universal-dev-standards 6.3.2 → 6.3.3

package/bin/uds.js

@@ -247,7 +247,7 @@ program
 
 program
   .command('deps')
-  .description('Compare what you test against what your users install (published packages ship no lockfile)')
+  .description('Compare the versions you test against the versions your declared ranges resolve to')
   .option('--path <dir>', 'Directory containing package.json (default: cwd)')
   .option('--json', 'Output raw JSON')
   .option('--concurrency <n>', 'Parallel registry lookups (default: 8)')

package/bundled/locales/zh-CN/CHANGELOG.md

@@ -1,8 +1,8 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.3.2
-translation_version: 6.3.2
-last_synced: 2026-08-06
+source_version: 6.3.3
+translation_version: 6.3.3
+last_synced: 2026-08-07
 status: current
 ---
 
@@ -17,6 +17,13 @@ status: current
 
 ## [Unreleased]
 
+## [6.3.3] - 2026-08-07
+
+### Fixed
+
+- **6.3.2 改好了说明，却把说明刚刚撤回的那个主张留在它上方的标题里。** 漂移区段的标题是 `N shipped ≠ tested`——黄色，就在那段说明「出货的与测到的是否不同，取决于项目怎么出货」的 dim 文字上一行。对随产物出货 lockfile 的产物而言，出货的**就是**测到的，因此那个标题在整份报告最醒目的位置说了与事实相反的话。这正是 1.1.0 改写 Lock Strategy 条目所要根除的形状：一句误导的话，下面附一句限定。标题现在改为指出两个不一致的字段——`N tested ≠ resolves`——这是对测量结果的陈述，不是对「谁收到了它」的结论。已加测试钉住。
+- **另有两处在说同一件事，其中一处是采用者最先读到的。** `uds deps --help` 把这个命令描述为「Compare what you test against what your users install (published packages ship no lockfile)」，模块自身的摘要行则写「does what you test match what your users install?」。两者现在都改以「声明范围会解析到什么」表述。发现方式是修完标题后对整个 repo grep 已撤回的措辞——那是我自己那一轮修正漏掉的两处。
+
 ## [6.3.2] - 2026-08-06
 
 ### 修复

package/bundled/locales/zh-CN/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **语言**: [English](../../README.md) | [繁體中文](../zh-TW/README.md) | 简体中文
 
-**版本**: 6.3.2 | **发布日期**: 2026-07-31 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.3.3 | **发布日期**: 2026-07-31 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
 
 语言无关、框架无关的软件项目文档标准。通过 AI 原生工作流，确保不同技术栈之间的一致性、质量和可维护性。
 

package/bundled/locales/zh-TW/CHANGELOG.md

@@ -1,8 +1,8 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.3.2
-translation_version: 6.3.2
-last_synced: 2026-08-06
+source_version: 6.3.3
+translation_version: 6.3.3
+last_synced: 2026-08-07
 status: current
 ---
 
@@ -17,6 +17,13 @@ status: current
 
 ## [Unreleased]
 
+## [6.3.3] - 2026-08-07
+
+### Fixed
+
+- **6.3.2 改好了說明，卻把說明剛剛撤回的那個主張留在它上方的標題裡。** 漂移區段的標題是 `N shipped ≠ tested`——黃色，就在那段說明「出貨的與測到的是否不同，取決於專案怎麼出貨」的 dim 文字上一行。對隨產物出貨 lockfile 的產物而言，出貨的**就是**測到的，因此那個標題在整份報告最醒目的位置說了與事實相反的話。這正是 1.1.0 改寫 Lock Strategy 條目所要根除的形狀：一句誤導的話，下面附一句限定。標題現在改為指出兩個不一致的欄位——`N tested ≠ resolves`——這是對量測結果的陳述，不是對「誰收到了它」的結論。已加測試釘住。
+- **另有兩處在說同一件事，其中一處是採用者最先讀到的。** `uds deps --help` 把這個指令描述為「Compare what you test against what your users install (published packages ship no lockfile)」，模組自身的摘要行則寫「does what you test match what your users install?」。兩者現在都改以「宣告範圍會解析到什麼」表述。發現方式是修完標題後對整個 repo grep 已撤回的措辭——那是我自己那一輪修正漏掉的兩處。
+
 ## [6.3.2] - 2026-08-06
 
 ### 修復

package/bundled/locales/zh-TW/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **語言**: [English](../../README.md) | 繁體中文 | [简体中文](../zh-CN/README.md)
 
-**版本**: 6.3.2 | **發布日期**: 2026-07-31 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.3.3 | **發布日期**: 2026-07-31 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
 
 語言無關、框架無關的軟體專案文件標準。透過 AI 原生工作流，確保不同技術堆疊之間的一致性、品質和可維護性。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "universal-dev-standards",
-  "version": "6.3.2",
+  "version": "6.3.3",
   "description": "CLI tool for adopting Universal Development Standards",
   "keywords": [
     "documentation",

package/src/commands/deps.js

@@ -1,10 +1,17 @@
 /**
- * `uds deps` — does what you test match what your users install?
+ * `uds deps` — does what you test match what your ranges resolve to?
  * // implements XSPEC-366 R1
  *
- * A published npm package does not carry its lockfile. This compares, per
- * runtime dependency, the declared range, the version the lockfile pins, and
- * the version a consumer's install would actually resolve to.
+ * Compares, per runtime dependency, the declared range, the version the
+ * lockfile pins, and the version a fresh install would resolve that range to.
+ *
+ * It deliberately stops there. Whether a gap between the second and third
+ * numbers is already in a user's hands depends on how the project ships —
+ * a published npm package carries no lockfile, so consumers resolve the
+ * ranges themselves; an artifact that ships its lockfile (a container image,
+ * a deployed service) hands users the pinned column and meets the third one
+ * at its next lockfile regeneration. This module cannot know which applies,
+ * so it never phrases the gap as something users already have.
  *
  * See `utils/dependency-resolution.js` for why resolution goes through
  * `npm view` and why a failed lookup is never reported as agreement.
@@ -36,7 +43,14 @@ export function render(result) {
 
   if (result.drifted.length > 0) {
     lines.push('');
-    lines.push(chalk.yellow(`  ${result.drifted.length} shipped ≠ tested:`));
+    // Named after the two columns that disagree, not after a conclusion about
+    // who receives them. `shipped ≠ tested` — the wording this replaced — is
+    // false for an artifact that ships its own lockfile, where shipped IS
+    // tested. 6.3.2 rewrote the explanation below to state both readings but
+    // left this heading asserting one of them, in yellow, one line above the
+    // dim correction. That is the "misleading line with a qualification
+    // underneath it" shape that R4 rewrote the supply-chain standard to stop.
+    lines.push(chalk.yellow(`  ${result.drifted.length} tested ≠ resolves:`));
     for (const d of result.drifted) {
       lines.push(
         `    ${chalk.bold(d.name)}  ${chalk.dim(d.range)}` +

package/standards-registry.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "version": "6.3.2",
+  "version": "6.3.3",
   "lastUpdated": "2026-05-13",
   "description": "Standards registry for universal-dev-standards with integrated skills and AI-optimized formats",
   "formats": {
@@ -58,14 +58,14 @@
     "standards": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
-      "version": "6.3.2"
+      "version": "6.3.3"
     },
     "skills": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
       "localPath": "skills",
       "rawUrl": "https://raw.githubusercontent.com/AsiaOstrich/universal-dev-standards/main/skills",
-      "version": "6.3.2",
+      "version": "6.3.3",
       "note": "Skills are now included in the main repository under skills/"
     }
   },
@@ -2236,7 +2236,7 @@
       "id": "license-compliance",
       "name": "License Compliance Standards",
       "nameZh": "授權合規標準",
-      "version": "6.3.2",
+      "version": "6.3.3",
       "source": {
         "human": "core/license-compliance.md",
         "ai": "ai/standards/license-compliance.ai.yaml"
@@ -2248,7 +2248,7 @@
       "id": "verification-oracle",
       "name": "Verification Oracle Standards",
       "nameZh": "驗證 Oracle 標準",
-      "version": "6.3.2",
+      "version": "6.3.3",
       "source": {
         "human": "core/verification-oracle.md",
         "ai": "ai/standards/verification-oracle.ai.yaml"
@@ -2260,7 +2260,7 @@
       "id": "model-provenance",
       "name": "Model Provenance Policy Standards",
       "nameZh": "模型來源政策標準",
-      "version": "6.3.2",
+      "version": "6.3.3",
       "source": {
         "human": "core/model-provenance.md",
         "ai": "ai/standards/model-provenance.ai.yaml"
@@ -2272,7 +2272,7 @@
       "id": "resource-cost-boundary",
       "name": "Resource / Cost Boundary Declaration Standards",
       "nameZh": "資源／成本邊界宣告標準",
-      "version": "6.3.2",
+      "version": "6.3.3",
       "source": {
         "human": "core/resource-cost-boundary.md",
         "ai": "ai/standards/resource-cost-boundary.ai.yaml"