universal-dev-standards 6.7.1 → 6.7.2

package/bundled/locales/zh-CN/CHANGELOG.md

@@ -1,8 +1,8 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.7.1
-translation_version: 6.7.1
-last_synced: 2026-08-17
+source_version: 6.7.2
+translation_version: 6.7.2
+last_synced: 2026-08-18
 status: current
 ---
 
@@ -17,6 +17,22 @@ status: current
 
 ## [Unreleased]
 
+## [6.7.2] - 2026-08-18
+
+### 修正
+
+- **`uds update --skills` 更新了全部内容，却永不推进版本标记。** 五个采用 repo 中有四个停在 6.6.0，而同一份 manifest 的 `skills.version` 已经是 6.7.0；唯一推进的，正是那个没装 skills 的。两次执行都 exit 0、都打印「57 succeeded」、都没打印任何失败。先前对此的判读——「有东西报告了失败而它没有浮上来」——**是错的**。探针测到 `results=57 failing=0`、registry 版本解为 `"6.7.1"`、准备写入的值也正确：**reconciler 每一步都做对了，是较晚的一次写入撤销了它。** `update.js` 在命令开头读一次 manifest，那是在 reconciler 执行之前；`updateSkillsOnly()` 随后把那份过期的内存对象写回去覆盖掉它。`updateCommandsOnly()` 有一模一样的缺陷，**它是遍历找出来的，不是撞到的**。两处现在各自重读 manifest，并且**只套用自己拥有的字段**——把整份对象复制回去，会让任何后续步骤新增的字段重蹈同一个缺陷。这件事之所以要紧，是因为该机制自己的注释写着：它存在的目的，就是让每周陈旧度侦察（读的正是这个字段）不再误报。
+- **一份列出 57 项变更、其中 55 项是无条件的计划。** skill 没有内容比对（XSPEC-382 R1），于是每次升级都重印同样的 55 行、理由完全相同，把审阅者真正需要批准的那 2 行埋在底下。现在它们折叠成一行，**而那一行写出自己折了几个**，总数不变——一个不声明自己设限的上限，读起来就像「就这些了」。摘要那行同样改为 `Update: 57 (2 changed, 55 unconditional reinstall)`；单独的 `Update: 57` 是真的，而且什么都没回答，**而决定要不要批准一次升级时读的正是摘要**。
+
+### 变更
+
+- **无条件重装的理由字符串收敛为单一导出常量**，不再是产生端一份、渲染端一份。两份副本之间的漂移在这里是无声的：折叠会单纯地停止折叠，而计划看起来与它一直以来的样子一模一样。
+
+### 测试
+
+- **为版本标记补上行为层测试，与既有的形状测试并存。** 随修正加入的回归测试断言的是源代码文本——那两个函数含有 `readManifest(projectPath)`——若有人重构成「调用它然后丢掉结果」，它仍然全绿。而这里宣称的是行为，所以 `tests/e2e/update-version-advances.test.js` 会真的跑一次安装、种下探针版本、执行 `update --apply --yes --skills`，再断言标记真的动了。已双向验过：修正在场为绿，还原缺陷为红。
+- 两份新测试都断言**正反两臂**。折叠测试会检查一般计划完全不受影响，因为只验「那 55 行不见了」的测试，对一个把所有 update 行都丢掉的渲染器也照样会过。
+
 ## [6.7.1] - 2026-08-18
 
 ### 修正

package/bundled/locales/zh-CN/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **语言**: [English](../../README.md) | [繁體中文](../zh-TW/README.md) | 简体中文
 
-**版本**: 6.7.1 | **发布日期**: 2026-08-18 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.7.2 | **发布日期**: 2026-08-18 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
 
 语言无关、框架无关的软件项目文档标准。通过 AI 原生工作流，确保不同技术栈之间的一致性、质量和可维护性。
 

package/bundled/locales/zh-CN/SECURITY.md

@@ -13,7 +13,7 @@ status: current
 <!-- UDS_SUPPORTED_VERSIONS_START -->
 | 版本 | 支持状态 |
 |------|--------|
-| 6.7.1 | ✅ 最新正式版 |
+| 6.7.2 | ✅ 最新正式版 |
 | < 6.0.0 | ❌ 已终止支持 |
 <!-- UDS_SUPPORTED_VERSIONS_END -->
 

package/bundled/locales/zh-TW/CHANGELOG.md

@@ -1,8 +1,8 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.7.1
-translation_version: 6.7.1
-last_synced: 2026-08-17
+source_version: 6.7.2
+translation_version: 6.7.2
+last_synced: 2026-08-18
 status: current
 ---
 
@@ -17,6 +17,22 @@ status: current
 
 ## [Unreleased]
 
+## [6.7.2] - 2026-08-18
+
+### 修正
+
+- **`uds update --skills` 更新了全部內容，卻永不前進版本標記。** 五個採用 repo 中有四個停在 6.6.0，而同一份 manifest 的 `skills.version` 已經是 6.7.0；唯一前進的，正是那個沒裝 skills 的。兩次執行都 exit 0、都印「57 succeeded」、都沒印任何失敗。先前對此的判讀——「有東西回報了失敗而它沒有浮上來」——**是錯的**。探針量到 `results=57 failing=0`、registry 版本解為 `"6.7.1"`、準備寫入的值也正確：**reconciler 每一步都做對了，是較晚的一次寫入撤銷了它。** `update.js` 在指令開頭讀一次 manifest，那是在 reconciler 執行之前；`updateSkillsOnly()` 隨後把那份過期的記憶體物件寫回去覆蓋掉它。`updateCommandsOnly()` 有一模一樣的缺陷，**它是走訪找出來的，不是撞到的**。兩處現在各自重讀 manifest，並且**只套用自己擁有的欄位**——把整份物件複製回去，會讓任何後續步驟新增的欄位重蹈同一個缺陷。這件事之所以要緊，是因為該機制自己的註解寫著：它存在的目的，就是讓每週陳舊度偵察（讀的正是這個欄位）不再誤報。
+- **一份列出 57 項變更、其中 55 項是無條件的計畫。** skill 沒有內容比對（XSPEC-382 R1），於是每次升級都重印同樣的 55 列、理由完全相同，把審閱者真正需要核可的那 2 列埋在底下。現在它們摺疊成一行，**而那一行寫出自己摺了幾個**，總數不變——一個不聲明自己設限的上限，讀起來就像「就這些了」。摘要那行同樣改為 `Update: 57 (2 changed, 55 unconditional reinstall)`；單獨的 `Update: 57` 是真的，而且什麼都沒回答，**而決定要不要核可一次升級時讀的正是摘要**。
+
+### 變更
+
+- **無條件重裝的理由字串收斂為單一匯出常數**，不再是產生端一份、渲染端一份。兩份副本之間的漂移在這裡是無聲的：摺疊會單純地停止摺疊，而計畫看起來與它一直以來的樣子一模一樣。
+
+### 測試
+
+- **為版本標記補上行為層測試，與既有的形狀測試並存。** 隨修正加入的迴歸測試斷言的是原始碼文字——那兩個函式含有 `readManifest(projectPath)`——若有人重構成「呼叫它然後丟掉結果」，它仍然全綠。而這裡宣稱的是行為，所以 `tests/e2e/update-version-advances.test.js` 會真的跑一次安裝、種下探針版本、執行 `update --apply --yes --skills`，再斷言標記真的動了。已雙向驗過：修正在場為綠，還原缺陷為紅。
+- 兩份新測試都斷言**正反兩臂**。摺疊測試會檢查一般計畫完全不受影響，因為只驗「那 55 列不見了」的測試，對一個把所有 update 列都丟掉的渲染器也照樣會過。
+
 ## [6.7.1] - 2026-08-18
 
 ### 修正

package/bundled/locales/zh-TW/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **語言**: [English](../../README.md) | 繁體中文 | [简体中文](../zh-CN/README.md)
 
-**版本**: 6.7.1 | **發布日期**: 2026-08-18 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.7.2 | **發布日期**: 2026-08-18 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
 
 語言無關、框架無關的軟體專案文件標準。透過 AI 原生工作流，確保不同技術堆疊之間的一致性、品質和可維護性。
 

package/bundled/locales/zh-TW/SECURITY.md

@@ -13,7 +13,7 @@ status: current
 <!-- UDS_SUPPORTED_VERSIONS_START -->
 | 版本 | 支援狀態 |
 |------|--------|
-| 6.7.1 | ✅ 最新正式版 |
+| 6.7.2 | ✅ 最新正式版 |
 | < 6.0.0 | ❌ 已終止支援 |
 <!-- UDS_SUPPORTED_VERSIONS_END -->
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "universal-dev-standards",
-  "version": "6.7.1",
+  "version": "6.7.2",
   "description": "CLI tool for adopting Universal Development Standards",
   "keywords": [
     "documentation",

package/src/commands/update.js

@@ -1933,7 +1933,26 @@ async function updateSkillsOnly(projectPath, manifest, options) {
     Object.assign(manifest.skillHashes, result.allFileHashes);
   }
 
-  writeManifest(manifest, projectPath);
+  // 🔴 Re-read before writing. `manifest` was loaded at the top of the update
+  // command, BEFORE the reconciler ran; the reconciler writes its own copy to
+  // disk — including the advanced `upstream.version` — and writing this stale
+  // object back silently reverts it.
+  //
+  // Measured 2026-08-18 with probes inside plan-executor: results=57 failing=0,
+  // registry version "6.7.1", "about to write upstream = {version:'6.7.1'}" —
+  // and the value on disk afterwards was still the old one. The reconciler did
+  // everything right and this write undid it. Both runs exited 0 and printed
+  // "57 succeeded", so a repo could be fully upgraded while its own manifest
+  // said otherwise, and the weekly staleness scout — which reads exactly
+  // `upstream.version` — kept reporting it as behind. (XSPEC-382 R5)
+  //
+  // Only the fields this function owns are carried over: copying the whole
+  // object back would reintroduce the same overwrite for any field a later
+  // step adds.
+  const freshForSkills = readManifest(projectPath) || manifest;
+  freshForSkills.skills = manifest.skills;
+  freshForSkills.skillHashes = manifest.skillHashes;
+  writeManifest(freshForSkills, projectPath);
 
   console.log();
   process.exit(0);
@@ -2040,7 +2059,28 @@ async function updateCommandsOnly(projectPath, manifest, options) {
     replaceCommandHashesForUpdatedAgents(manifest.commandHashes, result.allFileHashes);
   }
 
-  writeManifest(manifest, projectPath);
+  // 🔴 Re-read before writing. `manifest` was loaded at the top of the update
+  // command, BEFORE the reconciler ran; the reconciler writes its own copy to
+  // disk — including the advanced `upstream.version` — and writing this stale
+  // object back silently reverts it.
+  //
+  // Measured 2026-08-18 with probes inside plan-executor: results=57 failing=0,
+  // registry version "6.7.1", "about to write upstream = {version:'6.7.1'}" —
+  // and the value on disk afterwards was still the old one. The reconciler did
+  // everything right and this write undid it. Both runs exited 0 and printed
+  // "57 succeeded", so a repo could be fully upgraded while its own manifest
+  // said otherwise, and the weekly staleness scout — which reads exactly
+  // `upstream.version` — kept reporting it as behind. (XSPEC-382 R5)
+  //
+  // Only the fields this function owns are carried over: copying the whole
+  // object back would reintroduce the same overwrite for any field a later
+  // step adds.
+  // Found by traversal, not by hitting it: the same shape existed here, and
+  // fixing only the instance I ran into would have left the class open.
+  const freshForCommands = readManifest(projectPath) || manifest;
+  freshForCommands.commands = manifest.commands;
+  freshForCommands.commandHashes = manifest.commandHashes;
+  writeManifest(freshForCommands, projectPath);
 
   console.log();
   process.exit(0);

package/src/reconciler/diff-engine.js

@@ -39,6 +39,17 @@
  * @param {boolean} [options.force=false] - Force update even if hashes match
  * @returns {ReconciliationPlan}
  */
+/**
+ * The reason attached to every skill/command action, because no content
+ * comparison is implemented for them (XSPEC-382 R1).
+ *
+ * Exported and referenced by `formatPlan` rather than spelled out twice: two
+ * copies of a string are two things that can drift, and the drift here is
+ * silent — the collapse would just stop collapsing and the plan would go back
+ * to listing all 57 rows, which is indistinguishable from "it always did that".
+ */
+export const UNCONDITIONAL_REINSTALL_REASON = 'no hash available for comparison, re-installing';
+
 export function computeDiff(desired, actual, options = {}) {
   const { force = false } = options;
   const actions = [];
@@ -138,7 +149,7 @@ function diffCategory(desiredMap, actualMap, category, actions, warnings, summar
           type: 'update',
           category,
           path: desiredEntry.relativePath,
-          reason: 'no hash available for comparison, re-installing',
+          reason: UNCONDITIONAL_REINSTALL_REASON,
           details: {
             sourcePath: desiredEntry.sourcePath,
             metadata: desiredEntry.metadata
@@ -339,6 +350,14 @@ export function formatPlan(plan) {
     (grouped[action.type] || []).push(action);
   }
 
+  // XSPEC-382 R3/R4 — how many updates are unconditional reinstalls rather than
+  // real changes. Computed once here because both the Update section and the
+  // Summary need it, and a reader of the Summary alone must not be left with a
+  // number that answers nothing: `Update: 57` is true and useless.
+  const unconditionalCount = grouped.update.filter(
+    (a) => a.reason === UNCONDITIONAL_REINSTALL_REASON
+  ).length;
+
   if (grouped.create.length > 0) {
     lines.push(`+ Create (${grouped.create.length}):`);
     for (const a of grouped.create) {
@@ -348,10 +367,30 @@ export function formatPlan(plan) {
   }
 
   if (grouped.update.length > 0) {
+    // XSPEC-382 R3 — collapse the unconditional reinstalls.
+    //
+    // Every skill is always an `update` because no content comparison exists for
+    // them (see the `hash: null` on both sides of the diff, and R1). On a real
+    // upgrade that produced `Update (57)` where 55 rows carried one identical
+    // reason and only 2 were actual changes — the two a reviewer needs to see,
+    // buried under fifty-five that say nothing about this upgrade.
+    //
+    // Collapsed, NOT hidden: the count is printed. A capped list that does not
+    // say it was capped reads as "these are all of them", which is the failure
+    // this repo keeps finding. Printing the denominator alongside the excluded
+    // count is the `class-level-fix` rule.
+    const real = grouped.update.filter((a) => a.reason !== UNCONDITIONAL_REINSTALL_REASON);
+    const collapsed = unconditionalCount;
+
     lines.push(`~ Update (${grouped.update.length}):`);
-    for (const a of grouped.update) {
+    for (const a of real) {
       lines.push(`  ~ ${a.path} (${a.reason})`);
     }
+    if (collapsed > 0) {
+      lines.push(
+        `  i ${collapsed} UDS-managed skill/command director${collapsed === 1 ? 'y' : 'ies'} reinstalled unconditionally — no content comparison is implemented for them (XSPEC-382)`
+      );
+    }
     lines.push('');
   }
 
@@ -373,7 +412,11 @@ export function formatPlan(plan) {
 
   lines.push('Summary:');
   lines.push(`  Create: ${plan.summary.create}`);
-  lines.push(`  Update: ${plan.summary.update}`);
+  lines.push(
+    unconditionalCount > 0
+      ? `  Update: ${plan.summary.update} (${plan.summary.update - unconditionalCount} changed, ${unconditionalCount} unconditional reinstall)`
+      : `  Update: ${plan.summary.update}`
+  );
   lines.push(`  Migrate Block: ${plan.summary.migrate_block}`);
   lines.push(`  Delete: ${plan.summary.delete}`);
   lines.push(`  Unchanged: ${plan.summary.unchanged}`);

package/standards-registry.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "version": "6.7.1",
+  "version": "6.7.2",
   "lastUpdated": "2026-05-13",
   "description": "Standards registry for universal-dev-standards with integrated skills and AI-optimized formats",
   "formats": {
@@ -58,14 +58,14 @@
     "standards": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
-      "version": "6.7.1"
+      "version": "6.7.2"
     },
     "skills": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
       "localPath": "skills",
       "rawUrl": "https://raw.githubusercontent.com/AsiaOstrich/universal-dev-standards/main/skills",
-      "version": "6.7.1",
+      "version": "6.7.2",
       "note": "Skills are now included in the main repository under skills/"
     }
   },
@@ -2260,7 +2260,7 @@
       "id": "license-compliance",
       "name": "License Compliance Standards",
       "nameZh": "授權合規標準",
-      "version": "6.7.1",
+      "version": "6.7.2",
       "source": {
         "human": "core/license-compliance.md",
         "ai": "ai/standards/license-compliance.ai.yaml"
@@ -2272,7 +2272,7 @@
       "id": "verification-oracle",
       "name": "Verification Oracle Standards",
       "nameZh": "驗證 Oracle 標準",
-      "version": "6.7.1",
+      "version": "6.7.2",
       "source": {
         "human": "core/verification-oracle.md",
         "ai": "ai/standards/verification-oracle.ai.yaml"
@@ -2284,7 +2284,7 @@
       "id": "model-provenance",
       "name": "Model Provenance Policy Standards",
       "nameZh": "模型來源政策標準",
-      "version": "6.7.1",
+      "version": "6.7.2",
       "source": {
         "human": "core/model-provenance.md",
         "ai": "ai/standards/model-provenance.ai.yaml"
@@ -2296,7 +2296,7 @@
       "id": "resource-cost-boundary",
       "name": "Resource / Cost Boundary Declaration Standards",
       "nameZh": "資源／成本邊界宣告標準",
-      "version": "6.7.1",
+      "version": "6.7.2",
       "source": {
         "human": "core/resource-cost-boundary.md",
         "ai": "ai/standards/resource-cost-boundary.ai.yaml"