[IsaacHuo]

Prepare 0.1.0-alpha.1 after the data/permission gates in PR #12. VERSION, npm root/lock identity and OpenAPI metadata agree; API shapes, the dependency graph, SQLite version 1 and archive v1/v2 compatibility are unchanged. The dated changelog, bilingual startup instructions, security scope and third-party notices define a Windows-first metadata-research source preview with no installer or bundled runtime binaries.

Two candidate failures were repaired before merge:

• A Fandol font range failed certificate validation through the rotating CTAN endpoint. A fixed MIT CTAN mirror serves the same 4,947,904 bytes and existing SHA-256; TLS verification stays enabled. Real HTTPS verification and subsequent CI preparation/compilation passed.
• Concurrent upload callbacks appended to stale material selections, losing a selected input. They now merge with the latest conversation selection. The strengthened browser scenario holds both upload responses until both files exist: it failed before the fix and passed after, preserving selections through reload and run creation.

Windows validation (Node.js 24.19.0 / npm 11.17.0): check (57 tests), build, 13 browser scenarios, actionlint 1.7.12, Gitleaks 8.30.1, npm audit (zero vulnerabilities), identity/OpenAPI/dependency-graph/source-exclusion checks and whitespace checks passed. Typecheck/build and the full browser suite were repeated after the selection repair. Actual candidate source tar excludes research data, credentials, dependencies/build/test artifacts, local Skills/hooks, Supervisor-Skills and prepared TeX/fonts. No new live model calls; existing bundle-size advisories remain.

Merge only after exact-head required-checks and resolved reviews. Publish only after the exact main push CI and release dry-run pass, using the existing immutable-tag prerelease workflow.