Harden the new cn assertions against false passes and fix overlay update wording

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Kb7vDj6PHwymeDeSUUk1eX

manual/zh-cn/05-recovery.md

@@ -2,12 +2,10 @@
 
 ## 更新
 
-所有安装形态统一用 `omarchycn update`（即 `omarchy cn update`）做完整更新：
+所有安装形态都可以用 `omarchycn update`（即 `omarchy cn update`）：
 
-- ISO / 一键转换等包安装：走完整更新管线（系统包 + [omarchycn] 仓库里的 cn 包 → 应用目录、镜像表、AI registry 随包更新 → 上游迁移与 cn 迁移）
-- Overlay 安装：拉取源码 → 重装 overlay → 执行未跑过的 cn 迁移
-
-包安装上直接跑 `omarchy update` 效果相同（cn 迁移已并入其管线）。
+- ISO / 一键转换等包安装：完整更新管线（系统包 + [omarchycn] 仓库里的 cn 包 → 应用目录、镜像表、AI registry 随包更新 → 上游迁移与 cn 迁移）；直接跑 `omarchy update` 效果相同（cn 迁移已并入其管线）
+- Overlay 安装：只更新 cn 层（拉取源码 → 重装 overlay → 执行未跑过的 cn 迁移）；底下的 Omarchy 系统仍用 `omarchy update` 更新
 
 ## 备份位置
 

test/shell.d/omarchycn-test.sh

@@ -125,30 +125,39 @@ pass "convert/revert pair: parse, main() guard, ask=4, mirror constant in sync"
 bash -n "$ROOT/bin/omarchy-cn-migrate" || fail "omarchy-cn-migrate parses"
 grep -q '^OMARCHY_PATH="\$OMARCHY_PATH" omarchy-cn-migrate$' "$ROOT/bin/omarchy-migrate" ||
   fail "omarchy-migrate runs cn migrations (upstream-sync drift)"
-grep -q 'exec omarchy-update' "$ROOT/bin/omarchy-cn-update" ||
+grep -qE '^\s*exec omarchy-update$' "$ROOT/bin/omarchy-cn-update" ||
   fail "omarchy-cn-update serves package installs via omarchy-update"
-grep -q 'omarchy-cn-migrate ]]' "$ROOT/bin/omarchy-cn-update" ||
+grep -q '^if \[\[ .* ! -f \$src/bin/omarchy-cn-migrate \]\]' "$ROOT/bin/omarchy-cn-update" ||
   fail "downgrade guard checks for omarchy-cn-migrate"
 pass "update pipeline: cn migrate wired into omarchy-migrate, package branch present"
 
-# cn migrate runner: pending migrations run once, markers skip reruns
+# cn migrate runner: pending run once, markers at the contract path suppress and persist
 mig_root=$(mktemp -d)
-mkdir -p "$mig_root/cn/migrations"
+mig_done="$HOME/.local/state/omarchycn/migrations-done"
+mkdir -p "$mig_root/cn/migrations" "$mig_done"
+printf 'echo seeded >> "$HOME/mig-calls"\n' > "$mig_root/cn/migrations/999999999.sh"
 printf 'echo ran >> "$HOME/mig-calls"\n' > "$mig_root/cn/migrations/1000000000.sh"
+touch "$mig_done/999999999.sh"
 OMARCHY_PATH="$mig_root" omarchy-cn-migrate > /dev/null
 OMARCHY_PATH="$mig_root" omarchy-cn-migrate > /dev/null
-[[ $(wc -l < "$HOME/mig-calls") -eq 1 ]] || fail "cn migrate marker prevents reruns"
+[[ $(cat "$HOME/mig-calls") == "ran" ]] || fail "cn migrate runs pending once, honors seeded markers" "$(cat "$HOME/mig-calls")"
+[[ -f $mig_done/1000000000.sh ]] || fail "cn migrate writes markers to the contract path"
 rm -rf "$mig_root"
-pass "omarchy-cn-migrate runs pending migrations once"
+pass "omarchy-cn-migrate marker contract holds"
 
 # Every cn command must be executable (the menu launches them directly)
 nonexec=$(find "$ROOT/bin" -maxdepth 1 \( -name omarchycn -o -name 'omarchy-cn-*' \) ! -perm -u+x)
 [[ -z $nonexec ]] || fail "non-executable cn commands" "$nonexec"
+if [[ -d $ROOT/.git ]]; then
+  badmode=$(git -C "$ROOT" ls-files -s bin/omarchycn 'bin/omarchy-cn-*' | grep -v '^100755' || true)
+  [[ -z $badmode ]] || fail "cn commands tracked without exec mode" "$badmode"
+fi
 pass "all cn commands carry the executable bit"
 
 # App catalog and menu install entries stay in sync
 catalog_ids=$(jq -r '.apps | keys[]' "$ROOT/cn/apps.json" | sort)
-menu_ids=$(grep -o '"omarchycn\.apps\.[a-z-]*"' "$ROOT/default/omarchy/omarchy-menu.jsonc" |
+menu_ids=$(grep -v '^\s*//' "$ROOT/default/omarchy/omarchy-menu.jsonc" |
+  grep -o '"omarchycn\.apps\.[a-z-]*"' |
   sed 's/.*apps\.//; s/"//' | sort)
 diff <(printf '%s\n' "$catalog_ids") <(printf '%s\n' "$menu_ids") > /dev/null ||
   fail "menu app entries drift from cn/apps.json"