@synopackageland/cli 0.15.0 → 0.15.2

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.15.2 (2026-10-18)
+
+- Preserve command-set process exit codes instead of resetting them to 0 after CLI dispatch. `ctl` failures now reach scripts and CI with their documented exit codes; successful commands still exit 0 and uncaught exceptions exit 1.
+- Add subprocess regression coverage for `ctl` exit codes 0–8, confirmation before writes, and failures from `check`, `build`, `inspect`, `status` and `test`. Document the existing `ctl` exit-code contract and informational discovery/session results.
+- CLI-only patch: templates and SDK fixtures/examples remain pinned to 0.15.1; executor/lifecycle digests are unchanged.
+
+繁中摘要：修正 CLI 在子指令完成後把退出碼覆寫成 0 的問題，讓 `ctl` 失敗正確傳遞至腳本與 CI；成功仍為 0，未捕捉例外仍為 1。新增實際子行程測試，涵蓋 `ctl` 的 0–8 退出碼、寫入確認及其他主要指令的失敗；README 記錄既有退出碼與 discovery／session 資訊結果。此次僅更新 CLI，templates／SDK 維持 0.15.1，executor／lifecycle digest 不變。
+
+## 0.15.1 (2026-10-18)
+
+- Require explicit `DSM_E2E_SSH` for e2e tunnels and use `dsm` as the default saved-profile target; set `DSM_E2E_TARGET` to reuse an earlier target name. Anonymize internal NAS fixtures and documentation.
+- Pin templates and SDK fixtures/examples to 0.15.1. Add the 0.15.1 executor/lifecycle digest entry and retain the published 0.15.0 pins unchanged.
+- Cover package-named control.sh refusal logs and rejected `.executor` / `.policy.json` staging cleanup.
+- Executor task definitions change: Apps rebuilt with SDK 0.15.1 require one administrator reapproval after upgrade.
+
+繁中摘要：e2e tunnel 必須明確設定 `DSM_E2E_SSH`，profile 預設 target 改為 `dsm`（沿用舊 profile 時設定 `DSM_E2E_TARGET`）；清理內部 NAS 範例資訊。templates／SDK pins 同步 0.15.1；新增同版三架構 executor／lifecycle digest，保留 0.15.0 pins。驗證 control.sh 拒絕 log 的套件名與 runtime copies 清除。**task 定義改變：App 使用新 SDK 重建升級後，管理員需重新核准一次。**
+
 ## 0.15.0 (2026-10-18)
 
 - Add `synopkgland ctl` host/session management, authenticated API v1 discovery, explicit command trust, typed invocation and fixed job/pagination/NDJSON/upload flows. Commands keep App backend authorization; writes require confirmation.
@@ -329,7 +346,7 @@ before its timeout.
 - The window approval of an upgrade (outdated tasks) makes 11 scheduler calls
   instead of 12: the outdated boot task is deleted by the approval's own first
   EventScheduler get, made moments before the password, instead of a second
-  get (2.9 s on vt-nas in t-0484). The control task is still read again by id
+  get (2.9 s on the test NAS in t-0484). The control task is still read again by id
   before its delete (spec/scheduler/v1). A fresh approval stays at 8.
   繁中：升級核准的排程呼叫由 12 降為 11（boot 任務不再於刪除前重讀）。
 - A scope approval reads the executor's selection back every second at most

package/README.md

@@ -68,6 +68,19 @@ templates checkout and `SYNOPKGLAND_SDK_DIR` to an SDK checkout; SPKs built with
 packs the local SDK into its frontend (`npm install --install-links`) without building it: run
 `npm ci && npm run build` in `$SYNOPKGLAND_SDK_DIR/ts` first, and again after SDK changes.
 
+To check the CLI's DSM terminology rules against templates without a new templates release:
+
+```sh
+SYNOPKGLAND_TEMPLATES_DIR=/path/to/templates npm run test:glossary
+```
+
+This compares `OFF_GLOSSARY` and the Italian sentence rule, including regex sources and
+flags. It supports declaration-only rules with read-only use in `glossaryProblems`;
+post-declaration mutations, aliases and other unsupported rule uses fail the check instead of
+comparing a partial snapshot. The command also fails on drift or missing source. It needs a checkout because templates
+0.15.1 does not publish `scripts/test/i18n.test.mjs`. The npm gate runs this check when
+`SYNOPKGLAND_TEMPLATES_DIR` is set; otherwise it explicitly reports that the drift check was skipped.
+
 ## Capabilities
 
 Add them with `init --with …` or later with `synopkgland add <capability…>`.
@@ -150,12 +163,17 @@ await dismissNotifications(); // when a card shows later
 ```
 
 `runWithTunnel` (the `tunnel --` command) opens an SSH tunnel to the NAS
-(`DSM_E2E_SSH`, default `root@vt-nas.syno`) on a free loopback port and runs the
+(`DSM_E2E_SSH`, required, e.g. `admin@nas.example`) on a free loopback port and runs the
 command with `DSM_E2E_URL` set. It masks DSM's session cookies (`id`, `did`,
 `_SSID`), `X-SYNO-TOKEN`, `SynoToken` and `_sid` as `***` in the command's
 output and in the files under `DSM_E2E_OUTPUT_DIR` (default `.e2e`), and makes
 that directory private (700, files 600); saved sessions keep their cookies.
-Accounts come from mode 600 files named by `DSM_E2E_ACCOUNT_<USER>`.
+Set `DSM_E2E_SSH` to your NAS SSH destination in the environment or a local
+untracked `.env`; an unset or blank value fails before SSH or the command starts.
+`nas.example` is a fixture hostname; replace it with your own host. Accounts come
+from mode 600 files named by `DSM_E2E_ACCOUNT_<USER>`. Saved profiles use
+`DSM_E2E_TARGET` (default `dsm`) and the user as their names; set the target to
+an existing profile's target name to keep reusing it.
 `signIn` and `openDesktop` also register those values as e2e secrets in the
 test's worker, so e2e masks them in its own report. A test that forwards
 requests with `context.route` and `route.fetch` should end with
@@ -255,6 +273,37 @@ commands and their schemas. Run the listed alias/command with typed flags,
 `--help` and `--dry-run`; writes require `--yes`. There is no mutable current
 context. Use `--host a,b` or `--all-hosts` for bounded parallel operations.
 
+`ctl` preserves these process exit codes, including with `--json`:
+
+| Exit code | Meaning and examples |
+| --- | --- |
+| 0 | Command completed successfully (including help and `--dry-run`). |
+| 1 | Unexpected internal error (`CTL_INTERNAL`), or an uncaught CLI exception. |
+| 2 | Authentication/session failure: `CTL_NOT_AUTHENTICATED`, `CTL_AUTH_FAILED`, `CTL_CREDENTIAL_MISMATCH`, or unavailable OS credential storage. |
+| 3 | Invalid parameters, schema validation or unknown names: `CTL_PARAMS_INVALID`, `CTL_ARGUMENT_INVALID`, `CTL_APP_UNKNOWN`, `CTL_COMMAND_UNKNOWN`. |
+| 4 | Permission refusal that fails the command: `CTL_PERMISSION_DENIED`, `CTL_INVENTORY_DENIED`. |
+| 5 | App/contract failure that fails the command: `CTL_APP_ERROR`, `CTL_RESPONSE_INVALID`, `CTL_JOB_FAILED`. |
+| 6 | Network/HTTP failure or uncertain completion: `CTL_NETWORK`, `CTL_HTTP_ERROR`, `CTL_JOB_TIMEOUT`, `CTL_LOGOUT_FAILED`. |
+| 7 | Confirmation required (`CTL_CONFIRM_REQUIRED`): a write/destructive command or host removal without confirmation; no business operation runs. |
+| 8 | A multi-host command has at least one failed host (including when all hosts fail); inspect each host's error. |
+
+For example, `synopkgland ctl studio drafts create --host nas --json` without
+`--yes` returns `ok:false` with `CTL_CONFIRM_REQUIRED` and exits 7 once discovery
+and parameter validation succeed. Missing sessions fail earlier with exit 2.
+Discovery catches per-App description errors and excludes those Apps from its
+results. For example, a changed pinned description (`CTL_DESCRIPTION_CHANGED`)
+or an invalid descriptor (`CTL_DESCRIPTOR_INVALID`) appears in
+`ctl list --host nas --refresh --json` under `data.diagnostics`; the listing still
+returns `ok:true` and exits 0, even if no Apps remain. These diagnostic codes do
+not become process exit codes 4 or 5. Attempting to execute an excluded App with
+`--refresh` instead returns `ok:false`, `CTL_APP_UNKNOWN` and exit 3 because the
+App is absent from discovery results; no business operation runs.
+
+`ctl host list/show` can also succeed while reporting `authenticated:false` and
+exit 0. Check discovery `apps`/`diagnostics` and session fields as well as the exit
+code when deciding whether an App is ready.
+After a network or job timeout, query the App's state before retrying a write.
+
 Read `synopkgland skill show ctl` for the AI workflow, batch discovery approval,
 cache refresh, host removal/revocation and explicit `ctl.commands` authoring.
 API descriptions are private SPK files named `synopkgland-api.json`, served

package/dist/bin.js

@@ -3,9 +3,8 @@ import { loadDotEnv } from "./load-env.js";
 import { runCli } from "./cli.js";
 loadDotEnv();
 // Package deployment is explicit; this CLI does not publish releases.
-runCli(process.argv).then(() => 0).then((status) => {
-    process.exitCode = status;
-}).catch((error) => {
+// Successful completion leaves Node's default 0 or the command's exitCode intact.
+runCli(process.argv).catch((error) => {
     console.error(error instanceof Error ? error.message : String(error));
     process.exit(1);
 });

package/dist/cli.d.ts

@@ -1 +1,2 @@
+/** Resolves after dispatch; commands may set process.exitCode. Rejections are failures. */
 export declare function runCli(argv: string[]): Promise<void>;

package/dist/cli.js

@@ -275,6 +275,7 @@ async function containerBuild(project, arches, options) {
     return commitOutputs(options.outDir ? resolve(options.outDir) : project.root, (stage) => forEachArch(arches ?? CONTAINER_ARCH_FAMILIES, jobs, async (arch) => (await build(arch, join(stage, `${packageId}-${arch}.spk`)))
         .outputPath));
 }
+/** Resolves after dispatch; commands may set process.exitCode. Rejections are failures. */
 export async function runCli(argv) {
     if (argv[2] === "ctl") {
         const { runCtl } = await import("./ctl/cli.js");

package/dist/contract/unsupported-types.js

@@ -3,7 +3,7 @@ import { collectInstallParameters } from "./load.js";
  * Install parameter types that the schema still accepts but that have no working
  * install path on the live package-only route.
  *
- * Measured on vt-nas 2026-08-27: both end in DSM broken/150 with no Container
+ * Measured on the test NAS 2026-08-27: both end in DSM broken/150 with no Container
  * Manager project, while a no-parameter control package installed fine on the
  * same NAS. `secret` renders its password field and fails; `homes` renders no
  * input at all. `check` reports these as warnings so build keeps working

package/dist/contract/validate.js

@@ -33,7 +33,7 @@ export function validateContract(parsed, contractFile) {
     }
     // DSM 7.4 Package Center refuses an SPK whose package identity exceeds 32
     // characters -- "Invalid file format", before the install starts and with
-    // nothing written to synopkg.log. Measured on 10.17.83.200: 32 installs, 33
+    // nothing written to synopkg.log. Measured on a DSM 7.4 test NAS: 32 installs, 33
     // does not.
     if (typeof contract.package === "string" && contract.package.length > DSM_PACKAGE_IDENTITY_MAX) {
         const pos = getValuePosition(doc, ["package"]) ?? { line: 1, column: 1 };
@@ -164,7 +164,7 @@ function validateInstallParameters(parsed, contractFile) {
             }
         }
         // A45/A46: both types are in the schema enum but neither has a working
-        // install path on the live package-only route -- measured on vt-nas as DSM
+        // install path on the live package-only route -- measured on the test NAS as DSM
         // broken/150 with no Container Manager project, against a no-parameter
         // control that installed fine. Refusing here is what makes the failure
         // honest: `homes` used to validate, build a valid SPK, and only break at

package/dist/e2e/dsm.d.ts

@@ -17,7 +17,7 @@ type Page = ReturnType<NonNullable<ReturnType<typeof surfaceOf>>["page"]>;
 type Locator = ReturnType<Page["locator"]>;
 /** The DSM URL the browser opens: DSM_E2E_URL, else the local end of the SSH tunnel. */
 export declare function dsmUrl(env?: Env): string;
-/** ssh arguments forwarding the loopback ports of `forwards` to the NAS. */
+/** ssh arguments forwarding loopback ports to the NAS; DSM_E2E_SSH is required. */
 export declare function tunnelArgs(env?: Env): string[];
 /** A loopback port nothing listens on now, for a tunnel that names none. */
 export declare function freePort(): Promise<number>;
@@ -122,7 +122,7 @@ export declare function waitForDesktop(page?: Page): Promise<void>;
 /**
  * Closes every DSM notification card; returns how many were closed. DSM shows
  * them a moment after the desktop (the admin's "Admin account security" card
- * about 2 s later on vt-nas), so it first waits up to
+ * about 2 s later on a DSM 7.4 test NAS), so it first waits up to
  * DSM_E2E_NOTIFICATION_WAIT_MS (default 5000) for one.
  */
 export declare function dismissNotifications(page?: Page, env?: Env): Promise<number>;

package/dist/e2e/dsm.js

@@ -41,11 +41,14 @@ function forwards(env) {
         ...extra(env.DSM_E2E_TUNNEL_HTTPS_PORT, env.DSM_E2E_REMOTE_HTTPS_PORT, "443"),
     ];
 }
-/** ssh arguments forwarding the loopback ports of `forwards` to the NAS. */
+/** ssh arguments forwarding loopback ports to the NAS; DSM_E2E_SSH is required. */
 export function tunnelArgs(env = process.env) {
+    const target = env.DSM_E2E_SSH?.trim();
+    if (!target)
+        throw new Error("DSM_E2E_SSH is required to open a NAS tunnel; set it to user@nas.example (using your NAS host).");
     return ["-N", "-o", "BatchMode=yes", "-o", "ExitOnForwardFailure=yes",
         ...forwards(env).flatMap(([local, remote]) => ["-L", `127.0.0.1:${local}:127.0.0.1:${remote}`]),
-        env.DSM_E2E_SSH || "root@vt-nas.syno"];
+        target];
 }
 /** A loopback port nothing listens on now, for a tunnel that names none. */
 export function freePort() {
@@ -80,12 +83,13 @@ export async function runWithTunnel(command, outer = process.env) {
         throw new Error("runWithTunnel needs a command to run.");
     const port = Number(outer.DSM_E2E_TUNNEL_PORT || await freePort());
     const env = { ...outer, DSM_E2E_TUNNEL_PORT: String(port) };
+    const args = tunnelArgs(env);
     const ports = forwards(env).map(([local]) => Number(local));
     for (const used of ports) {
         if (await portOpen(used))
             throw new Error(`Port ${used} is already in use; name another DSM_E2E_TUNNEL_* port or close it before opening the tunnel.`);
     }
-    const ssh = spawn(env.DSM_E2E_SSH_BIN || "ssh", tunnelArgs(env), { stdio: ["ignore", "ignore", "inherit"] });
+    const ssh = spawn(env.DSM_E2E_SSH_BIN || "ssh", args, { stdio: ["ignore", "ignore", "inherit"] });
     let sshExited = false;
     ssh.once("exit", () => { sshExited = true; });
     try {
@@ -93,7 +97,7 @@ export async function runWithTunnel(command, outer = process.env) {
         for (const waiting of ports) {
             while (!(await portOpen(waiting))) {
                 if (sshExited || Date.now() > deadline)
-                    throw new Error(`The SSH tunnel to ${tunnelArgs(env).at(-1)} did not open on port ${waiting}.`);
+                    throw new Error(`The SSH tunnel to ${args.at(-1)} did not open on port ${waiting}.`);
                 await new Promise(accept => setTimeout(accept, 100));
             }
         }
@@ -364,7 +368,7 @@ const notificationCloseSelector = ".v-notification-container .v-notification-pan
 /**
  * Closes every DSM notification card; returns how many were closed. DSM shows
  * them a moment after the desktop (the admin's "Admin account security" card
- * about 2 s later on vt-nas), so it first waits up to
+ * about 2 s later on a DSM 7.4 test NAS), so it first waits up to
  * DSM_E2E_NOTIFICATION_WAIT_MS (default 5000) for one.
  */
 export async function dismissNotifications(page = dsmPage(), env = process.env) {
@@ -454,7 +458,7 @@ async function restoredSessionLive(page) {
  */
 export async function signIn(app, user = "admin", env = process.env) {
     const url = dsmUrl(env);
-    const file = profilePath(env.DSM_E2E_TARGET || "vt-nas", user, env);
+    const file = profilePath(env.DSM_E2E_TARGET || "dsm", user, env);
     const context = surface().context();
     const profile = loadProfile(file, url);
     if (profile)

package/dist/host/share-permission-lookup.d.ts

@@ -8,7 +8,7 @@ import type { SharePermissionRow } from "./share-permission.js";
  * the install proceed, while an empty list would read as a real denial and
  * refuse the install on a transport error.
  *
- * The APIs used were confirmed present on DSM 7.4 (vt-nas):
+ * The APIs used were confirmed present on DSM 7.4 (the test NAS):
  * `SYNO.Core.Share.Permission`, `SYNO.Core.Group`, `SYNO.Core.Group.Member`.
  * `SYNO.Core.User.Group` also exists on the NAS but has no generated
  * synoagentcli operation, which is why membership is derived group-by-group.

package/dist/host/share-permission.d.ts

@@ -10,7 +10,7 @@
  * extra_values directly, and share permission can change after install.
  *
  * The rows are SYNO.Core.Share.Permission v1 output verbatim. Read the tests
- * before changing the predicate: on vt-nas, `newadmin` has is_writable=false on
+ * before changing the predicate: on the test NAS, `newadmin` has is_writable=false on
  * its own row for `pkgland-p0b` and still writes there, because the
  * `administrators` group row carries the grant. A user-row-only check rejects
  * the only configuration with live proof behind it.

package/dist/host/share-permission.js

@@ -10,7 +10,7 @@
  * extra_values directly, and share permission can change after install.
  *
  * The rows are SYNO.Core.Share.Permission v1 output verbatim. Read the tests
- * before changing the predicate: on vt-nas, `newadmin` has is_writable=false on
+ * before changing the predicate: on the test NAS, `newadmin` has is_writable=false on
  * its own row for `pkgland-p0b` and still writes there, because the
  * `administrators` group row carries the grant. A user-row-only check rejects
  * the only configuration with live proof behind it.

package/dist/runtime/executor-digests.json

@@ -9,5 +9,16 @@
             "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
         },
         "goToolchain": "go1.26.9"
+    },
+    "0.15.1": {
+        "x86_64": "4f47fb43f6e60dbad064afb0bbec96dd009fa046670e2c4b590b128a855cb404",
+        "aarch64": "c903b09ad657a838f0c62b6688e65e9094572b22b969770fca92fcc3640a5364",
+        "armv7": "8178d90de7ea720530bb9496e50ed118086b0e57382d84675aadc68f482d219f",
+        "lifecycle": {
+            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
+            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
+            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
+        },
+        "goToolchain": "go1.26.9"
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.15.0",
+  "version": "0.15.2",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -19,6 +19,7 @@
   "scripts": {
     "build": "rm -rf dist && tsc",
     "test": "npm run build && node --import tsx --test test/*.test.ts test/ctl/*.test.ts",
+    "test:glossary": "node --test scripts/test/glossary-drift.test.mjs",
     "test:scripts": "node --test scripts/test/gate.test.mjs scripts/test/release.test.mjs scripts/test/pack-docker.test.mjs scripts/test/npm-pack.test.mjs scripts/test/executor-bump.test.mjs scripts/test/smoke-exports.test.mjs scripts/test/executor-digests.test.mjs scripts/test/parallel.test.mjs scripts/test/scaffold-matrix.test.mjs scripts/test/frontend-deps.test.mjs scripts/test/docker-gate.test.mjs scripts/test/gate-plan.test.mjs scripts/test/gates.test.mjs",
     "gates": "bash scripts/ci/gates.sh",
     "gates:fast": "bash scripts/ci/gates.sh --fast",
@@ -26,7 +27,7 @@
   },
   "dependencies": {
     "@napi-rs/keyring": "^2.1.1",
-    "@synopackageland/templates": "0.15.0",
+    "@synopackageland/templates": "0.15.1",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "json-canonicalize": "^3.0.1",

package/skills/SKILL.md

@@ -129,7 +129,7 @@ sweep forward the cancel instead of admitting it.
   `ExportExample` creates a private JSON file, calls `MoveFromStaging` once, and
   repeats the original request on repeated IDs. Review `example.go` to
   adapt a real producer; show Saved only from a protected committed receipt.
-- Wizard support is measured on vt-nas DSM 7.4 via a session-only SSH local
+- Wizard support is measured on the test NAS DSM 7.4 via a session-only SSH local
   forward. This is not proof of other DSM releases or full writer/reboot behavior.
 
 ## 開啟方式

package/skills/reference/compose.md

@@ -23,7 +23,7 @@ compose:
   network: {egress: isolated}
   # Private package binds are rejected by DSM build; keep compatible upstream named volumes.
 identity_gateway:
-  sdk: 0.15.0
+  sdk: 0.15.1
   mode: none
   access: dsm-users
   listen: {http: 28000}
@@ -151,7 +151,7 @@ declared availability readiness, LAN isolation/egress, protected grant lifecycle
 ACLs, two-user visibility and clean install/upgrade/reboot/stop/uninstall before
 calling the package supported on a NAS. No NAS is accessed by the build gate.
 
-The unified Compose contract requires SDK, CLI and templates 0.15.0. Use the published, matching versions together; the legacy packaging route and bridge publish mode are removed.
+The unified Compose contract requires SDK, CLI and templates 0.15.1. Use the published, matching versions together; the legacy packaging route and bridge publish mode are removed.
 
 Primary override files, and each included override set, must share a directory. Cross-directory override bases are rejected before loader I/O. Included implicit .env files are confined, inventoried and preserved; symlinks are rejected.
 
@@ -198,7 +198,7 @@ resources and does not migrate or delete retained data.
 Bridge web ingress uses a dedicated `sdk_ingress` internal bridge. The web service
 receives a fixed IPv4 address, and the package-account gateway connects directly
 to its declared container port. Internal bridges were reachable by package-account
-hooks in the sa3200d and vt-nas feasibility probes. No HAProxy helper, published
+hooks in feasibility probes on an SA3200D and another test NAS. No HAProxy helper, published
 container port, Docker socket or host root is required. Explicit internet egress
 still adds the existing outbound bridge; other App services retain their internal networks.
 
@@ -231,7 +231,7 @@ Legacy `.sc` residue is not purged by this topology. Migrating an already publis
 installation requires a separately authorized cleanup or an official worker fix;
 a no-publish rebuild cannot claim to remove historical service registrations.
 
-On vt-nas DSM 7.4/Docker 24.0.2, internal networks blocked tested external IPv4
+On the test NAS DSM 7.4/Docker 24.0.2, internal networks blocked tested external IPv4
 and external DNS, but allowed NAS host services through the bridge gateway and
 NAS LAN address. Therefore `isolated` is not a host-service firewall. IPv6 had
 no usable default route on this fixture, which is not proof of an IPv6 firewall.
@@ -245,7 +245,7 @@ Set-Cookie. Other App sessions/native cookies retain their normal semantics.
 Cookies are shared across ports on the same hostname, so filtering only this
 package's SDK cookie would leak another App's SDK session to an upstream.
 
-Historical publish-topology vt-nas validation was release-blocked: the Container Manager
+Historical publish-topology validation on the test NAS was release-blocked: the Container Manager
 24.0.2-1706 docker-project worker can return profile error 1202 on update,
 which Package Center reports as postinst-worker failure 277. The owned test
 project and a real Vaultwarden package reproduced this; switching Compose
@@ -328,7 +328,7 @@ The [docker-project contract](https://help.synology.com/developer-guide/resource
 documents project deletion on PREUNINST and build flags, without a separate
 package-account profile-release option.
 
-The original isolated Header fixture on vt-nas installed and started from a
+The original isolated Header fixture on the test NAS installed and started from a
 clean configuration, then its upgrade still returned port conflict → 1202 →
 277. Historical `.sc` residue alone is therefore insufficient to explain or
 resolve that environment's upgrade failure. Preserve the timestamp/PID chain;

package/skills/reference/create.md

@@ -40,8 +40,8 @@ rootOps 與 delegate 已共用管理員 PasswordConfirm 核准的 protected exec
 backend 寫 `runtime: python|node|rust`（`runtime: go` 等同 `kind: go`）。CGI 是 SDK 的 Go runtime（`bridge/cmd/runtime`），它驗證 DSM session、entry 與 `permissions.json` 後，以套件帳號（不是 root）每個請求啟動一次 App。App 放在 ui 以外的目錄，打包成 `target/app/`，build 寫入 `bridge.json`（spec/bridge/v1）並把它與 `permissions.json` 的 sha256 編進 runtime。
 
 ```yaml
-backend: {runtime: python, dir: app, entry: main.py, sdk: 0.15.0}
-backend: {runtime: node, dir: app, entry: main.mjs, sdk: 0.15.0, node: {package: Node.js_v20}}
+backend: {runtime: python, dir: app, entry: main.py, sdk: 0.15.1}
+backend: {runtime: node, dir: app, entry: main.mjs, sdk: 0.15.1, node: {package: Node.js_v20}}
 backend: {runtime: rust, dir: app, entry: hello, methods: [hello.greet]}
 ```
 
@@ -213,7 +213,7 @@ sweep forward the cancel instead of admitting it.
   `ExportExample` creates a private JSON file, calls `MoveFromStaging` once, and
   repeats the original request on repeated IDs. Review `example.go` to
   adapt a real producer; show Saved only from a protected committed receipt.
-- Wizard support is measured on vt-nas DSM 7.4 via a session-only SSH local
+- Wizard support is measured on the test NAS DSM 7.4 via a session-only SSH local
   forward. This is not proof of other DSM releases or full writer/reboot behavior.
 
 ## 開啟方式

package/skills/reference/files.md

@@ -118,7 +118,7 @@ sweep forward the cancel instead of admitting it.
   `ExportExample` creates a private JSON file, calls `MoveFromStaging` once, and
   repeats the original request on repeated IDs. Review `example.go` to
   adapt a real producer; show Saved only from a protected committed receipt.
-- Wizard support is measured on vt-nas DSM 7.4 via a session-only SSH local
+- Wizard support is measured on the test NAS DSM 7.4 via a session-only SSH local
   forward. This is not proof of other DSM releases or full writer/reboot behavior.
 
 The pinned scope-selection task also binds the protected generation observed before confirmation. The executor compares it under the publish lock and refuses stale tasks, so a retained task cannot replay an older selection after another confirmation.