diff --git a/manual/zh-cn/05-recovery.md b/manual/zh-cn/05-recovery.md
index bd3454b1..6c744fbf 100644
--- a/manual/zh-cn/05-recovery.md
+++ b/manual/zh-cn/05-recovery.md
@@ -2,8 +2,12 @@
 
 ## 更新
 
-- ISO 安装：系统随上游 `omarchy update`；cn 层当前随新版 ISO 迭代（[omarchycn] pacman 仓库暂只分发 keyring，omarchy-dev 包上仓后将改为 pacman 更新）
-- Overlay 安装：`omarchycn update`（拉取源码 → 重装 overlay → 执行未跑过的 cn 迁移）
+所有安装形态统一用 `omarchycn update`（即 `omarchy cn update`）做完整更新：
+
+- ISO / 一键转换等包安装：走完整更新管线（系统包 + [omarchycn] 仓库里的 cn 包 → 应用目录、镜像表、AI registry 随包更新 → 上游迁移与 cn 迁移）
+- Overlay 安装：拉取源码 → 重装 overlay → 执行未跑过的 cn 迁移
+
+包安装上直接跑 `omarchy update` 效果相同（cn 迁移已并入其管线）。
 
 ## 备份位置
 
diff --git a/test/shell.d/omarchycn-test.sh b/test/shell.d/omarchycn-test.sh
index c917396c..333667a1 100755
--- a/test/shell.d/omarchycn-test.sh
+++ b/test/shell.d/omarchycn-test.sh
@@ -121,6 +121,39 @@ revert_mirror=$(grep -m1 '^MIRROR_LINE=' "$ROOT/bin/omarchy-cn-revert" | cut -d'
   fail "revert MIRROR_LINE drifted from cn/lib/mirror.sh" "$revert_mirror"
 pass "convert/revert pair: parse, main() guard, ask=4, mirror constant in sync"
 
+# Update pipeline: cn migrations ride omarchy-migrate, cn update serves both forms
+bash -n "$ROOT/bin/omarchy-cn-migrate" || fail "omarchy-cn-migrate parses"
+grep -q '^OMARCHY_PATH="\$OMARCHY_PATH" omarchy-cn-migrate$' "$ROOT/bin/omarchy-migrate" ||
+  fail "omarchy-migrate runs cn migrations (upstream-sync drift)"
+grep -q 'exec omarchy-update' "$ROOT/bin/omarchy-cn-update" ||
+  fail "omarchy-cn-update serves package installs via omarchy-update"
+grep -q 'omarchy-cn-migrate ]]' "$ROOT/bin/omarchy-cn-update" ||
+  fail "downgrade guard checks for omarchy-cn-migrate"
+pass "update pipeline: cn migrate wired into omarchy-migrate, package branch present"
+
+# cn migrate runner: pending migrations run once, markers skip reruns
+mig_root=$(mktemp -d)
+mkdir -p "$mig_root/cn/migrations"
+printf 'echo ran >> "$HOME/mig-calls"\n' > "$mig_root/cn/migrations/1000000000.sh"
+OMARCHY_PATH="$mig_root" omarchy-cn-migrate > /dev/null
+OMARCHY_PATH="$mig_root" omarchy-cn-migrate > /dev/null
+[[ $(wc -l < "$HOME/mig-calls") -eq 1 ]] || fail "cn migrate marker prevents reruns"
+rm -rf "$mig_root"
+pass "omarchy-cn-migrate runs pending migrations once"
+
+# Every cn command must be executable (the menu launches them directly)
+nonexec=$(find "$ROOT/bin" -maxdepth 1 \( -name omarchycn -o -name 'omarchy-cn-*' \) ! -perm -u+x)
+[[ -z $nonexec ]] || fail "non-executable cn commands" "$nonexec"
+pass "all cn commands carry the executable bit"
+
+# App catalog and menu install entries stay in sync
+catalog_ids=$(jq -r '.apps | keys[]' "$ROOT/cn/apps.json" | sort)
+menu_ids=$(grep -o '"omarchycn\.apps\.[a-z-]*"' "$ROOT/default/omarchy/omarchy-menu.jsonc" |
+  sed 's/.*apps\.//; s/"//' | sort)
+diff <(printf '%s\n' "$catalog_ids") <(printf '%s\n' "$menu_ids") > /dev/null ||
+  fail "menu app entries drift from cn/apps.json"
+pass "menu app entries match the catalog"
+
 # Menu: OmarchyCN entries parse and reference only existing commands
 node -e '
   const fs = require("fs");