docs: define launch policy and complete bilingual product documentation

AGENTS.md

@@ -1,5 +1,31 @@
 # AGENTS.md
 
+## Authorization decision before implementation
+
+Decision `2026-10-auth-1`: Offline perpetual entitlement plus a bounded update/feature window; no activation lease or device cap. Read the complete [local authorization decision](https://github.com/turinglambdaai/taskly/pull/60) and its Chinese counterpart before commercial, trial, update-eligibility or credential work. Record this decision revision and the source/policy SHAs actually read in the PR/handoff. Refresh at each bounded slice; existing agent conversations do not receive this change automatically. Follow the existing product contract and implementation issue; do not activate a payment gate merely because a plan exists.
+
+## Required policy discovery at each slice
+
+Before starting the next bounded slice, refresh remote state safely and re-read
+this root AGENTS file, the repository's canonical implementation handoff, and
+the current [family delivery standard](https://github.com/turinglambdaai/turinglambdaai.github.io/blob/master/docs/PRODUCT-STANDARD.md),
+[documentation language policy](https://github.com/turinglambdaai/turinglambdaai.github.io/blob/master/docs/DOCUMENTATION-LANGUAGES.md)
+and [portfolio decisions](https://github.com/turinglambdaai/turinglambdaai.github.io/blob/master/PORTFOLIO.md).
+Follow the corresponding Chinese links when preferred; both public user paths
+must express the same promises. Product-specific plans and technical protocol
+owners remain in their owning repositories.
+
+Record the repository starting SHA and the central-policy commit/revision
+actually read in the PR or handoff. A link's presence is not an acknowledgement
+that an agent has read it. Existing conversations and stale checkouts do not
+receive policy updates automatically: refresh these inputs at slice boundaries.
+Preserve other agents' dirty worktrees; use an isolated checkout when needed,
+without stashing, resetting or overwriting their work. Missing/offline policy
+inputs must be reported as unverified, not silently claimed current.
+
+Current approved launch design is in [PR #60](https://github.com/turinglambdaai/taskly/pull/60), pending its full checks and merge. The complete desktop purchase/trial/update design supersedes the old split-Pro candidates. Historical commercial notes later in this file are superseded by that design; documentation does not activate runtime restrictions or remove existing gates.
+
+
 指引给 AI agent（及开发者）：如何理解、构建、运行、改动 Taskly。
 
 ## 这是什么
@@ -98,6 +124,14 @@ taskly/
 
 ## 组合定位（Portfolio placement）
 
-- 轨道与授权：轨道 2 消费买断（消费主打）；授权形态：AGPL-3.0；商业归属：收费产品——本地 SQLite 单文件 + 三平台原生 + CLI 是真实差异，按 Things 式买断 + 更新窗收费；v0.2 还年轻，先补成熟度并按未来 Pro 边界（候选：自然语言输入、提醒/日历集成、主题）做每个功能决策。
-- 组合归属唯一权威：[PORTFOLIO.md](https://github.com/turinglambdaai/turinglambdaai.github.io/blob/master/PORTFOLIO.md)（turinglambdaai.github.io 仓库）。改归属/授权先改权威档，再同步本节。
-- 纪律：价格只进本仓 `PRICING.md`，且收费开始时才发布；README 与产品站不做价格预告。
+- 2026-10-v2：Taskly 是首个消费买断主力；完整官方桌面版，14 天试用，首购含 12 个月更新，续购可选。不把提醒、自然语言输入或 CLI 拆成多个收费项。
+- 具体价格、试用到期的数据出口与开卖门禁以 [PRICING.md](PRICING.md) 为唯一权威；此前 Pro 候选与价格发布限制均已被替代。组合策略见 [PORTFOLIO](https://github.com/turinglambdaai/turinglambdaai.github.io/blob/master/PORTFOLIO.md)。
+- 当前开发中、没有实际用户；先完成 #58 与现有 acceptance，不因此给开发预览即时加收费墙。不售未交付手机平台，不修改 AGPL 源码权利。
+
+## Documentation languages
+
+Public default documentation is English; maintain complete Chinese user paths in `*.zh-CN.md`, with reciprocal links. Update both languages when prices, quotas, installation, recovery, privacy or supported platforms change. API/protocol identifiers and commands remain unchanged; do not maintain a second normative protocol or implementation. Follow the [family language policy](https://github.com/turinglambdaai/turinglambdaai.github.io/blob/master/docs/DOCUMENTATION-LANGUAGES.md). Existing internal notes are not a claim that every document is bilingual.
+
+## Public product documentation
+
+The paired `docs/USER-GUIDE.md` / `docs/USER-GUIDE.zh-CN.md` own the public installation, first-use, data/recovery, privacy and availability path. Keep the homepage and both README entry points aligned with them when behavior changes. Detailed technical contracts and the current implementation queue retain their existing owners. Do not publish target prices, a purchase link or a ready/secure/platform claim before its release evidence exists.

PRICING.md

@@ -0,0 +1,50 @@
+# Taskly product and pricing plan
+
+**English** · [简体中文](PRICING.zh-CN.md)
+
+## Launch status and implementation boundaries
+
+- Policy version: `2026-10-v2`, 2026-10-23. The owner confirmed that every product is still in development and has no actual users. This document replaces conflicting previous pricing, early-bird and Pro proposals; there is no existing customer cohort to migrate. **Prices are launch targets, not live offers or claims that the listed features are implemented.**
+- Entitlements cover delivered platforms only. New commercial plans do not change the LICENSE of released source. Source use, modification and redistribution rights are separate from official products, updates and services.
+- Security fixes and reading, backing up or exporting your own data must not require another purchase. BYOK keys, payment-provider secrets and issuer private keys have different owners. Native hosts do not collect payment or issue credentials directly.
+
+## Decision
+
+**Consumer flagship; one purchase for the complete official desktop product**
+
+Launch target: **¥168 / US$24; optional 12-month update renewal: ¥68 / US$10**. CNY and USD are independently set regional targets, not a live exchange-rate conversion.
+
+Daily use, long-lived personal data and native interaction make Taskly a candidate for the first complete consumer product. A single complete purchase avoids maintaining an artificial Free/Pro feature matrix.
+
+## Free and paid scope
+
+Free / evaluation: Development previews remain free; this design does not add payment restrictions to existing previews. The future stable commercial edition has a full 14-day trial. After the trial, reading, searching, backups and standard-format export remain available. Reminders, natural-language entry and the CLI are part of the complete product, not separately priced extras. Source remains under AGPL-3.0.
+
+Paid: One named user, covering the complete official macOS, Windows and Linux desktop product on platforms actually delivered, with 12 months of new-version eligibility. Unreleased mobile editions, hosted sync and model usage are not bundled promises.
+
+## Purchase, trial and updates
+
+A purchase includes 12 months of new-version eligibility. Versions obtained within that update window remain usable afterwards. Optional renewal adds 12 months from `max(payment time, current updates_through)`, with no back-billing for a gap and no automatic charge. Team renewals apply to the purchased number of named seats. There is no lifetime-all-future-updates plan. One named user can use their own computers; no hardware fingerprint is collected. Offline seat limits are contractual, not real-time concurrency enforcement. A team purchase combines seats; it does not imply a collaboration cloud.
+
+A new paid tier has a full 14-day trial, then returns to the free tier. For a complete paid product, trial expiry preserves reading/search/backup/export. Offline trial state is a convenience and an agreement, not advertised as rollback-proof or impossible to reset. Do not presell codes before technical and platform gates pass. After a successful payment, Commerce issues Permit credentials idempotently. Use release time and `updates_through` for update eligibility; the current date must not suddenly invalidate an acquired version. Do not promise prompt offline refund/revocation enforcement that cannot be implemented.
+
+The target price includes no custom development, hardware procurement, certification or response-time SLA. Support is asynchronous issue handling for the purchased version, supported platforms and validated combinations; a solo maintainer must not promise round-the-clock responses. Before sales, publish refund/cancellation rules, currency/tax totals, privacy terms and support scope, and confirm them at checkout. This plan is not a substitute for final checkout terms.
+
+## Authorization decision for implementation
+
+Decision revision: `2026-10-auth-1` (2026-10-23). This selects the integration design; it does not claim that the running app already implements it. Follow Permit's [normative entitlement semantics](https://github.com/turinglambdaai/permit/blob/main/docs/entitlement-v1.md) and [framework boundary](https://github.com/turinglambdaai/permit/blob/main/docs/framework-integration.md); this document owns product policy, not a second wire protocol.
+
+- **Credential and connectivity:** use a signed Protocol v1 `entitlement` for the purchased product, verified locally through the public `permit` facade. Set `activation_required=false` and `installation_id=null`. Do not issue activation leases, require periodic online checks, bind hardware or introduce a device cap. Purchase, reissue and recovery may use Commerce online; an imported credential must work without that service.
+- **Perpetual use and update window:** `use_expires_at=null`; `updates_through` is the paid update cutoff. For the paid scope use `feature_policy="published-through"`, `features=[]` and `features_through=updates_through`. Evaluate authenticated release and feature-introduction timestamps; a manually copied future binary must not widen rights. Keep free capabilities outside this gate. An expired update window preserves eligible acquired functionality and user data; security-fix delivery needs a separately identified eligible patch path.
+- **People and teams:** use an opaque stable person subject, never an email address as the authorization key. One named user may use their own computers. Where a five-seat offer exists, Commerce records five named assignments and issues a separate one-seat entitlement per assignee; reassignment creates a new right. There is no floating/concurrent-seat promise. Offline use cannot prove that a former assignee discarded an old credential; accept that commercial risk rather than adding an undisclosed online lease.
+- **Trial, renewal and recovery:** keep the full 14-day evaluation local, outside the signed protocol; do not require signup. Preserve the free/data-access behavior described above on expiry. Renewal/reissue retains `entitlement_id`, increases `revision` and replaces the complete snapshot; the update cutoff uses `max(payment time, current updates_through)`. Idempotent payment delivery must not create extra rights or extend a window twice. Re-download/import restores the same purchase rather than consuming a device slot.
+- **Refund and trust:** record refunds and stop future issuance/download eligibility according to the published refund terms. A connected client can receive a withdrawn snapshot; an old offline perpetual credential cannot be revoked immediately. Keep issuer keys on the issuing service, public trust keys in the product, and release-signing keys separate. Store credentials through product-owned storage, redact diagnostics, and retain legitimate historical trust paths through normal key retirement.
+- **Implementation gate:** pin the Permit version and reviewed immutable Offer, map the exact product/edition/features in the existing product contract, and prove import, wrong-product rejection, signature failure, renewal replay, cutoff boundaries, service outage and post-expiry data access. Record the source/policy SHAs read and remaining platform evidence. No new payment wall is activated by this document.
+
+## Next gate before sales
+
+Complete the data recovery, feedback and installation-specific update scenarios in #58 first. Then verify post-trial reading/export, Permit import/recovery, update-window boundaries, offline operation and refund states. This documentation does not change gates in the active reminder, sync or host code.
+
+Execution entry: [issue #58](https://github.com/turinglambdaai/taskly/issues/58). Complete this bounded slice before expanding commercial features.
+
+Portfolio role and shared boundaries: [PORTFOLIO](https://github.com/turinglambdaai/turinglambdaai.github.io/blob/master/PORTFOLIO.md).

PRICING.zh-CN.md

@@ -0,0 +1,50 @@
+# Taskly 产品与收费方案
+
+[English](PRICING.md) · **简体中文**
+
+## 首发与执行边界
+
+- 本方案版本 `2026-10-v2`（2026-10-23）。用户确认所有产品仍在开发、没有实际用户；本文件替代此前冲突的定价/早鸟/Pro 设想，不存在需要迁移的现有客户群。**价格是首发目标，不表示已经开卖或已完成相应功能。**
+- 只发布已交付平台的权益；新计划不改变已经发布源码的 LICENSE。开源源码的使用/修改/再分发权与官方商品、更新和服务分别说明。
+- 修复安全漏洞、读取/备份/导出自己的数据不以再次购买作为条件。模型 key、支付渠道密钥和签发私钥各有边界，不在宿主代码里直接收款或签发。
+
+## 决策
+
+**个人效率主力；官方稳定版买断**
+
+首发目标：**¥168 / US$24；续购 12 个月更新 ¥68 / US$10**。人民币和美元是分别设定的地区目标价格，不是实时汇率换算。
+
+每天使用、数据长期积累且有原生交互差异，适合作为消费线首个完整商品；少做一套免费/Pro 功能矩阵，降低独立维护成本。
+
+## 免费与付费边界
+
+免费 / 评估：开发预览期免费，不在开发版追装收费墙。未来稳定商业版完整试用 14 天；试用结束保留读取、搜索、备份和标准格式导出。提醒、自然语言输入和 CLI 是完整产品的一部分，不再拆成零碎付费项。源码依 AGPL-3.0 提供。
+
+付费：一个命名用户，已交付的 macOS / Windows / Linux 官方完整桌面产品；含 12 个月新版本资格。不给未发布移动端、云同步或模型额度作捆绑承诺。
+
+## 买断、试用与更新
+
+首购包含 12 个月新版本资格；到期后，更新窗内已获得的版本继续使用。续购自 `max(支付时间, 当前 updates_through)` 起增加 12 个月，不追收中断月份，不自动扣款；团队续购按所购命名席位数执行。无“终身所有未来更新”方案。一个命名用户可在本人电脑使用，不采集硬件指纹；离线席位是合同约定，不宣传实时并发强制执行。团队购买只合并席位，不隐含协作云服务。
+
+新增付费层完整试用 14 天，到期回到免费层；完整买断产品试用结束保留读取/搜索/备份/导出。离线试用只作便利和约定，不宣传防回拨或不可重置。付费技术/平台门禁通过前不发预售码。支付成功后由 Commerce 幂等签发 Permit；用发行时间与 `updates_through` 判断更新资格，不能拿当前时间让已获版本突然失效。离线退款/撤销的及时性不做无法实现的承诺。
+
+无定制开发、硬件采购、认证或响应时限 SLA 包含在上述标价中。支持范围为购买版本、明确支持平台及已验证组合的异步问题处理，不能承诺一人团队全天响应。公开销售前补齐退款/取消说明、币种/税费最终价、隐私与支持范围并在结账页确认；本文件不代替最终结账条款。
+
+## 授权实施决策
+
+决策修订：`2026-10-auth-1`（2026-10-23）。这里确定接入设计，不表示当前应用已经实现。字段含义遵循 Permit 的[英文权益规范](https://github.com/turinglambdaai/permit/blob/main/docs/entitlement-v1.md)与[框架边界](https://github.com/turinglambdaai/permit/blob/main/docs/framework-integration.md)；本文件负责产品政策，不另造线协议。
+
+- **凭据与联网：**购买后签发 Protocol v1 的 `entitlement`，产品通过公开 `permit` 接口在本地验签。设 `activation_required=false`、`installation_id=null`。不发激活租约，不要求定期联网，不绑定硬件，也不增加设备上限。购买、重发和恢复可在线经过 Commerce；凭据导入后必须能够脱离该服务使用。
+- **永久使用与更新窗：**`use_expires_at=null`；`updates_through` 为已付更新截止时间。付费范围采用 `feature_policy="published-through"`、`features=[]`、`features_through=updates_through`。依据可信的发布及功能引入时间判断；手动复制新版不能扩大权益。免费能力不进入该门禁。更新窗结束仍保留已获资格的功能与用户数据；安全修复需有单独标识且具备资格的补丁交付路径。
+- **个人与团队：**主体使用稳定、不透明的 person id，不以邮箱作为授权键。一个命名用户可以在自己的电脑上使用。只有确有五席方案的产品，才由 Commerce 记录五个命名分配，并为每人单独签发一席权益；改分配产生新权益。不承诺浮动或实时并发席位。离线无法证明原使用人已删除旧凭据，接受该商业风险，不暗加在线租约。
+- **试用、续购与恢复：**完整 14 天评估使用协议外的本地试用状态，不强制注册；到期保留上文规定的免费或数据访问能力。续购或重发保持 `entitlement_id`、递增 `revision`、替换完整快照；更新窗从 `max(payment time, current updates_through)` 起算。重复支付投递不能多发权益或重复延长。重新下载或导入恢复原购买，不消耗设备名额。
+- **退款与信任：**记录退款，按公开退款条款停止后续签发或下载资格。联网客户端可收到撤回快照；已离线保存的永久凭据无法立即撤销。签发私钥只在签发服务，产品仅含公钥信任库，更新签名另用密钥。凭据存储由产品负责，诊断脱敏；正常密钥退役保留合法历史凭据的信任路径。
+- **实施门禁：**锁定 Permit 版本与经审查的不可变 Offer，在既有产品契约中映射准确的产品、版本层和功能；验证导入、错产品拒绝、验签失败、续购重放、截止边界、服务离线和到期数据访问。记录实际阅读的源码/政策 SHA 与尚缺的平台证据。本文件不启用新的收费墙。
+
+## 开卖前的下一步
+
+先完成 #58 的数据恢复、反馈与安装形态更新场景；再完成试用到期保留读取/导出、Permit 导入/恢复、更新窗边界、离线和退款状态。当前提醒/同步等活跃代码不在本次文档变更中改门禁。
+
+执行入口：[本仓 #58](https://github.com/turinglambdaai/taskly/issues/58)。先交付这个切片，再扩展商业功能。
+
+组合定位及通用边界：[PORTFOLIO 中文版](https://github.com/turinglambdaai/turinglambdaai.github.io/blob/master/PORTFOLIO.zh-CN.md)。