chore: switch to dev integration workflow

.changeset/README.md

@@ -6,4 +6,4 @@
 pnpm changeset
 ```
 
-合并到主分支后，Release workflow 会创建 Version PR；只有 Changesets 生成的 `changeset-release/<branch>` PR 合并后才允许自动发布受影响的 `@biugle/*` 包。不要手工改包版本号来触发发布。
+日常 Changeset 随功能 Pull Request 合入 `dev`，发布时再通过审核的 `dev` → `main` Pull Request 晋级。只有 Changesets 生成的 `changeset-release/main` PR 合并后才允许自动发布受影响的 `@biugle/*` 包。不要手工改包版本号来触发发布。

.github/workflows/codeql.yml

@@ -2,7 +2,7 @@ name: CodeQL
 
 on:
   push:
-    branches: ["main", "master"]
+    branches: ["main", "dev"]
   pull_request:
   schedule:
     - cron: "23 5 * * 1"

.github/workflows/release.yml

@@ -2,7 +2,7 @@ name: Release packages
 
 on:
   push:
-    branches: ["main", "master"]
+    branches: ["main"]
 
 concurrency:
   group: biu-release-${{ github.ref }}

docs/en/final-delivery-review.md

@@ -197,9 +197,9 @@ Stable locale/option references and a real-mount regression now cover this loop,
 | `CHANGESETS_GITHUB_TOKEN` | Least-privilege GitHub token allowing generated Release PRs to trigger required CI | Configure when Release PRs require CI and verify those checks actually appear; do not reuse the npm token           |
 | `GITHUB_TOKEN`            | Automatically supplied workflow token                                              | Do not create a same-name Secret manually; PRs created with this token do not automatically trigger other workflows |
 
-npm path: feature PR/Changeset → complete main gate → Version PR → reviewed Release PR merge → origin validation → publish affected packages only. Validation checks the merged same-repository `changeset-release/<branch>` PR, base branch, fixed title and associated commit; API failures fail closed.
+npm path: feature PR/Changeset → dev integration → reviewed dev → main promotion → complete main gate → Version PR → reviewed Release PR merge → origin validation → publish affected packages only. Validation checks the merged same-repository `changeset-release/main` PR, base branch, fixed title and associated commit; API failures fail closed.
 
-Vercel path: each Portal/APP Project builds and deploys independently through native Git integration. The npm guard does not block Vercel main deployments; manual `deploy-demo.yml` uploads acceptance artifacts without calling Vercel CLI. A deployment owner must verify the six Projects' domains, Production Branch and build settings. See [Release](release.md) and [Vercel deployment](vercel-deploy.md).
+Vercel path: each Portal/APP Project builds and deploys independently through native Git integration, with dev for Preview and main for Production. Manual `deploy-demo.yml` uploads acceptance artifacts without calling Vercel CLI. A deployment owner must verify the six Projects' domains, branch and build settings. See [Release](release.md) and [Vercel deployment](vercel-deploy.md).
 
 ## Optimization priorities and outstanding work
 

docs/en/release.md

@@ -11,15 +11,17 @@ pnpm changeset
 pnpm verify
 ```
 
-Developers commit a Changeset instead of running versioning manually or editing package versions and changelogs. Merge the Changeset with the feature through a normal Pull Request into protected `main`; the Release workflow then creates a Version PR. After that Release PR is merged, the publish workflow verifies its origin, runs the full gate and publishes only the affected packages.
+Developers commit a Changeset instead of running versioning manually or editing package versions and changelogs. Feature Pull Requests target `dev`, the shared integration branch. When a release is ready, open a reviewed `dev` → `main` Pull Request; only protected `main` is a production and npm release source. After that merge, the Release workflow creates a Version PR. When the Version PR is merged, the publish workflow verifies its origin, runs the full gate and publishes only the affected packages.
 
 ### Complete GitHub Actions release flow
 
 The workflow is `.github/workflows/release.yml`:
 
 ```text
 Developer opens a Pull Request containing .changeset/*.md
-        ↓ review and merge into protected main
+        ↓ review and merge into dev
+Release manager opens and reviews a dev → main Pull Request
+        ↓ merge into protected main
 Actions installs dependencies and runs changesets/action
         ↓
 Creates or updates changeset-release/main
@@ -35,11 +37,11 @@ Only a verified release merge runs changeset publish
 Publishes affected @biugle/* packages
 ```
 
-`pnpm release:publish` runs `scripts/release-publish.mjs`, which calls `scripts/verify-release-origin.mjs` before publishing. The verifier uses the GitHub API to check that the current SHA is associated with a merged same-repository `changeset-release/<branch>` PR, and validates its base branch, fixed `chore: release packages` title and source branch. It does not depend on the PR creator's account, so both the default `GITHUB_TOKEN` and a `CHANGESETS_GITHUB_TOKEN` PAT are supported. Normal main pushes, manual version edits and ordinary feature PR merges skip successfully without running `changeset publish`; GitHub verification errors fail closed. Only a verified release PR merge publishes. Isolated API tests for this flow run as part of `pnpm verify`. The guard protects npm publishing only; Vercel Git integration can still deploy pushes to `main` according to each Vercel Project's settings, so the branch must also be protected.
+`pnpm release:publish` runs `scripts/release-publish.mjs`, which calls `scripts/verify-release-origin.mjs` before publishing. The verifier uses the GitHub API to check that the current SHA is associated with a merged same-repository `changeset-release/<branch>` PR, and validates its base branch, fixed `chore: release packages` title and source branch. It does not depend on the PR creator's account, so both the default `GITHUB_TOKEN` and a `CHANGESETS_GITHUB_TOKEN` PAT are supported. Normal dev/main pushes, manual version edits and ordinary feature PR merges skip successfully without running `changeset publish`; GitHub verification errors fail closed. Only a verified main release PR merge publishes. Isolated API tests for this flow run as part of `pnpm verify`. Vercel should use `dev` for Preview and `main` for Production.
 
 Branch protection cannot be changed by a repository file and must be enabled by a GitHub repository administrator. Create a ruleset requiring Pull Requests and the `CI / validate` check, blocking force pushes and branch deletion, and limiting bypass actors. Changesets Action defaults to `GITHUB_TOKEN`; GitHub does not start other workflows for PR events created by that token. To require CI on generated Release PRs, set a least-privilege fine-grained PAT as `CHANGESETS_GITHUB_TOKEN`; the workflow prefers it and falls back to the automatic token when unset. Verify that the bot PR receives the required check before enforcing the rule. Do not use the npm token as a GitHub token.
 
-The repository must allow workflows to create pull requests and protect `main`:
+The repository must allow workflows to create pull requests and protect `main`; `dev` should also require Pull Requests and CI:
 
 ```text
 Settings → Actions → General
@@ -63,7 +65,7 @@ Required Repository Secret:
 
 Keep `NPM_GIT_BIUGLE` only in GitHub Actions Secrets. Never place it in the repository, Vercel environment variables, `.npmrc` or logs. If the npm organization requires 2FA, use a token suitable for automated publishing.
 
-After the Release PR is merged, `changeset-release/main` is a one-off release branch. GitHub can delete it automatically when automatic head-branch deletion is enabled; otherwise it can be deleted manually. This does not affect future Changesets releases.
+After the Release PR is merged, `changeset-release/main` is a one-off release branch. GitHub can delete it automatically when automatic head-branch deletion is enabled; otherwise it can be deleted manually. This does not affect future Changesets releases. After the Version PR is merged and published, open a `main` → `dev` Pull Request to sync generated versions, changelogs and the lockfile so a later `dev` → `main` promotion cannot overwrite released version metadata.
 
 If Actions fails before creating the PR, fix the permission and rerun the failed job. If `changeset-release/main` already exists, reuse it and do not run `pnpm version-packages` again.
 
@@ -75,16 +77,16 @@ Runtime establishes a manifest baseline at startup and checks once on user actio
 
 ## CI and Vercel
 
-| Workflow                        | Trigger                                   | Responsibility                                                                  | Timeout    |
-| ------------------------------- | ----------------------------------------- | ------------------------------------------------------------------------------- | ---------- |
-| CI                              | Pull Request                              | Complete `pnpm verify` gate for merge checks                                    | 30 minutes |
-| Release packages                | main/master push                          | Complete gate, Version PR and origin-verified npm publishing                    | 45 minutes |
-| CodeQL                          | Pull Request, main/master push and weekly | JS/TS security analysis without installing or building the project              | 20 minutes |
-| Build demo acceptance artifacts | Manual `workflow_dispatch`                | Downloadable builds of all six Demos; seven-day retention; missing output fails | 30 minutes |
+| Workflow                        | Trigger                                | Responsibility                                                                  | Timeout    |
+| ------------------------------- | -------------------------------------- | ------------------------------------------------------------------------------- | ---------- |
+| CI                              | Pull Request                           | Complete `pnpm verify` gate for merge checks                                    | 30 minutes |
+| Release packages                | main push                              | Complete gate, Version PR and origin-verified npm publishing                    | 45 minutes |
+| CodeQL                          | Pull Request, main/dev push and weekly | JavaScript and TypeScript security analysis without installing or building      | 20 minutes |
+| Build demo acceptance artifacts | Manual `workflow_dispatch`             | Downloadable builds of all six Demos; seven-day retention; missing output fails | 30 minutes |
 
 CI and CodeQL cancel superseded runs on the same ref. Release uses `queue: max` with `cancel-in-progress: false` to retain up to 100 pending runs in each branch's concurrency group without canceling an in-progress publication. Later ordinary pushes do not replace a queued Release PR merge run. A full queue cancels new runs. Execution follows the time each run enters the concurrency waiting queue; global workflow dispatch FIFO is not guaranteed. See [GitHub concurrency controls](https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/control-workflow-concurrency).
 
-After the frozen-lockfile install, CI runs `pnpm verify` on Pull Requests: foundation and Demo type checks, public-package tarball/export checks, tests, ESLint, Prettier, Knip, a production dependency audit, 100 CLI create inputs, seven Portal/APP preset and environment builds, and all six Demo builds. The Release workflow runs the same verification on main pushes before Changesets; ordinary pushes skip npm publishing, and only a release PR merge that passes origin verification runs `changeset publish`. The Demo workflow is manual-only and uploads Portal A/B, React/Vue/HTML APPs and Custom React acceptance artifacts for seven days. The Release gate already builds all six Demos on main/master pushes, so a second automatic build is unnecessary. Vercel deployment uses native Git integration; `NPM_GIT_BIUGLE` is required only for npm publishing.
+After the frozen-lockfile install, CI runs `pnpm verify` on Pull Requests: foundation and Demo type checks, public-package tarball/export checks, tests, ESLint, Prettier, Knip, a production dependency audit, 100 CLI create inputs, seven Portal/APP preset and environment builds, and all six Demo builds. The Release workflow runs the same verification on main pushes before Changesets; ordinary pushes skip npm publishing, and only a release PR merge that passes origin verification runs `changeset publish`. The Demo workflow is manual-only and uploads Portal A/B, React/Vue/HTML APPs and Custom React acceptance artifacts for seven days. The Release gate already builds all six Demos on main pushes, so a second automatic build is unnecessary. Vercel deployment uses native Git integration; `NPM_GIT_BIUGLE` is required only for npm publishing.
 
 Required repository secrets:
 
@@ -107,7 +109,7 @@ Recommended Demo project and domain mapping:
 | `biu-html-app`   | `biu-html.biugle.cn`   | `html-child`    |
 | `biu-custom-app` | `biu-custom.biugle.cn` | `layout-custom` |
 
-Before enabling release automation, make sure the repository has an initial `main` commit, Actions are enabled, and the protected branch requires the CI `validate` job. The current `.github/dependabot.yml` combines routine npm and GitHub Actions version updates into one weekly batch, with at most one open version-update PR. GitHub security updates remain on their separate security-fix path. Dependabot PRs still run CI and CodeQL, while Vercel skips their Preview builds. Other recommended repository controls include secret scanning with push protection and npm trusted publishing/provenance.
+Before enabling release automation, make sure the repository has an initial `main` commit, a `dev` integration branch, Actions enabled, and protected branches requiring the CI `validate` job. Dependabot has been removed; maintainers update dependencies through reviewed Pull Requests into `dev`. Other recommended repository controls include secret scanning with push protection and npm trusted publishing/provenance.
 
 ## Release checklist
 

docs/en/vercel-deploy.md

@@ -8,7 +8,7 @@ Repository:
 git@github.com:biugle/biu.git
 ```
 
-Use Vercel's native Git integration. Regular Pull Requests get Preview deployments, and pushes to `main` create Production deployments. Dependabot PR events still reach Vercel, but the root `vercel.json` marks their Preview builds as ignored before build and deploy steps run. No `VERCEL_TOKEN`, `VERCEL_ORG_ID` or npm token is needed by Vercel.
+Use Vercel's native Git integration. Pull Requests and pushes for `dev` create Preview deployments, and pushes to `main` create Production deployments. No `VERCEL_TOKEN`, `VERCEL_ORG_ID` or npm token is needed by Vercel.
 
 ## Projects
 
@@ -52,7 +52,7 @@ The 2026-10-25 live check found that this correction had not been deployed at th
 
 Add each domain under `Settings → Domains`, then create the CNAME record shown by Vercel at your DNS provider. The target is commonly `cname.vercel-dns.com`, but the Vercel-provided value is authoritative.
 
-After configuring the six Projects, merge changes through reviewed Pull Requests into protected `main`. Vercel deploys all six Projects after the merge and creates Preview deployments for regular Pull Requests. The root `vercel.json` `ignoreCommand` skips only Preview builds authored by `dependabot[bot]`; Vercel still receives the PR event and evaluates the ignore command, but does not build or publish that Preview. GitHub CI and CodeQL still run for those PRs, and Production builds after merging to `main` are not skipped. `pnpm verify:vercel-routing` covers these deployment cases. Do not push directly to `main` or configure a second Vercel CLI deployment for the same Project. `deploy-demo.yml` only builds and uploads acceptance artifacts when manually dispatched; they expire after seven days. The Release gate already builds all Demos on main/master pushes.
+After configuring the six Projects, merge reviewed Pull Requests into protected `dev`; Vercel creates Preview deployments there. Promote `dev` to protected `main` through a reviewed Pull Request for Production deployment. `pnpm verify:vercel-routing` covers asset routing. Do not push directly to `main` or configure a second Vercel CLI deployment for the same Project. `deploy-demo.yml` only builds and uploads acceptance artifacts when manually dispatched; they expire after seven days. The Release gate already builds all Demos on main pushes.
 
 ## Production checks
 

docs/final-delivery-review.md

@@ -197,9 +197,9 @@ main-a 中英文资源各 3411 条，英文资源从本轮基线 2742 条增至
 | `CHANGESETS_GITHUB_TOKEN` | 最小权限 GitHub token，让生成的 Release PR 触发 required CI | Release PR 需要 CI 时配置并验证检查实际产生；不得复用 npm token         |
 | `GITHUB_TOKEN`            | GitHub 自动提供的 workflow token                            | 不手工建立同名 Secret；默认 token 创建的 PR 不自动触发其他 workflow     |
 
-npm 链路：功能 PR/Changeset → main 的完整门禁 → Version PR → 评审合并 Release PR → 来源校验 → 仅发布受影响包。校验同仓库、已合并 `changeset-release/<branch>` PR、base branch、固定标题和提交关联；API 验证失败关闭。
+npm 链路：功能 PR/Changeset → dev 集成 → 审核 dev → main → main 完整门禁 → Version PR → 评审合并 Release PR → 来源校验 → 仅发布受影响包。校验同仓库、已合并 `changeset-release/main` PR、base branch、固定标题和提交关联；API 验证失败关闭。
 
-Vercel 链路：每个 Portal/APP Project 的原生 Git 集成独立构建部署。npm guard 不阻止 Vercel 部署 main；手动 `deploy-demo.yml` 只上传验收 artifact，不调用 Vercel CLI。六个 Project 的域名、Production Branch 和构建配置需由部署负责人核验。操作步骤见[发布手册](release.md)与[Vercel 指南](vercel-deploy.md)。
+Vercel 链路：每个 Portal/APP Project 的原生 Git 集成独立构建部署，dev 提供 Preview，main 部署 Production；手动 `deploy-demo.yml` 只上传验收 artifact，不调用 Vercel CLI。六个 Project 的域名、分支和构建配置需由部署负责人核验。操作步骤见[发布手册](release.md)与[Vercel 指南](vercel-deploy.md)。
 
 ## 优化优先级与未闭环清单