M5 review fixes: key download step, honest update paths, ordered checklist, channel semantics

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QKxGW1raAWaqeU8WdHsMsp

AGENTS.md

@@ -15,12 +15,12 @@ matching guide before starting:
 
 This fork carries the OmarchyCN China-integration layer on top of upstream `basecamp/omarchy`:
 
-- `bin/omarchycn` routes to `omarchy cn <command>`; all cn commands are `bin/omarchy-cn-*` and follow every upstream bin convention (metadata, helpers, `$OMARCHY_PATH`)
+- `bin/omarchycn` routes to `omarchy cn <command>`; all cn commands are `bin/omarchy-cn-*` and follow the upstream bin conventions (metadata, helpers, `$OMARCHY_PATH` — sole exception: the overlay installer bootstraps by resolving its own checkout)
 - `cn/` holds the data layer: `mirrors.json`, `dev-mirrors.json`, `apps.json`, `registry/` (AI providers/harnesses/compatibility), `fcitx5/`, `fontconfig/`, `keys/`, `lib/` (sourced helpers), `release` (cn release number)
 - cn migrations live in `cn/migrations/*.sh`, run by `omarchy-cn-update` with per-file completion markers under `~/.local/state/omarchycn/`
 - Packaging: `packages/omarchy-pkgs-cn.patch` must be applied to the sibling `omarchy-pkgs` checkout so `omarchy-dev` ships `cn/`; keyring in `packages/omarchycn-keyring/`
 - Release process: `docs/release-checklist.md`; signing: `docs/release-signing.md`; pacman repo: `docs/pacman-repo.md`
-- Upstream sync: `.gitea/workflows/upstream-sync.yml` opens a PR per upstream change; keep upstream file edits minimal (currently: one `GROUP_DESCRIPTIONS[cn]` line and the OmarchyCN menu section)
+- Upstream sync: `.gitea/workflows/upstream-sync.yml` opens a PR per upstream change; keep upstream file edits minimal (currently: one `GROUP_DESCRIPTIONS[cn]` line in `bin/omarchy`, the OmarchyCN section in `default/omarchy/omarchy-menu.jsonc`, a rewritten `README.md` (known recurring sync conflict, resolve toward ours), `AGENTS.md` additions, and two `.gitignore` lines)
 - cn tests: `test/shell.d/omarchycn-test.sh`, `test/shell.d/omarchycn-ai-test.sh`
 
 # Documentation Layout

bin/omarchy-cn-update

@@ -19,10 +19,41 @@ if [[ ! -d $src/.git ]]; then
   exit 1
 fi
 
+channel=$(omarchy-cn-channel)
+channel=${channel%% *}
+
 old=$(git -C "$src" rev-parse --short HEAD)
-git -C "$src" pull --ff-only
+git -C "$src" fetch -q --tags origin
+
+case "$channel" in
+nightly)
+  git -C "$src" checkout -q quattro
+  git -C "$src" pull --ff-only origin quattro
+  ;;
+beta)
+  tag=$(git -C "$src" tag -l "*-cn.*" | sort -V | tail -1)
+  if [[ -z $tag ]]; then
+    echo "beta 通道无可用发布 tag" >&2
+    exit 1
+  fi
+  git -C "$src" checkout -q "$tag"
+  ;;
+stable)
+  tag=$(git -C "$src" tag -l "*-cn.*" | grep -vE "alpha|beta|rc" | sort -V | tail -1)
+  if [[ -z $tag ]]; then
+    echo "当前尚无 stable 发布（omarchycn channel beta 可跟随预发布）" >&2
+    exit 1
+  fi
+  git -C "$src" checkout -q "$tag"
+  ;;
+*)
+  echo "Unknown channel: $channel" >&2
+  exit 1
+  ;;
+esac
+
 new=$(git -C "$src" rev-parse --short HEAD)
-echo "Source: $old -> $new"
+echo "Channel: $channel, source: $old -> $new"
 
 "$src/bin/omarchy-cn-install-overlay"
 

docs/release-checklist.md

@@ -6,11 +6,12 @@
 2. 用 `--local-source` 重建 ISO（`packages/omarchy-pkgs-cn.patch` 已应用到 omarchy-pkgs）
 3. 验证 omarchy-dev 包含 cn 层（`tar -tf … | grep usr/share/omarchy/cn/`）
 4. QEMU OVMF UEFI 冒烟：进入安装器欢迎屏
-5. `sha256sum` → `SHA256SUMS.txt`；用发布子钥出三份分离签名（SUMS/ISO/release.json）
+5. `sha256sum` → `SHA256SUMS.txt`；签名 SUMS 与 ISO（发布子钥）
 6. SBOM 两份：syft（live airootfs）+ 离线仓库 .PKGINFO 采集
-7. `release.json`：版本、双向提交、包版本表、迁移列表、min_compatible、产物清单
+7. `release.json`（版本、双向提交、包版本表、迁移列表、min_compatible、产物清单）→ 签名 release.json
 8. 建 tag 与 Release，上传全部产物，Release Notes 写明上游基线与已知问题
-9. `cn/release` 数字 +1，提交
+9. 匿名回读已发布 ISO 并 sha256 复核 == 本地构建值
+10. `cn/release` 数字 +1，提交
 
 ## 版本规则
 

manual/zh-cn/01-install.md

@@ -5,7 +5,7 @@
 从 [Releases](https://git.zacharyzhang.com/ZacharyZhang-NY/omarchycn/releases) 下载最新 ISO 及 `SHA256SUMS.txt`、`SHA256SUMS.txt.asc`：
 
 ```bash
-gpg --import cn/keys/omarchycn-release.asc
+curl -sSf https://git.zacharyzhang.com/ZacharyZhang-NY/omarchycn/raw/branch/quattro/cn/keys/omarchycn-release.asc | gpg --import
 gpg --verify SHA256SUMS.txt.asc SHA256SUMS.txt
 sha256sum -c SHA256SUMS.txt
 ```

manual/zh-cn/05-recovery.md

@@ -2,7 +2,7 @@
 
 ## 更新
 
-- ISO 安装：跟随上游 `omarchy update`（cn 层随 omarchy-dev 包更新）
+- ISO 安装：系统随上游 `omarchy update`；cn 层当前随新版 ISO 迭代（[omarchycn] pacman 仓库暂只分发 keyring，omarchy-dev 包上仓后将改为 pacman 更新）
 - Overlay 安装：`omarchycn update`（拉取源码 → 重装 overlay → 执行未跑过的 cn 迁移）
 
 ## 备份位置