发布候选：整合桌面端界面与发布稳定化里程碑

docs/branch-governance.md

@@ -78,6 +78,29 @@ Meaning:
 
 Direct promotion that skips stages is discouraged and must be justified in writing.
 
+## 3.1 Unified Web and Desktop Mainline
+
+CTMS Web and Desktop are two delivery targets of the same product version. They
+share the Vue application, API contract, and product branches.
+
+Rules:
+
+- Do not create long-lived `web-dev`, `desktop-dev`, `web-release`, or
+  `desktop-release` branches.
+- Web and Desktop changes both follow `feature/*` -> `dev` -> `main` ->
+  `release`.
+- A platform-specific feature or agent task branch is allowed while work is in
+  progress, for example `feature/desktop-file-picker` or
+  `codex/desktop-menu-polish`, but it must merge back into `dev`.
+- `codex/ctms-desktop` was the temporary desktop integration branch for the
+  Tauri baseline. It is no longer a current desktop mainline. Do not commit,
+  rebase, or push new desktop work to it unless explicitly cleaning up the
+  historical branch after its accepted changes are present on `dev`.
+- Platform differences belong behind `frontend/src/runtime/`. Shared business
+  modules must not import Tauri APIs directly.
+- A release tag identifies one product source state. Web and Desktop artifacts
+  for that release must be built from the same tag and Git commit.
+
 ## 4. Branch Entry Rules
 
 ### Changes allowed into `dev`
@@ -214,6 +237,13 @@ Rules:
 - tags are created on `release`, not on `dev`
 - a tag must point to the exact production release commit
 - patch hotfixes on `release` should increment the patch version
+- Web and Desktop use the same semantic version. Do not add a separate Desktop
+  product version.
+- Desktop packaging-only rebuilds may add build metadata to the artifact name,
+  but must retain the product version and record the source commit.
+- Before creating a tag, run `cd frontend && npm run version:check`.
+- Change the shared client version with
+  `cd frontend && npm run version:set -- <version>`.
 
 ## 7. Hotfix Back-Merge Rules