docs: remove lark doc workflows

Change-Id: I7d36543f090ebbb42c945667ad25534273a5c305
2026-07-03 22:24:31 +08:00 · 2026-06-25 14:25:03 +08:00
211 changed files with 1094 additions and 16689 deletions
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,7 +5,6 @@ on:
    branches: [main]
  pull_request:
    branches: [main]
-    types: [opened, synchronize, reopened, edited]
  workflow_dispatch:

 permissions:
@@ -71,7 +70,6 @@ jobs:
      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
        with:
          fetch-depth: 0
-          persist-credentials: false
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
        with:
          go-version-file: go.mod
@@ -89,23 +87,6 @@ jobs:
      - name: Run errs/ lint guards (lintcheck)
        run: go run -C lint . --changed-from "$QUALITY_GATE_CHANGED_FROM" ..

-  script-test:
-    needs: fast-gate
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
-        with:
-          go-version-file: go.mod
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: '22'
-      - name: Run script tests
-        run: make script-test
-
  deterministic-gate:
    needs: fast-gate
    runs-on: ubuntu-latest
@@ -128,28 +109,8 @@ jobs:
        env:
          QUALITY_GATE_CHANGED_FROM: ${{ github.event.pull_request.base.sha || github.event.before || 'origin/main' }}
        run: echo "QUALITY_GATE_CHANGED_FROM=$(bash scripts/resolve-changed-from.sh)" >> "$GITHUB_ENV"
-      - name: Write public content metadata
-        if: ${{ github.event_name == 'pull_request' }}
-        env:
-          PR_TITLE: ${{ github.event.pull_request.title }}
-          PR_BODY: ${{ github.event.pull_request.body }}
-          PR_BRANCH: ${{ github.head_ref }}
-        run: |
-          mkdir -p .tmp/quality-gate
-          python3 - <<'PY'
-          import json
-          import os
-
-          with open(".tmp/quality-gate/public-content-metadata.json", "w", encoding="utf-8") as f:
-              json.dump({
-                  "title": os.environ.get("PR_TITLE", ""),
-                  "body": os.environ.get("PR_BODY", ""),
-                  "branch": os.environ.get("PR_BRANCH", ""),
-              }, f)
-              f.write("\n")
-          PY
      - name: Run CLI deterministic gate
-        run: PUBLIC_CONTENT_METADATA=.tmp/quality-gate/public-content-metadata.json make quality-gate
+        run: make quality-gate
      - name: Upload quality gate facts
        if: ${{ always() && github.event_name == 'pull_request' }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
@@ -259,7 +220,7 @@ jobs:

  # ── Layer 3: E2E Gate ──────────────────────────────────────────────
  e2e-dry-run:
-    needs: [unit-test, lint, script-test, deterministic-gate]
+    needs: [unit-test, lint, deterministic-gate]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
@@ -280,7 +241,7 @@ jobs:
        run: go test -v -count=1 -timeout=5m ./tests/cli_e2e/... -run 'DryRun|Regression'

  e2e-live:
-    needs: [unit-test, lint, script-test, deterministic-gate]
+    needs: [unit-test, lint, deterministic-gate]
    if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork }}
    runs-on: ubuntu-latest
    permissions:
@@ -372,7 +333,7 @@ jobs:
  # ── Results Gate (single required check for branch protection) ─────
  results:
    if: ${{ always() }}
-    needs: [fast-gate, unit-test, lint, script-test, deterministic-gate, coverage, deadcode, e2e-dry-run, e2e-live, security, license-header]
+    needs: [fast-gate, unit-test, lint, deterministic-gate, coverage, deadcode, e2e-dry-run, e2e-live, security, license-header]
    runs-on: ubuntu-latest
    steps:
      - name: Evaluate results
@@ -384,7 +345,6 @@ jobs:
          echo "| L1 | fast-gate | ${{ needs.fast-gate.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| L2 | unit-test | ${{ needs.unit-test.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| L2 | lint | ${{ needs.lint.result }} |" >> $GITHUB_STEP_SUMMARY
-          echo "| L2 | script-test | ${{ needs.script-test.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| L2 | deterministic-gate | ${{ needs.deterministic-gate.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| L2 | coverage | ${{ needs.coverage.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| L2 | deadcode | ${{ needs.deadcode.result }} |" >> $GITHUB_STEP_SUMMARY
@@ -401,7 +361,6 @@ jobs:
            "${{ needs.fast-gate.result }}" \
            "${{ needs.unit-test.result }}" \
            "${{ needs.lint.result }}" \
-            "${{ needs.script-test.result }}" \
            "${{ needs.deterministic-gate.result }}" \
            "${{ needs.coverage.result }}" \
            "${{ needs.deadcode.result }}" \
--- a/.github/workflows/comment-audit.yml
+++ b/.github/workflows/comment-audit.yml
@@ -1,28 +0,0 @@
-name: Comment Audit
-
-on:
-  issue_comment:
-    types: [created, edited]
-  pull_request_review:
-    types: [submitted, edited]
-  pull_request_review_comment:
-    types: [created, edited]
-
-permissions:
-  contents: read
-
-jobs:
-  public-content-comment-audit:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-        with:
-          persist-credentials: false
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
-        with:
-          go-version-file: go.mod
-      - name: Post-publication comment audit
-        run: |
-          mkdir -p .tmp/comment-audit
-          cp "$GITHUB_EVENT_PATH" .tmp/comment-audit/event.json
-          go run ./internal/qualitygate/cmd/comment-audit --event .tmp/comment-audit/event.json --kind "$GITHUB_EVENT_NAME"
--- a/.github/workflows/semantic-review.yml
+++ b/.github/workflows/semantic-review.yml
@@ -88,44 +88,31 @@ jobs:
                commit_sha: targetHeadSha,
              });
              const candidatePRs = associatedPRs.filter((candidate) =>
+                candidate.state === "open" &&
                candidate.base?.repo?.id === context.payload.repository.id &&
                candidate.head?.sha === targetHeadSha
              );
-              const openCandidatePRs = candidatePRs.filter((candidate) => candidate.state === "open");
-              if (openCandidatePRs.length > 1) {
-                throw new Error(`ambiguous open PRs for workflow_run head ${targetHeadSha}: ${openCandidatePRs.length}`);
+              if (candidatePRs.length > 1) {
+                throw new Error(`ambiguous open PRs for workflow_run head ${targetHeadSha}: ${candidatePRs.length}`);
              }
-              if (openCandidatePRs.length === 1) {
-                prNumber = openCandidatePRs[0].number;
-              } else if (candidatePRs.length > 0) {
-                core.notice("PR quality summary skipped: workflow_run target PR is no longer open");
-                core.setOutput("stale", "true");
-                return;
+              if (candidatePRs.length === 1) {
+                prNumber = candidatePRs[0].number;
              }
            }
            if (!prNumber) {
              const candidatePRs = await github.paginate(github.rest.pulls.list, {
                owner: context.repo.owner,
                repo: context.repo.repo,
-                state: "all",
+                state: "open",
                per_page: 100,
              }).then((prs) => prs.filter((candidate) =>
                candidate.base?.repo?.id === context.payload.repository.id &&
                candidate.head?.sha === targetHeadSha
              ));
-              const openCandidatePRs = candidatePRs.filter((candidate) => candidate.state === "open");
-              if (openCandidatePRs.length > 1) {
-                throw new Error(`ambiguous open PRs from pull list fallback for workflow_run head ${targetHeadSha}: ${openCandidatePRs.length}`);
-              }
-              if (openCandidatePRs.length === 1) {
-                prNumber = openCandidatePRs[0].number;
-              } else if (candidatePRs.length > 0) {
-                core.notice("PR quality summary skipped: workflow_run target PR is no longer open");
-                core.setOutput("stale", "true");
-                return;
-              } else {
+              if (candidatePRs.length !== 1) {
                throw new Error(`expected one open PR from pull list fallback for workflow_run head ${targetHeadSha}, got ${candidatePRs.length}`);
              }
+              prNumber = candidatePRs[0].number;
            }
            if (!Number.isInteger(prNumber) || prNumber <= 0) throw new Error("missing pull request binding");
            const { data: pr } = await github.rest.pulls.get({
@@ -134,11 +121,6 @@ jobs:
              pull_number: prNumber,
            });
            if (pr.base.repo.id !== context.payload.repository.id) throw new Error("PR base repo mismatch");
-            if (pr.state !== "open") {
-              core.notice("PR quality summary skipped: workflow_run target PR is no longer open");
-              core.setOutput("stale", "true");
-              return;
-            }
            if (pr.head.sha !== targetHeadSha) {
              core.notice("PR quality summary skipped: workflow_run is stale for this PR head");
              core.setOutput("stale", "true");
@@ -317,44 +299,31 @@ jobs:
                commit_sha: targetHeadSha,
              });
              const candidatePRs = associatedPRs.filter((candidate) =>
+                candidate.state === "open" &&
                candidate.base?.repo?.id === context.payload.repository.id &&
                candidate.head?.sha === targetHeadSha
              );
-              const openCandidatePRs = candidatePRs.filter((candidate) => candidate.state === "open");
-              if (openCandidatePRs.length > 1) {
-                throw new Error(`ambiguous open PRs for workflow_run head ${targetHeadSha}: ${openCandidatePRs.length}`);
+              if (candidatePRs.length > 1) {
+                throw new Error(`ambiguous open PRs for workflow_run head ${targetHeadSha}: ${candidatePRs.length}`);
              }
-              if (openCandidatePRs.length === 1) {
-                prNumber = openCandidatePRs[0].number;
-              } else if (candidatePRs.length > 0) {
-                core.notice("semantic review skipped: workflow_run target PR is no longer open");
-                core.setOutput("stale", "true");
-                return;
+              if (candidatePRs.length === 1) {
+                prNumber = candidatePRs[0].number;
              }
            }
            if (!prNumber) {
              const candidatePRs = await github.paginate(github.rest.pulls.list, {
                owner: context.repo.owner,
                repo: context.repo.repo,
-                state: "all",
+                state: "open",
                per_page: 100,
              }).then((prs) => prs.filter((candidate) =>
                candidate.base?.repo?.id === context.payload.repository.id &&
                candidate.head?.sha === targetHeadSha
              ));
-              const openCandidatePRs = candidatePRs.filter((candidate) => candidate.state === "open");
-              if (openCandidatePRs.length > 1) {
-                throw new Error(`ambiguous open PRs from pull list fallback for workflow_run head ${targetHeadSha}: ${openCandidatePRs.length}`);
-              }
-              if (openCandidatePRs.length === 1) {
-                prNumber = openCandidatePRs[0].number;
-              } else if (candidatePRs.length > 0) {
-                core.notice("semantic review skipped: workflow_run target PR is no longer open");
-                core.setOutput("stale", "true");
-                return;
-              } else {
+              if (candidatePRs.length !== 1) {
                throw new Error(`expected one open PR from pull list fallback for workflow_run head ${targetHeadSha}, got ${candidatePRs.length}`);
              }
+              prNumber = candidatePRs[0].number;
            }
            if (!Number.isInteger(prNumber) || prNumber <= 0) throw new Error("missing pull request binding");
            const { data: pr } = await github.rest.pulls.get({
@@ -363,16 +332,6 @@ jobs:
              pull_number: prNumber,
            });
            if (pr.base.repo.id !== context.payload.repository.id) throw new Error("PR base repo mismatch");
-            if (pr.state !== "open") {
-              core.notice("semantic review skipped: workflow_run target PR is no longer open");
-              core.setOutput("stale", "true");
-              return;
-            }
-            if (!pr.head.repo) {
-              core.notice("semantic review skipped: workflow_run target PR head repository is unavailable");
-              core.setOutput("stale", "true");
-              return;
-            }
            if (pr.head.sha !== targetHeadSha) {
              core.notice("semantic review skipped: workflow_run is stale for this PR head");
              core.setOutput("stale", "true");
@@ -430,10 +389,6 @@ jobs:
              repo: context.repo.repo,
              pull_number: pr,
            });
-            if (pull.state !== "open") {
-              core.notice("semantic review skipped infrastructure failure check: PR is no longer open");
-              return;
-            }
            if (pull.head.sha !== headSha) {
              core.notice("semantic review skipped infrastructure failure check: PR head changed");
              return;
--- a/.gitignore
+++ b/.gitignore
@@ -51,4 +51,3 @@ app.log
 cover*.out

 lark-env.sh
-/automations/
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,69 +2,6 @@

 All notable changes to this project will be documented in this file.

-## [v1.0.60] - 2026-06-29
-
-### Features
-
- **affordance**: Per-command usage guidance system with markdown source (#1565)
- **event**: Support VC meeting lifecycle events (#1632)
- **sheets**: Use `office_sheet_file` parent_type for imported office spreadsheets (#1606)
- **authorization**: Expand lark-shared auth guidance and assert clean logout JSON (#1598)
- **transport**: Add `LARK_CLI_NO_PROXY_WARN` to silence proxy warning (#1647)
-
-### Bug Fixes
-
- **install**: Load `@clack/prompts` via dynamic import to avoid `ERR_REQUIRE_ESM` (#1652)
-
-### Tests
-
- **doc**: Derive fetch test flag defaults from `v2FetchFlags` (#1428)
-
-### Build
-
- **ci**: Reduce public content false positives
-
-## [v1.0.59] - 2026-06-26
-
-### Features
-
- **slides**: Add `+replace-pages` and `xml get` shortcuts, and expose the presentation URL (#1585)
- **minutes**: Support speaker list and no-Lark speaker replace (#1594)
- **calendar/vc/minutes**: Optimize and extend calendar, vc, minutes, and note shortcuts and skills (#1571)
-
-### Bug Fixes
-
- **docs**: Hide docs `api-version` compat flag (#1580)
-
-## [v1.0.58] - 2026-06-25
-
-### Features
-
- **sheets**: Typed table I/O and error contract, workbook import/export, and skill refresh (#1355)
- **base**: Add Base URL and title resolve shortcuts (#1338)
- **drive**: Add `+member-add` shortcut with wiki space member collection collaborator support (#1204)
- **doc**: Support `create` title option (#1536)
- **doc**: Add `im-markdown` output format for doc fetch (#1550)
- **whiteboard**: Export whiteboard as SVG and update whiteboard via SVG (#1559)
- **card**: Support `card.action.trigger` event with auto-fetched card content (#1528)
- **task**: Add task event consumer (#1510)
-
-### Bug Fixes
-
- **doc**: Prefix docs resource shortcuts (#1564)
- **binding**: Skip unix mode audit on Windows (#1525)
-
-### Documentation
-
- **approval**: Sync approval skill for meta API commands (#1499)
- **doc**: Restore lark-doc style requirements (#1579)
- **im**: Document `chat.nickname` get/update/delete (#1378)
- **im**: Clarify audio message opus requirement (#1271)
-
-### Build
-
- **ci**: Add public content safeguards and reduce false positives
-
 ## [v1.0.57] - 2026-06-23

 ### Features
@@ -1299,9 +1236,6 @@ Bundled AI agent skills for intelligent assistance:
 - Bilingual documentation (English & Chinese).
 - CI/CD pipelines: linting, testing, coverage reporting, and automated releases.

-[v1.0.60]: https://github.com/larksuite/cli/releases/tag/v1.0.60
-[v1.0.59]: https://github.com/larksuite/cli/releases/tag/v1.0.59
-[v1.0.58]: https://github.com/larksuite/cli/releases/tag/v1.0.58
 [v1.0.57]: https://github.com/larksuite/cli/releases/tag/v1.0.57
 [v1.0.56]: https://github.com/larksuite/cli/releases/tag/v1.0.56
 [v1.0.55]: https://github.com/larksuite/cli/releases/tag/v1.0.55
--- a/5
+++ b/5
@@ -12,7 +12,6 @@ QUALITY_GATE_DIR ?= .tmp/quality-gate
 QUALITY_GATE_MANIFEST_OUT ?= $(QUALITY_GATE_DIR)/command-manifest.json
 QUALITY_GATE_COMMAND_INDEX_OUT ?= $(QUALITY_GATE_DIR)/command-index.json
 QUALITY_GATE_FACTS_OUT ?= $(QUALITY_GATE_DIR)/facts.json
-PUBLIC_CONTENT_METADATA ?= $(QUALITY_GATE_DIR)/public-content-metadata.json
 LDFLAGS  := -s -w -X $(MODULE)/internal/build.Version=$(VERSION) -X $(MODULE)/internal/build.Date=$(DATE)
 PREFIX   ?= /usr/local

@@ -70,8 +69,7 @@ integration-test: build
 test: vet fmt-check script-test unit-test examples-build integration-test

 quality-gate: build
-	mkdir -p $(QUALITY_GATE_DIR) $(dir $(QUALITY_GATE_FACTS_OUT)) $(dir $(PUBLIC_CONTENT_METADATA))
-	test -f $(PUBLIC_CONTENT_METADATA) || printf '{}\n' > $(PUBLIC_CONTENT_METADATA)
+	mkdir -p $(QUALITY_GATE_DIR) $(dir $(QUALITY_GATE_FACTS_OUT))
 	LARKSUITE_CLI_REMOTE_META=off \
 	LARKSUITE_CLI_NO_UPDATE_NOTIFIER=1 \
 	LARKSUITE_CLI_NO_SKILLS_NOTIFIER=1 \
@@ -91,7 +89,6 @@ quality-gate: build
 		--changed-from $(QUALITY_GATE_CHANGED_FROM_RESOLVED) \
 		--manifest $(QUALITY_GATE_MANIFEST_OUT) \
 		--command-index $(QUALITY_GATE_COMMAND_INDEX_OUT) \
-		--public-content-metadata $(PUBLIC_CONTENT_METADATA) \
 		--facts-out $(QUALITY_GATE_FACTS_OUT)

 install: build
--- a/README.md
+++ b/README.md
@@ -198,7 +198,7 @@ Prefixed with `+`, designed to be friendly for both humans and AI, with smart de
 ```bash
 lark-cli calendar +agenda
 lark-cli im +messages-send --chat-id "oc_xxx" --text "Hello"
-lark-cli docs +create --doc-format markdown --content $'<title>Weekly Report</title>\n# Progress\n- Completed feature X'
+lark-cli docs +create --api-version v2 --doc-format markdown --content $'<title>Weekly Report</title>\n# Progress\n- Completed feature X'
 ```

 Run `lark-cli <service> --help` to see all shortcut commands.
--- a/README.zh.md
+++ b/README.zh.md
@@ -199,7 +199,7 @@ CLI 提供三种粒度的调用方式，覆盖从快速操作到完全自定义
 ```bash
 lark-cli calendar +agenda
 lark-cli im +messages-send --chat-id "oc_xxx" --text "Hello"
-lark-cli docs +create --doc-format markdown --content $'<title>周报</title>\n# 本周进展\n- 完成了 X 功能'
+lark-cli docs +create --api-version v2 --doc-format markdown --content $'<title>周报</title>\n# 本周进展\n- 完成了 X 功能'
 ```

 运行 `lark-cli <service> --help` 查看所有快捷命令。
--- a/affordance/README.md
+++ b/affordance/README.md
@@ -1,49 +0,0 @@
-# Affordance
-
-Per-command usage guidance for the CLI, authored as one markdown file per domain
-(`<service>.md`). It is surfaced in `lark-cli <command> --help` and in the
-`schema` output, and read directly at runtime (lazy, cached) — there is no build
-step. Maintain these files alongside `skills/` and `shortcuts/`.
-
-## Format
-
-A small, fixed markdown subset; each file describes one domain:
-
-    # <domain>            optional `> skill: <name>` applies to every command below
-    ## <command>          the command as typed, minus `lark-cli <domain>`
-    <lead paragraph>      when to use this command
-    ### Avoid when        when not to use it / which command to use instead
-    ### Prerequisites     what you must have first (e.g. an id, and where it comes from)
-    ### Tips              gotchas and constraints
-    ### Examples          **description** lines, each followed by a fenced command
-    ### <other heading>   a custom section; flows through verbatim
-
-Reference another command with `[[command]]` — it renders as `command` in help.
-Under `Avoid when` it means "use that one instead"; under `Prerequisites`
-("… from [[command]]") it means "get the input there first".
-
-## Example
-
-    ## messages get
-    Fetch the full content of a single message by id.
-
-    ### Avoid when
-    - Reading several at once → use [[messages batch_get]]
-
-    ### Prerequisites
-    - message_id from [[messages list]]
-
-    ### Examples
-
-    **Fetch one message**
-    ```bash
-    lark-cli mail user_mailbox.messages get --message-id "<id>"
-    ```
-
-## Notes
-
- Write plain prose; the only convention is wrapping command references in `[[ ]]`.
- Keep it concise and high-signal — don't restate field/flag names, id types, or
-  anything the schema and flags already show; the agent infers the rest.
- Command-form headings resolve to method ids via the registry, so plural resource
-  names (`messages`) map to the singular method id (`message`) automatically.
--- a/affordance/contact.md
+++ b/affordance/contact.md
@@ -1,19 +0,0 @@
-# contact
-> skill: lark-contact
-
-## user_profiles batch_query
-Bulk-fetch personal status and signature for user ids you already have.
-
-### Avoid when
- Need more than status/signature (name, dept, email), or don't have the open_id yet → use [[+search-user]]
-
-### Tips
- Off by default — set include_personal_status / include_description to true under query_option
- ids in user_ids must match --user-id-type (default open_id)
-
-### Examples
-
-**Bulk-query status and signature**
-```bash
-lark-cli contact user_profiles batch_query --data '{"user_ids":["ou_3a8b****6a7b"],"query_option":{"include_personal_status":true,"include_description":true}}'
-```
--- a/cmd/api/api.go
+++ b/cmd/api/api.go
@@ -67,21 +67,8 @@ func NewCmdApiWithContext(ctx context.Context, f *cmdutil.Factory, runF func(*AP

 	cmd := &cobra.Command{
 		Use:   "api <method> <path>",
-		Short: "Raw HTTP escape hatch — call any endpoint by path (fallback when no typed command exists)",
-		Long: `Raw HTTP escape hatch: send any Lark API request by HTTP method + path.
-
-Prefer the typed domain command when one exists — it validates parameters,
-shows the Risk level, gates destructive calls behind --yes, and carries usage
-guidance that this raw command does not. If a domain command covers your task
-(browse with ` + "`lark-cli <domain> --help`" + `), use it instead of this.
-
-Reach for ` + "`api`" + ` only for endpoints that have no typed command yet (e.g.
-newer/preview APIs), where you already have the HTTP path from the Lark docs.
-
-Examples:
-  lark-cli api GET /open-apis/calendar/v4/calendars
-  lark-cli api POST /open-apis/im/v1/messages --params '{"receive_id_type":"open_id"}' --data @body.json`,
-		Args: cobra.ExactArgs(2),
+		Short: "Generic Lark API requests",
+		Args:  cobra.ExactArgs(2),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			opts.Method = strings.ToUpper(args[0])
 			opts.Path = args[1]
--- a/cmd/build.go
+++ b/cmd/build.go
@@ -170,10 +170,6 @@ func buildInternal(ctx context.Context, inv cmdutil.InvocationContext, opts ...B
 	rootCmd.SetOut(cfg.streams.Out)
 	rootCmd.SetErr(cfg.streams.ErrOut)

-	// Root-only usage template (curated Usage synopsis + skills footer); see
-	// rootUsageTemplate.
-	rootCmd.SetUsageTemplate(rootUsageTemplate)
-
 	installTipsHelpFunc(rootCmd)
 	rootCmd.SilenceErrors = true
 	// SilenceUsage as a static field (not only in PersistentPreRun) so it also
@@ -209,8 +205,6 @@ func buildInternal(ctx context.Context, inv cmdutil.InvocationContext, opts ...B
 	}
 	shortcuts.RegisterShortcutsWithContext(ctx, rootCmd, f)

-	groupRootCommands(rootCmd)
-
 	installUnknownSubcommandGuard(rootCmd)

 	if mode := f.ResolveStrictMode(ctx); mode.IsActive() && !cfg.skipStrictMode {
--- a/cmd/event/list_test.go
+++ b/cmd/event/list_test.go
@@ -10,22 +10,10 @@ import (

 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
-	eventlib "github.com/larksuite/cli/internal/event"

 	_ "github.com/larksuite/cli/events"
 )

-func TestEventLookup_VCMeetingLifecycleKeys(t *testing.T) {
-	for _, key := range []string{
-		"vc.meeting.participant_meeting_started_v1",
-		"vc.meeting.participant_meeting_joined_v1",
-	} {
-		if _, ok := eventlib.Lookup(key); !ok {
-			t.Fatalf("event.Lookup(%q) should succeed", key)
-		}
-	}
-}
-
 func TestRunList_TextOutput(t *testing.T) {
 	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})

@@ -39,8 +27,6 @@ func TestRunList_TextOutput(t *testing.T) {
 		"im.message.receive_v1",
 		"im.message.message_read_v1",
 		"task.task.update_user_access_v2",
-		"vc.meeting.participant_meeting_started_v1",
-		"vc.meeting.participant_meeting_joined_v1",
 	} {
 		if !strings.Contains(out, want) {
 			t.Errorf("list output missing %q; full output:\n%s", want, out)
@@ -71,15 +57,9 @@ func TestRunList_JSONOutput(t *testing.T) {
 		}
 	}

-	gotKeys := map[string]map[string]interface{}{}
-	for _, row := range rows {
-		if key, ok := row["key"].(string); ok {
-			gotKeys[key] = row
-		}
-	}
 	var foundTask bool
-	for key, row := range gotKeys {
-		if key == "task.task.update_user_access_v2" {
+	for _, row := range rows {
+		if row["key"] == "task.task.update_user_access_v2" {
 			foundTask = true
 			if row["single_consumer"] != true {
 				t.Errorf("task row single_consumer = %v, want true", row["single_consumer"])
@@ -89,12 +69,4 @@ func TestRunList_JSONOutput(t *testing.T) {
 	if !foundTask {
 		t.Fatal("event list JSON missing task.task.update_user_access_v2")
 	}
-	for _, want := range []string{
-		"vc.meeting.participant_meeting_started_v1",
-		"vc.meeting.participant_meeting_joined_v1",
-	} {
-		if _, ok := gotKeys[want]; !ok {
-			t.Errorf("JSON list output missing %q", want)
-		}
-	}
 }
--- a/cmd/event/schema_test.go
+++ b/cmd/event/schema_test.go
@@ -124,45 +124,6 @@ func TestRunSchema_TaskUpdateUserAccessJSON(t *testing.T) {
 	}
 }

-func TestRunSchema_JSONOutput_VCMeetingLifecycleKeys(t *testing.T) {
-	for _, key := range []string{
-		"vc.meeting.participant_meeting_started_v1",
-		"vc.meeting.participant_meeting_joined_v1",
-	} {
-		t.Run(key, func(t *testing.T) {
-			f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})
-
-			if err := runSchema(f, key, true); err != nil {
-				t.Fatalf("runSchema json: %v", err)
-			}
-
-			var payload map[string]interface{}
-			if err := json.Unmarshal(stdout.Bytes(), &payload); err != nil {
-				t.Fatalf("output is not valid JSON: %v\n%s", err, stdout.String())
-			}
-			if payload["key"] != key {
-				t.Errorf("key = %v, want %s", payload["key"], key)
-			}
-			resolved, ok := payload["resolved_output_schema"].(map[string]interface{})
-			if !ok {
-				t.Fatalf("resolved_output_schema missing or wrong type: %+v", payload)
-			}
-			properties, ok := resolved["properties"].(map[string]interface{})
-			if !ok {
-				t.Fatalf("resolved_output_schema.properties missing or wrong type: %+v", resolved)
-			}
-			for _, field := range []string{"type", "event_id", "timestamp", "meeting_id", "topic", "meeting_no", "start_time", "calendar_event_id"} {
-				if _, ok := properties[field]; !ok {
-					t.Errorf("resolved output schema missing field %q: %+v", field, properties)
-				}
-			}
-			if _, ok := properties["end_time"]; ok {
-				t.Errorf("resolved output schema should not include end_time for %s: %+v", key, properties)
-			}
-		})
-	}
-}
-
 func TestSchema_RendersSubscriptionKeyMarker(t *testing.T) {
 	const syntheticKey = "test.evt_sub"
 	t.Cleanup(func() { eventlib.UnregisterKeyForTest(syntheticKey) })
--- a/cmd/root.go
+++ b/cmd/root.go
@@ -11,11 +11,9 @@ import (
 	"sort"
 	"strings"

-	"github.com/larksuite/cli/cmd/service"
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/extension/platform"
 	"github.com/larksuite/cli/internal/build"
-	"github.com/larksuite/cli/internal/cmdmeta"
 	"github.com/larksuite/cli/internal/cmdpolicy"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/deprecation"
@@ -30,60 +28,43 @@ import (

 const rootLong = `lark-cli — Lark/Feishu CLI tool.

-AGENT QUICKSTART (driving this as an agent? start here):
-    Browse commands:  lark-cli <domain> --help            # +shortcuts (preferred) and raw API resources
-    Inspect a call:   lark-cli schema <service>.<resource>.<method>   # params, types, scopes, examples
-    Prefer a +shortcut over the raw API resource when one matches the task.
-    Risk: each command's --help shows read | write | high-risk-write;
-          high-risk-write needs --yes, only after the user confirms.
-    On any API call: --jq <expr> filters JSON output, --dry-run previews the request (runs nothing).
+USAGE:
+    lark-cli <command> [subcommand] [method] [options]
+    lark-cli api <method> <path> [--params <json>] [--data <json>]
+    lark-cli schema <service.resource.method>

-EXAMPLES (one per command style, in order of preference):
-    lark-cli calendar +agenda                                       # +shortcut — a high-level task, prefer these
-    lark-cli mail user_mailbox.messages list --user-mailbox-id me   # typed command for one API method
-    lark-cli schema mail.user_mailbox.messages.list                 # inspect a method's params before calling
-    lark-cli api GET /open-apis/calendar/v4/calendars               # raw escape hatch — any endpoint by HTTP path`
+EXAMPLES:
+    # View upcoming events
+    lark-cli calendar +agenda

-// rootUsageTemplate is cobra's default usage template with two root-only
-// additions gated on {{if not .HasParent}}: a curated multi-form Usage synopsis
-// (replacing cobra's generic "[flags] / [command]") and a human skills-setup
-// footer. Subcommands render the stock template unchanged. The rest is verbatim
-// cobra so the command groups and flags are untouched.
-const rootUsageTemplate = `{{if .HasParent}}Usage:{{if .Runnable}}
-  {{.UseLine}}{{end}}{{if .HasAvailableSubCommands}}
-  {{.CommandPath}} [command]{{end}}{{else}}Usage:
-  lark-cli <command> [subcommand] [method] [flags]
-  lark-cli api <method> <path> [--params <json>] [--data <json>]
-  lark-cli schema <service.resource.method>{{end}}{{if gt (len .Aliases) 0}}
+    # List calendar events
+    lark-cli calendar events instance_view --params '{"calendar_id":"primary","start_time":"1700000000","end_time":"1700086400"}'

-Aliases:
-  {{.NameAndAliases}}{{end}}{{if .HasExample}}
+    # Search users
+    lark-cli contact +search-user --query "John"

-Examples:
-{{.Example}}{{end}}{{if .HasAvailableSubCommands}}{{$cmds := .Commands}}{{if eq (len .Groups) 0}}
+    # Generic API call
+    lark-cli api GET /open-apis/calendar/v4/calendars

-Available Commands:{{range $cmds}}{{if (or .IsAvailableCommand (eq .Name "help"))}}
-  {{rpad .Name .NamePadding }} {{.Short}}{{end}}{{end}}{{else}}{{range $group := .Groups}}
+AI AGENT SKILLS:
+    lark-cli pairs with AI agent skills (Claude Code, etc.) that
+    teach the agent Lark API patterns, best practices, and workflows.

-{{.Title}}{{range $cmds}}{{if (and (eq .GroupID $group.ID) (or .IsAvailableCommand (eq .Name "help")))}}
-  {{rpad .Name .NamePadding }} {{.Short}}{{end}}{{end}}{{end}}{{if not .AllChildCommandsHaveGroup}}
+    Install all skills:
+        npx skills add larksuite/cli -g -y

-Additional Commands:{{range $cmds}}{{if (and (eq .GroupID "") (or .IsAvailableCommand (eq .Name "help")))}}
-  {{rpad .Name .NamePadding }} {{.Short}}{{end}}{{end}}{{end}}{{end}}{{end}}{{if .HasAvailableLocalFlags}}
+    Or pick specific domains:
+        npx skills add larksuite/cli -s lark-calendar -y
+        npx skills add larksuite/cli -s lark-im -y

-Flags:
-{{.LocalFlags.FlagUsages | trimTrailingWhitespaces}}{{end}}{{if .HasAvailableInheritedFlags}}
+    Learn more: https://github.com/larksuite/cli#agent-skills

-Global Flags:
-{{.InheritedFlags.FlagUsages | trimTrailingWhitespaces}}{{end}}{{if .HasHelpSubCommands}}
+COMMUNITY:
+    GitHub:     https://github.com/larksuite/cli
+    Issues:     https://github.com/larksuite/cli/issues
+    Docs:       https://open.feishu.cn/document/

-Additional help topics:{{range .Commands}}{{if .IsAdditionalHelpTopicCommand}}
-  {{rpad .CommandPath .CommandPathPadding}} {{.Short}}{{end}}{{end}}{{end}}{{if .HasAvailableSubCommands}}
-
-Use "{{.CommandPath}} [command] --help" for more information about a command.{{end}}{{if not .HasParent}}
-
-Skills setup (one-time, humans): npx skills add larksuite/cli -g -y — https://github.com/larksuite/cli#agent-skills{{end}}
-`
+More help: lark-cli <command> --help`

 // Execute runs the root command and returns the process exit code.
 // rawInvocationArgs holds os.Args[1:] captured at Execute() entry. cobra's
@@ -548,49 +529,6 @@ func availableSubcommandNames(cmd *cobra.Command) (available, deprecated []strin
 	return available, deprecated
 }

-// Root command help groups, so an agent sees content domains, agent tooling, and
-// CLI management as distinct blocks instead of one flat alphabetical dump.
-const (
-	groupDomains    = "lark-domains"
-	groupTooling    = "agent-tooling"
-	groupManagement = "cli-management"
-)
-
-// groupRootCommands classifies root's direct children into the help groups,
-// called once after all commands are registered. Unclassified commands fall to
-// cobra's "Additional Commands" section.
-func groupRootCommands(root *cobra.Command) {
-	root.AddGroup(
-		&cobra.Group{ID: groupDomains, Title: "Lark domains:"},
-		&cobra.Group{ID: groupTooling, Title: "Agent tooling:"},
-		&cobra.Group{ID: groupManagement, Title: "CLI management:"},
-	)
-	tooling := map[string]bool{"api": true, "schema": true, "skills": true}
-	management := map[string]bool{"auth": true, "config": true, "profile": true, "doctor": true, "update": true}
-	for _, c := range root.Commands() {
-		if c.GroupID != "" {
-			continue
-		}
-		switch {
-		case tooling[c.Name()]:
-			c.GroupID = groupTooling
-		case management[c.Name()]:
-			c.GroupID = groupManagement
-		case isLarkDomain(c):
-			c.GroupID = groupDomains
-		}
-	}
-}
-
-// isLarkDomain reports whether a root child is a Lark domain (service-sourced or
-// shortcut-tagged), not CLI tooling. Mirrors service.PrepareDomainHelp.
-func isLarkDomain(c *cobra.Command) bool {
-	if src, _ := cmdmeta.SourceOf(c); src == cmdmeta.SourceService {
-		return true
-	}
-	return cmdmeta.Domain(c) != ""
-}
-
 // flagDidYouMean is the root FlagErrorFunc (inherited by all subcommands). It
 // converts cobra's flag-parse errors into a typed validation envelope: an
 // unknown flag gets a focused "did you mean" hint (so agents recover even when
@@ -672,17 +610,6 @@ func installTipsHelpFunc(root *cobra.Command) {
 				defer func() { f.Hidden = true }()
 			}
 		}
-		// Domain and method commands compose their agent guidance into Long lazily
-		// here (shortcuts attach after service registration); both skip the generic
-		// bottom-of-help append below.
-		if service.PrepareDomainHelp(cmd, embeddedSkillContent) {
-			defaultHelp(cmd, args)
-			return
-		}
-		if service.PrepareMethodHelp(cmd) {
-			defaultHelp(cmd, args)
-			return
-		}
 		defaultHelp(cmd, args)
 		out := cmd.OutOrStdout()
 		if level, ok := cmdutil.GetRisk(cmd); ok {
--- a/cmd/root_test.go
+++ b/cmd/root_test.go
@@ -76,13 +76,11 @@ func TestPersistentPreRunE_ConfigSubcommands(t *testing.T) {
 }

 func TestRootLong_AgentSkillsLinkTargetsReadmeSection(t *testing.T) {
-	// The human skills-install guidance now lives in the root usage-template
-	// footer (below the command list), not in the agent-facing Long.
-	if !strings.Contains(rootUsageTemplate, "https://github.com/larksuite/cli#agent-skills") {
-		t.Fatalf("root help footer should link to the README Agent Skills section, got:\n%s", rootUsageTemplate)
+	if !strings.Contains(rootLong, "https://github.com/larksuite/cli#agent-skills") {
+		t.Fatalf("root help should link to the README Agent Skills section, got:\n%s", rootLong)
 	}
-	if strings.Contains(rootUsageTemplate, "https://github.com/larksuite/cli#install-ai-agent-skills") {
-		t.Fatalf("root help should not reference the removed install-ai-agent-skills anchor, got:\n%s", rootUsageTemplate)
+	if strings.Contains(rootLong, "https://github.com/larksuite/cli#install-ai-agent-skills") {
+		t.Fatalf("root help should not reference the removed install-ai-agent-skills anchor, got:\n%s", rootLong)
 	}
 }

--- a/cmd/service/affordance.go
+++ b/cmd/service/affordance.go
@@ -4,211 +4,41 @@
 package service

 import (
-	"encoding/json"
 	"fmt"
-	"io/fs"
 	"strings"

-	"github.com/larksuite/cli/internal/affordance"
-	"github.com/larksuite/cli/internal/cmdmeta"
-	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/meta"
-	"github.com/spf13/cobra"
 )

-// PrepareDomainHelp appends navigational guidance (routing line, risk legend,
-// skill pointer) to a top-level Lark domain's description, returning false for
-// anything that is not such a domain. Built lazily at help time because
-// shortcuts attach after service registration. skillFS (nil-safe) gates the
-// skill pointer.
-//
-// A hand-authored Long is preserved as the base (e.g. event's "Use 'event
-// consume <EventKey>'…"); service domains carry only a Short at this point, so
-// we fall back to it. The pristine base is captured once into an annotation so
-// re-rendering does not append the guidance twice.
-func PrepareDomainHelp(cmd *cobra.Command, skillFS fs.FS) bool {
-	if cmd.Annotations[schemaPathAnnotation] != "" {
-		return false // a method command
-	}
-	// Direct child of root only — so Domain() reads this command's own tag, and
-	// nested resource groups are excluded.
-	if cmd.Parent() == nil || cmd.Parent().Parent() != nil {
-		return false
-	}
-	// A domain is service-sourced or shortcut-tagged; CLI tooling has neither.
-	if src, _ := cmdmeta.SourceOf(cmd); src != cmdmeta.SourceService && cmdmeta.Domain(cmd) == "" {
-		return false
-	}
-	if !cmd.HasAvailableSubCommands() {
-		return false
-	}
-
-	hasShortcuts, hasResources := false, false
-	for _, c := range cmd.Commands() {
-		if c.Hidden || c.Name() == "help" || c.Name() == "completion" {
-			continue
-		}
-		if strings.HasPrefix(c.Name(), "+") {
-			hasShortcuts = true
-		} else {
-			hasResources = true
-		}
-	}
-
-	var b strings.Builder
-	b.WriteString(domainHelpBase(cmd))
-	if hasShortcuts && hasResources { // routing only matters when both styles exist
-		b.WriteString("\n\nPrefer a +-prefixed shortcut when one matches your task; otherwise use the raw API resource below.")
-	}
-	b.WriteString("\n\nRisk levels (read | write | high-risk-write) appear in each command's --help; high-risk-write requires --yes, only after the user confirms.")
-	if skill := "lark-" + cmd.Name(); skillFS != nil {
-		if _, err := fs.Stat(skillFS, skill+"/SKILL.md"); err == nil {
-			fmt.Fprintf(&b, "\n\nDomain guide (concepts, command choice, conventions): lark-cli skills read %s", skill)
-		}
-	}
-	cmd.Long = b.String()
-	return true
-}
-
-// domainHelpBase returns the description to seed domain help with — the
-// hand-authored Long when present, else the Short — captured once into an
-// annotation so re-rendering reuses the pristine text instead of the
-// already-augmented Long.
-func domainHelpBase(cmd *cobra.Command) string {
-	if base, ok := cmd.Annotations[domainBaseAnnotation]; ok {
-		return base
-	}
-	base := cmd.Long
-	if base == "" {
-		base = cmd.Short
-	}
-	if cmd.Annotations == nil {
-		cmd.Annotations = map[string]string{}
-	}
-	cmd.Annotations[domainBaseAnnotation] = base
-	return base
-}
-
-// methodLong is the build-time Long (description + schema pointer +
-// params-only addendum). Agent guidance is added lazily by PrepareMethodHelp,
-// so command construction never parses the overlay.
-func methodLong(description, schemaPath, paramsOnly string) string {
+// methodLong composes a method command's long help in one place: the
+// description, the affordance guidance block (when the method has one), the
+// pointer to the full schema, and the params-only addendum (params whose flag
+// name is taken — paramFlagBinder.paramsOnlyHelp, "" when none). Affordance
+// sits near the top so an agent sees when-to-use and few-shot examples before
+// the flag list.
+func methodLong(description, affordance, schemaPath, paramsOnly string) string {
 	var b strings.Builder
 	b.WriteString(description)
-	fmt.Fprintf(&b, "\n\nFull parameter schema:\n  lark-cli schema %s", schemaPath)
+	if affordance != "" {
+		b.WriteString("\n\n")
+		b.WriteString(affordance)
+	}
+	fmt.Fprintf(&b, "\n\nView parameter definitions before calling:\n  lark-cli schema %s", schemaPath)
 	b.WriteString(paramsOnly)
 	return b.String()
 }

-// Annotation keys PrepareMethodHelp reads to rebuild a method command's Long.
-const (
-	affordanceServiceAnnotation = "affordance-service"
-	affordanceMethodAnnotation  = "affordance-method"
-	schemaPathAnnotation        = "method-schema-path"
-	paramsOnlyAnnotation        = "method-params-only"
-	domainBaseAnnotation        = "affordance-domain-base"
-)
-
-// setMethodHelpData records the coordinates PrepareMethodHelp needs (storing a
-// few strings is the only build-time cost; the overlay stays untouched).
-func setMethodHelpData(cmd *cobra.Command, service, methodID, schemaPath, paramsOnly string) {
-	if cmd.Annotations == nil {
-		cmd.Annotations = map[string]string{}
-	}
-	if service != "" && methodID != "" {
-		cmd.Annotations[affordanceServiceAnnotation] = service
-		cmd.Annotations[affordanceMethodAnnotation] = methodID
-	}
-	cmd.Annotations[schemaPathAnnotation] = schemaPath
-	if paramsOnly != "" {
-		cmd.Annotations[paramsOnlyAnnotation] = paramsOnly
-	}
-}
-
-// PrepareMethodHelp rebuilds a generated method command's Long with the agent
-// guidance at the TOP (Risk, then the affordance block, then the schema
-// pointer), returning false for non-method commands. The overlay is parsed
-// here — only when help is rendered.
-func PrepareMethodHelp(cmd *cobra.Command) bool {
-	ann := cmd.Annotations
-	if ann == nil {
-		return false
-	}
-	schemaPath, ok := ann[schemaPathAnnotation]
-	if !ok {
-		return false
-	}
-
-	var b strings.Builder
-	b.WriteString(cmd.Short)
-	if level, ok := cmdutil.GetRisk(cmd); ok {
-		// --yes asserts the USER confirmed; the agent must not self-approve.
-		if level == cmdutil.RiskHighRiskWrite {
-			fmt.Fprintf(&b, "\n\nRisk: %s (requires explicit user confirmation to execute; the agent must NOT add --yes on its own — only pass --yes after the user has confirmed)", level)
-		} else {
-			fmt.Fprintf(&b, "\n\nRisk: %s", level)
-		}
-	}
-
-	var skills []string
-	if raw, ok := affordanceRaw(cmd); ok {
-		if block := renderAffordance(meta.Method{Affordance: raw}); block != "" {
-			b.WriteString("\n\n")
-			b.WriteString(block)
-		}
-		if a, ok := (meta.Method{Affordance: raw}).ParsedAffordance(); ok {
-			skills = a.Skills
-		}
-	}
-
-	fmt.Fprintf(&b, "\n\nFull parameter schema:\n  lark-cli schema %s", schemaPath)
-	b.WriteString(ann[paramsOnlyAnnotation])
-
-	if len(skills) > 0 {
-		b.WriteString("\n\nWorkflow skill (end-to-end usage):")
-		for _, s := range skills {
-			fmt.Fprintf(&b, "\n  lark-cli skills read %s", s)
-		}
-	}
-
-	cmd.Long = b.String()
-	return true
-}
-
-// affordanceLookup is the overlay source; a package var so tests can inject.
-var affordanceLookup = affordance.For
-
-// RenderAffordanceForCmd renders a method command's affordance block, or "" when
-// it carries none.
-func RenderAffordanceForCmd(cmd *cobra.Command) string {
-	raw, ok := affordanceRaw(cmd)
-	if !ok {
-		return ""
-	}
-	return renderAffordance(meta.Method{Affordance: raw})
-}
-
-func affordanceRaw(cmd *cobra.Command) (json.RawMessage, bool) {
-	if cmd.Annotations == nil {
-		return nil, false
-	}
-	service := cmd.Annotations[affordanceServiceAnnotation]
-	methodID := cmd.Annotations[affordanceMethodAnnotation]
-	if service == "" || methodID == "" {
-		return nil, false
-	}
-	return affordanceLookup(service, methodID)
-}
-
-// renderAffordance renders a method's affordance as a help block, or "" when it
-// has none. Sections are joined with blank lines so they scan as distinct groups.
+// renderAffordance renders a method's affordance as a help block — when to use,
+// prerequisites, and (most importantly for agents) few-shot Examples — or "" when
+// the method carries no affordance. It reads the single typed model
+// (meta.Method.ParsedAffordance) so the help and the envelope agree on shape.
 func renderAffordance(m meta.Method) string {
 	a, ok := m.ParsedAffordance()
 	if !ok {
 		return ""
 	}

-	var sections []string
+	var b strings.Builder
 	bullets := func(title string, items []string) {
 		var nonEmpty []string
 		for _, it := range items {
@@ -219,18 +49,15 @@ func renderAffordance(m meta.Method) string {
 		if len(nonEmpty) == 0 {
 			return
 		}
-		var s strings.Builder
-		fmt.Fprintf(&s, "%s:\n", title)
+		fmt.Fprintf(&b, "%s:\n", title)
 		for _, it := range nonEmpty {
-			fmt.Fprintf(&s, "  • %s\n", it)
+			fmt.Fprintf(&b, "  • %s\n", it)
 		}
-		sections = append(sections, strings.TrimRight(s.String(), "\n"))
 	}

 	bullets("When to use", a.UseWhen)
-	bullets("Avoid when", a.AvoidWhen)
+	bullets("Avoid when", a.DoNotUseWhen)
 	bullets("Prerequisites", a.Prerequisites)
-	bullets("Tips", a.Tips)
 	if len(a.Examples) > 0 {
 		var lines []string
 		for _, ex := range a.Examples {
@@ -244,13 +71,10 @@ func renderAffordance(m meta.Method) string {
 			}
 		}
 		if len(lines) > 0 {
-			sections = append(sections, "Examples:\n"+strings.Join(lines, "\n"))
+			fmt.Fprintf(&b, "Examples:\n%s\n", strings.Join(lines, "\n"))
 		}
 	}
-	for _, ext := range a.Extensions {
-		bullets(ext.Label, ext.Items)
-	}
 	bullets("Related", a.Related)

-	return strings.Join(sections, "\n\n")
+	return strings.TrimRight(b.String(), "\n")
 }
--- a/cmd/service/affordance_test.go
+++ b/cmd/service/affordance_test.go
@@ -8,18 +8,15 @@ import (
 	"strings"
 	"testing"

-	"github.com/larksuite/cli/internal/cmdmeta"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/meta"
-	"github.com/spf13/cobra"
 )

 func TestRenderAffordance(t *testing.T) {
 	raw := json.RawMessage(`{
 		"use_when": ["发送文本消息"],
-		"avoid_when": ["群已解散"],
+		"do_not_use_when": ["群已解散"],
 		"prerequisites": ["已获取 chat_id"],
-		"tips": ["富文本用 msg_type=post"],
 		"examples": [
 			{"description":"发一条文本","command":"lark-cli im messages create --params '{...}'"},
 			{"command":"lark-cli im messages list"},
@@ -32,7 +29,6 @@ func TestRenderAffordance(t *testing.T) {
 		"When to use:", "发送文本消息",
 		"Avoid when:", "群已解散",
 		"Prerequisites:", "已获取 chat_id",
-		"Tips:", "富文本用 msg_type=post",
 		"Examples:", "发一条文本", "lark-cli im messages create --params '{...}'",
 		"lark-cli im messages list", // example with no description -> bare command line
 		"Related:", "im.messages.list",
@@ -52,12 +48,9 @@ func TestRenderAffordance(t *testing.T) {
 	}
 }

-// Affordance is rendered lazily (at --help time) rather than baked into the
-// command's Long, so building a command never carries the affordance block —
-// even for a method whose metadata happens to declare one.
-func TestServiceMethod_AffordanceNotInLong(t *testing.T) {
+func TestServiceMethod_AffordanceInLong(t *testing.T) {
 	withAff := map[string]interface{}{
-		"id": "messages.create", "path": "messages", "httpMethod": "POST", "description": "发送消息",
+		"path": "messages", "httpMethod": "POST", "description": "发送消息",
 		"affordance": map[string]interface{}{
 			"examples": []interface{}{
 				map[string]interface{}{"description": "发文本", "command": "lark-cli im messages create ..."},
@@ -66,120 +59,14 @@ func TestServiceMethod_AffordanceNotInLong(t *testing.T) {
 	}
 	f, _, _, _ := cmdutil.TestFactory(t, testConfig)
 	cmd := NewCmdServiceMethod(f, imSpec(), meta.FromMap(withAff), "create", "messages", nil)
-	if strings.Contains(cmd.Long, "Examples:") {
-		t.Errorf("affordance must not be baked into Long (lazy):\n%s", cmd.Long)
+	if !strings.Contains(cmd.Long, "Examples:") || !strings.Contains(cmd.Long, "lark-cli im messages create ...") {
+		t.Errorf("affordance examples not in command Long:\n%s", cmd.Long)
 	}
-	// The lookup ref is recorded so the help path can resolve it later.
-	if cmd.Annotations[affordanceServiceAnnotation] != "im" || cmd.Annotations[affordanceMethodAnnotation] != "messages.create" {
-		t.Errorf("affordance ref annotations = %v, want im/messages.create", cmd.Annotations)
-	}
-}
-
-// RenderAffordanceForCmd resolves a command's overlay through the (injectable)
-// lookup and renders it; commands without a ref render nothing.
-func TestRenderAffordanceForCmd(t *testing.T) {
-	orig := affordanceLookup
-	t.Cleanup(func() { affordanceLookup = orig })
-	affordanceLookup = func(service, methodID string) (json.RawMessage, bool) {
-		if service != "im" || methodID != "messages.create" {
-			return nil, false
-		}
-		return json.RawMessage(`{"use_when":["发文本消息"],"tips":["富文本用 msg_type=post"],"examples":[{"description":"发一条","command":"lark-cli im messages create ..."}]}`), true
-	}
-
-	f, _, _, _ := cmdutil.TestFactory(t, testConfig)
-	withRef := map[string]interface{}{"id": "messages.create", "path": "messages", "httpMethod": "POST", "description": "发送消息"}
-	cmd := NewCmdServiceMethod(f, imSpec(), meta.FromMap(withRef), "create", "messages", nil)
-	block := RenderAffordanceForCmd(cmd)
-	for _, want := range []string{"When to use:", "发文本消息", "Tips:", "富文本用 msg_type=post", "Examples:", "lark-cli im messages create ..."} {
-		if !strings.Contains(block, want) {
-			t.Errorf("RenderAffordanceForCmd missing %q in:\n%s", want, block)
-		}
-	}
-
-	// No overlay for this method id -> empty block.
-	noRef := map[string]interface{}{"id": "x.list", "path": "x", "httpMethod": "GET", "description": "d"}
-	cmd2 := NewCmdServiceMethod(f, imSpec(), meta.FromMap(noRef), "list", "x", nil)
-	if got := RenderAffordanceForCmd(cmd2); got != "" {
-		t.Errorf("method with no overlay should render nothing, got:\n%s", got)
-	}
-}
-
-// PrepareMethodHelp composes the guidance into Long at the top: description,
-// then the affordance block, then the full-schema pointer — so an agent reads
-// when-to-use/examples before the flag list.
-func TestPrepareMethodHelp(t *testing.T) {
-	orig := affordanceLookup
-	t.Cleanup(func() { affordanceLookup = orig })
-	affordanceLookup = func(_, _ string) (json.RawMessage, bool) {
-		return json.RawMessage(`{"use_when":["发文本消息"],"examples":[{"description":"发一条","command":"lark-cli im messages create ..."}]}`), true
-	}
-
-	f, _, _, _ := cmdutil.TestFactory(t, testConfig)
-	m := map[string]interface{}{"id": "messages.create", "path": "messages", "httpMethod": "POST", "description": "发送消息"}
-	cmd := NewCmdServiceMethod(f, imSpec(), meta.FromMap(m), "create", "messages", nil)
-
-	if !PrepareMethodHelp(cmd) {
-		t.Fatal("PrepareMethodHelp returned false for a service-method command")
-	}
-	long := cmd.Long
-	// Description leads; affordance block sits above the schema pointer.
-	descAt := strings.Index(long, "发送消息")
-	useAt := strings.Index(long, "When to use:")
-	exAt := strings.Index(long, "Examples:")
-	schemaAt := strings.Index(long, "Full parameter schema:")
-	if descAt != 0 {
-		t.Errorf("description should lead Long, got:\n%s", long)
-	}
-	if !(descAt < useAt && useAt < exAt && exAt < schemaAt) {
-		t.Errorf("order should be description < affordance < schema pointer; got desc=%d use=%d ex=%d schema=%d\n%s", descAt, useAt, exAt, schemaAt, long)
-	}
-
-	// A non-service command (no schema-path annotation) is left untouched.
-	if PrepareMethodHelp(&cobra.Command{Use: "plain"}) {
-		t.Error("PrepareMethodHelp should return false for a non-service command")
-	}
-}
-
-// domainCmd wires a domain-tagged command with a subcommand under a root, the
-// shape PrepareDomainHelp expects.
-func domainCmd(short, long string) *cobra.Command {
-	root := &cobra.Command{Use: "root"}
-	dom := &cobra.Command{Use: "event", Short: short, Long: long}
-	cmdmeta.SetDomain(dom, "event")
-	dom.AddCommand(&cobra.Command{Use: "consume", Run: func(*cobra.Command, []string) {}})
-	root.AddCommand(dom)
-	return dom
-}
-
-func TestPrepareDomainHelp_PreservesHandAuthoredLong(t *testing.T) {
-	const long = "Unified event consumption system. Use 'event consume <EventKey>'."
-	dom := domainCmd("Consume and manage real-time events", long)
-
-	if !PrepareDomainHelp(dom, nil) {
-		t.Fatal("PrepareDomainHelp returned false for a domain-tagged command")
-	}
-	if !strings.HasPrefix(dom.Long, long) {
-		t.Errorf("hand-authored Long must lead; got:\n%s", dom.Long)
-	}
-	if !strings.Contains(dom.Long, "Risk levels") {
-		t.Errorf("domain guidance should be appended; got:\n%s", dom.Long)
-	}
-
-	// Re-rendering must not append the guidance a second time.
-	PrepareDomainHelp(dom, nil)
-	if n := strings.Count(dom.Long, "Risk levels"); n != 1 {
-		t.Errorf("guidance appended %d times across re-renders, want 1:\n%s", n, dom.Long)
-	}
-}
-
-// A service domain carries only a Short at help time; it seeds the base.
-func TestPrepareDomainHelp_FallsBackToShort(t *testing.T) {
-	dom := domainCmd("Message and group chat management", "")
-	if !PrepareDomainHelp(dom, nil) {
-		t.Fatal("PrepareDomainHelp returned false for a domain-tagged command")
-	}
-	if !strings.HasPrefix(dom.Long, "Message and group chat management") {
-		t.Errorf("Short should seed Long when no hand-authored Long exists; got:\n%s", dom.Long)
+
+	// A method with no affordance adds no guidance block.
+	plain := map[string]interface{}{"path": "x", "httpMethod": "GET", "description": "d"}
+	cmd2 := NewCmdServiceMethod(f, imSpec(), meta.FromMap(plain), "list", "x", nil)
+	if strings.Contains(cmd2.Long, "Examples:") {
+		t.Errorf("no-affordance method should have no Examples in Long:\n%s", cmd2.Long)
 	}
 }
--- a/cmd/service/flaggroups_test.go
+++ b/cmd/service/flaggroups_test.go
@@ -60,11 +60,8 @@ func TestServiceFlagGroups_AgentContract(t *testing.T) {
 	if i := idx("--chat-id"); i < iParams || i > iBody {
 		t.Errorf("--chat-id not under API Parameters:\n%s", out)
 	}
-	// The redundant "<name>, required|optional." prefix is gone: required-ness is
-	// carried by the Required:/Optional: subheadings, and the snake-case --params
-	// key by the schema envelope — so it isn't echoed on every flag line.
-	if strings.Contains(out, "chat_id, required") || strings.Contains(out, "member_id_type, optional") {
-		t.Errorf("redundant <name>, required/optional prefix should not appear:\n%s", out)
+	if !strings.Contains(out, "chat_id, required") {
+		t.Errorf("typed flag help format wrong:\n%s", out)
 	}
 	if !strings.Contains(out, "enum: open_id=以 open_id 标识用户|user_id=以 user_id 标识用户") {
 		t.Errorf("expected compact enum value=meaning inline:\n%s", out)
--- a/cmd/service/paramhelp.go
+++ b/cmd/service/paramhelp.go
@@ -30,11 +30,6 @@ func fieldFacts(f meta.Field) []string {
 	if d := sanitizeFieldDesc(f.Description); d != "" {
 		facts = append(facts, d)
 	}
-	if f.CanonicalType() == "boolean" {
-		// cobra shows no type word for bools and swallows a separate value as a
-		// positional, so spell out the presence-only contract.
-		facts = append(facts, "bool flag (presence = true; omit for false; takes no value)")
-	}
 	if opts := f.EnumOptions(); len(opts) > 0 {
 		facts = append(facts, "enum: "+formatEnumInline(opts))
 	}
@@ -47,15 +42,20 @@ func fieldFacts(f meta.Field) []string {
 	return facts
 }

-// paramFlagUsage renders the typed param flag's help line: the field's facts
-// joined inline. Required/optional is not repeated here — the grouped help's
-// Required:/Optional: subheadings already partition the flags — and the
-// snake-case --params key is carried by the schema envelope (each param's
-// property + "flag") and the params-only addendum, so it isn't echoed on every
-// line either. Returns "" when the field has no facts (cobra then shows the bare
-// flag with its type).
+// paramFlagUsage renders the typed param flag's help line:
+//
+//	<param_name>, required|optional[. <fact>]...
+//
+// It leads with the canonical underscore param name (the key this flag
+// overrides in --params) and required/optional, then joins the field's facts
+// inline.
 func paramFlagUsage(f meta.Field) string {
-	return strings.Join(fieldFacts(f), ". ")
+	req := "optional"
+	if f.Required {
+		req = "required"
+	}
+	parts := append([]string{fmt.Sprintf("%s, %s", f.Name, req)}, fieldFacts(f)...)
+	return strings.Join(parts, ". ") + "."
 }

 // paramExample picks a concrete sample for a params-only field's --help snippet:
@@ -103,23 +103,8 @@ func sanitizeOptionDesc(s string) string { return inlineClause(s, "。；;\n\r",
 // sanitizeFieldDesc is the field-description policy: one line per field, so
 // keep full sentences and cut only at note separators (meta_data appends
 // bullet notes after ;/；) — the later sentence often carries the key
-// affordance, e.g. user_mailbox_id's `可以输入"me"`. The trailing doc
-// cross-reference is dropped first (see cutDocRef).
-func sanitizeFieldDesc(s string) string { return inlineClause(cutDocRef(s), "；;\n\r", 60) }
-
-// docRefRe matches a "see the docs" breadcrumb (更多信息参见…/获取方式见…/详见…).
-// On the compact flag line the markdown link's URL is stripped, so the
-// breadcrumb is a dead pointer — drop it. Anchored on a leading clause separator
-// so a subject that runs straight into the phrase isn't orphaned.
-var docRefRe = regexp.MustCompile(`[。；;，,、]\s*(更多信息|获取方式|获取方法|详见|[请可]?参[见考阅])`)
-
-// cutDocRef truncates s at the first doc-reference breadcrumb.
-func cutDocRef(s string) string {
-	if loc := docRefRe.FindStringIndex(s); loc != nil {
-		return s[:loc[0]]
-	}
-	return s
-}
+// affordance, e.g. user_mailbox_id's `可以输入"me"`.
+func sanitizeFieldDesc(s string) string { return inlineClause(s, "；;\n\r", 60) }

 // formatEnumInline renders allowed values for the help line: "v=meaning" when
 // the value carries a (sanitized, truncated) description — so opaque numeric
--- a/cmd/service/service.go
+++ b/cmd/service/service.go
@@ -7,7 +7,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"sort"
 	"strings"

 	"github.com/larksuite/cli/errs"
@@ -65,38 +64,15 @@ func registerServiceWithContext(ctx context.Context, parent *cobra.Command, svc
 	// resource-command chain — one level for a flat dotted resource like
 	// "chat.members", deeper for genuinely nested resources. A service with no
 	// methods keeps its bare command (svcCmd is created above regardless).
-	refs := apicatalog.ServiceMethods(svc, nil)
-
-	// Collect each resource's verbs up front so resourceShort can summarize a
-	// resource as its verb list from the first ensureChildCommand call.
-	verbs := map[string][]string{}
-	for _, ref := range refs {
-		key := strings.Join(ref.ResourcePath, ".")
-		verbs[key] = append(verbs[key], ref.Method.Name)
-	}
-
-	for _, ref := range refs {
+	for _, ref := range apicatalog.ServiceMethods(svc, nil) {
 		resCmd := svcCmd
-		var path []string
 		for _, seg := range ref.ResourcePath {
-			path = append(path, seg)
-			resCmd = ensureChildCommand(resCmd, seg, resourceShort(seg, verbs[strings.Join(path, ".")]))
+			resCmd = ensureChildCommand(resCmd, seg, seg+" operations")
 		}
 		resCmd.AddCommand(buildMethodCommand(ctx, f, newMethodCommandSpec(ref), nil, parent.PersistentFlags()))
 	}
 }

-// resourceShort summarizes a resource as its sorted verb list, or the
-// "<name> operations" placeholder for an intermediate group with no methods.
-func resourceShort(seg string, verbs []string) string {
-	if len(verbs) == 0 {
-		return seg + " operations"
-	}
-	sorted := append([]string(nil), verbs...)
-	sort.Strings(sorted)
-	return strings.Join(sorted, ", ")
-}
-
 // serviceShort is the service command's help summary: the localized description
 // from the registry, falling back to the metadata's own description.
 func serviceShort(svc meta.Service) string {
@@ -201,19 +177,7 @@ type methodCommandSpec struct {
 	// the API declares a body.
 	acceptsBody  bool
 	declaresBody bool
-	paginates    bool   // method accepts a page_token param (so --page-all is meaningful)
-	serviceName  string // owning service name (e.g. "approval"), for the lazy affordance lookup
-}
-
-// methodPaginates reports whether a method takes a page_token param, the signal
-// that makes the --page-all/--page-limit/--page-delay flags meaningful.
-func methodPaginates(m meta.Method) bool {
-	for _, f := range m.Params() {
-		if f.Name == "page_token" {
-			return true
-		}
-	}
-	return false
+	affordance   string // rendered hand-authored usage guidance (when-to-use, examples); "" if none
 }

 func newMethodCommandSpec(ref apicatalog.MethodRef) methodCommandSpec {
@@ -222,7 +186,6 @@ func newMethodCommandSpec(ref apicatalog.MethodRef) methodCommandSpec {
 		method:       m,
 		schemaPath:   ref.SchemaPath(),
 		servicePath:  ref.Service.ServicePath,
-		serviceName:  ref.Service.Name,
 		risk:         m.Risk,
 		restricts:    m.RestrictsIdentity(),
 		identities:   m.Identities(),
@@ -230,7 +193,7 @@ func newMethodCommandSpec(ref apicatalog.MethodRef) methodCommandSpec {
 		fileFields:   detectFileFields(m),
 		acceptsBody:  methodTakesBody(m.HTTPMethod),
 		declaresBody: len(m.Data()) > 0 || len(m.Files()) > 0,
-		paginates:    methodPaginates(m),
+		affordance:   renderAffordance(m),
 	}
 }

@@ -291,14 +254,6 @@ func buildMethodCommand(ctx context.Context, f *cmdutil.Factory, spec methodComm
 	cmd.Flags().BoolVar(&opts.PageAll, "page-all", false, "automatically paginate through all pages")
 	cmd.Flags().IntVar(&opts.PageLimit, "page-limit", 10, "max pages to fetch with --page-all (0 = unlimited)")
 	cmd.Flags().IntVar(&opts.PageDelay, "page-delay", 200, "delay in ms between pages")
-	// Keep the pagination flags registered (a harmless no-op if passed) but hide
-	// them from help on non-paginating commands, so help doesn't imply a
-	// get/write can paginate.
-	if !spec.paginates {
-		for _, name := range []string{"page-all", "page-limit", "page-delay"} {
-			_ = cmd.Flags().MarkHidden(name)
-		}
-	}
 	cmd.Flags().StringVar(&opts.Format, "format", "json", "output format: json|ndjson|table|csv")
 	cmd.Flags().Bool("json", false, "shorthand for --format json")
 	cmd.Flags().StringVarP(&opts.JqExpr, "jq", "q", "", "jq expression to filter JSON output")
@@ -316,11 +271,10 @@ func buildMethodCommand(ctx context.Context, f *cmdutil.Factory, spec methodComm

 	// Registered last so the collision guard sees the standard flags above.
 	opts.binder = newParamFlagBinder(cmd, spec.params, reserved)
-	// Build-time Long; the agent guidance is added lazily by PrepareMethodHelp
-	// (setMethodHelpData records the coordinates it needs).
-	paramsOnly := opts.binder.paramsOnlyHelp()
-	cmd.Long = methodLong(m.Description, spec.schemaPath, paramsOnly)
-	setMethodHelpData(cmd, spec.serviceName, m.ID, spec.schemaPath, paramsOnly)
+	// Single composition point for Long: description, affordance, schema
+	// pointer, and the binder's params-only addendum (params whose flag name is
+	// taken, reachable via --params only).
+	cmd.Long = methodLong(m.Description, spec.affordance, spec.schemaPath, opts.binder.paramsOnlyHelp())

 	// Group flags for the grouped --help renderer (typed param flags are grouped
 	// as API Parameters by the binder). tagFlagGroup is a no-op for flags not
@@ -338,11 +292,13 @@ func buildMethodCommand(ctx context.Context, f *cmdutil.Factory, spec methodComm
 	tagFlagGroup(cmd.Flags(), "file", groupBody)
 	if fl := cmd.Flags().Lookup("params"); fl != nil {
 		annotate(fl, flagGroupAnnotation, []string{groupRaw})
-		// Keep the precedence rule on the flag's own one line (not a multi-line
-		// note that breaks the one-entry-per-flag rhythm an agent parses). Only
-		// meaningful when typed flags exist to override.
+		// State the precedence rule where the agent reads it: --params is the
+		// base, typed flags override. Only meaningful when typed flags exist.
 		if len(spec.params) > 0 {
-			fl.Usage = "Raw URL/query params JSON. Supports - and @file. If both set, typed flags override matching keys in --params."
+			annotate(fl, flagNoteAnnotation, []string{
+				"Typed API parameter flags above are preferred.",
+				"If both are set, typed flags override matching keys in --params.",
+			})
 		}
 	}
 	for _, name := range []string{"as", "dry-run", "page-all", "page-limit", "page-delay", "yes"} {
--- a/content_embed.go
+++ b/content_embed.go
@@ -1,41 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package main
-
-import (
-	"embed"
-	"fmt"
-	"io/fs"
-	"os"
-
-	"github.com/larksuite/cli/cmd"
-	"github.com/larksuite/cli/internal/affordance"
-)
-
-// embeddedContentFS bundles the agent-readable content that must ship in lockstep
-// with the binary: each skill's docs (SKILL.md + references/, plus whiteboard's
-// routes/ and scenes/) and the per-domain affordance guidance (affordance/*.md).
-// Machine-resource skill dirs (assets/, scripts/) are excluded. It's a whitelist —
-// a new content type is omitted until added to the embed list. The embed must live
-// in this root package because go:embed cannot reach up out of a package's dir.
-//
-//go:embed skills/*/SKILL.md skills/*/references skills/*/routes skills/*/scenes affordance/*.md
-var embeddedContentFS embed.FS
-
-// init wires the embedded content into the CLI. It compiles into `go build .` but
-// not the single-file preview build (`go build ./main.go`), so that build stays
-// self-contained (shipping no embedded content). Assembly failures warn on stderr
-// rather than panicking — embedded content is nice-to-have, not load-bearing.
-func init() {
-	if sub, err := fs.Sub(embeddedContentFS, "skills"); err != nil {
-		fmt.Fprintln(os.Stderr, "warning: skills embed assembly failed, skills commands disabled:", err)
-	} else {
-		cmd.SetEmbeddedSkillContent(sub)
-	}
-	if sub, err := fs.Sub(embeddedContentFS, "affordance"); err != nil {
-		fmt.Fprintln(os.Stderr, "warning: affordance embed assembly failed, command guidance disabled:", err)
-	} else {
-		affordance.SetSource(sub)
-	}
-}
--- a/events/vc/participant_meeting_joined.go
+++ b/events/vc/participant_meeting_joined.go
@@ -1,62 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package vc
-
-import (
-	"context"
-	"encoding/json"
-
-	"github.com/larksuite/cli/internal/event"
-)
-
-// VCParticipantMeetingJoinedOutput is the flattened shape for vc.meeting.participant_meeting_joined_v1.
-type VCParticipantMeetingJoinedOutput struct {
-	Type            string `json:"type"                      desc:"Event type; always vc.meeting.participant_meeting_joined_v1"`
-	EventID         string `json:"event_id,omitempty"        desc:"Globally unique event ID; safe for deduplication"`
-	Timestamp       string `json:"timestamp,omitempty"       desc:"Event delivery time (ms timestamp string); taken from header.create_time when present" kind:"timestamp_ms"`
-	MeetingID       string `json:"meeting_id,omitempty"      desc:"Meeting ID" kind:"meeting_id"`
-	Topic           string `json:"topic,omitempty"           desc:"Meeting topic"`
-	MeetingNo       string `json:"meeting_no,omitempty"      desc:"Meeting number"`
-	StartTime       string `json:"start_time,omitempty"      desc:"Meeting start time in RFC3339, converted to the local timezone"`
-	CalendarEventID string `json:"calendar_event_id,omitempty" desc:"Calendar event ID associated with the meeting"`
-}
-
-func processVCParticipantMeetingJoined(_ context.Context, _ event.APIClient, raw *event.RawEvent, _ map[string]string) (json.RawMessage, error) {
-	var envelope struct {
-		Header struct {
-			EventID    string `json:"event_id"`
-			EventType  string `json:"event_type"`
-			CreateTime string `json:"create_time"`
-		} `json:"header"`
-		Event struct {
-			Meeting struct {
-				ID              string `json:"id"`
-				Topic           string `json:"topic"`
-				MeetingNo       string `json:"meeting_no"`
-				StartTime       string `json:"start_time"`
-				EndTime         string `json:"end_time"`
-				CalendarEventID string `json:"calendar_event_id"`
-			} `json:"meeting"`
-		} `json:"event"`
-	}
-	if err := json.Unmarshal(raw.Payload, &envelope); err != nil {
-		return raw.Payload, nil //nolint:nilerr // passthrough on malformed payload so consumers still see the event
-	}
-
-	meeting := envelope.Event.Meeting
-	out := &VCParticipantMeetingJoinedOutput{
-		Type:            envelope.Header.EventType,
-		EventID:         envelope.Header.EventID,
-		Timestamp:       envelope.Header.CreateTime,
-		MeetingID:       meeting.ID,
-		Topic:           meeting.Topic,
-		MeetingNo:       meeting.MeetingNo,
-		StartTime:       unixSecondsToLocalRFC3339(meeting.StartTime),
-		CalendarEventID: meeting.CalendarEventID,
-	}
-	if out.Type == "" {
-		out.Type = raw.EventType
-	}
-	return json.Marshal(out)
-}
--- a/events/vc/participant_meeting_lifecycle_test.go
+++ b/events/vc/participant_meeting_lifecycle_test.go
@@ -1,281 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package vc
-
-import (
-	"context"
-	"encoding/json"
-	"reflect"
-	"testing"
-	"time"
-
-	"github.com/larksuite/cli/internal/event"
-)
-
-func TestVCKeys_ProcessedMeetingLifecycleRegistered(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-
-	for _, tc := range []struct {
-		eventType  string
-		schemaType reflect.Type
-	}{
-		{eventTypeMeetingStarted, reflect.TypeOf(VCParticipantMeetingStartedOutput{})},
-		{eventTypeMeetingJoined, reflect.TypeOf(VCParticipantMeetingJoinedOutput{})},
-	} {
-		t.Run(tc.eventType, func(t *testing.T) {
-			def, ok := event.Lookup(tc.eventType)
-			if !ok {
-				t.Fatalf("%s should be registered via Keys()", tc.eventType)
-			}
-			if def.Schema.Custom == nil {
-				t.Error("Processed key must set Schema.Custom")
-			}
-			if def.Schema.Native != nil {
-				t.Error("Processed key must not set Schema.Native")
-			}
-			if def.Process == nil {
-				t.Error("Process must not be nil for processed key")
-			}
-			if def.PreConsume == nil {
-				t.Error("PreConsume must not be nil for processed key")
-			}
-			if len(def.Scopes) != 1 || def.Scopes[0] != "vc:meeting.meetingevent:read" {
-				t.Errorf("Scopes = %v", def.Scopes)
-			}
-			if len(def.AuthTypes) != 1 || def.AuthTypes[0] != "user" {
-				t.Errorf("AuthTypes = %v", def.AuthTypes)
-			}
-			if len(def.RequiredConsoleEvents) != 1 || def.RequiredConsoleEvents[0] != tc.eventType {
-				t.Errorf("RequiredConsoleEvents = %v", def.RequiredConsoleEvents)
-			}
-			if def.Schema.Custom.Type != tc.schemaType {
-				t.Errorf("Custom schema Type = %v, want %v", def.Schema.Custom.Type, tc.schemaType)
-			}
-		})
-	}
-}
-
-func TestProcessVCParticipantMeetingLifecycle(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-
-	for _, tc := range []struct {
-		name      string
-		eventType string
-		process   event.ProcessFunc
-	}{
-		{
-			name:      "started",
-			eventType: eventTypeMeetingStarted,
-			process:   processVCParticipantMeetingStarted,
-		},
-		{
-			name:      "joined",
-			eventType: eventTypeMeetingJoined,
-			process:   processVCParticipantMeetingJoined,
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			payload := `{
-				"schema": "2.0",
-				"header": {
-					"event_id": "ev_vc_lifecycle_001",
-					"event_type": "` + tc.eventType + `",
-					"create_time": "1608725989000",
-					"app_id": "cli_test"
-				},
-				"event": {
-					"meeting": {
-						"id": "6911188411934433028",
-						"topic": "my meeting",
-						"meeting_no": "235812466",
-						"start_time": "1608883322",
-						"end_time": "1608883899",
-						"calendar_event_id": "efa67a98-06a8-4df5-8559-746c8f4477ef_0"
-					}
-				}
-			}`
-			out := runMeetingLifecycleMap(t, tc.eventType, tc.process, payload)
-
-			if out["type"] != tc.eventType {
-				t.Errorf("type = %q", out["type"])
-			}
-			if out["event_id"] != "ev_vc_lifecycle_001" {
-				t.Errorf("event_id = %q", out["event_id"])
-			}
-			if out["timestamp"] != "1608725989000" {
-				t.Errorf("timestamp = %q", out["timestamp"])
-			}
-			if out["meeting_id"] != "6911188411934433028" {
-				t.Errorf("meeting_id = %q", out["meeting_id"])
-			}
-			if out["topic"] != "my meeting" || out["meeting_no"] != "235812466" {
-				t.Errorf("topic/meeting_no = %q/%q", out["topic"], out["meeting_no"])
-			}
-			if out["calendar_event_id"] != "efa67a98-06a8-4df5-8559-746c8f4477ef_0" {
-				t.Errorf("calendar_event_id = %q", out["calendar_event_id"])
-			}
-			if want := time.Unix(1608883322, 0).Local().Format(time.RFC3339); out["start_time"] != want {
-				t.Errorf("start_time = %q, want %q", out["start_time"], want)
-			}
-			if _, hasEndTime := out["end_time"]; hasEndTime {
-				t.Error("end_time should not be present in started/joined output")
-			}
-		})
-	}
-}
-
-func TestProcessVCParticipantMeetingLifecycle_InvalidMeetingTimes(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-
-	for _, tc := range []struct {
-		name      string
-		eventType string
-		process   event.ProcessFunc
-	}{
-		{"started", eventTypeMeetingStarted, processVCParticipantMeetingStarted},
-		{"joined", eventTypeMeetingJoined, processVCParticipantMeetingJoined},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			payload := `{
-				"schema": "2.0",
-				"header": {
-					"event_id": "ev_vc_lifecycle_002",
-					"event_type": "` + tc.eventType + `",
-					"create_time": "1608725989001"
-				},
-				"event": {
-					"meeting": {
-						"id": "meeting_invalid_time",
-						"start_time": "bad",
-						"end_time": ""
-					}
-				}
-			}`
-			out := runMeetingLifecycleRaw(t, tc.eventType, tc.process, payload)
-			switch tc.eventType {
-			case eventTypeMeetingStarted:
-				var started VCParticipantMeetingStartedOutput
-				if err := json.Unmarshal(out, &started); err != nil {
-					t.Fatalf("Process output is not valid started JSON: %v\nraw=%s", err, string(out))
-				}
-				if started.StartTime != "" {
-					t.Errorf("StartTime = %q, want empty string", started.StartTime)
-				}
-			case eventTypeMeetingJoined:
-				var joined VCParticipantMeetingJoinedOutput
-				if err := json.Unmarshal(out, &joined); err != nil {
-					t.Fatalf("Process output is not valid joined JSON: %v\nraw=%s", err, string(out))
-				}
-				if joined.StartTime != "" {
-					t.Errorf("StartTime = %q, want empty string", joined.StartTime)
-				}
-			}
-		})
-	}
-}
-
-func TestProcessVCParticipantMeetingLifecycle_MalformedPayload(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-
-	for _, tc := range []struct {
-		name      string
-		eventType string
-		process   event.ProcessFunc
-	}{
-		{"started", eventTypeMeetingStarted, processVCParticipantMeetingStarted},
-		{"joined", eventTypeMeetingJoined, processVCParticipantMeetingJoined},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			raw := &event.RawEvent{
-				EventType: tc.eventType,
-				Payload:   json.RawMessage(`not json`),
-				Timestamp: time.Now(),
-			}
-			got, err := tc.process(context.Background(), nil, raw, nil)
-			if err != nil {
-				t.Fatalf("Process should swallow parse errors, got %v", err)
-			}
-			if string(got) != "not json" {
-				t.Errorf("malformed fallback output = %q, want original bytes", string(got))
-			}
-		})
-	}
-}
-
-func TestVCParticipantMeetingLifecycle_PreConsumeSubscriptionLifecycle(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-
-	for _, eventType := range []string{eventTypeMeetingStarted, eventTypeMeetingJoined} {
-		t.Run(eventType, func(t *testing.T) {
-			def, ok := event.Lookup(eventType)
-			if !ok {
-				t.Fatalf("%s should be registered via Keys()", eventType)
-			}
-
-			type call struct {
-				method string
-				path   string
-				body   any
-			}
-			var calls []call
-			rt := &stubAPIClient{
-				callFn: func(_ context.Context, method, path string, body any) (json.RawMessage, error) {
-					calls = append(calls, call{method: method, path: path, body: body})
-					return json.RawMessage(`{"code":0,"msg":"success","data":{}}`), nil
-				},
-			}
-
-			cleanup, err := def.PreConsume(context.Background(), rt, nil)
-			if err != nil {
-				t.Fatalf("PreConsume error: %v", err)
-			}
-			if cleanup == nil {
-				t.Fatal("cleanup must not be nil")
-			}
-			if len(calls) != 1 {
-				t.Fatalf("calls after subscribe = %d, want 1", len(calls))
-			}
-			if calls[0].method != "POST" || calls[0].path != pathMeetingSubscribe {
-				t.Fatalf("subscribe call = %+v", calls[0])
-			}
-			assertSubscriptionRequest(t, calls[0].body, eventType)
-
-			cleanup()
-			if len(calls) != 2 {
-				t.Fatalf("calls after cleanup = %d, want 2", len(calls))
-			}
-			if calls[1].method != "POST" || calls[1].path != pathMeetingUnsubscribe {
-				t.Fatalf("unsubscribe call = %+v", calls[1])
-			}
-			assertSubscriptionRequest(t, calls[1].body, eventType)
-		})
-	}
-}
-
-func runMeetingLifecycleMap(t *testing.T, eventType string, process event.ProcessFunc, payload string) map[string]string {
-	t.Helper()
-	got := runMeetingLifecycleRaw(t, eventType, process, payload)
-	if got == nil {
-		t.Fatal("Process output is nil")
-	}
-	var out map[string]string
-	if err := json.Unmarshal(got, &out); err != nil {
-		t.Fatalf("Process output is not valid flat JSON object: %v\nraw=%s", err, string(got))
-	}
-	return out
-}
-
-func runMeetingLifecycleRaw(t *testing.T, eventType string, process event.ProcessFunc, payload string) json.RawMessage {
-	t.Helper()
-	raw := &event.RawEvent{
-		EventType: eventType,
-		Payload:   json.RawMessage(payload),
-		Timestamp: time.Now(),
-	}
-	got, err := process(context.Background(), nil, raw, nil)
-	if err != nil {
-		t.Fatalf("Process error: %v", err)
-	}
-	return got
-}
--- a/events/vc/participant_meeting_started.go
+++ b/events/vc/participant_meeting_started.go
@@ -1,61 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package vc
-
-import (
-	"context"
-	"encoding/json"
-
-	"github.com/larksuite/cli/internal/event"
-)
-
-// VCParticipantMeetingStartedOutput is the flattened shape for vc.meeting.participant_meeting_started_v1.
-type VCParticipantMeetingStartedOutput struct {
-	Type            string `json:"type"                      desc:"Event type; always vc.meeting.participant_meeting_started_v1"`
-	EventID         string `json:"event_id,omitempty"        desc:"Globally unique event ID; safe for deduplication"`
-	Timestamp       string `json:"timestamp,omitempty"       desc:"Event delivery time (ms timestamp string); taken from header.create_time when present" kind:"timestamp_ms"`
-	MeetingID       string `json:"meeting_id,omitempty"      desc:"Meeting ID" kind:"meeting_id"`
-	Topic           string `json:"topic,omitempty"           desc:"Meeting topic"`
-	MeetingNo       string `json:"meeting_no,omitempty"      desc:"Meeting number"`
-	StartTime       string `json:"start_time,omitempty"      desc:"Meeting start time in RFC3339, converted to the local timezone"`
-	CalendarEventID string `json:"calendar_event_id,omitempty" desc:"Calendar event ID associated with the meeting"`
-}
-
-func processVCParticipantMeetingStarted(_ context.Context, _ event.APIClient, raw *event.RawEvent, _ map[string]string) (json.RawMessage, error) {
-	var envelope struct {
-		Header struct {
-			EventID    string `json:"event_id"`
-			EventType  string `json:"event_type"`
-			CreateTime string `json:"create_time"`
-		} `json:"header"`
-		Event struct {
-			Meeting struct {
-				ID              string `json:"id"`
-				Topic           string `json:"topic"`
-				MeetingNo       string `json:"meeting_no"`
-				StartTime       string `json:"start_time"`
-				CalendarEventID string `json:"calendar_event_id"`
-			} `json:"meeting"`
-		} `json:"event"`
-	}
-	if err := json.Unmarshal(raw.Payload, &envelope); err != nil {
-		return raw.Payload, nil //nolint:nilerr // passthrough on malformed payload so consumers still see the event
-	}
-
-	meeting := envelope.Event.Meeting
-	out := &VCParticipantMeetingStartedOutput{
-		Type:            envelope.Header.EventType,
-		EventID:         envelope.Header.EventID,
-		Timestamp:       envelope.Header.CreateTime,
-		MeetingID:       meeting.ID,
-		Topic:           meeting.Topic,
-		MeetingNo:       meeting.MeetingNo,
-		StartTime:       unixSecondsToLocalRFC3339(meeting.StartTime),
-		CalendarEventID: meeting.CalendarEventID,
-	}
-	if out.Type == "" {
-		out.Type = raw.EventType
-	}
-	return json.Marshal(out)
-}
--- a/events/vc/register.go
+++ b/events/vc/register.go
@@ -11,8 +11,6 @@ import (
 )

 const (
-	eventTypeMeetingStarted               = "vc.meeting.participant_meeting_started_v1"
-	eventTypeMeetingJoined                = "vc.meeting.participant_meeting_joined_v1"
 	eventTypeMeetingEnded                 = "vc.meeting.participant_meeting_ended_v1"
 	eventTypeNoteGenerated                = "vc.note.generated_v1"
 	eventTypeRecordingStarted             = "vc.recording.recording_started_v1"
@@ -32,38 +30,6 @@ const (
 // Keys returns all VC-domain EventKey definitions.
 func Keys() []event.KeyDefinition {
 	return []event.KeyDefinition{
-		{
-			Key:         eventTypeMeetingStarted,
-			DisplayName: "Participant meeting started",
-			Description: "Triggered when a meeting the current user participates in has started",
-			EventType:   eventTypeMeetingStarted,
-			Schema: event.SchemaDef{
-				Custom: &event.SchemaSpec{Type: reflect.TypeOf(VCParticipantMeetingStartedOutput{})},
-			},
-			Process:    processVCParticipantMeetingStarted,
-			PreConsume: subscriptionPreConsume(eventTypeMeetingStarted, pathMeetingSubscribe, pathMeetingUnsubscribe),
-			Scopes:     []string{"vc:meeting.meetingevent:read"},
-			AuthTypes: []string{
-				"user",
-			},
-			RequiredConsoleEvents: []string{eventTypeMeetingStarted},
-		},
-		{
-			Key:         eventTypeMeetingJoined,
-			DisplayName: "Participant meeting joined",
-			Description: "Triggered when the current user joins a meeting",
-			EventType:   eventTypeMeetingJoined,
-			Schema: event.SchemaDef{
-				Custom: &event.SchemaSpec{Type: reflect.TypeOf(VCParticipantMeetingJoinedOutput{})},
-			},
-			Process:    processVCParticipantMeetingJoined,
-			PreConsume: subscriptionPreConsume(eventTypeMeetingJoined, pathMeetingSubscribe, pathMeetingUnsubscribe),
-			Scopes:     []string{"vc:meeting.meetingevent:read"},
-			AuthTypes: []string{
-				"user",
-			},
-			RequiredConsoleEvents: []string{eventTypeMeetingJoined},
-		},
 		{
 			Key:         eventTypeMeetingEnded,
 			DisplayName: "Participant meeting ended",
--- a/internal/affordance/affordance.go
+++ b/internal/affordance/affordance.go
@@ -1,96 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-// Package affordance is the lazily-loaded store of usage guidance for
-// service-API methods. The source of truth is one markdown file per service in
-// the top-level affordance/ tree (see mdparse.go), injected via SetSource so
-// domain owners maintain it next to skills/ and shortcuts/. A service is read
-// and parsed at most once, on first access, so normal command execution never
-// touches it.
-package affordance
-
-import (
-	"encoding/json"
-	"io/fs"
-	"strings"
-	"sync"
-
-	"github.com/larksuite/cli/internal/apicatalog"
-	"github.com/larksuite/cli/internal/registry"
-)
-
-var (
-	mu        sync.Mutex
-	byService = map[string]map[string]json.RawMessage{}
-	tried     = map[string]bool{}
-	mdSource  fs.FS // top-level affordance/*.md tree; nil in the minimal preview build
-)
-
-// SetSource installs the markdown guidance tree (the top-level affordance/
-// directory) as the source. Called once at startup before any lookup; clears
-// the parse cache so re-sourcing (e.g. in tests) takes effect.
-func SetSource(fsys fs.FS) {
-	mu.Lock()
-	defer mu.Unlock()
-	mdSource = fsys
-	byService = map[string]map[string]json.RawMessage{}
-	tried = map[string]bool{}
-}
-
-// For returns the raw affordance overlay for one method, loading the owning
-// service on first access. ok is false when there is no entry (absent source,
-// parse failure, or unknown method all collapse to "no guidance").
-func For(service, methodID string) (json.RawMessage, bool) {
-	mu.Lock()
-	defer mu.Unlock()
-	if !tried[service] {
-		tried[service] = true
-		byService[service] = loadService(service)
-	}
-	raw, ok := byService[service][methodID]
-	return raw, ok && len(raw) > 0
-}
-
-// loadService parses a service's markdown guidance into per-method overlays,
-// marshalling each to JSON so downstream callers keep the same wire shape.
-func loadService(service string) map[string]json.RawMessage {
-	if mdSource == nil {
-		return nil
-	}
-	src, err := fs.ReadFile(mdSource, service+".md")
-	if err != nil {
-		return nil
-	}
-	m := map[string]json.RawMessage{}
-	for id, a := range parseDomainMD(src, commandFormResolver(service)) {
-		if b, err := json.Marshal(a); err == nil {
-			m[id] = b
-		}
-	}
-	return m
-}
-
-// commandFormResolver maps a method's command-form heading ("user_mailbox.messages
-// list") to its method id ("user_mailbox.message.list") via the registry's
-// authoritative resource↔id table. Resource names are irregularly pluralised
-// (message/messages, user_mailbox/user_mailboxes), so this cannot be guessed; the
-// space→dot fallback covers domains where the two already coincide.
-func commandFormResolver(service string) func(string) string {
-	byForm := map[string]string{}
-	for _, svc := range registry.EmbeddedServicesTyped() {
-		if svc.Name != service {
-			continue
-		}
-		for _, ref := range apicatalog.ServiceMethods(svc, nil) {
-			byForm[strings.Join(ref.CommandPath()[1:], " ")] = ref.Method.ID
-		}
-		break
-	}
-	return func(h string) string {
-		h = strings.TrimSpace(h)
-		if id, ok := byForm[h]; ok {
-			return id
-		}
-		return strings.ReplaceAll(h, " ", ".")
-	}
-}
--- a/internal/affordance/affordance_test.go
+++ b/internal/affordance/affordance_test.go
@@ -1,86 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package affordance
-
-import (
-	"encoding/json"
-	"testing"
-	"testing/fstest"
-)
-
-// fixtureMD is a minimal affordance source: two methods, each with a lead
-// paragraph (use_when) and a fenced example.
-const fixtureMD = "# approval\n" +
-	"> skill: lark-approval\n\n" +
-	"## instances cc\n" +
-	"把一个审批实例抄送给指定用户。\n\n" +
-	"### Examples\n\n" +
-	"**抄送给用户**\n" +
-	"```bash\n" +
-	"lark-cli approval instances cc --data '{\"instance_code\":\"x\"}'\n" +
-	"```\n\n" +
-	"## instances get\n" +
-	"查询某审批实例详情。\n\n" +
-	"### Examples\n\n" +
-	"**按 code 查询**\n" +
-	"```bash\n" +
-	"lark-cli approval instances get --instance-code \"x\"\n" +
-	"```\n"
-
-func TestFor(t *testing.T) {
-	prev := mdSource
-	t.Cleanup(func() { SetSource(prev) }) // SetSource mutates package state; restore for test isolation
-	SetSource(fstest.MapFS{"approval.md": &fstest.MapFile{Data: []byte(fixtureMD)}})
-
-	// A seeded method in a seeded service resolves to its overlay.
-	raw, ok := For("approval", "instances.cc")
-	if !ok {
-		t.Fatal(`For("approval","instances.cc") ok=false, want an overlay`)
-	}
-	var a struct {
-		UseWhen  []string `json:"use_when"`
-		Examples []struct {
-			Command string `json:"command"`
-		} `json:"examples"`
-	}
-	if err := json.Unmarshal(raw, &a); err != nil {
-		t.Fatalf("overlay is not valid affordance JSON: %v", err)
-	}
-	if len(a.UseWhen) == 0 || len(a.Examples) == 0 || a.Examples[0].Command == "" {
-		t.Errorf("overlay missing use_when/examples: %s", raw)
-	}
-
-	// Misses: unknown method in a known service, and an unknown service, both
-	// resolve to ok=false (no panic, no error) so callers treat them as "no
-	// guidance".
-	if _, ok := For("approval", "instances.no_such_method"); ok {
-		t.Error("unknown method should be ok=false")
-	}
-	if _, ok := For("no_such_service", "x.y"); ok {
-		t.Error("unknown service should be ok=false")
-	}
-
-	// A second lookup of the same service is served from cache (parsed at most
-	// once) and stays consistent.
-	if _, ok := For("approval", "instances.get"); !ok {
-		t.Error("second lookup in a cached service should still resolve")
-	}
-}
-
-// Non-bullet paragraph lines under any section are preserved as items, not
-// dropped (regression: they previously only updated pending, lost without a fence).
-func TestParseDomainMD_ParagraphNotDropped(t *testing.T) {
-	md := "# d\n\n## foo bar\nwhat it does.\n\n### Tips\n- a bullet\nplain paragraph note.\n\n### See also\nrun [[other cmd]] first.\n"
-	got := parseDomainMD([]byte(md), nil) // nil resolver -> space->dot, "foo bar" -> "foo.bar"
-	a, ok := got["foo.bar"]
-	if !ok {
-		t.Fatal("method not parsed")
-	}
-	if len(a.Tips) != 2 || a.Tips[1] != "plain paragraph note." {
-		t.Errorf("Tips paragraph dropped: %v", a.Tips)
-	}
-	if len(a.Extensions) != 1 || len(a.Extensions[0].Items) != 1 || a.Extensions[0].Items[0] != "run `other cmd` first." {
-		t.Errorf("custom-section paragraph not flowed through: %+v", a.Extensions)
-	}
-}
--- a/internal/affordance/mdparse.go
+++ b/internal/affordance/mdparse.go
@@ -1,180 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package affordance
-
-import (
-	"regexp"
-	"strings"
-
-	"github.com/larksuite/cli/internal/meta"
-)
-
-// The affordance source is a narrow, fixed markdown subset (see src/*.md):
-//
-//	# domain            optional `> skill: <name>` applied to every method
-//	## command          e.g. `instances get`
-//	<lead paragraph>    -> use_when (when this command is right)
-//	### Avoid when      -> avoid_when (links become prefer/alternative edges)
-//	### Prerequisites   -> prerequisites   (a "…来自 [[x]]" link is a sequence edge)
-//	### Tips            -> tips
-//	### Examples        -> examples: **description** + a ```fenced``` command
-//	### <other>         -> extensions[] (custom section, flows through verbatim)
-//	[[cmd]]             -> a command reference, rendered as `cmd`
-//
-// Parsing is lazy and cached (see For), so the constrained grammar is read at
-// most once per domain.
-
-var mdLink = regexp.MustCompile(`\[\[(.+?)\]\]`)
-
-// standardSection maps a section heading to its typed Affordance field; any
-// other heading becomes an extension.
-var standardSection = map[string]string{
-	"Avoid when":    "avoid_when",
-	"Prerequisites": "prerequisites",
-	"Tips":          "tips",
-	"Examples":      "examples",
-}
-
-func linkToBacktick(s string) string { return mdLink.ReplaceAllString(s, "`$1`") }
-
-// headingToKey maps a command heading ("instances get") to its affordance key
-// ("instances.get"). The space→dot rule holds where the command form matches
-// the method id; domains whose resource names differ (e.g. plural "messages"
-// vs id segment "message") need the registry's authoritative resource↔id table.
-func headingToKey(h string) string {
-	return strings.ReplaceAll(strings.TrimSpace(h), " ", ".")
-}
-
-type mdSection struct {
-	label string
-	items []string
-	cases []meta.AffordanceCase
-}
-
-// parseDomainMD parses one domain's markdown into per-method Affordance values,
-// keyed by method id. resolve maps a command-form heading ("user_mailbox.messages
-// list") to its method id ("user_mailbox.message.list"); nil falls back to the
-// space→dot rule (valid only where the command form already equals the id).
-func parseDomainMD(src []byte, resolve func(string) string) map[string]meta.Affordance {
-	if resolve == nil {
-		resolve = headingToKey
-	}
-	out := map[string]meta.Affordance{}
-
-	var skill, curKey string
-	var useWhen, para []string // lead paragraphs -> use_when entries (blank line separates)
-	var secs []*mdSection
-	var sec *mdSection
-	var pending string
-	var fence []string
-	inFence := false
-
-	assemble := func() {
-		if curKey == "" {
-			return
-		}
-		if len(para) > 0 {
-			useWhen = append(useWhen, strings.TrimSpace(strings.Join(para, " ")))
-			para = nil
-		}
-		var a meta.Affordance
-		if len(useWhen) > 0 {
-			a.UseWhen = useWhen
-		}
-		for _, s := range secs {
-			switch standardSection[s.label] {
-			case "avoid_when":
-				a.AvoidWhen = s.items
-			case "prerequisites":
-				a.Prerequisites = s.items
-			case "tips":
-				a.Tips = s.items
-			case "examples":
-				a.Examples = s.cases
-			default:
-				a.Extensions = append(a.Extensions, meta.AffordanceSection{Label: s.label, Items: s.items})
-			}
-		}
-		if skill != "" {
-			a.Skills = []string{skill}
-		}
-		out[curKey] = a
-	}
-
-	reset := func() { useWhen, para, secs, sec, pending, fence, inFence = nil, nil, nil, nil, "", nil, false }
-
-	// flushPending appends a non-bullet paragraph line that was not consumed as
-	// an example description (i.e. no fence followed) to the current section's
-	// items, so prose under any section is preserved rather than dropped.
-	flushPending := func() {
-		if sec != nil && pending != "" {
-			sec.items = append(sec.items, linkToBacktick(pending))
-			pending = ""
-		}
-	}
-
-	for _, raw := range strings.Split(string(src), "\n") {
-		line := strings.TrimRight(raw, "\r")
-		t := strings.TrimSpace(line)
-		switch {
-		case strings.HasPrefix(line, "## "):
-			flushPending()
-			assemble()
-			curKey = resolve(line[3:])
-			reset()
-			continue
-		case strings.HasPrefix(line, "# "):
-			continue
-		case strings.HasPrefix(t, "> skill:"):
-			skill = strings.TrimSpace(t[len("> skill:"):])
-			continue
-		case strings.HasPrefix(line, "### "):
-			flushPending()
-			sec = &mdSection{label: strings.TrimSpace(line[4:])}
-			secs = append(secs, sec)
-			pending, fence, inFence = "", nil, false
-			continue
-		}
-		if curKey == "" {
-			continue
-		}
-		if sec == nil { // lead paragraphs before any section -> use_when (blank line separates entries)
-			if t == "" {
-				if len(para) > 0 {
-					useWhen = append(useWhen, strings.Join(para, " "))
-					para = nil
-				}
-			} else {
-				para = append(para, t)
-			}
-			continue
-		}
-		// inside a section: a fenced block is an example command; otherwise the
-		// shape follows the writing (bullet item vs **description** before a fence).
-		if strings.HasPrefix(t, "```") {
-			if !inFence {
-				inFence, fence = true, nil
-			} else {
-				inFence = false
-				sec.cases = append(sec.cases, meta.AffordanceCase{Description: pending, Command: strings.Join(fence, "\n")})
-				pending = ""
-			}
-			continue
-		}
-		if inFence {
-			fence = append(fence, line)
-			continue
-		}
-		if strings.HasPrefix(t, "-") {
-			flushPending()
-			sec.items = append(sec.items, linkToBacktick(strings.TrimSpace(t[1:])))
-		} else if t != "" {
-			flushPending()
-			pending = strings.Trim(t, "* ")
-		}
-	}
-	flushPending()
-	assemble()
-	return out
-}
--- a/internal/meta/affordance.go
+++ b/internal/meta/affordance.go
@@ -5,39 +5,30 @@ package meta

 import "encoding/json"

-// Affordance is the typed usage guidance overlaid on a method. It is the single
-// model the envelope renderer and the command help both parse, so the
-// vocabulary is defined once; the JSON tags double as the envelope wire shape.
-// Skills entries are skill names (or name/path) rendered as runnable
-// `lark-cli skills read <entry>` pointers.
+// Affordance is the hand-authored usage guidance overlaid on a method: when to
+// use it, when not to, prerequisites, few-shot examples, and related methods.
+// It is the single typed model of the affordance shape; the envelope renderer
+// and the command help both parse through ParsedAffordance so the vocabulary
+// is defined once. The JSON tags double as the envelope's wire shape.
 type Affordance struct {
-	UseWhen       []string            `json:"use_when,omitempty"`
-	AvoidWhen     []string            `json:"avoid_when,omitempty"`
-	Prerequisites []string            `json:"prerequisites,omitempty"`
-	Tips          []string            `json:"tips,omitempty"`
-	Examples      []AffordanceCase    `json:"examples,omitempty"`
-	Extensions    []AffordanceSection `json:"extensions,omitempty"`
-	Related       []string            `json:"related,omitempty"`
-	Skills        []string            `json:"skills,omitempty"`
+	UseWhen       []string         `json:"use_when,omitempty"`
+	DoNotUseWhen  []string         `json:"do_not_use_when,omitempty"`
+	Prerequisites []string         `json:"prerequisites,omitempty"`
+	Examples      []AffordanceCase `json:"examples,omitempty"`
+	Related       []string         `json:"related,omitempty"`
 }

-// AffordanceCase is one few-shot example: a description and a ready-to-run command.
+// AffordanceCase is one few-shot example: a one-line description and a
+// ready-to-run command.
 type AffordanceCase struct {
-	Description string `json:"description,omitempty"`
+	Description string `json:"description"`
 	Command     string `json:"command"`
 }

-// AffordanceSection is a custom guidance section: any heading beyond the
-// standard four (Avoid when / Prerequisites / Tips / Examples) flows through
-// here with its label preserved, so authors can add sections without code
-// changes.
-type AffordanceSection struct {
-	Label string   `json:"label"`
-	Items []string `json:"items,omitempty"`
-}
-
-// ParsedAffordance decodes the method's overlay. ok is false when it is absent,
-// malformed, or wholly empty — callers treat all three as "no guidance".
+// ParsedAffordance decodes the method's raw affordance overlay into the typed
+// Affordance. ok is false when the method carries no affordance, the JSON is
+// malformed, or every section is empty — so callers can treat "no guidance"
+// uniformly.
 func (m Method) ParsedAffordance() (Affordance, bool) {
 	if len(m.Affordance) == 0 {
 		return Affordance{}, false
@@ -46,7 +37,7 @@ func (m Method) ParsedAffordance() (Affordance, bool) {
 	if json.Unmarshal(m.Affordance, &a) != nil {
 		return Affordance{}, false
 	}
-	if len(a.UseWhen) == 0 && len(a.AvoidWhen) == 0 && len(a.Prerequisites) == 0 && len(a.Tips) == 0 && len(a.Examples) == 0 && len(a.Extensions) == 0 && len(a.Related) == 0 && len(a.Skills) == 0 {
+	if len(a.UseWhen) == 0 && len(a.DoNotUseWhen) == 0 && len(a.Prerequisites) == 0 && len(a.Examples) == 0 && len(a.Related) == 0 {
 		return Affordance{}, false
 	}
 	return a, true
--- a/internal/meta/affordance_test.go
+++ b/internal/meta/affordance_test.go
@@ -19,7 +19,7 @@ func TestMethod_ParsedAffordance(t *testing.T) {
 	notOK := map[string]string{
 		"empty payload":        ``,
 		"empty object":         `{}`,
-		"all empty arrays":     `{"use_when":[],"avoid_when":[],"prerequisites":[],"tips":[],"examples":[],"related":[]}`,
+		"all empty arrays":     `{"use_when":[],"do_not_use_when":[],"prerequisites":[],"examples":[],"related":[]}`,
 		"malformed string":     `"not an object"`,
 		"malformed number":     `42`,
 		"nested type mismatch": `{"examples":"should be a list"}`,
@@ -35,9 +35,8 @@ func TestMethod_ParsedAffordance(t *testing.T) {
 	// Populated affordance parses with all fields.
 	raw := `{
 		"use_when": ["需要拿到当前用户的主日历 ID"],
-		"avoid_when": ["已知具体 calendar_id"],
+		"do_not_use_when": ["已知具体 calendar_id"],
 		"prerequisites": ["user 身份登录"],
-		"tips": ["主日历的 calendar_id 即当前用户的 union_id"],
 		"examples": [{"description":"获取主日历","command":"lark-cli calendar calendars primary"}],
 		"related": ["calendars.list"]
 	}`
@@ -48,22 +47,10 @@ func TestMethod_ParsedAffordance(t *testing.T) {
 	if len(a.UseWhen) != 1 || a.UseWhen[0] != "需要拿到当前用户的主日历 ID" {
 		t.Errorf("UseWhen = %v", a.UseWhen)
 	}
-	if len(a.Tips) != 1 || a.Tips[0] != "主日历的 calendar_id 即当前用户的 union_id" {
-		t.Errorf("Tips = %v", a.Tips)
-	}
 	if len(a.Examples) != 1 || a.Examples[0].Description != "获取主日历" || a.Examples[0].Command != "lark-cli calendar calendars primary" {
 		t.Errorf("Examples = %+v", a.Examples)
 	}
 	if len(a.Related) != 1 || a.Related[0] != "calendars.list" {
 		t.Errorf("Related = %v", a.Related)
 	}
-
-	// A method whose only guidance is Tips still parses as populated.
-	tipsOnly, ok := (Method{Affordance: json.RawMessage(`{"tips":["先调用 list 拿到 id"]}`)}).ParsedAffordance()
-	if !ok {
-		t.Fatal("ParsedAffordance with only tips ok=false, want populated")
-	}
-	if len(tipsOnly.Tips) != 1 || tipsOnly.Tips[0] != "先调用 list 拿到 id" {
-		t.Errorf("Tips = %v", tipsOnly.Tips)
-	}
 }
--- a/internal/qualitygate/cmd/comment-audit/main.go
+++ b/internal/qualitygate/cmd/comment-audit/main.go
@@ -1,92 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package main
-
-import (
-	"encoding/json"
-	"flag"
-	"fmt"
-	"os"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/qualitygate/publiccontent"
-	"github.com/larksuite/cli/internal/qualitygate/report"
-	"github.com/larksuite/cli/internal/validate"
-	"github.com/larksuite/cli/internal/vfs"
-)
-
-type eventPayload struct {
-	Comment *struct {
-		Body string `json:"body"`
-	} `json:"comment"`
-	Review *struct {
-		Body string `json:"body"`
-	} `json:"review"`
-}
-
-func main() {
-	eventPath := flag.String("event", os.Getenv("GITHUB_EVENT_PATH"), "GitHub event payload path")
-	kind := flag.String("kind", os.Getenv("GITHUB_EVENT_NAME"), "GitHub event kind")
-	flag.Parse()
-
-	if *eventPath == "" {
-		fmt.Fprintln(os.Stderr, "comment-audit: --event or GITHUB_EVENT_PATH is required")
-		os.Exit(2)
-	}
-	body, err := commentBody(*eventPath)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "comment-audit: %v\n", err)
-		os.Exit(2)
-	}
-	diags := diagnostics(publiccontent.ScanComment(*kind, body))
-	if len(diags) > 0 {
-		fmt.Fprintln(os.Stderr, auditFailureSummary(len(diags)))
-	}
-	report.Print(os.Stderr, diags)
-	os.Exit(report.ExitCode(diags))
-}
-
-func auditFailureSummary(count int) string {
-	return fmt.Sprintf("post-publication audit found public content findings: %d", count)
-}
-
-func commentBody(path string) (string, error) {
-	safePath, err := validate.SafeInputPath(path)
-	if err != nil {
-		return "", errs.NewValidationError(errs.SubtypeInvalidArgument, "invalid --event: %v", err).
-			WithParam("--event").
-			WithCause(err)
-	}
-	data, err := vfs.ReadFile(safePath)
-	if err != nil {
-		return "", err
-	}
-	var payload eventPayload
-	if err := json.Unmarshal(data, &payload); err != nil {
-		return "", err
-	}
-	switch {
-	case payload.Comment != nil:
-		return payload.Comment.Body, nil
-	case payload.Review != nil:
-		return payload.Review.Body, nil
-	default:
-		return "", nil
-	}
-}
-
-func diagnostics(items []publiccontent.Finding) []report.Diagnostic {
-	out := make([]report.Diagnostic, 0, len(items))
-	for _, item := range items {
-		out = append(out, report.Diagnostic{
-			Rule:       item.Rule,
-			Action:     item.Action,
-			File:       item.File,
-			Line:       item.Line,
-			Message:    item.Message,
-			Suggestion: item.Suggestion,
-		})
-	}
-	return out
-}
--- a/internal/qualitygate/cmd/comment-audit/main_test.go
+++ b/internal/qualitygate/cmd/comment-audit/main_test.go
@@ -1,70 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package main
-
-import (
-	"errors"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-)
-
-func TestCommentBodyReadsSafeRelativeEventPath(t *testing.T) {
-	dir := t.TempDir()
-	if err := writeTestFile(filepath.Join(dir, "event.json"), `{"comment":{"body":"clean comment"}}`); err != nil {
-		t.Fatal(err)
-	}
-	origDir, err := os.Getwd()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := os.Chdir(dir); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() {
-		_ = os.Chdir(origDir)
-	})
-
-	got, err := commentBody("event.json")
-	if err != nil {
-		t.Fatalf("commentBody() error = %v", err)
-	}
-	if got != "clean comment" {
-		t.Fatalf("comment body = %q", got)
-	}
-}
-
-func TestCommentBodyRejectsUnsafeEventPath(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "event.json")
-	if err := writeTestFile(path, `{"comment":{"body":"clean"}}`); err != nil {
-		t.Fatal(err)
-	}
-
-	_, err := commentBody(path)
-	problem, ok := errs.ProblemOf(err)
-	if err == nil || !ok {
-		t.Fatalf("commentBody(%q) error = %v, want unsafe path validation error", path, err)
-	}
-	if problem.Category != errs.CategoryValidation || problem.Subtype != errs.SubtypeInvalidArgument {
-		t.Fatalf("commentBody(%q) problem = %#v, want invalid argument validation", path, problem)
-	}
-	var validationErr *errs.ValidationError
-	if !errors.As(err, &validationErr) || validationErr.Param != "--event" {
-		t.Fatalf("commentBody(%q) error = %v, want --event validation param", path, err)
-	}
-}
-
-func TestAuditFailureSummaryStatesPostPublicationAudit(t *testing.T) {
-	got := auditFailureSummary(2)
-	want := "post-publication audit found public content findings: 2"
-	if got != want {
-		t.Fatalf("auditFailureSummary() = %q, want %q", got, want)
-	}
-}
-
-func writeTestFile(path, data string) error {
-	return os.WriteFile(path, []byte(data), 0o644)
-}
--- a/internal/qualitygate/cmd/quality-gate/main.go
+++ b/internal/qualitygate/cmd/quality-gate/main.go
@@ -13,7 +13,6 @@ import (
 	"github.com/larksuite/cli/internal/qualitygate/manifest"
 	"github.com/larksuite/cli/internal/qualitygate/report"
 	"github.com/larksuite/cli/internal/qualitygate/rules"
-	"github.com/larksuite/cli/internal/validate"
 )

 func main() {
@@ -42,7 +41,6 @@ func runCheck(args []string) int {
 	fs.StringVar(&opts.FactsOut, "facts-out", "", "write facts JSON to this path")
 	fs.StringVar(&opts.ManifestPath, "manifest", "", "hand-authored command manifest JSON")
 	fs.StringVar(&opts.CommandIndexPath, "command-index", "", "full command index JSON")
-	fs.StringVar(&opts.PublicContentMetadataPath, "public-content-metadata", "", "PR title/body metadata JSON for public content checks")
 	fs.BoolVar(&printLegacyCommandCandidates, "print-legacy-command-candidates", false, "print current non-kebab-case hand-authored command candidates")
 	fs.BoolVar(&printLegacyFlagCandidates, "print-legacy-flag-candidates", false, "print current non-kebab-case flag candidates")
 	if err := fs.Parse(args); err != nil {
@@ -50,15 +48,6 @@ func runCheck(args []string) int {
 		return 2
 	}

-	if opts.PublicContentMetadataPath != "" {
-		safePath, err := validate.SafeInputPath(opts.PublicContentMetadataPath)
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "quality-gate check: --public-content-metadata: %v\n", err)
-			return 2
-		}
-		opts.PublicContentMetadataPath = safePath
-	}
-
 	if opts.ManifestPath == "" || opts.CommandIndexPath == "" {
 		fmt.Fprintln(os.Stderr, "quality-gate check: --manifest and --command-index are required")
 		return 2
--- a/internal/qualitygate/cmd/quality-gate/main_test.go
+++ b/internal/qualitygate/cmd/quality-gate/main_test.go
@@ -37,37 +37,6 @@ func TestCheckRequiresManifestInputs(t *testing.T) {
 	}
 }

-func TestCheckAcceptsPublicContentMetadataFlag(t *testing.T) {
-	code, stderr := runCheckCaptureStderr(t, []string{
-		"--repo", t.TempDir(),
-		"--cli-bin", "./lark-cli",
-		"--public-content-metadata", ".tmp/quality-gate/pr.json",
-	})
-	if code != 2 {
-		t.Fatalf("exit code = %d, stderr=%s", code, stderr)
-	}
-	if strings.Contains(stderr, "flag provided but not defined") {
-		t.Fatalf("public content metadata flag was not registered: %s", stderr)
-	}
-	if !strings.Contains(stderr, "--manifest and --command-index are required") {
-		t.Fatalf("stderr = %s", stderr)
-	}
-}
-
-func TestCheckRejectsUnsafePublicContentMetadataPath(t *testing.T) {
-	code, stderr := runCheckCaptureStderr(t, []string{
-		"--repo", t.TempDir(),
-		"--cli-bin", "./lark-cli",
-		"--public-content-metadata", filepath.Join(t.TempDir(), "pr.json"),
-	})
-	if code != 2 {
-		t.Fatalf("exit code = %d, stderr=%s", code, stderr)
-	}
-	if !strings.Contains(stderr, "--public-content-metadata") || !strings.Contains(stderr, "--file") {
-		t.Fatalf("stderr = %s, want unsafe public content metadata path error", stderr)
-	}
-}
-
 func TestCheckReportsManifestReadErrorsWithFlagName(t *testing.T) {
 	dir := t.TempDir()
 	manifestPath := filepath.Join(dir, "command-manifest.json")
--- a/internal/qualitygate/cmd/semantic-review/main.go
+++ b/internal/qualitygate/cmd/semantic-review/main.go
@@ -56,14 +56,6 @@ func run(args []string) int {
 		_ = semantic.WriteMarkdown(markdownOut, decision)
 		return 0
 	}
-	if reviewPath == "" && !semantic.BuildInputView(f).HasReviewableFacts() {
-		decision := finalizeDecision(block, waiverDiags, semantic.Decision{})
-		if err := writeSemanticOutputs(decisionOut, markdownOut, decision); err != nil {
-			fmt.Fprintf(os.Stderr, "semantic-review: %v\n", err)
-			return 2
-		}
-		return decisionExitCode(decision)
-	}
 	review, err := semantic.LoadOrReviewWithConfig(context.Background(), f, reviewPath, modelConfig)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "semantic-review: %v\n", err)
@@ -80,15 +72,6 @@ func run(args []string) int {
 		return 0
 	}
 	decision := semantic.DecideWithWaivers(f, review, policy, waivers)
-	decision = finalizeDecision(block, waiverDiags, decision)
-	if err := writeSemanticOutputs(decisionOut, markdownOut, decision); err != nil {
-		fmt.Fprintf(os.Stderr, "semantic-review: %v\n", err)
-		return 2
-	}
-	return decisionExitCode(decision)
-}
-
-func finalizeDecision(block bool, waiverDiags []report.Diagnostic, decision semantic.Decision) semantic.Decision {
 	decision.BlockMode = block
 	if !block && len(decision.Blockers) > 0 {
 		for i := range decision.Blockers {
@@ -98,21 +81,15 @@ func finalizeDecision(block bool, waiverDiags []report.Diagnostic, decision sema
 		decision.Blockers = nil
 	}
 	decision.SystemWarnings = append(diagnosticSystemWarnings(waiverDiags), decision.SystemWarnings...)
-	return decision
-}
-
-func writeSemanticOutputs(decisionOut, markdownOut string, decision semantic.Decision) error {
 	if err := semantic.WriteDecision(decisionOut, decision); err != nil {
-		return fmt.Errorf("write decision: %w", err)
+		fmt.Fprintf(os.Stderr, "semantic-review: write decision: %v\n", err)
+		return 2
 	}
 	if err := semantic.WriteMarkdown(markdownOut, decision); err != nil {
-		return fmt.Errorf("write markdown: %w", err)
+		fmt.Fprintf(os.Stderr, "semantic-review: write markdown: %v\n", err)
+		return 2
 	}
-	return nil
-}
-
-func decisionExitCode(decision semantic.Decision) int {
-	if decision.BlockMode && len(decision.Blockers) > 0 {
+	if block && len(decision.Blockers) > 0 {
 		return 1
 	}
 	return 0
--- a/internal/qualitygate/cmd/semantic-review/main_test.go
+++ b/internal/qualitygate/cmd/semantic-review/main_test.go
@@ -7,7 +7,6 @@ import (
 	"encoding/json"
 	"os"
 	"path/filepath"
-	"strings"
 	"testing"

 	"github.com/larksuite/cli/internal/qualitygate/facts"
@@ -212,19 +211,7 @@ func TestRunWritesSkippedDecisionForUnavailableReviewer(t *testing.T) {
 	  "allowed_base_urls": ["https://ark.ap-southeast.bytepluses.com/api/v3"]
 	}`, "")
 	factsPath := filepath.Join(t.TempDir(), "facts.json")
-	f := facts.Facts{
-		SchemaVersion: 1,
-		Skills: []facts.SkillFact{{
-			SourceFile:               "skills/lark-wiki/SKILL.md",
-			Line:                     30,
-			Changed:                  true,
-			ReferencesInvalidCommand: true,
-		}},
-	}
-	if !semantic.BuildInputView(f).HasReviewableFacts() {
-		t.Fatal("test setup must contain reviewable facts")
-	}
-	if err := f.WriteFile(factsPath); err != nil {
+	if err := (facts.Facts{SchemaVersion: 1}).WriteFile(factsPath); err != nil {
 		t.Fatalf("write facts: %v", err)
 	}
 	decisionPath := filepath.Join(t.TempDir(), "decision.json")
@@ -241,71 +228,6 @@ func TestRunWritesSkippedDecisionForUnavailableReviewer(t *testing.T) {
 	}
 }

-func TestRunShortCircuitsEmptySemanticInputWithoutReviewer(t *testing.T) {
-	t.Setenv("ARK_API_KEY", "")
-	t.Setenv("ARK_BASE_URL", "")
-	t.Setenv("ARK_MODEL", "")
-
-	repo := t.TempDir()
-	writeSemanticConfig(t, repo, `{
-	  "schema_version": 1,
-	  "default_enforcement": "observe",
-	  "block_categories": ["skill_quality"]
-	}`, `{
-	  "allowed": ["semantic-review-v1"],
-	  "allowed_base_urls": ["https://ark.ap-southeast.bytepluses.com/api/v3"]
-	}`, "")
-	factsPath := filepath.Join(t.TempDir(), "facts.json")
-	f := facts.Facts{
-		SchemaVersion: 1,
-		Commands: []facts.CommandFact{{
-			Path:    "service command 1",
-			Domain:  "service",
-			Changed: true,
-			Source:  "service",
-		}},
-		Outputs: []facts.OutputFact{{
-			Command:          "service command 1",
-			Domain:           "service",
-			Changed:          true,
-			Source:           "service",
-			IsList:           true,
-			HasDefaultLimit:  true,
-			HasDecisionField: true,
-		}},
-	}
-	if semantic.BuildInputView(f).HasReviewableFacts() {
-		t.Fatal("test setup must not contain reviewable facts")
-	}
-	if err := f.WriteFile(factsPath); err != nil {
-		t.Fatalf("write facts: %v", err)
-	}
-	decisionPath := filepath.Join(t.TempDir(), "decision.json")
-	markdownPath := filepath.Join(t.TempDir(), "semantic.md")
-	code := run([]string{"--repo", repo, "--facts", factsPath, "--decision-out", decisionPath, "--markdown-out", markdownPath, "--block"})
-	if code != 0 {
-		t.Fatalf("run() = %d, want clean pass", code)
-	}
-	decision := readDecision(t, decisionPath)
-	if decision.Skipped || decision.Degraded || decision.InfrastructureFailure || !decision.BlockMode {
-		t.Fatalf("expected non-degraded pass decision: %#v", decision)
-	}
-	if len(decision.SystemWarnings) != 0 || len(decision.Warnings) != 0 || len(decision.Blockers) != 0 {
-		t.Fatalf("empty semantic view should not produce findings: %#v", decision)
-	}
-	data, err := os.ReadFile(markdownPath)
-	if err != nil {
-		t.Fatalf("read markdown: %v", err)
-	}
-	markdown := string(data)
-	if !strings.Contains(markdown, "No semantic blockers.") {
-		t.Fatalf("markdown missing pass summary: %s", markdown)
-	}
-	if strings.Contains(strings.ToLower(markdown), "skipped") || strings.Contains(strings.ToLower(markdown), "degraded") {
-		t.Fatalf("markdown should not report semantic review as skipped/degraded: %s", markdown)
-	}
-}
-
 func TestRunWritesInfrastructureFailureDecisionForInvalidReviewerConfig(t *testing.T) {
 	t.Setenv("ARK_API_KEY", "test-key")
 	t.Setenv("ARK_BASE_URL", "")
@@ -321,19 +243,7 @@ func TestRunWritesInfrastructureFailureDecisionForInvalidReviewerConfig(t *testi
 	  "allowed_base_urls": ["https://ark.ap-southeast.bytepluses.com/api/v3"]
 	}`, "")
 	factsPath := filepath.Join(t.TempDir(), "facts.json")
-	f := facts.Facts{
-		SchemaVersion: 1,
-		Skills: []facts.SkillFact{{
-			SourceFile:               "skills/lark-wiki/SKILL.md",
-			Line:                     30,
-			Changed:                  true,
-			ReferencesInvalidCommand: true,
-		}},
-	}
-	if !semantic.BuildInputView(f).HasReviewableFacts() {
-		t.Fatal("test setup must contain reviewable facts")
-	}
-	if err := f.WriteFile(factsPath); err != nil {
+	if err := (facts.Facts{SchemaVersion: 1}).WriteFile(factsPath); err != nil {
 		t.Fatalf("write facts: %v", err)
 	}
 	decisionPath := filepath.Join(t.TempDir(), "decision.json")
--- a/internal/qualitygate/config/semantic/policy.json
+++ b/internal/qualitygate/config/semantic/policy.json
@@ -5,8 +5,7 @@
    "error_hint",
    "default_output",
    "naming",
-    "skill_quality",
-    "public_content_leakage"
+    "skill_quality"
  ],
  "rollout_groups": [
    {
@@ -17,8 +16,7 @@
      },
      "categories": [
        "error_hint",
-        "skill_quality",
-        "public_content_leakage"
+        "skill_quality"
      ],
      "owner": "cli-owner",
      "reason": "first semantic blocking rollout only affects changed facts"
--- a/internal/qualitygate/facts/schema.go
+++ b/internal/qualitygate/facts/schema.go
@@ -13,15 +13,14 @@ import (
 )

 type Facts struct {
-	SchemaVersion int                 `json:"schema_version"`
-	Commands      []CommandFact       `json:"commands,omitempty"`
-	Skills        []SkillFact         `json:"skills,omitempty"`
-	SkillQuality  []SkillQualityFact  `json:"skill_quality,omitempty"`
-	Errors        []ErrorFact         `json:"errors,omitempty"`
-	Outputs       []OutputFact        `json:"outputs,omitempty"`
-	Examples      []CommandExample    `json:"examples,omitempty"`
-	PublicContent []PublicContentFact `json:"public_content,omitempty"`
-	Diagnostics   []DiagnosticFact    `json:"diagnostics,omitempty"`
+	SchemaVersion int                `json:"schema_version"`
+	Commands      []CommandFact      `json:"commands,omitempty"`
+	Skills        []SkillFact        `json:"skills,omitempty"`
+	SkillQuality  []SkillQualityFact `json:"skill_quality,omitempty"`
+	Errors        []ErrorFact        `json:"errors,omitempty"`
+	Outputs       []OutputFact       `json:"outputs,omitempty"`
+	Examples      []CommandExample   `json:"examples,omitempty"`
+	Diagnostics   []DiagnosticFact   `json:"diagnostics,omitempty"`
 }

 type CommandFact struct {
@@ -110,17 +109,6 @@ type OutputFact struct {
 	HasDecisionField bool     `json:"has_decision_field,omitempty"`
 }

-type PublicContentFact struct {
-	Rule       string        `json:"rule"`
-	Action     report.Action `json:"action"`
-	File       string        `json:"file"`
-	Line       int           `json:"line"`
-	Source     string        `json:"source,omitempty"`
-	Excerpt    string        `json:"excerpt,omitempty"`
-	Message    string        `json:"message,omitempty"`
-	Suggestion string        `json:"suggestion,omitempty"`
-}
-
 type DryRunRequest struct {
 	Method string              `json:"method"`
 	URL    string              `json:"url"`
@@ -218,11 +206,6 @@ func BuildWithCommandLookup(m manifest.Manifest, commandLookup manifest.Manifest
 	}
 }

-func WithPublicContent(f Facts, publicContent []PublicContentFact) Facts {
-	f.PublicContent = publicContent
-	return f
-}
-
 type commandScope struct {
 	Domain string
 	Source string
--- a/internal/qualitygate/facts/schema_test.go
+++ b/internal/qualitygate/facts/schema_test.go
@@ -34,7 +34,6 @@ func TestFactsSchemaCarriesGatekeeperFields(t *testing.T) {
 		Errors:        []ErrorFact{{Code: "invalid_input", Message: "bad path", Hint: "pass --file", Retryable: false, HintActionCount: 1, RequiredHint: true}},
 		Outputs:       []OutputFact{{Command: "im messages list", Fields: []string{"message_id", "sender", "create_time"}, IsList: true, HasDefaultLimit: true, HasDecisionField: true}},
 		Skills:        []SkillFact{{SourceFile: "skills/lark-doc/SKILL.md", Line: 1, DestructiveWithoutGuard: true, ScopeConflict: true}},
-		PublicContent: []PublicContentFact{{Rule: "public_content_generic_credential", Action: report.ActionReject, File: "docs/public.md", Line: 4, Excerpt: "api_key = <redacted>"}},
 	}
 	data, err := json.Marshal(f)
 	if err != nil {
@@ -44,10 +43,7 @@ func TestFactsSchemaCarriesGatekeeperFields(t *testing.T) {
 	if err := json.Unmarshal(data, &got); err != nil {
 		t.Fatalf("unmarshal facts: %v", err)
 	}
-	if !got.Errors[0].RequiredHint ||
-		got.Outputs[0].Fields[0] != "message_id" ||
-		!got.Skills[0].ScopeConflict ||
-		got.PublicContent[0].Rule != "public_content_generic_credential" {
+	if !got.Errors[0].RequiredHint || got.Outputs[0].Fields[0] != "message_id" || !got.Skills[0].ScopeConflict {
 		t.Fatalf("facts lost gatekeeper fields: %#v", got)
 	}
 }
--- a/internal/qualitygate/publiccontent/collect.go
+++ b/internal/qualitygate/publiccontent/collect.go
@@ -1,343 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package publiccontent
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"sort"
-	"strconv"
-	"strings"
-)
-
-func Collect(ctx context.Context, opts Options) ([]Finding, error) {
-	metadata, err := LoadMetadata(opts.MetadataPath)
-	if err != nil {
-		return nil, err
-	}
-
-	var out []Finding
-	changedFiles, base, err := changedFiles(ctx, opts.Repo, opts.ChangedFrom)
-	if err != nil {
-		return nil, err
-	}
-	patches := map[string][]changedChunk{}
-	if base != "" {
-		patches, err = changedPatches(ctx, opts.Repo, base)
-		if err != nil {
-			return nil, err
-		}
-	}
-	for _, file := range changedFiles {
-		if !scanChangedFile(file) {
-			continue
-		}
-		for _, chunk := range patches[file] {
-			findings := scanText(file, "file", chunk.Text, isDetectorRuleFile(file))
-			for i := range findings {
-				findings[i].Line += chunk.StartLine - 1
-			}
-			out = append(out, findings...)
-			out = append(out, semanticCandidate(file, "file", chunk.Text, chunk.StartLine)...)
-		}
-		privateKeyFindings, err := scanTouchedPrivateKeyBlocks(ctx, opts.Repo, file, patches[file])
-		if err != nil {
-			return nil, err
-		}
-		out = appendUniqueFindings(out, privateKeyFindings...)
-	}
-	if base != "" {
-		commitFindings, err := scanCommitMessages(ctx, opts.Repo, base)
-		if err != nil {
-			return nil, err
-		}
-		out = append(out, commitFindings...)
-	}
-	branchName := opts.BranchName
-	if branchName == "" {
-		branchName = metadata.Branch
-	}
-	if branchName == "" {
-		branchName = branchFromEnv()
-	}
-	if branchName == "" {
-		branchName = currentBranch(ctx, opts.Repo)
-	}
-	if branchName != "" {
-		out = append(out, scanText("branch", "branch", branchName, false)...)
-	}
-	out = append(out, scanMetadata(metadata)...)
-	sort.SliceStable(out, func(i, j int) bool {
-		if out[i].File != out[j].File {
-			return out[i].File < out[j].File
-		}
-		if out[i].Line != out[j].Line {
-			return out[i].Line < out[j].Line
-		}
-		return out[i].Rule < out[j].Rule
-	})
-	return out, nil
-}
-
-func currentBranch(ctx context.Context, repo string) string {
-	data, err := gitOutput(ctx, repo, "branch", "--show-current")
-	if err != nil {
-		return ""
-	}
-	return strings.TrimSpace(string(data))
-}
-
-func branchFromEnv() string {
-	for _, key := range []string{"PR_BRANCH", "GITHUB_HEAD_REF", "GITHUB_REF_NAME"} {
-		if value := strings.TrimSpace(os.Getenv(key)); value != "" {
-			return value
-		}
-	}
-	return ""
-}
-
-func changedFiles(ctx context.Context, repo, changedFrom string) ([]string, string, error) {
-	if changedFrom == "" {
-		return nil, "", nil
-	}
-	baseBytes, err := gitOutput(ctx, repo, "merge-base", changedFrom, "HEAD")
-	if err != nil {
-		return nil, "", err
-	}
-	base := strings.TrimSpace(string(baseBytes))
-	files, err := diffFileNames(ctx, repo, base)
-	if err != nil {
-		return nil, "", err
-	}
-	sort.Strings(files)
-	return files, base, nil
-}
-
-func diffFileNames(ctx context.Context, repo, base string) ([]string, error) {
-	data, err := gitOutput(ctx, repo, "diff", "--name-only", "-z", "--diff-filter=ACMR", base+"..HEAD")
-	if err != nil {
-		return nil, err
-	}
-	var files []string
-	for _, file := range bytes.Split(data, []byte{0}) {
-		if len(file) == 0 {
-			continue
-		}
-		files = append(files, filepath.ToSlash(string(file)))
-	}
-	return files, nil
-}
-
-var detectorFixtureExclusions = map[string]bool{
-	"internal/qualitygate/publiccontent/collect_test.go": true,
-	"internal/qualitygate/publiccontent/rules.go":        true,
-	"internal/qualitygate/publiccontent/scan.go":         true,
-	"internal/qualitygate/publiccontent/scan_test.go":    true,
-}
-
-func scanChangedFile(file string) bool {
-	normalized := strings.TrimPrefix(strings.ReplaceAll(file, "\\", "/"), "./")
-	return !detectorFixtureExclusions[normalized]
-}
-
-type changedChunk struct {
-	StartLine int
-	Text      string
-}
-
-func (c changedChunk) endLine() int {
-	lines := strings.Count(strings.TrimRight(c.Text, "\n"), "\n") + 1
-	if lines < 1 {
-		lines = 1
-	}
-	return c.StartLine + lines - 1
-}
-
-func changedPatches(ctx context.Context, repo, base string) (map[string][]changedChunk, error) {
-	files, err := diffFileNames(ctx, repo, base)
-	if err != nil {
-		return nil, err
-	}
-	data, err := gitOutput(ctx, repo, "diff", "--no-ext-diff", "--unified=0", "--diff-filter=ACMR", base+"..HEAD")
-	if err != nil {
-		return nil, err
-	}
-	out := map[string][]changedChunk{}
-	var file string
-	var chunk *changedChunk
-	nextLine := 0
-	nextFile := 0
-	flush := func() {
-		if file == "" || chunk == nil || chunk.Text == "" {
-			chunk = nil
-			return
-		}
-		out[file] = append(out[file], *chunk)
-		chunk = nil
-	}
-	for _, raw := range strings.Split(string(data), "\n") {
-		switch {
-		case strings.HasPrefix(raw, "diff --git "):
-			flush()
-			file = ""
-			if nextFile < len(files) {
-				file = files[nextFile]
-				nextFile++
-			}
-		case strings.HasPrefix(raw, "@@ "):
-			flush()
-			start, ok := parseNewHunkStart(raw)
-			if !ok {
-				nextLine = 0
-				continue
-			}
-			nextLine = start
-			chunk = &changedChunk{StartLine: start}
-		case strings.HasPrefix(raw, "+") && !strings.HasPrefix(raw, "+++"):
-			if chunk == nil {
-				chunk = &changedChunk{StartLine: max(nextLine, 1)}
-			}
-			chunk.Text += strings.TrimPrefix(raw, "+") + "\n"
-			nextLine++
-		case strings.HasPrefix(raw, "-"):
-			continue
-		default:
-			if chunk != nil && strings.HasPrefix(raw, `\ No newline at end of file`) {
-				continue
-			}
-			flush()
-		}
-	}
-	flush()
-	return out, nil
-}
-
-func parseNewHunkStart(header string) (int, bool) {
-	parts := strings.Split(header, " ")
-	for _, part := range parts {
-		if !strings.HasPrefix(part, "+") {
-			continue
-		}
-		raw := strings.TrimPrefix(part, "+")
-		if before, _, ok := strings.Cut(raw, ","); ok {
-			raw = before
-		}
-		start, err := strconv.Atoi(raw)
-		return start, err == nil && start > 0
-	}
-	return 0, false
-}
-
-func scanCommitMessages(ctx context.Context, repo, base string) ([]Finding, error) {
-	data, err := gitOutput(ctx, repo, "log", "--format=%H%x00%B%x00", base+"..HEAD")
-	if err != nil {
-		return nil, err
-	}
-	parts := bytes.Split(data, []byte{0})
-	var out []Finding
-	for i := 0; i+1 < len(parts); i += 2 {
-		sha := strings.TrimSpace(string(parts[i]))
-		body := string(parts[i+1])
-		if sha == "" || body == "" {
-			continue
-		}
-		short := sha
-		if len(short) > 12 {
-			short = short[:12]
-		}
-		out = append(out, scanText("commit:"+short, "commit", body, false)...)
-		out = append(out, semanticCandidate("commit:"+short, "commit", body, 1)...)
-	}
-	return out, nil
-}
-
-type lineRange struct {
-	Start int
-	End   int
-}
-
-func scanTouchedPrivateKeyBlocks(ctx context.Context, repo, file string, chunks []changedChunk) ([]Finding, error) {
-	if len(chunks) == 0 {
-		return nil, nil
-	}
-	data, err := gitOutput(ctx, repo, "show", "HEAD:"+file)
-	if err != nil {
-		return nil, err
-	}
-	var added []lineRange
-	for _, chunk := range chunks {
-		added = append(added, lineRange{Start: chunk.StartLine, End: chunk.endLine()})
-	}
-	var out []Finding
-	for _, block := range privateKeyBlocks(string(data)) {
-		if !rangesIntersectAny(block, added) {
-			continue
-		}
-		out = append(out, newFinding("public_content_private_key_block", file, block.Start, "file", "private key block"))
-	}
-	return out, nil
-}
-
-func privateKeyBlocks(text string) []lineRange {
-	lines := strings.Split(text, "\n")
-	var out []lineRange
-	inPrivateKey := false
-	start := 0
-	for i, line := range lines {
-		lineNo := i + 1
-		if !inPrivateKey && strings.Contains(line, privateKeyBeginPrefix) && strings.Contains(line, privateKeyMarker) {
-			inPrivateKey = true
-			start = lineNo
-		}
-		if inPrivateKey && strings.Contains(line, privateKeyEndPrefix) && strings.Contains(line, privateKeyMarker) {
-			out = append(out, lineRange{Start: start, End: lineNo})
-			inPrivateKey = false
-		}
-	}
-	return out
-}
-
-func rangesIntersectAny(block lineRange, ranges []lineRange) bool {
-	for _, r := range ranges {
-		if block.Start <= r.End && r.Start <= block.End {
-			return true
-		}
-	}
-	return false
-}
-
-func appendUniqueFindings(items []Finding, additions ...Finding) []Finding {
-	for _, addition := range additions {
-		duplicate := false
-		for _, item := range items {
-			if item.Rule == addition.Rule &&
-				item.File == addition.File &&
-				item.Line == addition.Line &&
-				item.Source == addition.Source {
-				duplicate = true
-				break
-			}
-		}
-		if !duplicate {
-			items = append(items, addition)
-		}
-	}
-	return items
-}
-
-func gitOutput(ctx context.Context, repo string, args ...string) ([]byte, error) {
-	cmd := exec.CommandContext(ctx, "git", args...)
-	cmd.Dir = repo
-	var stdout, stderr bytes.Buffer
-	cmd.Stdout = &stdout
-	cmd.Stderr = &stderr
-	if err := cmd.Run(); err != nil {
-		return nil, fmt.Errorf("git %s: %w\n%s", strings.Join(args, " "), err, stderr.Bytes())
-	}
-	return stdout.Bytes(), nil
-}
--- a/internal/qualitygate/publiccontent/collect_test.go
+++ b/internal/qualitygate/publiccontent/collect_test.go
@@ -1,885 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package publiccontent
-
-import (
-	"context"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-func TestCollectScansOnlyCurrentContributionAndMetadata(t *testing.T) {
-	repo := t.TempDir()
-	runGit(t, repo, "init")
-	runGit(t, repo, "config", "user.email", "test@example.com")
-	runGit(t, repo, "config", "user.name", "Test User")
-
-	writeFile(t, filepath.Join(repo, "baseline.md"), `BASE_`+`TOKEN="baseline-only"
-`)
-	runGit(t, repo, "add", "baseline.md")
-	runGit(t, repo, "commit", "-m", "base")
-
-	writeFile(t, filepath.Join(repo, "docs", "public.md"), `# Public change
-
-api_`+`key = "example-public-key"
-`)
-	runGit(t, repo, "add", "docs/public.md")
-	runGit(t, repo, "commit", "-m", "add public doc", "-m", "Change"+"-Id: I0123456789abcdef0123456789abcdef01234567")
-
-	metadataPath := filepath.Join(repo, "pr-metadata.json")
-	writeFile(t, metadataPath, `{"title":"publish public docs","body":"Reviewed`+`-on: https://review.example.test/c/project/+/123"}`)
-
-	got, err := Collect(context.Background(), Options{
-		Repo:         repo,
-		ChangedFrom:  "HEAD~1",
-		MetadataPath: metadataPath,
-	})
-	if err != nil {
-		t.Fatalf("Collect() error = %v", err)
-	}
-
-	rules := findingRules(got)
-	for _, want := range []string{
-		"public_content_generic_credential",
-		"public_content_change_id_trailer",
-		"public_content_reviewed_on_trailer",
-	} {
-		if !rules[want] {
-			t.Fatalf("missing rule %s in findings %#v", want, got)
-		}
-	}
-	for _, item := range got {
-		if item.File == "baseline.md" {
-			t.Fatalf("collector scanned unchanged baseline file: %#v", got)
-		}
-	}
-}
-
-func TestCollectScansOnlyChangedLinesInChangedFiles(t *testing.T) {
-	repo := t.TempDir()
-	runGit(t, repo, "init")
-	runGit(t, repo, "config", "user.email", "test@example.com")
-	runGit(t, repo, "config", "user.name", "Test User")
-
-	writeFile(t, filepath.Join(repo, "docs", "workflow.md"), "SECRET_TOKEN=legacy-example\npublic baseline\n")
-	runGit(t, repo, "add", "docs/workflow.md")
-	runGit(t, repo, "commit", "-m", "base")
-
-	writeFile(t, filepath.Join(repo, "docs", "workflow.md"), "SECRET_TOKEN=legacy-example\npublic baseline\nnew public line\n")
-	runGit(t, repo, "add", "docs/workflow.md")
-	runGit(t, repo, "commit", "-m", "add public line")
-
-	metadataPath := filepath.Join(repo, "pr-metadata.json")
-	writeFile(t, metadataPath, `{}`)
-
-	got, err := Collect(context.Background(), Options{
-		Repo:         repo,
-		ChangedFrom:  "HEAD~1",
-		MetadataPath: metadataPath,
-	})
-	if err != nil {
-		t.Fatalf("Collect() error = %v", err)
-	}
-	for _, item := range got {
-		if item.Rule == "public_content_generic_credential" && item.File == "docs/workflow.md" {
-			t.Fatalf("collector scanned unchanged legacy line in changed file: %#v", got)
-		}
-	}
-}
-
-func TestCollectSemanticCandidatesStoreSanitizedReviewText(t *testing.T) {
-	repo := t.TempDir()
-	runGit(t, repo, "init")
-	runGit(t, repo, "config", "user.email", "test@example.com")
-	runGit(t, repo, "config", "user.name", "Test User")
-
-	writeFile(t, filepath.Join(repo, "docs", "public.md"), "base\n")
-	runGit(t, repo, "add", "docs/public.md")
-	runGit(t, repo, "commit", "-m", "base")
-
-	raw := "private launch plan for alpha-service rollout on Friday with SERVICE_" + "TOKEN=real-" + "secret-value"
-	writeFile(t, filepath.Join(repo, "docs", "public.md"), "base\n"+raw+"\n")
-	runGit(t, repo, "add", "docs/public.md")
-	runGit(t, repo, "commit", "-m", "add semantic candidate")
-
-	metadataPath := filepath.Join(repo, "pr-metadata.json")
-	writeFile(t, metadataPath, `{}`)
-
-	got, err := Collect(context.Background(), Options{
-		Repo:         repo,
-		ChangedFrom:  "HEAD~1",
-		MetadataPath: metadataPath,
-	})
-	if err != nil {
-		t.Fatalf("Collect() error = %v", err)
-	}
-	var found bool
-	for _, item := range got {
-		if item.Rule != "public_content_semantic_candidate" || item.File != "docs/public.md" {
-			continue
-		}
-		found = true
-		if !strings.Contains(item.Excerpt, "alpha-service rollout on Friday") {
-			t.Fatalf("semantic candidate should include sanitized review text, got %#v", item)
-		}
-		if strings.Contains(item.Excerpt, "real-"+"secret-value") {
-			t.Fatalf("semantic candidate leaked credential value: %#v", item)
-		}
-		if !strings.Contains(item.Excerpt, "SERVICE_TOKEN=<redacted>") {
-			t.Fatalf("semantic candidate should redact credentials in review text, got %#v", item)
-		}
-		if !strings.Contains(item.Excerpt, "semantic signals") || !strings.Contains(item.Excerpt, "roadmap_timing") {
-			t.Fatalf("semantic candidate excerpt should preserve semantic signals, got %#v", item)
-		}
-	}
-	if !found {
-		t.Fatalf("missing semantic candidate in findings %#v", got)
-	}
-}
-
-func TestCollectSemanticCandidatesDoNotLeakWhitespaceCredentialTail(t *testing.T) {
-	repo := newGitRepo(t)
-	writeFile(t, filepath.Join(repo, "docs", "public.md"), "base\n")
-	runGit(t, repo, "add", "docs/public.md")
-	runGit(t, repo, "commit", "-m", "base")
-
-	raw := "private launch plan for internal rollout on Friday with SERVICE_" + "TOKEN=\"real " + "secret value\""
-	writeFile(t, filepath.Join(repo, "docs", "public.md"), "base\n"+raw+"\n")
-	runGit(t, repo, "add", "docs/public.md")
-	runGit(t, repo, "commit", "-m", "add semantic candidate")
-
-	got := collectFromPreviousCommit(t, repo)
-	for _, item := range got {
-		if item.Rule != "public_content_semantic_candidate" || item.File != "docs/public.md" {
-			continue
-		}
-		if strings.Contains(item.Excerpt, "secret value") || strings.Contains(item.Excerpt, "real "+"secret value") {
-			t.Fatalf("semantic candidate leaked credential tail: %#v", item)
-		}
-		if !strings.Contains(item.Excerpt, "SERVICE_TOKEN=<redacted>") {
-			t.Fatalf("semantic candidate should redact full credential assignment, got %#v", item)
-		}
-		return
-	}
-	t.Fatalf("missing semantic candidate in findings %#v", got)
-}
-
-func TestCollectJSONBearerHeadersDoNotLeakIntoSemanticCandidates(t *testing.T) {
-	repo := newGitRepo(t)
-	writeFile(t, filepath.Join(repo, "docs", "public.md"), "base\n")
-	runGit(t, repo, "add", "docs/public.md")
-	runGit(t, repo, "commit", "-m", "base")
-
-	token := "abcdefghijklmnopqrstuvwxyz"
-	raw := "private launch plan for internal rollout on Friday with " +
-		`{"headers":{"Authorization":"Bearer ` + token + `"}}`
-	writeFile(t, filepath.Join(repo, "docs", "public.md"), "base\n"+raw+"\n")
-	runGit(t, repo, "add", "docs/public.md")
-	runGit(t, repo, "commit", "-m", "add json bearer")
-
-	got := collectFromPreviousCommit(t, repo)
-	requireFinding(t, got, "docs/public.md", "public_content_bearer_header")
-	for _, item := range got {
-		if item.File != "docs/public.md" {
-			continue
-		}
-		if strings.Contains(item.Excerpt, token) {
-			t.Fatalf("finding leaked JSON bearer token: %#v", item)
-		}
-	}
-}
-
-func TestCollectDetectsQuotedJSONCredentialAssignments(t *testing.T) {
-	repo := newGitRepo(t)
-	writeFile(t, filepath.Join(repo, "docs", "public.json"), "{}\n")
-	runGit(t, repo, "add", "docs/public.json")
-	runGit(t, repo, "commit", "-m", "base")
-
-	writeFile(t, filepath.Join(repo, "docs", "public.json"), strings.Join([]string{
-		`{"access_` + `token":"real-json-token"}`,
-		`{"client_` + `secret": "real ` + `secret value"}`,
-		`{"tenantAccess` + `Token":"real-tenant-camel-token"}`,
-		`{"github` + `Token":"real-github-token"}`,
-		`{"vendorApi` + `Key":"real-vendor-key"}`,
-		`{"slackBot` + `Token":"xoxb-real-token"}`,
-	}, "\n")+"\n")
-	runGit(t, repo, "add", "docs/public.json")
-	runGit(t, repo, "commit", "-m", "add json config")
-
-	got := collectFromPreviousCommit(t, repo)
-	var count int
-	for _, item := range got {
-		if item.File == "docs/public.json" && item.Rule == "public_content_generic_credential" {
-			count++
-			for _, forbidden := range []string{
-				"real-json-token",
-				"real secret value",
-				"real-tenant-camel-token",
-				"real-github-token",
-				"real-vendor-key",
-				"xoxb-real-token",
-			} {
-				if strings.Contains(item.Excerpt, forbidden) {
-					t.Fatalf("JSON credential finding leaked value %q in excerpt %q", forbidden, item.Excerpt)
-				}
-			}
-		}
-	}
-	if count != 6 {
-		t.Fatalf("JSON credential findings = %d, want 6: %#v", count, got)
-	}
-}
-
-func TestCollectAllowsBenignJSONTokenFields(t *testing.T) {
-	repo := newGitRepo(t)
-	writeFile(t, filepath.Join(repo, "docs", "public.json"), "{}\n")
-	runGit(t, repo, "add", "docs/public.json")
-	runGit(t, repo, "commit", "-m", "base")
-
-	writeFile(t, filepath.Join(repo, "docs", "public.json"), strings.Join([]string{
-		`{"tokenizer":"cl100k_base"}`,
-		`{"token_count": 42}`,
-		`{"page_token":"next"}`,
-		`{"next_page_token":"next"}`,
-		`{"file_token":"file-example"}`,
-		`{"doc_token":"doc-example"}`,
-		`{"node_token":"node-example"}`,
-		`{"wiki_token":"wikcn_public_doc_example"}`,
-		`{"folder_token":"folder-example"}`,
-		`{"obj_token":"obj-example"}`,
-		`{"spreadsheet_token":"sheet-example"}`,
-		`{"parent_node_token":"parent-example"}`,
-		`{"origin_node_token":"origin-example"}`,
-		`{"drive_route_token":"route-example"}`,
-		`{"token":"<wiki_token>"}`,
-		`{"token":"wiki_token"}`,
-		`{"token_url":"https://example.com/oauth/token"}`,
-		`{"token_endpoint":"https://example.com/oauth/token"}`,
-		`{"token_format":"Bearer"}`,
-		`{"secret_name":"public-example-secret"}`,
-		`{"base_token":"base-example"}`,
-		`{"app_token":"app-example"}`,
-		`{"sync_token":"sync-example"}`,
-		`{"parent_token":"parent-example"}`,
-		`{"target_token":"target-example"}`,
-		`{"parent_file_token":"parent-file-example"}`,
-		`{"refresh_token_expires_in": 7200}`,
-		`{"access_token_expires_in": 7200}`,
-		`{"token_expires_in": 7200}`,
-		`{"token_status":"active"}`,
-	}, "\n")+"\n")
-	runGit(t, repo, "add", "docs/public.json")
-	runGit(t, repo, "commit", "-m", "add benign json token fields")
-
-	got := collectFromPreviousCommit(t, repo)
-	for _, item := range got {
-		if item.File == "docs/public.json" && item.Rule == "public_content_generic_credential" {
-			t.Fatalf("benign JSON token field should not be credential finding: %#v", got)
-		}
-	}
-}
-
-func TestCollectDetectsAngleWrappedRealisticCredentialValues(t *testing.T) {
-	repo := newGitRepo(t)
-	writeFile(t, filepath.Join(repo, "docs", "config.yaml"), "base: true\n")
-	runGit(t, repo, "add", "docs/config.yaml")
-	runGit(t, repo, "commit", "-m", "base")
-	stripeLike := "sk_" + "live_1234567890abcdef"
-	patLike := "gh" + "p_1234567890abcdef1234567890abcdef1234"
-
-	writeFile(t, filepath.Join(repo, "docs", "config.yaml"), strings.Join([]string{
-		"API_KEY: <" + stripeLike + ">",
-		"SECRET_TOKEN: <" + patLike + ">",
-		"CLIENT_SECRET: <real-client-secret-value>",
-	}, "\n")+"\n")
-	runGit(t, repo, "add", "docs/config.yaml")
-	runGit(t, repo, "commit", "-m", "add credential config")
-
-	got := collectFromPreviousCommit(t, repo)
-	var count int
-	for _, item := range got {
-		if item.File == "docs/config.yaml" && item.Rule == "public_content_generic_credential" {
-			count++
-		}
-	}
-	if count != 3 {
-		t.Fatalf("angle-wrapped realistic credential findings = %d, want 3: %#v", count, got)
-	}
-}
-
-func TestCollectDetectsCredentialShapedValuesUnderBenignKeys(t *testing.T) {
-	repo := newGitRepo(t)
-	writeFile(t, filepath.Join(repo, "docs", "public.json"), "{}\n")
-	runGit(t, repo, "add", "docs/public.json")
-	runGit(t, repo, "commit", "-m", "base")
-	stripeLike := "sk_" + "live_1234567890abcdef"
-	patLike := "gh" + "p_1234567890abcdef1234567890abcdef1234"
-
-	writeFile(t, filepath.Join(repo, "docs", "public.json"), strings.Join([]string{
-		`{"access_token_expires_in":"` + patLike + `"}`,
-		`{"refresh_token_expires_in":"` + stripeLike + `"}`,
-		`{"client_secret_status":"real-client-secret-value"}`,
-		`{"client_secret_name":"real-client-secret-value"}`,
-		`{"app_token":"` + patLike + `"}`,
-		`{"sync_token":"` + stripeLike + `"}`,
-		`{"target_token":"real-client-secret-value"}`,
-	}, "\n")+"\n")
-	runGit(t, repo, "add", "docs/public.json")
-	runGit(t, repo, "commit", "-m", "add credential-shaped benign fields")
-
-	got := collectFromPreviousCommit(t, repo)
-	var count int
-	for _, item := range got {
-		if item.File == "docs/public.json" && item.Rule == "public_content_generic_credential" {
-			count++
-		}
-	}
-	if count != 7 {
-		t.Fatalf("credential-shaped benign-key findings = %d, want 7: %#v", count, got)
-	}
-}
-
-func TestCollectDetectsBareIdentifierCredentialsWithMetadataSuffixes(t *testing.T) {
-	repo := newGitRepo(t)
-	writeFile(t, filepath.Join(repo, "docs", "config.yaml"), "base: true\n")
-	runGit(t, repo, "add", "docs/config.yaml")
-	runGit(t, repo, "commit", "-m", "base")
-
-	writeFile(t, filepath.Join(repo, "docs", "config.yaml"), strings.Join([]string{
-		"API_KEY_NAME: prod_key",
-		"CLIENT_SECRET_NAME: prod_secret",
-		"SECRET_STATUS: prod_secret",
-	}, "\n")+"\n")
-	runGit(t, repo, "add", "docs/config.yaml")
-	runGit(t, repo, "commit", "-m", "add credential config")
-
-	got := collectFromPreviousCommit(t, repo)
-	var count int
-	for _, item := range got {
-		if item.File == "docs/config.yaml" && item.Rule == "public_content_generic_credential" {
-			count++
-		}
-	}
-	if count != 3 {
-		t.Fatalf("metadata-suffixed bare credential findings = %d, want 3: %#v", count, got)
-	}
-}
-
-func TestCollectDetectsAccessKeyCredentials(t *testing.T) {
-	repo := newGitRepo(t)
-	writeFile(t, filepath.Join(repo, "docs", "config.yaml"), "base: true\n")
-	runGit(t, repo, "add", "docs/config.yaml")
-	runGit(t, repo, "commit", "-m", "base")
-	accessKey := "AK" + "IAIOSFODNN7EXAMPX"
-
-	writeFile(t, filepath.Join(repo, "docs", "config.yaml"), strings.Join([]string{
-		"AWS_ACCESS_KEY_ID: " + accessKey,
-		"ACCESS_KEY_ID: " + accessKey,
-		"ACCESS_KEY: " + accessKey,
-	}, "\n")+"\n")
-	runGit(t, repo, "add", "docs/config.yaml")
-	runGit(t, repo, "commit", "-m", "add access key config")
-
-	got := collectFromPreviousCommit(t, repo)
-	var count int
-	for _, item := range got {
-		if item.File != "docs/config.yaml" || item.Rule != "public_content_generic_credential" {
-			continue
-		}
-		count++
-		if strings.Contains(item.Excerpt, "AKIAIOSFODNN7EXAMPX") {
-			t.Fatalf("access key finding leaked value in excerpt %q", item.Excerpt)
-		}
-	}
-	if count != 3 {
-		t.Fatalf("access key credential findings = %d, want 3: %#v", count, got)
-	}
-}
-
-func TestCollectDetectsPrivateKeyAssignments(t *testing.T) {
-	repo := newGitRepo(t)
-	writeFile(t, filepath.Join(repo, "docs", "config.yaml"), "base: true\n")
-	runGit(t, repo, "add", "docs/config.yaml")
-	runGit(t, repo, "commit", "-m", "base")
-
-	privateKey := "LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0t"
-	writeFile(t, filepath.Join(repo, "docs", "config.yaml"), strings.Join([]string{
-		"PRIVATE_KEY: " + privateKey,
-		"SSH_PRIVATE_KEY: " + privateKey,
-		"JWT_PRIVATE_KEY: " + privateKey,
-		"SIGNING_PRIVATE_KEY: " + privateKey,
-	}, "\n")+"\n")
-	runGit(t, repo, "add", "docs/config.yaml")
-	runGit(t, repo, "commit", "-m", "add private key config")
-
-	got := collectFromPreviousCommit(t, repo)
-	var count int
-	for _, item := range got {
-		if item.File != "docs/config.yaml" || item.Rule != "public_content_generic_credential" {
-			continue
-		}
-		count++
-		if strings.Contains(item.Excerpt, privateKey) {
-			t.Fatalf("private key finding leaked value in excerpt %q", item.Excerpt)
-		}
-	}
-	if count != 4 {
-		t.Fatalf("private key assignment findings = %d, want 4: %#v", count, got)
-	}
-}
-
-func TestCollectDetectsCredentialValuesThatLookLikeBareIdentifiers(t *testing.T) {
-	repo := newGitRepo(t)
-	writeFile(t, filepath.Join(repo, "docs", "config.yaml"), "base: true\n")
-	runGit(t, repo, "add", "docs/config.yaml")
-	runGit(t, repo, "commit", "-m", "base")
-
-	writeFile(t, filepath.Join(repo, "docs", "config.yaml"), strings.Join([]string{
-		"API_KEY_OPENAI: prod_key",
-		"CLIENT_SECRET_GOOGLE: prod_secret",
-		"TOKEN_GITHUB: github_token",
-		"APP_PASSWORD_PROD: prod_password",
-	}, "\n")+"\n")
-	runGit(t, repo, "add", "docs/config.yaml")
-	runGit(t, repo, "commit", "-m", "add credential config")
-
-	got := collectFromPreviousCommit(t, repo)
-	var count int
-	for _, item := range got {
-		if item.File == "docs/config.yaml" && item.Rule == "public_content_generic_credential" {
-			count++
-		}
-	}
-	if count != 4 {
-		t.Fatalf("bare identifier credential findings = %d, want 4: %#v", count, got)
-	}
-}
-
-func TestCollectAllowsBenignUnquotedTokenFields(t *testing.T) {
-	repo := newGitRepo(t)
-	writeFile(t, filepath.Join(repo, "docs", "config.yaml"), "base: true\n")
-	runGit(t, repo, "add", "docs/config.yaml")
-	runGit(t, repo, "commit", "-m", "base")
-
-	writeFile(t, filepath.Join(repo, "docs", "config.yaml"), strings.Join([]string{
-		"tokens: 128",
-		"token_type: bearer",
-		"max_tokens: 2000",
-		"completion_tokens: 200",
-		"prompt_tokens: 100",
-	}, "\n")+"\n")
-	runGit(t, repo, "add", "docs/config.yaml")
-	runGit(t, repo, "commit", "-m", "add benign token config")
-
-	got := collectFromPreviousCommit(t, repo)
-	for _, item := range got {
-		if item.File == "docs/config.yaml" && item.Rule == "public_content_generic_credential" {
-			t.Fatalf("benign unquoted token field should not be credential finding: %#v", got)
-		}
-	}
-}
-
-func TestCollectDetectsCredentialPhraseBeforeEnvironmentSuffix(t *testing.T) {
-	repo := newGitRepo(t)
-	writeFile(t, filepath.Join(repo, "docs", "config.yaml"), "base: true\n")
-	runGit(t, repo, "add", "docs/config.yaml")
-	runGit(t, repo, "commit", "-m", "base")
-
-	writeFile(t, filepath.Join(repo, "docs", "config.yaml"), strings.Join([]string{
-		"API_KEY_OPENAI: real-openai-key",
-		"TOKEN_GITHUB: real-github-token",
-		"CLIENT_SECRET_GOOGLE: real-google-secret",
-		"SECRET_KEY_BASE: real-secret-key-base",
-		"APP_PASSWORD_PROD: real-prod-password",
-	}, "\n")+"\n")
-	runGit(t, repo, "add", "docs/config.yaml")
-	runGit(t, repo, "commit", "-m", "add credential config")
-
-	got := collectFromPreviousCommit(t, repo)
-	var count int
-	for _, item := range got {
-		if item.File != "docs/config.yaml" || item.Rule != "public_content_generic_credential" {
-			continue
-		}
-		count++
-		for _, forbidden := range []string{
-			"real-openai-key",
-			"real-github-token",
-			"real-google-secret",
-			"real-secret-key-base",
-			"real-prod-password",
-		} {
-			if strings.Contains(item.Excerpt, forbidden) {
-				t.Fatalf("credential finding leaked value %q in excerpt %q", forbidden, item.Excerpt)
-			}
-		}
-	}
-	if count != 5 {
-		t.Fatalf("credential suffix variants findings = %d, want 5: %#v", count, got)
-	}
-}
-
-func TestCollectDetectsPrivateKeyWhenOnlyEndIsAdded(t *testing.T) {
-	repo := newGitRepo(t)
-
-	writeFile(t, filepath.Join(repo, "docs", "key.pem"), privateKeyBegin()+"legacy-body\n")
-	runGit(t, repo, "add", "docs/key.pem")
-	runGit(t, repo, "commit", "-m", "base")
-
-	writeFile(t, filepath.Join(repo, "docs", "key.pem"), privateKeyBegin()+"legacy-body\nnew-body\n"+privateKeyEnd())
-	runGit(t, repo, "add", "docs/key.pem")
-	runGit(t, repo, "commit", "-m", "complete key")
-
-	got := collectFromPreviousCommit(t, repo)
-	requireFinding(t, got, "docs/key.pem", "public_content_private_key_block")
-}
-
-func TestCollectDetectsPrivateKeyWhenOnlyBeginIsAdded(t *testing.T) {
-	repo := newGitRepo(t)
-
-	writeFile(t, filepath.Join(repo, "docs", "key.pem"), "legacy-body\n"+privateKeyEnd())
-	runGit(t, repo, "add", "docs/key.pem")
-	runGit(t, repo, "commit", "-m", "base")
-
-	writeFile(t, filepath.Join(repo, "docs", "key.pem"), privateKeyBegin()+"legacy-body\n"+privateKeyEnd())
-	runGit(t, repo, "add", "docs/key.pem")
-	runGit(t, repo, "commit", "-m", "complete key")
-
-	got := collectFromPreviousCommit(t, repo)
-	requireFinding(t, got, "docs/key.pem", "public_content_private_key_block")
-}
-
-func TestCollectDetectsPrivateKeyWhenOnlyBodyIsAdded(t *testing.T) {
-	repo := newGitRepo(t)
-
-	writeFile(t, filepath.Join(repo, "docs", "key.pem"), privateKeyBegin()+privateKeyEnd())
-	runGit(t, repo, "add", "docs/key.pem")
-	runGit(t, repo, "commit", "-m", "base")
-
-	writeFile(t, filepath.Join(repo, "docs", "key.pem"), privateKeyBegin()+"new-body\n"+privateKeyEnd())
-	runGit(t, repo, "add", "docs/key.pem")
-	runGit(t, repo, "commit", "-m", "add body")
-
-	got := collectFromPreviousCommit(t, repo)
-	requireFinding(t, got, "docs/key.pem", "public_content_private_key_block")
-}
-
-func TestCollectIgnoresUntouchedHistoricalPrivateKey(t *testing.T) {
-	repo := newGitRepo(t)
-
-	writeFile(t, filepath.Join(repo, "docs", "key.pem"), privateKeyBegin()+"legacy-body\n"+privateKeyEnd())
-	runGit(t, repo, "add", "docs/key.pem")
-	runGit(t, repo, "commit", "-m", "base")
-
-	writeFile(t, filepath.Join(repo, "docs", "key.pem"), privateKeyBegin()+"legacy-body\n"+privateKeyEnd())
-	writeFile(t, filepath.Join(repo, "docs", "public.md"), "public docs update\n")
-	runGit(t, repo, "add", "docs/public.md")
-	runGit(t, repo, "commit", "-m", "docs update")
-
-	got := collectFromPreviousCommit(t, repo)
-	for _, item := range got {
-		if item.File == "docs/key.pem" && item.Rule == "public_content_private_key_block" {
-			t.Fatalf("collector reported untouched historical private key: %#v", got)
-		}
-	}
-}
-
-func TestCollectIgnoresDeletedPrivateKeyLine(t *testing.T) {
-	repo := newGitRepo(t)
-
-	writeFile(t, filepath.Join(repo, "docs", "key.pem"), privateKeyBegin()+"legacy-body\n"+privateKeyEnd())
-	runGit(t, repo, "add", "docs/key.pem")
-	runGit(t, repo, "commit", "-m", "base")
-
-	writeFile(t, filepath.Join(repo, "docs", "key.pem"), privateKeyBegin()+privateKeyEnd())
-	runGit(t, repo, "add", "docs/key.pem")
-	runGit(t, repo, "commit", "-m", "remove body")
-
-	got := collectFromPreviousCommit(t, repo)
-	for _, item := range got {
-		if item.File == "docs/key.pem" && item.Rule == "public_content_private_key_block" {
-			t.Fatalf("collector reported delete-only private key cleanup: %#v", got)
-		}
-	}
-}
-
-func TestCollectSkipsOnlyKnownQualityGateFixtureFiles(t *testing.T) {
-	repo := t.TempDir()
-	runGit(t, repo, "init")
-	runGit(t, repo, "config", "user.email", "test@example.com")
-	runGit(t, repo, "config", "user.name", "Test User")
-
-	writeFile(t, filepath.Join(repo, "README.md"), "base\n")
-	runGit(t, repo, "add", "README.md")
-	runGit(t, repo, "commit", "-m", "base")
-
-	writeFile(t, filepath.Join(repo, "internal", "qualitygate", "publiccontent", "collect_test.go"), "SECRET_TOKEN=fixture\n")
-	writeFile(t, filepath.Join(repo, "internal", "qualitygate", "publiccontent", "scan_test.go"), "SECRET_TOKEN=fixture\n")
-	writeFile(t, filepath.Join(repo, "internal", "qualitygate", "publiccontent", "scan.go"), "const privateKeyFixture = \""+privateKeyBeginPrefix+privateKeyMarker+"\"\n")
-	writeFile(t, filepath.Join(repo, "internal", "qualitygate", "publiccontent", "rules.go"), "markers := []string{\"generated with automation\"}\n")
-	writeFile(t, filepath.Join(repo, "tests", "e2e", "new-public-workflow.test.sh"), "SECRET_TOKEN=real-leak\n")
-	runGit(t, repo, "add", ".")
-	runGit(t, repo, "commit", "-m", "add scanner fixtures")
-
-	metadataPath := filepath.Join(repo, "pr-metadata.json")
-	writeFile(t, metadataPath, `{}`)
-
-	got, err := Collect(context.Background(), Options{
-		Repo:         repo,
-		ChangedFrom:  "HEAD~1",
-		MetadataPath: metadataPath,
-	})
-	if err != nil {
-		t.Fatalf("Collect() error = %v", err)
-	}
-	var foundOrdinaryTestLeak bool
-	for _, item := range got {
-		switch item.File {
-		case "internal/qualitygate/publiccontent/collect_test.go",
-			"internal/qualitygate/publiccontent/scan.go",
-			"internal/qualitygate/publiccontent/scan_test.go",
-			"internal/qualitygate/publiccontent/rules.go":
-			t.Fatalf("collector scanned known fixture or detector implementation file: %#v", got)
-		}
-		if item.File == "tests/e2e/new-public-workflow.test.sh" && item.Rule == "public_content_generic_credential" {
-			foundOrdinaryTestLeak = true
-		}
-	}
-	if !foundOrdinaryTestLeak {
-		t.Fatalf("collector should still scan ordinary test files for real leaks: %#v", got)
-	}
-}
-
-func TestScanChangedFileDocumentsFixtureExclusions(t *testing.T) {
-	excluded := []string{
-		"internal/qualitygate/publiccontent/collect_test.go",
-		"internal/qualitygate/publiccontent/rules.go",
-		"internal/qualitygate/publiccontent/scan.go",
-		"internal/qualitygate/publiccontent/scan_test.go",
-	}
-	for _, file := range excluded {
-		if scanChangedFile(file) {
-			t.Fatalf("scanChangedFile(%q) = true, want false for detector fixture/implementation path", file)
-		}
-	}
-
-	included := []string{
-		"internal/qualitygate/publiccontent/new_test.go",
-		"tests/e2e/new-public-workflow.test.sh",
-		"docs/public.md",
-	}
-	for _, file := range included {
-		if !scanChangedFile(file) {
-			t.Fatalf("scanChangedFile(%q) = false, want true", file)
-		}
-	}
-}
-
-func TestCollectScansAddedLinesInSpecialPathNames(t *testing.T) {
-	repo := newGitRepo(t)
-	writeFile(t, filepath.Join(repo, "docs", "old.md"), "base\n")
-	runGit(t, repo, "add", ".")
-	runGit(t, repo, "commit", "-m", "base")
-
-	writeFile(t, filepath.Join(repo, "docs", "has space.md"), "SECRET_TOKEN=space-value\n")
-	writeFile(t, filepath.Join(repo, `weird"quote.md`), "SECRET_TOKEN=quote-value\n")
-	runGit(t, repo, "mv", "docs/old.md", "docs/new name.md")
-	writeFile(t, filepath.Join(repo, "docs", "new name.md"), "base\nSECRET_TOKEN=rename-value\n")
-	runGit(t, repo, "add", ".")
-	runGit(t, repo, "commit", "-m", "add special paths")
-
-	got := collectFromPreviousCommit(t, repo)
-	requireFinding(t, got, "docs/has space.md", "public_content_generic_credential")
-	requireFinding(t, got, `weird"quote.md`, "public_content_generic_credential")
-	requireFinding(t, got, "docs/new name.md", "public_content_generic_credential")
-}
-
-func TestCollectScansBranchNameAsWarning(t *testing.T) {
-	repo := t.TempDir()
-	metadataPath := filepath.Join(repo, "pr-metadata.json")
-	writeFile(t, metadataPath, `{"branch":"bot/public-doc-update"}`)
-	got, err := Collect(context.Background(), Options{
-		Repo:         repo,
-		MetadataPath: metadataPath,
-	})
-	if err != nil {
-		t.Fatalf("Collect() error = %v", err)
-	}
-	if len(got) != 1 || got[0].Rule != "public_content_automation_branch" {
-		t.Fatalf("branch findings = %#v", got)
-	}
-}
-
-func TestCollectUsesExplicitBranchNameWhenDetached(t *testing.T) {
-	repo := newGitRepo(t)
-	writeFile(t, filepath.Join(repo, "README.md"), "base\n")
-	runGit(t, repo, "add", "README.md")
-	runGit(t, repo, "commit", "-m", "base")
-	runGit(t, repo, "checkout", "-b", "bot/public-doc-update")
-	writeFile(t, filepath.Join(repo, "docs.md"), "safe docs\n")
-	runGit(t, repo, "add", "docs.md")
-	runGit(t, repo, "commit", "-m", "docs")
-	head := strings.TrimSpace(string(runGitOutput(t, repo, "rev-parse", "HEAD")))
-	runGit(t, repo, "checkout", "--detach", head)
-
-	metadataPath := filepath.Join(repo, "pr-metadata.json")
-	writeFile(t, metadataPath, `{}`)
-	got, err := Collect(context.Background(), Options{
-		Repo:         repo,
-		MetadataPath: metadataPath,
-		BranchName:   "bot/public-doc-update",
-	})
-	if err != nil {
-		t.Fatalf("Collect() error = %v", err)
-	}
-	requireFinding(t, got, "branch", "public_content_automation_branch")
-}
-
-func TestCollectUsesBranchEnvironmentWhenDetached(t *testing.T) {
-	repo := newGitRepo(t)
-	writeFile(t, filepath.Join(repo, "README.md"), "base\n")
-	runGit(t, repo, "add", "README.md")
-	runGit(t, repo, "commit", "-m", "base")
-	runGit(t, repo, "checkout", "-b", "bot/public-env-update")
-	writeFile(t, filepath.Join(repo, "docs.md"), "safe docs\n")
-	runGit(t, repo, "add", "docs.md")
-	runGit(t, repo, "commit", "-m", "docs")
-	head := strings.TrimSpace(string(runGitOutput(t, repo, "rev-parse", "HEAD")))
-	runGit(t, repo, "checkout", "--detach", head)
-	t.Setenv("GITHUB_HEAD_REF", "bot/public-env-update")
-
-	metadataPath := filepath.Join(repo, "pr-metadata.json")
-	writeFile(t, metadataPath, `{}`)
-	got, err := Collect(context.Background(), Options{
-		Repo:         repo,
-		MetadataPath: metadataPath,
-	})
-	if err != nil {
-		t.Fatalf("Collect() error = %v", err)
-	}
-	requireFinding(t, got, "branch", "public_content_automation_branch")
-}
-
-func TestCollectPreservesFindingAttributionForChangedLines(t *testing.T) {
-	repo := newGitRepo(t)
-	writeFile(t, filepath.Join(repo, "docs", "auth.md"), "intro\n")
-	runGit(t, repo, "add", "docs/auth.md")
-	runGit(t, repo, "commit", "-m", "base")
-
-	writeFile(t, filepath.Join(repo, "docs", "auth.md"), "intro\nAuthorization: Bearer abcdefghijklmnopqrstuvwxyz\n")
-	runGit(t, repo, "add", "docs/auth.md")
-	runGit(t, repo, "commit", "-m", "add auth docs")
-
-	got := collectFromPreviousCommit(t, repo)
-	for _, item := range got {
-		if item.Rule == "public_content_bearer_header" {
-			if item.File != "docs/auth.md" || item.Line != 2 || item.Source != "file" {
-				t.Fatalf("changed-line attribution = %#v", item)
-			}
-			return
-		}
-	}
-	t.Fatalf("missing bearer finding: %#v", got)
-}
-
-func TestAppendUniqueFindingsDeduplicatesByRuleFileLineAndSource(t *testing.T) {
-	base := []Finding{newFinding("public_content_private_key_block", "docs/key.pem", 1, "file", "private key block")}
-	got := appendUniqueFindings(base,
-		newFinding("public_content_private_key_block", "docs/key.pem", 1, "file", "private key block"),
-		newFinding("public_content_private_key_block", "docs/key.pem", 2, "file", "private key block"),
-	)
-	if len(got) != 2 {
-		t.Fatalf("appendUniqueFindings len = %d, want 2: %#v", len(got), got)
-	}
-}
-
-func newGitRepo(t *testing.T) string {
-	t.Helper()
-	repo := t.TempDir()
-	runGit(t, repo, "init")
-	runGit(t, repo, "config", "user.email", "test@example.com")
-	runGit(t, repo, "config", "user.name", "Test User")
-	return repo
-}
-
-func privateKeyBegin() string {
-	return privateKeyBeginPrefix + privateKeyMarker + "\n"
-}
-
-func privateKeyEnd() string {
-	return privateKeyEndPrefix + privateKeyMarker + "\n"
-}
-
-func collectFromPreviousCommit(t *testing.T, repo string) []Finding {
-	t.Helper()
-	metadataPath := filepath.Join(repo, "pr-metadata.json")
-	writeFile(t, metadataPath, `{}`)
-	got, err := Collect(context.Background(), Options{
-		Repo:         repo,
-		ChangedFrom:  "HEAD~1",
-		MetadataPath: metadataPath,
-	})
-	if err != nil {
-		t.Fatalf("Collect() error = %v", err)
-	}
-	return got
-}
-
-func requireFinding(t *testing.T, got []Finding, file, rule string) {
-	t.Helper()
-	for _, item := range got {
-		if item.File == file && item.Rule == rule {
-			return
-		}
-	}
-	t.Fatalf("missing %s in %s findings: %#v", rule, file, got)
-}
-
-func TestCollectRequiresValidMetadataJSON(t *testing.T) {
-	repo := t.TempDir()
-	metadataPath := filepath.Join(repo, "pr-metadata.json")
-	writeFile(t, metadataPath, `{"title":`)
-
-	_, err := Collect(context.Background(), Options{Repo: repo, MetadataPath: metadataPath})
-	if err == nil || !strings.Contains(err.Error(), "public content metadata") {
-		t.Fatalf("Collect() error = %v, want metadata parse error", err)
-	}
-}
-
-func runGit(t *testing.T, repo string, args ...string) {
-	t.Helper()
-	if len(args) > 0 && args[0] == "commit" {
-		args = append([]string{"commit", "--no-verify"}, args[1:]...)
-	}
-	cmd := exec.Command("git", args...)
-	cmd.Dir = repo
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		t.Fatalf("git %v failed: %v\n%s", args, err, out)
-	}
-}
-
-func runGitOutput(t *testing.T, repo string, args ...string) []byte {
-	t.Helper()
-	cmd := exec.Command("git", args...)
-	cmd.Dir = repo
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		t.Fatalf("git %v failed: %v\n%s", args, err, out)
-	}
-	return out
-}
-
-func writeFile(t *testing.T, path, data string) {
-	t.Helper()
-	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(path, []byte(data), 0o644); err != nil {
-		t.Fatal(err)
-	}
-}
--- a/internal/qualitygate/publiccontent/comment_audit.go
+++ b/internal/qualitygate/publiccontent/comment_audit.go
@@ -1,11 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package publiccontent
-
-func ScanComment(kind, body string) []Finding {
-	if kind == "" {
-		kind = "comment"
-	}
-	return scanText(kind, "comment", body, false)
-}
--- a/internal/qualitygate/publiccontent/comment_audit_test.go
+++ b/internal/qualitygate/publiccontent/comment_audit_test.go
@@ -1,19 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package publiccontent
-
-import "testing"
-
-func TestScanCommentAuditsPublishedCommentBodies(t *testing.T) {
-	got := ScanComment("issue_comment", `The published comment included /tmp/harness`+`-agent/run and CCM`+`-Harness: stage-4`)
-	rules := findingRules(got)
-	if !rules["public_content_harness_metadata"] || !rules["public_content_ccm_harness_trailer"] {
-		t.Fatalf("comment audit findings = %#v", got)
-	}
-	for _, item := range got {
-		if item.File != "issue_comment" {
-			t.Fatalf("comment finding file = %q, want issue_comment", item.File)
-		}
-	}
-}
--- a/internal/qualitygate/publiccontent/metadata.go
+++ b/internal/qualitygate/publiccontent/metadata.go
@@ -1,45 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package publiccontent
-
-import (
-	"encoding/json"
-	"fmt"
-
-	"github.com/larksuite/cli/internal/vfs"
-)
-
-func LoadMetadata(path string) (Metadata, error) {
-	if path == "" {
-		return Metadata{}, nil
-	}
-	data, err := vfs.ReadFile(path)
-	if err != nil {
-		return Metadata{}, fmt.Errorf("public content metadata: %w", err)
-	}
-	if len(data) == 0 {
-		return Metadata{}, nil
-	}
-	var out Metadata
-	if err := json.Unmarshal(data, &out); err != nil {
-		return Metadata{}, fmt.Errorf("public content metadata: %w", err)
-	}
-	return out, nil
-}
-
-func scanMetadata(m Metadata) []Finding {
-	text := ""
-	if m.Title != "" {
-		text += "title: " + m.Title + "\n"
-	}
-	if m.Body != "" {
-		text += "body:\n" + m.Body + "\n"
-	}
-	if text == "" {
-		return nil
-	}
-	out := scanText("pull_request_metadata", "metadata", text, false)
-	out = append(out, semanticCandidate("pull_request_metadata", "metadata", text, 1)...)
-	return out
-}
--- a/internal/qualitygate/publiccontent/metadata_test.go
+++ b/internal/qualitygate/publiccontent/metadata_test.go
@@ -1,22 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package publiccontent
-
-import (
-	"path/filepath"
-	"testing"
-)
-
-func TestLoadMetadataReadsTitleAndBody(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "metadata.json")
-	writeFile(t, path, `{"title":"public change","body":"pass`+`word = \"example-password\""}`)
-
-	got, err := LoadMetadata(path)
-	if err != nil {
-		t.Fatalf("LoadMetadata() error = %v", err)
-	}
-	if got.Title != "public change" || got.Body == "" {
-		t.Fatalf("metadata = %#v", got)
-	}
-}
--- a/internal/qualitygate/publiccontent/rules.go
+++ b/internal/qualitygate/publiccontent/rules.go
@@ -1,478 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package publiccontent
-
-import (
-	"net/url"
-	"path/filepath"
-	"regexp"
-	"strings"
-
-	"github.com/larksuite/cli/internal/qualitygate/report"
-)
-
-var (
-	credentialAssignmentRE = regexp.MustCompile(`(?i)["']?\b[A-Za-z0-9_-]*(?:api[_-]?key|access[_-]?key|private[_-]?key|secret|password|passwd|token|webhook|access[_-]?token|client[_-]?secret)[A-Za-z0-9_-]*\b["']?\s*[:=]\s*(?:"((?:\\.|[^"\\])*)"|'((?:\\.|[^'\\])*)'|(\$\([^)]*\))|(\$\{\{[^}]+\}\})|([^"'\s,}\]]+))`)
-	jwtLikeRE              = regexp.MustCompile(`\b[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b`)
-	credentialURLRE        = regexp.MustCompile(`(?i)\b[a-z][a-z0-9+.-]*://[^/\s:@]*:[^@\s/]+@[^)\s]+`)
-	bearerHeaderRE         = regexp.MustCompile(`(?i)(?:\bAuthorization\s*:\s*Bearer\s+|["']Authorization["']\s*:\s*["']Bearer\s+)[A-Za-z0-9._+/=-]{12,}`)
-	semanticBearerHeaderRE = regexp.MustCompile(`(?i)(?:\bAuthorization\s*:\s*Bearer\s+[^"'\s,}\]]+|["']Authorization["']\s*:\s*["']Bearer\s+[^"'\\\s,}\]]+)`)
-	changeIDTrailerRE      = regexp.MustCompile(`(?i)^\s*Change-Id:\s*\S+`)
-	reviewedOnTrailerRE    = regexp.MustCompile(`(?i)^\s*Reviewed-on:\s*\S+`)
-	ccmHarnessTrailerRE    = regexp.MustCompile(`(?i)\bCCM-Harness:\s*\S+`)
-	privateIPv4RE          = regexp.MustCompile(`\b(?:10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|192\.168\.[0-9]{1,3}\.[0-9]{1,3}|172\.(?:1[6-9]|2[0-9]|3[0-1])\.[0-9]{1,3}\.[0-9]{1,3})\b`)
-	automationBranchRE     = regexp.MustCompile(`(?i)(^|/)(bot|automation)[-/]`)
-)
-
-func actionForRule(rule string) report.Action {
-	switch rule {
-	case "public_content_generic_credential",
-		"public_content_private_key_block",
-		"public_content_jwt_like_token",
-		"public_content_bearer_header",
-		"public_content_credential_url",
-		"public_content_change_id_trailer",
-		"public_content_reviewed_on_trailer",
-		"public_content_provenance_marker",
-		"public_content_detector_fingerprint",
-		"public_content_harness_metadata",
-		"public_content_ccm_harness_trailer":
-		return report.ActionReject
-	case "public_content_private_ipv4",
-		"public_content_automation_branch":
-		return report.ActionWarning
-	default:
-		return report.ActionWarning
-	}
-}
-
-func isPlaceholderValue(value string) bool {
-	trimmed := strings.Trim(value, `"'`)
-	normalized := strings.ToLower(trimmed)
-	if normalized == "" ||
-		normalized == "=" ||
-		percentWrappedPlaceholder(normalized) ||
-		angleWrappedPlaceholder(normalized) ||
-		urlWithAnglePlaceholder(normalized) ||
-		isCredentialReferenceValue(trimmed) {
-		return true
-	}
-	return namedPlaceholderValue(normalized)
-}
-
-func namedPlaceholderValue(value string) bool {
-	switch value {
-	case "...", "placeholder", "redacted", "<redacted>", "xxxx", "test-secret":
-		return true
-	}
-	return strings.Contains(value, "cli_example") ||
-		allXPlaceholder(value) ||
-		conventionalNamedPlaceholderValue(value)
-}
-
-func allXPlaceholder(value string) bool {
-	if len(value) < 4 {
-		return false
-	}
-	for _, r := range value {
-		if r != 'x' {
-			return false
-		}
-	}
-	return true
-}
-
-func conventionalNamedPlaceholderValue(value string) bool {
-	if !delimitedPlaceholderIdentifier(value) {
-		return false
-	}
-	normalized := strings.ReplaceAll(value, "-", "_")
-	if rest, ok := strings.CutPrefix(normalized, "your_"); ok {
-		return conventionalCredentialPlaceholderName(rest)
-	}
-	if rest, ok := strings.CutSuffix(normalized, "_here"); ok {
-		return conventionalCredentialPlaceholderName(rest)
-	}
-	return false
-}
-
-func conventionalCredentialPlaceholderName(value string) bool {
-	switch value {
-	case "api_key",
-		"access_key",
-		"private_key",
-		"secret",
-		"password",
-		"passwd",
-		"token",
-		"webhook",
-		"access_token",
-		"refresh_token",
-		"bearer_token",
-		"session_token",
-		"client_secret":
-		return true
-	default:
-		return false
-	}
-}
-
-func urlWithAnglePlaceholder(value string) bool {
-	if !strings.Contains(value, "://") ||
-		!strings.Contains(value, "<") ||
-		!strings.Contains(value, ">") {
-		return false
-	}
-	return !urlRemainderLooksCredentialLike(removeAnglePlaceholders(value))
-}
-
-func removeAnglePlaceholders(value string) string {
-	var out strings.Builder
-	for len(value) > 0 {
-		start := strings.Index(value, "<")
-		if start < 0 {
-			out.WriteString(value)
-			break
-		}
-		out.WriteString(value[:start])
-		end := strings.Index(value[start+1:], ">")
-		if end < 0 {
-			out.WriteString(value[start:])
-			break
-		}
-		value = value[start+end+2:]
-	}
-	return out.String()
-}
-
-func urlRemainderLooksCredentialLike(value string) bool {
-	normalized := strings.ToLower(value)
-	for _, marker := range []string{
-		"secret",
-		"token",
-		"password",
-		"passwd",
-		"api_key",
-		"apikey",
-		"private_key",
-		"privatekey",
-		"client_secret",
-		"clientsecret",
-	} {
-		if strings.Contains(normalized, marker) {
-			return true
-		}
-	}
-	for _, part := range strings.FieldsFunc(normalized, func(r rune) bool {
-		return !((r >= 'a' && r <= 'z') || (r >= '0' && r <= '9') || r == '_' || r == '-')
-	}) {
-		if credentialShapedIdentifier(part) || longCredentialSegment(part) {
-			return true
-		}
-	}
-	return false
-}
-
-func longCredentialSegment(value string) bool {
-	if len(value) < 16 {
-		return false
-	}
-	var hasLetter, hasDigit bool
-	for _, r := range value {
-		switch {
-		case r >= 'a' && r <= 'z':
-			hasLetter = true
-		case r >= '0' && r <= '9':
-			hasDigit = true
-		case r == '_' || r == '-':
-		default:
-			return false
-		}
-	}
-	return hasLetter || hasDigit
-}
-
-func isCredentialReferenceValue(value string) bool {
-	normalized := strings.ToLower(value)
-	switch {
-	case strings.HasPrefix(normalized, "${{"):
-		return githubExpressionReference(normalized)
-	case strings.HasPrefix(normalized, "$("):
-		return !commandSubstitutionLooksCredentialLike(normalized)
-	case strings.HasPrefix(normalized, "process.env."):
-		return credentialReferenceIdentifier(strings.TrimPrefix(normalized, "process.env."))
-	case strings.HasPrefix(normalized, "${"):
-		return credentialReferenceIdentifier(strings.TrimSuffix(strings.TrimPrefix(normalized, "${"), "}"))
-	case strings.HasPrefix(value, "$"):
-		return credentialReferenceIdentifier(strings.TrimPrefix(normalized, "$"))
-	default:
-		return false
-	}
-}
-
-func commandSubstitutionLooksCredentialLike(value string) bool {
-	if !strings.HasPrefix(value, "$(") || !strings.HasSuffix(value, ")") {
-		return false
-	}
-	inner := strings.TrimSuffix(strings.TrimPrefix(value, "$("), ")")
-	for _, part := range strings.FieldsFunc(inner, func(r rune) bool {
-		return !((r >= 'a' && r <= 'z') || (r >= '0' && r <= '9') || r == '_' || r == '-')
-	}) {
-		if credentialShapedIdentifier(part) || longCredentialSegment(part) {
-			return true
-		}
-	}
-	return false
-}
-
-func githubExpressionReference(value string) bool {
-	if !strings.HasPrefix(value, "${{") || !strings.HasSuffix(value, "}}") {
-		return false
-	}
-	expr := strings.TrimSpace(strings.TrimSuffix(strings.TrimPrefix(value, "${{"), "}}"))
-	switch {
-	case strings.HasPrefix(expr, "secrets."):
-		return dottedReferenceIdentifier(strings.TrimPrefix(expr, "secrets."))
-	case strings.HasPrefix(expr, "env."):
-		return dottedReferenceIdentifier(strings.TrimPrefix(expr, "env."))
-	case strings.HasPrefix(expr, "vars."):
-		return dottedReferenceIdentifier(strings.TrimPrefix(expr, "vars."))
-	case expr == "github.token":
-		return true
-	default:
-		return false
-	}
-}
-
-func dottedReferenceIdentifier(value string) bool {
-	if value == "" {
-		return false
-	}
-	for _, part := range strings.Split(value, ".") {
-		if !referenceIdentifier(part) {
-			return false
-		}
-	}
-	return true
-}
-
-func credentialReferenceIdentifier(value string) bool {
-	return referenceIdentifier(value) && !credentialShapedIdentifier(value)
-}
-
-func referenceIdentifier(value string) bool {
-	if value == "" {
-		return false
-	}
-	for i, r := range value {
-		switch {
-		case r >= 'a' && r <= 'z':
-		case r >= '0' && r <= '9' && i > 0:
-		case r == '_' && i > 0:
-		default:
-			return false
-		}
-	}
-	return true
-}
-
-func angleWrappedPlaceholder(value string) bool {
-	if len(value) < 3 || !strings.HasPrefix(value, "<") || !strings.HasSuffix(value, ">") {
-		return false
-	}
-	return anglePlaceholderIdentifier(strings.Trim(value, "<>"))
-}
-
-func percentWrappedPlaceholder(value string) bool {
-	if len(value) < 3 || !strings.HasPrefix(value, "%") || !strings.HasSuffix(value, "%") {
-		return false
-	}
-	inner := strings.Trim(value, "%")
-	return delimitedPlaceholderIdentifier(inner) && !credentialShapedIdentifier(inner)
-}
-
-func delimitedPlaceholderIdentifier(value string) bool {
-	if value == "" {
-		return false
-	}
-	for _, r := range value {
-		if (r >= 'a' && r <= 'z') || (r >= '0' && r <= '9') || r == '_' || r == '-' {
-			continue
-		}
-		return false
-	}
-	return true
-}
-
-func anglePlaceholderIdentifier(value string) bool {
-	if value == "" {
-		return false
-	}
-	for _, r := range value {
-		if (r >= 'a' && r <= 'z') || (r >= '0' && r <= '9') || r == '_' || r == '-' {
-			continue
-		}
-		return false
-	}
-	if credentialShapedIdentifier(value) {
-		return false
-	}
-	switch value {
-	case "token",
-		"id",
-		"userid",
-		"openid",
-		"key",
-		"secret",
-		"password",
-		"api-key",
-		"user-id",
-		"open-id",
-		"client-secret",
-		"access-token",
-		"refresh-token",
-		"auth-token",
-		"bearer-token",
-		"session-token",
-		"service-token":
-		return true
-	}
-	for _, suffix := range []string{"_token", "_id", "_key", "_secret", "_password"} {
-		if strings.HasSuffix(value, suffix) {
-			return true
-		}
-	}
-	for _, suffix := range []string{"-token", "-id", "-key", "-secret", "-password"} {
-		if strings.HasSuffix(value, suffix) {
-			return true
-		}
-	}
-	return false
-}
-
-func credentialShapedValue(value string) bool {
-	normalized := strings.ToLower(strings.Trim(value, `"'<>`))
-	return credentialShapedIdentifier(normalized)
-}
-
-func credentialShapedIdentifier(value string) bool {
-	switch {
-	case strings.HasPrefix(value, "sk_live_"),
-		strings.HasPrefix(value, "sk_test_"),
-		strings.HasPrefix(value, "ghp_"),
-		strings.HasPrefix(value, "gho_"),
-		strings.HasPrefix(value, "ghu_"),
-		strings.HasPrefix(value, "github_pat_"),
-		strings.HasPrefix(value, "xoxb_"),
-		strings.HasPrefix(value, "xoxp_"),
-		strings.HasPrefix(value, "xoxa_"):
-		return true
-	case strings.HasPrefix(value, "real-") &&
-		(strings.Contains(value, "secret") ||
-			strings.Contains(value, "token") ||
-			strings.Contains(value, "key") ||
-			strings.Contains(value, "password")):
-		return true
-	default:
-		return false
-	}
-}
-
-func resourceTokenPlaceholderValue(value string) bool {
-	normalized := strings.ToLower(strings.Trim(value, `"'`))
-	switch normalized {
-	case "wiki_token",
-		"folder_token",
-		"obj_token",
-		"spreadsheet_token",
-		"file_token",
-		"doc_token",
-		"node_token",
-		"parent_node_token",
-		"origin_node_token",
-		"drive_route_token":
-		return true
-	default:
-		return minuteTokenFixturePlaceholder(normalized)
-	}
-}
-
-func minuteTokenFixturePlaceholder(value string) bool {
-	if value == "minute_no_meta" {
-		return true
-	}
-	suffix, ok := strings.CutPrefix(value, "minute_")
-	if !ok || suffix == "" {
-		return false
-	}
-	for _, r := range suffix {
-		if r < '0' || r > '9' {
-			return false
-		}
-	}
-	return true
-}
-
-func provenanceMarker(line string) bool {
-	normalized := strings.ToLower(line)
-	markers := []string{
-		"generat" + "ed by tool",
-		"creat" + "ed by tool",
-		"generat" + "ed by automation",
-		"creat" + "ed by automation",
-		"machine-" + "generated",
-		"generated with automated",
-		"generated with automation",
-		"🤖 generated",
-	}
-	for _, marker := range markers {
-		if strings.Contains(normalized, marker) {
-			return true
-		}
-	}
-	if strings.HasPrefix(normalized, "co-authored-by:") &&
-		(strings.Contains(normalized, "<bot@") ||
-			strings.Contains(normalized, " bot@") ||
-			strings.Contains(normalized, "[bot]") ||
-			strings.Contains(normalized, "automation") ||
-			strings.Contains(normalized, "automated-code-assistant")) {
-		return true
-	}
-	return false
-}
-
-// Detector fingerprint checks are intentionally scoped to public rule/config
-// files. They do not try to hide this package's implementation; they prevent
-// publishing reusable detector identifiers in external-facing rule bundles.
-func isDetectorRuleFile(path string) bool {
-	normalized := filepath.ToSlash(path)
-	base := filepath.Base(normalized)
-	return base == ".gitleaks.toml" ||
-		strings.Contains(normalized, "public-rules/") ||
-		strings.Contains(normalized, "public_rules/")
-}
-
-func detectorFingerprint(line string) bool {
-	normalized := strings.ToLower(line)
-	fingerprints := []string{
-		strings.Join([]string{"public", "content", "leakage"}, "-"),
-		strings.Join([]string{"public", "content", "detector"}, "-"),
-		"publiccontent",
-	}
-	for _, fingerprint := range fingerprints {
-		if strings.Contains(normalized, fingerprint) {
-			return true
-		}
-	}
-	return false
-}
-
-func redactCredentialURL(raw string) string {
-	u, err := url.Parse(raw)
-	if err != nil || u.User == nil {
-		return "<credential-url>"
-	}
-	u.User = url.UserPassword("<user>", "<redacted>")
-	return u.String()
-}
--- a/internal/qualitygate/publiccontent/scan.go
+++ b/internal/qualitygate/publiccontent/scan.go
@@ -1,837 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package publiccontent
-
-import (
-	"encoding/base64"
-	"encoding/json"
-	"fmt"
-	"path/filepath"
-	"sort"
-	"strings"
-	"unicode"
-)
-
-const (
-	privateKeyBeginPrefix = "-----" + "BEGIN "
-	privateKeyEndPrefix   = "-----" + "END "
-	privateKeyMarker      = "PRIVATE " + "KEY-----"
-)
-
-func ScanFile(path string, data []byte) []Finding {
-	return scanText(filepath.ToSlash(path), "file", string(data), isDetectorRuleFile(path))
-}
-
-func semanticCandidate(file, source, text string, line int) []Finding {
-	excerpt := redactedSemanticExcerpt(text)
-	if excerpt == "" {
-		return nil
-	}
-	return []Finding{newFinding("public_content_semantic_candidate", file, line, source, excerpt)}
-}
-
-func scanText(file, source, text string, detectorFile bool) []Finding {
-	var out []Finding
-	lines := strings.Split(text, "\n")
-	inPrivateKey := false
-	privateKeyLine := 0
-	for i, line := range lines {
-		lineNo := i + 1
-		if strings.Contains(line, privateKeyBeginPrefix) && strings.Contains(line, privateKeyMarker) {
-			inPrivateKey = true
-			privateKeyLine = lineNo
-		}
-		if inPrivateKey && strings.Contains(line, privateKeyEndPrefix) && strings.Contains(line, privateKeyMarker) {
-			out = append(out, newFinding("public_content_private_key_block", file, privateKeyLine, source, "private key block"))
-			inPrivateKey = false
-		}
-		for _, match := range credentialAssignmentRE.FindAllStringSubmatch(line, -1) {
-			if !isCredentialAssignmentMatch(match[0]) {
-				continue
-			}
-			value := credentialAssignmentValue(match)
-			keyName, _ := normalizedCredentialAssignmentKey(match[0])
-			if value == "" ||
-				isNonSecretLiteralValue(value) ||
-				isBenignCodeCredentialExpression(file, value) ||
-				isPlaceholderValue(value) ||
-				isResourceTokenPlaceholderAssignment(keyName, value) {
-				continue
-			}
-			if looksLikeEqualityComparison(value) {
-				continue
-			}
-			out = append(out, newFinding("public_content_generic_credential", file, lineNo, source, redactAssignment(match[0])))
-		}
-		for _, match := range jwtLikeRE.FindAllString(line, -1) {
-			if !isJWTToken(match) {
-				continue
-			}
-			out = append(out, newFinding("public_content_jwt_like_token", file, lineNo, source, redactToken(match)))
-		}
-		for _, match := range bearerHeaderRE.FindAllString(line, -1) {
-			if isPlaceholderBearerHeader(match) {
-				continue
-			}
-			out = append(out, newFinding("public_content_bearer_header", file, lineNo, source, "Authorization: Bearer <redacted>"))
-		}
-		for _, match := range credentialURLRE.FindAllString(line, -1) {
-			if isPlaceholderCredentialURL(match) {
-				continue
-			}
-			out = append(out, newFinding("public_content_credential_url", file, lineNo, source, redactCredentialURL(match)))
-		}
-		for _, match := range privateIPv4RE.FindAllString(line, -1) {
-			out = append(out, newFinding("public_content_private_ipv4", file, lineNo, source, match))
-		}
-		if source == "branch" && automationBranchRE.MatchString(line) {
-			out = append(out, newFinding("public_content_automation_branch", file, lineNo, source, "automation branch marker"))
-		}
-		switch {
-		case changeIDTrailerRE.MatchString(line):
-			out = append(out, newFinding("public_content_change_id_trailer", file, lineNo, source, "Change-Id: <redacted>"))
-		case reviewedOnTrailerRE.MatchString(line):
-			out = append(out, newFinding("public_content_reviewed_on_trailer", file, lineNo, source, "Reviewed-on: <redacted>"))
-		case ccmHarnessTrailerRE.MatchString(line):
-			out = append(out, newFinding("public_content_ccm_harness_trailer", file, lineNo, source, "CCM-Harness: <redacted>"))
-		}
-		if provenanceMarker(line) {
-			out = append(out, newFinding("public_content_provenance_marker", file, lineNo, source, "provenance marker"))
-		}
-		if strings.Contains(line, "/tmp/harness-agent") {
-			out = append(out, newFinding("public_content_harness_metadata", file, lineNo, source, "/tmp/harness-agent"))
-		}
-		if detectorFile && detectorFingerprint(line) {
-			out = append(out, newFinding("public_content_detector_fingerprint", file, lineNo, source, "public detector fingerprint"))
-		}
-	}
-	sort.SliceStable(out, func(i, j int) bool {
-		if out[i].File != out[j].File {
-			return out[i].File < out[j].File
-		}
-		if out[i].Line != out[j].Line {
-			return out[i].Line < out[j].Line
-		}
-		return out[i].Rule < out[j].Rule
-	})
-	return out
-}
-
-func isCredentialAssignmentMatch(match string) bool {
-	name, value, ok := normalizedCredentialAssignment(match)
-	if !ok {
-		return false
-	}
-	if isWebhookCredentialKey(name) && webhookAssignmentValueLooksCredentialLike(value) {
-		return true
-	}
-	if isBenignTokenField(name) && !credentialShapedValue(value) {
-		return false
-	}
-	return isExplicitCredentialKey(name)
-}
-
-func normalizedCredentialAssignmentKey(match string) (string, bool) {
-	key, _, ok := normalizedCredentialAssignment(match)
-	return key, ok
-}
-
-func normalizedCredentialAssignment(match string) (string, string, bool) {
-	key, ok := credentialAssignmentKey(match)
-	if !ok {
-		return "", "", false
-	}
-	key = strings.TrimSpace(key)
-	if key == "" {
-		return "", "", false
-	}
-	submatches := credentialAssignmentRE.FindStringSubmatch(match)
-	return normalizedCredentialKey(strings.Trim(key, `"'`)), credentialAssignmentValue(submatches), true
-}
-
-func normalizedCredentialKey(key string) string {
-	key = strings.TrimSpace(key)
-	var out []rune
-	var prev rune
-	for i, r := range key {
-		if r == '-' {
-			r = '_'
-		}
-		if i > 0 && isCredentialKeyBoundary(prev, r) {
-			out = append(out, '_')
-		}
-		out = append(out, unicode.ToLower(r))
-		prev = r
-	}
-	key = string(out)
-	key = strings.ReplaceAll(key, "-", "_")
-	return key
-}
-
-func isCredentialKeyBoundary(prev, current rune) bool {
-	if prev == '_' || current == '_' {
-		return false
-	}
-	return (unicode.IsLower(prev) || unicode.IsDigit(prev)) && unicode.IsUpper(current)
-}
-
-func isBenignTokenField(key string) bool {
-	if isTokenMetricField(key) ||
-		isTokenMetadataField(key) ||
-		isResourceTokenField(key) ||
-		isPaginationOrSyncTokenField(key) {
-		return true
-	}
-	return false
-}
-
-func isTokenMetricField(key string) bool {
-	switch key {
-	case "tokenizer",
-		"token_count",
-		"tokens",
-		"max_tokens",
-		"completion_tokens",
-		"prompt_tokens":
-		return true
-	default:
-		return false
-	}
-}
-
-func isTokenMetadataField(key string) bool {
-	switch key {
-	case "access_token_expires_in",
-		"refresh_token_expires_in",
-		"token_expires_in",
-		"token_status",
-		"token_type",
-		"token_url",
-		"token_endpoint",
-		"token_format",
-		"secret_name":
-		return true
-	default:
-		return false
-	}
-}
-
-func isPaginationOrSyncTokenField(key string) bool {
-	switch key {
-	case "page_token",
-		"next_page_token",
-		"sync_token":
-		return true
-	default:
-		return false
-	}
-}
-
-func isResourceTokenField(key string) bool {
-	if !strings.HasSuffix(key, "_token") {
-		return false
-	}
-	prefix := strings.TrimSuffix(key, "_token")
-	switch prefix {
-	case "app",
-		"base",
-		"board",
-		"doc",
-		"drive_route",
-		"file",
-		"folder",
-		"host_node",
-		"minute",
-		"node",
-		"obj",
-		"origin_node",
-		"parent",
-		"parent_file",
-		"parent_node",
-		"share",
-		"spreadsheet",
-		"target",
-		"wiki":
-		return true
-	default:
-		return false
-	}
-}
-
-func isResourceTokenPlaceholderAssignment(key, value string) bool {
-	switch {
-	case key == "client_token" && idempotencyTokenPlaceholderValue(value):
-		return true
-	case key == "retry_without_token" && numericStringPlaceholderValue(value):
-		return true
-	case tokenLikePlaceholderKey(key):
-		return tokenLikePlaceholderValue(value)
-	default:
-		return false
-	}
-}
-
-func tokenLikePlaceholderKey(key string) bool {
-	return key == "token" ||
-		strings.HasSuffix(key, "_token") ||
-		strings.HasSuffix(key, "-token")
-}
-
-func tokenLikePlaceholderValue(value string) bool {
-	normalized := strings.ToLower(strings.Trim(value, `"'`))
-	if normalized == "" || credentialShapedIdentifier(normalized) {
-		return false
-	}
-	return resourceTokenPlaceholderValue(value) ||
-		isPlaceholderValue(value) ||
-		normalized == "token" ||
-		strings.Contains(normalized, "...") ||
-		strings.Contains(normalized, "xxx") ||
-		strings.Contains(normalized, "_or_") ||
-		strings.HasSuffix(normalized, "_token") ||
-		strings.HasPrefix(normalized, ".")
-}
-
-func idempotencyTokenPlaceholderValue(value string) bool {
-	return numericStringPlaceholderValue(value) || uuidStringPlaceholderValue(value)
-}
-
-func uuidStringPlaceholderValue(value string) bool {
-	normalized := strings.Trim(value, `"'`)
-	parts := strings.Split(normalized, "-")
-	if len(parts) != 5 {
-		return false
-	}
-	for i, part := range parts {
-		want := []int{8, 4, 4, 4, 12}[i]
-		if len(part) != want {
-			return false
-		}
-		for _, r := range part {
-			if (r >= '0' && r <= '9') ||
-				(r >= 'a' && r <= 'f') ||
-				(r >= 'A' && r <= 'F') {
-				continue
-			}
-			return false
-		}
-	}
-	return true
-}
-
-func numericStringPlaceholderValue(value string) bool {
-	normalized := strings.Trim(value, `"'`)
-	if normalized == "" {
-		return false
-	}
-	for _, r := range normalized {
-		if r < '0' || r > '9' {
-			return false
-		}
-	}
-	return true
-}
-
-func isBenignCodeCredentialExpression(file, value string) bool {
-	normalized := strings.TrimSpace(value)
-	if strings.HasPrefix(normalized, "regexp.MustCompile(") {
-		return true
-	}
-	if !sourceCodeFile(file) || quotedLiteral(value) || credentialShapedValue(value) {
-		return false
-	}
-	return codeReferenceExpression(normalized)
-}
-
-func sourceCodeFile(file string) bool {
-	switch filepath.Ext(file) {
-	case ".go", ".py":
-		return true
-	default:
-		return false
-	}
-}
-
-func quotedLiteral(value string) bool {
-	normalized := strings.TrimSpace(value)
-	return len(normalized) >= 2 &&
-		((strings.HasPrefix(normalized, `"`) && strings.HasSuffix(normalized, `"`)) ||
-			(strings.HasPrefix(normalized, `'`) && strings.HasSuffix(normalized, `'`)))
-}
-
-func codeReferenceExpression(value string) bool {
-	if value == "" {
-		return false
-	}
-	for _, marker := range []string{".", "(", ")", "[", "]", "{"} {
-		if strings.Contains(value, marker) {
-			return true
-		}
-	}
-	return codeIdentifier(value) && !credentialNameFragment(value)
-}
-
-func codeIdentifier(value string) bool {
-	for i, r := range value {
-		switch {
-		case r >= 'a' && r <= 'z':
-		case r >= 'A' && r <= 'Z':
-		case r == '_' && i > 0:
-		case r >= '0' && r <= '9' && i > 0:
-		default:
-			return false
-		}
-	}
-	return true
-}
-
-func credentialNameFragment(value string) bool {
-	normalized := strings.ToLower(value)
-	for _, marker := range []string{"secret", "token", "password", "passwd", "key"} {
-		if strings.Contains(normalized, marker) {
-			return true
-		}
-	}
-	return false
-}
-
-func isNonSecretLiteralValue(value string) bool {
-	switch strings.ToLower(strings.TrimSpace(strings.Trim(value, `"'`))) {
-	case "true", "false", "null", "nil", "{", "[":
-		return true
-	default:
-		return false
-	}
-}
-
-func isJWTToken(value string) bool {
-	parts := strings.Split(value, ".")
-	if len(parts) != 3 {
-		return false
-	}
-	header, err := decodeBase64URLSegment(parts[0])
-	if err != nil || !json.Valid(header) {
-		return false
-	}
-	var fields map[string]interface{}
-	if err := json.Unmarshal(header, &fields); err != nil {
-		return false
-	}
-	alg, ok := fields["alg"].(string)
-	return ok && alg != ""
-}
-
-func decodeBase64URLSegment(value string) ([]byte, error) {
-	if decoded, err := base64.RawURLEncoding.DecodeString(value); err == nil {
-		return decoded, nil
-	}
-	return base64.URLEncoding.DecodeString(value)
-}
-
-func isPlaceholderBearerHeader(match string) bool {
-	normalized := strings.ToLower(match)
-	idx := strings.LastIndex(normalized, "bearer ")
-	if idx < 0 {
-		return false
-	}
-	value := strings.TrimSpace(match[idx+len("bearer "):])
-	return isPlaceholderValue(value)
-}
-
-func isWebhookCredentialKey(key string) bool {
-	return strings.Contains(strings.ReplaceAll(key, "_", ""), "webhook")
-}
-
-func webhookAssignmentValueLooksCredentialLike(value string) bool {
-	normalized := strings.ToLower(strings.Trim(value, `"'`))
-	if normalized == "" || isPlaceholderValue(normalized) || isNonSecretLiteralValue(normalized) {
-		return false
-	}
-	return urlRemainderLooksCredentialLike(removeAnglePlaceholders(normalized)) ||
-		credentialShapedIdentifier(strings.Trim(normalized, "$"))
-}
-
-func isExplicitCredentialKey(key string) bool {
-	compact := strings.ReplaceAll(key, "_", "")
-	switch compact {
-	case "token",
-		"accesstoken",
-		"refreshtoken",
-		"authtoken",
-		"bearertoken",
-		"sessiontoken",
-		"servicetoken",
-		"apikey",
-		"accesskey",
-		"privatekey",
-		"apisecret",
-		"secret",
-		"secretkey",
-		"clientsecret",
-		"password",
-		"passwd":
-		return true
-	}
-	for _, phrase := range []string{
-		"accesstoken",
-		"refreshtoken",
-		"authtoken",
-		"bearertoken",
-		"sessiontoken",
-		"servicetoken",
-		"bottoken",
-		"apikey",
-		"accesskey",
-		"privatekey",
-		"apisecret",
-		"clientsecret",
-		"secretkey",
-	} {
-		if strings.Contains(compact, phrase) {
-			return true
-		}
-	}
-	parts := credentialKeyParts(key)
-	for _, phrase := range [][2]string{
-		{"access", "token"},
-		{"refresh", "token"},
-		{"auth", "token"},
-		{"bearer", "token"},
-		{"session", "token"},
-		{"service", "token"},
-		{"bot", "token"},
-		{"api", "key"},
-		{"access", "key"},
-		{"private", "key"},
-		{"api", "secret"},
-		{"client", "secret"},
-		{"secret", "key"},
-	} {
-		if hasAdjacentCredentialParts(parts, phrase[0], phrase[1]) {
-			return true
-		}
-	}
-	for _, part := range parts {
-		switch part {
-		case "token", "secret", "password", "passwd":
-			return true
-		}
-	}
-	for _, suffix := range []string{
-		"token",
-		"accesstoken",
-		"refreshtoken",
-		"authtoken",
-		"bearertoken",
-		"sessiontoken",
-		"servicetoken",
-		"bottoken",
-		"apikey",
-		"accesskey",
-		"privatekey",
-		"apisecret",
-		"clientsecret",
-		"secret",
-		"secretkey",
-		"password",
-		"passwd",
-	} {
-		if strings.HasSuffix(compact, suffix) {
-			return true
-		}
-	}
-	for _, suffix := range []string{
-		"_access_token",
-		"_refresh_token",
-		"_auth_token",
-		"_bearer_token",
-		"_session_token",
-		"_service_token",
-		"_api_key",
-		"_access_key",
-		"_private_key",
-		"_api_secret",
-		"_client_secret",
-		"_secret",
-		"_secret_key",
-		"_password",
-		"_passwd",
-	} {
-		if strings.HasSuffix(key, suffix) {
-			return true
-		}
-	}
-	return false
-}
-
-func credentialKeyParts(key string) []string {
-	var parts []string
-	for _, part := range strings.Split(key, "_") {
-		if part != "" {
-			parts = append(parts, part)
-		}
-	}
-	return parts
-}
-
-func hasAdjacentCredentialParts(parts []string, first, second string) bool {
-	for i := 0; i+1 < len(parts); i++ {
-		if parts[i] == first && parts[i+1] == second {
-			return true
-		}
-	}
-	return false
-}
-
-func credentialAssignmentValue(match []string) string {
-	for _, value := range match[1:] {
-		if value != "" {
-			return value
-		}
-	}
-	return ""
-}
-
-func looksLikeEqualityComparison(value string) bool {
-	return strings.HasPrefix(strings.TrimSpace(value), "=")
-}
-
-func isPlaceholderCredentialURL(raw string) bool {
-	userInfo, ok := credentialURLUserInfo(raw)
-	if !ok {
-		return false
-	}
-	_, password, ok := strings.Cut(userInfo, ":")
-	if !ok {
-		return false
-	}
-	return credentialURLPasswordPlaceholder(password)
-}
-
-func credentialURLPasswordPlaceholder(password string) bool {
-	normalized := strings.ToLower(password)
-	decoded := strings.ReplaceAll(normalized, "%3c", "<")
-	decoded = strings.ReplaceAll(decoded, "%3e", ">")
-	switch decoded {
-	case "placeholder", "redacted", "<redacted>", "xxxx":
-		return true
-	}
-	return angleWrappedPlaceholder(decoded) || percentWrappedPlaceholder(decoded)
-}
-
-func credentialURLUserInfo(raw string) (string, bool) {
-	schemeIdx := strings.Index(raw, "://")
-	if schemeIdx < 0 {
-		return "", false
-	}
-	rest := raw[schemeIdx+len("://"):]
-	atIdx := strings.Index(rest, "@")
-	if atIdx < 0 {
-		return "", false
-	}
-	return rest[:atIdx], true
-}
-
-func newFinding(rule, file string, line int, source, excerpt string) Finding {
-	return Finding{
-		Rule:       rule,
-		Action:     actionForRule(rule),
-		File:       file,
-		Line:       line,
-		Source:     source,
-		Excerpt:    excerpt,
-		Message:    messageForRule(rule),
-		Suggestion: suggestionForRule(rule),
-	}
-}
-
-func messageForRule(rule string) string {
-	switch rule {
-	case "public_content_generic_credential":
-		return "public contribution contains a generic credential assignment"
-	case "public_content_private_key_block":
-		return "public contribution contains a private key block"
-	case "public_content_jwt_like_token":
-		return "public contribution contains a JWT-like token"
-	case "public_content_bearer_header":
-		return "public contribution contains an Authorization bearer token"
-	case "public_content_credential_url":
-		return "public contribution contains credentials embedded in a URL"
-	case "public_content_private_ipv4":
-		return "public contribution contains a private-network IP address"
-	case "public_content_automation_branch":
-		return "public contribution uses an automation-shaped branch name"
-	case "public_content_change_id_trailer":
-		return "public contribution contains a Change-Id trailer"
-	case "public_content_reviewed_on_trailer":
-		return "public contribution contains a Reviewed-on trailer"
-	case "public_content_provenance_marker":
-		return "public contribution contains a prohibited provenance marker"
-	case "public_content_detector_fingerprint":
-		return "public rule/config content exposes public detector fingerprints"
-	case "public_content_harness_metadata":
-		return "public contribution contains visible harness pipeline metadata"
-	case "public_content_ccm_harness_trailer":
-		return "public contribution contains a CCM-Harness trailer"
-	case "public_content_semantic_candidate":
-		return "public contribution contains text for semantic public content review"
-	default:
-		return "public contribution contains content that should not be published"
-	}
-}
-
-func suggestionForRule(rule string) string {
-	switch actionForRule(rule) {
-	case "REJECT":
-		return "remove the value from the public contribution and replace it with a non-sensitive placeholder"
-	default:
-		return "remove private workflow metadata before publishing the public contribution"
-	}
-}
-
-func redactAssignment(match string) string {
-	key, ok := credentialAssignmentKey(match)
-	if !ok {
-		return "<credential-assignment>"
-	}
-	return fmt.Sprintf("%s= <redacted>", strings.TrimSpace(key))
-}
-
-func credentialAssignmentKey(match string) (string, bool) {
-	idx := -1
-	for _, sep := range []string{":", "="} {
-		if candidate := strings.Index(match, sep); candidate >= 0 && (idx < 0 || candidate < idx) {
-			idx = candidate
-		}
-	}
-	if idx < 0 {
-		return "", false
-	}
-	return match[:idx], true
-}
-
-func redactToken(_ string) string {
-	return "<jwt-like-token>"
-}
-
-func redactedSemanticExcerpt(text string) string {
-	normalized := strings.Join(strings.Fields(text), " ")
-	if normalized == "" {
-		return ""
-	}
-	signals := semanticSignals(normalized)
-	if len(signals) == 0 {
-		return ""
-	}
-	sanitized := truncateRunes(sanitizeSemanticExcerpt(text), 600)
-	return fmt.Sprintf("semantic signals: %s; excerpt: %q", strings.Join(signals, ","), sanitized)
-}
-
-func semanticSignals(normalized string) []string {
-	lower := strings.ToLower(normalized)
-	var signals []string
-	add := func(signal string) {
-		for _, existing := range signals {
-			if existing == signal {
-				return
-			}
-		}
-		signals = append(signals, signal)
-	}
-
-	hasPrivateScope := strings.Contains(lower, "private") || strings.Contains(lower, "internal-only")
-	hasRequestMetadata := strings.Contains(lower, "request header") || strings.Contains(lower, "request headers") || strings.Contains(lower, "authorization header") || strings.Contains(lower, "metadata header")
-	hasTrustBoundary := strings.Contains(lower, "spoof") || strings.Contains(lower, "trust") || strings.Contains(lower, "risk scoring") || strings.Contains(lower, "classification")
-	hasRoadmap := strings.Contains(lower, "roadmap") || strings.Contains(lower, "migration") || strings.Contains(lower, "rollout") || strings.Contains(lower, "cutover") || strings.Contains(lower, "unpublished")
-	hasTiming := strings.Contains(lower, "target date") || strings.Contains(lower, "friday") || strings.Contains(lower, "monday") || strings.Contains(lower, "tuesday") || strings.Contains(lower, "wednesday") || strings.Contains(lower, "thursday") || strings.Contains(lower, "customer-visible")
-	hasImplementation := strings.Contains(lower, "server-side") || strings.Contains(lower, "implementation")
-
-	if hasPrivateScope && hasRequestMetadata && hasTrustBoundary {
-		add("private_scope")
-		add("request_metadata")
-		add("trust_boundary_detail")
-	}
-	if hasRoadmap && (hasPrivateScope || hasTiming) {
-		add("roadmap_detail")
-		if hasPrivateScope {
-			add("private_scope")
-		}
-		if hasTiming {
-			add("roadmap_timing")
-		}
-	}
-	if hasPrivateScope && hasImplementation && hasTrustBoundary {
-		add("private_scope")
-		add("implementation_detail")
-		add("trust_boundary_detail")
-	}
-
-	return signals
-}
-
-func sanitizeSemanticExcerpt(text string) string {
-	text = redactPrivateKeyBlocks(text)
-	text = credentialAssignmentRE.ReplaceAllStringFunc(text, sanitizeCredentialAssignment)
-	text = strings.ReplaceAll(text, `<redacted>"`, `<redacted>`)
-	text = strings.ReplaceAll(text, `<redacted>'`, `<redacted>`)
-	text = semanticBearerHeaderRE.ReplaceAllString(text, "Authorization: Bearer <redacted>")
-	text = jwtLikeRE.ReplaceAllStringFunc(text, func(match string) string {
-		if isJWTToken(match) {
-			return "<jwt-like-token>"
-		}
-		return match
-	})
-	text = credentialURLRE.ReplaceAllStringFunc(text, sanitizeCredentialURL)
-	return strings.Join(strings.Fields(text), " ")
-}
-
-func redactPrivateKeyBlocks(text string) string {
-	lines := strings.Split(text, "\n")
-	var out []string
-	inPrivateKey := false
-	for _, line := range lines {
-		if strings.Contains(line, privateKeyBeginPrefix) && strings.Contains(line, privateKeyMarker) {
-			out = append(out, "<private-key-block>")
-			inPrivateKey = true
-			if strings.Contains(line, privateKeyEndPrefix) && strings.Contains(line, privateKeyMarker) {
-				inPrivateKey = false
-			}
-			continue
-		}
-		if inPrivateKey {
-			if strings.Contains(line, privateKeyEndPrefix) && strings.Contains(line, privateKeyMarker) {
-				inPrivateKey = false
-			}
-			continue
-		}
-		out = append(out, line)
-	}
-	return strings.Join(out, "\n")
-}
-
-func sanitizeCredentialAssignment(match string) string {
-	key, ok := credentialAssignmentKey(match)
-	if !ok {
-		return "<credential-assignment>"
-	}
-	return strings.TrimSpace(key) + "=<redacted>"
-}
-
-func sanitizeCredentialURL(raw string) string {
-	redacted := redactCredentialURL(raw)
-	redacted = strings.ReplaceAll(redacted, "%3Cuser%3E", "<user>")
-	redacted = strings.ReplaceAll(redacted, "%3Credacted%3E", "<redacted>")
-	return redacted
-}
-
-func truncateRunes(text string, limit int) string {
-	if limit <= 0 {
-		return ""
-	}
-	runes := []rune(text)
-	if len(runes) <= limit {
-		return text
-	}
-	return string(runes[:limit]) + "..."
-}
--- a/internal/qualitygate/publiccontent/scan_test.go
+++ b/internal/qualitygate/publiccontent/scan_test.go
--- a/internal/qualitygate/publiccontent/types.go
+++ b/internal/qualitygate/publiccontent/types.go
@@ -1,30 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package publiccontent
-
-import "github.com/larksuite/cli/internal/qualitygate/report"
-
-type Options struct {
-	Repo         string
-	ChangedFrom  string
-	MetadataPath string
-	BranchName   string
-}
-
-type Metadata struct {
-	Title  string `json:"title"`
-	Body   string `json:"body"`
-	Branch string `json:"branch"`
-}
-
-type Finding struct {
-	Rule       string
-	Action     report.Action
-	File       string
-	Line       int
-	Source     string
-	Excerpt    string
-	Message    string
-	Suggestion string
-}
--- a/internal/qualitygate/rules/dryrun.go
+++ b/internal/qualitygate/rules/dryrun.go
@@ -174,9 +174,8 @@ type materializedExample struct {
 }

 type placeholderContext struct {
-	FlagName    string
-	FlagUsage   string
-	FlagDefault string
+	FlagName  string
+	FlagUsage string
 }

 func materializePlaceholderExample(raw string, cmd manifest.Command) (materializedExample, bool) {
@@ -248,7 +247,6 @@ func placeholderContextForFlag(name string, flag *manifest.Flag) placeholderCont
 	ctx := placeholderContext{FlagName: name}
 	if flag != nil {
 		ctx.FlagUsage = flag.Usage
-		ctx.FlagDefault = flag.DefValue
 	}
 	return ctx
 }
@@ -311,17 +309,11 @@ func fakeValueForPlaceholder(raw string, ctx placeholderContext) (string, bool)
 	if name == "" {
 		return "", false
 	}
-	if value, ok := fakeNumericValueForPlaceholder(name, ctx); ok {
-		return value, true
-	}
-	if value, ok := fakeContextualURLValueForPlaceholder(name, ctx); ok {
-		return value, true
-	}
 	if value, ok := fakeValueFromPlaceholderName(name); ok {
 		return value, true
 	}
 	if isGenericPlaceholderName(name) {
-		return fakeValueFromContextHint(ctx)
+		return fakeValueFromUsageHint(ctx.FlagUsage)
 	}
 	return "", false
 }
@@ -344,26 +336,16 @@ func fakeValueFromPlaceholderName(name string) (string, bool) {
 		return "file_test123", true
 	case hasPlaceholderToken(tokens, "file") && hasPlaceholderToken(tokens, "token"):
 		return "file_test123", true
-	case hasPlaceholderToken(tokens, "folder") && hasPlaceholderToken(tokens, "token"):
-		return "fld_test123", true
 	case hasPlaceholderToken(tokens, "image", "img"):
 		return "img_test123", true
 	case hasPlaceholderToken(tokens, "app"):
 		return "app_test123", true
-	case hasPlaceholderToken(tokens, "draft"):
-		return "draft_test123", true
-	case hasPlaceholderToken(tokens, "label"):
-		return "label_test123", true
-	case hasPlaceholderToken(tokens, "share"):
-		return "share_test123", true
 	case hasPlaceholderToken(tokens, "doc", "document"):
 		return "doc_test123", true
 	case hasPlaceholderToken(tokens, "sheet", "spreadsheet"):
 		return "shtcn_test123", true
 	case hasPlaceholderToken(tokens, "base"):
 		return "base_test123", true
-	case hasPlaceholderToken(tokens, "space"):
-		return "space_test123", true
 	case hasPlaceholderToken(tokens, "table"):
 		return "tbl_test123", true
 	case hasPlaceholderToken(tokens, "view"):
@@ -395,98 +377,17 @@ func fakeValueFromPlaceholderName(name string) (string, bool) {
 	}
 }

-func fakeValueFromContextHint(ctx placeholderContext) (string, bool) {
-	if value, ok := fakeNumericValueForPlaceholder("", ctx); ok {
-		return value, true
-	}
-	if value, ok := fakeContextualURLValueForPlaceholder("", ctx); ok {
-		return value, true
-	}
-	match := placeholderValuePattern.FindStringSubmatch(strings.ToLower(ctx.FlagUsage))
+func fakeValueFromUsageHint(usage string) (string, bool) {
+	match := placeholderValuePattern.FindStringSubmatch(strings.ToLower(usage))
 	if len(match) != 2 || !knownTokenPrefix(match[1]) {
 		return "", false
 	}
 	return match[1] + "_test123", true
 }

-func fakeContextualURLValueForPlaceholder(name string, ctx placeholderContext) (string, bool) {
-	nameTokens := placeholderTokenSet(name)
-	flagName := strings.ReplaceAll(strings.ToLower(ctx.FlagName), "-", "_")
-	flagTokens := placeholderTokenSet(flagName)
-	if !hasPlaceholderToken(nameTokens, "url", "link") && !hasPlaceholderToken(flagTokens, "url", "link") {
-		return "", false
-	}
-	usage := strings.ToLower(ctx.FlagUsage)
-	if strings.Contains(usage, "lark") || strings.Contains(usage, "feishu") || strings.Contains(usage, "document url") {
-		return "https://example.feishu.cn/docx/doc_test123", true
-	}
-	return "", false
-}
-
-func fakeNumericValueForPlaceholder(name string, ctx placeholderContext) (string, bool) {
-	nameTokens := placeholderTokenSet(name)
-	flagName := strings.ReplaceAll(strings.ToLower(ctx.FlagName), "-", "_")
-	flagTokens := placeholderTokenSet(flagName)
-	usage := strings.ToLower(ctx.FlagUsage)
-
-	switch {
-	case placeholderTokenPair(nameTokens, "meeting", "id") || placeholderTokenPair(flagTokens, "meeting", "id"):
-		return "400000000001", true
-	case placeholderTokenPair(nameTokens, "meeting", "ids") || placeholderTokenPair(flagTokens, "meeting", "ids"):
-		return "400000000001", true
-	case placeholderTokenPair(nameTokens, "meeting", "no") || placeholderTokenPair(flagTokens, "meeting", "no"):
-		return "123456789", true
-	case placeholderTokenPair(nameTokens, "meeting", "number") || placeholderTokenPair(flagTokens, "meeting", "number"):
-		return "123456789", true
-	case hasPlaceholderToken(nameTokens, "timestamp") || hasPlaceholderToken(flagTokens, "timestamp") || strings.Contains(usage, "unix timestamp"):
-		return defaultPositiveInteger(ctx.FlagDefault, "1893456000"), true
-	case placeholderTokenPair(nameTokens, "page", "size") || placeholderTokenPair(flagTokens, "page", "size"):
-		return defaultPositiveInteger(ctx.FlagDefault, "20"), true
-	case placeholderTokenPair(nameTokens, "page", "limit") || placeholderTokenPair(flagTokens, "page", "limit"):
-		return defaultPositiveInteger(ctx.FlagDefault, "10"), true
-	case numericPlaceholderName(nameTokens) || numericPlaceholderName(flagTokens) || numericUsageHint(usage):
-		return defaultPositiveInteger(ctx.FlagDefault, "20"), true
-	default:
-		return "", false
-	}
-}
-
-func numericPlaceholderName(tokens map[string]bool) bool {
-	if len(tokens) == 0 || hasPlaceholderToken(tokens, "token", "format", "type", "status", "mode") {
-		return false
-	}
-	return hasPlaceholderToken(tokens,
-		"amount", "count", "depth", "height", "index", "length", "limit", "max",
-		"number", "revision", "size", "width",
-	)
-}
-
-func numericUsageHint(usage string) bool {
-	if usage == "" {
-		return false
-	}
-	return strings.Contains(usage, "positive integer") ||
-		strings.Contains(usage, "decimal integer") ||
-		strings.Contains(usage, "number of ") ||
-		strings.Contains(usage, "(number)")
-}
-
-func defaultPositiveInteger(raw, fallback string) string {
-	raw = strings.TrimSpace(raw)
-	if raw == "" || strings.HasPrefix(raw, "-") || raw == "0" {
-		return fallback
-	}
-	for _, r := range raw {
-		if r < '0' || r > '9' {
-			return fallback
-		}
-	}
-	return raw
-}
-
 func knownTokenPrefix(prefix string) bool {
 	switch prefix {
-	case "app", "base", "doc", "draft", "file", "fld", "img", "item", "label", "meeting", "obcn", "oc", "od", "om", "ou", "page", "rec", "share", "shtcn", "space", "task", "tbl", "token", "viw", "wiki":
+	case "app", "base", "doc", "file", "fld", "img", "item", "meeting", "obcn", "oc", "od", "om", "ou", "page", "rec", "shtcn", "task", "tbl", "token", "viw", "wiki":
 		return true
 	default:
 		return false
@@ -530,10 +431,6 @@ func hasPlaceholderToken(tokens map[string]bool, wants ...string) bool {
 	return false
 }

-func placeholderTokenPair(tokens map[string]bool, first, second string) bool {
-	return tokens[first] && tokens[second]
-}
-
 func hasUnresolvedDryRunPlaceholder(value string) bool {
 	if skillscan.HasPlaceholder(value) {
 		return true
@@ -726,7 +623,6 @@ func appendDryRunArg(raw string) ([]string, error) {
 		return nil, fmt.Errorf("not a lark-cli command")
 	}
 	argv = truncateShellTail(argv)
-	argv = forceDryRunJSONFormat(argv)
 	hasDryRunArg := false
 	dryRunEnabled := false
 	for _, arg := range argv[1:] {
@@ -746,23 +642,6 @@ func appendDryRunArg(raw string) ([]string, error) {
 	return append(argv[1:], "--dry-run"), nil
 }

-func forceDryRunJSONFormat(argv []string) []string {
-	for i := 1; i < len(argv); i++ {
-		arg := argv[i]
-		if arg == "--format" {
-			if i+1 < len(argv) && argv[i+1] == "pretty" {
-				argv[i+1] = "json"
-			}
-			return argv
-		}
-		if arg == "--format=pretty" {
-			argv[i] = "--format=json"
-			return argv
-		}
-	}
-	return argv
-}
-
 func truncateShellTail(argv []string) []string {
 	for i, arg := range argv {
 		if i == 0 {
--- a/internal/qualitygate/rules/dryrun_test.go
+++ b/internal/qualitygate/rules/dryrun_test.go
@@ -305,161 +305,6 @@ func TestRunDryRunsMaterializesInlinePlaceholderFlagValues(t *testing.T) {
 	}
 }

-func TestRunDryRunsMaterializesNumericPlaceholderFlagValues(t *testing.T) {
-	cliBin, argsPath := fakeDryRunCLI(t, `{"api":[{"method":"GET","url":"/open-apis/vc/v1/bots/events","params":{"meeting_id":"400000000001","page_size":50}}]}`)
-	m := manifest.Manifest{Commands: []manifest.Command{{
-		Path:     "vc +meeting-events",
-		Runnable: true,
-		Flags: []manifest.Flag{
-			{Name: "meeting-id", TakesValue: true, Usage: "meeting ID to query; must be a long positive integer, not a 9-digit meeting number"},
-			{Name: "page-size", TakesValue: true, Usage: "page size, 20-100 (default 50)", DefValue: "50"},
-			{Name: "dry-run"},
-		},
-	}}}
-	ex := skillscan.Example{
-		Raw:            "lark-cli vc +meeting-events --meeting-id <meeting_id> --page-size <page_size>",
-		SourceFile:     "skills/lark-vc-agent/SKILL.md",
-		Line:           120,
-		HasPlaceholder: true,
-	}
-
-	diags, facts := RunDryRuns(context.Background(), cliBin, m, []skillscan.Example{ex})
-	if len(diags) != 0 {
-		t.Fatalf("RunDryRuns() diagnostics = %#v", diags)
-	}
-	if len(facts) != 1 || !facts[0].Executable || facts[0].SkipReason != "" {
-		t.Fatalf("numeric placeholder example should be executable after materialization: %#v", facts)
-	}
-	wantArgs := []string{"vc", "+meeting-events", "--meeting-id", "400000000001", "--page-size", "50", "--dry-run"}
-	if gotArgs := readArgs(t, argsPath); !reflect.DeepEqual(gotArgs, wantArgs) {
-		t.Fatalf("fake CLI args = %#v, want %#v", gotArgs, wantArgs)
-	}
-}
-
-func TestRunDryRunsMaterializesNumericPlaceholdersInsideJSONFlags(t *testing.T) {
-	cliBin, argsPath := fakeDryRunCLI(t, `{"api":[{"method":"GET","url":"/open-apis/test","params":{"timestamp":"1893456000","count":"20"}}]}`)
-	m := manifest.Manifest{Commands: []manifest.Command{{
-		Path:     "api GET",
-		Runnable: true,
-		Flags: []manifest.Flag{
-			{Name: "params", TakesValue: true},
-			{Name: "dry-run"},
-		},
-	}}}
-	ex := skillscan.Example{
-		Raw:            `lark-cli api GET /open-apis/test --params '{"timestamp":"<timestamp>","count":"<count>"}'`,
-		SourceFile:     "skills/lark-demo/SKILL.md",
-		Line:           20,
-		HasPlaceholder: true,
-	}
-
-	diags, facts := RunDryRuns(context.Background(), cliBin, m, []skillscan.Example{ex})
-	if len(diags) != 0 {
-		t.Fatalf("RunDryRuns() diagnostics = %#v", diags)
-	}
-	if len(facts) != 1 || !facts[0].Executable || facts[0].SkipReason != "" {
-		t.Fatalf("JSON numeric placeholder example should be executable after materialization: %#v", facts)
-	}
-	wantArgs := []string{"api", "GET", "/open-apis/test", "--params", `{"timestamp":"1893456000","count":"20"}`, "--dry-run"}
-	if gotArgs := readArgs(t, argsPath); !reflect.DeepEqual(gotArgs, wantArgs) {
-		t.Fatalf("fake CLI args = %#v, want %#v", gotArgs, wantArgs)
-	}
-}
-
-func TestRunDryRunsMaterializesLarkDocumentURLPlaceholders(t *testing.T) {
-	cliBin, argsPath := fakeDryRunCLI(t, `{"api":[{"method":"GET","url":"/open-apis/drive/v1/metas/batch_query"}]}`)
-	m := manifest.Manifest{Commands: []manifest.Command{{
-		Path:     "drive +inspect",
-		Runnable: true,
-		Flags: []manifest.Flag{
-			{Name: "url", TakesValue: true, Usage: "Lark/Feishu document URL (docx, doc, sheet, bitable, wiki, file, folder, mindnote, slides)"},
-			{Name: "format", TakesValue: true},
-			{Name: "dry-run"},
-		},
-	}}}
-	ex := skillscan.Example{
-		Raw:            "lark-cli drive +inspect --url '<url>' --format json",
-		SourceFile:     "skills/lark-drive/references/lark-drive-workflow-permission-governance-commands.md",
-		Line:           15,
-		HasPlaceholder: true,
-	}
-
-	diags, facts := RunDryRuns(context.Background(), cliBin, m, []skillscan.Example{ex})
-	if len(diags) != 0 {
-		t.Fatalf("RunDryRuns() diagnostics = %#v", diags)
-	}
-	if len(facts) != 1 || !facts[0].Executable || facts[0].SkipReason != "" {
-		t.Fatalf("Lark URL placeholder example should be executable after materialization: %#v", facts)
-	}
-	wantArgs := []string{"drive", "+inspect", "--url", "https://example.feishu.cn/docx/doc_test123", "--format", "json", "--dry-run"}
-	if gotArgs := readArgs(t, argsPath); !reflect.DeepEqual(gotArgs, wantArgs) {
-		t.Fatalf("fake CLI args = %#v, want %#v", gotArgs, wantArgs)
-	}
-}
-
-func TestRunDryRunsMaterializesResourceIDPlaceholderFlagValues(t *testing.T) {
-	cliBin, argsPath := fakeDryRunCLI(t, `{"api":[{"method":"GET","url":"/open-apis/wiki/v2/spaces/space_test123/nodes"}]}`)
-	m := manifest.Manifest{Commands: []manifest.Command{{
-		Path:     "wiki +node-list",
-		Runnable: true,
-		Flags: []manifest.Flag{
-			{Name: "space-id", TakesValue: true, Usage: "wiki space ID"},
-			{Name: "page-token", TakesValue: true, Usage: "page token"},
-			{Name: "format", TakesValue: true},
-			{Name: "dry-run"},
-		},
-	}}}
-	ex := skillscan.Example{
-		Raw:            "lark-cli wiki +node-list --space-id <space_id> --page-token <PAGE_TOKEN> --format json",
-		SourceFile:     "skills/lark-wiki/references/lark-wiki-node-list.md",
-		Line:           24,
-		HasPlaceholder: true,
-	}
-
-	diags, facts := RunDryRuns(context.Background(), cliBin, m, []skillscan.Example{ex})
-	if len(diags) != 0 {
-		t.Fatalf("RunDryRuns() diagnostics = %#v", diags)
-	}
-	if len(facts) != 1 || !facts[0].Executable || facts[0].SkipReason != "" {
-		t.Fatalf("resource ID placeholder example should be executable after materialization: %#v", facts)
-	}
-	wantArgs := []string{"wiki", "+node-list", "--space-id", "space_test123", "--page-token", "page_test123", "--format", "json", "--dry-run"}
-	if gotArgs := readArgs(t, argsPath); !reflect.DeepEqual(gotArgs, wantArgs) {
-		t.Fatalf("fake CLI args = %#v, want %#v", gotArgs, wantArgs)
-	}
-}
-
-func TestRunDryRunsMaterializesResourcePlaceholdersInsideJSONFlags(t *testing.T) {
-	cliBin, argsPath := fakeDryRunCLI(t, `{"api":[{"method":"POST","url":"/open-apis/mail/v1/user_mailboxes/me/drafts/draft_test123/send"}]}`)
-	m := manifest.Manifest{Commands: []manifest.Command{{
-		Path:     "mail user_mailbox.drafts send",
-		Runnable: true,
-		Flags: []manifest.Flag{
-			{Name: "params", TakesValue: true},
-			{Name: "data", TakesValue: true},
-			{Name: "dry-run"},
-		},
-	}}}
-	ex := skillscan.Example{
-		Raw:            `lark-cli mail user_mailbox.drafts send --params '{"user_mailbox_id":"me","draft_id":"<draft_id>"}' --data '{"send_time":"<unix_timestamp>"}'`,
-		SourceFile:     "skills/lark-mail/references/lark-mail-send.md",
-		Line:           172,
-		HasPlaceholder: true,
-	}
-
-	diags, facts := RunDryRuns(context.Background(), cliBin, m, []skillscan.Example{ex})
-	if len(diags) != 0 {
-		t.Fatalf("RunDryRuns() diagnostics = %#v", diags)
-	}
-	if len(facts) != 1 || !facts[0].Executable || facts[0].SkipReason != "" {
-		t.Fatalf("JSON resource placeholder example should be executable after materialization: %#v", facts)
-	}
-	wantArgs := []string{"mail", "user_mailbox.drafts", "send", "--params", `{"user_mailbox_id":"me","draft_id":"draft_test123"}`, "--data", `{"send_time":"1893456000"}`, "--dry-run"}
-	if gotArgs := readArgs(t, argsPath); !reflect.DeepEqual(gotArgs, wantArgs) {
-		t.Fatalf("fake CLI args = %#v, want %#v", gotArgs, wantArgs)
-	}
-}
-
 func TestRunDryRunsSkipsUnknownFlagsBeforeDryRun(t *testing.T) {
 	m := manifest.Manifest{Commands: []manifest.Command{{
 		Path:     "im +chat-messages-list",
@@ -755,51 +600,6 @@ func TestAppendDryRunArgDoesNotDuplicate(t *testing.T) {
 	}
 }

-func TestAppendDryRunArgForcesJSONFormat(t *testing.T) {
-	got, err := appendDryRunArg("lark-cli vc +meeting-events --meeting-id 400000000001 --format pretty")
-	if err != nil {
-		t.Fatalf("appendDryRunArg() error = %v", err)
-	}
-	want := []string{"vc", "+meeting-events", "--meeting-id", "400000000001", "--format", "json", "--dry-run"}
-	if !reflect.DeepEqual(got, want) {
-		t.Fatalf("appendDryRunArg() = %#v, want %#v", got, want)
-	}
-}
-
-func TestAppendDryRunArgForcesInlineJSONFormat(t *testing.T) {
-	got, err := appendDryRunArg("lark-cli vc +meeting-events --meeting-id 400000000001 --format=pretty --dry-run")
-	if err != nil {
-		t.Fatalf("appendDryRunArg() error = %v", err)
-	}
-	want := []string{"vc", "+meeting-events", "--meeting-id", "400000000001", "--format=json", "--dry-run"}
-	if !reflect.DeepEqual(got, want) {
-		t.Fatalf("appendDryRunArg() = %#v, want %#v", got, want)
-	}
-}
-
-func TestAppendDryRunArgPreservesNonPrettyFormat(t *testing.T) {
-	for _, raw := range []string{
-		"lark-cli mail +watch --format data --dry-run",
-		"lark-cli export +events --format=ndjson --dry-run",
-		"lark-cli docs +fetch --format table",
-	} {
-		got, err := appendDryRunArg(raw)
-		if err != nil {
-			t.Fatalf("appendDryRunArg(%q) error = %v", raw, err)
-		}
-		for _, arg := range got {
-			if arg == "--format=json" {
-				t.Fatalf("appendDryRunArg(%q) unexpectedly rewrote inline format: %#v", raw, got)
-			}
-		}
-		for i, arg := range got {
-			if arg == "--format" && i+1 < len(got) && got[i+1] == "json" {
-				t.Fatalf("appendDryRunArg(%q) unexpectedly rewrote split format: %#v", raw, got)
-			}
-		}
-	}
-}
-
 func TestAppendDryRunArgForcesDryRunWhenExplicitlyDisabled(t *testing.T) {
 	got, err := appendDryRunArg("lark-cli docs +fetch --dry-run=false --doc abc")
 	if err != nil {
--- a/internal/qualitygate/rules/run.go
+++ b/internal/qualitygate/rules/run.go
@@ -15,20 +15,18 @@ import (
 	manifestexamples "github.com/larksuite/cli/internal/qualitygate/examples"
 	"github.com/larksuite/cli/internal/qualitygate/facts"
 	"github.com/larksuite/cli/internal/qualitygate/manifest"
-	"github.com/larksuite/cli/internal/qualitygate/publiccontent"
 	"github.com/larksuite/cli/internal/qualitygate/report"
 	"github.com/larksuite/cli/internal/qualitygate/skillscan"
 	"github.com/larksuite/cli/internal/vfs"
 )

 type Options struct {
-	Repo                      string
-	CLIBin                    string
-	ChangedFrom               string
-	FactsOut                  string
-	ManifestPath              string
-	CommandIndexPath          string
-	PublicContentMetadataPath string
+	Repo             string
+	CLIBin           string
+	ChangedFrom      string
+	FactsOut         string
+	ManifestPath     string
+	CommandIndexPath string
 }

 func Run(ctx context.Context, opts Options) ([]report.Diagnostic, facts.Facts, error) {
@@ -100,60 +98,9 @@ func Run(ctx context.Context, opts Options) ([]report.Diagnostic, facts.Facts, e
 	if opts.ChangedFrom != "" {
 		diags = append(diags, errorDiags...)
 	}
-	publicContent, err := publiccontent.Collect(ctx, publiccontent.Options{
-		Repo:         opts.Repo,
-		ChangedFrom:  opts.ChangedFrom,
-		MetadataPath: opts.PublicContentMetadataPath,
-	})
-	if err != nil {
-		return nil, facts.Facts{}, err
-	}
-	diags = append(diags, publicContentDiagnostics(publicContent)...)
 	diags = filterPRDiagnostics(opts.Repo, opts.ChangedFrom, scope, m, diags)

-	builtFacts := facts.BuildWithCommandLookup(m, commandIndex, skillFacts, skillQualityFacts, errorFacts, exampleFacts, outputFacts, diags, scope.Files)
-	return diags, facts.WithPublicContent(builtFacts, publicContentFacts(publicContent)), nil
-}
-
-func publicContentDiagnostics(items []publiccontent.Finding) []report.Diagnostic {
-	if len(items) == 0 {
-		return nil
-	}
-	out := make([]report.Diagnostic, 0, len(items))
-	for _, item := range items {
-		if item.Rule == "public_content_semantic_candidate" {
-			continue
-		}
-		out = append(out, report.Diagnostic{
-			Rule:       item.Rule,
-			Action:     item.Action,
-			File:       item.File,
-			Line:       item.Line,
-			Message:    item.Message,
-			Suggestion: item.Suggestion,
-		})
-	}
-	return out
-}
-
-func publicContentFacts(items []publiccontent.Finding) []facts.PublicContentFact {
-	if len(items) == 0 {
-		return nil
-	}
-	out := make([]facts.PublicContentFact, 0, len(items))
-	for _, item := range items {
-		out = append(out, facts.PublicContentFact{
-			Rule:       item.Rule,
-			Action:     item.Action,
-			File:       item.File,
-			Line:       item.Line,
-			Source:     item.Source,
-			Excerpt:    item.Excerpt,
-			Message:    item.Message,
-			Suggestion: item.Suggestion,
-		})
-	}
-	return out
+	return diags, facts.BuildWithCommandLookup(m, commandIndex, skillFacts, skillQualityFacts, errorFacts, exampleFacts, outputFacts, diags, scope.Files), nil
 }

 func readManifestInput(path, kind, flag string) (manifest.Manifest, error) {
@@ -220,9 +167,6 @@ func filterPRDiagnostics(repo, changedFrom string, scope qdiff.Scope, m manifest
 }

 func prDiagnosticRelevant(repo string, changedFiles map[string]bool, commandScope diagnosticCommandScope, m manifest.Manifest, diag report.Diagnostic) bool {
-	if strings.HasPrefix(diag.Rule, "public_content_") {
-		return true
-	}
 	file := normalizeDiagnosticFile(repo, diag.File)
 	if file != "" && changedFiles[file] {
 		return true
--- a/internal/qualitygate/rules/run_test.go
+++ b/internal/qualitygate/rules/run_test.go
@@ -189,99 +189,6 @@ description: Manage Drive comments with service command references.
 	}
 }

-func TestRunCollectsPublicContentFindingsIntoDiagnosticsAndFacts(t *testing.T) {
-	repo := t.TempDir()
-	runGit(t, repo, "init")
-	runGit(t, repo, "config", "user.email", "test@example.com")
-	runGit(t, repo, "config", "user.name", "Test User")
-	if err := vfs.WriteFile(filepath.Join(repo, "README.md"), []byte("# test\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	runGit(t, repo, "add", "README.md")
-	runGit(t, repo, "commit", "-m", "base")
-
-	if err := vfs.MkdirAll(filepath.Join(repo, "docs"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	publicDoc := "api_" + "key = \"example-public-key\"\n" +
-		"Public docs describe a pri" + "vate request header and trust classification detail.\n"
-	if err := vfs.WriteFile(filepath.Join(repo, "docs", "public.md"), []byte(publicDoc), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	runGit(t, repo, "add", "docs/public.md")
-	runGit(t, repo, "commit", "-m", "add public doc")
-
-	metadataPath := filepath.Join(repo, "pr-metadata.json")
-	if err := vfs.WriteFile(metadataPath, []byte(`{"title":"public docs","body":"Change`+`-Id: I0123456789abcdef0123456789abcdef01234567"}`), 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	manifestPath := filepath.Join(repo, "command-manifest.json")
-	indexPath := filepath.Join(repo, "command-index.json")
-	m := manifest.Manifest{SchemaVersion: 1, Commands: []manifest.Command{{
-		Path:          "docs +fetch",
-		CanonicalPath: "docs +fetch",
-		Domain:        "docs",
-		Source:        manifest.SourceShortcut,
-	}}}
-	if err := manifest.WriteFile(manifestPath, manifest.KindCommandManifest, m); err != nil {
-		t.Fatal(err)
-	}
-	idx := manifest.Manifest{SchemaVersion: 1, Commands: append([]manifest.Command{}, m.Commands...)}
-	idx.Commands = append(idx.Commands, manifest.Command{
-		Path:          "drive files get",
-		CanonicalPath: "drive files get",
-		Domain:        "drive",
-		Source:        manifest.SourceService,
-		Generated:     true,
-		Runnable:      true,
-	})
-	if err := manifest.WriteFile(indexPath, manifest.KindCommandIndex, idx); err != nil {
-		t.Fatal(err)
-	}
-
-	diags, gotFacts, err := Run(context.Background(), Options{
-		Repo:                      repo,
-		CLIBin:                    "./lark-cli",
-		ChangedFrom:               "HEAD~1",
-		ManifestPath:              manifestPath,
-		CommandIndexPath:          indexPath,
-		PublicContentMetadataPath: metadataPath,
-	})
-	if err != nil {
-		t.Fatalf("Run() error = %v", err)
-	}
-	actions := map[string]report.Action{}
-	for _, diag := range diags {
-		actions[diag.Rule] = diag.Action
-	}
-	if actions["public_content_generic_credential"] != report.ActionReject {
-		t.Fatalf("generic credential diagnostic action = %q, diagnostics=%#v", actions["public_content_generic_credential"], diags)
-	}
-	if actions["public_content_change_id_trailer"] != report.ActionReject {
-		t.Fatalf("change-id diagnostic action = %q, diagnostics=%#v", actions["public_content_change_id_trailer"], diags)
-	}
-	if actions["public_content_semantic_candidate"] != "" {
-		t.Fatalf("semantic candidates should not become deterministic diagnostics: %#v", diags)
-	}
-	factRules := map[string]bool{}
-	for _, item := range gotFacts.PublicContent {
-		factRules[item.Rule] = true
-	}
-	for _, want := range []string{
-		"public_content_generic_credential",
-		"public_content_change_id_trailer",
-		"public_content_semantic_candidate",
-	} {
-		if !factRules[want] {
-			t.Fatalf("missing public content fact %s: %#v", want, gotFacts.PublicContent)
-		}
-	}
-	if len(gotFacts.PublicContent) < 3 {
-		t.Fatalf("public content facts = %#v", gotFacts.PublicContent)
-	}
-}
-
 func TestLoadBaseReferenceManifestReadsCommandGolden(t *testing.T) {
 	repo := t.TempDir()
 	runGit(t, repo, "init")
@@ -599,7 +506,7 @@ func TestNormalizeDiagnosticFileHandlesAbsoluteRepo(t *testing.T) {

 func runGit(t *testing.T, repo string, args ...string) {
 	t.Helper()
-	cmd := exec.Command("git", append([]string{"-c", "core.hooksPath=/dev/null", "-C", repo}, args...)...)
+	cmd := exec.Command("git", append([]string{"-C", repo}, args...)...)
 	cmd.Env = append(os.Environ(), "GIT_AUTHOR_DATE=2026-06-17T00:00:00Z", "GIT_COMMITTER_DATE=2026-06-17T00:00:00Z")
 	out, err := cmd.CombinedOutput()
 	if err != nil {
--- a/internal/qualitygate/semantic/client.go
+++ b/internal/qualitygate/semantic/client.go
@@ -339,7 +339,7 @@ func jsonSchemaResponseFormat() map[string]any {
 							"properties": map[string]any{
 								"category": map[string]any{
 									"type": "string",
-									"enum": []string{"error_hint", "default_output", "naming", "skill_quality", "public_content_leakage"},
+									"enum": []string{"error_hint", "default_output", "naming", "skill_quality"},
 								},
 								"severity": map[string]any{
 									"type": "string",
--- a/internal/qualitygate/semantic/gatekeeper.go
+++ b/internal/qualitygate/semantic/gatekeeper.go
@@ -10,10 +10,9 @@ import (
 	"strings"

 	"github.com/larksuite/cli/internal/qualitygate/facts"
-	"github.com/larksuite/cli/internal/qualitygate/report"
 )

-var evidencePattern = regexp.MustCompile(`^facts\.(commands|skills|errors|outputs|public_content)\[(\d+)\]$`)
+var evidencePattern = regexp.MustCompile(`^facts\.(commands|skills|errors|outputs)\[(\d+)\]$`)

 func Decide(f facts.Facts, r Review, p Policy) Decision {
 	return DecideWithWaivers(f, r, p, Waivers{})
@@ -173,16 +172,6 @@ func evidenceFingerprint(f facts.Facts, ev string) string {
 			"has_default_limit:" + strconv.FormatBool(out.HasDefaultLimit),
 			"has_decision_field:" + strconv.FormatBool(out.HasDecisionField),
 		}, ":")
-	case "public_content":
-		item := f.PublicContent[idx]
-		return strings.Join([]string{
-			"public_content",
-			"rule:" + item.Rule,
-			"action:" + string(item.Action),
-			"file:" + item.File,
-			"line:" + strconv.Itoa(item.Line),
-			"source:" + item.Source,
-		}, ":")
 	default:
 		return "ref:" + ev
 	}
@@ -212,7 +201,7 @@ func validFinding(f Finding) bool {

 func allowedCategory(category string) bool {
 	switch category {
-	case "error_hint", "default_output", "naming", "skill_quality", "public_content_leakage":
+	case "error_hint", "default_output", "naming", "skill_quality":
 		return true
 	default:
 		return false
@@ -258,12 +247,6 @@ func reproducibleEvidence(f facts.Facts, category, kind string, idx int) bool {
 		}
 		skill := f.Skills[idx]
 		return skill.ReferencesInvalidCommand
-	case "public_content_leakage":
-		if kind != "public_content" {
-			return false
-		}
-		item := f.PublicContent[idx]
-		return item.Action == report.ActionReject || item.Rule == "public_content_semantic_candidate"
 	default:
 		return false
 	}
@@ -294,8 +277,6 @@ func evidenceExists(f facts.Facts, kind string, idx int) bool {
 		return idx < len(f.Errors)
 	case "outputs":
 		return idx < len(f.Outputs)
-	case "public_content":
-		return idx < len(f.PublicContent)
 	default:
 		return false
 	}
--- a/internal/qualitygate/semantic/gatekeeper_test.go
+++ b/internal/qualitygate/semantic/gatekeeper_test.go
@@ -242,7 +242,6 @@ func TestGatekeeperBlockerMatrix(t *testing.T) {
 		Outputs:       []facts.OutputFact{{Command: "im messages list", IsList: true, HasDefaultLimit: false, HasDecisionField: false}},
 		Commands:      []facts.CommandFact{{Path: "docs fetch", NameConflictsExisting: true}},
 		Skills:        []facts.SkillFact{{SourceFile: "skills/lark-doc/SKILL.md", Line: 3, ReferencesInvalidCommand: true}},
-		PublicContent: []facts.PublicContentFact{{Rule: "public_content_generic_credential", Action: "REJECT", File: "docs/public.md", Line: 4, Source: "metadata"}},
 	}
 	for _, tc := range []struct {
 		category string
@@ -252,7 +251,6 @@ func TestGatekeeperBlockerMatrix(t *testing.T) {
 		{"default_output", "facts.outputs[0]"},
 		{"naming", "facts.commands[0]"},
 		{"skill_quality", "facts.skills[0]"},
-		{"public_content_leakage", "facts.public_content[0]"},
 	} {
 		t.Run(tc.category, func(t *testing.T) {
 			r := Review{Findings: []Finding{{
@@ -270,59 +268,6 @@ func TestGatekeeperBlockerMatrix(t *testing.T) {
 	}
 }

-func TestGatekeeperDoesNotPromotePublicContentWarningsToBlockers(t *testing.T) {
-	f := facts.Facts{
-		SchemaVersion: 1,
-		PublicContent: []facts.PublicContentFact{{
-			Rule:   "public_content_" + "pri" + "vate_ipv4",
-			Action: "WARNING",
-			File:   "docs/network.md",
-			Line:   1,
-			Source: "file",
-		}},
-	}
-	review := Review{Findings: []Finding{{
-		Category:        "public_content_leakage",
-		Severity:        "minor",
-		Evidence:        []string{"facts.public_content[0]"},
-		Message:         "pri" + "vate network address appears in public docs",
-		SuggestedAction: "confirm the public docs do not expose pri" + "vate deployment details",
-	}}}
-
-	got := Decide(f, review, DefaultPolicy())
-	if len(got.Blockers) != 0 || len(got.Warnings) != 1 {
-		t.Fatalf("public content warning should not become a blocker: %#v", got)
-	}
-	if got.Warnings[0].ReviewAction != ReviewActionObserve {
-		t.Fatalf("review action = %q, want %q", got.Warnings[0].ReviewAction, ReviewActionObserve)
-	}
-}
-
-func TestGatekeeperAllowsPublicContentSemanticCandidatesAsBlockers(t *testing.T) {
-	f := facts.Facts{
-		SchemaVersion: 1,
-		PublicContent: []facts.PublicContentFact{{
-			Rule:   "public_content_semantic_candidate",
-			Action: "WARNING",
-			File:   "docs/public.md",
-			Line:   1,
-			Source: "file",
-		}},
-	}
-	review := Review{Findings: []Finding{{
-		Category:        "public_content_leakage",
-		Severity:        "major",
-		Evidence:        []string{"facts.public_content[0]"},
-		Message:         "semantic review found pri" + "vate rollout detail",
-		SuggestedAction: "remove pri" + "vate rollout detail from public docs",
-	}}}
-
-	got := Decide(f, review, DefaultPolicy())
-	if len(got.Blockers) != 1 {
-		t.Fatalf("semantic candidate should remain blockable, got %#v", got)
-	}
-}
-
 func TestGatekeeperSkillQualityOnlyBlocksInvalidCommandReferences(t *testing.T) {
 	f := facts.Facts{
 		SchemaVersion: 1,
--- a/internal/qualitygate/semantic/prompt.go
+++ b/internal/qualitygate/semantic/prompt.go
@@ -24,7 +24,7 @@ func BuildPrompt(f facts.Facts) []Message {
 			"Use only the provided JSON view.",
 			"The changed_summary may summarize broad changed surfaces; review only listed facts, not omitted summarized items.",
 			"Use fact_ref values exactly when writing finding evidence.",
-			"Only facts.commands, facts.skills, facts.errors, facts.outputs, and facts.public_content fact_ref values may be blocker evidence.",
+			"Only facts.commands, facts.skills, facts.errors, and facts.outputs fact_ref values may be blocker evidence.",
 			"Evidence entries must be exact fact_ref strings such as \"facts.commands[0]\" with no explanations, labels, or suffix text.",
 			"facts.examples and facts.skill_quality entries are context only.",
 			"Report an error_hint finding for any facts.errors item where boundary is true, required_hint is true, and hint_action_count is 0.",
@@ -38,9 +38,6 @@ func BuildPrompt(f facts.Facts) []Message {
 			"For naming findings, use category \"naming\" and evidence containing that facts.commands fact_ref.",
 			"Report a skill_quality finding for any facts.skills item where references_invalid_command is true.",
 			"For skill_quality findings, use category \"skill_quality\" and evidence containing that facts.skills fact_ref.",
-			"Review public content leakage findings and semantic candidates without private dictionaries.",
-			"Do not reveal internal rule lists when explaining public content leakage.",
-			"For public_content_leakage findings, preserve the deterministic finding source and excerpt.",
 			"Report each distinct issue as a separate finding.",
 			"The verdict value must be \"pass\" when findings is empty and \"warn\" when findings is non-empty; never use \"fail\".",
 			"Severity must be one of \"minor\", \"major\", or \"critical\"; never use \"error\", \"warning\", \"medium\", or \"high\".",
--- a/internal/qualitygate/semantic/prompt_contract_test.go
+++ b/internal/qualitygate/semantic/prompt_contract_test.go
@@ -23,10 +23,7 @@ func TestBuildPromptContainsSemanticReviewContract(t *testing.T) {
 		"A facts.outputs item with is_list true, has_default_limit false, and has_decision_field true must still produce a default_output finding.",
 		"Report a naming finding for any facts.commands item where name_conflicts_existing is true or flag_alias_conflict is true.",
 		"Report a skill_quality finding for any facts.skills item where references_invalid_command is true.",
-		"Review public content leakage findings and semantic candidates without private dictionaries.",
-		"Do not reveal internal rule lists when explaining public content leakage.",
-		"For public_content_leakage findings, preserve the deterministic finding source and excerpt.",
-		"Only facts.commands, facts.skills, facts.errors, facts.outputs, and facts.public_content fact_ref values may be blocker evidence.",
+		"Only facts.commands, facts.skills, facts.errors, and facts.outputs fact_ref values may be blocker evidence.",
 		"Evidence entries must be exact fact_ref strings such as \"facts.commands[0]\" with no explanations, labels, or suffix text.",
 		"facts.examples and facts.skill_quality entries are context only.",
 		"Report each distinct issue as a separate finding.",
--- a/internal/qualitygate/semantic/schema.go
+++ b/internal/qualitygate/semantic/schema.go
@@ -78,11 +78,11 @@ func DefaultPolicy() Policy {
 	return Policy{
 		SchemaVersion:      1,
 		DefaultEnforcement: "observe",
-		BlockCategories:    []string{"error_hint", "default_output", "naming", "skill_quality", "public_content_leakage"},
+		BlockCategories:    []string{"error_hint", "default_output", "naming", "skill_quality"},
 		RolloutGroups: []RolloutGroup{{
 			ID:          "all",
 			Enforcement: "blocking",
-			Categories:  []string{"error_hint", "default_output", "naming", "skill_quality", "public_content_leakage"},
+			Categories:  []string{"error_hint", "default_output", "naming", "skill_quality"},
 			Owner:       "test",
 			Reason:      "default in-memory policy",
 		}},
--- a/internal/qualitygate/semantic/scope.go
+++ b/internal/qualitygate/semantic/scope.go
@@ -82,15 +82,6 @@ func factScope(f facts.Facts, kind string, idx int) (FactScope, bool) {
 			Source:      item.Source,
 			CommandPath: item.Command,
 		}, true
-	case "public_content":
-		item := f.PublicContent[idx]
-		return FactScope{
-			FactKind:   "public_content",
-			Changed:    true,
-			Source:     item.Source,
-			SourceFile: item.File,
-			Line:       item.Line,
-		}, true
 	default:
 		return FactScope{}, false
 	}
@@ -204,7 +195,7 @@ func containsString(values []string, want string) bool {

 func allowedFactKind(kind string) bool {
 	switch kind {
-	case "skill", "command", "error", "output", "public_content":
+	case "skill", "command", "error", "output":
 		return true
 	default:
 		return false
--- a/internal/qualitygate/semantic/scope_test.go
+++ b/internal/qualitygate/semantic/scope_test.go
@@ -81,30 +81,6 @@ func TestGatekeeperSkillQualityUsesSkillEvidence(t *testing.T) {
 	}
 }

-func TestGatekeeperUsesPublicContentEvidence(t *testing.T) {
-	f := facts.Facts{
-		SchemaVersion: 1,
-		PublicContent: []facts.PublicContentFact{{
-			Rule:   "public_content_generic_credential",
-			Action: "REJECT",
-			File:   "docs/public.md",
-			Line:   12,
-			Source: "metadata",
-		}},
-	}
-	review := Review{Findings: []Finding{{
-		Category:        "public_content_leakage",
-		Severity:        "critical",
-		Evidence:        []string{"facts.public_content[0]"},
-		Message:         "public content finding needs review",
-		SuggestedAction: "remove the sensitive public content",
-	}}}
-	got := Decide(f, review, DefaultPolicy())
-	if len(got.Blockers) != 1 || got.Blockers[0].RolloutGroups[0] != "all" {
-		t.Fatalf("expected public content blocker, got %#v", got)
-	}
-}
-
 func TestGatekeeperAppliesSharedWaiverID(t *testing.T) {
 	f := facts.Facts{
 		SchemaVersion: 1,
--- a/internal/qualitygate/semantic/view.go
+++ b/internal/qualitygate/semantic/view.go
@@ -13,29 +13,27 @@ import (
 )

 type InputView struct {
-	SchemaVersion        int                    `json:"schema_version"`
-	ChangedSummary       ChangedSummary         `json:"changed_summary"`
-	RuleSummary          []RuleSummaryItem      `json:"rule_summary,omitempty"`
-	Commands             []CommandInput         `json:"commands,omitempty"`
-	Skills               []SkillInput           `json:"skills,omitempty"`
-	SkillQuality         []SkillQualityInput    `json:"skill_quality,omitempty"`
-	Errors               []ErrorInput           `json:"errors,omitempty"`
-	Outputs              []OutputInput          `json:"outputs,omitempty"`
-	Examples             []ExampleInput         `json:"examples,omitempty"`
-	PublicContentLeakage []PublicContentInput   `json:"public_content_leakage,omitempty"`
-	Diagnostics          []facts.DiagnosticFact `json:"diagnostics,omitempty"`
+	SchemaVersion  int                    `json:"schema_version"`
+	ChangedSummary ChangedSummary         `json:"changed_summary"`
+	RuleSummary    []RuleSummaryItem      `json:"rule_summary,omitempty"`
+	Commands       []CommandInput         `json:"commands,omitempty"`
+	Skills         []SkillInput           `json:"skills,omitempty"`
+	SkillQuality   []SkillQualityInput    `json:"skill_quality,omitempty"`
+	Errors         []ErrorInput           `json:"errors,omitempty"`
+	Outputs        []OutputInput          `json:"outputs,omitempty"`
+	Examples       []ExampleInput         `json:"examples,omitempty"`
+	Diagnostics    []facts.DiagnosticFact `json:"diagnostics,omitempty"`
 }

 type ChangedSummary struct {
-	Commands      int      `json:"commands,omitempty"`
-	Skills        int      `json:"skills,omitempty"`
-	SkillQuality  int      `json:"skill_quality,omitempty"`
-	Errors        int      `json:"errors,omitempty"`
-	Outputs       int      `json:"outputs,omitempty"`
-	Examples      int      `json:"examples,omitempty"`
-	PublicContent int      `json:"public_content,omitempty"`
-	Domains       []string `json:"domains,omitempty"`
-	Sources       []string `json:"sources,omitempty"`
+	Commands     int      `json:"commands,omitempty"`
+	Skills       int      `json:"skills,omitempty"`
+	SkillQuality int      `json:"skill_quality,omitempty"`
+	Errors       int      `json:"errors,omitempty"`
+	Outputs      int      `json:"outputs,omitempty"`
+	Examples     int      `json:"examples,omitempty"`
+	Domains      []string `json:"domains,omitempty"`
+	Sources      []string `json:"sources,omitempty"`
 }

 type RuleSummaryItem struct {
@@ -88,22 +86,6 @@ type ExampleInput struct {
 	facts.CommandExample
 }

-type PublicContentInput struct {
-	FactRef string `json:"fact_ref"`
-	facts.PublicContentFact
-}
-
-func (v InputView) HasReviewableFacts() bool {
-	return len(v.Commands) > 0 ||
-		len(v.Skills) > 0 ||
-		len(v.SkillQuality) > 0 ||
-		len(v.Errors) > 0 ||
-		len(v.Outputs) > 0 ||
-		len(v.Examples) > 0 ||
-		len(v.PublicContentLeakage) > 0 ||
-		len(v.Diagnostics) > 0
-}
-
 func BuildInputView(f facts.Facts) InputView {
 	selected := newInputSelection(f)
 	selected.addChangedReviewCandidates()
@@ -122,17 +104,16 @@ func BuildInputView(f facts.Facts) InputView {
 	}

 	return InputView{
-		SchemaVersion:        f.SchemaVersion,
-		ChangedSummary:       changedSummary(f),
-		RuleSummary:          ruleSummary(f.Diagnostics),
-		Commands:             selected.commandInputs(),
-		Skills:               selected.skillInputs(),
-		SkillQuality:         selected.skillQualityInputs(),
-		Errors:               selected.errorInputs(),
-		Outputs:              selected.outputInputs(),
-		Examples:             selected.exampleInputs(),
-		PublicContentLeakage: selected.publicContentInputs(),
-		Diagnostics:          viewDiagnostics,
+		SchemaVersion:  f.SchemaVersion,
+		ChangedSummary: changedSummary(f),
+		RuleSummary:    ruleSummary(f.Diagnostics),
+		Commands:       selected.commandInputs(),
+		Skills:         selected.skillInputs(),
+		SkillQuality:   selected.skillQualityInputs(),
+		Errors:         selected.errorInputs(),
+		Outputs:        selected.outputInputs(),
+		Examples:       selected.exampleInputs(),
+		Diagnostics:    viewDiagnostics,
 	}
 }

@@ -157,11 +138,6 @@ func (s *inputSelection) addChangedReviewCandidates() {
 			s.outputs[i] = true
 		}
 	}
-	for i, item := range s.f.PublicContent {
-		if publicContentReviewCandidate(item) {
-			s.publicContent[i] = true
-		}
-	}
 }

 func commandReviewCandidate(cmd facts.CommandFact) bool {
@@ -181,31 +157,25 @@ func outputReviewCandidate(_ facts.OutputFact) bool {
 	return false
 }

-func publicContentReviewCandidate(item facts.PublicContentFact) bool {
-	return item.Rule == "public_content_semantic_candidate"
-}
-
 type inputSelection struct {
-	f             facts.Facts
-	commands      []bool
-	skills        []bool
-	skillQuality  []bool
-	errors        []bool
-	outputs       []bool
-	examples      []bool
-	publicContent []bool
+	f            facts.Facts
+	commands     []bool
+	skills       []bool
+	skillQuality []bool
+	errors       []bool
+	outputs      []bool
+	examples     []bool
 }

 func newInputSelection(f facts.Facts) *inputSelection {
 	return &inputSelection{
-		f:             f,
-		commands:      make([]bool, len(f.Commands)),
-		skills:        make([]bool, len(f.Skills)),
-		skillQuality:  make([]bool, len(f.SkillQuality)),
-		errors:        make([]bool, len(f.Errors)),
-		outputs:       make([]bool, len(f.Outputs)),
-		examples:      make([]bool, len(f.Examples)),
-		publicContent: make([]bool, len(f.PublicContent)),
+		f:            f,
+		commands:     make([]bool, len(f.Commands)),
+		skills:       make([]bool, len(f.Skills)),
+		skillQuality: make([]bool, len(f.SkillQuality)),
+		errors:       make([]bool, len(f.Errors)),
+		outputs:      make([]bool, len(f.Outputs)),
+		examples:     make([]bool, len(f.Examples)),
 	}
 }

@@ -224,8 +194,6 @@ func (s *inputSelection) diagnosticContext(diag facts.DiagnosticFact) *inputSele
 		s.addDiagnosticExamples(out, diag)
 	case diag.Rule == "no_bare_helper_error":
 		s.addDiagnosticErrors(out, diag)
-	case strings.HasPrefix(diag.Rule, "public_content_"):
-		s.addDiagnosticPublicContent(out, diag)
 	}
 	return out
 }
@@ -288,15 +256,6 @@ func (s *inputSelection) addDiagnosticExamples(out *inputSelection, diag facts.D
 	}
 }

-func (s *inputSelection) addDiagnosticPublicContent(out *inputSelection, diag facts.DiagnosticFact) {
-	for i, item := range s.f.PublicContent {
-		if diagnosticLocationMatches(diag.File, diag.Line, item.File, item.Line) ||
-			diag.Rule == item.Rule {
-			out.publicContent[i] = true
-		}
-	}
-}
-
 func includeDiagnosticInView(diag facts.DiagnosticFact, selected, context *inputSelection) bool {
 	if diag.Action == report.ActionReject {
 		return true
@@ -311,7 +270,6 @@ func (s *inputSelection) merge(other *inputSelection) {
 	mergeSelections(s.errors, other.errors)
 	mergeSelections(s.outputs, other.outputs)
 	mergeSelections(s.examples, other.examples)
-	mergeSelections(s.publicContent, other.publicContent)
 }

 func (s *inputSelection) intersects(other *inputSelection) bool {
@@ -320,8 +278,7 @@ func (s *inputSelection) intersects(other *inputSelection) bool {
 		selectionsIntersect(s.skillQuality, other.skillQuality) ||
 		selectionsIntersect(s.errors, other.errors) ||
 		selectionsIntersect(s.outputs, other.outputs) ||
-		selectionsIntersect(s.examples, other.examples) ||
-		selectionsIntersect(s.publicContent, other.publicContent)
+		selectionsIntersect(s.examples, other.examples)
 }

 func (s *inputSelection) commandInputs() []CommandInput {
@@ -394,16 +351,6 @@ func (s *inputSelection) exampleInputs() []ExampleInput {
 	return out
 }

-func (s *inputSelection) publicContentInputs() []PublicContentInput {
-	out := make([]PublicContentInput, 0, countSelected(s.publicContent))
-	for i, ok := range s.publicContent {
-		if ok {
-			out = append(out, PublicContentInput{FactRef: factRef("public_content", i), PublicContentFact: s.f.PublicContent[i]})
-		}
-	}
-	return out
-}
-
 func changedSummary(f facts.Facts) ChangedSummary {
 	domains := map[string]bool{}
 	sources := map[string]bool{}
@@ -455,10 +402,6 @@ func changedSummary(f facts.Facts) ChangedSummary {
 		addNonEmpty(domains, example.Domain)
 		addNonEmpty(sources, example.Source)
 	}
-	for _, item := range f.PublicContent {
-		out.PublicContent++
-		addNonEmpty(sources, item.Source)
-	}
 	out.Domains = sortedViewSetKeys(domains)
 	out.Sources = sortedViewSetKeys(sources)
 	return out
@@ -491,8 +434,7 @@ func semanticDiagnosticRule(rule string) bool {
 		strings.HasPrefix(rule, "default_output") ||
 		strings.HasPrefix(rule, "skill_") ||
 		strings.HasPrefix(rule, "example_dry_run") ||
-		rule == "no_bare_helper_error" ||
-		strings.HasPrefix(rule, "public_content_")
+		rule == "no_bare_helper_error"
 }

 func diagnosticCommandMatches(diag facts.DiagnosticFact, values ...string) bool {
--- a/internal/qualitygate/semantic/view_test.go
+++ b/internal/qualitygate/semantic/view_test.go
@@ -77,122 +77,6 @@ func TestInputViewKeepsChangedReviewCandidatesWithOriginalRefs(t *testing.T) {
 	}
 }

-func TestInputViewIncludesPublicContentLeakage(t *testing.T) {
-	f := facts.Facts{
-		SchemaVersion: 1,
-		PublicContent: []facts.PublicContentFact{{
-			Rule:    "public_content_generic_credential",
-			Action:  report.ActionReject,
-			File:    "docs/public.md",
-			Line:    4,
-			Excerpt: "api_key = <redacted>",
-			Message: "generic credential assignment",
-		}},
-		Diagnostics: []facts.DiagnosticFact{{
-			Rule:    "public_content_generic_credential",
-			Action:  report.ActionReject,
-			File:    "docs/public.md",
-			Line:    4,
-			Message: "generic credential assignment",
-		}},
-	}
-
-	view := BuildInputView(f)
-	if len(view.PublicContentLeakage) != 1 {
-		t.Fatalf("public content leakage len = %d, want 1", len(view.PublicContentLeakage))
-	}
-	if got := view.PublicContentLeakage[0].FactRef; got != "facts.public_content[0]" {
-		t.Fatalf("public content fact ref = %q", got)
-	}
-	if len(view.Diagnostics) != 1 {
-		t.Fatalf("diagnostics len = %d, want 1", len(view.Diagnostics))
-	}
-}
-
-func TestInputViewIncludesPublicContentSemanticCandidatesWithoutDiagnostics(t *testing.T) {
-	f := facts.Facts{
-		SchemaVersion: 1,
-		PublicContent: []facts.PublicContentFact{{
-			Rule:    "public_content_semantic_candidate",
-			Action:  report.ActionWarning,
-			File:    "docs/public.md",
-			Line:    1,
-			Source:  "file",
-			Excerpt: "public prose that needs semantic review",
-			Message: "public contribution contains text for semantic public content review",
-		}},
-	}
-
-	view := BuildInputView(f)
-	if len(view.PublicContentLeakage) != 1 {
-		t.Fatalf("semantic candidate len = %d, want 1", len(view.PublicContentLeakage))
-	}
-	if got := view.PublicContentLeakage[0].FactRef; got != "facts.public_content[0]" {
-		t.Fatalf("semantic candidate fact ref = %q", got)
-	}
-	if len(view.Diagnostics) != 0 {
-		t.Fatalf("semantic candidate should not require diagnostics, got %#v", view.Diagnostics)
-	}
-}
-
-func TestPromptIncludesSanitizedPublicContentExcerpt(t *testing.T) {
-	scopeText := "pri" + "vate rollout"
-	f := facts.Facts{
-		SchemaVersion: 1,
-		PublicContent: []facts.PublicContentFact{{
-			Rule:    "public_content_semantic_candidate",
-			Action:  report.ActionWarning,
-			File:    "docs/public.md",
-			Line:    1,
-			Source:  "file",
-			Excerpt: `semantic signals: pri` + `vate_scope,roadmap_detail; excerpt: "` + scopeText + ` token=<redacted>"`,
-			Message: "public contribution contains text for semantic public content review",
-		}},
-	}
-
-	view := BuildInputView(f)
-	if len(view.PublicContentLeakage) != 1 {
-		t.Fatalf("semantic candidate len = %d, want 1", len(view.PublicContentLeakage))
-	}
-	if got := view.PublicContentLeakage[0].Excerpt; !strings.Contains(got, scopeText) || !strings.Contains(got, "token=<redacted>") {
-		t.Fatalf("semantic candidate excerpt missing from view: %q", got)
-	}
-
-	messages := BuildPrompt(f)
-	if len(messages) != 2 {
-		t.Fatalf("messages len = %d, want 2", len(messages))
-	}
-	if !strings.Contains(messages[1].Content, scopeText) || !strings.Contains(messages[1].Content, "redacted") {
-		t.Fatalf("prompt missing sanitized public content excerpt: %s", messages[1].Content)
-	}
-	if strings.Contains(messages[1].Content, "real-"+"secret-value") {
-		t.Fatalf("prompt leaked raw sensitive value %q", messages[1].Content)
-	}
-}
-
-func TestInputViewExcludesPublicContentWarningsWithoutSemanticCandidate(t *testing.T) {
-	f := facts.Facts{
-		SchemaVersion: 1,
-		PublicContent: []facts.PublicContentFact{{
-			Rule:    "public_content_" + "pri" + "vate_ipv4",
-			Action:  report.ActionWarning,
-			File:    "docs/network.md",
-			Line:    1,
-			Source:  "file",
-			Excerpt: "192.168." + "0.10",
-			Message: "public contribution contains a pri" + "vate-network IP address",
-		}},
-	}
-
-	view := BuildInputView(f)
-	if len(view.PublicContentLeakage) != 0 {
-		t.Fatalf("warning-only public content should not enter semantic view: %#v", view.PublicContentLeakage)
-	}
-	if len(view.Diagnostics) != 0 {
-		t.Fatalf("warning-only public content should not add diagnostics: %#v", view.Diagnostics)
-	}
-}
-
 func TestInputViewSummarizesBroadChangedCommandSurface(t *testing.T) {
 	f := broadChangedFacts(434, 44)

--- a/internal/qualitygate/semantic/waiver.go
+++ b/internal/qualitygate/semantic/waiver.go
@@ -138,10 +138,6 @@ func parseWaiver(parts []string, lineNo int) (Waiver, error) {
 		if item.SourceFile == "" || item.Line == 0 {
 			return Waiver{}, fmt.Errorf("%s:%d: %s waiver requires source_file and line", waiverPath, lineNo, item.FactKind)
 		}
-	case "public_content":
-		if item.SourceFile == "" || item.Line == 0 || item.CommandPath != "" {
-			return Waiver{}, fmt.Errorf("%s:%d: public_content waiver requires source_file and line only", waiverPath, lineNo)
-		}
 	case "command", "output":
 		if item.CommandPath == "" {
 			return Waiver{}, fmt.Errorf("%s:%d: %s waiver requires command_path", waiverPath, lineNo, item.FactKind)
--- a/internal/qualitygate/semantic/waiver_test.go
+++ b/internal/qualitygate/semantic/waiver_test.go
@@ -21,27 +21,24 @@ func TestLoadWaivers(t *testing.T) {

 	writeSemanticFile(t, repo, "waivers.txt", "# waiver_id\tcategory\tfact_kind\tsource_file\tline\tcommand_path\towner\treason\tadded_at\texpires_at\n"+
 		"wiki-move-202606\tskill_quality\tskill\tskills/lark-wiki/SKILL.md\t30\t\twiki-owner\tmigration\t2026-06-08\t2026-07-15\n"+
-		"wiki-move-202606\tskill_quality\tskill\tskills/lark-wiki/references/move.md\t12\t\twiki-owner\tmigration\t2026-06-08\t2026-07-15\n"+
-		"public-doc-202606\tpublic_content_leakage\tpublic_content\tdocs/public.md\t4\t\tsecurity-owner\treviewed false positive\t2026-06-08\t2026-07-15\n")
+		"wiki-move-202606\tskill_quality\tskill\tskills/lark-wiki/references/move.md\t12\t\twiki-owner\tmigration\t2026-06-08\t2026-07-15\n")
 	w, diags, err = LoadWaivers(repo, now)
 	if err != nil {
 		t.Fatalf("LoadWaivers() error = %v", err)
 	}
-	if len(diags) != 0 || len(w.Items) != 3 {
+	if len(diags) != 0 || len(w.Items) != 2 {
 		t.Fatalf("LoadWaivers() = %#v %#v", w, diags)
 	}

 	for name, body := range map[string]string{
-		"bad columns":                     "one\ttoo-few\n",
-		"bad id":                          "BAD\terror_hint\terror\tcmd/root.go\t1\t\to\tr\t2026-06-08\t2026-07-15\n",
-		"bad fact kind":                   "id1\terror_hint\tskill_quality\tcmd/root.go\t1\t\to\tr\t2026-06-08\t2026-07-15\n",
-		"missing owner":                   "id1\terror_hint\terror\tcmd/root.go\t1\t\t\tr\t2026-06-08\t2026-07-15\n",
-		"missing line":                    "id1\terror_hint\terror\tcmd/root.go\t\t\to\tr\t2026-06-08\t2026-07-15\n",
-		"missing command":                 "id1\tdefault_output\toutput\t\t\t\to\tr\t2026-06-08\t2026-07-15\n",
-		"public content missing line":     "id1\tpublic_content_leakage\tpublic_content\tdocs/public.md\t\t\to\tr\t2026-06-08\t2026-07-15\n",
-		"public content command selector": "id1\tpublic_content_leakage\tpublic_content\t\t\tcmd/foo\to\tr\t2026-06-08\t2026-07-15\n",
-		"bad source path":                 "id1\terror_hint\terror\t../cmd/root.go\t1\t\to\tr\t2026-06-08\t2026-07-15\n",
-		"bad date format":                 "id1\terror_hint\terror\tcmd/root.go\t1\t\to\tr\t20260608\t2026-07-15\n",
+		"bad columns":     "one\ttoo-few\n",
+		"bad id":          "BAD\terror_hint\terror\tcmd/root.go\t1\t\to\tr\t2026-06-08\t2026-07-15\n",
+		"bad fact kind":   "id1\terror_hint\tskill_quality\tcmd/root.go\t1\t\to\tr\t2026-06-08\t2026-07-15\n",
+		"missing owner":   "id1\terror_hint\terror\tcmd/root.go\t1\t\t\tr\t2026-06-08\t2026-07-15\n",
+		"missing line":    "id1\terror_hint\terror\tcmd/root.go\t\t\to\tr\t2026-06-08\t2026-07-15\n",
+		"missing command": "id1\tdefault_output\toutput\t\t\t\to\tr\t2026-06-08\t2026-07-15\n",
+		"bad source path": "id1\terror_hint\terror\t../cmd/root.go\t1\t\to\tr\t2026-06-08\t2026-07-15\n",
+		"bad date format": "id1\terror_hint\terror\tcmd/root.go\t1\t\to\tr\t20260608\t2026-07-15\n",
 	} {
 		t.Run(name, func(t *testing.T) {
 			writeSemanticFile(t, repo, "waivers.txt", body)
--- a/internal/registry/scope_priorities.json
+++ b/internal/registry/scope_priorities.json
@@ -5609,21 +5609,6 @@
    "final_score": "80.0587",
    "recommend": "false"
  },
-  {
-    "scope_name": "im:chat.nickname:read",
-    "final_score": "88.0587",
-    "recommend": "true"
-  },
-  {
-    "scope_name": "im:chat.nickname:write",
-    "final_score": "79.5982",
-    "recommend": "true"
-  },
-  {
-    "scope_name": "im:chat.user_setting:write",
-    "final_score": "83.6587",
-    "recommend": "true"
-  },
  {
    "scope_name": "im:chat.user_setting:read",
    "final_score": "88.0587",
--- a/internal/schema/assembler.go
+++ b/internal/schema/assembler.go
@@ -4,11 +4,8 @@
 package schema

 import (
-	"regexp"
 	"sort"
-	"strings"

-	"github.com/larksuite/cli/internal/affordance"
 	"github.com/larksuite/cli/internal/apicatalog"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/meta"
@@ -25,7 +22,7 @@ func Convert(f meta.Field) Property {
 	if f.Type == "file" {
 		p.Format = "binary"
 	}
-	p.Description = normalizeDesc(f.Description)
+	p.Description = f.Description
 	p.Default = f.CoercedDefault()
 	p.Example = f.CoercedExample()
 	p.Minimum = f.MinBound()
@@ -55,24 +52,6 @@ func Convert(f meta.Field) Property {
 	return p
 }

-var (
-	sepRunRe   = regexp.MustCompile(`[;；]{2,}`)
-	spaceRunRe = regexp.MustCompile(`[ \t]{2,}`)
-)
-
-// normalizeDesc de-crufts a meta_data description for the envelope — strips
-// markdown emphasis and collapses doubled separators/spaces — but keeps content
-// (links, newlines, sentences); the compact flag-help has its own stricter pass.
-func normalizeDesc(s string) string {
-	if s == "" {
-		return ""
-	}
-	s = strings.ReplaceAll(s, "**", "")
-	s = sepRunRe.ReplaceAllString(s, "; ")
-	s = spaceRunRe.ReplaceAllString(s, " ")
-	return strings.TrimRight(s, " ;；。.，,、\n")
-}
-
 // enumSchema splits coerced enum options into the parallel enum / enumDescriptions
 // arrays for the envelope. enumDescriptions is nil unless at least one value
 // carries a description (so the bare-enum form stays values-only), keeping the
@@ -107,18 +86,6 @@ func propsOf(fields []meta.Field) *OrderedProps {
 	return op
 }

-// paramPropsOf is propsOf for the params section: each property also carries
-// its CLI flag (--kebab-name).
-func paramPropsOf(fields []meta.Field) *OrderedProps {
-	op := &OrderedProps{}
-	for _, f := range fields {
-		p := Convert(f)
-		p.Flag = "--" + f.FlagName()
-		op.Set(f.Name, p)
-	}
-	return op
-}
-
 // requiredOf returns the alphabetized names of the required fields.
 func requiredOf(fields []meta.Field) []string {
 	var required []string
@@ -141,17 +108,16 @@ func buildInputSchema(m meta.Method) *InputSchema {
 		Properties: &OrderedProps{},
 	}

-	addInputObject(is, "params", "", m.Params(), true, "")
-	addInputObject(is, "data", "", m.Data(), false, "--data")
-	addInputObject(is, "file", "Binary file uploads. Each property is a file field with format:binary; CLI maps each to --file <key>=<path>.", m.Files(), false, "--file")
+	addInputObject(is, "params", "", m.Params())
+	addInputObject(is, "data", "", m.Data())
+	addInputObject(is, "file", "Binary file uploads. Each property is a file field with format:binary; CLI maps each to --file <key>=<path>.", m.Files())

 	if m.Risk == core.RiskHighRiskWrite {
 		falseVal := false
 		is.Properties.Set("yes", Property{
 			Type:        "boolean",
-			Flag:        "--yes",
 			Default:     falseVal,
-			Description: "CLI confirmation gate. Must be true to execute; lark-cli rejects with confirmation_required if absent or false. Pass --yes only after the user has explicitly confirmed; not sent to the backend.",
+			Description: "CLI confirmation gate. Must be true to execute; lark-cli rejects with confirmation_required if absent or false. Not sent to the backend.",
 		})
 	}

@@ -159,24 +125,20 @@ func buildInputSchema(m meta.Method) *InputSchema {
 	return is
 }

-// addInputObject adds one section (params/data/file) when it has fields, marking
-// the section required at top level when any field is. asFlags tags each property
-// with its --flag (params only); carrier names the section's flag (--data/--file).
-func addInputObject(is *InputSchema, name, description string, fields []meta.Field, asFlags bool, carrier string) {
+// addInputObject adds one named sub-object section (params/data/file) to the
+// input schema when it has fields: its Properties come from the fields, its
+// Required lists the mandatory keys, and the section itself is required at top
+// level when any field is required. Empty sections are skipped.
+func addInputObject(is *InputSchema, name, description string, fields []meta.Field) {
 	if len(fields) == 0 {
 		return
 	}
-	props := propsOf(fields)
-	if asFlags {
-		props = paramPropsOf(fields)
-	}
 	req := requiredOf(fields)
 	is.Properties.Set(name, Property{
 		Type:        "object",
 		Description: description,
-		Carrier:     carrier,
 		Required:    req,
-		Properties:  props,
+		Properties:  propsOf(fields),
 	})
 	if len(req) > 0 {
 		is.Required = append(is.Required, name)
@@ -217,13 +179,7 @@ func buildMeta(m meta.Method) *Meta {
 // EnvelopeOf renders the MCP envelope for one method ref — the ref-based entry
 // callers use, since apicatalog.MethodRef is the metadata navigation currency.
 func EnvelopeOf(ref apicatalog.MethodRef) Envelope {
-	m := ref.Method
-	// The affordance overlay lives in the CLI, not the metadata; look it up
-	// lazily here (it takes precedence over any affordance the metadata carries).
-	if raw, ok := affordance.For(ref.Service.Name, m.ID); ok {
-		m.Affordance = raw
-	}
-	return assemble(ref.Service.Name, ref.ResourcePath, m)
+	return assemble(ref.Service.Name, ref.ResourcePath, ref.Method)
 }

 // Envelopes renders the given method refs into envelopes, sorted by name. The
@@ -249,7 +205,7 @@ func assemble(serviceName string, resourcePath []string, m meta.Method) Envelope

 	return Envelope{
 		Name:         name,
-		Description:  normalizeDesc(m.Description),
+		Description:  m.Description,
 		InputSchema:  buildInputSchema(m),
 		OutputSchema: buildOutputSchema(m),
 		Meta:         buildMeta(m),
--- a/internal/schema/assembler_test.go
+++ b/internal/schema/assembler_test.go
@@ -9,9 +9,7 @@ import (
 	"reflect"
 	"strings"
 	"testing"
-	"testing/fstest"

-	"github.com/larksuite/cli/internal/affordance"
 	"github.com/larksuite/cli/internal/apicatalog"
 	"github.com/larksuite/cli/internal/meta"
 	"github.com/larksuite/cli/internal/registry"
@@ -506,31 +504,6 @@ func TestBuildMeta_AffordanceFromMethod(t *testing.T) {
 	}
 }

-// EnvelopeOf injects affordance from the CLI overlay (looked up lazily by
-// service + method id), so a method whose metadata carries none still gets
-// guidance in its envelope when an overlay entry exists.
-func TestEnvelopeOf_AffordanceFromOverlay(t *testing.T) {
-	// The overlay source is the top-level affordance/ tree, injected at startup;
-	// inject a fixture so this unit test does not depend on the shipped content.
-	// Reset afterwards (this binary installs no source by default) for isolation.
-	t.Cleanup(func() { affordance.SetSource(nil) })
-	affordance.SetSource(fstest.MapFS{"approval.md": &fstest.MapFile{Data: []byte(
-		"# approval\n> skill: lark-approval\n\n## instances get\n查询某审批实例的状态与进度。\n\n### Examples\n\n**按 code 查询**\n```bash\nlark-cli approval instances get --instance-code \"x\"\n```\n")}})
-	env := synthEnvelope("approval", []string{"instances"}, meta.Method{ID: "instances.get", Name: "get"})
-	if env.Meta == nil || env.Meta.Affordance == nil {
-		t.Fatal("expected affordance from the approval overlay, got none")
-	}
-	if len(env.Meta.Affordance.UseWhen) == 0 || len(env.Meta.Affordance.Examples) == 0 {
-		t.Errorf("overlay affordance missing use_when/examples: %+v", env.Meta.Affordance)
-	}
-
-	// A method id with no overlay entry carries no affordance.
-	bare := synthEnvelope("approval", []string{"instances"}, meta.Method{ID: "instances.no_such_method", Name: "x"})
-	if bare.Meta != nil && bare.Meta.Affordance != nil {
-		t.Errorf("method without overlay should have no affordance, got %+v", bare.Meta.Affordance)
-	}
-}
-
 func TestBuildMeta_MissingDocURLOmitted(t *testing.T) {
 	method := map[string]interface{}{
 		"scopes":       []interface{}{"x"},
--- a/internal/schema/types.go
+++ b/internal/schema/types.go
@@ -13,10 +13,6 @@ import (
 )

 // Envelope is the MCP Tool spec contract for a single API method command.
-//
-// The REST route (httpMethod/path) is deliberately NOT exposed: every
-// schema-resolvable method already has a typed command, so the raw path would
-// only tempt an agent toward the `api` escape hatch.
 type Envelope struct {
 	Name         string        `json:"name"`
 	Description  string        `json:"description"`
@@ -48,15 +44,9 @@ type OutputSchema struct {
 // "params" / "data" sub-objects inside inputSchema): it lists which keys
 // inside that object's Properties are mandatory. Leaf fields ignore it.
 type Property struct {
-	Type        string `json:"type,omitempty"`
-	Description string `json:"description,omitempty"`
-	// Flag is the typed CLI flag a params property maps to (e.g. "--folder-id");
-	// absent on body/file fields, which travel via the section's Carrier.
-	Flag string `json:"flag,omitempty"`
-	// Carrier names the flag a whole inputSchema section travels on ("--data" /
-	// "--file"); empty on the params section, whose properties carry their Flag.
-	Carrier string        `json:"carrier,omitempty"`
-	Enum    []interface{} `json:"enum,omitempty"`
+	Type        string        `json:"type,omitempty"`
+	Description string        `json:"description,omitempty"`
+	Enum        []interface{} `json:"enum,omitempty"`
 	// EnumDescriptions, when present, is parallel to Enum: the human meaning of
 	// each allowed value, in the same order. Omitted when no value carries a
 	// description. This is the widely-recognized JSON-Schema extension (VS Code,
--- a/internal/transport/warn.go
+++ b/internal/transport/warn.go
@@ -16,14 +16,6 @@ import (
 const (
 	// EnvNoProxy disables automatic proxy support when set to any non-empty value.
 	EnvNoProxy = "LARK_CLI_NO_PROXY"
-
-	// EnvNoProxyWarn suppresses the proxy-detected warning when set to any
-	// non-empty value, while leaving proxy behavior unchanged. Unlike
-	// EnvNoProxy (which both silences the warning AND disables the proxy), this
-	// keeps proxy egress active. It exists so agents consuming --format json can
-	// keep using the proxy without the human-oriented warning line landing in
-	// the output stream and breaking JSON parsing.
-	EnvNoProxyWarn = "LARK_CLI_NO_PROXY_WARN"
 )

 // proxyEnvKeys lists environment variables that Go's ProxyFromEnvironment reads.
@@ -81,11 +73,6 @@ func redactProxyURL(raw string) string {
 // are redacted. Safe to call multiple times; only the first call prints.
 func WarnIfProxied(w io.Writer) {
 	proxyWarningOnce.Do(func() {
-		// Explicit opt-out: silence the warning without touching proxy behavior.
-		// Checked before the plugin and env-proxy branches so it suppresses both.
-		if os.Getenv(EnvNoProxyWarn) != "" {
-			return
-		}
 		// Proxy plugin mode overrides env proxies and LARK_CLI_NO_PROXY (see
 		// Shared), so its warning and disable instructions take precedence.
 		// Emitting the env-proxy warning here would be misleading: it tells the
@@ -101,7 +88,7 @@ func WarnIfProxied(w io.Writer) {
 		if key == "" {
 			return
 		}
-		fmt.Fprintf(w, "[lark-cli] [WARN] proxy detected: %s=%s — requests (including credentials) will transit through this proxy. Set %s=1 to disable proxy, or %s=1 to keep the proxy and silence this warning.\n",
-			key, redactProxyURL(val), EnvNoProxy, EnvNoProxyWarn)
+		fmt.Fprintf(w, "[lark-cli] [WARN] proxy detected: %s=%s — requests (including credentials) will transit through this proxy. Set %s=1 to disable proxy.\n",
+			key, redactProxyURL(val), EnvNoProxy)
 	})
 }
--- a/internal/transport/warn_test.go
+++ b/internal/transport/warn_test.go
@@ -93,47 +93,6 @@ func TestWarnIfProxied_SilentWhenDisabled(t *testing.T) {
 	}
 }

-// TestWarnIfProxied_SilentWhenWarnOptOut verifies that LARK_CLI_NO_PROXY_WARN
-// suppresses the warning while the proxy stays configured (unlike
-// LARK_CLI_NO_PROXY, which also disables the proxy).
-func TestWarnIfProxied_SilentWhenWarnOptOut(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	unsetProxyPluginEnv(t)
-	resetProxyPluginState()
-	proxyWarningOnce = sync.Once{}
-
-	t.Setenv("HTTPS_PROXY", "http://proxy:8080")
-	t.Setenv(EnvNoProxyWarn, "1")
-
-	var buf bytes.Buffer
-	WarnIfProxied(&buf)
-
-	if buf.Len() != 0 {
-		t.Errorf("expected no warning when %s is set, got: %s", EnvNoProxyWarn, buf.String())
-	}
-}
-
-// TestWarnIfProxied_WarnOptOutSuppressesPluginWarning verifies that
-// LARK_CLI_NO_PROXY_WARN also suppresses the proxy-plugin warning.
-func TestWarnIfProxied_WarnOptOutSuppressesPluginWarning(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	unsetProxyPluginEnv(t)
-	proxyWarningOnce = sync.Once{}
-
-	old := proxyPluginStatus
-	proxyPluginStatus = func() (string, string, bool) { return "http://127.0.0.1:3128", "", true }
-	t.Cleanup(func() { proxyPluginStatus = old })
-
-	t.Setenv(EnvNoProxyWarn, "1")
-
-	var buf bytes.Buffer
-	WarnIfProxied(&buf)
-
-	if buf.Len() != 0 {
-		t.Errorf("expected no plugin warning when %s is set, got: %s", EnvNoProxyWarn, buf.String())
-	}
-}
-
 // TestWarnIfProxied_OnlyOnce verifies that proxy warnings are emitted only once.
 func TestWarnIfProxied_OnlyOnce(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@larksuite/cli",
-  "version": "1.0.60",
+  "version": "1.0.57",
  "description": "The official CLI for Lark/Feishu open platform",
  "bin": {
    "lark-cli": "scripts/run.js"
--- a/scripts/ci-quality-summary-publish.js
+++ b/scripts/ci-quality-summary-publish.js
@@ -45,10 +45,6 @@ async function publishTargetStillCurrent(github, context, core, target, phase =
    repo: context.repo.repo,
    pull_number: target.pr,
  });
-  if (pr.state !== "open") {
-    core.notice(`PR quality summary skipped: PR is no longer open before ${phase}`);
-    return false;
-  }
  if (pr.head.sha !== target.headSha) {
    core.notice(`PR quality summary skipped: PR head changed before ${phase}`);
    return false;
--- a/scripts/ci-quality-summary-publish.test.js
+++ b/scripts/ci-quality-summary-publish.test.js
@@ -152,25 +152,6 @@ describe("ci-quality-summary-publish", () => {
    });
  });

-  it("does not publish a summary when the PR closes before comment creation", async () => {
-    await withPublishTempDir(async ({ calls }) => {
-      await publish({
-        github: fakeGithub(calls, {
-          jobs: [{ name: "unit-test", conclusion: "failure", html_url: "https://github.example/jobs/1" }],
-          pullResponses: [
-            currentPullResponse(),
-            currentPullResponse({ state: "closed" }),
-          ],
-        }),
-        context: workflowRunContext({ conclusion: "failure" }),
-        core: silentCore(calls),
-      });
-
-      assert.equal(calls.comments.length, 0);
-      assert.match(calls.notices.join("\n"), /PR is no longer open/);
-    });
-  });
-
  it("does not delete an existing summary when the PR base changes before cleanup", async () => {
    await withPublishTempDir(async ({ calls }) => {
      await publish({
@@ -357,7 +338,6 @@ function fakeGithub(calls, options = {}) {
 function currentPullResponse(overrides = {}) {
  return {
    data: {
-      state: overrides.state || "open",
      head: { sha: overrides.headSha || process.env.CI_QUALITY_SUMMARY_HEAD_SHA },
      base: {
        sha: overrides.baseSha || process.env.CI_QUALITY_SUMMARY_BASE_SHA,
--- a/scripts/ci-workflow.test.sh
+++ b/scripts/ci-workflow.test.sh
@@ -5,42 +5,26 @@
 set -euo pipefail

 workflow=".github/workflows/ci.yml"
-job_section() {
-  local job="$1"
-  awk -v job="$job" '
-    $0 == "  " job ":" { in_job = 1; print; next }
-    in_job && /^  [A-Za-z0-9_-]+:/ { exit }
-    in_job { print }
-  ' "$workflow"
-}
 workflow_permissions="$(awk '
  /^permissions:/ { in_permissions = 1; print; next }
  in_permissions && /^[^[:space:]]/ { exit }
  in_permissions { print }
 ' "$workflow")"
-fast_gate_section="$(job_section fast-gate)"
-unit_test_section="$(job_section unit-test)"
 lint_section="$(awk '
  /^  lint:/ { in_job = 1 }
  in_job { print }
-  /^  script-test:/ { exit }
+  /^  deterministic-gate:/ { exit }
 ' "$workflow")"
-script_test_section="$(job_section script-test)"
 deterministic_section="$(awk '
  /^  deterministic-gate:/ { in_job = 1 }
  in_job { print }
  /^  coverage:/ { exit }
 ' "$workflow")"
-coverage_job_section="$(job_section coverage)"
-deadcode_section="$(job_section deadcode)"
-dry_run_section="$(job_section e2e-dry-run)"
 section="$(awk '
  /^  e2e-live:/ { in_job = 1 }
  in_job { print }
  /^  security:/ { exit }
 ' "$workflow")"
-security_section="$(job_section security)"
-license_header_section="$(job_section license-header)"
 results_section="$(awk '
  /^  results:/ { in_job = 1 }
  in_job { print }
@@ -114,94 +98,13 @@ if ! grep -Fq "make quality-gate" <<<"$deterministic_section"; then
  exit 1
 fi

-if ! grep -Fq "Write public content metadata" <<<"$deterministic_section"; then
-  echo "deterministic-gate should write PR title/body metadata before quality-gate"
-  exit 1
-fi
-
-if ! grep -Fq "types: [opened, synchronize, reopened, edited]" "$workflow"; then
-  echo "CI pull_request trigger should include edited so PR title/body changes are rescanned"
-  exit 1
-fi
-
-if ! grep -Fq "script-test:" <<<"$script_test_section"; then
-  echo "CI should run make script-test so workflow and publisher contract tests are not local-only"
-  exit 1
-fi
-
-if ! grep -Fq "make script-test" <<<"$script_test_section"; then
-  echo "script-test job should invoke make script-test"
-  exit 1
-fi
-
-if ! grep -Fq "actions/setup-node" <<<"$script_test_section"; then
-  echo "script-test job should install Node for JavaScript workflow tests"
-  exit 1
-fi
-
-if grep -Fq '${{ secrets.' <<<"$script_test_section"; then
-  echo "script-test must not reference secrets"
-  exit 1
-fi
-
-if grep -Fq "metadata-gate:" "$workflow"; then
-  echo "metadata-gate should not run alongside deterministic-gate because both would upload the same facts artifact"
-  exit 1
-fi
-
-if grep -Fq "github.event.action != 'edited'" <<<"$fast_gate_section"; then
-  echo "fast-gate must run on pull_request edited events so title/body edits cannot replace failed CI with a light success"
-  exit 1
-fi
-
-for full_job in \
-  "$unit_test_section" \
-  "$lint_section" \
-  "$script_test_section" \
-  "$deterministic_section" \
-  "$coverage_job_section" \
-  "$dry_run_section" \
-  "$security_section"; do
-  if grep -Fq "github.event.action != 'edited'" <<<"$full_job"; then
-    echo "full CI jobs must run on pull_request edited events; do not skip title/body-only edits"
-    exit 1
-  fi
-done
-
-for pull_request_job in "$deadcode_section" "$license_header_section"; do
-  if grep -Fq "github.event.action != 'edited'" <<<"$pull_request_job"; then
-    echo "pull_request-only CI jobs must run on edited events"
-    exit 1
-  fi
-done
-
-if grep -Fq '${{ secrets.' <<<"$deterministic_section"; then
-  echo "deterministic-gate must not reference secrets"
-  exit 1
-fi
-
-if ! grep -Fq "PUBLIC_CONTENT_METADATA=" <<<"$deterministic_section"; then
-  echo "deterministic-gate should pass public content metadata into make quality-gate"
-  exit 1
-fi
-
-if ! grep -Fq "PR_BRANCH:" <<<"$deterministic_section"; then
-  echo "deterministic-gate should pass the pull request branch into public content metadata"
-  exit 1
-fi
-
 if ! grep -Fq "name: quality-gate-facts-\${{ github.event.pull_request.base.sha }}-\${{ github.event.pull_request.head.sha }}" <<<"$deterministic_section"; then
  echo "deterministic-gate should upload base/head-bound quality-gate-facts for semantic review"
  exit 1
 fi

-if ! grep -Fq "needs: [unit-test, lint, script-test, deterministic-gate]" "$workflow"; then
-  echo "E2E jobs should wait for script-test and deterministic-gate"
-  exit 1
-fi
-
-if ! grep -Fq "script-test" <<<"$results_section"; then
-  echo "results job should include script-test"
+if ! grep -Fq "needs: [unit-test, lint, deterministic-gate]" "$workflow"; then
+  echo "E2E jobs should wait for deterministic-gate"
  exit 1
 fi

@@ -307,11 +210,6 @@ if ! grep -Fq "go run ./internal/qualitygate/cmd/manifest-export" <<<"$make_outp
  exit 1
 fi

-if ! grep -Fq -- "--public-content-metadata .tmp/quality-gate/public-content-metadata.json" <<<"$make_output"; then
-  echo "quality-gate check should consume public content metadata"
-  exit 1
-fi
-
 if ! grep -Fq -- "--manifest .tmp/quality-gate/command-manifest.json" <<<"$make_output" ||
   ! grep -Fq -- "--command-index .tmp/quality-gate/command-index.json" <<<"$make_output"; then
  echo "quality-gate check should consume both exported command snapshots"
--- a/scripts/install-wizard.js
+++ b/scripts/install-wizard.js
@@ -5,12 +5,7 @@
 const fs = require("fs");
 const path = require("path");
 const { execFileSync, execFile } = require("child_process");
-
-// @clack/prompts is ESM-only since v1; load it via dynamic import() so this
-// CommonJS script works on all supported Node versions (require() of an ESM
-// package throws ERR_REQUIRE_ESM before Node 22.12). Assigned in the entry
-// point below before main() runs.
-let p;
+const p = require("@clack/prompts");

 const PKG = "@larksuite/cli";
 const SKILLS_REPO = "https://open.feishu.cn";
@@ -379,12 +374,7 @@ async function main() {
  }
 }

-(async () => {
-  p = await import("@clack/prompts");
-  await main();
-})().catch((err) => {
-  const msg = "Unexpected error: " + (err.message || err);
-  if (p) p.cancel(msg);
-  else console.error(msg);
+main().catch((err) => {
+  p.cancel("Unexpected error: " + (err.message || err));
  process.exit(1);
 });
--- a/scripts/semantic-review-publish.js
+++ b/scripts/semantic-review-publish.js
@@ -175,7 +175,7 @@ function inlineCode(value) {
 }

 function parseEvidenceRef(ref) {
-  const match = /^facts\.(commands|skills|errors|outputs|public_content)\[(\d+)\]$/.exec(String(ref || ""));
+  const match = /^facts\.(commands|skills|errors|outputs)\[(\d+)\]$/.exec(String(ref || ""));
  if (!match) {
    return null;
  }
@@ -230,20 +230,6 @@ function evidenceLocation(facts, ref) {
        return { kind: parsed.kind, command: item.path, label: item.path };
      }
      return null;
-    case "public_content":
-      if (item.file && Number.isInteger(item.line) && item.line > 0) {
-        const label = `${item.file}:${item.line}`;
-        if (item.file === "branch" || item.file === "pull_request_metadata" || String(item.file).startsWith("commit:")) {
-          return { kind: parsed.kind, label };
-        }
-        return {
-          kind: parsed.kind,
-          path: item.file,
-          line: item.line,
-          label,
-        };
-      }
-      return null;
    default:
      return null;
  }
@@ -859,10 +845,6 @@ async function publishTargetStillCurrent(github, context, core, target, phase =
    repo: context.repo.repo,
    pull_number: target.pr,
  });
-  if (pr.state !== "open") {
-    core.notice(`semantic review skipped: PR is no longer open before ${phase}`);
-    return false;
-  }
  if (pr.head.sha !== target.headSha) {
    core.notice(`semantic review skipped: PR head changed before ${phase}`);
    return false;
--- a/scripts/semantic-review-publish.test.js
+++ b/scripts/semantic-review-publish.test.js
@@ -202,100 +202,6 @@ describe("semantic-review-publish", () => {
    assert.equal(selectInlineTarget({ evidence: ["facts.errors[0]"] }, facts, changedLineIndex), null);
  });

-  it("maps public content evidence to changed files but not virtual metadata", () => {
-    const restrictedScope = "pri" + "vate";
-    const facts = {
-      public_content: [
-        {
-          rule: "public_content_semantic_candidate",
-          action: "WARNING",
-          file: "docs/public-roadmap.md",
-          line: 4,
-          source: "file",
-        },
-        {
-          rule: "public_content_semantic_candidate",
-          action: "WARNING",
-          file: "pull_request_metadata",
-          line: 1,
-          source: "metadata",
-        },
-        {
-          rule: "public_content_automation_branch",
-          action: "WARNING",
-          file: "branch",
-          line: 1,
-          source: "branch",
-        },
-        {
-          rule: "public_content_change_id_trailer",
-          action: "REJECT",
-          file: "commit:1234abc",
-          line: 3,
-          source: "commit",
-        },
-      ],
-    };
-    const changedLineIndex = buildChangedLineIndex([{
-      filename: "docs/public-roadmap.md",
-      patch: [
-        "@@ -3,2 +3,3 @@",
-        " context",
-        "+Specific " + restrictedScope + " roadmap detail",
-      ].join("\n"),
-    }]);
-
-    assert.deepEqual(
-      selectInlineTarget({ evidence: ["facts.public_content[0]"] }, facts, changedLineIndex),
-      { path: "docs/public-roadmap.md", line: 4 },
-    );
-    assert.equal(selectInlineTarget({ evidence: ["facts.public_content[1]"] }, facts, changedLineIndex), null);
-    assert.equal(selectInlineTarget({ evidence: ["facts.public_content[2]"] }, facts, changedLineIndex), null);
-    assert.equal(selectInlineTarget({ evidence: ["facts.public_content[3]"] }, facts, changedLineIndex), null);
-
-    const markdown = buildSummaryMarkdown({
-      block_mode: true,
-      blockers: [{
-        category: "public_content_leakage",
-        severity: "major",
-        review_action: "must_fix",
-        evidence: ["facts.public_content[1]"],
-        fingerprint: "public-content-metadata",
-        message: "PR metadata contains " + restrictedScope + " rollout detail",
-        suggested_action: "Move " + restrictedScope + " detail to an internal channel.",
-      }],
-      warnings: [],
-    }, facts);
-    assert.match(markdown, /pull_request_metadata:1/);
-
-    const virtualMarkdown = buildSummaryMarkdown({
-      block_mode: true,
-      blockers: [
-        {
-          category: "public_content_leakage",
-          severity: "major",
-          review_action: "must_fix",
-          evidence: ["facts.public_content[2]"],
-          fingerprint: "public-content-branch",
-          message: "Branch name looks automation-owned.",
-          suggested_action: "Use a maintainer-owned public branch name.",
-        },
-        {
-          category: "public_content_leakage",
-          severity: "major",
-          review_action: "must_fix",
-          evidence: ["facts.public_content[3]"],
-          fingerprint: "public-content-commit",
-          message: "Commit trailer contains " + restrictedScope + " review metadata.",
-          suggested_action: "Remove " + restrictedScope + " review metadata from commits.",
-        },
-      ],
-      warnings: [],
-    }, facts);
-    assert.match(virtualMarkdown, /branch:1/);
-    assert.match(virtualMarkdown, /commit:1234abc:3/);
-  });
-
  it("builds finding markers from stable fingerprints and evidence identity", () => {
    const factsA = {
      skills: [{
@@ -709,35 +615,6 @@ describe("semantic-review-publish", () => {
    });
  });

-  it("skips publishing when the PR closes after verification", async () => {
-    await withPublishTempDir(async ({ calls }) => {
-      fs.writeFileSync("decision.json", JSON.stringify({
-        block_mode: true,
-        blockers: [],
-        warnings: [],
-      }), "utf8");
-
-      await publish({
-        github: fakeGithub(calls, {
-          currentPullRequest: {
-            state: "closed",
-            head: { sha: "0123456789abcdef0123456789abcdef01234567" },
-            base: {
-              sha: "fedcba9876543210fedcba9876543210fedcba98",
-              repo: { id: 123 },
-            },
-          },
-        }),
-        context: workflowRunContext(),
-        core: silentCore(calls),
-      });
-
-      assert.equal(calls.checks.length, 0);
-      assert.equal(calls.comments.length, 0);
-      assert.match(calls.notices[0], /PR is no longer open before publishing/);
-    });
-  });
-
  it("rejects publishing when the PR base repo changed after verification", async () => {
    await withPublishTempDir(async ({ calls }) => {
      fs.writeFileSync("decision.json", JSON.stringify({
@@ -2346,8 +2223,8 @@ function fakeGithub(calls, options = {}) {
        },
      },
      pulls: {
-        get: async () => {
-          const pull = Array.isArray(options.currentPullRequests)
+        get: async () => ({
+          data: Array.isArray(options.currentPullRequests)
            ? options.currentPullRequests[Math.min(pullGetCount++, options.currentPullRequests.length - 1)]
            : options.currentPullRequest || {
            head: { sha: process.env.SEMANTIC_REVIEW_HEAD_SHA },
@@ -2355,9 +2232,8 @@ function fakeGithub(calls, options = {}) {
              sha: process.env.SEMANTIC_REVIEW_BASE_SHA,
              repo: { id: 123 },
            },
-          };
-          return { data: { state: "open", ...pull } };
-        },
+          },
+        }),
        listFiles() {},
        listReviewComments() {},
        createReviewComment: async (args) => {
--- a/scripts/semantic-review-verify-artifact.js
+++ b/scripts/semantic-review-verify-artifact.js
@@ -229,36 +229,6 @@ function requireSafePath(value, path) {
  return file;
 }

-function requirePublicContentFile(value, path) {
-  const file = requireString(value, path);
-  if (file === "branch" || file === "pull_request_metadata" || /^commit:[0-9a-f]{7,40}$/.test(file)) {
-    return file;
-  }
-  if (file.startsWith("commit:")) {
-    throw new Error(`facts JSON ${path} must be a valid public content location`);
-  }
-  requireSafePath(file, path);
-  if (
-    file === "" ||
-    file === "." ||
-    file.startsWith("./") ||
-    file.includes("\\") ||
-    file.includes("\0") ||
-    file.split("/").includes(".git") ||
-    /^[A-Za-z][A-Za-z0-9+.-]*:/.test(file)
-  ) {
-    throw new Error(`facts JSON ${path} must be a repository-relative path`);
-  }
-  return file;
-}
-
-function requirePositiveLine(value, path) {
-  requireLine(value, path);
-  if (value === 0) {
-    throw new Error(`facts JSON ${path} must be a positive line number`);
-  }
-}
-
 function requireStringArray(value, path, { optional = false } = {}) {
  if (value === undefined || value === null) {
    if (optional) {
@@ -451,20 +421,6 @@ function verifyFactsJSON(data) {
  for (const [i, value] of requireArray(facts, "examples").entries()) {
    verifyCommandExample(value, `examples[${i}]`);
  }
-  for (const [i, value] of requireArray(facts, "public_content").entries()) {
-    const item = requireObject(value, `public_content[${i}]`);
-    requireString(item.rule, `public_content[${i}].rule`);
-    const action = requireString(item.action, `public_content[${i}].action`);
-    if (!VALID_ACTIONS.has(action)) {
-      throw new Error(`facts JSON public_content[${i}].action is invalid`);
-    }
-    requirePublicContentFile(item.file, `public_content[${i}].file`);
-    requirePositiveLine(item.line, `public_content[${i}].line`);
-    requireString(item.source, `public_content[${i}].source`, { optional: true });
-    requireString(item.excerpt, `public_content[${i}].excerpt`, { optional: true });
-    requireString(item.message, `public_content[${i}].message`, { optional: true });
-    requireString(item.suggestion, `public_content[${i}].suggestion`, { optional: true });
-  }
  for (const [i, value] of requireArray(facts, "diagnostics").entries()) {
    const item = requireObject(value, `diagnostics[${i}]`);
    requireString(item.rule, `diagnostics[${i}].rule`);
--- a/scripts/semantic-review-verify-artifact.test.js
+++ b/scripts/semantic-review-verify-artifact.test.js
@@ -67,43 +67,7 @@ describe("verifyZipEntries", () => {
    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "semantic-review-zip-"));
    const zipPath = path.join(dir, "facts.zip");
    const outPath = path.join(dir, "facts.json");
-    const restrictedScope = "pri" + "vate";
-    const facts = Buffer.from(JSON.stringify({
-      schema_version: 1,
-      public_content: [
-        {
-          rule: "public_content_semantic_candidate",
-          action: "WARNING",
-          file: "pull_request_metadata",
-          line: 1,
-          source: "metadata",
-          excerpt: "public release notes mention an internal rollout plan",
-          message: "public contribution may contain sensitive implementation detail",
-          suggestion: "move internal detail to " + restrictedScope + " discussion",
-        },
-        {
-          rule: "public_content_change_id_trailer",
-          action: "REJECT",
-          file: "commit:1234abc",
-          line: 3,
-          source: "commit",
-        },
-        {
-          rule: "public_content_automation_branch",
-          action: "WARNING",
-          file: "branch",
-          line: 1,
-          source: "branch",
-        },
-        {
-          rule: "public_content_" + "pri" + "vate_ipv4",
-          action: "WARNING",
-          file: "docs/public-network.md",
-          line: 7,
-          source: "file",
-        },
-      ],
-    }) + "\n");
+    const facts = Buffer.from('{"schema_version":1}\n');
    const zip = makeZip([{ fileName: "facts.json", data: facts, mode: 0o100644 }]);
    fs.writeFileSync(zipPath, zip);

@@ -139,19 +103,6 @@ describe("verifyZipEntries", () => {
      ["bad-error-path", Buffer.from('{"schema_version":1,"errors":[{"file":"../x.go","line":1,"boundary":true,"uses_structured_error":false,"has_hint":false,"hint_action_count":0,"required_hint":true,"retryable":false}]}'), /errors\[0\]\.file/],
      ["bad-example-dry-run", Buffer.from('{"schema_version":1,"examples":[{"raw":"lark-cli docs +fetch","source_file":"skills/lark-doc/SKILL.md","line":3,"executable":true,"dry_run":{"method":"GET","url":"/open-apis/docx","query":{"page_size":["20",1]}}}]}'), /examples\[0\]\.dry_run\.query\.page_size\[1\]/],
      ["bad-output-field", Buffer.from(JSON.stringify({ schema_version: 1, outputs: [{ command: "drive files list", fields: ["ok", "x".repeat(9000)] }] })), /outputs\[0\]\.fields\[1\]/],
-      ["non-array-public-content", Buffer.from('{"schema_version":1,"public_content":{}}'), /public_content must be an array/],
-      ["bad-public-content-item", Buffer.from('{"schema_version":1,"public_content":["not-object"]}'), /public_content\[0\]/],
-      ["bad-public-content-action", Buffer.from('{"schema_version":1,"public_content":[{"rule":"public_content_semantic_candidate","action":"BLOCK","file":"pull_request_metadata","line":1}]}'), /public_content\[0\]\.action/],
-      ["bad-public-content-path", Buffer.from('{"schema_version":1,"public_content":[{"rule":"public_content_semantic_candidate","action":"WARNING","file":"../x","line":1}]}'), /public_content\[0\]\.file/],
-      ["dot-slash-public-content-path", Buffer.from('{"schema_version":1,"public_content":[{"rule":"public_content_semantic_candidate","action":"WARNING","file":"./foo","line":1}]}'), /public_content\[0\]\.file/],
-      ["empty-public-content-path", Buffer.from('{"schema_version":1,"public_content":[{"rule":"public_content_semantic_candidate","action":"WARNING","file":"","line":1}]}'), /public_content\[0\]\.file/],
-      ["dot-public-content-path", Buffer.from('{"schema_version":1,"public_content":[{"rule":"public_content_semantic_candidate","action":"WARNING","file":".","line":1}]}'), /public_content\[0\]\.file/],
-      ["url-public-content-path", Buffer.from('{"schema_version":1,"public_content":[{"rule":"public_content_semantic_candidate","action":"WARNING","file":"https://example.invalid/x","line":1}]}'), /public_content\[0\]\.file/],
-      ["dotgit-public-content-path", Buffer.from('{"schema_version":1,"public_content":[{"rule":"public_content_semantic_candidate","action":"WARNING","file":".git/config","line":1}]}'), /public_content\[0\]\.file/],
-      ["windows-public-content-path", Buffer.from('{"schema_version":1,"public_content":[{"rule":"public_content_semantic_candidate","action":"WARNING","file":"C:\\\\tmp\\\\x","line":1}]}'), /public_content\[0\]\.file/],
-      ["bad-public-content-commit-ref", Buffer.from('{"schema_version":1,"public_content":[{"rule":"public_content_change_id_trailer","action":"REJECT","file":"commit:notasha","line":1}]}'), /public_content\[0\]\.file/],
-      ["bad-public-content-line", Buffer.from('{"schema_version":1,"public_content":[{"rule":"public_content_semantic_candidate","action":"WARNING","file":"pull_request_metadata","line":"1"}]}'), /public_content\[0\]\.line/],
-      ["zero-public-content-line", Buffer.from('{"schema_version":1,"public_content":[{"rule":"public_content_semantic_candidate","action":"WARNING","file":"pull_request_metadata","line":0}]}'), /public_content\[0\]\.line/],
      ["bad-diagnostic-action", Buffer.from('{"schema_version":1,"diagnostics":[{"rule":"r","action":"BLOCK","file":"x.go","line":1,"message":"m"}]}'), /diagnostics.*action/],
      ["long-message", Buffer.from(JSON.stringify({ schema_version: 1, diagnostics: [{ rule: "r", action: "REJECT", file: "x.go", line: 1, message: "x".repeat(9000) }] })), /too long/],
    ]) {
--- a/scripts/semantic-review-workflow.test.sh
+++ b/scripts/semantic-review-workflow.test.sh
@@ -184,10 +184,6 @@ require_in_step "$summary_verify_step" 'eventHeadSha && eventHeadSha.toLowerCase
 require_in_step "$summary_verify_step" 'factsArtifactPattern' "PR quality summary should use the base-bound facts artifact name when available"
 require_in_step "$summary_verify_step" 'const baseSha = artifactBaseSha || eventBaseSha || pr.base.sha' "PR quality summary must prefer the CI-time artifact base SHA"
 require_in_step "$summary_verify_step" 'core.setOutput("artifact_error"' "PR quality summary must expose artifact binding failures"
-require_in_step "$summary_verify_step" 'state: "all"' "PR quality summary fallback must inspect closed PRs before failing"
-require_in_step "$summary_verify_step" 'candidate.state === "open"' "PR quality summary fallback must still prefer open PRs"
-require_in_step "$summary_verify_step" 'workflow_run target PR is no longer open' "PR quality summary must skip stale workflow_run events after PR closure"
-require_in_step "$summary_verify_step" 'pr.state !== "open"' "PR quality summary must skip direct workflow_run PR bindings after PR closure"
 require_in_step "$summary_artifact_step" 'factsArtifactName' "PR quality summary artifact step must use the verified facts artifact binding"
 require_in_step "$summary_extract_facts_step" 'SEMANTIC_REVIEW_DECISION_OUT' "PR quality summary artifact verifier must write an infrastructure decision on verifier failure"

@@ -216,12 +212,7 @@ require_in_step "$verify_step" 'runPRs.length > 1' "semantic-review must fail cl
 require_in_step "$verify_step" 'listPullRequestsAssociatedWithCommit' "semantic-review must resolve fork workflow_run PRs when pull_requests is empty"
 require_in_step "$verify_step" 'commit_sha: targetHeadSha' "semantic-review fallback must resolve PRs by the workflow_run PR head SHA"
 require_in_step "$verify_step" 'github.rest.pulls.list' "semantic-review must have a pull-list fallback when commit association is empty"
-require_in_step "$verify_step" 'openCandidatePRs.length > 1' "semantic-review must fail closed when commit-to-PR fallback is ambiguous"
-require_in_step "$verify_step" 'state: "all"' "semantic-review fallback must inspect closed PRs before failing"
-require_in_step "$verify_step" 'candidate.state === "open"' "semantic-review fallback must still prefer open PRs"
-require_in_step "$verify_step" 'workflow_run target PR is no longer open' "semantic-review must skip stale workflow_run events after PR closure"
-require_in_step "$verify_step" 'pr.state !== "open"' "semantic-review must skip direct workflow_run PR bindings after PR closure"
-require_in_step "$verify_step" '!pr.head.repo' "semantic-review must skip unavailable PR head repositories before reading owner/repo"
+require_in_step "$verify_step" 'candidatePRs.length > 1' "semantic-review must fail closed when commit-to-PR fallback is ambiguous"
 require_in_step "$verify_step" 'pr.head.sha !== targetHeadSha' "semantic-review must skip stale PR heads"
 require_in_step "$verify_step" 'eventBaseSha && parsedBaseSha.toLowerCase() !== eventBaseSha.toLowerCase()' "semantic-review should tolerate mutable workflow_run PR base metadata"
 require_in_step "$verify_step" 'const baseSha = artifactBaseSha || eventBaseSha || pr.base.sha' "semantic-review must prefer the CI-time artifact base SHA"
@@ -269,7 +260,6 @@ require_in_step "$semantic_step" 'args+=(--waivers-file' "same-repo PR head waiv
 require_in_step "$precheckout_step" 'SEMANTIC_REVIEW_BASE_SHA' "pre-checkout failure publisher must receive verified base SHA"
 require_in_step "$precheckout_step" 'SEMANTIC_REVIEW_RUN_ID' "pre-checkout failure publisher must receive verified run id"
 require_in_step "$precheckout_step" 'github.rest.pulls.get' "pre-checkout failure publisher must recheck PR target before writing"
-require_in_step "$precheckout_step" 'pull.state !== "open"' "pre-checkout failure publisher must skip closed PRs before writing"
 require_in_step "$precheckout_step" 'pull.head.sha !== headSha' "pre-checkout failure publisher must skip stale PR heads"
 require_in_step "$precheckout_step" 'pull.base.sha !== baseSha' "pre-checkout failure publisher must skip stale PR bases"

--- a/shortcuts/calendar/calendar_meeting.go
+++ b/shortcuts/calendar/calendar_meeting.go
@@ -1,215 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-//
-// calendar +meeting — get meeting info for calendar events via mget_instance_relation_info
-
-package calendar
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"strings"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/output"
-	"github.com/larksuite/cli/internal/validate"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-const meetingLogPrefix = "[calendar +meeting]"
-
-// mgetInstanceRelationRequestBody is the request body for mget_instance_relation_info API.
-type mgetInstanceRelationRequestBody struct {
-	InstanceIDs            []string `json:"instance_ids"`
-	NeedMeetingInstanceIDs bool     `json:"need_meeting_instance_ids"`
-	NeedMeetingNotes       bool     `json:"need_meeting_notes"`
-	NeedAIMeetingNotes     bool     `json:"need_ai_meeting_notes"`
-}
-
-// meetingInfoItem represents a single event's meeting info in the output.
-type meetingInfoItem struct {
-	EventID     string `json:"event_id"`
-	MeetingID   string `json:"meeting_id,omitempty"`
-	MeetingNote string `json:"meeting_note,omitempty"`
-	Error       string `json:"error,omitempty"`
-	Hint        string `json:"hint,omitempty"`
-}
-
-// translateFailMsg converts API fail_msg to a user-friendly error message.
-func translateFailMsg(failMsg string) string {
-	switch failMsg {
-	case "No Permission":
-		return "no read permission for this calendar event (not a participant of the event)"
-	case "Not Found":
-		return "event not found on the specified calendar (event ID may be incorrect or does not belong to this calendar)"
-	default:
-		return failMsg
-	}
-}
-
-// fetchEventMeetingInfo queries mget_instance_relation_info for a single event instance.
-func fetchEventMeetingInfo(ctx context.Context, runtime *common.RuntimeContext, instanceID, calendarID string) *meetingInfoItem {
-	body := &mgetInstanceRelationRequestBody{
-		InstanceIDs:            []string{instanceID},
-		NeedMeetingInstanceIDs: true,
-		NeedMeetingNotes:       true,
-		NeedAIMeetingNotes:     false,
-	}
-
-	data, err := runtime.CallAPITyped("POST",
-		fmt.Sprintf("/open-apis/calendar/v4/calendars/%s/events/mget_instance_relation_info", validate.EncodePathSegment(calendarID)),
-		nil, body)
-	if err != nil {
-		msg := unwrapCalendarAPIError(err)
-		if msg == "" {
-			msg = err.Error()
-		}
-		return &meetingInfoItem{EventID: instanceID, Error: msg}
-	}
-
-	// Check for failed instance IDs first
-	if failedIDs, _ := data["failed_instance_ids"].([]any); len(failedIDs) > 0 {
-		for _, raw := range failedIDs {
-			if failInfo, ok := raw.(map[string]any); ok {
-				if failID, _ := failInfo["instance_id"].(string); failID == instanceID {
-					failMsg, _ := failInfo["fail_msg"].(string)
-					return &meetingInfoItem{EventID: instanceID, Error: translateFailMsg(failMsg)}
-				}
-			}
-		}
-	}
-
-	infos, _ := data["instance_relation_infos"].([]any)
-	if len(infos) == 0 {
-		return &meetingInfoItem{EventID: instanceID, Error: "no event relation info found"}
-	}
-
-	info, _ := infos[0].(map[string]any)
-	result := &meetingInfoItem{EventID: instanceID}
-
-	// Extract meeting_id (return first if multiple) — API returns string
-	if rawIDs, _ := info["meeting_instance_ids"].([]any); len(rawIDs) > 0 {
-		if id, ok := rawIDs[0].(string); ok && id != "" {
-			result.MeetingID = id
-		}
-	}
-
-	// Extract meeting_note (return first if multiple)
-	if notes, _ := info["meeting_notes"].([]any); len(notes) > 0 {
-		if note, ok := notes[0].(string); ok && note != "" {
-			result.MeetingNote = note
-		}
-	}
-
-	// Add hints for empty resources (independent checks)
-	var emptyFields []string
-	if result.MeetingID == "" {
-		emptyFields = append(emptyFields, "meeting_id")
-	}
-	if result.MeetingNote == "" {
-		emptyFields = append(emptyFields, "meeting_note")
-	}
-	if len(emptyFields) > 0 {
-		result.Hint = fmt.Sprintf("%s not found for this event", strings.Join(emptyFields, ", "))
-	}
-
-	return result
-}
-
-// CalendarMeeting gets meeting info for calendar events.
-var CalendarMeeting = common.Shortcut{
-	Service:     "calendar",
-	Command:     "+meeting",
-	Description: "Get meeting info for calendar events (meeting_id, meeting_note)",
-	Risk:        "read",
-	Scopes:      []string{"calendar:calendar.event:read"},
-	AuthTypes:   []string{"user"},
-	HasFormat:   true,
-	Flags: []common.Flag{
-		{Name: "event-ids", Desc: "calendar event instance IDs, comma-separated for batch", Required: true},
-		{Name: "calendar-id", Desc: "calendar ID (default: primary)"},
-	},
-	Validate: func(ctx context.Context, runtime *common.RuntimeContext) error {
-		if err := rejectCalendarAutoBotFallback(runtime); err != nil {
-			return err
-		}
-		ids := common.SplitCSV(runtime.Str("event-ids"))
-		const maxBatchSize = 50
-		if len(ids) > maxBatchSize {
-			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--event-ids: too many IDs (%d), maximum is %d", len(ids), maxBatchSize).WithParam("--event-ids")
-		}
-		return nil
-	},
-	DryRun: func(ctx context.Context, runtime *common.RuntimeContext) *common.DryRunAPI {
-		calendarID := runtime.Str("calendar-id")
-		if calendarID == "" {
-			calendarID = "<primary>"
-		}
-		return common.NewDryRunAPI().
-			POST(fmt.Sprintf("/open-apis/calendar/v4/calendars/%s/events/mget_instance_relation_info", calendarID)).
-			Set("event_ids", common.SplitCSV(runtime.Str("event-ids"))).
-			Set("calendar_id", calendarID)
-	},
-	Execute: func(ctx context.Context, runtime *common.RuntimeContext) error {
-		errOut := runtime.IO().ErrOut
-		instanceIDs := common.SplitCSV(runtime.Str("event-ids"))
-		calendarID := strings.TrimSpace(runtime.Str("calendar-id"))
-		if calendarID == "" {
-			calendarID = PrimaryCalendarIDStr
-		}
-
-		results := make([]*meetingInfoItem, 0, len(instanceIDs))
-		fmt.Fprintf(errOut, "%s querying %d event_id(s)\n", meetingLogPrefix, len(instanceIDs))
-		for _, id := range instanceIDs {
-			if err := ctx.Err(); err != nil {
-				return err
-			}
-			fmt.Fprintf(errOut, "%s querying event_id=%s ...\n", meetingLogPrefix, id)
-			results = append(results, fetchEventMeetingInfo(ctx, runtime, id, calendarID))
-		}
-
-		successCount := 0
-		for _, r := range results {
-			if r.Error == "" {
-				successCount++
-			}
-		}
-		fmt.Fprintf(errOut, "%s done: %d total, %d succeeded, %d failed\n", meetingLogPrefix, len(results), successCount, len(results)-successCount)
-
-		if successCount == 0 && len(results) > 0 {
-			return runtime.OutPartialFailure(map[string]any{"meetings": results}, &output.Meta{Count: len(results)})
-		}
-
-		outData := map[string]any{"meetings": results}
-		runtime.OutFormat(outData, &output.Meta{Count: len(results)}, func(w io.Writer) {
-			if len(results) == 0 {
-				fmt.Fprintln(w, "No events.")
-				return
-			}
-			var rows []map[string]interface{}
-			for _, r := range results {
-				row := map[string]interface{}{"event_id": r.EventID}
-				if r.Error != "" {
-					row["status"] = "FAIL"
-					row["error"] = r.Error
-				} else {
-					row["status"] = "OK"
-					if r.MeetingID != "" {
-						row["meeting_id"] = r.MeetingID
-					}
-					if r.MeetingNote != "" {
-						row["meeting_note"] = r.MeetingNote
-					}
-					if r.Hint != "" {
-						row["hint"] = r.Hint
-					}
-				}
-				rows = append(rows, row)
-			}
-			output.PrintTable(w, rows)
-			fmt.Fprintf(w, "\n%d event(s), %d succeeded, %d failed\n", len(results), successCount, len(results)-successCount)
-		})
-		return nil
-	},
-}
--- a/shortcuts/calendar/calendar_meeting_test.go
+++ b/shortcuts/calendar/calendar_meeting_test.go
@@ -1,484 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package calendar
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"strings"
-	"sync"
-	"testing"
-
-	"github.com/spf13/cobra"
-
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/httpmock"
-	"github.com/larksuite/cli/internal/output"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-// ---------------------------------------------------------------------------
-// helpers
-// ---------------------------------------------------------------------------
-
-var calWarmOnce sync.Once
-
-func calWarmTokenCache(t *testing.T) {
-	t.Helper()
-	calWarmOnce.Do(func() {
-		f, _, _, reg := cmdutil.TestFactory(t, calDefaultConfig())
-		reg.Register(&httpmock.Stub{
-			URL:  "/open-apis/test/v1/warm",
-			Body: map[string]interface{}{"code": 0, "msg": "ok", "data": map[string]interface{}{}},
-		})
-		s := common.Shortcut{
-			Service:   "test",
-			Command:   "+warm",
-			AuthTypes: []string{"bot"},
-			Execute: func(_ context.Context, rctx *common.RuntimeContext) error {
-				_, err := rctx.CallAPITyped("GET", "/open-apis/test/v1/warm", nil, nil)
-				return err
-			},
-		}
-		parent := &cobra.Command{Use: "test"}
-		s.Mount(parent, f)
-		parent.SetArgs([]string{"+warm"})
-		parent.SilenceErrors = true
-		parent.SilenceUsage = true
-		parent.Execute()
-	})
-}
-
-func calDefaultConfig() *core.CliConfig {
-	return &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
-		UserOpenId: "ou_testuser",
-	}
-}
-
-func calMountAndRun(t *testing.T, s common.Shortcut, args []string, f *cmdutil.Factory, stdout *bytes.Buffer) error {
-	t.Helper()
-	calWarmTokenCache(t)
-	parent := &cobra.Command{Use: "calendar"}
-	s.Mount(parent, f)
-	parent.SetArgs(args)
-	parent.SilenceErrors = true
-	parent.SilenceUsage = true
-	if stdout != nil {
-		stdout.Reset()
-	}
-	return parent.Execute()
-}
-
-// ---------------------------------------------------------------------------
-// calendar +meeting tests
-// ---------------------------------------------------------------------------
-
-func mgetInstanceRelationStub(calendarID, instanceID string, meetingIDs []string, meetingNotes []string, aiMeetingNotes []string) *httpmock.Stub {
-	infos := map[string]interface{}{
-		"instance_id": instanceID,
-	}
-	mIDs := make([]interface{}, len(meetingIDs))
-	for i, id := range meetingIDs {
-		mIDs[i] = id
-	}
-	infos["meeting_instance_ids"] = mIDs
-	if len(meetingNotes) > 0 {
-		notes := make([]interface{}, len(meetingNotes))
-		for i, n := range meetingNotes {
-			notes[i] = n
-		}
-		infos["meeting_notes"] = notes
-	}
-	if len(aiMeetingNotes) > 0 {
-		notes := make([]interface{}, len(aiMeetingNotes))
-		for i, n := range aiMeetingNotes {
-			notes[i] = n
-		}
-		infos["ai_meeting_notes"] = notes
-	}
-	return &httpmock.Stub{
-		Method: "POST",
-		URL:    fmt.Sprintf("/open-apis/calendar/v4/calendars/%s/events/mget_instance_relation_info", calendarID),
-		Body: map[string]interface{}{
-			"code": 0, "msg": "ok",
-			"data": map[string]interface{}{
-				"instance_relation_infos": []interface{}{infos},
-			},
-		},
-	}
-}
-
-func mgetInstanceRelationFailedStub(calendarID, instanceID, failMsg string) *httpmock.Stub {
-	return &httpmock.Stub{
-		Method: "POST",
-		URL:    fmt.Sprintf("/open-apis/calendar/v4/calendars/%s/events/mget_instance_relation_info", calendarID),
-		Body: map[string]interface{}{
-			"code": 0, "msg": "ok",
-			"data": map[string]interface{}{
-				"instance_relation_infos": []interface{}{},
-				"failed_instance_ids": []interface{}{
-					map[string]interface{}{
-						"instance_id": instanceID,
-						"fail_msg":    failMsg,
-					},
-				},
-			},
-		},
-	}
-}
-
-func TestMeeting_Validation_MissingEventIDs(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, calDefaultConfig())
-	err := calMountAndRun(t, CalendarMeeting, []string{"+meeting", "--as", "user"}, f, nil)
-	if err == nil {
-		t.Fatal("expected validation error for missing --event-ids")
-	}
-}
-
-func TestMeeting_Validation_BatchLimit(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, calDefaultConfig())
-	ids := make([]string, 51)
-	for i := range ids {
-		ids[i] = fmt.Sprintf("evt%d", i)
-	}
-	err := calMountAndRun(t, CalendarMeeting, []string{"+meeting", "--event-ids", strings.Join(ids, ","), "--as", "user"}, f, nil)
-	if err == nil {
-		t.Fatal("expected batch limit error")
-	}
-	if !strings.Contains(err.Error(), "too many IDs") {
-		t.Errorf("expected 'too many IDs' error, got: %v", err)
-	}
-}
-
-func TestMeeting_DryRun(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, calDefaultConfig())
-	err := calMountAndRun(t, CalendarMeeting, []string{"+meeting", "--event-ids", "evt001", "--dry-run", "--as", "user"}, f, stdout)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if !strings.Contains(stdout.String(), "mget_instance_relation_info") {
-		t.Errorf("dry-run should show mget API path, got: %s", stdout.String())
-	}
-}
-
-func TestMeeting_Execute_Success(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, calDefaultConfig())
-	reg.Register(mgetInstanceRelationStub("primary", "evt_m1", []string{"123456"}, []string{"doc_note1"}, []string{"doc_ai1"}))
-
-	err := calMountAndRun(t, CalendarMeeting, []string{"+meeting", "--event-ids", "evt_m1", "--as", "user"}, f, stdout)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	var resp map[string]any
-	if err := json.Unmarshal(stdout.Bytes(), &resp); err != nil {
-		t.Fatalf("failed to parse output: %v", err)
-	}
-	data, _ := resp["data"].(map[string]any)
-	meetings, _ := data["meetings"].([]any)
-	if len(meetings) != 1 {
-		t.Fatalf("expected 1 meeting, got %d", len(meetings))
-	}
-	m, _ := meetings[0].(map[string]any)
-	if m["meeting_id"] != "123456" {
-		t.Errorf("meeting_id = %v, want 123456", m["meeting_id"])
-	}
-	if m["meeting_note"] != "doc_note1" {
-		t.Errorf("meeting_note = %v, want doc_note1", m["meeting_note"])
-	}
-	if _, hasAI := m["ai_meeting_note"]; hasAI {
-		t.Error("ai_meeting_note should not be present in output")
-	}
-}
-
-func TestMeeting_Execute_FailedInstance(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, calDefaultConfig())
-	reg.Register(mgetInstanceRelationFailedStub("primary", "evt_fail", "No Permission"))
-
-	err := calMountAndRun(t, CalendarMeeting, []string{"+meeting", "--event-ids", "evt_fail", "--as", "user"}, f, stdout)
-	if err == nil {
-		t.Fatal("expected partial failure error")
-	}
-	var pfErr *output.PartialFailureError
-	if !errors.As(err, &pfErr) {
-		t.Fatalf("expected *output.PartialFailureError, got %T: %v", err, err)
-	}
-	// Verify translated fail_msg appears in output
-	var resp map[string]any
-	if err := json.Unmarshal(stdout.Bytes(), &resp); err == nil {
-		data, _ := resp["data"].(map[string]any)
-		meetings, _ := data["meetings"].([]any)
-		if len(meetings) > 0 {
-			m, _ := meetings[0].(map[string]any)
-			if errMsg, _ := m["error"].(string); !strings.Contains(errMsg, "no read permission") {
-				t.Errorf("expected translated fail_msg, got: %v", errMsg)
-			}
-		}
-	}
-}
-
-func TestMeeting_Execute_NoMeeting(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, calDefaultConfig())
-	reg.Register(mgetInstanceRelationStub("primary", "evt_nomeet", []string{}, nil, nil))
-
-	err := calMountAndRun(t, CalendarMeeting, []string{"+meeting", "--event-ids", "evt_nomeet", "--as", "user"}, f, stdout)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	var resp map[string]any
-	if err := json.Unmarshal(stdout.Bytes(), &resp); err != nil {
-		t.Fatalf("failed to parse output: %v", err)
-	}
-	data, _ := resp["data"].(map[string]any)
-	meetings, _ := data["meetings"].([]any)
-	if len(meetings) != 1 {
-		t.Fatalf("expected 1 meeting, got %d", len(meetings))
-	}
-	m, _ := meetings[0].(map[string]any)
-	if hint, _ := m["hint"].(string); !strings.Contains(hint, "meeting_id") {
-		t.Errorf("expected hint about meeting_id, got: %v", hint)
-	}
-}
-
-// ---------------------------------------------------------------------------
-// calendar +search-event tests
-// ---------------------------------------------------------------------------
-
-func TestSearchEvent_Validation_InvalidTimeRange(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, calDefaultConfig())
-	err := calMountAndRun(t, CalendarSearchEvent, []string{"+search-event", "--start", "bad-format", "--end", "2026-04-27", "--as", "user"}, f, nil)
-	if err == nil {
-		t.Fatal("expected validation error for invalid --start")
-	}
-	if !strings.Contains(err.Error(), "--start") {
-		t.Errorf("unexpected error: %v", err)
-	}
-}
-
-func TestSearchEvent_Validation_TimeRangeStartAfterEnd(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, calDefaultConfig())
-	err := calMountAndRun(t, CalendarSearchEvent, []string{"+search-event", "--start", "2026-04-27", "--end", "2026-04-20", "--as", "user"}, f, nil)
-	if err == nil {
-		t.Fatal("expected validation error for start after end")
-	}
-}
-
-func TestSearchEvent_DryRun(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, calDefaultConfig())
-	err := calMountAndRun(t, CalendarSearchEvent, []string{"+search-event", "--query", "周会", "--dry-run", "--as", "user"}, f, stdout)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if !strings.Contains(stdout.String(), "search_event") {
-		t.Errorf("dry-run should show search_event API path, got: %s", stdout.String())
-	}
-}
-
-func TestSearchEvent_Execute_Success(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, calDefaultConfig())
-	reg.Register(&httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/calendar/v4/calendars/primary/events/search_event",
-		Body: map[string]interface{}{
-			"code": 0, "msg": "ok",
-			"data": map[string]interface{}{
-				"items": []interface{}{
-					map[string]interface{}{
-						"display_info": "Q2 周会\n2026-04-23 15:00-16:00",
-						"meta_data": map[string]interface{}{
-							"event_id": "evt_search1",
-							"summary":  "Q2 周会",
-							"start": map[string]interface{}{
-								"date_time": "2026-04-23T15:00:00+08:00",
-								"timezone":  "Asia/Shanghai",
-							},
-							"end": map[string]interface{}{
-								"date_time": "2026-04-23T16:00:00+08:00",
-								"timezone":  "Asia/Shanghai",
-							},
-							"is_all_day": false,
-							"app_link":   "https://applink.feishu.cn/...",
-						},
-					},
-				},
-				"has_more":   false,
-				"page_token": "",
-			},
-		},
-	})
-
-	err := calMountAndRun(t, CalendarSearchEvent, []string{"+search-event", "--query", "周会", "--as", "user"}, f, stdout)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	var resp map[string]any
-	if err := json.Unmarshal(stdout.Bytes(), &resp); err != nil {
-		t.Fatalf("failed to parse output: %v", err)
-	}
-	data, _ := resp["data"].(map[string]any)
-	if data["calendar_id"] != "primary" {
-		t.Errorf("calendar_id = %v, want primary", data["calendar_id"])
-	}
-	items, _ := data["items"].([]any)
-	if len(items) != 1 {
-		t.Fatalf("expected 1 item, got %d", len(items))
-	}
-	item, _ := items[0].(map[string]any)
-	if item["event_id"] != "evt_search1" {
-		t.Errorf("event_id = %v, want evt_search1", item["event_id"])
-	}
-	if item["summary"] != "Q2 周会" {
-		t.Errorf("summary = %v, want 'Q2 周会'", item["summary"])
-	}
-}
-
-func TestSearchEvent_Execute_Empty(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, calDefaultConfig())
-	reg.Register(&httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/calendar/v4/calendars/primary/events/search_event",
-		Body: map[string]interface{}{
-			"code": 0, "msg": "ok",
-			"data": map[string]interface{}{
-				"items":    []interface{}{},
-				"has_more": false,
-			},
-		},
-	})
-
-	err := calMountAndRun(t, CalendarSearchEvent, []string{"+search-event", "--query", "nonexistent", "--as", "user"}, f, stdout)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-}
-
-// ---------------------------------------------------------------------------
-// Pure function tests
-// ---------------------------------------------------------------------------
-
-func TestParseSearchEventTimeRange(t *testing.T) {
-	tests := []struct {
-		name    string
-		start   string
-		end     string
-		wantErr bool
-	}{
-		{"empty", "", "", false},
-		{"valid", "2026-04-20", "2026-04-27", false},
-		{"start only defaults end", "2026-04-20", "", false},
-		{"end only defaults start", "", "2026-04-27", false},
-		{"invalid start format", "not-a-date", "2026-04-27", true},
-		{"start after end", "2026-04-27", "2026-04-20", true},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			cmd := &cobra.Command{Use: "test"}
-			cmd.Flags().String("start", "", "")
-			cmd.Flags().String("end", "", "")
-			if tt.start != "" {
-				_ = cmd.Flags().Set("start", tt.start)
-			}
-			if tt.end != "" {
-				_ = cmd.Flags().Set("end", tt.end)
-			}
-			runtime := common.TestNewRuntimeContext(cmd, calDefaultConfig())
-			_, _, err := parseSearchEventTimeRange(runtime)
-			if (err != nil) != tt.wantErr {
-				t.Errorf("parseSearchEventTimeRange() error = %v, wantErr %v", err, tt.wantErr)
-			}
-		})
-	}
-
-	t.Run("start only fills end with end-of-day", func(t *testing.T) {
-		cmd := &cobra.Command{Use: "test"}
-		cmd.Flags().String("start", "", "")
-		cmd.Flags().String("end", "", "")
-		_ = cmd.Flags().Set("start", "2026-04-20")
-		runtime := common.TestNewRuntimeContext(cmd, calDefaultConfig())
-		startRFC, endRFC, err := parseSearchEventTimeRange(runtime)
-		if err != nil {
-			t.Fatalf("unexpected error: %v", err)
-		}
-		if !strings.HasPrefix(startRFC, "2026-04-20T00:00:00") {
-			t.Errorf("start = %s, want 2026-04-20T00:00:00...", startRFC)
-		}
-		if !strings.HasPrefix(endRFC, "2026-04-20T23:59:59") {
-			t.Errorf("end = %s, want 2026-04-20T23:59:59...", endRFC)
-		}
-	})
-
-	t.Run("end only fills start with start-of-day", func(t *testing.T) {
-		cmd := &cobra.Command{Use: "test"}
-		cmd.Flags().String("start", "", "")
-		cmd.Flags().String("end", "", "")
-		_ = cmd.Flags().Set("end", "2026-04-27")
-		runtime := common.TestNewRuntimeContext(cmd, calDefaultConfig())
-		startRFC, endRFC, err := parseSearchEventTimeRange(runtime)
-		if err != nil {
-			t.Fatalf("unexpected error: %v", err)
-		}
-		if !strings.HasPrefix(startRFC, "2026-04-27T00:00:00") {
-			t.Errorf("start = %s, want 2026-04-27T00:00:00...", startRFC)
-		}
-		if !strings.HasPrefix(endRFC, "2026-04-27T23:59:59") {
-			t.Errorf("end = %s, want 2026-04-27T23:59:59...", endRFC)
-		}
-	})
-}
-
-func TestBuildSearchEventFilter(t *testing.T) {
-	cmd := &cobra.Command{Use: "test"}
-	cmd.Flags().String("attendee-ids", "", "")
-	_ = cmd.Flags().Set("attendee-ids", "ou_user1,oc_chat1,omm_room1")
-	runtime := common.TestNewRuntimeContext(cmd, calDefaultConfig())
-
-	filter := buildSearchEventFilter(runtime, "", "")
-	if filter == nil {
-		t.Fatal("expected filter to be non-nil")
-	}
-	if len(filter.AttendeeUserIDs) != 1 || filter.AttendeeUserIDs[0] != "ou_user1" {
-		t.Errorf("attendee_user_ids = %v, want [ou_user1]", filter.AttendeeUserIDs)
-	}
-	if len(filter.AttendeeChatIDs) != 1 || filter.AttendeeChatIDs[0] != "oc_chat1" {
-		t.Errorf("attendee_chat_ids = %v, want [oc_chat1]", filter.AttendeeChatIDs)
-	}
-	if len(filter.MeetingRoomIDs) != 1 || filter.MeetingRoomIDs[0] != "omm_room1" {
-		t.Errorf("meeting_room_ids = %v, want [omm_room1]", filter.MeetingRoomIDs)
-	}
-}
-
-func TestBuildSearchEventFilter_Empty(t *testing.T) {
-	cmd := &cobra.Command{Use: "test"}
-	cmd.Flags().String("attendee-ids", "", "")
-	runtime := common.TestNewRuntimeContext(cmd, calDefaultConfig())
-
-	filter := buildSearchEventFilter(runtime, "", "")
-	if filter != nil {
-		t.Errorf("expected nil for empty filter, got %v", filter)
-	}
-}
-
-func TestBuildSearchEventFilter_TimeRange(t *testing.T) {
-	cmd := &cobra.Command{Use: "test"}
-	cmd.Flags().String("attendee-ids", "", "")
-	runtime := common.TestNewRuntimeContext(cmd, calDefaultConfig())
-
-	filter := buildSearchEventFilter(runtime, "2026-04-20T00:00:00+08:00", "2026-04-27T23:59:59+08:00")
-	if filter == nil {
-		t.Fatal("expected filter to be non-nil")
-	}
-	if filter.TimeRange == nil {
-		t.Fatal("expected time_range in filter")
-	}
-	if filter.TimeRange.StartTime != "2026-04-20T00:00:00+08:00" {
-		t.Errorf("start_time = %v, want 2026-04-20T00:00:00+08:00", filter.TimeRange.StartTime)
-	}
-}
--- a/shortcuts/calendar/calendar_room_find.go
+++ b/shortcuts/calendar/calendar_room_find.go
@@ -66,8 +66,7 @@ type roomFindSlot struct {
 type roomFindTimeSlot struct {
 	Start        string                `json:"start,omitempty"`
 	End          string                `json:"end,omitempty"`
-	MeetingRooms []*roomFindSuggestion `json:"meeting_rooms"`
-	Hint         string                `json:"hint,omitempty"`
+	MeetingRooms []*roomFindSuggestion `json:"meeting_rooms,omitempty"`
 }

 type roomFindOutput struct {
@@ -104,18 +103,11 @@ func collectRoomFindResults(slots []roomFindSlot, limit int, fetch func(roomFind
 				}
 				return
 			}
-			if suggestions == nil {
-				suggestions = []*roomFindSuggestion{}
-			}
-			ts := &roomFindTimeSlot{
+			out.TimeSlots = append(out.TimeSlots, &roomFindTimeSlot{
 				Start:        slot.Start,
 				End:          slot.End,
 				MeetingRooms: suggestions,
-			}
-			if len(suggestions) == 0 {
-				ts.Hint = "no meeting room matches the current filters for this slot"
-			}
-			out.TimeSlots = append(out.TimeSlots, ts)
+			})
 		}(slot)
 	}
 	wg.Wait()
@@ -382,10 +374,6 @@ var CalendarRoomFind = common.Shortcut{
 			}
 			for _, slot := range out.TimeSlots {
 				fmt.Fprintf(w, "%s - %s\n", slot.Start, slot.End)
-				if len(slot.MeetingRooms) == 0 {
-					fmt.Fprintf(w, "0 meeting room(s) found: %s\n", slot.Hint)
-					continue
-				}
 				var rows []map[string]interface{}
 				for _, room := range slot.MeetingRooms {
 					rows = append(rows, map[string]interface{}{
@@ -396,7 +384,6 @@ var CalendarRoomFind = common.Shortcut{
 					})
 				}
 				output.PrintTable(w, rows)
-				fmt.Fprintf(w, "%d meeting room(s) found\n", len(slot.MeetingRooms))
 				fmt.Fprintln(w)
 			}
 		})
--- a/shortcuts/calendar/calendar_room_find_test.go
+++ b/shortcuts/calendar/calendar_room_find_test.go
@@ -4,8 +4,6 @@
 package calendar

 import (
-	"encoding/json"
-	"strings"
 	"testing"
 	"time"
 )
@@ -84,60 +82,3 @@ func TestCollectRoomFindResults_LimitsConcurrency(t *testing.T) {
 		t.Fatalf("expected %d time slots, got %d", len(slots), len(out.TimeSlots))
 	}
 }
-
-func TestCollectRoomFindResults_EmptySlotEmitsHintAndArray(t *testing.T) {
-	slots := []roomFindSlot{
-		{Start: "2026-03-27T14:00:00+08:00", End: "2026-03-27T15:00:00+08:00"},
-		{Start: "2026-03-27T15:00:00+08:00", End: "2026-03-27T16:00:00+08:00"},
-	}
-
-	out, err := collectRoomFindResults(slots, 2, func(slot roomFindSlot) ([]*roomFindSuggestion, error) {
-		if strings.HasPrefix(slot.Start, "2026-03-27T14") {
-			return []*roomFindSuggestion{{RoomID: "rm_1", RoomName: "Room A"}}, nil
-		}
-		return nil, nil
-	})
-	if err != nil {
-		t.Fatalf("collectRoomFindResults returned error: %v", err)
-	}
-	if len(out.TimeSlots) != 2 {
-		t.Fatalf("expected 2 time slots, got %d", len(out.TimeSlots))
-	}
-
-	for _, ts := range out.TimeSlots {
-		if ts.MeetingRooms == nil {
-			t.Fatalf("meeting_rooms should be non-nil for slot %s", ts.Start)
-		}
-		switch {
-		case strings.HasPrefix(ts.Start, "2026-03-27T14"):
-			if len(ts.MeetingRooms) != 1 {
-				t.Fatalf("expected 1 room for first slot, got %d", len(ts.MeetingRooms))
-			}
-			if ts.Hint != "" {
-				t.Fatalf("non-empty slot should not carry hint, got %q", ts.Hint)
-			}
-		case strings.HasPrefix(ts.Start, "2026-03-27T15"):
-			if len(ts.MeetingRooms) != 0 {
-				t.Fatalf("expected 0 rooms for empty slot, got %d", len(ts.MeetingRooms))
-			}
-			if ts.Hint == "" {
-				t.Fatal("empty slot should carry a hint explaining the filters")
-			}
-		}
-	}
-
-	emptySlot := out.TimeSlots[0]
-	if !strings.HasPrefix(emptySlot.Start, "2026-03-27T15") {
-		emptySlot = out.TimeSlots[1]
-	}
-	raw, err := json.Marshal(emptySlot)
-	if err != nil {
-		t.Fatalf("marshal empty slot: %v", err)
-	}
-	if !strings.Contains(string(raw), `"meeting_rooms":[]`) {
-		t.Fatalf("expected meeting_rooms:[] in JSON, got %s", raw)
-	}
-	if !strings.Contains(string(raw), `"hint"`) {
-		t.Fatalf("expected hint field in JSON, got %s", raw)
-	}
-}
--- a/shortcuts/calendar/calendar_search_event.go
+++ b/shortcuts/calendar/calendar_search_event.go
@@ -1,331 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-//
-// calendar +search-event — search calendar events by keyword, time range, and attendees
-
-package calendar
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/output"
-	"github.com/larksuite/cli/internal/validate"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-const (
-	defaultSearchEventPageSize = 20
-	maxSearchEventPageSize     = 30
-)
-
-// searchEventTimeRange represents the time range filter for search_event API.
-type searchEventTimeRange struct {
-	StartTime string `json:"start_time,omitempty"`
-	EndTime   string `json:"end_time,omitempty"`
-}
-
-// searchEventFilter represents the filter object for the search_event API request.
-type searchEventFilter struct {
-	AttendeeUserIDs []string              `json:"attendee_user_ids,omitempty"`
-	AttendeeChatIDs []string              `json:"attendee_chat_ids,omitempty"`
-	MeetingRoomIDs  []string              `json:"meeting_room_ids,omitempty"`
-	TimeRange       *searchEventTimeRange `json:"time_range,omitempty"`
-}
-
-// searchEventRequestBody is the request body for the search_event API.
-type searchEventRequestBody struct {
-	Query  string             `json:"query"`
-	Filter *searchEventFilter `json:"filter,omitempty"`
-}
-
-// searchEventTimeInfo represents start/end time info in the search result.
-type searchEventTimeInfo struct {
-	Date     string `json:"date,omitempty"`
-	DateTime string `json:"date_time,omitempty"`
-	Timezone string `json:"timezone,omitempty"`
-}
-
-// searchEventItem represents a single event in the search result output.
-type searchEventItem struct {
-	EventID  string               `json:"event_id"`
-	Summary  string               `json:"summary"`
-	Start    *searchEventTimeInfo `json:"start,omitempty"`
-	End      *searchEventTimeInfo `json:"end,omitempty"`
-	IsAllDay bool                 `json:"is_all_day,omitempty"`
-	AppLink  string               `json:"app_link,omitempty"`
-}
-
-// searchEventOutput is the structured output for +search-event.
-type searchEventOutput struct {
-	CalendarID string            `json:"calendar_id"`
-	Items      []searchEventItem `json:"items"`
-	HasMore    bool              `json:"has_more"`
-	PageToken  string            `json:"page_token"`
-}
-
-// parseSearchEventTimeRange parses --start / --end into RFC3339 strings.
-// When only one side is provided, the other defaults to the same day's
-// boundary (start → end-of-day, end → start-of-day).
-func parseSearchEventTimeRange(runtime *common.RuntimeContext) (string, string, error) {
-	startInput := strings.TrimSpace(runtime.Str("start"))
-	endInput := strings.TrimSpace(runtime.Str("end"))
-	if startInput == "" && endInput == "" {
-		return "", "", nil
-	}
-
-	var startSec, endSec int64
-
-	if startInput != "" {
-		ts, err := common.ParseTime(startInput)
-		if err != nil {
-			return "", "", errs.NewValidationError(errs.SubtypeInvalidArgument, "--start: %v", err).WithParam("--start")
-		}
-		startSec, _ = strconv.ParseInt(ts, 10, 64)
-	}
-	if endInput != "" {
-		ts, err := common.ParseTime(endInput, "end")
-		if err != nil {
-			return "", "", errs.NewValidationError(errs.SubtypeInvalidArgument, "--end: %v", err).WithParam("--end")
-		}
-		endSec, _ = strconv.ParseInt(ts, 10, 64)
-	}
-
-	if startInput == "" {
-		t := time.Unix(endSec, 0).In(time.Local)
-		startSec = time.Date(t.Year(), t.Month(), t.Day(), 0, 0, 0, 0, t.Location()).Unix()
-	}
-	if endInput == "" {
-		t := time.Unix(startSec, 0).In(time.Local)
-		endSec = time.Date(t.Year(), t.Month(), t.Day(), 23, 59, 59, 0, t.Location()).Unix()
-	}
-
-	if startSec > endSec {
-		return "", "", errs.NewValidationError(errs.SubtypeInvalidArgument, "--start must be before --end").WithParam("--start")
-	}
-
-	return time.Unix(startSec, 0).Format(time.RFC3339), time.Unix(endSec, 0).Format(time.RFC3339), nil
-}
-
-// buildSearchEventFilter builds the filter object for the search_event API.
-func buildSearchEventFilter(runtime *common.RuntimeContext, startTime, endTime string) *searchEventFilter {
-	attendeeIDs := common.SplitCSV(runtime.Str("attendee-ids"))
-
-	var userIDs, chatIDs, roomIDs []string
-	for _, id := range attendeeIDs {
-		switch {
-		case strings.HasPrefix(id, "ou_"):
-			userIDs = append(userIDs, id)
-		case strings.HasPrefix(id, "oc_"):
-			chatIDs = append(chatIDs, id)
-		case strings.HasPrefix(id, "omm_"):
-			roomIDs = append(roomIDs, id)
-		default:
-			userIDs = append(userIDs, id)
-		}
-	}
-
-	var tr *searchEventTimeRange
-	if startTime != "" || endTime != "" {
-		tr = &searchEventTimeRange{StartTime: startTime, EndTime: endTime}
-	}
-
-	if len(userIDs) == 0 && len(chatIDs) == 0 && len(roomIDs) == 0 && tr == nil {
-		return nil
-	}
-	return &searchEventFilter{
-		AttendeeUserIDs: userIDs,
-		AttendeeChatIDs: chatIDs,
-		MeetingRoomIDs:  roomIDs,
-		TimeRange:       tr,
-	}
-}
-
-// extractTimeInfo extracts time info from a meta_data start/end map.
-func extractTimeInfo(m map[string]any) *searchEventTimeInfo {
-	if m == nil {
-		return nil
-	}
-	info := &searchEventTimeInfo{}
-	if v, ok := m["date"].(string); ok && v != "" {
-		info.Date = v
-	}
-	if v, ok := m["date_time"].(string); ok && v != "" {
-		info.DateTime = v
-	}
-	if v, ok := m["timezone"].(string); ok && v != "" {
-		info.Timezone = v
-	}
-	if info.Date == "" && info.DateTime == "" {
-		return nil
-	}
-	return info
-}
-
-// CalendarSearchEvent searches calendar events by keyword, time range, and attendees.
-var CalendarSearchEvent = common.Shortcut{
-	Service:     "calendar",
-	Command:     "+search-event",
-	Description: "Search calendar events by keyword, time range, and attendees",
-	Risk:        "read",
-	Scopes:      []string{"calendar:calendar.event:read"},
-	AuthTypes:   []string{"user"},
-	HasFormat:   true,
-	Flags: []common.Flag{
-		{Name: "calendar-id", Desc: "calendar ID (default: primary)"},
-		{Name: "query", Desc: "search keyword"},
-		{Name: "attendee-ids", Desc: "attendee IDs, comma-separated (supports user ou_, chat oc_, room omm_)"},
-		{Name: "start", Desc: "search time range start (ISO 8601 or YYYY-MM-DD)"},
-		{Name: "end", Desc: "search time range end (ISO 8601 or YYYY-MM-DD)"},
-		{Name: "page-token", Desc: "page token for next page"},
-		{Name: "page-size", Default: "20", Desc: "page size, 1-30 (default 20)"},
-	},
-	Validate: func(ctx context.Context, runtime *common.RuntimeContext) error {
-		if err := rejectCalendarAutoBotFallback(runtime); err != nil {
-			return err
-		}
-		if _, _, err := parseSearchEventTimeRange(runtime); err != nil {
-			return err
-		}
-		if _, err := common.ValidatePageSizeTyped(runtime, "page-size", defaultSearchEventPageSize, 1, maxSearchEventPageSize); err != nil {
-			return err
-		}
-		return nil
-	},
-	DryRun: func(ctx context.Context, runtime *common.RuntimeContext) *common.DryRunAPI {
-		calendarID := runtime.Str("calendar-id")
-		if calendarID == "" {
-			calendarID = "<primary>"
-		}
-		return common.NewDryRunAPI().
-			POST(fmt.Sprintf("/open-apis/calendar/v4/calendars/%s/events/search_event", calendarID)).
-			Set("calendar_id", calendarID)
-	},
-	Execute: func(ctx context.Context, runtime *common.RuntimeContext) error {
-		calendarID := strings.TrimSpace(runtime.Str("calendar-id"))
-		if calendarID == "" {
-			calendarID = PrimaryCalendarIDStr
-		}
-
-		startTime, endTime, err := parseSearchEventTimeRange(runtime)
-		if err != nil {
-			return err
-		}
-
-		// Build request body — always send query (even if empty)
-		body := &searchEventRequestBody{
-			Query: strings.TrimSpace(runtime.Str("query")),
-		}
-		if filter := buildSearchEventFilter(runtime, startTime, endTime); filter != nil {
-			body.Filter = filter
-		}
-
-		// Build query params
-		params := map[string]any{}
-		pageSize, _ := strconv.Atoi(strings.TrimSpace(runtime.Str("page-size")))
-		if pageSize <= 0 {
-			pageSize = defaultSearchEventPageSize
-		}
-		params["page_size"] = strconv.Itoa(pageSize)
-		if pt := strings.TrimSpace(runtime.Str("page-token")); pt != "" {
-			params["page_token"] = pt
-		}
-
-		data, err := runtime.CallAPITyped("POST",
-			fmt.Sprintf("/open-apis/calendar/v4/calendars/%s/events/search_event", validate.EncodePathSegment(calendarID)),
-			params, body)
-		if err != nil {
-			return err
-		}
-		if data == nil {
-			data = map[string]any{}
-		}
-
-		items := common.GetSlice(data, "items")
-		hasMore, _ := data["has_more"].(bool)
-		pageToken, _ := data["page_token"].(string)
-
-		// Transform items to structured output
-		outItems := make([]searchEventItem, 0, len(items))
-		for _, raw := range items {
-			item, _ := raw.(map[string]any)
-			if item == nil {
-				continue
-			}
-			meta, _ := item["meta_data"].(map[string]any)
-			out := searchEventItem{}
-			if meta != nil {
-				if v, ok := meta["event_id"].(string); ok {
-					out.EventID = v
-				}
-				if v, ok := meta["summary"].(string); ok {
-					out.Summary = v
-				}
-				if v, ok := meta["is_all_day"].(bool); ok {
-					out.IsAllDay = v
-				}
-				if v, ok := meta["app_link"].(string); ok {
-					out.AppLink = v
-				}
-				if start, ok := meta["start"].(map[string]any); ok {
-					out.Start = extractTimeInfo(start)
-				}
-				if end, ok := meta["end"].(map[string]any); ok {
-					out.End = extractTimeInfo(end)
-				}
-			}
-			outItems = append(outItems, out)
-		}
-
-		outData := searchEventOutput{
-			CalendarID: calendarID,
-			Items:      outItems,
-			HasMore:    hasMore,
-			PageToken:  pageToken,
-		}
-
-		runtime.OutFormat(outData, &output.Meta{Count: len(outItems)}, func(w io.Writer) {
-			if len(outItems) == 0 {
-				fmt.Fprintln(w, "No events found.")
-				return
-			}
-			var rows []map[string]interface{}
-			for _, item := range outItems {
-				row := map[string]interface{}{
-					"event_id": item.EventID,
-					"summary":  common.TruncateStr(item.Summary, 40),
-				}
-				if item.Start != nil {
-					if item.Start.DateTime != "" {
-						row["start"] = item.Start.DateTime
-					} else if item.Start.Date != "" {
-						row["start"] = item.Start.Date
-					}
-				}
-				if item.End != nil {
-					if item.End.DateTime != "" {
-						row["end"] = item.End.DateTime
-					} else if item.End.Date != "" {
-						row["end"] = item.End.Date
-					}
-				}
-				if item.IsAllDay {
-					row["is_all_day"] = true
-				}
-				rows = append(rows, row)
-			}
-			output.PrintTable(w, rows)
-			fmt.Fprintf(w, "\n%d event(s) found\n", len(outItems))
-		})
-
-		if hasMore && runtime.Format != "json" && runtime.Format != "" {
-			fmt.Fprintf(runtime.IO().Out, "\n(more available, page_token: %s)\n", pageToken)
-		}
-		return nil
-	},
-}
--- a/shortcuts/calendar/calendar_test.go
+++ b/shortcuts/calendar/calendar_test.go
@@ -2234,10 +2234,10 @@ func TestResolveStartEnd_ExplicitValues(t *testing.T) {
 // Shortcuts() registration test
 // ---------------------------------------------------------------------------

-func TestShortcuts_Returns9(t *testing.T) {
+func TestShortcuts_Returns7(t *testing.T) {
 	shortcuts := Shortcuts()
-	if len(shortcuts) != 9 {
-		t.Fatalf("expected 9 shortcuts, got %d", len(shortcuts))
+	if len(shortcuts) != 7 {
+		t.Fatalf("expected 7 shortcuts, got %d", len(shortcuts))
 	}

 	names := map[string]bool{}
--- a/shortcuts/calendar/errors.go
+++ b/shortcuts/calendar/errors.go
@@ -42,30 +42,3 @@ func withParam(err error, flag string) error {
 	}
 	return err
 }
-
-// unwrapCalendarAPIError returns a user-facing message extracted from a
-// calendar business-domain *errs.APIError, or "" when the error is not an
-// APIError or its Code is not specialized here. Callers should fall back to
-// err.Error() on "".
-//
-// Today it handles:
-//   - 190014 (invalid_parameters): returns Problem.Hint, which carries the
-//     server-supplied field-level detail (e.g. "end_time should be later
-//     than start_time") lifted by errclass.BuildAPIError.
-//
-// Add additional 19xxxx codes here as they become worth surfacing — keep this
-// the single switch site so call sites stay readable.
-func unwrapCalendarAPIError(err error) string {
-	if err == nil {
-		return ""
-	}
-	var ae *errs.APIError
-	if !errors.As(err, &ae) {
-		return ""
-	}
-	switch ae.Code {
-	case 190014:
-		return ae.Hint
-	}
-	return ""
-}
--- a/shortcuts/calendar/errors_attribution_test.go
+++ b/shortcuts/calendar/errors_attribution_test.go
@@ -240,62 +240,3 @@ func TestParseCalendarAttendeeIDs_Valid(t *testing.T) {
 		t.Errorf("dedup/trim failed: got %v", ids)
 	}
 }
-
-// ---------------------------------------------------------------------------
-// unwrapCalendarAPIError helper
-// ---------------------------------------------------------------------------
-
-func TestUnwrapCalendarAPIError_NilReturnsEmpty(t *testing.T) {
-	if got := unwrapCalendarAPIError(nil); got != "" {
-		t.Errorf("nil err should return empty string, got %q", got)
-	}
-}
-
-func TestUnwrapCalendarAPIError_NonAPIErrorReturnsEmpty(t *testing.T) {
-	// Validation, internal, and plain errors are not calendar API business
-	// errors; the helper must signal "no specialization" so callers fall back.
-	cases := []error{
-		errs.NewValidationError(errs.SubtypeInvalidArgument, "bad input"),
-		errs.NewInternalError(errs.SubtypeSDKError, "io failure"),
-		errors.New("plain error"),
-	}
-	for _, e := range cases {
-		if got := unwrapCalendarAPIError(e); got != "" {
-			t.Errorf("unwrapCalendarAPIError(%T) = %q, want empty", e, got)
-		}
-	}
-}
-
-func TestUnwrapCalendarAPIError_Code190014_ReturnsHint(t *testing.T) {
-	ae := errs.NewAPIError(errs.SubtypeInvalidParameters, "invalid params").
-		WithCode(190014).
-		WithHint("end_time should be later than start_time")
-	got := unwrapCalendarAPIError(ae)
-	if got != "end_time should be later than start_time" {
-		t.Errorf("expected lifted hint, got %q", got)
-	}
-}
-
-func TestUnwrapCalendarAPIError_Code190014_WrappedStillResolves(t *testing.T) {
-	// withStepContext wraps the typed error but errors.As must still find it.
-	inner := errs.NewAPIError(errs.SubtypeInvalidParameters, "invalid params").
-		WithCode(190014).
-		WithHint("calendar_id is required")
-	wrapped := withStepContext(inner, "while fetching meeting info for %s", "evt_x")
-	got := unwrapCalendarAPIError(wrapped)
-	if !strings.Contains(got, "calendar_id is required") {
-		t.Errorf("expected wrapped 190014 to surface hint, got %q", got)
-	}
-}
-
-func TestUnwrapCalendarAPIError_UnhandledCodeReturnsEmpty(t *testing.T) {
-	// An APIError carrying a code that isn't specialized here should return
-	// "" so callers fall back to err.Error() — keeps the helper conservative
-	// while we add 19xxxx codes incrementally.
-	ae := errs.NewAPIError(errs.SubtypeInvalidParameters, "some other error").
-		WithCode(190099).
-		WithHint("ignore me")
-	if got := unwrapCalendarAPIError(ae); got != "" {
-		t.Errorf("unhandled code should return empty, got %q", got)
-	}
-}
--- a/shortcuts/calendar/shortcuts.go
+++ b/shortcuts/calendar/shortcuts.go
@@ -15,7 +15,5 @@ func Shortcuts() []common.Shortcut {
 		CalendarRoomFind,
 		CalendarRsvp,
 		CalendarSuggestion,
-		CalendarMeeting,
-		CalendarSearchEvent,
 	}
 }
--- a/shortcuts/common/artifact_path.go
+++ b/shortcuts/common/artifact_path.go
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: MIT

 // This file defines artifact-path conventions shared between
-// `minutes +download` and `minutes +detail`. Callers outside those two shortcuts
+// `minutes +download` and `vc +notes`. Callers outside those two shortcuts
 // should not take a dependency on these symbols.

 package common
--- a/shortcuts/doc/doc_errors_test.go
+++ b/shortcuts/doc/doc_errors_test.go
@@ -203,13 +203,6 @@ func TestValidateCreateV2Contract(t *testing.T) {
 	}
 }

-func TestValidateCreateV2AllowsTitleWithoutContent(t *testing.T) {
-	rt := docValidateRuntime(t, map[string]string{"title": "Only Title"}, nil, nil)
-	if err := validateCreateV2(context.Background(), rt); err != nil {
-		t.Fatalf("validateCreateV2() error = %v, want nil", err)
-	}
-}
-
 func TestValidateFetchV2Contract(t *testing.T) {
 	cases := []struct {
 		name       string
--- a/shortcuts/doc/docs_create_test.go
+++ b/shortcuts/doc/docs_create_test.go
@@ -90,6 +90,7 @@ func TestDocsCreateV2BotAutoGrantSkippedWithoutCurrentUser(t *testing.T) {

 	err := runDocsCreateShortcut(t, f, stdout, []string{
 		"+create",
+		"--api-version", "v2",
 		"--content", "<title>内容</title><p>正文</p>",
 		"--as", "bot",
 	})
@@ -124,6 +125,7 @@ func TestDocsCreateV2UserSkipsPermissionGrantAugmentation(t *testing.T) {

 	err := runDocsCreateShortcut(t, f, stdout, []string{
 		"+create",
+		"--api-version", "v2",
 		"--content", "<title>内容</title><p>正文</p>",
 		"--as", "user",
 	})
@@ -161,6 +163,7 @@ func TestDocsCreateV2BotAutoGrantFailureDoesNotFailCreate(t *testing.T) {

 	err := runDocsCreateShortcut(t, f, stdout, []string{
 		"+create",
+		"--api-version", "v2",
 		"--content", "<title>内容</title><p>正文</p>",
 		"--as", "bot",
 	})
@@ -198,6 +201,7 @@ func TestDocsCreateV2FallbackURLWhenBackendOmitsIt(t *testing.T) {

 	err := runDocsCreateShortcut(t, f, stdout, []string{
 		"+create",
+		"--api-version", "v2",
 		"--content", "<title>内容</title><p>正文</p>",
 		"--as", "user",
 	})
@@ -229,6 +233,7 @@ func TestDocsCreateV2PreservesBackendURL(t *testing.T) {

 	err := runDocsCreateShortcut(t, f, stdout, []string{
 		"+create",
+		"--api-version", "v2",
 		"--content", "<title>内容</title><p>正文</p>",
 		"--as", "user",
 	})
@@ -243,7 +248,7 @@ func TestDocsCreateV2PreservesBackendURL(t *testing.T) {
 	}
 }

-func TestDocsCreateAPIVersionCompatFlagIsIgnored(t *testing.T) {
+func TestDocsCreateAPIVersionV1StillUsesV2Endpoint(t *testing.T) {
 	t.Parallel()

 	f, stdout, _, reg := cmdutil.TestFactory(t, docsCreateTestConfig(t, ""))
@@ -257,7 +262,7 @@ func TestDocsCreateAPIVersionCompatFlagIsIgnored(t *testing.T) {

 	err := runDocsCreateShortcut(t, f, stdout, []string{
 		"+create",
-		"--api-version", "legacy",
+		"--api-version", "v1",
 		"--content", "<title>项目计划</title>",
 		"--as", "user",
 	})
@@ -277,6 +282,7 @@ func TestDocsCreateRejectsLegacyV1Flags(t *testing.T) {
 	f, stdout, _, _ := cmdutil.TestFactory(t, docsCreateTestConfig(t, ""))
 	err := runDocsCreateShortcut(t, f, stdout, []string{
 		"+create",
+		"--title", "项目计划",
 		"--markdown", "## 目标",
 		"--as", "user",
 	})
@@ -286,7 +292,8 @@ func TestDocsCreateRejectsLegacyV1Flags(t *testing.T) {
 	for _, want := range []string{
 		"docs +create is v2-only",
 		"the old v1 interface has been shut down",
-		"legacy v1 flag(s) --markdown are no longer supported",
+		"legacy v1 flag(s) --title, --markdown are no longer supported",
+		"--title -> put the title in --content",
 		"--markdown -> use --content with --doc-format markdown",
 		"lark-cli skills read lark-doc references/lark-doc-create.md",
 		"lark-cli skills read lark-doc references/lark-doc-xml.md",
--- a/shortcuts/doc/docs_create_v2.go
+++ b/shortcuts/doc/docs_create_v2.go
@@ -4,9 +4,7 @@
 package doc

 import (
-	"bytes"
 	"context"
-	"encoding/xml"
 	"strings"

 	"github.com/larksuite/cli/errs"
@@ -16,7 +14,6 @@ import (
 // v2CreateFlags returns the flag definitions for the v2 (OpenAPI) create path.
 func v2CreateFlags() []common.Flag {
 	return []common.Flag{
-		{Name: "title", Desc: "document title; when provided, the CLI prepends it to --content as <title>...</title> so the title wins over later content titles"},
 		{Name: "content", Desc: "document body; XML by default or Markdown when --doc-format markdown. " + docsContentSkillHelp + "; use --help for the latest command flags", Input: []string{common.File, common.Stdin}},
 		{Name: "doc-format", Desc: "content format; xml is default and supports richer DocxXML blocks, markdown imports plain Markdown", Default: "xml", Enum: []string{"xml", "markdown"}},
 		{Name: "parent-token", Desc: "parent folder token or wiki node token; mutually exclusive with --parent-position"},
@@ -28,12 +25,8 @@ func validateCreateV2(_ context.Context, runtime *common.RuntimeContext) error {
 	if err := validateDocsV2Only(runtime, "+create", docsCreateLegacyFlags()); err != nil {
 		return err
 	}
-	title := strings.TrimSpace(runtime.Str("title"))
-	if runtime.Changed("title") && title == "" {
-		return errs.NewValidationError(errs.SubtypeInvalidArgument, "--title must not be empty").WithParam("--title")
-	}
-	if runtime.Str("content") == "" && title == "" {
-		return errs.NewValidationError(errs.SubtypeInvalidArgument, "--content is required unless --title is provided").WithParam("--content")
+	if runtime.Str("content") == "" {
+		return errs.NewValidationError(errs.SubtypeInvalidArgument, "--content is required").WithParam("--content")
 	}
 	if runtime.Str("parent-token") != "" && runtime.Str("parent-position") != "" {
 		return errs.NewValidationError(errs.SubtypeInvalidArgument, "--parent-token and --parent-position are mutually exclusive").WithParams(
@@ -73,7 +66,7 @@ func executeCreateV2(_ context.Context, runtime *common.RuntimeContext) error {
 func buildCreateBody(runtime *common.RuntimeContext) map[string]interface{} {
 	body := map[string]interface{}{
 		"format":  runtime.Str("doc-format"),
-		"content": buildCreateContent(runtime),
+		"content": runtime.Str("content"),
 	}
 	if v := runtime.Str("parent-token"); v != "" {
 		body["parent_token"] = v
@@ -85,26 +78,6 @@ func buildCreateBody(runtime *common.RuntimeContext) map[string]interface{} {
 	return body
 }

-func buildCreateContent(runtime *common.RuntimeContext) string {
-	content := runtime.Str("content")
-	title := strings.TrimSpace(runtime.Str("title"))
-	if title == "" {
-		return content
-	}
-
-	titleTag := "<title>" + escapeDocTitleText(title) + "</title>"
-	if content == "" {
-		return titleTag
-	}
-	return titleTag + "\n" + content
-}
-
-func escapeDocTitleText(title string) string {
-	var buf bytes.Buffer
-	_ = xml.EscapeText(&buf, []byte(title))
-	return buf.String()
-}
-
 // augmentDocsCreatePermission grants full_access to the current CLI user when
 // the document was created with bot identity.
 func augmentDocsCreatePermission(runtime *common.RuntimeContext, data map[string]interface{}) {
--- a/shortcuts/doc/docs_fetch_v2_test.go
+++ b/shortcuts/doc/docs_fetch_v2_test.go
@@ -7,7 +7,6 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"fmt"
 	"reflect"
 	"strings"
 	"testing"
@@ -44,23 +43,6 @@ func TestBuildCreateBodyIncludesSceneFromContext(t *testing.T) {
 	}
 }

-func TestBuildCreateBodyPrependsTitleToContent(t *testing.T) {
-	t.Parallel()
-
-	runtime := newCreateBodyTestRuntime(context.Background())
-	if err := runtime.Cmd.Flags().Set("title", "A & B <C>"); err != nil {
-		t.Fatalf("set title: %v", err)
-	}
-	if err := runtime.Cmd.Flags().Set("content", "## Body"); err != nil {
-		t.Fatalf("set content: %v", err)
-	}
-
-	body := buildCreateBody(runtime)
-	if got, want := body["content"], "<title>A &amp; B &lt;C&gt;</title>\n## Body"; got != want {
-		t.Fatalf("content = %#v, want %q", got, want)
-	}
-}
-
 func TestBuildUpdateBodyIncludesSceneFromContext(t *testing.T) {
 	t.Parallel()

@@ -508,10 +490,10 @@ func TestDocsFetchDryRunDefaultsToV2Endpoint(t *testing.T) {
 	}
 }

-func TestDocsFetchAPIVersionCompatFlagIsIgnored(t *testing.T) {
+func TestDocsFetchAPIVersionV1StillUsesV2Endpoint(t *testing.T) {
 	t.Parallel()

-	runtime := newFetchShortcutTestRuntime(t, "legacy", nil)
+	runtime := newFetchShortcutTestRuntime(t, "v1", nil)
 	if err := validateFetchV2(context.Background(), runtime); err != nil {
 		t.Fatalf("validateFetchV2() error = %v", err)
 	}
@@ -806,48 +788,20 @@ func TestDocsFetchRejectsLegacyFlags(t *testing.T) {

 func newFetchBodyTestRuntime(ctx context.Context) *common.RuntimeContext {
 	cmd := &cobra.Command{Use: "+fetch"}
-	cmd.Flags().String("doc-format", fetchDefault("doc-format"), "")
-	cmd.Flags().String("detail", fetchDefault("detail"), "")
-	cmd.Flags().String("lang", fetchDefault("lang"), "")
-	cmd.Flags().Int("revision-id", fetchDefaultInt("revision-id"), "")
-	cmd.Flags().String("scope", fetchDefault("scope"), "")
-	cmd.Flags().String("start-block-id", fetchDefault("start-block-id"), "")
-	cmd.Flags().String("end-block-id", fetchDefault("end-block-id"), "")
-	cmd.Flags().String("keyword", fetchDefault("keyword"), "")
-	cmd.Flags().Int("context-before", fetchDefaultInt("context-before"), "")
-	cmd.Flags().Int("context-after", fetchDefaultInt("context-after"), "")
-	cmd.Flags().Int("max-depth", fetchDefaultInt("max-depth"), "")
+	cmd.Flags().String("doc-format", "xml", "")
+	cmd.Flags().String("detail", "simple", "")
+	cmd.Flags().String("lang", "", "")
+	cmd.Flags().Int("revision-id", -1, "")
+	cmd.Flags().String("scope", "full", "")
+	cmd.Flags().String("start-block-id", "", "")
+	cmd.Flags().String("end-block-id", "", "")
+	cmd.Flags().String("keyword", "", "")
+	cmd.Flags().Int("context-before", 0, "")
+	cmd.Flags().Int("context-after", 0, "")
+	cmd.Flags().Int("max-depth", -1, "")
 	return common.TestNewRuntimeContextWithCtx(ctx, cmd, nil)
 }

-// fetchDefault returns the declared default for a flag from the real
-// v2FetchFlags definition so tests don't hardcode a stale default.
-// It panics if the flag is not found, since a missing flag indicates
-// a test setup error rather than a runtime condition.
-func fetchDefault(name string) string {
-	for _, fl := range v2FetchFlags() {
-		if fl.Name == name {
-			return fl.Default
-		}
-	}
-	panic(fmt.Sprintf("fetchDefault: flag %q not found in v2FetchFlags", name))
-}
-
-// fetchDefaultInt returns the declared default for an int flag from
-// v2FetchFlags, parsed as an int. It panics if the flag is not found
-// or its default cannot be parsed as an int.
-func fetchDefaultInt(name string) int {
-	s := fetchDefault(name)
-	if s == "" {
-		return 0
-	}
-	var d int
-	if _, err := fmt.Sscanf(s, "%d", &d); err != nil {
-		panic(fmt.Sprintf("fetchDefaultInt: flag %q default %q is not an int", name, s))
-	}
-	return d
-}
-
 func mustSetFetchFlag(t *testing.T, runtime *common.RuntimeContext, name, value string) {
 	t.Helper()

@@ -862,17 +816,17 @@ func newFetchShortcutTestRuntime(t *testing.T, apiVersion string, setFlags map[s
 	cmd := &cobra.Command{Use: "+fetch"}
 	cmd.Flags().String("api-version", "", "")
 	cmd.Flags().String("doc", "doxcnFetchDryRun", "")
-	cmd.Flags().String("doc-format", fetchDefault("doc-format"), "")
-	cmd.Flags().String("detail", fetchDefault("detail"), "")
-	cmd.Flags().String("lang", fetchDefault("lang"), "")
-	cmd.Flags().Int("revision-id", fetchDefaultInt("revision-id"), "")
-	cmd.Flags().String("scope", fetchDefault("scope"), "")
-	cmd.Flags().String("start-block-id", fetchDefault("start-block-id"), "")
-	cmd.Flags().String("end-block-id", fetchDefault("end-block-id"), "")
-	cmd.Flags().String("keyword", fetchDefault("keyword"), "")
-	cmd.Flags().Int("context-before", fetchDefaultInt("context-before"), "")
-	cmd.Flags().Int("context-after", fetchDefaultInt("context-after"), "")
-	cmd.Flags().Int("max-depth", fetchDefaultInt("max-depth"), "")
+	cmd.Flags().String("doc-format", "xml", "")
+	cmd.Flags().String("detail", "simple", "")
+	cmd.Flags().String("lang", "", "")
+	cmd.Flags().Int("revision-id", -1, "")
+	cmd.Flags().String("scope", "full", "")
+	cmd.Flags().String("start-block-id", "", "")
+	cmd.Flags().String("end-block-id", "", "")
+	cmd.Flags().String("keyword", "", "")
+	cmd.Flags().Int("context-before", 0, "")
+	cmd.Flags().Int("context-after", 0, "")
+	cmd.Flags().Int("max-depth", -1, "")
 	cmd.Flags().String("offset", "", "")
 	cmd.Flags().String("limit", "", "")
 	if apiVersion != "" {
@@ -891,7 +845,6 @@ func newFetchShortcutTestRuntime(t *testing.T, apiVersion string, setFlags map[s
 func newCreateBodyTestRuntime(ctx context.Context) *common.RuntimeContext {
 	cmd := &cobra.Command{Use: "+create"}
 	cmd.Flags().String("doc-format", "xml", "")
-	cmd.Flags().String("title", "", "")
 	cmd.Flags().String("content", "<title>hello</title>", "")
 	cmd.Flags().String("parent-token", "", "")
 	cmd.Flags().String("parent-position", "", "")
--- a/shortcuts/doc/docs_update_test.go
+++ b/shortcuts/doc/docs_update_test.go
@@ -34,8 +34,8 @@ func TestValidCommandsV2(t *testing.T) {
 	}
 }

-func TestDocsUpdateDryRunIgnoresAPIVersionCompatFlag(t *testing.T) {
-	for _, apiVersion := range []string{"v1", "v2", "legacy"} {
+func TestDocsUpdateDryRunAcceptsDeprecatedAPIVersionValues(t *testing.T) {
+	for _, apiVersion := range []string{"v1", "v2"} {
 		t.Run(apiVersion, func(t *testing.T) {
 			t.Parallel()

--- a/shortcuts/doc/v2_only.go
+++ b/shortcuts/doc/v2_only.go
@@ -17,14 +17,15 @@ type docsLegacyFlag struct {

 func docsAPIVersionCompatFlag() common.Flag {
 	return common.Flag{
-		Name:   "api-version",
-		Desc:   "deprecated compatibility flag; ignored by docs shortcuts",
-		Hidden: true,
+		Name:    "api-version",
+		Desc:    "deprecated compatibility flag; docs shortcuts always use v2, and both v1/v2 are accepted for rollback-safe skill examples",
+		Default: "v2",
 	}
 }

 func docsCreateLegacyFlags() []docsLegacyFlag {
 	return []docsLegacyFlag{
+		{Name: "title", Replacement: "put the title in --content, for example <title>Title</title>"},
 		{Name: "markdown", Replacement: "use --content with --doc-format markdown"},
 		{Name: "folder-token", Replacement: "use --parent-token"},
 		{Name: "wiki-node", Replacement: "use --parent-token"},
@@ -54,7 +55,7 @@ func docsLegacyFlagDefinitions(flags []docsLegacyFlag) []common.Flag {
 	for _, flag := range flags {
 		out = append(out, common.Flag{
 			Name:   flag.Name,
-			Desc:   "deprecated compatibility flag; run `lark-cli skills read lark-doc` for the current CLI skill",
+			Desc:   "deprecated v1 compatibility flag; run `lark-cli skills read lark-doc` for the v2 CLI skill",
 			Hidden: true,
 		})
 	}
@@ -62,6 +63,12 @@ func docsLegacyFlagDefinitions(flags []docsLegacyFlag) []common.Flag {
 }

 func validateDocsV2Only(runtime *common.RuntimeContext, shortcut string, legacyFlags []docsLegacyFlag) error {
+	switch apiVersion := strings.TrimSpace(runtime.Str("api-version")); apiVersion {
+	case "", "v1", "v2":
+	default:
+		return docsV2OnlyError(shortcut, "--api-version is deprecated and only accepts v1 or v2; both values execute the v2 API", "--api-version")
+	}
+
 	var used []string
 	var replacements []string
 	for _, flag := range legacyFlags {
--- a/shortcuts/doc/v2_only_test.go
+++ b/shortcuts/doc/v2_only_test.go
@@ -11,8 +11,8 @@ import (
 	"github.com/spf13/cobra"
 )

-func TestValidateDocsV2OnlyIgnoresAPIVersionValues(t *testing.T) {
-	for _, apiVersion := range []string{"", "v1", "v2", "v0", "legacy"} {
+func TestValidateDocsV2OnlyAllowsDefaultAndDeprecatedAPIVersionValues(t *testing.T) {
+	for _, apiVersion := range []string{"", "v1", "v2"} {
 		t.Run(apiVersion, func(t *testing.T) {
 			runtime := docsV2OnlyTestRuntime(t, apiVersion, false)
 			if err := validateDocsV2Only(runtime, "+update", []docsLegacyFlag{{Name: "mode", Replacement: "use --command"}}); err != nil {
@@ -22,6 +22,28 @@ func TestValidateDocsV2OnlyIgnoresAPIVersionValues(t *testing.T) {
 	}
 }

+func TestValidateDocsV2OnlyRejectsUnknownAPIVersion(t *testing.T) {
+	runtime := docsV2OnlyTestRuntime(t, "v0", false)
+	err := validateDocsV2Only(runtime, "+fetch", nil)
+	if err == nil {
+		t.Fatal("expected unknown --api-version to be rejected")
+	}
+	for _, want := range []string{
+		"docs +fetch is v2-only",
+		"--api-version is deprecated and only accepts v1 or v2",
+		"both values execute the v2 API",
+		"lark-cli skills read lark-doc references/lark-doc-fetch.md",
+		"lark-cli skills read lark-doc references/lark-doc-xml.md",
+		"lark-cli skills read lark-doc references/lark-doc-md.md",
+		"MUST NOT grep/open local SKILL.md files",
+		"lark-cli docs +fetch --help",
+	} {
+		if !strings.Contains(err.Error(), want) {
+			t.Fatalf("error missing %q: %v", want, err)
+		}
+	}
+}
+
 func TestValidateDocsV2OnlyRejectsChangedLegacyFlags(t *testing.T) {
 	runtime := docsV2OnlyTestRuntime(t, "", true)
 	err := validateDocsV2Only(runtime, "+update", []docsLegacyFlag{{Name: "mode", Replacement: "use --command"}})
--- a/shortcuts/drive/drive_member_add.go
+++ b/shortcuts/drive/drive_member_add.go
@@ -1,686 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package drive
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net/url"
-	"strconv"
-	"strings"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/validate"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-// driveMemberAddIDTypes covers every user-facing --member-type value accepted
-// by the shortcut. Some values are normalized before hitting the API.
-var driveMemberAddIDTypes = []string{
-	"email", "openid", "unionid", "openchat", "opendepartmentid",
-	"groupid", "appid", "wikispaceid",
-}
-
-var driveMemberAddPerms = []string{"view", "edit", "full_access"}
-var driveMemberAddPermTypes = []string{"container", "single_page"}
-var driveMemberAddWikiSpaceMemberKinds = []string{"wiki_space_member", "wiki_space_viewer", "wiki_space_editor"}
-
-// driveMemberAddPrefixToType maps ID prefixes to their expected member_type
-// for conflict validation when --member-type is provided explicitly.
-var driveMemberAddPrefixToType = map[string]string{
-	"ou_": "openid",
-	"on_": "unionid",
-	"oc_": "openchat",
-	"od_": "opendepartmentid",
-}
-
-var driveMemberAddURLPathToType = []struct {
-	Prefix string
-	Type   string
-}{
-	{"/drive/folder/", "folder"},
-	{"/docx/", "docx"},
-	{"/doc/", "doc"},
-	{"/sheets/", "sheet"},
-	{"/base/", "bitable"},
-	{"/bitable/", "bitable"},
-	{"/wiki/", "wiki"},
-	{"/file/", "file"},
-	{"/mindnotes/", "mindnote"},
-	{"/slides/", "slides"},
-	{"/minutes/", "minutes"},
-}
-
-var driveMemberAddResourceTypes = []string{"docx", "doc", "sheet", "bitable", "file", "folder", "wiki", "mindnote", "slides", "minutes"}
-
-const driveMemberAddBatchLimit = 10
-
-// DriveMemberAdd adds a collaborator/member permission to a Drive resource.
-var DriveMemberAdd = common.Shortcut{
-	Service:     "drive",
-	Command:     "+member-add",
-	Description: "Add a collaborator/member permission to a Drive document, file, folder, or wiki node",
-	Risk:        "high-risk-write",
-	Scopes:      []string{"docs:permission.member:create"},
-	AuthTypes:   []string{"user", "bot"},
-	HasFormat:   true,
-	Flags: []common.Flag{
-		{Name: "token", Desc: "target token or document URL; type is auto-inferred from URL path when omitted", Required: true},
-		{Name: "type", Desc: "target resource type; required when --token is a bare token"},
-		{Name: "member-id", Desc: "collaborator ID; comma-separated for batch (max 10). Interpretation is decided by --member-type", Required: true},
-		{Name: "member-type", Desc: "ID type for --member-id; supported: email|openid|unionid|openchat|opendepartmentid|groupid|appid|wikispaceid", Required: true},
-		{Name: "member-kind", Desc: "request body type when --member-type=wikispaceid; one of wiki_space_member|wiki_space_viewer|wiki_space_editor"},
-		{Name: "perm", Desc: "permission role to grant; defaults to view"},
-		{Name: "perm-type", Desc: "wiki permission scope; defaults to container; rejected for non-wiki types"},
-		{Name: "need-notification", Type: "bool", Desc: "send an in-app notification after the grant (user identity only)"},
-	},
-	Tips: []string{
-		"Resource type is auto-inferred from URL paths; pass --type when --token is a bare token.",
-		"Supported --member-type values: email, openid, unionid, openchat, opendepartmentid, groupid, appid, wikispaceid.",
-		"When --member-type=wikispaceid, pass --member-kind wiki_space_member, wiki_space_viewer, or wiki_space_editor.",
-		"--member-type is required; if the ID prefix conflicts with --member-type (e.g. ou_xxx with email), the command rejects it.",
-		"--perm defaults to view (safest); use --dry-run first when granting edit or full_access.",
-		"For wiki nodes, --perm-type defaults to container (current page and sub-pages), except --member-type=wikispaceid where --member-kind provides the wiki-space role.",
-		"Department collaborator (--member-type=opendepartmentid) requires --as user; bot identity is not supported for department authorization.",
-	},
-	Validate: func(ctx context.Context, runtime *common.RuntimeContext) error {
-		_, err := readDriveMemberAddSpec(runtime)
-		return err
-	},
-	DryRun: func(ctx context.Context, runtime *common.RuntimeContext) *common.DryRunAPI {
-		spec, err := readDriveMemberAddSpec(runtime)
-		if err != nil {
-			return common.NewDryRunAPI().Set("error", err.Error())
-		}
-		return buildDriveMemberAddDryRun(spec)
-	},
-	Execute: func(ctx context.Context, runtime *common.RuntimeContext) error {
-		spec, err := readDriveMemberAddSpec(runtime)
-		if err != nil {
-			return err
-		}
-
-		if len(spec.MemberIDs) == 1 {
-			return executeDriveMemberAddSingle(runtime, spec)
-		}
-		return executeDriveMemberAddBatch(runtime, spec)
-	},
-}
-
-// driveMemberAddSpec is the normalized request model shared by Validate,
-// DryRun, Execute, and output shaping so they all observe the same defaults.
-type driveMemberAddSpec struct {
-	Token        string
-	ResourceType string
-	MemberIDs    []string
-	MemberType   string
-	// MemberKind is the explicit --member-kind value for member_type=wikispaceid.
-	MemberKind       string
-	Perm             string
-	PermType         string
-	NeedNotification bool
-	NotificationSet  bool
-}
-
-// DryRunParams builds the preview query string while preserving the semantic
-// difference between an omitted notification flag and an explicit false.
-func (spec driveMemberAddSpec) DryRunParams() map[string]interface{} {
-	params := map[string]interface{}{"type": spec.ResourceType}
-	if spec.NotificationSet {
-		params["need_notification"] = spec.NeedNotification
-	}
-	return params
-}
-
-// APIQueryParams builds the query params for permission.members.create.
-func (spec driveMemberAddSpec) APIQueryParams() map[string]interface{} {
-	params := map[string]interface{}{"type": spec.ResourceType}
-	if spec.NotificationSet {
-		params["need_notification"] = strconv.FormatBool(spec.NeedNotification)
-	}
-	return params
-}
-
-// buildMemberBody builds a single member object for the request body.
-func buildMemberBody(memberID, memberType, wikiSpaceMemberKind, perm, permType string) map[string]interface{} {
-	body := map[string]interface{}{
-		"member_id":   memberID,
-		"member_type": memberType,
-		"perm":        perm,
-	}
-	if bodyType := driveMemberAddBodyType(memberType, wikiSpaceMemberKind); bodyType != "" {
-		body["type"] = bodyType
-	}
-	if permType != "" {
-		body["perm_type"] = permType
-	}
-	return body
-}
-
-// readDriveMemberAddSpec parses runtime flags into a normalized request model,
-// applying inference, defaults, and cross-field validation in one place.
-func readDriveMemberAddSpec(runtime *common.RuntimeContext) (driveMemberAddSpec, error) {
-	token, resourceType, err := resolveDriveMemberAddTarget(runtime.Str("token"), runtime.Str("type"))
-	if err != nil {
-		return driveMemberAddSpec{}, err
-	}
-
-	// Parse member-id: comma-separated for batch.
-	rawMemberID := strings.TrimSpace(runtime.Str("member-id"))
-	if rawMemberID == "" {
-		return driveMemberAddSpec{}, errs.NewValidationError(errs.SubtypeInvalidArgument, "--member-id is required and cannot be blank").WithParam("--member-id")
-	}
-	memberIDs := splitAndTrimMembers(rawMemberID)
-	if len(memberIDs) == 0 {
-		return driveMemberAddSpec{}, errs.NewValidationError(errs.SubtypeInvalidArgument, "--member-id is required and must contain at least one non-blank ID").WithParam("--member-id")
-	}
-	if len(memberIDs) > driveMemberAddBatchLimit {
-		return driveMemberAddSpec{}, errs.NewValidationError(errs.SubtypeInvalidArgument, "--member-id accepts at most %d IDs, got %d", driveMemberAddBatchLimit, len(memberIDs)).WithParam("--member-id")
-	}
-	if duplicate, first, second, ok := firstDuplicateDriveMemberID(memberIDs); ok {
-		return driveMemberAddSpec{}, errs.NewValidationError(errs.SubtypeInvalidArgument,
-			"--member-id contains duplicate collaborator ID %q at positions %d and %d; remove duplicates before retrying",
-			duplicate, first+1, second+1,
-		).WithParam("--member-id")
-	}
-
-	memberType, err := resolveDriveMemberAddMemberType(memberIDs, runtime.Str("member-type"))
-	if err != nil {
-		return driveMemberAddSpec{}, err
-	}
-	memberKind, err := resolveDriveMemberAddMemberKind(memberType, runtime.Str("member-kind"))
-	if err != nil {
-		return driveMemberAddSpec{}, err
-	}
-
-	// perm: default to view.
-	perm, err := normalizeDriveMemberAddEnumValue(runtime.Str("perm"), driveMemberAddPerms, "--perm")
-	if err != nil {
-		return driveMemberAddSpec{}, err
-	}
-	if perm == "" {
-		perm = "view"
-	}
-
-	// perm-type: only meaningful for wiki; default container except for wiki-space collaborators.
-	permType, err := normalizeDriveMemberAddEnumValue(runtime.Str("perm-type"), driveMemberAddPermTypes, "--perm-type")
-	if err != nil {
-		return driveMemberAddSpec{}, err
-	}
-	if resourceType == "wiki" && memberType == "wikispaceid" {
-		if runtime.Changed("perm-type") {
-			return driveMemberAddSpec{}, errs.NewValidationError(
-				errs.SubtypeInvalidArgument,
-				"--perm-type is not supported when --member-type=wikispaceid; use --member-kind wiki_space_member|wiki_space_viewer|wiki_space_editor to set the wiki-space role",
-			).WithParam("--perm-type")
-		}
-		permType = ""
-	} else if resourceType == "wiki" && permType == "" {
-		permType = driveMemberAddDefaultPermType(resourceType)
-	} else if resourceType != "wiki" && runtime.Changed("perm-type") {
-		return driveMemberAddSpec{}, errs.NewValidationError(errs.SubtypeInvalidArgument, "--perm-type only applies when resource type is wiki; got %q", resourceType).WithParam("--perm-type")
-	} else if resourceType != "wiki" {
-		permType = ""
-	}
-
-	spec := driveMemberAddSpec{
-		Token:            token,
-		ResourceType:     resourceType,
-		MemberIDs:        memberIDs,
-		MemberType:       memberType,
-		MemberKind:       memberKind,
-		Perm:             perm,
-		PermType:         permType,
-		NeedNotification: runtime.Bool("need-notification"),
-		NotificationSet:  runtime.Changed("need-notification"),
-	}
-	if runtime.As().IsBot() && spec.NotificationSet {
-		return driveMemberAddSpec{}, errs.NewValidationError(errs.SubtypeInvalidArgument, "--need-notification is only valid with --as user; omit it when using --as bot").WithParam("--need-notification")
-	}
-	if runtime.As().IsBot() && spec.MemberType == "opendepartmentid" {
-		return driveMemberAddSpec{}, errs.NewValidationError(errs.SubtypeInvalidArgument, "--member-type=opendepartmentid requires --as user; bot identity does not support adding department collaborators").WithParam("--member-type")
-	}
-	return spec, nil
-}
-
-// resolveDriveMemberAddTarget extracts (token, type) from a user-supplied
-// --token value that may be either a bare token or a full resource URL, plus an
-// optional explicit --type. Explicit --type wins over URL inference.
-func resolveDriveMemberAddTarget(raw, explicitType string) (token, resourceType string, err error) {
-	raw = strings.TrimSpace(raw)
-	if raw == "" {
-		return "", "", errs.NewValidationError(errs.SubtypeInvalidArgument, "--token is required").WithParam("--token")
-	}
-	explicitType = strings.ToLower(strings.TrimSpace(explicitType))
-
-	if strings.Contains(raw, "://") {
-		parsed, parseErr := url.Parse(raw)
-		if parseErr != nil || parsed.Hostname() == "" {
-			return "", "", errs.NewValidationError(errs.SubtypeInvalidArgument, "--token URL is malformed: %q", raw).WithParam("--token")
-		}
-		urlToken, urlType, ok := parseDriveMemberAddResourceURLPath(parsed.Path)
-		if !ok {
-			return "", "", errs.NewValidationError(errs.SubtypeInvalidArgument,
-				"unsupported URL path %q: expected one of %s followed by a token",
-				parsed.Path, strings.Join(driveMemberAddSupportedURLPaths(), ", "),
-			).WithParam("--token")
-		}
-		token = urlToken
-		if explicitType == "" {
-			resourceType = urlType
-		}
-	} else {
-		token = raw
-	}
-
-	if explicitType != "" {
-		if !isSupportedDriveMemberAddResourceType(explicitType) {
-			return "", "", errs.NewValidationError(errs.SubtypeInvalidArgument, "--type must be one of: %s", strings.Join(driveMemberAddResourceTypes, ", ")).WithParam("--type")
-		}
-		resourceType = explicitType
-	}
-
-	if resourceType == "" {
-		return "", "", errs.NewValidationError(errs.SubtypeInvalidArgument,
-			"--type is required when --token is a bare token; accepted values: %s",
-			strings.Join(driveMemberAddResourceTypes, ", "),
-		).WithParam("--type")
-	}
-	return token, resourceType, nil
-}
-
-func driveMemberAddSupportedURLPaths() []string {
-	paths := make([]string, 0, len(driveMemberAddURLPathToType))
-	for _, mapping := range driveMemberAddURLPathToType {
-		paths = append(paths, mapping.Prefix)
-	}
-	return paths
-}
-
-func parseDriveMemberAddResourceURLPath(path string) (token, resourceType string, ok bool) {
-	for _, mapping := range driveMemberAddURLPathToType {
-		if !strings.HasPrefix(path, mapping.Prefix) {
-			continue
-		}
-		token := path[len(mapping.Prefix):]
-		token = strings.TrimRight(token, "/")
-		if idx := strings.IndexByte(token, '/'); idx >= 0 {
-			token = token[:idx]
-		}
-		token = strings.TrimSpace(token)
-		if token == "" {
-			return "", "", false
-		}
-		return token, mapping.Type, true
-	}
-	return "", "", false
-}
-
-func isSupportedDriveMemberAddResourceType(resourceType string) bool {
-	switch resourceType {
-	case "docx", "doc", "sheet", "bitable", "file", "folder", "wiki", "mindnote", "slides", "minutes":
-		return true
-	default:
-		return false
-	}
-}
-
-func resolveDriveMemberAddMemberType(memberIDs []string, explicit string) (string, error) {
-	var err error
-	explicit, err = normalizeDriveMemberAddEnumValue(explicit, driveMemberAddIDTypes, "--member-type")
-	if err != nil {
-		return "", err
-	}
-	if explicit == "" {
-		return "", errs.NewValidationError(errs.SubtypeInvalidArgument, "--member-type is required; accepted values: %s", strings.Join(driveMemberAddIDTypes, ", ")).WithParam("--member-type")
-	}
-	for i, memberID := range memberIDs {
-		if expected := inferMemberTypeFromID(memberID); expected != "" && expected != explicit {
-			return "", errs.NewValidationError(errs.SubtypeInvalidArgument,
-				"member-id[%d] %q prefix implies --member-type %s, but --member-type %s was provided; fix the ID or use the matching member type",
-				i+1, memberID, expected, explicit,
-			).WithParam("--member-id")
-		}
-	}
-	return normalizeDriveMemberAddMemberType(explicit), nil
-}
-
-func resolveDriveMemberAddMemberKind(memberType, raw string) (string, error) {
-	memberKind, err := normalizeDriveMemberAddEnumValue(raw, driveMemberAddWikiSpaceMemberKinds, "--member-kind")
-	if err != nil {
-		return "", err
-	}
-	if memberType == "wikispaceid" {
-		if memberKind == "" {
-			return "", errs.NewValidationError(
-				errs.SubtypeInvalidArgument,
-				"--member-kind is required when --member-type=wikispaceid; allowed: %s",
-				strings.Join(driveMemberAddWikiSpaceMemberKinds, ", "),
-			).WithParam("--member-kind")
-		}
-		return memberKind, nil
-	}
-	if memberKind != "" {
-		return "", errs.NewValidationError(errs.SubtypeInvalidArgument, "--member-kind only applies when --member-type=wikispaceid").WithParam("--member-kind")
-	}
-	return "", nil
-}
-
-func normalizeDriveMemberAddMemberType(memberType string) string {
-	return strings.ToLower(strings.TrimSpace(memberType))
-}
-
-func normalizeDriveMemberAddEnumValue(raw string, allowed []string, flagName string) (string, error) {
-	value := strings.TrimSpace(raw)
-	if value == "" {
-		return "", nil
-	}
-	for _, candidate := range allowed {
-		if strings.EqualFold(value, candidate) {
-			return candidate, nil
-		}
-	}
-	return "", errs.NewValidationError(
-		errs.SubtypeInvalidArgument,
-		"invalid value %q for %s, allowed: %s",
-		value,
-		flagName,
-		strings.Join(allowed, ", "),
-	).WithParam(flagName)
-}
-
-// splitAndTrimMembers splits a comma-separated member-id string and trims whitespace.
-func splitAndTrimMembers(raw string) []string {
-	parts := strings.Split(raw, ",")
-	var result []string
-	for _, p := range parts {
-		p = strings.TrimSpace(p)
-		if p != "" {
-			result = append(result, p)
-		}
-	}
-	return result
-}
-
-func firstDuplicateDriveMemberID(memberIDs []string) (duplicate string, first, second int, ok bool) {
-	seen := make(map[string]int, len(memberIDs))
-	for i, memberID := range memberIDs {
-		if prev, exists := seen[memberID]; exists {
-			return memberID, prev, i, true
-		}
-		seen[memberID] = i
-	}
-	return "", 0, 0, false
-}
-
-// inferMemberTypeFromID returns the expected member_type for a member-id
-// based on its prefix, or "" if no prefix matches (e.g. groupid).
-func inferMemberTypeFromID(memberID string) string {
-	memberID = strings.TrimSpace(memberID)
-	if memberID == "" {
-		return ""
-	}
-	if strings.Contains(memberID, "@") {
-		return "email"
-	}
-	for prefix, mtype := range driveMemberAddPrefixToType {
-		if strings.HasPrefix(memberID, prefix) {
-			return mtype
-		}
-	}
-	return ""
-}
-
-// driveMemberAddDefaultPermType returns the default perm_type for a given
-// resource type. For wiki nodes, container is the default for regular
-// collaborators. Wiki-space collaborators omit perm_type because their role is
-// carried by the body type field.
-func driveMemberAddDefaultPermType(resourceType string) string {
-	switch resourceType {
-	case "wiki":
-		return "container"
-	default:
-		return ""
-	}
-}
-
-// inferDriveMemberKind derives the request-body collaborator kind from
-// member-type for all supported member-type values.
-func inferDriveMemberKind(memberType string) string {
-	switch memberType {
-	case "email", "openid", "unionid", "userid":
-		return "user"
-	case "openchat":
-		return "chat"
-	case "opendepartmentid":
-		return "department"
-	case "groupid":
-		return "group"
-	default:
-		return ""
-	}
-}
-
-func driveMemberAddBodyType(memberType, wikiSpaceMemberKind string) string {
-	if memberType == "wikispaceid" {
-		return wikiSpaceMemberKind
-	}
-	return inferDriveMemberKind(memberType)
-}
-
-// buildDriveMemberAddDryRun renders the exact request preview for --dry-run.
-func buildDriveMemberAddDryRun(spec driveMemberAddSpec) *common.DryRunAPI {
-	if len(spec.MemberIDs) == 1 {
-		body := buildMemberBody(spec.MemberIDs[0], spec.MemberType, spec.MemberKind, spec.Perm, spec.PermType)
-		return common.NewDryRunAPI().
-			Desc("Add Drive collaborator/member permission").
-			POST(fmt.Sprintf("/open-apis/drive/v1/permissions/%s/members", validate.EncodePathSegment(spec.Token))).
-			Params(spec.DryRunParams()).
-			Body(body)
-	}
-
-	members := buildDriveMemberAddMemberBodies(spec)
-	return common.NewDryRunAPI().
-		Desc("Batch add Drive collaborator/member permissions").
-		POST(fmt.Sprintf("/open-apis/drive/v1/permissions/%s/members/batch_create", validate.EncodePathSegment(spec.Token))).
-		Params(spec.DryRunParams()).
-		Body(map[string]interface{}{"members": members})
-}
-
-// executeDriveMemberAddSingle calls the single-member create API.
-func executeDriveMemberAddSingle(runtime *common.RuntimeContext, spec driveMemberAddSpec) error {
-	fmt.Fprintf(runtime.IO().ErrOut, "Adding Drive member %s (type=%s, perm=%s) to %s %s...\n",
-		common.MaskToken(spec.MemberIDs[0]), spec.MemberType, spec.Perm, spec.ResourceType, common.MaskToken(spec.Token))
-
-	body := buildMemberBody(spec.MemberIDs[0], spec.MemberType, spec.MemberKind, spec.Perm, spec.PermType)
-	data, err := runtime.CallAPITyped(
-		"POST",
-		fmt.Sprintf("/open-apis/drive/v1/permissions/%s/members", validate.EncodePathSegment(spec.Token)),
-		spec.APIQueryParams(),
-		body,
-	)
-	if err != nil {
-		return err
-	}
-
-	out := driveMemberAddOutput(spec, spec.MemberIDs[0], common.GetMap(data, "member"))
-	fmt.Fprintf(runtime.IO().ErrOut, "Added Drive member %s\n", common.MaskToken(common.GetString(out, "member_id")))
-	runtime.Out(out, nil)
-	return nil
-}
-
-// executeDriveMemberAddBatch calls the batch_create API. A successful HTTP/API
-// response is treated as complete only when the server returns every requested
-// member_id, regardless of response array order.
-func executeDriveMemberAddBatch(runtime *common.RuntimeContext, spec driveMemberAddSpec) error {
-	members := buildDriveMemberAddMemberBodies(spec)
-
-	fmt.Fprintf(runtime.IO().ErrOut, "Adding %d Drive members (type=%s, perm=%s) to %s %s...\n",
-		len(spec.MemberIDs), spec.MemberType, spec.Perm, spec.ResourceType, common.MaskToken(spec.Token))
-
-	data, err := runtime.CallAPITyped(
-		"POST",
-		fmt.Sprintf("/open-apis/drive/v1/permissions/%s/members/batch_create", validate.EncodePathSegment(spec.Token)),
-		spec.APIQueryParams(),
-		map[string]interface{}{"members": members},
-	)
-	if err != nil {
-		return wrapDriveMemberAddBatchAPIError(err)
-	}
-
-	result := buildDriveMemberAddBatchResult(spec, data)
-	if common.GetBool(result, "partial") {
-		return runtime.OutPartialFailure(result, nil)
-	}
-
-	fmt.Fprintf(runtime.IO().ErrOut, "Added %d Drive member(s)\n", result["succeeded_count"])
-	runtime.Out(result, nil)
-	return nil
-}
-
-const (
-	driveMemberAddInvalidParameterCode = 1063001
-	driveMemberAddInvalidOperationCode = 1063003
-)
-
-func wrapDriveMemberAddBatchAPIError(err error) error {
-	var apiErr *errs.APIError
-	if !errors.As(err, &apiErr) {
-		return err
-	}
-
-	wrapped := *apiErr
-	switch apiErr.Code {
-	case driveMemberAddInvalidOperationCode:
-		wrapped.Message = "Drive batch member add failed: one or more requested members may already be collaborators on this resource"
-		wrapped.Hint = "For batch add, remove members that already have access (especially a bot/app being added again), then retry only the missing collaborators."
-	case driveMemberAddInvalidParameterCode:
-		wrapped.Message = "Drive batch member add failed: one or more requested members may be invalid for this resource or identity"
-		wrapped.Hint = "Check whether each --member-id exists, belongs to the same tenant, and is visible to the current identity; remove invalid members and retry only the valid collaborators."
-	default:
-		return err
-	}
-	wrapped.Cause = err
-	return &wrapped
-}
-
-func buildDriveMemberAddMemberBodies(spec driveMemberAddSpec) []map[string]interface{} {
-	members := make([]map[string]interface{}, len(spec.MemberIDs))
-	for i, mid := range spec.MemberIDs {
-		members[i] = buildMemberBody(mid, spec.MemberType, spec.MemberKind, spec.Perm, spec.PermType)
-	}
-	return members
-}
-
-func buildDriveMemberAddBatchResult(spec driveMemberAddSpec, data map[string]interface{}) map[string]interface{} {
-	rawMembers, _ := data["members"].([]interface{})
-
-	// Build set of requested IDs for O(1) lookup.
-	requestedSet := make(map[string]bool, len(spec.MemberIDs))
-	for _, id := range spec.MemberIDs {
-		requestedSet[id] = true
-	}
-
-	// First pass: build returned map and results array.
-	// Matching is done by member_id, not by array index, so the server may
-	// return members in any order without causing false partial_failure.
-	results := make([]map[string]interface{}, 0, len(rawMembers))
-	succeededIDs := make(map[string]bool, len(rawMembers))
-	var mismatched []map[string]interface{}
-
-	for _, raw := range rawMembers {
-		m, ok := raw.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		rawMemberID := common.GetString(m, "member_id")
-
-		out := driveMemberAddOutputWithOptions(spec, "", m, false)
-		results = append(results, out)
-
-		if rawMemberID != "" {
-			if requestedSet[rawMemberID] {
-				succeededIDs[rawMemberID] = true
-			} else {
-				mismatched = append(mismatched, map[string]interface{}{
-					"returned": rawMemberID,
-				})
-			}
-		}
-	}
-
-	// Second pass: find requested IDs missing from the response.
-	missing := make([]string, 0)
-	for _, memberID := range spec.MemberIDs {
-		if !succeededIDs[memberID] {
-			missing = append(missing, memberID)
-		}
-	}
-
-	partial := len(results) != len(spec.MemberIDs) || len(missing) > 0 || len(mismatched) > 0
-	result := map[string]interface{}{
-		"resource_token":     spec.Token,
-		"resource_type":      spec.ResourceType,
-		"requested_count":    len(spec.MemberIDs),
-		"succeeded_count":    len(succeededIDs),
-		"partial":            partial,
-		"members":            results,
-		"missing_member_ids": missing,
-	}
-	if len(mismatched) > 0 {
-		result["mismatched_member_ids"] = mismatched
-	}
-	return result
-}
-
-// driveMemberAddOutput flattens the server response into a stable envelope and
-// backfills fields from spec when the server omits them.
-func driveMemberAddOutput(spec driveMemberAddSpec, fallbackMemberID string, raw map[string]interface{}) map[string]interface{} {
-	return driveMemberAddOutputWithOptions(spec, fallbackMemberID, raw, true)
-}
-
-func driveMemberAddOutputWithOptions(spec driveMemberAddSpec, fallbackMemberID string, raw map[string]interface{}, allowDefaultMemberID bool) map[string]interface{} {
-	out := map[string]interface{}{
-		"resource_token": spec.Token,
-		"resource_type":  spec.ResourceType,
-	}
-	if raw != nil {
-		for _, key := range []string{"member_id", "member_type", "perm", "type"} {
-			if v, ok := raw[key]; ok {
-				out[key] = v
-			}
-		}
-		if spec.ResourceType == "wiki" {
-			if v, ok := raw["perm_type"]; ok {
-				out["perm_type"] = v
-			}
-		}
-	}
-	if common.GetString(out, "member_id") == "" {
-		if fallbackMemberID == "" && allowDefaultMemberID && len(spec.MemberIDs) > 0 {
-			fallbackMemberID = spec.MemberIDs[0]
-		}
-		if fallbackMemberID != "" {
-			out["member_id"] = fallbackMemberID
-		}
-	}
-	if common.GetString(out, "member_type") == "" {
-		out["member_type"] = spec.MemberType
-	}
-	if common.GetString(out, "perm") == "" {
-		out["perm"] = spec.Perm
-	}
-	if spec.PermType != "" && common.GetString(out, "perm_type") == "" {
-		out["perm_type"] = spec.PermType
-	}
-	if bodyType := driveMemberAddBodyType(spec.MemberType, spec.MemberKind); bodyType != "" && common.GetString(out, "type") == "" {
-		out["type"] = bodyType
-	}
-	if t := common.GetString(out, "type"); t != "" {
-		out["member_kind"] = t
-	}
-	delete(out, "type")
-	return out
-}
--- a/Show More
+++ b/Show More