迁移正式 Calcit 0.30.1，修复存档启动顺序并收敛依赖配置

.github/workflows/upload.yaml

@@ -27,6 +27,7 @@ jobs:
           deps-file: deps.cirru
       - name: Install dependencies
         run: |
+          set -euo pipefail
           corepack enable
           corepack prepare yarn@4.18.0 --activate
           caps --strict --ci
@@ -38,16 +39,21 @@ jobs:
           calcit edit format
           git diff --exit-code -- calcit.cirru
           calcit --check-only --all-defs --format json
-          calcit fix --workflow strict --verify --format json
+          calcit fix --workflow strict --verify --format json | jq -e '.data.workflow.status == "passed" and .diagnostics == []'
           calcit --check-only --ns app.config --ns app.main --ns app.schema --ns app.updater --ns app.util --ns app.comp.container --ns app.comp.showcase --summary-only --format json
           calcit analyze weak-types --ns-prefix app --only deprecated-call --summary-only --format json | jq -e '.data.summary.calls == 0'
           calcit analyze weak-types --only dynamic-method --summary-only --format json | jq -e '.data.summary.findings == 0'
           calcit test --require-match --summary-only --format json
       - name: Build frontend
         run: |
+          set -euo pipefail
           calcit js
-          yarn vite build --base="https://cos-sh.tiye.me/${GITHUB_REPOSITORY}/"
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+          base_url="https://cos-sh.tiye.me/${GITHUB_REPOSITORY}/"
+          if [[ "$GITHUB_EVENT_NAME" == "pull_request" ]]; then
+            base_url="./"
+          fi
+          yarn vite build --base="$base_url"
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: client-dist
           path: dist/
@@ -64,7 +70,7 @@ jobs:
       cancel-in-progress: false
       queue: max
     steps:
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: client-dist
           path: dist/

.yarnrc.yml

@@ -1,8 +1,4 @@
-approvedGitRepositories:
-  - "**"
-
-enableScripts: true
-
 nodeLinker: node-modules
 
-npmMinimalAgeGate: 0
+npmPreapprovedPackages:
+  - "@calcit/procs@0.30.1"

README.md

@@ -8,15 +8,15 @@ ClojureScript, beginners' home page
 
 ### Workflow
 
-The application uses paired Calcit / `@calcit/procs` 0.30.1-alpha.5, with stable
-module releases pinned in `deps.cirru`. Node.js 24 and Yarn 4.18.0 are used for
-the frontend build. `content/*.cljs` are displayed ClojureScript examples, not
-Calcit application source.
+使用者影响：应用使用精确配套正式 Calcit / `@calcit/procs` **0.30.1**，以及
+Respo 0.16.124、Reel 0.6.41、Markdown 0.4.59、UI 0.8.0、js-ffi 0.2.5
+（传递 Router 0.8.37），Node.js 24 / Yarn 4.18.0。升级后完整刷新，UI 0.8
+基础样式可能改变外观。`content/*.cljs` 是展示用 ClojureScript 示例，不是待迁移的 Calcit 应用源码。
 
-This is a 0.30.1 candidate migration, not a completed stable 0.30.1 release:
-the stable release currently has no CLI assets. Visitor navigation, the legacy
-saved Map format and random showcase selection are preserved. The header logo
-uses HTTPS at the same host/path, and site credits now name Calcit and Respo.
+原导航、展示内容、高亮、Map 存档字段与启动时随机展示选择保持不变。
+启动先读取并解码原存档，再渲染及注册保存监听；解析或解码失败时停止启动，不先注册
+可能覆盖原值的 `beforeunload`。不吞异常、不添加默认存档，也不把正常刷新验收称为
+全部损坏存档场景证明。Logo 继续使用原 HTTPS 地址。
 
 ```sh
 caps --strict --ci
@@ -39,15 +39,20 @@ when restored. Startup still chooses a random showcase, as before.
 
 CI checks all admitted definitions, the full strict workflow and all application public definitions,
 runs the two attached updater/hydration tests, and builds the frontend.
-Local acceptance also includes real browser rendering, code highlighting,
-showcase clicks, and refresh/hydration without runtime errors.
+旧 alpha.5 曾完成真实浏览器渲染、高亮、展示切换与刷新验收；这不替代本轮正式图的
+CI 和实际浏览器证据。保留已有两项 updater/hydration 测试，不新增验证脚本或预算。
+
+Yarn 恢复默认 Git 审批与包等待期，只预批准精确 `@calcit/procs@0.30.1`，不再
+通配批准任意 Git 仓库或关闭包等待期。
 
 Main/master deployment uploads frontend resources through
 `worktools/cos-upload-action` with built-in public checksum verification. The
 original server destination is unchanged. Repository deployment requires
 `COS_BUCKET`, `COS_SECRET_ID`, `COS_SECRET_KEY`, and `rsync_private_key`;
-no deployment secrets were listed during this migration. PR checks build
-without deployment credentials. Generated `js-out/` and `dist/` stay untracked.
+PR checks build without deployment credentials, using relative paths in the
+existing frontend artifact for local acceptance; production uses the original
+COS base. No secret availability or production success is inferred from PR CI.
+Generated `js-out/` and `dist/` stay untracked.
 
 ### License
 

deps.cirru

@@ -1,7 +1,7 @@
-{} (:calcit-version |0.30.1-alpha.5) (:version |0.1.0)
+{} (:calcit-version |0.30.1) (:version |0.1.0)
   :dependencies $ {}
-    |Respo/respo.calcit |0.16.122
-    |Respo/reel.calcit |0.6.39
-    |Respo/respo-markdown.calcit |0.4.56
-    |Respo/respo-ui.calcit |0.7.41
-    |calcit-lang/js-ffi |0.2.3
+    |Respo/respo.calcit |0.16.124
+    |Respo/reel.calcit |0.6.41
+    |Respo/respo-markdown.calcit |0.4.59
+    |Respo/respo-ui.calcit |0.8.0
+    |calcit-lang/js-ffi |0.2.5

package.json

@@ -21,7 +21,7 @@
     "vite": "8.3.1"
   },
   "dependencies": {
-    "@calcit/procs": "0.30.1-alpha.5",
+    "@calcit/procs": "0.30.1",
     "@calcit/std": "^0.0.2",
     "cirru-color": "^0.2.4",
     "copy-text-to-clipboard": "^3.2.2",