
+		return specific
 	}
-	return dests
+	return []string{agentHomeForMode(filepath.Join(home, skillSetupAgentHomes[0]), mode)}
 }

-func skillSetupBaseForMode(dest, mode string) string {
-	if mode == skillSetupModeMono {
-		return filepath.Dir(dest)
-	}
-	return dest
-}
-
-func isUniversalSkillSetupBase(base string) bool {
-	cleanBase := filepath.Clean(base)
-	if custom := strings.TrimSpace(skillSetupGetenv("CODEX_HOME")); custom != "" && sameSkillSetupPath(cleanBase, filepath.Join(custom, "skills")) {
-		return true
-	}
-	if custom := strings.TrimSpace(skillSetupGetenv("XDG_CONFIG_HOME")); custom != "" {
-		if sameSkillSetupPath(cleanBase, filepath.Join(custom, "agents", "skills")) ||
-			sameSkillSetupPath(cleanBase, filepath.Join(custom, "opencode", "skills")) {
-			return true
-		}
-	}
-	base = filepath.ToSlash(cleanBase)
-	for rel := range map[string]bool{
-		".config/agents/skills": true, ".gemini/antigravity/skills": true,
-		".gemini/antigravity-cli/skills": true, ".codex/skills": true,
-		".cursor/skills": true, ".deepagents/agent/skills": true,
-		".firebender/skills": true, ".gemini/skills": true,
-		".copilot/skills": true, ".config/opencode/skills": true,
-		// beta.6 compatibility roots are cleanup-only.
-		".github/skills": true, ".windsurf/skills": true,
-		".cline/skills": true, ".amp/skills": true,
-	} {
-		if strings.HasSuffix(base, "/"+rel) {
-			return true
-		}
-	}
-	return false
-}
-
-func sameSkillSetupPath(left, right string) bool {
-	return skillSetupPathKey(left) == skillSetupPathKey(right)
-}
-
-func skillSetupPathKey(path string) string {
-	clean := filepath.Clean(path)
-	if skillSetupFoldPathCase {
-		clean = strings.ToLower(clean)
-	}
-	return clean
-}
-
-func canonicalSkillSetupBase(dests []string, mode string) string {
+func genericSkillCleanupTarget(dests []string, managed map[string]bool) (*skillSetupTargetPlan, error) {
+	// Derive HOME from a concrete Agent destination instead of resolving it a
+	// second time. The destinations were already resolved from HOME by the
+	// caller, and a later/transient UserHomeDir failure must not turn an
+	// otherwise valid setup plan into an error. Direct/custom destinations that
+	// do not match a known concrete Agent root have no generic-root migration.
+	home := ""
 	for _, dest := range dests {
-		base := filepath.ToSlash(filepath.Clean(skillSetupBaseForMode(dest, mode)))
-		if strings.HasSuffix(base, "/.agents/skills") {
-			return skillSetupBaseForMode(dest, mode)
+		base := dest
+		if filepath.Base(dest) == "dws" {
+			base = filepath.Dir(dest)
+		}
+		base = filepath.Clean(base)
+		for i, rel := range skillSetupAgentHomes {
+			if i == 0 {
+				continue
+			}
+			suffix := filepath.Clean(filepath.FromSlash(rel))
+			needle := string(filepath.Separator) + suffix
+			if strings.HasSuffix(base, needle) {
+				home = strings.TrimSuffix(base, needle)
+				break
+			}
+		}
+		if home != "" {
+			break
 		}
 	}
-	return ""
-}
+	if home == "" {
+		return nil, nil
+	}
+	genericBase := filepath.Join(home, ".agents", "skills")

-func samePhysicalSkillSetupPath(left, right string) bool {
-	leftReal, leftErr := skillSetupEvalSymlinks(left)
-	rightReal, rightErr := skillSetupEvalSymlinks(right)
-	return leftErr == nil && rightErr == nil && sameSkillSetupPath(leftReal, rightReal)
+	target := &skillSetupTargetPlan{Destination: genericBase, CleanupOnly: true}
+	add := func(path, reason string) {
+		if info, statErr := skillSetupStat(path); statErr == nil && info.IsDir() {
+			target.Backups = append(target.Backups, skillSetupBackup{Path: path, Reason: reason})
+		}
+	}
+	add(filepath.Join(genericBase, "dws"), skillSetupBackupMutual)
+	entries, readErr := skillSetupReadDir(genericBase)
+	if readErr != nil && !errors.Is(readErr, os.ErrNotExist) {
+		return nil, fmt.Errorf("扫描通用 Skill 根目录失败 %s: %w", genericBase, readErr)
+	}
+	for _, entry := range entries {
+		path := filepath.Join(genericBase, entry.Name())
+		if entry.IsDir() && isManagedDWSMultiSkillDir(path, managed) {
+			target.Backups = append(target.Backups, skillSetupBackup{Path: path, Reason: skillSetupBackupStale})
+		}
+	}
+	if len(target.Backups) == 0 {
+		return nil, nil
+	}
+	sort.Slice(target.Backups, func(i, j int) bool { return target.Backups[i].Path < target.Backups[j].Path })
+	return target, nil
 }

 func buildSkillSetupPlan(mode, src string, dests, multiSkillNames []string, filtered bool) (*skillSetupPlan, error) {
@@ -1245,26 +1030,10 @@ func buildSkillSetupPlan(mode, src string, dests, multiSkillNames []string, filt
 	}
 	sort.Strings(plan.MultiSkillNames)
 	sortedDests := append([]string(nil), dests...)
-	sort.Slice(sortedDests, func(i, j int) bool {
-		leftCanonical := strings.HasSuffix(filepath.ToSlash(filepath.Clean(skillSetupBaseForMode(sortedDests[i], mode))), "/.agents/skills")
-		rightCanonical := strings.HasSuffix(filepath.ToSlash(filepath.Clean(skillSetupBaseForMode(sortedDests[j], mode))), "/.agents/skills")
-		if leftCanonical != rightCanonical {
-			return leftCanonical
-		}
-		return sortedDests[i] < sortedDests[j]
-	})
+	sort.Strings(sortedDests)
 	managedNames := currentManagedSkillNames()
-	canonicalBase := canonicalSkillSetupBase(sortedDests, mode)
 	for _, dest := range sortedDests {
-		base := skillSetupBaseForMode(dest, mode)
-		target := skillSetupTargetPlan{Destination: dest, CanonicalBase: canonicalBase}
-		if canonicalBase != "" && filepath.Clean(base) != filepath.Clean(canonicalBase) {
-			if isUniversalSkillSetupBase(base) {
-				target.CleanupOnly = true
-			} else {
-				target.LinkCanonical = true
-			}
-		}
+		target := skillSetupTargetPlan{Destination: dest}
 		seen := map[string]bool{}
 		add := func(path, reason string) {
 			if seen[path] {
@@ -1308,22 +1077,26 @@ func buildSkillSetupPlan(mode, src string, dests, multiSkillNames []string, filt
 			}
 		}
 		for _, path := range replacements {
-			if target.LinkCanonical && samePhysicalSkillSetupPath(path, filepath.Join(target.CanonicalBase, filepath.Base(path))) {
-				continue
-			}
-			_, statErr := skillSetupLstat(path)
+			info, statErr := skillSetupStat(path)
 			if statErr != nil {
 				if errors.Is(statErr, os.ErrNotExist) {
 					continue
 				}
 				return nil, fmt.Errorf("检查将被替换的 Skill 失败 %s: %w", path, statErr)
 			}
-			add(path, skillSetupBackupReplace)
+			if info.IsDir() {
+				add(path, skillSetupBackupReplace)
+			}
 		}
 		sort.Slice(target.Backups, func(i, j int) bool { return target.Backups[i].Path < target.Backups[j].Path })
-		if !target.CleanupOnly || len(target.Backups) > 0 {
-			plan.Targets = append(plan.Targets, target)
-		}
+		plan.Targets = append(plan.Targets, target)
+	}
+	cleanupTarget, cleanupErr := genericSkillCleanupTarget(sortedDests, managedNames)
+	if cleanupErr != nil {
+		return nil, cleanupErr
+	}
+	if cleanupTarget != nil {
+		plan.Targets = append(plan.Targets, *cleanupTarget)
 	}
 	return plan, nil
 }
@@ -1367,33 +1140,6 @@ func configureEventMiscMigrationPlan(plan *skillSetupPlan, targets []string, ins
 	}
 }

-func retireMigratedUniversalSkills(targets, names []string, out io.Writer) error {
-	home, err := skillSetupUserHomeDir()
-	if err != nil {
-		return fmt.Errorf("无法解析 HOME 以退役 universal Agent 旧副本: %w", err)
-	}
-	seen := map[string]bool{}
-	var victims []skillSetupBackup
-	for _, target := range targets {
-		if !isUniversalSkillSetupBase(target) {
-			continue
-		}
-		for _, name := range names {
-			path := filepath.Join(target, name)
-			if seen[path] {
-				continue
-			}
-			seen[path] = true
-			victims = append(victims, skillSetupBackup{Path: path, Reason: skillSetupBackupReplace})
-		}
-	}
-	sort.Slice(victims, func(i, j int) bool { return victims[i].Path < victims[j].Path })
-	if _, err := backupSkillSetupTarget(home, victims, out); err != nil {
-		return fmt.Errorf("退役 universal Agent Event/misc 旧副本失败，已回滚: %w", err)
-	}
-	return nil
-}
-
 func renderSkillSetupPlan(out io.Writer, plan *skillSetupPlan) {
 	fmt.Fprintf(out, "📦 将安装 skill：\n  mode: %s\n  source: %s\n", plan.Mode, plan.Source)
 	if plan.Mode == skillSetupModeMulti {
@@ -1402,14 +1148,12 @@ func renderSkillSetupPlan(out io.Writer, plan *skillSetupPlan) {
 			fmt.Fprintf(out, "    · %s\n", name)
 		}
 	}
-	fmt.Fprintln(out, "  安装与适配位置:")
+	fmt.Fprintln(out, "  destinations:")
 	for _, target := range plan.Targets {
 		if target.CleanupOnly {
-			fmt.Fprintf(out, "    - %s（移除该 Agent 中的旧版 DWS Skills，改用统一安装位置）\n", target.Destination)
-		} else if target.LinkCanonical {
-			fmt.Fprintf(out, "    - %s（自动配置此 Agent 使用统一安装位置）\n", target.Destination)
+			fmt.Fprintf(out, "    - %s (仅迁移旧的通用 DWS 副本)\n", target.Destination)
 		} else {
-			fmt.Fprintf(out, "    - %s（统一安装位置）\n", target.Destination)
+			fmt.Fprintf(out, "    - %s\n", target.Destination)
 		}
 	}
 	fmt.Fprintln(out, "  将备份并移除（先保存到 ~/.dws/skill-backups/）：")
@@ -1580,12 +1324,8 @@ func installMultiSkillsWithEventMigration(
 	}

 	migrationSet := make(map[string]struct{}, len(migrationTargets))
-	physicalMigrationTargets := make([]string, 0, len(migrationTargets))
 	for _, dest := range migrationTargets {
 		migrationSet[dest] = struct{}{}
-		if !isUniversalSkillSetupBase(dest) {
-			physicalMigrationTargets = append(physicalMigrationTargets, dest)
-		}
 	}
 	var ordinaryTargets []string
 	for _, dest := range dests {
@@ -1594,47 +1334,23 @@ func installMultiSkillsWithEventMigration(
 		}
 	}

-	var canonicalTargets, otherOrdinaryTargets []string
-	for _, dest := range ordinaryTargets {
-		base := filepath.ToSlash(filepath.Clean(skillSetupBaseForMode(dest, skillSetupModeMulti)))
-		if strings.HasSuffix(base, "/.agents/skills") {
-			canonicalTargets = append(canonicalTargets, dest)
-		} else {
-			otherOrdinaryTargets = append(otherOrdinaryTargets, dest)
-		}
-	}
-	installOrdinary := func(names, targets []string) error {
-		if len(targets) == 0 {
-			return nil
-		}
+	if len(ordinaryTargets) > 0 {
 		var n, nSkipped int
-		n, nSkipped, err = skillSetupInstallMulti(src, names, targets, out, errOut, filtered)
+		n, nSkipped, err = skillSetupInstallMulti(src, skillNames, ordinaryTargets, out, errOut, filtered)
 		installed += n
 		skipped += nSkipped
 		if err != nil {
-			return err
+			return installed, skipped, err
 		}
 		if nSkipped > 0 {
-			return fmt.Errorf("multi Skill 安装不完整（skipped=%d）；已保留折叠版 Event/misc，未执行迁移", nSkipped)
+			return installed, skipped, fmt.Errorf("multi Skill 安装不完整（skipped=%d）；已保留折叠版 Event/misc，未执行迁移", nSkipped)
 		}
-		return nil
-	}
-	canonicalNames := append([]string(nil), skillNames...)
-	if !containsSkillName(canonicalNames, multiMiscSkill) {
-		canonicalNames = append(canonicalNames, multiMiscSkill)
-		sort.Strings(canonicalNames)
-	}
-	if err := installOrdinary(canonicalNames, canonicalTargets); err != nil {
-		return installed, skipped, err
-	}
-	if err := installOrdinary(skillNames, otherOrdinaryTargets); err != nil {
-		return installed, skipped, err
 	}

 	// The folded pair is excluded from the ordinary best-effort installer. All
 	// other selected skills (especially dingtalk-shared) must succeed before the
 	// old Event route is touched.
-	for _, dest := range physicalMigrationTargets {
+	for _, dest := range migrationTargets {
 		if cleanupErr := cleanupMutualExclusion(dest, skillSetupModeMulti, out, errOut); cleanupErr != nil {
 			return installed, skipped + len(skillNames), cleanupErr
 		}
@@ -1645,9 +1361,9 @@ func installMultiSkillsWithEventMigration(
 			prerequisiteNames = append(prerequisiteNames, name)
 		}
 	}
-	if len(prerequisiteNames) > 0 && len(physicalMigrationTargets) > 0 {
+	if len(prerequisiteNames) > 0 {
 		var n, nSkipped int
-		n, nSkipped, err = skillSetupInstallMulti(src, prerequisiteNames, physicalMigrationTargets, out, errOut, true)
+		n, nSkipped, err = skillSetupInstallMulti(src, prerequisiteNames, migrationTargets, out, errOut, true)
 		installed += n
 		skipped += nSkipped
 		if err != nil {
@@ -1658,7 +1374,7 @@ func installMultiSkillsWithEventMigration(
 		}
 	}

-	migrated, migrationErr := migrateEventMiscAtomically(src, physicalMigrationTargets, out, errOut)
+	migrated, migrationErr := migrateEventMiscAtomically(src, migrationTargets, out, errOut)
 	installed += migrated
 	if migrationErr != nil {
 		return installed, skipped, migrationErr
@@ -1930,32 +1646,9 @@ func stageSkillSetupTarget(plan *skillSetupPlan, target skillSetupTargetPlan) (s
 			err = errors.Join(err, fmt.Errorf("清理 Skill staging 失败 %s: %w", stageRoot, cleanupErr))
 		}
 	}()
-	realStageParent, realParentErr := skillSetupEvalSymlinks(stageParent)
-	if realParentErr != nil {
-		return stageRoot, nil, fmt.Errorf("解析 Agent Skill 物理目录失败 %s: %w", stageParent, realParentErr)
-	}

 	stageOne := func(src, dest string) error {
 		stagedDir := filepath.Join(stageRoot, filepath.Base(dest))
-		if target.LinkCanonical {
-			canonicalTarget := filepath.Join(target.CanonicalBase, filepath.Base(dest))
-			if samePhysicalSkillSetupPath(dest, canonicalTarget) {
-				return nil
-			}
-			realCanonicalTarget, realTargetErr := skillSetupEvalSymlinks(canonicalTarget)
-			if realTargetErr != nil {
-				return fmt.Errorf("解析 canonical Skill 失败 %s: %w", canonicalTarget, realTargetErr)
-			}
-			relTarget, relErr := skillSetupRel(realStageParent, realCanonicalTarget)
-			if relErr != nil {
-				return fmt.Errorf("计算 Skill 相对链接失败 %s: %w", canonicalTarget, relErr)
-			}
-			if linkErr := skillSetupSymlink(relTarget, stagedDir); linkErr != nil {
-				return fmt.Errorf("创建 Skill 链接失败 %s -> %s: %w", stagedDir, relTarget, linkErr)
-			}
-			staged = append(staged, skillSetupStagedDir{staged: stagedDir, dest: dest})
-			return nil
-		}
 		if err := skillSetupMkdirAll(stagedDir, 0o755); err != nil {
 			return fmt.Errorf("创建 Skill staging 目录失败 %s: %w", stagedDir, err)
 		}
@@ -1982,11 +1675,16 @@ func stageSkillSetupTarget(plan *skillSetupPlan, target skillSetupTargetPlan) (s

 // restoreSkillSetupTarget removes a partially published replacement and
 // restores every original directory from its exact backup path.
-func restoreSkillSetupTarget(published []upgrade.SkillPathPublication, backups []skillSetupBackedUpDir) error {
-	restoreErr := skillSetupRollbackPaths(published)
+func restoreSkillSetupTarget(published []string, backups []skillSetupBackedUpDir) error {
+	var restoreErr error
+	for i := len(published) - 1; i >= 0; i-- {
+		if err := skillSetupRemoveAll(published[i]); err != nil {
+			restoreErr = errors.Join(restoreErr, fmt.Errorf("移除失败发布目录 %s: %w", published[i], err))
+		}
+	}
 	for i := len(backups) - 1; i >= 0; i-- {
 		item := backups[i]
-		if _, err := skillSetupLstat(item.original); err == nil {
+		if _, err := skillSetupStat(item.original); err == nil {
 			restoreErr = errors.Join(restoreErr, fmt.Errorf("恢复目标仍存在 %s；备份保留于 %s", item.original, item.backup))
 			continue
 		} else if !errors.Is(err, os.ErrNotExist) {
@@ -1997,7 +1695,7 @@ func restoreSkillSetupTarget(published []upgrade.SkillPathPublication, backups [
 			restoreErr = errors.Join(restoreErr, fmt.Errorf("创建 Skill 恢复目录失败 %s: %w；备份保留于 %s", filepath.Dir(item.original), err, item.backup))
 			continue
 		}
-		if err := skillSetupRestoreBackup(item.backup, item.original); err != nil {
+		if err := skillSetupPublishRename(item.backup, item.original); err != nil {
 			restoreErr = errors.Join(restoreErr, fmt.Errorf("恢复原 Skill 失败 %s: %w；备份保留于 %s", item.original, err, item.backup))
 		}
 	}
@@ -2030,53 +1728,45 @@ func backupSkillSetupTarget(home string, planned []skillSetupBackup, out io.Writ
 }

 func publishSkillSetupTarget(staged []skillSetupStagedDir, backups []skillSetupBackedUpDir) error {
-	published := make([]upgrade.SkillPathPublication, 0, len(staged))
+	published := make([]string, 0, len(staged))
 	for _, item := range staged {
-		publication, err := skillSetupPublishPath(item.staged, item.dest)
-		if err != nil {
+		// Record before rename so rollback also removes a destination created by
+		// a platform-specific partial failure.
+		published = append(published, item.dest)
+		if err := skillSetupPublishRename(item.staged, item.dest); err != nil {
 			publishErr := fmt.Errorf("发布 Skill 失败 %s: %w", item.dest, err)
 			if restoreErr := restoreSkillSetupTarget(published, backups); restoreErr != nil {
 				return errors.Join(publishErr, fmt.Errorf("Skill setup 回滚不完整: %w", restoreErr))
 			}
 			return publishErr
 		}
-		published = append(published, publication)
 	}
 	return nil
 }

 func executeSkillSetupPlan(plan *skillSetupPlan, out, errOut io.Writer) (installed, skipped int, err error) {
 	home, homeErr := skillSetupUserHomeDir()
-	hasCanonicalDependents := false
-	for _, candidate := range plan.Targets {
-		if candidate.CanonicalBase != "" && !sameSkillSetupPath(skillSetupBaseForMode(candidate.Destination, plan.Mode), candidate.CanonicalBase) {
-			hasCanonicalDependents = true
-			break
-		}
+	perTarget := 1
+	if plan.Mode == skillSetupModeMulti {
+		perTarget = len(plan.MultiSkillNames)
 	}
 	for _, target := range plan.Targets {
-		perTarget := 1
-		if plan.Mode == skillSetupModeMulti {
-			perTarget = len(plan.MultiSkillNames)
-		}
-		isCanonical := target.CanonicalBase != "" && sameSkillSetupPath(skillSetupBaseForMode(target.Destination, plan.Mode), target.CanonicalBase)
 		if target.CleanupOnly {
-			// Nothing is installed below a universal root, so a stale copy that
-			// resists retirement must not count as a skipped install: any skipped
-			// count fails the whole setup, even when every real target succeeded.
+			if skipped > 0 {
+				continue
+			}
 			if homeErr != nil {
-				fmt.Fprintf(errOut, "  ⚠️  无法解析 HOME，保留 universal Agent 旧副本 %s: %v\n", target.Destination, homeErr)
+				fmt.Fprintf(errOut, "  ✗ 无法解析 HOME，保留通用 Skill 副本 %s: %v\n", target.Destination, homeErr)
+				skipped++
 				continue
 			}
 			if _, cleanupErr := backupSkillSetupTarget(home, target.Backups, out); cleanupErr != nil {
-				fmt.Fprintf(errOut, "  ⚠️  universal Agent 旧副本迁移失败，已回滚，可手动删除 %s: %v\n", target.Destination, cleanupErr)
+				fmt.Fprintf(errOut, "  ✗ 通用 Skill 副本迁移失败，已回滚 %s: %v\n", target.Destination, cleanupErr)
+				skipped++
 			}
 			continue
 		}
 		if len(target.Backups) > 0 && homeErr != nil {
-			if isCanonical && hasCanonicalDependents {
-				return installed, skipped + perTarget, fmt.Errorf("无法解析 HOME，canonical Skill 刷新中止 %s: %w", target.Destination, homeErr)
-			}
 			if plan.Mode == skillSetupModeMono {
 				fmt.Fprintf(errOut, "  ✗ 无法解析 HOME，跳过刷新（保留原目录） %s: %v\n", target.Destination, homeErr)
 			} else {
@@ -2087,16 +1777,7 @@ func executeSkillSetupPlan(plan *skillSetupPlan, out, errOut io.Writer) (install
 		}

 		stageRoot, staged, stageErr := stageSkillSetupTarget(plan, target)
-		if stageErr != nil && target.LinkCanonical {
-			fmt.Fprintf(errOut, "  ℹ️  %s 无法使用共享安装方式，正在自动改用兼容安装\n", target.Destination)
-			fallback := target
-			fallback.LinkCanonical = false
-			stageRoot, staged, stageErr = stageSkillSetupTarget(plan, fallback)
-		}
 		if stageErr != nil {
-			if isCanonical && hasCanonicalDependents {
-				return installed, skipped + perTarget, fmt.Errorf("canonical Skill staging 失败 %s: %w", target.Destination, stageErr)
-			}
 			fmt.Fprintf(errOut, "  ✗ Skill staging 失败，保留原集合 %s: %v\n", target.Destination, stageErr)
 			skipped += perTarget
 			continue
@@ -2106,9 +1787,6 @@ func executeSkillSetupPlan(plan *skillSetupPlan, out, errOut io.Writer) (install
 			if cleanupErr := skillSetupRemoveAll(stageRoot); cleanupErr != nil {
 				backupErr = errors.Join(backupErr, fmt.Errorf("清理 Skill staging 失败 %s: %w", stageRoot, cleanupErr))
 			}
-			if isCanonical && hasCanonicalDependents {
-				return installed, skipped + perTarget, fmt.Errorf("canonical Skill 备份失败，已执行回滚 %s: %w", target.Destination, backupErr)
-			}
 			fmt.Fprintf(errOut, "  ✗ Skill 备份失败，已执行回滚，跳过整个 Agent 目标 %s: %v\n", target.Destination, backupErr)
 			skipped += perTarget
 			continue
@@ -2119,19 +1797,7 @@ func executeSkillSetupPlan(plan *skillSetupPlan, out, errOut io.Writer) (install
 			if cleanupErr != nil {
 				publishErr = errors.Join(publishErr, fmt.Errorf("清理 Skill staging 失败 %s: %w", stageRoot, cleanupErr))
 			}
-			if isCanonical && hasCanonicalDependents {
-				if errors.Is(publishErr, upgrade.ErrSkillPathPublicationUncertain) {
-					return installed, skipped + perTarget, fmt.Errorf("canonical Skill 发布状态不确定，目标可能属于并发写入并已保留 %s: %w", target.Destination, publishErr)
-				}
-				return installed, skipped + perTarget, fmt.Errorf("canonical Skill 发布失败，已执行回滚 %s: %w", target.Destination, publishErr)
-			}
-			if errors.Is(publishErr, upgrade.ErrSkillPathPublicationUncertain) {
-				// The destination may belong to a concurrent writer and was
-				// deliberately retained; the rollback refuses to displace it.
-				fmt.Fprintf(errOut, "  ✗ Skill 发布状态不确定，目标可能属于并发写入并已保留 %s: %v\n", target.Destination, publishErr)
-			} else {
-				fmt.Fprintf(errOut, "  ✗ Skill 发布失败，已执行回滚，跳过整个 Agent 目标 %s: %v\n", target.Destination, publishErr)
-			}
+			fmt.Fprintf(errOut, "  ✗ Skill 发布失败，已执行回滚，跳过整个 Agent 目标 %s: %v\n", target.Destination, publishErr)
 			skipped += perTarget
 			continue
 		}
@@ -2170,7 +1836,7 @@ func staleMultiSkillVictimsWithError(dest string, keep []string, managed ...map[
 	}
 	var victims []string
 	for _, e := range entries {
-		if (!e.IsDir() && e.Type()&os.ModeSymlink == 0) || keepSet[e.Name()] {
+		if !e.IsDir() || keepSet[e.Name()] {
 			continue
 		}
 		if !isManagedDWSMultiSkillDir(filepath.Join(dest, e.Name()), managed...) {
@@ -1,160 +0,0 @@
-package app
-
-import (
-	"bytes"
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/testseam"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/upgrade"
-)
-
-func canonicalFailurePlan(t *testing.T) (string, *skillSetupPlan) {
-	t.Helper()
-	home := t.TempDir()
-	src := t.TempDir()
-	skill := filepath.Join(src, "dingtalk-chat")
-	if err := os.MkdirAll(skill, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(skill, "SKILL.md"), []byte("chat"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	canonical := filepath.Join(home, ".agents", "skills")
-	dependent := filepath.Join(home, ".claude", "skills")
-	plan, err := buildSkillSetupPlan(skillSetupModeMulti, src, []string{canonical, dependent}, []string{"dingtalk-chat"}, true)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return home, plan
-}
-
-func TestCrossPlatformCoverageSkillSetupCanonicalHomeBackupAndPublishFailures(t *testing.T) {
-	t.Run("home", func(t *testing.T) {
-		_, plan := canonicalFailurePlan(t)
-		canonical := filepath.Join(plan.Targets[0].Destination, "dingtalk-chat")
-		if err := os.MkdirAll(canonical, 0o755); err != nil {
-			t.Fatal(err)
-		}
-		plan.Targets[0].Backups = []skillSetupBackup{{Path: canonical, Reason: skillSetupBackupReplace}}
-		testseam.Swap(t, &skillSetupUserHomeDir, func() (string, error) { return "", errors.New("home denied") })
-		if _, _, err := executeSkillSetupPlan(plan, &bytes.Buffer{}, &bytes.Buffer{}); err == nil || !strings.Contains(err.Error(), "canonical Skill 刷新中止") {
-			t.Fatalf("home failure = %v", err)
-		}
-	})
-
-	t.Run("backup", func(t *testing.T) {
-		home, plan := canonicalFailurePlan(t)
-		victim := filepath.Join(plan.Targets[0].Destination, "dingtalk-chat")
-		if err := os.MkdirAll(victim, 0o755); err != nil {
-			t.Fatal(err)
-		}
-		plan.Targets[0].Backups = []skillSetupBackup{{Path: victim, Reason: skillSetupBackupReplace}}
-		testseam.Swap(t, &skillSetupUserHomeDir, func() (string, error) { return home, nil })
-		testseam.Swap(t, &skillSetupBackupAndRemove, func(string, string) (string, error) { return "", errors.New("backup denied") })
-		if _, _, err := executeSkillSetupPlan(plan, &bytes.Buffer{}, &bytes.Buffer{}); err == nil || !strings.Contains(err.Error(), "canonical Skill 备份失败") {
-			t.Fatalf("backup failure = %v", err)
-		}
-	})
-
-	t.Run("publish", func(t *testing.T) {
-		home, plan := canonicalFailurePlan(t)
-		testseam.Swap(t, &skillSetupUserHomeDir, func() (string, error) { return home, nil })
-		testseam.Swap(t, &skillSetupPublishPath, func(string, string) (upgrade.SkillPathPublication, error) {
-			return upgrade.SkillPathPublication{}, errors.New("publish denied")
-		})
-		if _, _, err := executeSkillSetupPlan(plan, &bytes.Buffer{}, &bytes.Buffer{}); err == nil || !strings.Contains(err.Error(), "canonical Skill 发布失败") {
-			t.Fatalf("publish failure = %v", err)
-		}
-	})
-
-	t.Run("uncertain-publish", func(t *testing.T) {
-		home, plan := canonicalFailurePlan(t)
-		testseam.Swap(t, &skillSetupUserHomeDir, func() (string, error) { return home, nil })
-		testseam.Swap(t, &skillSetupPublishPath, func(string, string) (upgrade.SkillPathPublication, error) {
-			return upgrade.SkillPathPublication{}, fmt.Errorf("并发写入: %w", upgrade.ErrSkillPathPublicationUncertain)
-		})
-		errOut := &bytes.Buffer{}
-		_, _, err := executeSkillSetupPlan(plan, &bytes.Buffer{}, errOut)
-		if err == nil || !strings.Contains(err.Error(), "canonical Skill 发布状态不确定") {
-			t.Fatalf("uncertain publish = %v", err)
-		}
-		// The destination was deliberately retained, so the canonical error
-		// must not claim a rollback happened.
-		if strings.Contains(err.Error(), "回滚") {
-			t.Fatalf("uncertain error must not claim a rollback: %v", err)
-		}
-	})
-
-	t.Run("uncertain dependent target is retained and reported", func(t *testing.T) {
-		home, plan := canonicalFailurePlan(t)
-		testseam.Swap(t, &skillSetupUserHomeDir, func() (string, error) { return home, nil })
-		originalPublish := skillSetupPublishPath
-		testseam.Swap(t, &skillSetupPublishPath, func(staged, destination string) (upgrade.SkillPathPublication, error) {
-			if strings.HasPrefix(destination, filepath.Join(home, ".claude")) {
-				return upgrade.SkillPathPublication{}, fmt.Errorf("并发写入: %w", upgrade.ErrSkillPathPublicationUncertain)
-			}
-			return originalPublish(staged, destination)
-		})
-		errOut := &bytes.Buffer{}
-		_, skipped, err := executeSkillSetupPlan(plan, &bytes.Buffer{}, errOut)
-		if err != nil {
-			t.Fatalf("dependent uncertain publish = %v", err)
-		}
-		if skipped != 1 {
-			t.Fatalf("skipped = %d, want 1", skipped)
-		}
-		if !strings.Contains(errOut.String(), "发布状态不确定") || strings.Contains(errOut.String(), "已执行回滚") {
-			t.Fatalf("errOut = %q, want retained-destination notice", errOut.String())
-		}
-	})
-}
-
-func TestCrossPlatformCoverageSkillSetupLinkResolutionFailures(t *testing.T) {
-	home, plan := canonicalFailurePlan(t)
-	canonicalTarget := filepath.Join(plan.Targets[0].Destination, "dingtalk-chat")
-	if err := os.MkdirAll(canonicalTarget, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(canonicalTarget, "SKILL.md"), []byte("chat"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	linked := plan.Targets[1]
-
-	t.Run("physical-parent", func(t *testing.T) {
-		testseam.Swap(t, &skillSetupEvalSymlinks, func(path string) (string, error) {
-			if path == linked.Destination {
-				return "", errors.New("parent denied")
-			}
-			return filepath.EvalSymlinks(path)
-		})
-		if _, _, err := stageSkillSetupTarget(plan, linked); err == nil || !strings.Contains(err.Error(), "物理目录") {
-			t.Fatalf("physical parent error = %v", err)
-		}
-	})
-
-	t.Run("canonical-target", func(t *testing.T) {
-		testseam.Swap(t, &skillSetupEvalSymlinks, func(path string) (string, error) {
-			if path == canonicalTarget {
-				return "", errors.New("canonical denied")
-			}
-			return filepath.EvalSymlinks(path)
-		})
-		if _, _, err := stageSkillSetupTarget(plan, linked); err == nil || !strings.Contains(err.Error(), "解析 canonical") {
-			t.Fatalf("canonical target error = %v", err)
-		}
-	})
-
-	t.Run("relative-path", func(t *testing.T) {
-		testseam.Swap(t, &skillSetupRel, func(string, string) (string, error) { return "", errors.New("relative denied") })
-		if _, _, err := stageSkillSetupTarget(plan, linked); err == nil || !strings.Contains(err.Error(), "相对链接") {
-			t.Fatalf("relative path error = %v", err)
-		}
-	})
-
-	_ = home
-}
@@ -1,395 +0,0 @@
-package app
-
-import (
-	"bytes"
-	"errors"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/testseam"
-)
-
-func TestCrossPlatformCoverageSkillSetupCanonicalTargetsAndAgentCapabilities(t *testing.T) {
-	home := t.TempDir()
-	testseam.Swap(t, &skillSetupUserHomeDir, func() (string, error) { return home, nil })
-	testseam.Swap(t, &skillSetupAgentHomes, []string{
-		".agents/skills", ".codex/skills", ".claude/skills", ".openclaw/skills",
-	})
-	for _, parent := range []string{".codex", ".claude", ".openclaw"} {
-		if err := os.MkdirAll(filepath.Join(home, parent), 0o755); err != nil {
-			t.Fatal(err)
-		}
-	}
-
-	dests, err := resolveSkillSetupTargets("all", skillSetupModeMulti)
-	if err != nil {
-		t.Fatal(err)
-	}
-	canonical := filepath.Join(home, ".agents", "skills")
-	if len(dests) != 4 || dests[0] != canonical {
-		t.Fatalf("targets = %v", dests)
-	}
-
-	src := t.TempDir()
-	for _, name := range []string{"dingtalk-chat", "dingtalk-shared"} {
-		dir := filepath.Join(src, name)
-		if err := os.MkdirAll(dir, 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(filepath.Join(dir, "SKILL.md"), []byte(name), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-	oldCodex := filepath.Join(home, ".codex", "skills", "dingtalk-chat")
-	if err := os.MkdirAll(oldCodex, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(oldCodex, "SKILL.md"), []byte("beta.6"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	claudeSkills := filepath.Join(home, ".claude", "skills")
-	if err := os.MkdirAll(claudeSkills, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(claudeSkills, "dingtalk-chat"), []byte("unexpected file"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.Symlink("missing-target", filepath.Join(claudeSkills, "dingtalk-shared")); err != nil {
-		t.Fatal(err)
-	}
-
-	plan, err := buildSkillSetupPlan(skillSetupModeMulti, src, dests, []string{"dingtalk-chat", "dingtalk-shared"}, false)
-	if err != nil {
-		t.Fatal(err)
-	}
-	installed, skipped, err := executeSkillSetupPlan(plan, &bytes.Buffer{}, &bytes.Buffer{})
-	if err != nil || skipped != 0 || installed != 6 { // canonical + two linked Agents, two Skills each
-		t.Fatalf("execute = installed %d skipped %d err %v", installed, skipped, err)
-	}
-	if _, err := os.Lstat(oldCodex); !os.IsNotExist(err) {
-		t.Fatalf("Codex duplicate remains: %v", err)
-	}
-	for _, name := range []string{"dingtalk-chat", "dingtalk-shared"} {
-		if _, err := os.Stat(filepath.Join(canonical, name, "SKILL.md")); err != nil {
-			t.Fatalf("canonical %s missing: %v", name, err)
-		}
-		for _, agent := range []string{".claude", ".openclaw"} {
-			link := filepath.Join(home, agent, "skills", name)
-			info, err := os.Lstat(link)
-			if err != nil || info.Mode()&os.ModeSymlink == 0 {
-				t.Fatalf("link %s = %#v, %v", link, info, err)
-			}
-		}
-	}
-	// Re-running setup must recognize the existing links as already correct;
-	// canonical refreshes in place without turning links into copied trees.
-	plan, err = buildSkillSetupPlan(skillSetupModeMulti, src, dests, []string{"dingtalk-chat", "dingtalk-shared"}, false)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, _, err := executeSkillSetupPlan(plan, &bytes.Buffer{}, &bytes.Buffer{}); err != nil {
-		t.Fatal(err)
-	}
-	for _, agent := range []string{".claude", ".openclaw"} {
-		info, err := os.Lstat(filepath.Join(home, agent, "skills", "dingtalk-chat"))
-		if err != nil || info.Mode()&os.ModeSymlink == 0 {
-			t.Fatalf("idempotent setup replaced %s link: %#v, %v", agent, info, err)
-		}
-	}
-}
-
-func TestCrossPlatformCoverageSkillSetupDetectsShallowAndApplicationAgents(t *testing.T) {
-	// Keep the destination HOME synthetic: app-bundle detection is deliberately
-	// machine-scoped and must not depend on the selected installation HOME.
-	home := t.TempDir()
-	testseam.Swap(t, &skillSetupGetenv, func(string) string { return "" })
-	for _, dir := range []string{filepath.Join(home, ".config", "kimchi"), filepath.Join(home, ".tabnine")} {
-		if err := os.MkdirAll(dir, 0o755); err != nil {
-			t.Fatal(err)
-		}
-	}
-	sentinel := filepath.Join(home, "app-sentinel")
-	if err := os.MkdirAll(sentinel, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	appInfo, err := os.Stat(sentinel)
-	if err != nil {
-		t.Fatal(err)
-	}
-	zcodeApp := filepath.Join(string(filepath.Separator), "Applications", "ZCode.app")
-	minimaxApp := filepath.Join(string(filepath.Separator), "Applications", "MiniMax Code.app")
-	originalStat := skillSetupStat
-	testseam.Swap(t, &skillSetupStat, func(path string) (os.FileInfo, error) {
-		if path == zcodeApp || path == minimaxApp {
-			return appInfo, nil
-		}
-		return originalStat(path)
-	})
-	dests := detectExistingAgentHomes(home, skillSetupModeMulti)
-	for _, target := range []string{
-		filepath.Join(home, ".config", "kimchi", "harness", "skills"),
-		filepath.Join(home, ".tabnine", "agent", "skills"),
-		filepath.Join(home, ".zcode", "skills"),
-		filepath.Join(home, ".minimax", "skills"),
-	} {
-		if !containsSkillName(dests, target) {
-			t.Errorf("detected targets %v missing %s", dests, target)
-		}
-	}
-}
-
-func TestCrossPlatformCoverageSkillSetupCustomRootsAliasesAndUniversalTargets(t *testing.T) {
-	home := t.TempDir()
-	customClaude := filepath.Join(t.TempDir(), "claude")
-	customCodex := filepath.Join(t.TempDir(), "codex")
-	customHermes := filepath.Join(t.TempDir(), "hermes")
-	for _, root := range []string{customClaude, customCodex, customHermes, filepath.Join(home, ".moltbot"), filepath.Join(home, ".copilot"), filepath.Join(home, ".config", "opencode"), filepath.Join(home, ".config", "agents"), filepath.Join(home, ".codeium", "windsurf")} {
-		if err := os.MkdirAll(root, 0o755); err != nil {
-			t.Fatal(err)
-		}
-	}
-	testseam.Swap(t, &skillSetupUserHomeDir, func() (string, error) { return home, nil })
-	testseam.Swap(t, &skillSetupGetenv, func(name string) string {
-		switch name {
-		case "CLAUDE_CONFIG_DIR":
-			return customClaude
-		case "CODEX_HOME":
-			return customCodex
-		case "HERMES_HOME":
-			return customHermes
-		default:
-			return ""
-		}
-	})
-
-	dests, err := resolveSkillSetupTargets("all", skillSetupModeMulti)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, want := range []string{
-		filepath.Join(home, ".agents", "skills"),
-		filepath.Join(customClaude, "skills"),
-		filepath.Join(customCodex, "skills"),
-		filepath.Join(customHermes, "skills"),
-		filepath.Join(home, ".moltbot", "skills"),
-		filepath.Join(home, ".copilot", "skills"),
-		filepath.Join(home, ".config", "opencode", "skills"),
-		filepath.Join(home, ".config", "agents", "skills"),
-		filepath.Join(home, ".codeium", "windsurf", "skills"),
-	} {
-		found := false
-		for _, got := range dests {
-			if sameSkillSetupPath(got, want) {
-				found = true
-				break
-			}
-		}
-		if !found {
-			t.Fatalf("resolved targets %v missing %s", dests, want)
-		}
-	}
-	if !isUniversalSkillSetupBase(filepath.Join(customCodex, "skills")) || !isUniversalSkillSetupBase(filepath.Join(home, ".config", "opencode", "skills")) || !isUniversalSkillSetupBase(filepath.Join(home, ".config", "agents", "skills")) {
-		t.Fatal("custom Codex, OpenCode, and Amp must be universal cleanup-only targets")
-	}
-}
-
-func TestCrossPlatformCoverageSkillSetupCanonicalFailureStopsDependentTargets(t *testing.T) {
-	home := t.TempDir()
-	canonical := filepath.Join(home, ".agents", "skills")
-	claude := filepath.Join(home, ".claude", "skills")
-	if err := os.MkdirAll(claude, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	oldClaude := filepath.Join(claude, "dingtalk-chat")
-	if err := os.MkdirAll(oldClaude, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(oldClaude, "SKILL.md"), []byte("old remains"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	src := t.TempDir()
-	if err := os.MkdirAll(filepath.Join(src, "dingtalk-chat"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(src, "dingtalk-chat", "SKILL.md"), []byte("new"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	testseam.Swap(t, &skillSetupUserHomeDir, func() (string, error) { return home, nil })
-	plan, err := buildSkillSetupPlan(skillSetupModeMulti, src, []string{canonical, claude}, []string{"dingtalk-chat"}, true)
-	if err != nil {
-		t.Fatal(err)
-	}
-	testseam.Swap(t, &skillSetupCopyDir, func(string, string) error { return errors.New("canonical copy denied") })
-	if _, _, err := executeSkillSetupPlan(plan, &bytes.Buffer{}, &bytes.Buffer{}); err == nil || !strings.Contains(err.Error(), "canonical") {
-		t.Fatalf("canonical failure = %v", err)
-	}
-	body, readErr := os.ReadFile(filepath.Join(oldClaude, "SKILL.md"))
-	if readErr != nil || string(body) != "old remains" {
-		t.Fatalf("dependent Claude target changed: %q, %v", body, readErr)
-	}
-}
-
-func TestCrossPlatformCoverageSkillSetupCanonicalCopyFallbackMessage(t *testing.T) {
-	home := t.TempDir()
-	canonical := filepath.Join(home, ".agents", "skills")
-	claude := filepath.Join(home, ".claude", "skills")
-	src := t.TempDir()
-	skillSrc := filepath.Join(src, "dingtalk-chat")
-	if err := os.MkdirAll(skillSrc, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(skillSrc, "SKILL.md"), []byte("chat"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	testseam.Swap(t, &skillSetupUserHomeDir, func() (string, error) { return home, nil })
-	testseam.Swap(t, &skillSetupSymlink, func(string, string) error { return errors.New("links unavailable") })
-
-	plan, err := buildSkillSetupPlan(
-		skillSetupModeMulti,
-		src,
-		[]string{canonical, claude},
-		[]string{"dingtalk-chat"},
-		false,
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var out, errOut bytes.Buffer
-	installed, skipped, err := executeSkillSetupPlan(plan, &out, &errOut)
-	if err != nil || installed != 2 || skipped != 0 {
-		t.Fatalf("execute = installed %d skipped %d err %v", installed, skipped, err)
-	}
-	if !strings.Contains(errOut.String(), "自动改用兼容安装") {
-		t.Fatalf("human-readable fallback message missing: %s", errOut.String())
-	}
-	info, err := os.Lstat(filepath.Join(claude, "dingtalk-chat"))
-	if err != nil || !info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
-		t.Fatalf("copy fallback = %#v, %v", info, err)
-	}
-}
-
-func TestCrossPlatformCoverageUpstreamAgentEnumerationAndEffectiveRoots(t *testing.T) {
-	home := t.TempDir()
-	testseam.Swap(t, &skillSetupUserHomeDir, func() (string, error) { return home, nil })
-	testseam.Swap(t, &skillUserHomeDir, func() (string, error) { return home, nil })
-	testseam.Swap(t, &skillSetupGetenv, func(string) string { return "" })
-
-	expected := map[string]string{
-		"aider-desk": ".aider-desk/skills", "amp": ".config/agents/skills",
-		"antigravity": ".gemini/antigravity/skills", "antigravity-cli": ".gemini/antigravity-cli/skills",
-		"astrbot": ".astrbot/data/skills", "autohand-code": ".autohand/skills",
-		"augment": ".augment/skills", "bob": ".bob/skills", "claude-code": ".claude/skills",
-		"openclaw": ".openclaw/skills", "cline": ".agents/skills", "codearts-agent": ".codeartsdoer/skills",
-		"codebuddy": ".codebuddy/skills", "codemaker": ".codemaker/skills", "codestudio": ".codestudio/skills",
-		"codex": ".codex/skills", "command-code": ".commandcode/skills", "continue": ".continue/skills",
-		"cortex": ".snowflake/cortex/skills", "crush": ".config/crush/skills", "cursor": ".cursor/skills",
-		"deepagents": ".deepagents/agent/skills", "devin": ".config/devin/skills", "dexto": ".agents/skills",
-		"droid": ".factory/skills", "firebender": ".firebender/skills", "forgecode": ".forge/skills",
-		"gemini-cli": ".gemini/skills", "github-copilot": ".copilot/skills", "goose": ".config/goose/skills",
-		"grok": ".grok/skills", "hermes-agent": ".hermes/skills", "inference-sh": ".inferencesh/skills",
-		"jazz": ".jazz/skills", "junie": ".junie/skills", "iflow-cli": ".iflow/skills",
-		"kilo": ".kilocode/skills", "kimchi": ".config/kimchi/harness/skills", "kimi-code-cli": ".agents/skills",
-		"kiro-cli": ".kiro/skills", "kode": ".kode/skills", "lingma": ".lingma/skills", "loaf": ".agents/skills",
-		"mcpjam": ".mcpjam/skills", "minimax-code": ".minimax/skills", "mistral-vibe": ".vibe/skills",
-		"moxby": ".moxby/skills", "mux": ".mux/skills", "opencode": ".config/opencode/skills",
-		"openhands": ".openhands/skills", "ona": ".ona/skills", "pi": ".pi/agent/skills",
-		"qoder": ".qoder/skills", "qoder-cn": ".qoder-cn/skills", "qwen-code": ".qwen/skills",
-		"replit": ".config/agents/skills", "reasonix": ".reasonix/skills", "rovodev": ".rovodev/skills",
-		"roo": ".roo/skills", "tabnine-cli": ".tabnine/agent/skills", "terramind": ".terramind/skills",
-		"tinycloud": ".tinycloud/skills", "trae": ".trae/skills", "trae-cn": ".trae-cn/skills",
-		"universal": ".config/agents/skills", "warp": ".agents/skills", "windsurf": ".codeium/windsurf/skills",
-		"zed": ".agents/skills", "zcode": ".zcode/skills", "zencoder": ".zencoder/skills",
-		"zenflow": ".zencoder/skills", "neovate": ".neovate/skills", "pochi": ".pochi/skills", "adal": ".adal/skills",
-	}
-	if got := len(expected) + len(unsupportedGlobalAgentTargets); got != 76 {
-		t.Fatalf("upstream agent enumeration = %d, want 76", got)
-	}
-	for target, rel := range expected {
-		mapped, ok := agentSkillPaths[target]
-		if !ok || filepath.Clean(mapped) != filepath.Clean(rel) {
-			t.Errorf("agent %s map = %q, want %q", target, mapped, rel)
-		}
-		if got := resolveSkillSetupBase(home, target); !sameSkillSetupPath(got, filepath.Join(home, filepath.FromSlash(rel))) {
-			t.Errorf("agent %s effective root = %q, want %q", target, got, filepath.Join(home, rel))
-		}
-	}
-	for _, target := range []string{"eve", "promptscript"} {
-		if _, err := resolveSkillSetupTargets(target, skillSetupModeMulti); err == nil {
-			t.Errorf("%s unexpectedly resolved a global setup root", target)
-		}
-		if _, err := resolveSkillTargetPath(target); err == nil {
-			t.Errorf("%s unexpectedly resolved a marketplace install root", target)
-		}
-	}
-	if got := supportedTargets(); !strings.Contains(got, "eve") || !strings.Contains(got, "promptscript") {
-		t.Fatalf("supported targets omit no-global upstream agents: %s", got)
-	}
-
-	custom := map[string]string{
-		"AUTOHAND_HOME": filepath.Join(home, "autohand-home"), "CLAUDE_CONFIG_DIR": filepath.Join(home, "claude-home"),
-		"CODEX_HOME": filepath.Join(home, "codex-home"), "GROK_HOME": filepath.Join(home, "grok-home"),
-		"HERMES_HOME": filepath.Join(home, "hermes-home"), "VIBE_HOME": filepath.Join(home, "vibe-home"),
-		"XDG_CONFIG_HOME": filepath.Join(home, "xdg"),
-	}
-	testseam.Swap(t, &skillSetupGetenv, func(name string) string { return custom[name] })
-	customCases := map[string]string{
-		"autohand-code": filepath.Join(custom["AUTOHAND_HOME"], "skills"),
-		"claude-code":   filepath.Join(custom["CLAUDE_CONFIG_DIR"], "skills"),
-		"codex":         filepath.Join(custom["CODEX_HOME"], "skills"),
-		"grok":          filepath.Join(custom["GROK_HOME"], "skills"),
-		"hermes-agent":  filepath.Join(custom["HERMES_HOME"], "skills"),
-		"mistral-vibe":  filepath.Join(custom["VIBE_HOME"], "skills"),
-		"amp":           filepath.Join(custom["XDG_CONFIG_HOME"], "agents", "skills"),
-		"replit":        filepath.Join(custom["XDG_CONFIG_HOME"], "agents", "skills"),
-		"universal":     filepath.Join(custom["XDG_CONFIG_HOME"], "agents", "skills"),
-		"crush":         filepath.Join(custom["XDG_CONFIG_HOME"], "crush", "skills"),
-		"devin":         filepath.Join(custom["XDG_CONFIG_HOME"], "devin", "skills"),
-		"goose":         filepath.Join(custom["XDG_CONFIG_HOME"], "goose", "skills"),
-		"kimchi":        filepath.Join(custom["XDG_CONFIG_HOME"], "kimchi", "harness", "skills"),
-		"opencode":      filepath.Join(custom["XDG_CONFIG_HOME"], "opencode", "skills"),
-	}
-	for target, want := range customCases {
-		if got := resolveSkillSetupBase(home, target); !sameSkillSetupPath(got, want) {
-			t.Errorf("custom %s root = %q, want %q", target, got, want)
-		}
-	}
-	for _, target := range []string{"codex", "amp", "opencode"} {
-		if !isUniversalSkillSetupBase(resolveSkillSetupBase(home, target)) {
-			t.Errorf("custom %s root not classified universal", target)
-		}
-	}
-}
-
-func TestCrossPlatformCoverageOpenClawAliasPriority(t *testing.T) {
-	for _, tc := range []struct {
-		name string
-		dirs []string
-		want string
-	}{
-		{name: "default", want: ".openclaw"},
-		{name: "moltbot", dirs: []string{".moltbot"}, want: ".moltbot"},
-		{name: "clawdbot-before-moltbot", dirs: []string{".moltbot", ".clawdbot"}, want: ".clawdbot"},
-		{name: "openclaw-first", dirs: []string{".moltbot", ".clawdbot", ".openclaw"}, want: ".openclaw"},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			home := t.TempDir()
-			for _, dir := range tc.dirs {
-				if err := os.MkdirAll(filepath.Join(home, dir), 0o755); err != nil {
-					t.Fatal(err)
-				}
-			}
-			if got := resolveOpenClawSetupBase(home); got != filepath.Join(home, tc.want, "skills") {
-				t.Fatalf("OpenClaw root = %q", got)
-			}
-		})
-	}
-}
-
-func TestCrossPlatformCoverageSkillSetupWindowsPathNormalization(t *testing.T) {
-	testseam.Swap(t, &skillSetupFoldPathCase, true)
-	if !sameSkillSetupPath(filepath.Join("Root", "Skills"), filepath.Join("root", "skills")) {
-		t.Fatal("case-insensitive platform path normalization failed")
-	}
-}
@@ -15,7 +15,6 @@ import (
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/skillprovenance"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/skillstate"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/testseam"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/upgrade"
 )

 func useManagedSkillNames(t *testing.T, names ...string) {
@@ -337,12 +336,12 @@ func TestCrossPlatformCoverageSkillSetupTransactionFailuresRestoreOldSet(t *test
 					return originalBackup(homeDir, dir)
 				})
 			} else {
-				originalPublish := skillSetupPublishPath
-				testseam.Swap(t, &skillSetupPublishPath, func(oldPath, newPath string) (upgrade.SkillPathPublication, error) {
+				originalRename := skillSetupPublishRename
+				testseam.Swap(t, &skillSetupPublishRename, func(oldPath, newPath string) error {
 					if newPath == second && strings.HasPrefix(filepath.Base(filepath.Dir(oldPath)), ".dws-setup-set-") {
-						return upgrade.SkillPathPublication{}, failure
+						return failure
 					}
-					return originalPublish(oldPath, newPath)
+					return originalRename(oldPath, newPath)
 				})
 			}

@@ -433,8 +432,8 @@ func TestCrossPlatformCoverageSkillSetupTransactionFailureEdges(t *testing.T) {

 	t.Run("restore failure aggregation", func(t *testing.T) {
 		t.Run("remove published", func(t *testing.T) {
-			testseam.Swap(t, &skillSetupRollbackPaths, func([]upgrade.SkillPathPublication) error { return failure })
-			if err := restoreSkillSetupTarget([]upgrade.SkillPathPublication{{Destination: "published"}}, nil); !errors.Is(err, failure) {
+			testseam.Swap(t, &skillSetupRemoveAll, func(string) error { return failure })
+			if err := restoreSkillSetupTarget([]string{"published"}, nil); !errors.Is(err, failure) {
 				t.Fatalf("remove published error = %v", err)
 			}
 		})
@@ -446,14 +445,14 @@ func TestCrossPlatformCoverageSkillSetupTransactionFailureEdges(t *testing.T) {
 			}
 		})
 		t.Run("stat", func(t *testing.T) {
-			testseam.Swap(t, &skillSetupLstat, func(string) (os.FileInfo, error) { return nil, failure })
+			testseam.Swap(t, &skillSetupStat, func(string) (os.FileInfo, error) { return nil, failure })
 			err := restoreSkillSetupTarget(nil, []skillSetupBackedUpDir{{original: "original", backup: "backup"}})
 			if !errors.Is(err, failure) || !strings.Contains(err.Error(), "检查 Skill 恢复目标失败") {
 				t.Fatalf("restore stat error = %v", err)
 			}
 		})
 		t.Run("mkdir", func(t *testing.T) {
-			testseam.Swap(t, &skillSetupLstat, func(string) (os.FileInfo, error) { return nil, os.ErrNotExist })
+			testseam.Swap(t, &skillSetupStat, func(string) (os.FileInfo, error) { return nil, os.ErrNotExist })
 			testseam.Swap(t, &skillSetupMkdirAll, func(string, os.FileMode) error { return failure })
 			err := restoreSkillSetupTarget(nil, []skillSetupBackedUpDir{{original: "original", backup: "backup"}})
 			if !errors.Is(err, failure) || !strings.Contains(err.Error(), "创建 Skill 恢复目录失败") {
@@ -461,9 +460,9 @@ func TestCrossPlatformCoverageSkillSetupTransactionFailureEdges(t *testing.T) {
 			}
 		})
 		t.Run("rename", func(t *testing.T) {
-			testseam.Swap(t, &skillSetupLstat, func(string) (os.FileInfo, error) { return nil, os.ErrNotExist })
+			testseam.Swap(t, &skillSetupStat, func(string) (os.FileInfo, error) { return nil, os.ErrNotExist })
 			testseam.Swap(t, &skillSetupMkdirAll, func(string, os.FileMode) error { return nil })
-			testseam.Swap(t, &skillSetupRestoreBackup, func(string, string) error { return failure })
+			testseam.Swap(t, &skillSetupPublishRename, func(string, string) error { return failure })
 			err := restoreSkillSetupTarget(nil, []skillSetupBackedUpDir{{original: "original", backup: "backup"}})
 			if !errors.Is(err, failure) || !strings.Contains(err.Error(), "恢复原 Skill 失败") {
 				t.Fatalf("restore rename error = %v", err)
@@ -480,10 +479,10 @@ func TestCrossPlatformCoverageSkillSetupTransactionFailureEdges(t *testing.T) {
 			}
 			return "", failure
 		})
-		testseam.Swap(t, &skillSetupLstat, func(string) (os.FileInfo, error) { return nil, os.ErrNotExist })
+		testseam.Swap(t, &skillSetupStat, func(string) (os.FileInfo, error) { return nil, os.ErrNotExist })
 		testseam.Swap(t, &skillSetupMkdirAll, func(string, os.FileMode) error { return nil })
 		restoreErr := errors.New("restore failure")
-		testseam.Swap(t, &skillSetupRestoreBackup, func(string, string) error { return restoreErr })
+		testseam.Swap(t, &skillSetupPublishRename, func(string, string) error { return restoreErr })
 		_, err := backupSkillSetupTarget("home", []skillSetupBackup{{Path: "first"}, {Path: "second"}}, io.Discard)
 		if !errors.Is(err, failure) || !errors.Is(err, restoreErr) {
 			t.Fatalf("backup rollback error = %v", err)
@@ -491,11 +490,8 @@ func TestCrossPlatformCoverageSkillSetupTransactionFailureEdges(t *testing.T) {
 	})

 	t.Run("publish rollback failure", func(t *testing.T) {
-		testseam.Swap(t, &skillSetupPublishPath, func(string, string) (upgrade.SkillPathPublication, error) {
-			return upgrade.SkillPathPublication{}, failure
-		})
-		testseam.Swap(t, &skillSetupRestoreBackup, func(string, string) error { return failure })
-		testseam.Swap(t, &skillSetupLstat, func(string) (os.FileInfo, error) { return nil, os.ErrNotExist })
+		testseam.Swap(t, &skillSetupPublishRename, func(string, string) error { return failure })
+		testseam.Swap(t, &skillSetupStat, func(string) (os.FileInfo, error) { return nil, os.ErrNotExist })
 		testseam.Swap(t, &skillSetupMkdirAll, func(string, os.FileMode) error { return nil })
 		err := publishSkillSetupTarget(
 			[]skillSetupStagedDir{{staged: "staged", dest: "dest"}},
@@ -534,12 +530,12 @@ func TestCrossPlatformCoverageSkillSetupTransactionFailureEdges(t *testing.T) {

 		t.Run("after publish failure", func(t *testing.T) {
 			plan := newPlan(t)
-			originalPublish := skillSetupPublishPath
-			testseam.Swap(t, &skillSetupPublishPath, func(oldPath, newPath string) (upgrade.SkillPathPublication, error) {
+			originalRename := skillSetupPublishRename
+			testseam.Swap(t, &skillSetupPublishRename, func(oldPath, newPath string) error {
 				if strings.HasPrefix(filepath.Base(filepath.Dir(oldPath)), ".dws-setup-set-") {
-					return upgrade.SkillPathPublication{}, failure
+					return failure
 				}
-				return originalPublish(oldPath, newPath)
+				return originalRename(oldPath, newPath)
 			})
 			originalRemoveAll := skillSetupRemoveAll
 			cleanupErr := errors.New("cleanup after publish failure")
@@ -1,139 +0,0 @@
-package app
-
-import (
-	"errors"
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/testseam"
-)
-
-// TestCrossPlatformCoverageSkillSetupEventMigrationRetiresUniversalFoldedCopies
-// pins the P0 fix: when a beta.6 folded dingtalk-misc (carrying the personal
-// Event route) exists only in a UNIVERSAL agent home (~/.codex/skills), the
-// Event/misc migration must not leave physical duplicates there. Universal
-// homes read ~/.agents/skills directly, so their old folded copies are retired
-// (backed up) and the split standalone event + clean misc land in canonical.
-func TestCrossPlatformCoverageSkillSetupEventMigrationRetiresUniversalFoldedCopies(t *testing.T) {
-	home := t.TempDir()
-	testseam.Swap(t, &skillSetupUserHomeDir, func() (string, error) { return home, nil })
-
-	codexSkills := filepath.Join(home, ".codex", "skills")
-	writeFoldedEventMisc(t, codexSkills)
-	// beta.6 physical copies alongside the folded misc.
-	for _, name := range []string{multiEventSkill, multiSharedSkill} {
-		if err := os.MkdirAll(filepath.Join(codexSkills, name), 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(filepath.Join(codexSkills, name, "SKILL.md"), []byte("beta6 "+name+"\n"), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-	canonical := filepath.Join(home, ".agents", "skills")
-	src := writeMultiSkillSource(t, []string{multiEventSkill, multiSharedSkill, multiMiscSkill})
-
-	stdout, stderr, err := executeMultiSkillSetupTest(t, src, []string{canonical, codexSkills}, "--skill", "event", "--yes")
-	if err != nil {
-		t.Fatalf("setup failed: %v\nstderr=%s\nstdout=%s", err, stderr, stdout)
-	}
-
-	// P0: the universal home must not retain any physical dingtalk-* copy.
-	for _, name := range []string{multiEventSkill, multiMiscSkill, multiSharedSkill} {
-		if _, err := os.Stat(filepath.Join(codexSkills, name)); !os.IsNotExist(err) {
-			t.Fatalf("universal .codex/skills still has physical %s (stat err=%v)", name, err)
-		}
-	}
-	// canonical owns the new standalone event + clean misc (+ shared).
-	for _, name := range []string{multiEventSkill, multiMiscSkill, multiSharedSkill} {
-		if _, err := os.Stat(filepath.Join(canonical, name, "SKILL.md")); err != nil {
-			t.Fatalf("canonical missing %s: %v", name, err)
-		}
-	}
-	if err := validateCleanEventMiscRoot(filepath.Join(canonical, multiMiscSkill)); err != nil {
-		t.Fatalf("canonical misc still contains folded Event content: %v", err)
-	}
-	if _, _, err := executeMultiSkillSetupTest(t, src, []string{canonical, codexSkills}, "--skill", "event", "--yes"); err != nil {
-		t.Fatalf("idempotent rerun failed: %v", err)
-	}
-}
-
-func TestCrossPlatformCoverageSkillSetupUnrelatedSelectionPreservesUniversalFoldedPair(t *testing.T) {
-	home := t.TempDir()
-	testseam.Swap(t, &skillSetupUserHomeDir, func() (string, error) { return home, nil })
-	canonical := filepath.Join(home, ".agents", "skills")
-	codexSkills := filepath.Join(home, ".codex", "skills")
-	writeFoldedEventMisc(t, codexSkills)
-	writeOldStandaloneEvent(t, codexSkills)
-	chat := filepath.Join(codexSkills, "dingtalk-chat")
-	if err := os.MkdirAll(chat, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(chat, "SKILL.md"), []byte("keep chat\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	src := writeMultiSkillSource(t, []string{multiEventSkill, multiSharedSkill, multiMiscSkill, "dingtalk-doc"})
-	stdout, stderr, err := executeMultiSkillSetupTest(t, src, []string{canonical, codexSkills}, "--skill", "doc", "--yes")
-	if err != nil {
-		t.Fatalf("selective doc install failed: %v\nstdout=%s\nstderr=%s", err, stdout, stderr)
-	}
-	if strings.Contains(stdout, "Event 原子迁移") {
-		t.Fatalf("unrelated selection migrated Event/misc: %s", stdout)
-	}
-	assertOldEventMiscPair(t, codexSkills)
-	if body, err := os.ReadFile(filepath.Join(chat, "SKILL.md")); err != nil || string(body) != "keep chat\n" {
-		t.Fatalf("unselected chat changed: body=%q err=%v", body, err)
-	}
-}
-
-func TestCrossPlatformCoverageSkillSetupUniversalRetirementFailures(t *testing.T) {
-	failure := errors.New("retirement denied")
-
-	t.Run("home", func(t *testing.T) {
-		testseam.Swap(t, &skillSetupUserHomeDir, func() (string, error) { return "", failure })
-		codex := filepath.Join(t.TempDir(), ".codex", "skills")
-		if err := retireMigratedUniversalSkills([]string{codex}, []string{multiEventSkill}, io.Discard); !errors.Is(err, failure) {
-			t.Fatalf("home failure = %v, want %v", err, failure)
-		}
-	})
-
-	t.Run("deduplicate", func(t *testing.T) {
-		home := t.TempDir()
-		testseam.Swap(t, &skillSetupUserHomeDir, func() (string, error) { return home, nil })
-		codex := filepath.Join(home, ".codex", "skills")
-		if err := retireMigratedUniversalSkills(
-			[]string{codex, codex},
-			[]string{multiEventSkill, multiEventSkill},
-			io.Discard,
-		); err != nil {
-			t.Fatalf("deduplicated retirement failed: %v", err)
-		}
-	})
-
-	// Retiring an obsolete universal copy installs nothing, so its failure is
-	// surfaced as a warning and the successful installation is kept.
-	t.Run("backup failure warns without failing the command", func(t *testing.T) {
-		home := t.TempDir()
-		testseam.Swap(t, &skillSetupUserHomeDir, func() (string, error) { return home, nil })
-		codex := filepath.Join(home, ".codex", "skills")
-		writeFoldedEventMisc(t, codex)
-		src := writeMultiSkillSource(t, []string{multiEventSkill, multiSharedSkill, multiMiscSkill})
-		testseam.Swap(t, &skillSetupBackupAndRemove, func(string, string) (string, error) {
-			return "", failure
-		})
-		_, stderr, err := executeMultiSkillSetupTest(
-			t,
-			src,
-			[]string{filepath.Join(home, ".agents", "skills"), codex},
-			"--skill", "event", "--yes",
-		)
-		if err != nil {
-			t.Fatalf("retirement backup failure must not fail the command: %v", err)
-		}
-		if !strings.Contains(stderr, "退役 universal Agent") {
-			t.Fatalf("retirement backup failure must be reported, stderr = %q", stderr)
-		}
-	})
-}
@@ -523,45 +523,15 @@ func TestCrossPlatformCoverageSkillSetupEventMigrationFailureBranches(t *testing
 		}
 	})

-	t.Run("ordinary install error", func(t *testing.T) {
-		src := writeMultiSkillSource(t, []string{multiEventSkill, multiMiscSkill})
-		copyCalls := 0
-		testseam.Swap(t, &skillSetupCopyDir, func(string, string) error { copyCalls++; return fail })
+	t.Run("ordinary and prerequisite install errors", func(t *testing.T) {
+		testseam.Swap(t, &skillSetupInstallMulti, func(string, []string, []string, io.Writer, io.Writer, bool) (int, int, error) {
+			return 0, 0, fail
+		})
 		migration := filepath.Join(t.TempDir(), "migration")
 		ordinary := filepath.Join(t.TempDir(), "ordinary")
-		if _, _, err := installMultiSkillsWithEventMigration(src, []string{multiEventSkill}, []string{migration, ordinary}, []string{migration}, true, io.Discard, io.Discard); err == nil || !strings.Contains(err.Error(), "未执行迁移") {
+		if _, _, err := installMultiSkillsWithEventMigration("src", []string{multiEventSkill}, []string{migration, ordinary}, []string{migration}, true, io.Discard, io.Discard); !errors.Is(err, fail) {
 			t.Fatalf("ordinary install failure = %v", err)
 		}
-		if copyCalls == 0 {
-			t.Fatal("ordinary staging failure seam was not exercised")
-		}
-	})
-
-	t.Run("canonical ordinary install error", func(t *testing.T) {
-		testseam.Swap(t, &skillSetupInstallMulti, func(string, []string, []string, io.Writer, io.Writer, bool) (int, int, error) {
-			return 0, 0, fail
-		})
-		home := t.TempDir()
-		canonical := filepath.Join(home, ".agents", "skills")
-		universalMigration := filepath.Join(home, ".codex", "skills")
-		if _, _, err := installMultiSkillsWithEventMigration(
-			"src",
-			[]string{multiEventSkill},
-			[]string{canonical, universalMigration},
-			[]string{universalMigration},
-			true,
-			io.Discard,
-			io.Discard,
-		); !errors.Is(err, fail) {
-			t.Fatalf("canonical ordinary install failure = %v, want %v", err, fail)
-		}
-	})
-
-	t.Run("prerequisite install error", func(t *testing.T) {
-		testseam.Swap(t, &skillSetupInstallMulti, func(string, []string, []string, io.Writer, io.Writer, bool) (int, int, error) {
-			return 0, 0, fail
-		})
-		migration := filepath.Join(t.TempDir(), "migration")
 		if _, _, err := installMultiSkillsWithEventMigration("src", []string{multiEventSkill, multiMiscSkill, multiSharedSkill}, []string{migration}, []string{migration}, true, io.Discard, io.Discard); !errors.Is(err, fail) {
 			t.Fatalf("prerequisite install failure = %v", err)
 		}
@@ -48,13 +48,16 @@ func TestCrossPlatformCoverageSkillSetupPlanPreviewDeclineAndExecutionMatch(t *t
 	backupCalls, copyCalls := []string{}, 0
 	testseam.Swap(t, &skillSetupBackupAndRemove, func(_ string, path string) (string, error) {
 		backupCalls = append(backupCalls, path)
-		if err := os.RemoveAll(path); err != nil {
-			return "", err
-		}
 		return "backup", nil
 	})
 	testseam.Swap(t, &skillSetupCopyDir, func(string, string) error { copyCalls++; return nil })
 	testseam.Swap(t, &skillSetupWriteFile, func(string, []byte, os.FileMode) error { return nil })
+	testseam.Swap(t, &skillSetupPublishRename, func(src, dest string) error {
+		if err := os.RemoveAll(dest); err != nil {
+			return err
+		}
+		return os.Rename(src, dest)
+	})
 	dryRunCmd := skillSetupCoverageCommand(t, skillSetupModeMulti, false)
 	var dryRunOut bytes.Buffer
 	dryRunCmd.SetOut(&dryRunOut)
@@ -116,9 +119,6 @@ func TestCrossPlatformCoverageSkillSetupPlanPreviewDeclineAndExecutionMatch(t *t

 	// A filtered multi plan replaces only selected same-name skills and leaves
 	// unselected siblings out of the backup set.
-	if err := os.MkdirAll(filepath.Join(dest, "dws"), 0o755); err != nil {
-		t.Fatal(err)
-	}
 	filtered, err := buildSkillSetupPlan(skillSetupModeMulti, source, []string{dest}, []string{"dingtalk-a"}, true)
 	if err != nil {
 		t.Fatal(err)
@@ -149,38 +149,55 @@ func TestCrossPlatformCoverageSkillSetupMonoPlanIncludesSameNameTarget(t *testin
 func TestCrossPlatformCoverageSkillSetupGenericCleanupDerivesHomeFromConcreteTarget(t *testing.T) {
 	home := t.TempDir()
 	dest := filepath.Join(home, ".codex", "skills")
-	canonical := filepath.Join(home, ".agents", "skills")
-	oldCodex := filepath.Join(dest, "dingtalk-chat")
-	if err := os.MkdirAll(oldCodex, 0o755); err != nil {
+	genericMono := filepath.Join(home, ".agents", "skills", "dws")
+	if err := os.MkdirAll(genericMono, 0o755); err != nil {
 		t.Fatal(err)
 	}
 	testseam.Swap(t, &skillSetupUserHomeDir, func() (string, error) {
 		return "", errors.New("transient HOME failure")
 	})

-	plan, err := buildSkillSetupPlan(skillSetupModeMulti, "source", []string{canonical, dest}, []string{"dingtalk-chat"}, true)
+	plan, err := buildSkillSetupPlan(skillSetupModeMulti, "source", []string{dest}, []string{"dingtalk-chat"}, true)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if len(plan.Targets) != 2 || !plan.Targets[1].CleanupOnly || plan.Targets[1].Destination != dest {
-		t.Fatalf("universal cleanup target = %#v", plan.Targets)
+	if len(plan.Targets) != 2 || !plan.Targets[1].CleanupOnly || plan.Targets[1].Destination != filepath.Dir(genericMono) {
+		t.Fatalf("generic cleanup target = %#v", plan.Targets)
 	}
-	if len(plan.Targets[1].Backups) != 1 || plan.Targets[1].Backups[0].Path != oldCodex {
-		t.Fatalf("universal cleanup backups = %#v", plan.Targets[1].Backups)
+	if len(plan.Targets[1].Backups) != 1 || plan.Targets[1].Backups[0].Path != genericMono {
+		t.Fatalf("generic cleanup backups = %#v", plan.Targets[1].Backups)
 	}
 	var preview bytes.Buffer
 	renderSkillSetupPlan(&preview, plan)
-	if !strings.Contains(preview.String(), "改用统一安装位置") {
-		t.Fatalf("universal cleanup preview missing: %s", preview.String())
+	if !strings.Contains(preview.String(), "仅迁移旧的通用 DWS 副本") {
+		t.Fatalf("generic cleanup preview missing: %s", preview.String())
 	}

+	t.Run("managed multi and scan failure", func(t *testing.T) {
+		managedDir := filepath.Join(home, ".agents", "skills", "dingtalk-chat")
+		if err := os.MkdirAll(managedDir, 0o755); err != nil {
+			t.Fatal(err)
+		}
+		target, targetErr := genericSkillCleanupTarget([]string{dest}, map[string]bool{"dingtalk-chat": true})
+		if targetErr != nil || target == nil || len(target.Backups) != 2 {
+			t.Fatalf("managed generic cleanup = %#v, %v", target, targetErr)
+		}
+		failure := errors.New("generic scan failure")
+		testseam.Swap(t, &skillSetupReadDir, func(string) ([]os.DirEntry, error) { return nil, failure })
+		if _, targetErr := genericSkillCleanupTarget([]string{dest}, nil); !errors.Is(targetErr, failure) {
+			t.Fatalf("generic scan error = %v", targetErr)
+		}
+		if _, planErr := buildSkillSetupPlan(skillSetupModeMulti, "source", []string{dest}, []string{"dingtalk-chat"}, true); !errors.Is(planErr, failure) {
+			t.Fatalf("generic cleanup plan error = %v", planErr)
+		}
+	})
 }

 func TestCrossPlatformCoverageSkillSetupCleanupOnlyExecutionBranches(t *testing.T) {
 	failure := errors.New("cleanup failure")
 	cleanup := skillSetupTargetPlan{Destination: "generic", CleanupOnly: true, Backups: []skillSetupBackup{{Path: "old"}}}

-	t.Run("cleanup runs even after an install skip", func(t *testing.T) {
+	t.Run("prior skip suppresses cleanup", func(t *testing.T) {
 		testseam.Swap(t, &skillSetupUserHomeDir, func() (string, error) { return t.TempDir(), nil })
 		plan := &skillSetupPlan{Mode: skillSetupModeMono, Source: "missing", Targets: []skillSetupTargetPlan{{Destination: "install"}, cleanup}}
 		installed, skipped, err := executeSkillSetupPlan(plan, io.Discard, io.Discard)
@@ -189,14 +206,11 @@ func TestCrossPlatformCoverageSkillSetupCleanupOnlyExecutionBranches(t *testing.
 		}
 	})

-	// A cleanup-only target installs nothing, so its failure is a warning and
-	// must never increment skipped — runSkillSetup turns any skipped count into
-	// a hard error and would fail an otherwise complete installation.
 	t.Run("home failure keeps generic copy", func(t *testing.T) {
 		testseam.Swap(t, &skillSetupUserHomeDir, func() (string, error) { return "", failure })
 		var stderr bytes.Buffer
 		_, skipped, err := executeSkillSetupPlan(&skillSetupPlan{Mode: skillSetupModeMono, Targets: []skillSetupTargetPlan{cleanup}}, io.Discard, &stderr)
-		if err != nil || skipped != 0 || !strings.Contains(stderr.String(), "保留 universal Agent 旧副本") {
+		if err != nil || skipped != 1 || !strings.Contains(stderr.String(), "保留通用 Skill 副本") {
 			t.Fatalf("cleanup HOME failure = (%d, %v, %q)", skipped, err, stderr.String())
 		}
 	})
@@ -206,7 +220,7 @@ func TestCrossPlatformCoverageSkillSetupCleanupOnlyExecutionBranches(t *testing.
 		testseam.Swap(t, &skillSetupBackupAndRemove, func(string, string) (string, error) { return "", failure })
 		var stderr bytes.Buffer
 		_, skipped, err := executeSkillSetupPlan(&skillSetupPlan{Mode: skillSetupModeMono, Targets: []skillSetupTargetPlan{cleanup}}, io.Discard, &stderr)
-		if err != nil || skipped != 0 || !strings.Contains(stderr.String(), "迁移失败") {
+		if err != nil || skipped != 1 || !strings.Contains(stderr.String(), "迁移失败") {
 			t.Fatalf("cleanup backup failure = (%d, %v, %q)", skipped, err, stderr.String())
 		}
 	})
@@ -233,13 +247,11 @@ func TestCrossPlatformCoverageSkillSetupPlanDeduplicatesAndFailsClosed(t *testin
 		t.Fatal(err)
 	}
 	testseam.Swap(t, &skillSetupStat, func(string) (os.FileInfo, error) { return nil, failure })
-	testseam.Swap(t, &skillSetupLstat, func(string) (os.FileInfo, error) { return nil, failure })
 	if _, err := buildSkillSetupPlan(skillSetupModeMono, "source", []string{monoDest}, nil, false); err == nil || !strings.Contains(err.Error(), "\u68c0\u67e5\u5c06\u88ab\u66ff\u6362") {
 		t.Fatalf("replacement stat error = %v", err)
 	}

 	testseam.Swap(t, &skillSetupStat, func(string) (os.FileInfo, error) { return nil, os.ErrNotExist })
-	testseam.Swap(t, &skillSetupLstat, func(string) (os.FileInfo, error) { return nil, os.ErrNotExist })
 	testseam.Swap(t, &skillSetupReadDir, func(string) ([]os.DirEntry, error) { return nil, failure })
 	if _, err := buildSkillSetupPlan(skillSetupModeMulti, "source", []string{dest}, []string{"dingtalk-a"}, false); err == nil || !strings.Contains(err.Error(), "\u626b\u63cf\u8fc7\u671f") {
 		t.Fatalf("stale scan error = %v", err)
@@ -1,85 +0,0 @@
-package app
-
-import (
-	"errors"
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/testseam"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/upgrade"
-)
-
-func TestCrossPlatformCoverageSkillSetupRollbackRetainsConcurrentReplacement(t *testing.T) {
-	home := t.TempDir()
-	base := filepath.Join(home, ".agents", "skills")
-	first := filepath.Join(base, "dingtalk-first")
-	second := filepath.Join(base, "dingtalk-second")
-	writeSkillSetupFile(t, first, "old first")
-	writeSkillSetupFile(t, second, "old second")
-	backups, err := backupSkillSetupTarget(home, []skillSetupBackup{{Path: first}, {Path: second}}, io.Discard)
-	if err != nil {
-		t.Fatal(err)
-	}
-	stageRoot := filepath.Join(base, ".stage")
-	stagedFirst := filepath.Join(stageRoot, "dingtalk-first")
-	stagedSecond := filepath.Join(stageRoot, "dingtalk-second")
-	writeSkillSetupFile(t, stagedFirst, "new first")
-	writeSkillSetupFile(t, stagedSecond, "new second")
-
-	failure := errors.New("injected second setup publication failure")
-	originalPublish := skillSetupPublishPath
-	calls := 0
-	testseam.Swap(t, &skillSetupPublishPath, func(staged, destination string) (upgrade.SkillPathPublication, error) {
-		calls++
-		if calls == 2 {
-			if err := os.RemoveAll(first); err != nil {
-				t.Fatal(err)
-			}
-			writeSkillSetupFile(t, first, "concurrent")
-			return upgrade.SkillPathPublication{}, failure
-		}
-		return originalPublish(staged, destination)
-	})
-
-	err = publishSkillSetupTarget([]skillSetupStagedDir{
-		{staged: stagedFirst, dest: first},
-		{staged: stagedSecond, dest: second},
-	}, backups)
-	if !errors.Is(err, failure) || !strings.Contains(err.Error(), "拒绝删除非本事务") {
-		t.Fatalf("setup transaction error = %v", err)
-	}
-	assertSkillSetupFile(t, first, "concurrent")
-	assertSkillSetupFile(t, second, "old second")
-	var firstBackup string
-	for _, item := range backups {
-		if item.original == first {
-			firstBackup = item.backup
-			break
-		}
-	}
-	if firstBackup == "" {
-		t.Fatal("first backup was not recorded")
-	}
-	assertSkillSetupFile(t, firstBackup, "old first")
-}
-
-func writeSkillSetupFile(t *testing.T, dir, content string) {
-	t.Helper()
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(dir, "SKILL.md"), []byte(content), 0o644); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func assertSkillSetupFile(t *testing.T, dir, want string) {
-	t.Helper()
-	content, err := os.ReadFile(filepath.Join(dir, "SKILL.md"))
-	if err != nil || string(content) != want {
-		t.Fatalf("Skill content at %s = %q, %v; want %q", dir, content, err, want)
-	}
-}
@@ -297,12 +297,12 @@ func TestResolveSkillSetupTargetsSingleAgent(t *testing.T) {
 	if err != nil {
 		t.Fatalf("unexpected err: %v", err)
 	}
-	if len(got) != 2 {
-		t.Fatalf("expected canonical + Claude, got %d", len(got))
+	if len(got) != 1 {
+		t.Fatalf("expected 1 dest, got %d", len(got))
 	}
 	want := filepath.Join(home, ".claude", "skills", "dws")
-	if filepath.Clean(got[1]) != filepath.Clean(want) {
-		t.Fatalf("expected %s, got %s", want, got[1])
+	if filepath.Clean(got[0]) != filepath.Clean(want) {
+		t.Fatalf("expected %s, got %s", want, got[0])
 	}
 }

@@ -321,12 +321,12 @@ func TestResolveSkillSetupTargetsMultiOmitsDwsTail(t *testing.T) {
 	if err != nil {
 		t.Fatalf("unexpected err: %v", err)
 	}
-	if len(got) != 2 {
-		t.Fatalf("expected canonical + Claude, got %d", len(got))
+	if len(got) != 1 {
+		t.Fatalf("expected 1 dest, got %d", len(got))
 	}
 	want := filepath.Join(home, ".claude", "skills")
-	if filepath.Clean(got[1]) != filepath.Clean(want) {
-		t.Fatalf("expected %s, got %s", want, got[1])
+	if filepath.Clean(got[0]) != filepath.Clean(want) {
+		t.Fatalf("expected %s, got %s", want, got[0])
 	}
 }

@@ -343,8 +343,8 @@ func TestCrossPlatformCoverageResolveSkillSetupTargetsPrefersSpecificAgentRoot(t
 		t.Fatal(err)
 	}
 	want := filepath.Join(home, ".codex", "skills")
-	if len(got) != 2 || filepath.Clean(got[1]) != filepath.Clean(want) {
-		t.Fatalf("targets = %v, want canonical + %s", got, want)
+	if len(got) != 1 || filepath.Clean(got[0]) != filepath.Clean(want) {
+		t.Fatalf("targets = %v, want [%s]", got, want)
 	}
 }

@@ -360,8 +360,8 @@ func TestCrossPlatformCoverageResolveSkillSetupTargetsDetectsZCode(t *testing.T)
 		t.Fatal(err)
 	}
 	want := filepath.Join(home, ".zcode", "skills")
-	if len(got) != 2 || filepath.Clean(got[1]) != filepath.Clean(want) {
-		t.Fatalf("targets = %v, want canonical + %s", got, want)
+	if len(got) != 1 || filepath.Clean(got[0]) != filepath.Clean(want) {
+		t.Fatalf("targets = %v, want [%s]", got, want)
 	}

 	explicit, err := resolveSkillSetupTargets("zcode", skillSetupModeMono)
@@ -369,8 +369,8 @@ func TestCrossPlatformCoverageResolveSkillSetupTargetsDetectsZCode(t *testing.T)
 		t.Fatal(err)
 	}
 	wantMono := filepath.Join(want, "dws")
-	if len(explicit) != 2 || filepath.Clean(explicit[1]) != filepath.Clean(wantMono) {
-		t.Fatalf("explicit zcode targets = %v, want canonical + %s", explicit, wantMono)
+	if len(explicit) != 1 || filepath.Clean(explicit[0]) != filepath.Clean(wantMono) {
+		t.Fatalf("explicit zcode targets = %v, want [%s]", explicit, wantMono)
 	}
 }

@@ -1055,11 +1055,12 @@ func TestCrossPlatformCoverageSkillSetupSelectiveEventMigratesOnlyFoldedTargets(
 	if err := os.WriteFile(filepath.Join(foldedHome, "dingtalk-chat", "SKILL.md"), []byte("keep sibling\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
+
 	stdout, stderr, err := executeMultiSkillSetupTest(t, src, []string{freshHome, foldedHome}, "--skill", "event", "--yes")
 	if err != nil {
 		t.Fatalf("selective event setup failed: %v\nstderr=%s\nstdout=%s", err, stderr, stdout)
 	}
-	if !strings.Contains(stdout, "请重启已打开的 Agent") {
+	if !strings.Contains(stdout, "重新加载 Skills") {
 		t.Fatalf("completion should tell the user to reload skills: %s", stdout)
 	}

@@ -620,9 +620,6 @@ func runUpgrade(ctx context.Context, opts upgradeOptions) error {
 		for _, d := range succeeded {
 			fmt.Printf("         %s %s\n", ugDim("→"), ugCyan(shortenHome(d.Dir)))
 		}
-		for _, d := range result.RetireWarnings() {
-			fmt.Printf("       %s %s %s\n", ugYellow("⚠"), shortenHome(d.Dir), ugDim("旧副本未能迁移，可手动删除: "+d.Err.Error()))
-		}
 	} else {
 		fmt.Printf(" %s\n", ugGreen("✓"))
 	}
@@ -292,12 +292,6 @@ func TestCrossPlatformCoverageRunUpgradeAllStagesCoverage(t *testing.T) {
 			if stage == "install-failed-dir" {
 				return &upgradepkg.SkillUpgradeResult{Results: []upgradepkg.SkillDirResult{{Dir: "/failed", Status: upgradepkg.SkillDirFailed, Err: fail}}}, nil
 			}
-			if stage == "install-retire-warning" {
-				return &upgradepkg.SkillUpgradeResult{Results: []upgradepkg.SkillDirResult{
-					{Dir: "/ok", Status: upgradepkg.SkillDirOK},
-					{Dir: "/stale", Status: upgradepkg.SkillDirRetireWarning, Err: errors.New("retirement refused")},
-				}}, nil
-			}
 			return &upgradepkg.SkillUpgradeResult{Results: []upgradepkg.SkillDirResult{{Dir: "/ok", Status: upgradepkg.SkillDirOK}}}, nil
 		}
 	}
@@ -306,7 +300,7 @@ func TestCrossPlatformCoverageRunUpgradeAllStagesCoverage(t *testing.T) {
 		"ensure", "tag-error", "latest-error", "not-needed", "cancel", "find-binary", "temp-fallback", "temp-both",
 		"backup", "checksum-download", "checksum-read", "binary-download", "skills-download", "verify-binary", "verify-skills",
 		"extract-binary", "extract-tar", "binary-missing", "validate", "extract-skills", "skill-missing", "replace", "install", "install-failed-dir",
-		"success", "success-no-skills", "install-retire-warning",
+		"success", "success-no-skills",
 	} {
 		t.Run(stage, func(t *testing.T) {
 			configure(stage)
@@ -336,14 +330,14 @@ func TestCrossPlatformCoverageRunUpgradeAllStagesCoverage(t *testing.T) {
 				opts.skipSkills = true
 			}
 			err := runUpgrade(context.Background(), opts)
-			wantError := stage != "not-needed" && stage != "cancel" && stage != "backup" && stage != "checksum-download" && stage != "checksum-read" && stage != "success" && stage != "success-no-skills" && stage != "install-retire-warning"
+			wantError := stage != "not-needed" && stage != "cancel" && stage != "backup" && stage != "checksum-download" && stage != "checksum-read" && stage != "success" && stage != "success-no-skills"
 			if wantError && err == nil {
 				t.Fatalf("stage %s succeeded", stage)
 			}
 			if !wantError && err != nil {
 				t.Fatalf("stage %s failed: %v", stage, err)
 			}
-			if (stage == "success" || stage == "success-no-skills" || stage == "install-retire-warning") && !rb.cleaned {
+			if (stage == "success" || stage == "success-no-skills") && !rb.cleaned {
 				t.Fatal("successful upgrade did not clean backups")
 			}
 			if stage == "success" {
@@ -1,42 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0
-
-package app
-
-import (
-	"testing"
-
-	"github.com/spf13/cobra"
-)
-
-func assertWhiteboardPublicShortcutsStayAvailableInSchema(t *testing.T, root *cobra.Command, tools map[string]map[string]any) {
-	t.Helper()
-	for canonical, command := range map[string]string{
-		"whiteboard.shortcut_query":  "+query",
-		"whiteboard.shortcut_update": "+update",
-	} {
-		leaf, _, err := root.Find([]string{"whiteboard", command})
-		if err != nil || leaf == nil || leaf.Name() != command {
-			t.Errorf("find whiteboard %s: leaf=%v err=%v", command, leaf, err)
-		} else if leaf.Hidden || !leaf.Runnable() {
-			t.Errorf("whiteboard %s hidden/runnable=%v/%v, want false/true", command, leaf.Hidden, leaf.Runnable())
-		}
-		tool := tools[canonical]
-		if tool == nil {
-			t.Errorf("public %s missing from delivery Schema surface", canonical)
-			continue
-		}
-		if got := schemaContractString(tool["availability"]); got != "available" {
-			t.Errorf("%s availability=%q, want available", canonical, got)
-		}
-		if got := schemaContractString(tool["interface_mode"]); got != "composite" {
-			t.Errorf("%s interface_mode=%q, want composite", canonical, got)
-		}
-		if got := schemaContractString(tool["interface_reason"]); got == "" {
-			t.Errorf("%s missing composite adapter reason", canonical)
-		}
-		if tool["interface_ref"] != nil {
-			t.Errorf("%s composite interface_ref=%#v, want nil", canonical, tool["interface_ref"])
-		}
-	}
-}
@@ -192,7 +192,6 @@ func (p *OAuthProvider) refreshWithRefreshToken(ctx context.Context, data *Token
 	updated.CorpID = data.CorpID
 	updated.UserID = data.UserID
 	updated.UserName = data.UserName
-	updated.RepairOrganizationMirror = data.RepairOrganizationMirror
 	if updated.CorpName == "" {
 		updated.CorpName = data.CorpName
 	}
@@ -240,7 +239,6 @@ func (p *OAuthProvider) refreshViaMCP(ctx context.Context, data *TokenData) (*To
 	updated.CorpID = data.CorpID
 	updated.UserID = data.UserID
 	updated.UserName = data.UserName
-	updated.RepairOrganizationMirror = data.RepairOrganizationMirror
 	if updated.CorpName == "" {
 		updated.CorpName = data.CorpName
 	}
@@ -811,207 +811,7 @@ func (p *OAuthProvider) lockedRefresh(ctx context.Context) (*TokenData, error) {
 	if p.logger != nil {
 		p.logger.Debug("refreshing token (dual-locked)")
 	}
-	refreshed, rErr := oauthRefreshToken(p, ctx, data)
-	if rErr == nil || !isRefreshTokenRejected(rErr) {
-		return refreshed, rErr
-	}
-	// A stale identity slot can survive an older organization-only refresh.
-	// Retry once with the same-corp organization mirror while holding the
-	// existing dual lock; the fallback marks the publication so the rotated
-	// credential is written back into the mirror slot it consumed.
-	logging.AuthDebug(
-		"auth.refresh.fallback.triggered",
-		"corp_id", strings.TrimSpace(data.CorpID),
-		"user_id", strings.TrimSpace(data.UserID),
-		"error", rErr,
-	)
-	fallback, fErr := p.refreshFromOrgSlot(ctx, data)
-	if fErr != nil {
-		logging.AuthDebug("auth.refresh.fallback.unavailable", "error", fErr)
-		// The organization mirror may be absent for long-lived local logins
-		// that predate mirror publication. Recover from the legacy global
-		// slot before giving up.
-		if recovered, recoverErr := p.recoverRefreshFromLegacyGlobalSlot(ctx, data, rErr); recoverErr == nil {
-			return recovered, nil
-		}
-		return nil, rErr
-	}
-	if p.logger != nil {
-		p.logger.Warn(i18n.T("当前身份的 refresh_token 已失效，已从组织镜像 token 恢复登录态"))
-	}
-	return fallback, nil
-}
-
-// refreshFromOrgSlot retries a rejected refresh with the token mirrored in
-// the organization slot. The mirror must match the current corp, be valid,
-// and differ from the rejected token. When both slots carry user identities,
-// they must agree; legacy mirrors with an empty UserID are backfilled from the
-// current identity before refresh.
-func (p *OAuthProvider) refreshFromOrgSlot(ctx context.Context, current *TokenData) (*TokenData, error) {
-	if current == nil {
-		return nil, fmt.Errorf("no current token data")
-	}
-	corpID := strings.TrimSpace(current.CorpID)
-	if corpID == "" {
-		return nil, fmt.Errorf("current token has no corpId")
-	}
-	orgData, err := tokenLoadKeychainForCorpID(corpID)
-	if err != nil {
-		return nil, err
-	}
-	if orgData == nil {
-		return nil, ErrTokenDataNotFound
-	}
-	if strings.TrimSpace(orgData.CorpID) != corpID {
-		return nil, fmt.Errorf("organization token mirror for corpId %q contains token for corpId %q; refusing refresh fallback", corpID, orgData.CorpID)
-	}
-	if !orgData.IsRefreshTokenValid() {
-		return nil, fmt.Errorf("organization mirror refresh_token 已过期")
-	}
-	if orgData.RefreshToken == current.RefreshToken {
-		return nil, fmt.Errorf("organization mirror holds the same rejected refresh_token")
-	}
-	currentUserID := strings.TrimSpace(current.UserID)
-	orgUserID := strings.TrimSpace(orgData.UserID)
-	if currentUserID != "" && orgUserID != "" && orgUserID != currentUserID {
-		return nil, fmt.Errorf("organization token mirror for corpId %q belongs to userId %q; refusing refresh fallback for userId %q", corpID, orgData.UserID, current.UserID)
-	}
-	if orgUserID == "" {
-		orgData.UserID = current.UserID
-		orgData.UserName = current.UserName
-	}
-	// The refresh below consumes the mirror's refresh_token. Mark the
-	// publication so persistence writes the rotated credential back into the
-	// organization slot even under an explicit runtime selector whose plan
-	// would otherwise skip it (for example a preserved unresolved sibling).
-	orgData.RepairOrganizationMirror = true
-	refreshed, err := oauthRefreshToken(p, ctx, orgData)
-	if err != nil {
-		return nil, err
-	}
-	logging.AuthDebug(
-		"auth.refresh.fallback.success",
-		"corp_id", corpID,
-		"new_at_expires_at", refreshed.ExpiresAt.Format(time.RFC3339),
-	)
-	return refreshed, nil
-}
-
-func (p *OAuthProvider) recoverRefreshFromLegacyGlobalSlot(ctx context.Context, selected *TokenData, refreshErr error) (*TokenData, error) {
-	var exchangeErr *MCPTokenExchangeError
-	if !errors.As(refreshErr, &exchangeErr) || !exchangeErr.requiresReauthorization() {
-		return nil, refreshErr
-	}
-	if selected == nil {
-		return nil, refreshErr
-	}
-	logging.AuthDebug("auth.refresh.legacy_recovery.triggered",
-		"corp_id", strings.TrimSpace(selected.CorpID),
-		"user_id", strings.TrimSpace(selected.UserID),
-		"refresh_error_code", exchangeErr.Code,
-	)
-	legacy, loadErr := tokenLoadKeychain()
-	if loadErr != nil {
-		logging.AuthDebug("auth.refresh.legacy_recovery.failed", "step", "load_legacy", "error", loadErr)
-		return nil, refreshErr
-	}
-	if legacy == nil {
-		logging.AuthDebug("auth.refresh.legacy_recovery.failed", "step", "load_legacy", "reason", "empty_legacy")
-		return nil, refreshErr
-	}
-	if !legacyGlobalRefreshCandidateMatches(p.configDir, selected, legacy) {
-		logging.AuthDebug("auth.refresh.legacy_recovery.failed",
-			"step", "candidate_mismatch",
-			"legacy_corp_id", strings.TrimSpace(legacy.CorpID),
-			"legacy_user_id", strings.TrimSpace(legacy.UserID),
-		)
-		return nil, refreshErr
-	}
-	recovered := *legacy
-	if strings.TrimSpace(recovered.UserID) == "" {
-		recovered.UserID = strings.TrimSpace(selected.UserID)
-	}
-	if strings.TrimSpace(recovered.UserName) == "" {
-		recovered.UserName = strings.TrimSpace(selected.UserName)
-	}
-	if recovered.IsAccessTokenValid() {
-		if err := oauthSaveTokenLocked(p.configDir, &recovered); err != nil {
-			logging.AuthDebug("auth.refresh.legacy_recovery.failed", "step", "save", "error", err)
-			return nil, refreshErr
-		}
-		logging.AuthDebug("auth.refresh.legacy_recovery.success", "via", "valid_access_token")
-		return &recovered, nil
-	}
-	if !recovered.IsRefreshTokenValid() {
-		logging.AuthDebug("auth.refresh.legacy_recovery.failed", "step", "refresh_expired")
-		return nil, refreshErr
-	}
-	if strings.TrimSpace(recovered.RefreshToken) == strings.TrimSpace(selected.RefreshToken) {
-		logging.AuthDebug("auth.refresh.legacy_recovery.failed", "step", "same_refresh_token")
-		return nil, refreshErr
-	}
-	if err := preflightTokenRefreshPersistence(p.configDir, &recovered); err != nil {
-		logging.AuthDebug("auth.refresh.legacy_recovery.failed", "step", "preflight", "error", err)
-		return nil, refreshErr
-	}
-	refreshed, recoverErr := oauthRefreshToken(p, ctx, &recovered)
-	if recoverErr != nil {
-		logging.AuthDebug("auth.refresh.legacy_recovery.failed", "step", "refresh", "error", recoverErr)
-		return nil, refreshErr
-	}
-	logging.AuthDebug("auth.refresh.legacy_recovery.success", "via", "refresh")
-	return refreshed, nil
-}
-
-func legacyGlobalRefreshCandidateMatches(configDir string, selected, legacy *TokenData) bool {
-	if selected == nil || legacy == nil {
-		return false
-	}
-	selectedCorpID := strings.TrimSpace(selected.CorpID)
-	legacyCorpID := strings.TrimSpace(legacy.CorpID)
-	if selectedCorpID == "" || legacyCorpID != selectedCorpID {
-		return false
-	}
-	selectedUserID := strings.TrimSpace(selected.UserID)
-	legacyUserID := strings.TrimSpace(legacy.UserID)
-	if legacyUserID != "" {
-		return legacyUserID == selectedUserID
-	}
-	return legacyGlobalBlankUserIDMatchesSingleProfile(configDir, selectedCorpID, selectedUserID)
-}
-
-func legacyGlobalBlankUserIDMatchesSingleProfile(configDir, corpID, userID string) bool {
-	if strings.TrimSpace(corpID) == "" {
-		return false
-	}
-	cfg, err := tokenLoadProfiles(configDir)
-	if err != nil || cfg == nil {
-		logging.AuthDebug("auth.refresh.legacy_recovery.blank_user_rejected", "reason", "profiles_error", "error", err)
-		return false
-	}
-	profiles := profilesForCorpID(cfg, corpID)
-	if len(profiles) != 1 {
-		logging.AuthDebug("auth.refresh.legacy_recovery.blank_user_rejected",
-			"reason", "multi_profile",
-			"corp_id", strings.TrimSpace(corpID),
-			"profile_count", len(profiles),
-		)
-		return false
-	}
-	profile := profiles[0]
-	if profile != nil && sameProfileIdentity(profile.CorpID, profile.UserID, corpID, userID) {
-		return true
-	}
-	profileUserID := ""
-	if profile != nil {
-		profileUserID = strings.TrimSpace(profile.UserID)
-	}
-	logging.AuthDebug("auth.refresh.legacy_recovery.blank_user_rejected",
-		"reason", "identity_mismatch",
-		"selected_user_id", strings.TrimSpace(userID),
-		"profile_user_id", profileUserID,
-	)
-	return false
+	return oauthRefreshToken(p, ctx, data)
 }

 // ExchangeAuthCode takes an AuthCode and an optional UserID provided by an
@@ -1,427 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package auth
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/testseam"
-)
-
-func TestCrossPlatformCoverageIsRefreshTokenRejected(t *testing.T) {
-	tests := []struct {
-		name string
-		err  error
-		want bool
-	}{
-		{"nil", nil, false},
-		{"mcp authCode.notFound", &MCPTokenExchangeError{Code: legacyMCPRefreshRejectedCode, Message: "authCode not found"}, true},
-		{"mcp other business code", &MCPTokenExchangeError{Code: "other.error", Message: "boom"}, false},
-		{"wrapped mcp rejection", fmt.Errorf("refresh: %w", &MCPTokenExchangeError{Code: legacyMCPRefreshRejectedCode}), true},
-		{"http 400 has no reviewed business code", &HTTPStatusError{StatusCode: http.StatusBadRequest}, false},
-		{"http 401 has no reviewed business code", &HTTPStatusError{StatusCode: http.StatusUnauthorized}, false},
-		{"http 403 has no reviewed business code", &HTTPStatusError{StatusCode: http.StatusForbidden}, false},
-		{"http 500 is transient", &HTTPStatusError{StatusCode: http.StatusInternalServerError}, false},
-		{"http 429 is transient", &HTTPStatusError{StatusCode: http.StatusTooManyRequests}, false},
-		{"plain error is unknown", errors.New("boom"), false},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := isRefreshTokenRejected(tt.err); got != tt.want {
-				t.Fatalf("isRefreshTokenRejected(%v) = %v, want %v", tt.err, got, tt.want)
-			}
-		})
-	}
-}
-
-// orgSlotFallbackFixture wires the injectable seams lockedRefresh depends on
-// and records refresh attempts plus organization slot lookups.
-type orgSlotFallbackFixture struct {
-	provider       *OAuthProvider
-	stale          *TokenData
-	orgMirror      *TokenData
-	renewed        *TokenData
-	rejected       *MCPTokenExchangeError
-	refreshErr     error
-	orgRefreshErr  error
-	refreshCalls   []string
-	refreshUserIDs []string
-	orgLoads       int
-}
-
-func newOrgSlotFallbackFixture(t *testing.T) *orgSlotFallbackFixture {
-	t.Helper()
-	isolateOAuthPersistence(t)
-
-	f := &orgSlotFallbackFixture{
-		provider: &OAuthProvider{configDir: t.TempDir(), logger: slog.New(slog.NewTextHandler(io.Discard, nil)), Output: io.Discard},
-		stale: &TokenData{
-			AccessToken:  "old-access",
-			RefreshToken: "stale-refresh",
-			ExpiresAt:    time.Now().Add(-time.Hour),
-			RefreshExpAt: time.Now().Add(time.Hour),
-			CorpID:       "corp-1",
-			UserID:       "user-1",
-		},
-		orgMirror: &TokenData{
-			AccessToken:  "org-access",
-			RefreshToken: "org-refresh",
-			ExpiresAt:    time.Now().Add(-time.Minute),
-			RefreshExpAt: time.Now().Add(time.Hour),
-			CorpID:       "corp-1",
-			UserID:       "user-1",
-		},
-		renewed: &TokenData{
-			AccessToken:  "new-access",
-			RefreshToken: "new-refresh",
-			ExpiresAt:    time.Now().Add(time.Hour),
-			RefreshExpAt: time.Now().Add(24 * time.Hour),
-			CorpID:       "corp-1",
-			UserID:       "user-1",
-		},
-		rejected: &MCPTokenExchangeError{Code: legacyMCPRefreshRejectedCode, Message: "authCode not found"},
-	}
-	f.refreshErr = f.rejected
-
-	testseam.Swap(t, &oauthAcquireLock, func(context.Context, string) (*DualLock, error) { return &DualLock{}, nil })
-	testseam.Swap(t, &oauthLoadTokenLocked, func(configDir, _ string) (*TokenData, error) { return oauthLoadToken(configDir) })
-	testseam.Swap(t, &oauthLoadToken, func(string) (*TokenData, error) { return f.stale, nil })
-	testseam.Swap(t, &oauthRefreshToken, func(_ *OAuthProvider, _ context.Context, data *TokenData) (*TokenData, error) {
-		f.refreshCalls = append(f.refreshCalls, data.RefreshToken)
-		f.refreshUserIDs = append(f.refreshUserIDs, data.UserID)
-		switch data.RefreshToken {
-		case "stale-refresh":
-			return nil, f.refreshErr
-		case "org-refresh":
-			return f.renewed, f.orgRefreshErr
-		}
-		return nil, fmt.Errorf("unexpected refresh token %q", data.RefreshToken)
-	})
-	testseam.Swap(t, &tokenLoadKeychainForCorpID, func(corpID string) (*TokenData, error) {
-		f.orgLoads++
-		if corpID != "corp-1" {
-			return nil, ErrTokenDataNotFound
-		}
-		return f.orgMirror, nil
-	})
-	return f
-}
-
-func TestCrossPlatformCoverageLockedRefreshFallsBackToOrgSlot(t *testing.T) {
-	f := newOrgSlotFallbackFixture(t)
-
-	got, err := f.provider.lockedRefresh(context.Background())
-	if err != nil || got != f.renewed {
-		t.Fatalf("lockedRefresh() = %#v, %v; want renewed token, nil", got, err)
-	}
-	if len(f.refreshCalls) != 2 || f.refreshCalls[0] != "stale-refresh" || f.refreshCalls[1] != "org-refresh" {
-		t.Fatalf("refresh attempts = %v, want [stale-refresh org-refresh]", f.refreshCalls)
-	}
-	if f.orgLoads != 1 {
-		t.Fatalf("organization slot loads = %d, want 1", f.orgLoads)
-	}
-}
-
-func TestCrossPlatformCoverageRepairMarkerForcesOrganizationSlotWrite(t *testing.T) {
-	cfg := &ProfilesConfig{
-		Version: profilesVersion,
-		Profiles: []Profile{
-			{Name: "legacy", CorpID: "corp-1", UserID: ""},
-			{Name: "user-1", CorpID: "corp-1", UserID: "user-1"},
-		},
-	}
-	selector := profileSelector("corp-1", "user-1")
-
-	without := &TokenData{CorpID: "corp-1", UserID: "user-1"}
-	if plan := planTokenPersistenceWrites(cfg, without, selector); plan.WriteOrganization {
-		t.Fatalf("explicit selector preserved unresolved org slot: WriteOrganization = true, want false")
-	}
-
-	with := &TokenData{CorpID: "corp-1", UserID: "user-1", RepairOrganizationMirror: true}
-	if plan := planTokenPersistenceWrites(cfg, with, selector); !plan.WriteOrganization {
-		t.Fatalf("repair marker did not force the organization slot write")
-	}
-}
-
-func TestCrossPlatformCoverageLockedRefreshFallbackRepairsPersistedSlots(t *testing.T) {
-	isolateOAuthPersistence(t)
-	t.Setenv("DWS_CLIENT_ID", "")
-	t.Setenv("DWS_CLIENT_SECRET", "")
-
-	// Fake MCP refresh endpoint: the first call rejects the stale identity
-	// refresh_token with the reviewed business code; the second call (the
-	// organization mirror) succeeds and returns a rotated credential.
-	var refreshCalls atomic.Int32
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if refreshCalls.Add(1) == 1 {
-			fmt.Fprint(w, `{"errorCode":"invalidParameter.authCode.notFound","errorMsg":"authCode not found"}`)
-			return
-		}
-		fmt.Fprint(w, `{"accessToken":"new-access","refreshToken":"new-refresh","expiresIn":7200,"corpId":"corp-1","userId":"user-1","userName":"User One"}`)
-	}))
-	defer srv.Close()
-
-	configDir := setupMCPConfigDir(t, srv.URL)
-	resetAppConfigCache()
-
-	// Seed the pre-fallback state: an identity slot whose refresh_token the
-	// server rejects, plus a legacy organization mirror (no userId) with a
-	// still-valid refresh_token and a preserved unresolved sibling profile so
-	// an explicit --profile refresh would normally skip the org slot.
-	cfg := &ProfilesConfig{
-		Version: profilesVersion,
-		Profiles: []Profile{
-			{Name: "corp-1", CorpID: "corp-1", UserID: "", ClientID: "mcp-client"},
-			{Name: "user-1", CorpID: "corp-1", UserID: "user-1", UserName: "User One", ClientID: "mcp-client"},
-		},
-	}
-	if err := SaveProfiles(configDir, cfg); err != nil {
-		t.Fatalf("SaveProfiles() error = %v", err)
-	}
-	orgMirror := &TokenData{
-		AccessToken:  "org-access",
-		RefreshToken: "org-refresh",
-		ExpiresAt:    time.Now().Add(-time.Minute),
-		RefreshExpAt: time.Now().Add(time.Hour),
-		CorpID:       "corp-1",
-		Source:       "mcp",
-		ClientID:     "mcp-client",
-	}
-	if err := SaveTokenDataKeychainForCorpID("corp-1", orgMirror); err != nil {
-		t.Fatalf("SaveTokenDataKeychainForCorpID() error = %v", err)
-	}
-	staleIdentity := &TokenData{
-		AccessToken:  "stale-access",
-		RefreshToken: "stale-refresh",
-		ExpiresAt:    time.Now().Add(-time.Hour),
-		RefreshExpAt: time.Now().Add(time.Hour),
-		CorpID:       "corp-1",
-		UserID:       "user-1",
-		UserName:     "User One",
-		Source:       "mcp",
-		ClientID:     "mcp-client",
-	}
-	if err := SaveTokenDataKeychainForIdentity("corp-1", "user-1", staleIdentity); err != nil {
-		t.Fatalf("SaveTokenDataKeychainForIdentity() error = %v", err)
-	}
-
-	SetRuntimeProfile("corp-1:user-1")
-	t.Cleanup(func() { SetRuntimeProfile("") })
-
-	p := &OAuthProvider{
-		configDir:  configDir,
-		logger:     slog.New(slog.NewTextHandler(io.Discard, nil)),
-		Output:     io.Discard,
-		httpClient: srv.Client(),
-	}
-	got, err := p.lockedRefresh(context.Background())
-	if err != nil {
-		t.Fatalf("lockedRefresh() error = %v", err)
-	}
-	if got == nil || got.AccessToken != "new-access" || got.RefreshToken != "new-refresh" {
-		t.Fatalf("lockedRefresh() = %#v, want rotated credential", got)
-	}
-	if refreshCalls.Load() != 2 {
-		t.Fatalf("MCP refresh calls = %d, want primary rejection plus fallback", refreshCalls.Load())
-	}
-
-	// The fallback consumed the mirror's refresh_token: both persisted slots
-	// must now carry the rotated credential instead of the consumed one.
-	orgSlot, err := LoadTokenDataKeychainForCorpID("corp-1")
-	if err != nil {
-		t.Fatalf("LoadTokenDataKeychainForCorpID() error = %v", err)
-	}
-	if orgSlot.RefreshToken != "new-refresh" || orgSlot.UserID != "user-1" {
-		t.Fatalf("organization slot = %#v, want new-refresh for user-1", orgSlot)
-	}
-	identitySlot, err := LoadTokenDataKeychainForIdentity("corp-1", "user-1")
-	if err != nil {
-		t.Fatalf("LoadTokenDataKeychainForIdentity() error = %v", err)
-	}
-	if identitySlot.RefreshToken != "new-refresh" {
-		t.Fatalf("identity slot = %#v, want new-refresh", identitySlot)
-	}
-}
-
-func TestCrossPlatformCoverageLockedRefreshOrgSlotFallbackGuardrails(t *testing.T) {
-	t.Run("transient failure does not fall back", func(t *testing.T) {
-		f := newOrgSlotFallbackFixture(t)
-		f.refreshErr = &HTTPStatusError{StatusCode: http.StatusInternalServerError}
-
-		_, err := f.provider.lockedRefresh(context.Background())
-		if err == nil || err.Error() != f.refreshErr.Error() {
-			t.Fatalf("lockedRefresh() error = %v, want transient failure", err)
-		}
-		if f.orgLoads != 0 {
-			t.Fatalf("organization slot loads = %d, want 0 for transient failure", f.orgLoads)
-		}
-		if len(f.refreshCalls) != 1 {
-			t.Fatalf("refresh attempts = %v, want only the primary attempt", f.refreshCalls)
-		}
-	})
-
-	t.Run("missing org slot preserves rejection", func(t *testing.T) {
-		f := newOrgSlotFallbackFixture(t)
-		testseam.Swap(t, &tokenLoadKeychainForCorpID, func(string) (*TokenData, error) {
-			f.orgLoads++
-			return nil, ErrTokenDataNotFound
-		})
-
-		_, err := f.provider.lockedRefresh(context.Background())
-		if !errors.Is(err, f.rejected) {
-			t.Fatalf("lockedRefresh() error = %v, want original rejection", err)
-		}
-		if len(f.refreshCalls) != 1 {
-			t.Fatalf("refresh attempts = %v, want only the primary attempt", f.refreshCalls)
-		}
-	})
-
-	t.Run("nil org data from keychain preserves rejection", func(t *testing.T) {
-		f := newOrgSlotFallbackFixture(t)
-		testseam.Swap(t, &tokenLoadKeychainForCorpID, func(string) (*TokenData, error) {
-			f.orgLoads++
-			return nil, nil
-		})
-
-		_, err := f.provider.lockedRefresh(context.Background())
-		if !errors.Is(err, f.rejected) {
-			t.Fatalf("lockedRefresh() error = %v, want original rejection", err)
-		}
-		if len(f.refreshCalls) != 1 {
-			t.Fatalf("refresh attempts = %v, want only the primary attempt", f.refreshCalls)
-		}
-	})
-
-	t.Run("org slot refresh failure preserves rejection", func(t *testing.T) {
-		f := newOrgSlotFallbackFixture(t)
-		f.orgRefreshErr = fmt.Errorf("org mirror refresh failed")
-
-		_, err := f.provider.lockedRefresh(context.Background())
-		if !errors.Is(err, f.rejected) {
-			t.Fatalf("lockedRefresh() error = %v, want original rejection", err)
-		}
-		if len(f.refreshCalls) != 2 {
-			t.Fatalf("refresh attempts = %v, want primary and fallback attempts", f.refreshCalls)
-		}
-	})
-
-	t.Run("different user in org slot is rejected", func(t *testing.T) {
-		f := newOrgSlotFallbackFixture(t)
-		f.orgMirror.UserID = "user-2"
-
-		_, err := f.provider.lockedRefresh(context.Background())
-		if !errors.Is(err, f.rejected) {
-			t.Fatalf("lockedRefresh() error = %v, want original rejection", err)
-		}
-		if len(f.refreshCalls) != 1 {
-			t.Fatalf("refresh attempts = %v, mismatched user must not refresh", f.refreshCalls)
-		}
-	})
-
-	t.Run("empty org slot user identity is backfilled", func(t *testing.T) {
-		f := newOrgSlotFallbackFixture(t)
-		f.orgMirror.UserID = ""
-		f.orgMirror.UserName = ""
-
-		got, err := f.provider.lockedRefresh(context.Background())
-		if err != nil || got != f.renewed {
-			t.Fatalf("lockedRefresh() = %#v, %v; want renewed token, nil", got, err)
-		}
-		if len(f.refreshCalls) != 2 {
-			t.Fatalf("refresh attempts = %v, want fallback attempt", f.refreshCalls)
-		}
-		if f.refreshUserIDs[1] != "user-1" {
-			t.Fatalf("fallback refresh UserID = %q, want backfilled current identity user-1", f.refreshUserIDs[1])
-		}
-	})
-
-	t.Run("same rejected refresh token is skipped", func(t *testing.T) {
-		f := newOrgSlotFallbackFixture(t)
-		f.orgMirror.RefreshToken = "stale-refresh"
-
-		_, err := f.provider.lockedRefresh(context.Background())
-		if !errors.Is(err, f.rejected) {
-			t.Fatalf("lockedRefresh() error = %v, want original rejection", err)
-		}
-		if len(f.refreshCalls) != 1 {
-			t.Fatalf("refresh attempts = %v, retrying the rejected token must not run", f.refreshCalls)
-		}
-	})
-
-	t.Run("expired org refresh token is skipped", func(t *testing.T) {
-		f := newOrgSlotFallbackFixture(t)
-		f.orgMirror.RefreshExpAt = time.Now().Add(-time.Hour)
-
-		_, err := f.provider.lockedRefresh(context.Background())
-		if !errors.Is(err, f.rejected) {
-			t.Fatalf("lockedRefresh() error = %v, want original rejection", err)
-		}
-		if len(f.refreshCalls) != 1 {
-			t.Fatalf("refresh attempts = %v, want only the primary attempt", f.refreshCalls)
-		}
-	})
-
-	t.Run("missing corp id skips fallback", func(t *testing.T) {
-		f := newOrgSlotFallbackFixture(t)
-		f.stale.CorpID = ""
-
-		_, err := f.provider.lockedRefresh(context.Background())
-		if !errors.Is(err, f.rejected) {
-			t.Fatalf("lockedRefresh() error = %v, want original rejection", err)
-		}
-		if f.orgLoads != 0 {
-			t.Fatalf("organization slot loads = %d, want 0 without corpId", f.orgLoads)
-		}
-	})
-
-	t.Run("direct mode terminal status does not fall back without business code", func(t *testing.T) {
-		f := newOrgSlotFallbackFixture(t)
-		f.refreshErr = &HTTPStatusError{StatusCode: http.StatusBadRequest}
-
-		_, err := f.provider.lockedRefresh(context.Background())
-		if err == nil || err.Error() != f.refreshErr.Error() {
-			t.Fatalf("lockedRefresh() error = %v, want direct terminal status", err)
-		}
-		if f.orgLoads != 0 {
-			t.Fatalf("fallback slot loads = %d, want 0 without reviewed business code", f.orgLoads)
-		}
-		if len(f.refreshCalls) != 1 {
-			t.Fatalf("refresh attempts = %v, want only the primary attempt", f.refreshCalls)
-		}
-	})
-}
-
-func TestCrossPlatformCoverageRefreshFromOrgSlotBoundaries(t *testing.T) {
-	f := newOrgSlotFallbackFixture(t)
-
-	if _, err := f.provider.refreshFromOrgSlot(context.Background(), nil); err == nil {
-		t.Fatal("refreshFromOrgSlot(nil) succeeded")
-	}
-	f.orgMirror.CorpID = "corp-2"
-	if _, err := f.provider.refreshFromOrgSlot(context.Background(), f.stale); err == nil {
-		t.Fatal("refreshFromOrgSlot with mismatched corpId succeeded")
-	}
-	if len(f.refreshCalls) != 0 {
-		t.Fatalf("refresh attempts = %v, corpId mismatch must not refresh", f.refreshCalls)
-	}
-}
@@ -87,16 +87,3 @@ func ClassifyRefreshFailure(err error) RefreshFailureClass {
 	}
 	return RefreshFailureUnknown
 }
-
-// isRefreshTokenRejected reports whether the server returned a reviewed
-// business code that definitively rejects the presented refresh_token.
-// Only the reviewed MCP business code enables the organization-slot
-// fallback; direct-mode terminal HTTP rejections (400/401/403) carry no
-// reviewed business code and deliberately do not trigger the fallback.
-func isRefreshTokenRejected(err error) bool {
-	if err == nil {
-		return false
-	}
-	var exchangeErr *MCPTokenExchangeError
-	return errors.As(err, &exchangeErr) && exchangeErr != nil && exchangeErr.requiresReauthorization()
-}
@@ -15,7 +15,6 @@ import (
 	"testing"
 	"time"

-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/testseam"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
 )

@@ -190,195 +189,6 @@ func TestCrossPlatformCoverageGetTokenSnapshotOnlyExpiresProfileForNonTransientR
 	}
 }

-func TestCrossPlatformCoverageLegacyGlobalSlotRecoversRejectedIdentityRefresh(t *testing.T) {
-	selected := &TokenData{
-		AccessToken:  "expired-identity-access",
-		RefreshToken: "rejected-identity-refresh",
-		ExpiresAt:    time.Now().Add(-time.Hour),
-		RefreshExpAt: time.Now().Add(time.Hour),
-		CorpID:       "corp-v1039",
-		UserID:       "user-v1039",
-		UserName:     "V1039 User",
-		Source:       "mcp",
-	}
-	legacy := &TokenData{
-		AccessToken:  "valid-legacy-global-access",
-		RefreshToken: "valid-legacy-global-refresh",
-		ExpiresAt:    time.Now().Add(time.Hour),
-		RefreshExpAt: time.Now().Add(24 * time.Hour),
-		CorpID:       selected.CorpID,
-		Source:       "mcp",
-	}
-
-	testseam.Swap(t, &oauthAcquireLock, func(context.Context, string) (*DualLock, error) { return &DualLock{}, nil })
-	testseam.Swap(t, &oauthLoadTokenLocked, func(string, string) (*TokenData, error) { return selected, nil })
-	testseam.Swap(t, &oauthRefreshToken, func(*OAuthProvider, context.Context, *TokenData) (*TokenData, error) {
-		return nil, &MCPTokenExchangeError{Code: legacyMCPRefreshRejectedCode, Message: "authCode not found"}
-	})
-	testseam.Swap(t, &tokenLoadKeychain, func() (*TokenData, error) { return legacy, nil })
-	testseam.Swap(t, &tokenLoadProfiles, func(string) (*ProfilesConfig, error) {
-		return &ProfilesConfig{Version: profilesVersion, Profiles: []Profile{{
-			Name:     "V1039 User",
-			CorpID:   selected.CorpID,
-			UserID:   selected.UserID,
-			UserName: selected.UserName,
-		}}}, nil
-	})
-	testseam.Swap(t, &tokenLoadKeychainForCorpID, func(string) (*TokenData, error) { return nil, ErrTokenDataNotFound })
-	var saved *TokenData
-	testseam.Swap(t, &oauthSaveTokenLocked, func(_ string, data *TokenData) error {
-		copy := *data
-		saved = &copy
-		return nil
-	})
-
-	recovered, err := NewOAuthProvider(t.TempDir(), nil).lockedRefresh(context.Background())
-	if err != nil {
-		t.Fatalf("lockedRefresh() error = %v", err)
-	}
-	if recovered.AccessToken != legacy.AccessToken || recovered.RefreshToken != legacy.RefreshToken {
-		t.Fatalf("recovered token = %#v, want legacy credential material %#v", recovered, legacy)
-	}
-	if recovered.UserID != selected.UserID || recovered.UserName != selected.UserName {
-		t.Fatalf("recovered identity = %q/%q, want selected identity %q/%q", recovered.UserID, recovered.UserName, selected.UserID, selected.UserName)
-	}
-	if saved == nil || saved.AccessToken != recovered.AccessToken || saved.UserID != selected.UserID {
-		t.Fatalf("saved recovery token = %#v, want recovered identity token %#v", saved, recovered)
-	}
-}
-
-func TestCrossPlatformCoverageLegacyGlobalSlotRejectsBlankUserIDForMultiAccountCorp(t *testing.T) {
-	selected := &TokenData{
-		AccessToken:  "expired-identity-access",
-		RefreshToken: "rejected-identity-refresh",
-		ExpiresAt:    time.Now().Add(-time.Hour),
-		RefreshExpAt: time.Now().Add(time.Hour),
-		CorpID:       "corp-v1039-multi",
-		UserID:       "user-v1039-a",
-		Source:       "mcp",
-	}
-	legacy := &TokenData{
-		AccessToken:  "valid-legacy-global-access",
-		RefreshToken: "valid-legacy-global-refresh",
-		ExpiresAt:    time.Now().Add(time.Hour),
-		RefreshExpAt: time.Now().Add(24 * time.Hour),
-		CorpID:       selected.CorpID,
-		Source:       "mcp",
-	}
-	rejection := &MCPTokenExchangeError{Code: legacyMCPRefreshRejectedCode, Message: "authCode not found"}
-
-	testseam.Swap(t, &oauthAcquireLock, func(context.Context, string) (*DualLock, error) { return &DualLock{}, nil })
-	testseam.Swap(t, &oauthLoadTokenLocked, func(string, string) (*TokenData, error) { return selected, nil })
-	testseam.Swap(t, &oauthRefreshToken, func(*OAuthProvider, context.Context, *TokenData) (*TokenData, error) { return nil, rejection })
-	testseam.Swap(t, &tokenLoadKeychain, func() (*TokenData, error) { return legacy, nil })
-	testseam.Swap(t, &tokenLoadProfiles, func(string) (*ProfilesConfig, error) {
-		return &ProfilesConfig{Version: profilesVersion, Profiles: []Profile{
-			{Name: "User A", CorpID: selected.CorpID, UserID: selected.UserID},
-			{Name: "User B", CorpID: selected.CorpID, UserID: "user-v1039-b"},
-		}}, nil
-	})
-	testseam.Swap(t, &tokenLoadKeychainForCorpID, func(string) (*TokenData, error) { return nil, ErrTokenDataNotFound })
-	saved := false
-	testseam.Swap(t, &oauthSaveTokenLocked, func(string, *TokenData) error {
-		saved = true
-		return nil
-	})
-
-	_, err := NewOAuthProvider(t.TempDir(), nil).lockedRefresh(context.Background())
-	if !errors.Is(err, rejection) {
-		t.Fatalf("lockedRefresh() error = %v, want original rejection", err)
-	}
-	if saved {
-		t.Fatal("legacy global recovery saved a blank-user token for a multi-account organization")
-	}
-}
-
-func TestCrossPlatformCoverageLegacyGlobalSlotRejectsBlankSelectedUserIDForMultiAccountCorp(t *testing.T) {
-	selected := &TokenData{
-		AccessToken:  "expired-identity-access",
-		RefreshToken: "rejected-identity-refresh",
-		ExpiresAt:    time.Now().Add(-time.Hour),
-		RefreshExpAt: time.Now().Add(time.Hour),
-		CorpID:       "corp-v1039-blank-selected",
-		Source:       "mcp",
-	}
-	legacy := &TokenData{
-		AccessToken:  "valid-legacy-global-access",
-		RefreshToken: "valid-legacy-global-refresh",
-		ExpiresAt:    time.Now().Add(time.Hour),
-		RefreshExpAt: time.Now().Add(24 * time.Hour),
-		CorpID:       selected.CorpID,
-		Source:       "mcp",
-	}
-	rejection := &MCPTokenExchangeError{Code: legacyMCPRefreshRejectedCode, Message: "authCode not found"}
-
-	testseam.Swap(t, &oauthAcquireLock, func(context.Context, string) (*DualLock, error) { return &DualLock{}, nil })
-	testseam.Swap(t, &oauthLoadTokenLocked, func(string, string) (*TokenData, error) { return selected, nil })
-	testseam.Swap(t, &oauthRefreshToken, func(*OAuthProvider, context.Context, *TokenData) (*TokenData, error) { return nil, rejection })
-	testseam.Swap(t, &tokenLoadKeychain, func() (*TokenData, error) { return legacy, nil })
-	testseam.Swap(t, &tokenLoadProfiles, func(string) (*ProfilesConfig, error) {
-		return &ProfilesConfig{Version: profilesVersion, Profiles: []Profile{
-			{Name: "Blank A", CorpID: selected.CorpID, UserID: ""},
-			{Name: "Blank B", CorpID: selected.CorpID, UserID: ""},
-		}}, nil
-	})
-	testseam.Swap(t, &tokenLoadKeychainForCorpID, func(string) (*TokenData, error) { return nil, ErrTokenDataNotFound })
-	saved := false
-	testseam.Swap(t, &oauthSaveTokenLocked, func(string, *TokenData) error {
-		saved = true
-		return nil
-	})
-
-	_, err := NewOAuthProvider(t.TempDir(), nil).lockedRefresh(context.Background())
-	if !errors.Is(err, rejection) {
-		t.Fatalf("lockedRefresh() error = %v, want original rejection", err)
-	}
-	if saved {
-		t.Fatal("legacy global recovery saved a blank-selected token for a multi-account organization")
-	}
-}
-
-func TestCrossPlatformCoverageLegacyGlobalSlotRejectsDifferentUserID(t *testing.T) {
-	selected := &TokenData{
-		AccessToken:  "expired-identity-access",
-		RefreshToken: "rejected-identity-refresh",
-		ExpiresAt:    time.Now().Add(-time.Hour),
-		RefreshExpAt: time.Now().Add(time.Hour),
-		CorpID:       "corp-v1039-user-mismatch",
-		UserID:       "user-v1039-selected",
-		Source:       "mcp",
-	}
-	legacy := &TokenData{
-		AccessToken:  "valid-legacy-global-access",
-		RefreshToken: "valid-legacy-global-refresh",
-		ExpiresAt:    time.Now().Add(time.Hour),
-		RefreshExpAt: time.Now().Add(24 * time.Hour),
-		CorpID:       selected.CorpID,
-		UserID:       "user-v1039-other",
-		Source:       "mcp",
-	}
-	rejection := &MCPTokenExchangeError{Code: legacyMCPRefreshRejectedCode, Message: "authCode not found"}
-
-	testseam.Swap(t, &oauthAcquireLock, func(context.Context, string) (*DualLock, error) { return &DualLock{}, nil })
-	testseam.Swap(t, &oauthLoadTokenLocked, func(string, string) (*TokenData, error) { return selected, nil })
-	testseam.Swap(t, &oauthRefreshToken, func(*OAuthProvider, context.Context, *TokenData) (*TokenData, error) { return nil, rejection })
-	testseam.Swap(t, &tokenLoadKeychain, func() (*TokenData, error) { return legacy, nil })
-	testseam.Swap(t, &tokenLoadKeychainForCorpID, func(string) (*TokenData, error) { return nil, ErrTokenDataNotFound })
-	saved := false
-	testseam.Swap(t, &oauthSaveTokenLocked, func(string, *TokenData) error {
-		saved = true
-		return nil
-	})
-
-	_, err := NewOAuthProvider(t.TempDir(), nil).lockedRefresh(context.Background())
-	if !errors.Is(err, rejection) {
-		t.Fatalf("lockedRefresh() error = %v, want original rejection", err)
-	}
-	if saved {
-		t.Fatal("legacy global recovery saved a token owned by a different user")
-	}
-}
-
 func TestCrossPlatformCoverageLegacyRefreshFailureKeepsBlankCurrentSelectorIsolated(t *testing.T) {
 	fixture := seedBlankProfileSelectorFixture(t, "Fixture Organization", "Fixture Organization", true)
 	expired := *fixture.blankToken
@@ -443,330 +253,3 @@ func TestCrossPlatformCoverageLegacyRefreshFailureKeepsBlankCurrentSelectorIsola
 		}
 	}
 }
-
-func TestCrossPlatformCoverageLegacyGlobalSlotRejectsSingleProfileIdentityMismatch(t *testing.T) {
-	selected := &TokenData{
-		AccessToken:  "expired-identity-access",
-		RefreshToken: "rejected-identity-refresh",
-		ExpiresAt:    time.Now().Add(-time.Hour),
-		RefreshExpAt: time.Now().Add(time.Hour),
-		CorpID:       "corp-v1039-single-mismatch",
-		UserID:       "user-v1039-selected",
-		Source:       "mcp",
-	}
-	legacy := &TokenData{
-		AccessToken:  "valid-legacy-global-access",
-		RefreshToken: "valid-legacy-global-refresh",
-		ExpiresAt:    time.Now().Add(time.Hour),
-		RefreshExpAt: time.Now().Add(24 * time.Hour),
-		CorpID:       selected.CorpID,
-		Source:       "mcp",
-	}
-	rejection := &MCPTokenExchangeError{Code: legacyMCPRefreshRejectedCode, Message: "authCode not found"}
-
-	testseam.Swap(t, &oauthAcquireLock, func(context.Context, string) (*DualLock, error) { return &DualLock{}, nil })
-	testseam.Swap(t, &oauthLoadTokenLocked, func(string, string) (*TokenData, error) { return selected, nil })
-	testseam.Swap(t, &oauthRefreshToken, func(*OAuthProvider, context.Context, *TokenData) (*TokenData, error) { return nil, rejection })
-	testseam.Swap(t, &tokenLoadKeychain, func() (*TokenData, error) { return legacy, nil })
-	testseam.Swap(t, &tokenLoadProfiles, func(string) (*ProfilesConfig, error) {
-		return &ProfilesConfig{Version: profilesVersion, Profiles: []Profile{{
-			Name:   "Other User",
-			CorpID: selected.CorpID,
-			UserID: "user-v1039-other",
-		}}}, nil
-	})
-	testseam.Swap(t, &tokenLoadKeychainForCorpID, func(string) (*TokenData, error) { return nil, ErrTokenDataNotFound })
-	saved := false
-	testseam.Swap(t, &oauthSaveTokenLocked, func(string, *TokenData) error {
-		saved = true
-		return nil
-	})
-
-	_, err := NewOAuthProvider(t.TempDir(), nil).lockedRefresh(context.Background())
-	if !errors.Is(err, rejection) {
-		t.Fatalf("lockedRefresh() error = %v, want original rejection", err)
-	}
-	if saved {
-		t.Fatal("legacy global recovery saved a blank-user token whose single profile identity does not match")
-	}
-}
-
-func TestCrossPlatformCoverageLegacyGlobalSlotRefreshesExpiredLegacyCredential(t *testing.T) {
-	selected := &TokenData{
-		AccessToken:  "expired-identity-access",
-		RefreshToken: "rejected-identity-refresh",
-		ExpiresAt:    time.Now().Add(-time.Hour),
-		RefreshExpAt: time.Now().Add(time.Hour),
-		CorpID:       "corp-v1039-legacy-refresh",
-		UserID:       "user-v1039",
-		UserName:     "V1039 User",
-		Source:       "mcp",
-	}
-	legacy := &TokenData{
-		AccessToken:  "expired-legacy-global-access",
-		RefreshToken: "valid-legacy-global-refresh",
-		ExpiresAt:    time.Now().Add(-time.Hour),
-		RefreshExpAt: time.Now().Add(24 * time.Hour),
-		CorpID:       selected.CorpID,
-		UserID:       selected.UserID,
-		Source:       "mcp",
-	}
-	refreshed := &TokenData{
-		AccessToken:  "refreshed-legacy-access",
-		RefreshToken: "rotated-legacy-refresh",
-		ExpiresAt:    time.Now().Add(time.Hour),
-		RefreshExpAt: time.Now().Add(24 * time.Hour),
-		CorpID:       selected.CorpID,
-		UserID:       selected.UserID,
-		Source:       "mcp",
-	}
-	rejection := &MCPTokenExchangeError{Code: legacyMCPRefreshRejectedCode, Message: "authCode not found"}
-
-	testseam.Swap(t, &oauthAcquireLock, func(context.Context, string) (*DualLock, error) { return &DualLock{}, nil })
-	testseam.Swap(t, &oauthLoadTokenLocked, func(string, string) (*TokenData, error) { return selected, nil })
-	refreshCalls := 0
-	testseam.Swap(t, &oauthRefreshToken, func(*OAuthProvider, context.Context, *TokenData) (*TokenData, error) {
-		refreshCalls++
-		if refreshCalls == 1 {
-			return nil, rejection
-		}
-		return refreshed, nil
-	})
-	testseam.Swap(t, &tokenLoadKeychain, func() (*TokenData, error) { return legacy, nil })
-	testseam.Swap(t, &tokenLoadKeychainForCorpID, func(string) (*TokenData, error) { return nil, ErrTokenDataNotFound })
-
-	recovered, err := NewOAuthProvider(t.TempDir(), nil).lockedRefresh(context.Background())
-	if err != nil {
-		t.Fatalf("lockedRefresh() error = %v", err)
-	}
-	if refreshCalls != 2 {
-		t.Fatalf("oauthRefreshToken called %d times, want 2 (identity rejection + legacy refresh)", refreshCalls)
-	}
-	if recovered.AccessToken != refreshed.AccessToken {
-		t.Fatalf("recovered access token = %q, want refreshed legacy credential %q", recovered.AccessToken, refreshed.AccessToken)
-	}
-	if recovered.RefreshToken != refreshed.RefreshToken {
-		t.Fatalf("recovered refresh token = %q, want rotated credential %q", recovered.RefreshToken, refreshed.RefreshToken)
-	}
-}
-
-func TestCrossPlatformCoverageLegacyGlobalSlotRejectsProfilesLoadError(t *testing.T) {
-	selected := &TokenData{
-		AccessToken:  "expired-identity-access",
-		RefreshToken: "rejected-identity-refresh",
-		ExpiresAt:    time.Now().Add(-time.Hour),
-		RefreshExpAt: time.Now().Add(time.Hour),
-		CorpID:       "corp-v1039-profiles-error",
-		UserID:       "user-v1039",
-		Source:       "mcp",
-	}
-	legacy := &TokenData{
-		AccessToken:  "valid-legacy-global-access",
-		RefreshToken: "valid-legacy-global-refresh",
-		ExpiresAt:    time.Now().Add(time.Hour),
-		RefreshExpAt: time.Now().Add(24 * time.Hour),
-		CorpID:       selected.CorpID,
-		Source:       "mcp",
-	}
-	rejection := &MCPTokenExchangeError{Code: legacyMCPRefreshRejectedCode, Message: "authCode not found"}
-
-	testseam.Swap(t, &oauthAcquireLock, func(context.Context, string) (*DualLock, error) { return &DualLock{}, nil })
-	testseam.Swap(t, &oauthLoadTokenLocked, func(string, string) (*TokenData, error) { return selected, nil })
-	testseam.Swap(t, &oauthRefreshToken, func(*OAuthProvider, context.Context, *TokenData) (*TokenData, error) { return nil, rejection })
-	testseam.Swap(t, &tokenLoadKeychain, func() (*TokenData, error) { return legacy, nil })
-	testseam.Swap(t, &tokenLoadProfiles, func(string) (*ProfilesConfig, error) { return nil, errors.New("profiles read failed") })
-	testseam.Swap(t, &tokenLoadKeychainForCorpID, func(string) (*TokenData, error) { return nil, ErrTokenDataNotFound })
-	saved := false
-	testseam.Swap(t, &oauthSaveTokenLocked, func(string, *TokenData) error {
-		saved = true
-		return nil
-	})
-
-	_, err := NewOAuthProvider(t.TempDir(), nil).lockedRefresh(context.Background())
-	if !errors.Is(err, rejection) {
-		t.Fatalf("lockedRefresh() error = %v, want original rejection", err)
-	}
-	if saved {
-		t.Fatal("legacy global recovery saved a blank-user token when profiles could not be loaded")
-	}
-}
-
-func TestCrossPlatformCoverageLegacyGlobalSlotRejectsSameRefreshToken(t *testing.T) {
-	selected := &TokenData{
-		AccessToken:  "expired-identity-access",
-		RefreshToken: "shared-rejected-refresh",
-		ExpiresAt:    time.Now().Add(-time.Hour),
-		RefreshExpAt: time.Now().Add(time.Hour),
-		CorpID:       "corp-v1039-same-refresh",
-		UserID:       "user-v1039",
-		Source:       "mcp",
-	}
-	legacy := &TokenData{
-		AccessToken:  "expired-legacy-global-access",
-		RefreshToken: selected.RefreshToken,
-		ExpiresAt:    time.Now().Add(-time.Hour),
-		RefreshExpAt: time.Now().Add(24 * time.Hour),
-		CorpID:       selected.CorpID,
-		UserID:       selected.UserID,
-		Source:       "mcp",
-	}
-	rejection := &MCPTokenExchangeError{Code: legacyMCPRefreshRejectedCode, Message: "authCode not found"}
-
-	testseam.Swap(t, &oauthAcquireLock, func(context.Context, string) (*DualLock, error) { return &DualLock{}, nil })
-	testseam.Swap(t, &oauthLoadTokenLocked, func(string, string) (*TokenData, error) { return selected, nil })
-	testseam.Swap(t, &oauthRefreshToken, func(*OAuthProvider, context.Context, *TokenData) (*TokenData, error) { return nil, rejection })
-	testseam.Swap(t, &tokenLoadKeychain, func() (*TokenData, error) { return legacy, nil })
-	testseam.Swap(t, &tokenLoadKeychainForCorpID, func(string) (*TokenData, error) { return nil, ErrTokenDataNotFound })
-	saved := false
-	testseam.Swap(t, &oauthSaveTokenLocked, func(string, *TokenData) error {
-		saved = true
-		return nil
-	})
-
-	_, err := NewOAuthProvider(t.TempDir(), nil).lockedRefresh(context.Background())
-	if !errors.Is(err, rejection) {
-		t.Fatalf("lockedRefresh() error = %v, want original rejection", err)
-	}
-	if saved {
-		t.Fatal("legacy global recovery saved a token holding the same rejected refresh_token")
-	}
-}
-
-func TestCrossPlatformCoverageLegacyGlobalSlotRejectsNilSelectedAndEmptyLegacy(t *testing.T) {
-	rejection := &MCPTokenExchangeError{Code: legacyMCPRefreshRejectedCode, Message: "authCode not found"}
-	provider := NewOAuthProvider(t.TempDir(), nil)
-
-	// nil selected must be rejected before any dereference.
-	if _, err := provider.recoverRefreshFromLegacyGlobalSlot(context.Background(), nil, rejection); !errors.Is(err, rejection) {
-		t.Fatalf("nil selected error = %v, want original rejection", err)
-	}
-
-	// A keychain load that returns (nil, nil) must be rejected before any dereference.
-	testseam.Swap(t, &tokenLoadKeychain, func() (*TokenData, error) { return nil, nil })
-	selected := &TokenData{
-		CorpID: "corp-v1039-nil-legacy",
-		UserID: "user-v1039",
-		Source: "mcp",
-	}
-	if _, err := provider.recoverRefreshFromLegacyGlobalSlot(context.Background(), selected, rejection); !errors.Is(err, rejection) {
-		t.Fatalf("nil legacy error = %v, want original rejection", err)
-	}
-}
-
-func TestCrossPlatformCoverageLegacyGlobalRecoveryRejectsNonReauthorizationErrors(t *testing.T) {
-	provider := NewOAuthProvider(t.TempDir(), nil)
-	selected := &TokenData{CorpID: "corp-v1039-plain", UserID: "user-v1039", Source: "mcp"}
-
-	plainErr := errors.New("plain refresh failure")
-	if _, err := provider.recoverRefreshFromLegacyGlobalSlot(context.Background(), selected, plainErr); !errors.Is(err, plainErr) {
-		t.Fatalf("plain error = %v, want original plain failure", err)
-	}
-}
-
-func TestCrossPlatformCoverageLegacyGlobalRecoveryRejectsSaveAndRefreshFailures(t *testing.T) {
-	rejection := &MCPTokenExchangeError{Code: legacyMCPRefreshRejectedCode, Message: "authCode not found"}
-	selected := &TokenData{
-		CorpID: "corp-v1039-recovery-steps",
-		UserID: "user-v1039",
-		Source: "mcp",
-	}
-
-	t.Run("save_failure", func(t *testing.T) {
-		legacy := &TokenData{
-			AccessToken:  "valid-legacy-access",
-			RefreshToken: "valid-legacy-refresh",
-			ExpiresAt:    time.Now().Add(time.Hour),
-			RefreshExpAt: time.Now().Add(24 * time.Hour),
-			CorpID:       selected.CorpID,
-			UserID:       selected.UserID,
-			Source:       "mcp",
-		}
-		testseam.Swap(t, &tokenLoadKeychain, func() (*TokenData, error) { return legacy, nil })
-		testseam.Swap(t, &oauthSaveTokenLocked, func(string, *TokenData) error { return errors.New("save failed") })
-		if _, err := NewOAuthProvider(t.TempDir(), nil).recoverRefreshFromLegacyGlobalSlot(context.Background(), selected, rejection); !errors.Is(err, rejection) {
-			t.Fatalf("save failure error = %v, want original rejection", err)
-		}
-	})
-
-	t.Run("refresh_expired", func(t *testing.T) {
-		legacy := &TokenData{
-			AccessToken:  "expired-legacy-access",
-			RefreshToken: "expired-legacy-refresh",
-			ExpiresAt:    time.Now().Add(-time.Hour),
-			RefreshExpAt: time.Now().Add(-time.Hour),
-			CorpID:       selected.CorpID,
-			UserID:       selected.UserID,
-			Source:       "mcp",
-		}
-		testseam.Swap(t, &tokenLoadKeychain, func() (*TokenData, error) { return legacy, nil })
-		if _, err := NewOAuthProvider(t.TempDir(), nil).recoverRefreshFromLegacyGlobalSlot(context.Background(), selected, rejection); !errors.Is(err, rejection) {
-			t.Fatalf("expired refresh error = %v, want original rejection", err)
-		}
-	})
-
-	t.Run("refresh_error", func(t *testing.T) {
-		legacy := &TokenData{
-			AccessToken:  "expired-legacy-access",
-			RefreshToken: "valid-legacy-refresh",
-			ExpiresAt:    time.Now().Add(-time.Hour),
-			RefreshExpAt: time.Now().Add(24 * time.Hour),
-			CorpID:       selected.CorpID,
-			UserID:       selected.UserID,
-			Source:       "mcp",
-		}
-		testseam.Swap(t, &tokenLoadKeychain, func() (*TokenData, error) { return legacy, nil })
-		testseam.Swap(t, &oauthRefreshToken, func(*OAuthProvider, context.Context, *TokenData) (*TokenData, error) {
-			return nil, errors.New("legacy refresh failed")
-		})
-		if _, err := NewOAuthProvider(t.TempDir(), nil).recoverRefreshFromLegacyGlobalSlot(context.Background(), selected, rejection); !errors.Is(err, rejection) {
-			t.Fatalf("legacy refresh error = %v, want original rejection", err)
-		}
-	})
-
-	t.Run("preflight_error", func(t *testing.T) {
-		legacy := &TokenData{
-			AccessToken:  "expired-legacy-access",
-			RefreshToken: "valid-legacy-refresh",
-			ExpiresAt:    time.Now().Add(-time.Hour),
-			RefreshExpAt: time.Now().Add(24 * time.Hour),
-			CorpID:       selected.CorpID,
-			UserID:       selected.UserID,
-			Source:       "mcp",
-		}
-		testseam.Swap(t, &tokenLoadKeychain, func() (*TokenData, error) { return legacy, nil })
-		testseam.Swap(t, &profilesReadFile, func(string) ([]byte, error) { return nil, errors.New("read failed") })
-		if _, err := NewOAuthProvider(t.TempDir(), nil).recoverRefreshFromLegacyGlobalSlot(context.Background(), selected, rejection); !errors.Is(err, rejection) {
-			t.Fatalf("preflight error = %v, want original rejection", err)
-		}
-	})
-}
-
-func TestCrossPlatformCoverageLegacyGlobalCandidateMatchingBoundaries(t *testing.T) {
-	configDir := t.TempDir()
-	selected := &TokenData{CorpID: "corp-v1039-candidate", UserID: "user-v1039"}
-
-	if legacyGlobalRefreshCandidateMatches(configDir, selected, nil) {
-		t.Fatal("nil legacy accepted")
-	}
-	if legacyGlobalRefreshCandidateMatches(configDir, selected, &TokenData{CorpID: "corp-other", UserID: selected.UserID}) {
-		t.Fatal("different corp accepted")
-	}
-	if legacyGlobalRefreshCandidateMatches(configDir, &TokenData{UserID: "user-v1039"}, &TokenData{UserID: "user-v1039"}) {
-		t.Fatal("blank selected corp accepted")
-	}
-
-	blankSelected := &TokenData{CorpID: selected.CorpID}
-	testseam.Swap(t, &tokenLoadProfiles, func(string) (*ProfilesConfig, error) {
-		return &ProfilesConfig{Version: profilesVersion, Profiles: []Profile{{Name: "Blank User", CorpID: selected.CorpID}}}, nil
-	})
-	if !legacyGlobalRefreshCandidateMatches(configDir, blankSelected, &TokenData{CorpID: selected.CorpID}) {
-		t.Fatal("both blank user IDs should match only through the single-profile guard")
-	}
-	if legacyGlobalRefreshCandidateMatches(configDir, blankSelected, &TokenData{CorpID: selected.CorpID, UserID: "user-other"}) {
-		t.Fatal("blank selected with non-blank legacy accepted")
-	}
-
-	if legacyGlobalBlankUserIDMatchesSingleProfile(configDir, "", selected.UserID) {
-		t.Fatal("blank corp accepted by single-profile check")
-	}
-}
@@ -107,13 +107,6 @@ type TokenData struct {
 	// transient marker to reject ambiguous UID-less logins without breaking
 	// legitimate refreshes of unresolved accounts.
 	FreshAuthorization bool `json:"-"`
-	// RepairOrganizationMirror marks a fallback refresh that consumed the
-	// organization mirror's refresh_token. The regular write plan can skip the
-	// organization slot under an explicit runtime selector (for example when an
-	// unresolved sibling profile still owns it), which would strand a
-	// refresh_token the server has already rotated; the marker forces the
-	// rotated credential back into that slot.
-	RepairOrganizationMirror bool `json:"-"`
 }

 // tokenPersistenceWritePlan is the single source of truth for deciding which
@@ -134,7 +127,6 @@ type tokenPersistenceWritePlan struct {
 	ExistingIdentity               bool
 	UpgradesLegacyProfile          bool
 	PreserveUnresolvedOrganization bool
-	RepairOrganizationMirror       bool
 	WriteIdentity                  bool
 	WriteOrganization              bool
 	WriteGlobal                    bool
@@ -175,11 +167,6 @@ func planTokenPersistenceWrites(
 	plan.PreserveUnresolvedOrganization = plan.UserID != "" &&
 		unresolvedProfileForCorp(cfg, plan.CorpID) != nil &&
 		!plan.UpgradesLegacyProfile
-	// A fallback refresh consumed the organization mirror's refresh_token;
-	// the rotated credential must go back into that slot even when the
-	// selector-driven plan would skip it (for example an explicit --profile
-	// that preserves an unresolved sibling profile's slot).
-	plan.RepairOrganizationMirror = data.RepairOrganizationMirror
 	plan.WriteIdentity = plan.UserID != ""
 	orgCurrentSelector := ""
 	if cfg != nil {
@@ -190,8 +177,7 @@ func planTokenPersistenceWrites(
 	// reauthorization. Its organization slot must move with the newly exact
 	// identity even when an explicit runtime selector keeps it from becoming
 	// process-global current.
-	plan.WriteOrganization = plan.RepairOrganizationMirror ||
-		plan.UserID == "" ||
+	plan.WriteOrganization = plan.UserID == "" ||
 		plan.UpgradesLegacyProfile ||
 		(!plan.PreserveUnresolvedOrganization &&
 			(plan.MakeCurrent ||
@@ -401,7 +387,6 @@ func saveTokenDataLocked(configDir string, data *TokenData) error {
 			"persistence_profile", plan.PersistenceSelector,
 			"write_identity_slot", plan.WriteIdentity,
 			"write_org_mirror", plan.WriteOrganization,
-			"repair_org_mirror", plan.RepairOrganizationMirror,
 			"write_global_mirror", plan.WriteGlobal,
 			"publish_incoming_global", plan.MakeCurrent,
 		)
@@ -191,12 +191,12 @@
      "from": "oa +list-processes",
      "mode": "ambiguous",
      "candidates": [
-        "oa +search-forms",
-        "oa approval list-submitted",
+        "oa +list-forms",
+        "oa +my-initiated",
        "oa approval list-initiated"
      ],
      "reviewed": true,
-      "review_reason": "20260818 review keeps +list-forms unavailable because its live response lacks trustworthy continuation and removes +my-initiated from discovery because guaranteed-zero responses omit hasMore; process can still mean a searchable approval definition or an instance initiated by the current user, so stop and present the public keyword-search or exact atomic initiated routes."
+      "review_reason": "20260720 merged evaluation emitted +list-processes, but process can mean approval forms/templates or approval instances initiated by the current user; stop and present both shortcut workflows plus the exact native instance leaf."
    },
    {
      "from": "chat +conversation-detail",
@@ -242,9 +242,9 @@ var generatedCommandPathFallbacks = []CommandPathFallback{
 	{
 		From:         "oa +list-processes",
 		Mode:         "ambiguous",
-		Candidates:   []string{"oa +search-forms", "oa approval list-submitted", "oa approval list-initiated"},
+		Candidates:   []string{"oa +list-forms", "oa +my-initiated", "oa approval list-initiated"},
 		Reviewed:     true,
-		ReviewReason: "20260818 review keeps +list-forms unavailable because its live response lacks trustworthy continuation and removes +my-initiated from discovery because guaranteed-zero responses omit hasMore; process can still mean a searchable approval definition or an instance initiated by the current user, so stop and present the public keyword-search or exact atomic initiated routes.",
+		ReviewReason: "20260720 merged evaluation emitted +list-processes, but process can mean approval forms/templates or approval instances initiated by the current user; stop and present both shortcut workflows plus the exact native instance leaf.",
 	},
 }

@@ -172,7 +172,7 @@ func TestCrossPlatformCoverageCommandPathFallbackAuditCoverage(t *testing.T) {
 		"chat +send-file":                  {"chat +messages-send", "chat message send"},
 		"chat +send-image":                 {"chat +messages-send", "chat message send"},
 		"chat +send-media":                 {"chat +messages-send", "chat message send"},
-		"oa +list-processes":               {"oa +search-forms", "oa approval list-submitted", "oa approval list-initiated"},
+		"oa +list-processes":               {"oa +list-forms", "oa +my-initiated", "oa approval list-initiated"},
 		"doc +template":                    {"doc +template-list", "doc +template-search", "doc +create-from-template"},
 		"doc +version":                     {"doc +history-list", "doc +history-save", "doc +history-revert"},
 	}
@@ -1058,7 +1058,7 @@ var schemaCompactPayloadKeys = map[string]bool{
 	"agent_summary": true, "description": true,
 	"effect": true, "risk": true, "confirmation": true, "idempotency": true,
 	"interface_mode": true, "availability": true, "interface_reason": true,
-	"parameters": true, "constraints": true, "positionals": true, "dry_run": true,
+	"parameters": true, "constraints": true, "positionals": true, "dry_run": true, "wait": true,
 	"result": true, "pagination": true,
 	"examples": true, "use_when": true, "avoid_when": true,
 }
@@ -81,6 +81,7 @@ var schemaCatalogToolOptionalKeys = []string{
 	"pagination",
 	"positionals",
 	"result",
+	"wait",
 }

 var schemaCatalogToolEnums = map[string][]string{
@@ -301,7 +301,7 @@ func TestDeliveryCatalogDocReadParamDeclsMatchMergeBaseContract(t *testing.T) {
 		t.Fatalf("doc read --content-format required = %#v, want false", contentFormat["required"])
 	}

-	for _, flagName := range []string{"scope", "tags", "max-depth", "start-block-id", "end-block-id", "version", "password"} {
+	for _, flagName := range []string{"scope", "tags", "max-depth", "start-block-id", "end-block-id"} {
 		if parameters[flagName]["required"] != false {
 			t.Fatalf("doc read --%s required = %#v, want false", flagName, parameters[flagName]["required"])
 		}
@@ -315,15 +315,6 @@ func TestDeliveryCatalogDocReadParamDeclsMatchMergeBaseContract(t *testing.T) {
 	if parameters["max-depth"]["type"] != "integer" {
 		t.Fatalf("doc read --max-depth type = %#v, want integer", parameters["max-depth"]["type"])
 	}
-	if got := parameters["version"]["property"]; got != "historyVersion" {
-		t.Fatalf("doc read --version property = %#v, want historyVersion", got)
-	}
-	if parameters["version"]["type"] != "integer" {
-		t.Fatalf("doc read --version type = %#v, want integer", parameters["version"]["type"])
-	}
-	if got := parameters["password"]["property"]; got != "password" {
-		t.Fatalf("doc read --password property = %#v, want password", got)
-	}
 }

 func TestDeliveryCatalogDocCommentParamDeclsMatchMergeBaseContract(t *testing.T) {
@@ -76,7 +76,6 @@ var reviewedRuntimeSchemaExclusionGroups = []runtimeSchemaExclusionGroup{
 			"agoal scorecard detail",
 			"agoal scorecard entity-detail",
 			"agoal scorecard update",
-			"agoal scorecard search-entities",
 			"agoal strategy detail",
 			"agoal strategy list",
 			"agoal strategy update",
@@ -96,14 +96,7 @@ func init() {
 	registerRequireOneOf("sheet.update_cond_format", "ranges", "condition", "cell-style", "data-bar-style")
 	registerRequireOneOf("sheet.update_dimension", "hidden", "pixel-size")
 	registerRequireOneOf("sheet.update_filter_view", "name", "range", "criteria")
-	RegisterRuntimeSchemaConstraints("sheet.create_float_image", RuntimeSchemaConstraints{
-		MutuallyExclusive: [][]string{{"file", "src"}},
-		RequireOneOf:      [][]string{{"file", "src"}},
-	})
-	RegisterRuntimeSchemaConstraints("sheet.update_float_image", RuntimeSchemaConstraints{
-		MutuallyExclusive: [][]string{{"file", "src"}},
-		RequireOneOf:      [][]string{{"file", "src", "range", "width", "height", "offset-x", "offset-y"}},
-	})
+	registerRequireOneOf("sheet.update_float_image", "src", "range", "width", "height", "offset-x", "offset-y")
 	registerRequireOneOf("sheet.update_sheet", "name", "index", "hidden", "frozen-row-count", "frozen-column-count", "tab-color")
 	registerRequireOneOf("sheet.import", "folder-token", "workspace")
 	registerRequireOneOf("wiki.search_wikiSpaces", "query", "type")
@@ -60,6 +60,7 @@ type ToolSpec struct {
 	Constraints     RuntimeSchemaConstraints
 	Positionals     []contract.RuntimeSchemaPositional
 	DryRun          *contract.DryRunSpec
+	Wait            *contract.WaitSpec
 	Result          *contract.ResultSpec
 	Pagination      *contract.PaginationSpec
 	Safety          contract.SafetySpec
@@ -135,6 +136,7 @@ type RuntimeToolSpecInput struct {
 	Constraints     RuntimeSchemaConstraints
 	Positionals     []contract.RuntimeSchemaPositional
 	DryRun          *contract.DryRunSpec
+	Wait            *contract.WaitSpec
 	Result          *contract.ResultSpec
 	Pagination      *contract.PaginationSpec
 	Safety          contract.SafetySpec
@@ -542,6 +544,11 @@ func (t ToolSpec) Validate() error {
 			return err
 		}
 	}
+	if t.Wait != nil {
+		if err := t.Wait.Validate(id.CanonicalPath); err != nil {
+			return err
+		}
+	}
 	if t.Result != nil {
 		if _, err := contract.NormalizeResultSpec(t.Result, id.CanonicalPath); err != nil {
 			return err
@@ -744,6 +751,16 @@ func (t ToolSpec) normalized() ToolSpec {
 		dryRun.PreviewKind = strings.TrimSpace(dryRun.PreviewKind)
 		out.DryRun = &dryRun
 	}
+	if t.Wait != nil {
+		// NormalizeWaitSpec is the single canonical form shared with the
+		// declaration path: trimmed status values, duplicate/conflict
+		// rejection, defensive copy. Invalid declarations are rejected by
+		// ToolSpec.Validate below, which runs the same normalization
+		// through WaitSpec.Validate.
+		if wait, err := contract.NormalizeWaitSpec(t.Wait, id.CanonicalPath); err == nil {
+			out.Wait = wait
+		}
+	}
 	if t.Result != nil {
 		result, err := contract.NormalizeResultSpec(t.Result, id.CanonicalPath)
 		if err == nil {
@@ -982,6 +999,10 @@ func (t ToolSpec) ToPayload() (map[string]any, error) {
 		value, _ := typedJSONValue(t.DryRun)
 		payload["dry_run"] = value
 	}
+	if t.Wait != nil {
+		value, _ := typedJSONValue(t.Wait)
+		payload["wait"] = value
+	}
 	if t.Result != nil {
 		value, _ := typedJSONValue(t.Result)
 		payload["result"] = value
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
玉澜	8802dcf4dc	fix(corecmd): support strongly-typed DTOs in event/auto wait modes waitResource previously asserted result.Data() to map[string]any, which caused event mode and auto mode to fail with 'data is not an object' when commands returned strongly-typed DTOs (struct or struct pointer). Now normalizes via JSON round-trip for non-map types, preserving the fast path for map[string]any. Added regression tests covering struct values, struct pointers, nested dotted queries, and error cases.	2026-08-19 15:14:22 +08:00
玉澜	28bb377e66	fix: remove stale allowlist entry for drive_tree_list.py The file only exists in skills/mono/scripts/, not in skills/multi/, so the allowlist entry was causing TestMonoMultiSkillContentG4Drift to fail. The script is already referenced in both mono and multi documentation, so no allowlist entry is needed.	2026-08-19 15:02:54 +08:00
玉澜	a0fe8d70c2	Merge remote-tracking branch 'upstream/main' into feat/wait-framework	2026-08-19 14:29:57 +08:00
玉澜	4770e5a8e6	Merge remote-tracking branch 'upstream/main' into feat/wait-framework	2026-08-19 14:22:29 +08:00
玉澜	0bcc2f27c6	fix(corecmd): sync operation.state on terminal wait close and canonicalize wait statuses Terminal success/failure closes kept the acceptance-phase operation state, emitting self-contradicting envelopes (outcome=success with state=processing). WithOperationTerminalState now closes the envelope at the observed terminal status and clears timed_out. WaitSpec.Validate trimmed status values only for checking and never wrote them back, so padded declarations passed validation, published a padded Schema, and then fail-closed at runtime as unknown statuses. NormalizeWaitSpec is now the single canonical form shared by declaration (corecmd.New / AttachContract), ToolSpec, and validation: trimmed values, duplicate/conflict rejection, defensive copy. Also covers the waitTimeoutDuration secs<=0 branch flagged by the coverage gate.	2026-08-19 14:17:11 +08:00
john	0b3abfad4b	Merge branch 'main' into feat/wait-framework	2026-08-19 11:21:16 +08:00
玉澜	e625da4c27	fix(corecmd): reject overflowing --wait-timeout seconds int(secs)*time.Second can wrap a pflag-legal MaxInt64 into a non-positive duration, which skipped the wait deadline and waited forever. Convert with an overflow check and return a validation error instead.	2026-08-18 16:59:28 +08:00
玉澜	c68603fea0	fix(corecmd): wait only on pending and honor wait-timeout on leaf I/O Only a pending ResultInvoke envelope enters the wait phase, so success, failure, and partial results are returned unchanged. WaitPoll/WaitEvents now receive the --wait-timeout deadline (and Command().Context() is bound to the same loop context) so a blocked poll or subscribe cannot hang past the declared timeout. Also allowlist the leftover multi drive_tree_list.py orphan that broke CI after merging main.	2026-08-18 16:32:08 +08:00
john	f118a369b0	Merge branch 'main' into feat/wait-framework	2026-08-18 15:34:12 +08:00
玉澜	b7aa6bddf5	feat(corecmd): implement event and auto wait modes Completes the wait capability per review guidance ("add corresponding execution hooks and fallback tests for the modes"): - contract.WaitSpec restores event/auto modes with event_key, match_field, and a new resource_query (dotted path into the accepted result data yielding the identifier events correlate against); per-mode validation of required fields - internal/wait adds EventStream (leaf-owned transport) and RunEvent: correlated-event filtering, the same terminal/pending/unknown mapping as polling, timed-out pending on deadline during consumption, and an ErrEventStreamEnded sentinel distinguishing stream termination from fail-closed status errors - Spec.WaitEvents hook; validateWaitDecl pairs mode with hooks (poll<->WaitPoll, event<->WaitEvents, auto<->both; surplus hooks rejected too) - the wait phase runs event-first in auto mode and falls back to polling when the stream ends or the subscription fails, under one deadline spanning both phases; strict event mode surfaces stream errors - output.CommandResult gains Data() (deep copy) so the framework can resolve the resource identifier without exposing mutable state Changed-code coverage re-verified at 100% (CI cross-package recipe).	2026-08-15 19:29:22 +08:00
玉澜	64ad5f22b0	test(cli): cover Wait capability projection (validate/normalize/payload)	2026-08-15 18:53:48 +08:00
玉澜	c68207ad4b	fix(corecmd): CR feedback — poll-only wait, deadline-safe loop, ResultInvoke pairing Addresses the three P1 findings from review 4942891040: 1. event/auto modes were declared but always executed polls. WaitSpec now accepts poll only (event/auto fail validation with a not-implemented message); event_key/match_field dead fields removed. Event waiting will land with its own execution path and mode constant. 2. a deadline reached during the between-poll sleep re-polled with a cancelled context, so a context-aware poller surfaced its error as a poll failure instead of the contracted timed-out pending. The wait between polls now uses a timer + select on ctx.Done(), the deadline is checked before each poll, and a poll error on a cancelled context closes as timed-out pending with the last observed status. 3. legacy Invoke/Orchestrate/RunE commands declaring Wait observed a failure terminal while still exiting 0. validateWaitDecl now requires the ResultInvoke dispatcher (the only path whose unified envelope can be closed); the wait phase no longer wraps legacy paths. Also: dropped the unreachable nonPendingTerminal branch, simplified waitTimeoutSecs to the flag value (registration always seeds the reviewed default), and raised changed-code coverage to 100% (new wait-engine edge tests, output With* unit tests, contractfinal deep-copy coverage, AttachContract invalid-Wait panic path).	2026-08-15 18:16:24 +08:00
玉澜	4f57967c56	Merge remote-tracking branch 'upstream/main' into feat/wait-framework # Conflicts: # internal/corecmd/corecmd.go	2026-08-15 17:59:10 +08:00
玉澜	b49bc0ed14	feat(corecmd): add declarative Wait capability (Contract.Wait + wait phase) Framework-only: adds the reviewed wait contract mirroring the DryRunSpec pattern (types declaration -> ContractDecl -> ContractFinal -> ToolSpec -> Schema wait key). No business command declares it yet. - contract.WaitSpec (mode poll/event/auto, poll_command, status_query, terminal status->success/failure map, pending_values, event_key, match_field, default_timeout_secs) with closed-set Validate - Spec.WaitPoll hook pairs with the declaration at construction time (declared without hook / hook without declaration both panic) - declared leaves register --wait / --wait-timeout natively (never FlagSpec, so they cannot enter MCP toolArgs); undeclared leaves reject the flags as unknown instead of ignoring them - internal/wait engine: immediate-first-poll, x1.5 backoff capped 30s, dotted status extraction, fail-closed on unknown status, timeout -> pending - ResultInvoke path closes the unified envelope: success terminal -> success, failure terminal -> failure with new wire-stable error.type "wait" (exit code 8, additive like partial=7), timeout -> pending + meta.operation.timed_out with last observed state (exit 0) - output.WithOutcome / WithErrorInfo / WithOperationTimedOut preserve envelope invariants (I2/I3, pending requires meta.operation) Verified: go test ./... green; check-generated-drift.sh ok (schema assembly deterministic, wire unchanged); check-schema-catalog.sh ok (27 products, 1121 tools).	2026-08-15 12:41:46 +08:00