PickDone 0.3.2

新增

• 「今日·实验」获得自己的模块开关（默认关）：此前它只挂在开发者模式总闸下，实验期开着开发者模式就无法单独隐藏实验室入口。门控逻辑抽取为纯函数并有单测守护；项目/习惯/依赖维持原有两层门不变。

修复

• 今日页：项目筛选现在对卡片视图同样生效（此前只影响列表与矩阵视图，工具栏显示筛选中而其他项目任务照常回流）；项目筛选下拉与行上徽标遵循项目模块开关；残留的 ?project= 深链不再布下无法清除的筛选。
• 依赖视图门控统一为两层门口径：项目页 deps 页签与编辑面板依赖行此前无视模块开关。
• 待办箱批量删除对周期任务改走与单条删除相同的范围确认弹窗（此前静默只删所选实例），并回归统一撤销出口。
• CLI edit --date 改期现在把主提醒重锚到新日期同时刻、附加提醒按天数差平移，与 App 行为一致——此前提醒静默留在旧日期、到点即成过去时。
• CLI 加固：project --deadline 与 edit --deadline 同词汇表；edit --reminder none 清除提醒；--date "" 走完整清空级联；batch --dry-run 有失败时退出码 2；文本模式 dry-run 不再打印 "[object Object]"。
• 更新链路：更新包下载完成即刻冲刷渲染端待写，安装器强杀应用不再跑赢退出冲刷窗口；预安装清理若无法关闭被锁定/提权的实例，会弹出可见双语提示并中止，而不是在下游静默失败。
• 稳定性：审计轮转归档改时间戳并修剪，App+CLI 并发轮转不再互删历史；损坏的 config.json 以 config.json.bad 保留证据，不再被默认值静默覆盖（此前窗口尺寸/语言/锁屏密码会在下一次写入时全部丢失）；数据库关闭后的二次 quit 不再广播死信冲刷；退出看门狗触发时若更新已就绪则走安装而非硬退绕过。
• 发版流水线：打包白名单闭包校验在 tag 构建同样执行（此前仅 CI 有，tag 可绕过依赖漂移的唯一防线）；门禁失败自动还原工作区、重跑即可；发布正文按 workflow 文件名与 git remote 解析仓库，替代硬编码名。

---

Added

• The Today Lab view gets its own module switch (default off): it previously hung on the developer-mode master switch alone, so leaving developer mode on from experiment reviews kept the lab entry permanently in the sidebar. The gate logic is extracted into a pure, unit-tested helper; projects/habit/deps keep their existing two-layer gates.

Fixed

• Today page: the project filter now also applies to the card/deck view (it previously affected only list and matrix, letting other projects' tasks flow back while the toolbar claimed otherwise); the project filter dropdown and row badges honor the projects module switch, and a stale ?project= deep link can no longer set an unremovable filter.
• Dependency-view gates unified to the two-layer doctrine: the project page's deps tab and the EditPanel dependency row previously ignored the module switch.
• Batch delete in the todo box now routes repeating tasks through the same scope confirmation as single delete (it used to silently delete only the picked instances) and goes through the unified undo exit.
• CLI edit --date rescheduling now re-anchors the main reminder to the new date (same time of day) and shifts extra reminders by the day delta, matching the app — previously reminders silently stayed on the old date and fired in the past.
• CLI hardening: project --deadline accepts the same date vocabulary as edit --deadline; edit --reminder none clears the reminder; --date "" takes the full clear cascade; batch --dry-run reports failures via exit code 2; text-mode dry-run no longer prints "[object Object]".
• Update flow: pending renderer writes are flushed as soon as an update finishes downloading, so the installer's forced app termination can no longer outrun the quit-flush window; a pre-install kill that cannot close a locked or elevated instance now shows a visible bilingual message and aborts instead of failing silently downstream.
• Reliability: audit rotation archives are timestamped and pruned so concurrent app+CLI rotation can no longer delete each other's history; a corrupted config.json is preserved as config.json.bad instead of being silently replaced by defaults (which used to wipe window bounds, locale and the lock password on the next write); a failed second-pass quit no longer broadcasts a dead-letter flush after the database is closed; the quit watchdog now installs a ready update instead of hard-exiting past it.
• Release pipeline: the packaging whitelist closure check now also runs on tag builds (it was CI-only, letting a tag bypass the only guard against dependency drift); a failed gate run restores the working tree so the release can simply be re-run; release notes lookup matches the workflow by file and the repository by git remote instead of hardcoded names.