git:20260930.703c67e to git:20261001.c1be472

- Surgically updates existing skills when source code changes, preserving all [MANUAL] developer content while re-extracting only affected exports with full provenance tracking. Only changed exports are re-extracted — unchanged content is never touched. Every regenerated instruction must trace to code with file:line citations. Stack skills (`skill_type: "stack"` in metadata.json) are not supported by surgical update — use `skf-create-stack-skill` to re-compose from updated constituents. If a stack skill is provided, this workflow exits with a redirect message.

- - **Cross-skill data coupling:** stages in this workflow load shared assets from `skf-create-skill` to keep extraction semantics aligned between create and update — `re-extract.md` pulls `extraction-patterns.md`, `extraction-patterns-tracing.md`, and `tier-degradation-rules.md` from `skf-create-skill/references/`; `init.md` §6c reads the version files the Version Reconciliation section of `skf-create-skill/references/source-resolution-protocols.md` lists, and `skf-source-tree.py` (init.md §6b) computes a remote skill's clone path with that document's workspace rule; `write.md` reads `skill-sections.md` from `skf-create-skill/assets/`. Update-skill assumes these files are present at install time and that their semantics are stable across the two skills' versions.

- - Once `references/init.md` §6b has bound `{source_tree}` (a private source tree for a skill forged from a remote repository), every HALT or ABORT after it first runs `uv run {sourceTreeHelper} close --tree "{source_tree}"` from `{project-root}`, binds `{source_tree_close}` ← `status` and never stops on the result: on `removed` or `missing` it goes on; on `refused` it runs the command once more with `--tree` set to the exact `tree` value the helper's `open` printed, and binds that result the same way; on `left`, `refused` again, or a command that fails or prints no JSON, it adds `source-tree-not-removed: {source_tree} ({source_tree_close})` to the `warnings[]` of the envelope it emits. `references/health-check.md` removes the tree on every run that reaches step 8.

- - While `{source_tree}` is bound, a step that finds `{source_root}` missing HALTs with status `blocked` (`error.phase` `<step>:source-tree-missing`, for example `detect-changes:source-tree-missing`) instead of reading its files as deleted.

- - Once `references/init.md` §1b has bound `{lock_owner}`, every HALT, ABORT or other exit before step 8, the Stack Skill Guard's redirect included, first runs `uv run {runLockHelper} release --lock "{forge_data_folder}/{skill_name}/.skf-update.lock" --owner "{lock_owner}"` from `{project-root}`, before it emits its envelope, if any, and never stops on the result: when the command fails or prints no JSON, it adds `run-lock-not-released: {forge_data_folder}/{skill_name}/.skf-update.lock` to that envelope's `warnings[]`.

- | **Inputs** | skill_name [required] |

- | **Flags** | `--headless` / `-H` (auto-resolve all gates); `--from-test-report` (gap-driven mode); `--target-ref <ref>` (normal mode, a skill forged from a remote repository: read the current commit of that tag, branch, `HEAD` or full commit instead of the recorded `source_ref`, and record both as `source_ref` / `source_commit` when the update writes; init.md §6b); `--allow-workspace-drift` (gap-driven only: accept a workspace HEAD other than the pinned commit; update-skill takes nothing from HEAD, and a gap that needs the pinned tree, a rescope included, halts `halted-for-workspace-drift` before merge); `--allow-degraded` (headless only: pre-authorize the lossy degraded full re-extraction when the provenance map is missing, instead of halting `blocked`; init.md §4); `--detect-only` (run detect-changes only, exit before re-extract; envelope `status="detect-only"`); `--dry-run` (run detect-changes + re-extract, exit before merge/write; envelope `status="dry-run"` describes what would change; a re-extract halt such as `halted-for-remediation-path` or `halted-for-workspace-drift` still stops it). If both `--detect-only` and `--dry-run` are passed, `--detect-only` wins. |

- | **Gates** | step 1: Confirm Gate [C] | step 4: Confirm Gate [C if clean merge, HALT if conflicts] |

- | **Outputs** | A new version of the skill: SKILL.md, metadata.json, provenance-map.json and evidence-report.md in a new version folder `{skill_group}/{new_version}/` and its forge folder, beside the unchanged previous version (a gap-driven repair updates the current version in place); none when `--detect-only` or `--dry-run` is set — those modes are read-only inspection paths |

- | **Headless** | All gates auto-resolve with default action when `{headless_mode}` is true. Each auto-resolved gate appends a `{gate, default_action, taken_action, reason, evidence?}` entry to `headless_decisions[]`, surfaced in step 7's `SKF_UPDATE_RESULT_JSON` envelope so non-interactive runs can be audited post-hoc. A HALT reached in headless mode emits its own `SKF_UPDATE_RESULT_JSON` at the halt site (the site's `status` code plus an `error: {phase, path?, reason}` object) and exits — halts do not fall through to step 7. Pipeline branches on the envelope's top-level `status` field (`success`, `no-changes`, `detect-only`, `dry-run`, or one of the documented `halted-for-*`/`blocked` codes). The first four are successful exits — pipelines treating non-success as failure must include them in the success set. The status enum is defined once in `src/shared/scripts/schemas/skf-update-result-envelope.v1.json`. |

- 2. **Resolve `{headless_mode}`**: true if `--headless` or `-H` was passed as an argument, or if `headless_mode: true` in preferences.yaml. Default: false.

- 3. **Resolve workflow customization.** Run:

- This merges the three layers per `bmad-customize` rules (scalars override, arrays append): `{skill-root}/customize.toml` (bundled defaults), `_bmad/custom/<skill-name>.toml` under `{project-root}` (team overrides), and `_bmad/custom/<skill-name>.user.toml` under `{project-root}` (personal overrides). If the script is missing or fails, read `{skill-root}/customize.toml` directly.

- Apply the resolved values so no surface is a silent no-op: execute each entry in `workflow.activation_steps_prepend` in order now; treat every entry in `workflow.persistent_facts` as standing context for the whole run (entries prefixed `file:` are paths or globs whose contents load as facts — the bundled default loads any `project-context.md` under `{project-root}`); resolve `{onCompleteCommand}` ← `workflow.on_complete` if non-empty, else empty string, and stash it in workflow context (`references/report.md` §5b invokes it after the result contract is written; empty string = the hook is a no-op). After activation completes, execute each entry in `workflow.activation_steps_append` in order before `init.md` runs.

- 4. Load, read the full file, and then execute `references/init.md` to begin the workflow.