[cloudQuant]

What & Why

Promote the accepted dev integration to master as v0.2.0.

This release candidate aligns backend/frontend package metadata, documents the Fincore 0.5 compatibility work, removes the mutation-capable local release path, and makes repository-root tests work in isolated Git worktrees.

How

• Started from remote dev and merged the current remote master history into release/v0.2.0 before validation.
• Kept the release candidate free of tag creation, GitHub Release creation, and registry publication.
• Replaced name-based repository-root assertions with stable repository markers.

Governance declaration

• 目标分支: master（release/v0.2.0 promotion）
• 风险等级: R3
• 测试证据: Backend full suite: 4778 passed, 129 skipped; frontend: 143 files / 1286 tests passed, typecheck and production build passed; governance contracts: 209 passed; release guard, Ruff, package-version and doc-link checks passed.

Release 清单

• Release 清单: v0.2.0; changelog: CHANGELOG.md; release notes: docs/explanation/RELEASE_NOTES_V0.2.0.md; validation is recorded above; rollback before merge is to close this PR, and rollback after merge is a revert of the master merge commit through a hotfix/master-* PR. Owner authorization in this Codex task on 2026-09-02 waives the two-independent-maintainer approval requirement for this single promotion; all technical CI checks remain required. No tag, GitHub Release, image publication, or Gitee update is included.

Test Plan

• /Users/yunjinqi/opt/anaconda3/bin/conda run -n base env PYTHONPATH=/tmp/codex-fincore-050 python -m pytest -q (src/backend): 4778 passed, 129 skipped
• npm run test -- --run: 143 files / 1286 tests passed
• npm run typecheck and npm run build: passed
• /Users/yunjinqi/opt/anaconda3/bin/conda run -n base python -m pytest -q scripts/ci/tests/...: 209 passed
• /Users/yunjinqi/opt/anaconda3/bin/conda run -n base python scripts/ci/check_doc_links.py: passed

i18n 变更清单

• zh-CN key 数量 (count): 0
• en-US key 数量 (count): 0
• 本 PR 新增 key (added):
  • 无
• 本 PR 删除 key (removed):
  • 无

Checklist

• Tests added/updated
• Documentation updated
• No secrets or credentials committed
• Technical CI is required before merge

[cloudQuant]

npm audit baseline refresh rationale

The v0.2.0 root package version changed src/frontend/package-lock.json, so its SHA-256 binding changed. This is an intentional lockfile-review refresh, not a security threshold exception.

• Exact v0.2.0 lockfile hash: ec0153d515f1fa7642ac1aa5f8d6b2ffacb9b0c3c6281c95d6ccb3547a91f2bd
• Reviewed command: npm audit --omit=dev --json
• Result: high=0, critical=0 (unchanged); 5 moderate findings remain out of this high/critical ratchet scope.
• Baseline was refreshed locally through the explicit ALLOW_BASELINE_UPDATE=1 guard, then revalidated with scripts/ci/npm_audit_ratchet.py.

An in-place dependency change is not applicable: the lockfile dependency graph did not introduce a high/critical regression; only the v0.2.0 root metadata changed the deliberately exact lockfile fingerprint.

The existing owner authorization waiver applies only to the stated two-maintainer approval requirement. All technical CI checks remain required.