chore: 补齐两个 PR 漏掉的版本 bump + 指纹 token 收尾替换

.claude-plugin/marketplace.json

@@ -208,7 +208,7 @@
       "description": "Audio processing suite covering the full speech pipeline: ASR transcription (Qwen3, StepFun) with batch-mode guards against music-only repetition-loop hallucinations, speaker diarization and CAM++ voiceprint identification for multi-speaker recordings, transcript error correction, structured meeting minutes generation, and TTS voice synthesis (StepFun). Install once for the complete audio workflow.",
       "source": "./daymade-audio",
       "strict": false,
-      "version": "1.24.0",
+      "version": "1.24.1",
       "category": "suite",
       "keywords": [
         "suite",
@@ -234,7 +234,7 @@
       "description": "Daymade skills core suite. Bundles skill creation, quality review, governance, and marketplace development tooling under one shared namespace. Skill verification is risk-scaled: bounded fixes use targeted checks, narrow behavior changes use sampled replays, and full paired benchmarks are reserved for new, broad, high-risk, or explicitly benchmarked work. Existing-skill edits retain an old-vs-new capability audit and content-bound packaging attestation so prompt compression cannot silently delete runtime contracts. When the official skill-creator plugin is also installed, skill-creator detects the coexistence and offers a consent-based, reversible SessionStart routing hook so the daymade edition wins deterministically; on machines without the official plugin nothing is ever installed.",
       "source": "./daymade-skill",
       "strict": false,
-      "version": "1.25.0",
+      "version": "1.25.1",
       "category": "suite",
       "keywords": [
         "suite",
@@ -332,7 +332,7 @@
       "description": "Extract Feishu (Lark) Docs, Wiki pages, Wiki collections/hubs, spreadsheets (including cell-attachment file download), and Minutes (妙记) transcripts into clean high-fidelity local Markdown. The primary path is the lark-cli API — programmatic extraction with no LLM rewriting of the body — which recursively follows a collection's reference graph (mention-doc / sheet / cross-tenant links) and uses error codes to resolve permission boundaries precisely; a browser-DOM path is the fallback only when lark-cli cannot reach the content. Use this whenever the source is a Feishu/Lark URL and fidelity matters — including 导出飞书文档/合集/妙记转写, 把飞书 wiki/知识库转 markdown, scraping or archiving a Feishu collection, exporting a Feishu Minutes/妙记 transcript, or saving a Feishu page locally — even if the user only says clipping, archiving, converting, or \"save this\". Also covers the permission-denied path (owner-exported .docx → faithful Markdown with heading/highlight restoration).",
       "source": "./feishu-doc-scraper",
       "strict": false,
-      "version": "1.3.2",
+      "version": "1.3.3",
       "category": "productivity",
       "keywords": [
         "feishu",

CHANGELOG.md

@@ -8,6 +8,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Changed
+- **feishu-doc-scraper** v1.3.3: version-bump catch-up for the acceptance-gate fix shipped in #302 — the gate now extracts and checks residual Feishu embed tags (whiteboard/cite-mention-doc/sheet) on the raw `source.html` instead of the pandoc-stripped `source.md` (pandoc silently drops those tags, so a document that lost three whiteboards was reported clean), widens the gate from hub-collections-only to every document, and switches to per-document filenames so a hub's recursive fetches no longer overwrite each other.
+- **daymade-skill** v1.25.1: version-bump catch-up for the `audit_skill_regression compare --renamed-from <old-path>` fix — a legitimate skill rename/move no longer hard-fails the source-identity check when explicitly declared (identity check only; content/tree-hash verification unchanged, so a wrong declaration still fails), with the git-ref baseline mode locating the skill under its old path in the historical ref, plus the independent-review follow-ups (resolved-path hint in errors, distinct failures for `--after` outside a worktree vs `renamed-from` outside the repo, and a fourth test).
+- **transcript-fixer** (`daymade-audio` v1.24.1): swap one residual fixture token (`1v1沟通` → `1页纸汇报`) in the numeric-consistency scanner and its test. The token sat inside fully fictional bookstore context (星辰社/北岸分馆) and was never a leak on main, but it was homologous to the real project fingerprint sanitized everywhere else — a reader with insider knowledge could recognize the shared source. The digit-carrying shape the test exercises is preserved; 22/22 tests pass.
 - **docx-creator** (`daymade-docs` v1.8.0): three shipped-scheme corrections to the markdown-to-docx generator. (1) Body size moves from 24 half-points (12pt) to **21 (10.5pt)**, the common Chinese manuscript size, with body paragraphs gaining a 2-character first-line indent (`420` twips — a named constant beside the size constant so they change in lockstep); headings, list items, table cells, and soft-break info blocks correctly stay un-indented (the indent only belongs on flowing body text — ISSUE-004's multi-line blocks would warp under it). (2) **Chinese bold switches family to 黑体** — 宋体 has no true bold weight, so renderer-synthesized bold smeared multi-stroke characters into blobs in both LibreOffice and Word; Latin bold stays Times New Roman Bold, which has a real face. Registered as **ISSUE-014**. (3) Docs re-synced at all three sites that quote the old scheme (SKILL.md font section, known_issues shipped-scheme line, scripts/README.md lookup table).
 - **transcript-fixer** (`daymade-audio` v1.24.0): four instruction hardenings around entity adjudication and the second-pass review, all from 2026-08 production runs. (1) Canonical-first is tightened: only a user-confirmed or human-annotated diarization label may settle a canonical spelling — an auto-assigned or unknown-provenance label stays a *candidate* and must climb the verification ladder. (2) Asking the user for a canonical person name must preserve an escape hatch outside the shortlist (`Other / none of these` accepting free text) — a single local occurrence justifies a list entry, not list exhaustiveness; the real canonical may be an English name while every candidate is a Chinese transliteration. (3) The second-pass subagent's completion criterion changes from "the process ran" to "a usable result arrived": the reviewer must cover the whole file and return either the residual table or an explicit `no new residuals`; an empty, malformed, or truncated response is a failed pass and must be retried with a fresh reviewer, and a retryable failure (e.g. an HTTP timeout carrying `retry_after`) must wait at least that long before retrying. A targeted grep/trap-scan of known patterns is explicitly *not* an independent re-read — in one production run, substituting it for a timed-out cold review reported clean, and the retried review surfaced 26 additional candidates. (4) When Task is genuinely unavailable (the instructions are already executing inside a subagent), the fallback is a line-by-line re-read from the corrected artifact — never a known-pattern grep wearing a re-read's name.
 - **docs-cleaner** (`daymade-docs` v1.7.0): grows a second mode and a decision framework, turning a doc-merging tool into a documentation-governance one. **Mode 1 — post-change governance** is new: when code, config, ports, paths, deployment, auth, tests or a documented procedure change, it scopes from the change (not the repo), identifies which file *defines* each affected fact versus merely mentioning it, treats the implementation as evidence and the doc as the claim (explicitly **not** as license to edit code — if the implementation is what's wrong, report and stop), decides each doc's disposition (update vs archive) *before* editing, and finds every copy of a changed fact before changing one of them. **Mode 2 — consolidation** is the original workflow, preserved whole. Both share a new **Drift Test**: ask in order whether a value is computable from what's already recorded (→ a derived value; don't write it at all — the prose analogue of "generate your API docs, don't hand-copy them"), authoritatively defined elsewhere (→ link, don't restate), or a record of what was true at a moment (→ only now may you write it). Linking solves only the second case; pointing a link at a derived value manufactures scaffolding that goes stale *and* a false sense of alignment. Position gives no exemption — frontmatter, index description columns, checkbox state and table cells are all body text. Two self-certifying checks inherited from the old version were replaced with falsifiable ones: the tick-box "Value Preservation Checklist" became per-disposition evidence (a **Condense** section can't be verified by a verbatim search — it was *supposed* to be rewritten — so it needs its load-bearing claims enumerated instead), and the plan's "Value preserved: 100%" became a count-with-a-list filled in after execution, since at plan time it was the deleting party grading its own deletion. Verified by seven fresh-context independent review rounds — two on orthogonal axes (actionability, fidelity-to-the-old-version) and five auditing the previous rounds' own fixes, which is where most of what follows came from. Findings per round: 22 / 13 / 13 / 15 / 11 / 14 / 22. That count never converged, but the *kind* of defect did: rounds 1–2 found missing content, rounds 3–4 found the newly-written commands were wrong, and rounds 5–7 found that each rule written to fix the previous round could be complied with by an agent that was getting it wrong. The repeated correct answer was to remove something rather than repair it. The sharpest instance is worth stating because it generalizes: a check that had been producing false deletion reports for correctly-merged sections was given a softer alternative path — and the path turned out to be selectable, at check time, by the agent whose search had just missed. An exception that opens only when the gate has just caught something is not an exception; the fix binds the choice to a record made before the rewrite. One deliberate reversal of the old version is worth naming: its worked example told the reader to delete a dated test run as a "one-time record", which the new rules classify as an audit trail that may never be deleted quietly — the example now uses duplicated content instead, the only Delete you can justify by pointing at something. Two of them are the reason to read this entry — a `rg` command written without a path argument searches *stdin* in an agent's non-interactive shell and returns exit 1 with no output, byte-identical to the "clean pass" signature the file itself documented; and a hand-rolled broken-link pipeline mis-reported 16 of 17 valid links as broken the moment it was given more than one file, because `rg` prefixes `filename:` at 2+ paths — it had only ever been tested on one. The link pipeline is gone (delegated to `lychee`). So is the mechanical count-word sweep meant to catch renumbering damage: run repo-wide it emitted 652 MB on a real docs repo (17.7 MB scoped to one project directory) — a check nobody runs is a check that guarantees its own bypass — and the bounded alternative, searching only files that mention the subject, was measured **wrong in the direction that matters**: prose that bakes a count into a sentence refers to the subject by alias, translation or bare link, never by title, so the filter is anti-correlated with the target. It is now an honest three-step instruction that ends by stating what it did *not* cover, rather than a green check that quietly meant one of those two failures. Every shell command was re-measured on real repositories, multi-file inputs, empty inputs, and outside a git repo. Review dossier in the author's private knowledge repo.

daymade-audio/transcript-fixer/.security-scan-passed

@@ -1,4 +1,4 @@
 Security scan passed
-Scanned at: 2026-08-17T08:19:11.287912+00:00
+Scanned at: 2026-08-17T08:34:48.233816+00:00
 Tool: gitleaks + pattern-based validation
-Content hash: 12af5c1f3fc194d400d7c1b757369ef50b3463053451286a04ef62e7ad600e0d
+Content hash: 994bff034f383c85f17f8fb732e0456cc2520f7cf8dbb89d57c7005a9c7449d2

daymade-audio/transcript-fixer/scripts/scan_numeric_consistency.py

@@ -209,7 +209,7 @@ def scan_numeric_slot(text: str, terms: set[str]) -> Iterator[Finding]:
             # someone happened to file.
             # Widening is BOUNDED to two characters per side, and that bound is
             # the whole ballgame. An unbounded walk to the CJK-run edge looked
-            # more thorough and was catastrophically worse: "北岸分馆季度盘点前1v1"
+            # more thorough and was catastrophically worse: "北岸分馆季度盘点前1页纸"
             # swallows the entire phrase, lands next to the 1, and reports a
             # clean line. Chinese puts digits after a run of characters
             # constantly, so an unbounded rule fires on ordinary text — 97 hits

daymade-audio/transcript-fixer/scripts/tests/test_numeric_consistency.py

@@ -76,7 +76,7 @@ def test_orphan_plus_is_detected_in_both_scripts(text):
     ("星辰社说这批 5 种都能用，21 册很够", "term and digits merely co-occur"),
     ("本季项目6周规划", "term BEFORE digit is ordinary Chinese"),
     ("关键词出现38次", "same, with a different measure word"),
-    ("北岸分馆季度盘点前1v1沟通", "a phrase reaching a digit only if widening is unbounded"),
+    ("北岸分馆季度盘点前1页纸汇报", "a phrase reaching a digit only if widening is unbounded"),
     ("盘点核对了 35 册", "term adjacent to a number across a space"),
 ])
 def test_healthy_text_is_not_flagged_as_numeric_slot(text, why):