@synopackageland/cli 0.6.1 → 0.7.1

package/CHANGELOG.md

@@ -0,0 +1,846 @@
+# Changelog
+
+## 0.7.1 (2026-10-10)
+
+Rebuild packages to pick up template, hook and executor changes. The executor
+digest changed. A package built with CLI 0.7.0 needs one administrator approval
+after upgrading to a 0.7.1 build: the 0.7.0 executor opened the package
+`target` link without following it, so it cannot install the anchored executor
+itself. Executor-only upgrades between 0.7.1 or later builds need no approval.
+
+### Executor upgrade and daemon timeouts
+
+- During an INFO-anchored executor-only upgrade the executor log said
+  `executor paused: package pins require administrator approval` about two
+  seconds before the new executor was ready. That line now appears only when
+  the pins differ; an anchored handover logs only `executor upgrade:
+  INFO-anchored executor installed under the approved policy`. The executor
+  digest changes.
+
+- `executor_status_mismatch` in the app window and the app's settings names
+  its cause: `the approved executor is not answering (<reason>)`, `the running
+  executor reports other digests than this package pins`, or `the executor
+  status request failed` with the request's own code, instead of `scheduler
+  readback or operation failed` for all three. The Data and removal
+  troubleshooting table explains each.
+
+- After approval or control start the window asked `executor.status` every
+  500 ms for up to 10 s. The wait now doubles from 500 ms to 2 s within the
+  same 10 s budget: at most 7 requests instead of 20.
+
+- For live upgrade tests, the repository's `scripts/test/executor-bump.py`
+  makes an executor-only build+1 SPK and now rewrites the window script's
+  embedded pins with the INFO anchor and `executor/setup.json`. The earlier
+  out-of-tree copy left the window pins behind, so the panel reported
+  `executor_status_mismatch` after every such upgrade while CGI and CLI
+  status were ready.
+
+- On kernel 3.10 (DSM 7.1, for example DS416 armv7) an executor-only
+  upgrade, and approving again while the executor runs, no longer fail
+  with "pid executable mismatch". That kernel names a running executor
+  replaced by a rename after the rename source (`runtime/.executor
+  (deleted)`), and root control accepted only `runtime/executor`. Root
+  control now identifies the monitor by inode: the current
+  `runtime/executor`, or an unlinked root-owned inode on the runtime's
+  device whose last name was `executor` or `.executor*` in the runtime.
+  The fix runs in the new executor, which the installed one starts: an
+  upgrade from a package built with the target-link fix below needs no
+  approval; from 0.7.0 it still needs the one approval described there.
+  The executor digest changes.
+
+- When the approved tasks are ready but the executor does not answer
+  (`executor_status_mismatch`), the app window offers Approve background
+  access again. With the tasks approved, it restarts the executor without
+  a password.
+
+- `executor.status` (root-ops) names approval, not "Start the package", as
+  the next step when the package's last lifecycle request was start.
+  Regenerate or copy `backend/internal/app/executor.go`.
+
+- An executor-only upgrade (same policy, new executor matching the INFO
+  `synopkgland_executor_sha256` anchor) no longer fails with "executor
+  upgrade refused: INFO-anchored executor could not be installed". The
+  installer opened `/var/packages/<pkg>/target/executor` without following
+  the DSM `target` link, which the executor refuses, so every such upgrade
+  stayed paused. The fix runs in the executor that is already installed:
+  an upgrade from a package built with an earlier SDK still needs one
+  administrator approval. The executor digest changes.
+
+- `executor.status` (root-ops and delegate projects) no longer answers
+  `internal` while the executor is paused (package stopped, or pins waiting
+  for approval). It answers `{ready: false, state: "paused", reason:
+  "executor_not_listening", next}`, and `synopkgland status` shows the
+  reason and next step. Regenerate or copy
+  `backend/internal/app/executor.go` into existing projects.
+
+- `daemon.timeouts` defaults are now `{start: 30, stop: 30, status: 5,
+  uninstall: 60}` (were `start: 5, stop: 10, status: 2`). On vt-nas under
+  IO load a boot start took more than 5 s and a Connect revoke more than
+  9 s. The new `timeouts.uninstall` (2–120) bounds `uninstall_args`
+  separately; it used to get `stop - 1`, so an app had to raise the SIGKILL
+  wait to give its revoke time. DSM's package unit allows 3600 s for start
+  and stop. `inspect` still accepts SPKs built before `timeouts.uninstall`.
+  The manifest reference explains how to pick values from a loaded NAS.
+
+### Approval, identity and uninstall fixes
+
+- `identity: standalone`: "Continue with DSM" and every live revalidation
+  failed with `session_required` after a DSM web login, because DSM web
+  sessions enable SynoToken and DSM answers the `id` cookie alone with 119.
+  The backend now forwards the request's single `X-SYNO-TOKEN` header, which
+  the DSM window's `ctx.call` already sends, when it checks the DSM session.
+  Sessions without SynoToken still verify with the cookie alone. The token is
+  never put in a URL, logged or stored. This also unblocks root-ops approval
+  in an `identity: standalone` package, which stopped at `executor.control`.
+  Existing projects need the updated `internal/identity` files.
+- When approval created and read back both tasks but the executor then did
+  not start or report healthy, the window left the tasks behind, and with no
+  running executor there was no task inventory for uninstall to delete them.
+  The window now withdraws the tasks that approval created; tasks from an
+  earlier approval stay.
+- After a wrong password or a withdrawn approval, the window panel showed
+  only "Check status". It and the app's settings now keep the approve action.
+- Uninstall no longer logs `task cleanup unconfirmed` for every successful
+  delete: EventScheduler `delete` v1 and TaskScheduler `delete` v2 answer
+  `{"success":true}` without data, which now counts as confirmed. The task
+  definitions are unchanged, so no new approval is needed; the executor
+  digest changes.
+- The native root window (`@synopackageland/cli/authorization-sdk`) gave up
+  after about 30 s with `root_timeout`, while a loaded NAS ran the bootstrap
+  task for up to 4.5 minutes. It now keeps waiting while the task is queued or
+  running, up to 10 minutes, reports `{op, state, elapsedMs}` through
+  `options.progress`, and the authorization flow accepts the backend's ready
+  grant after `root_timeout` or `root_task_failed`.
+- A DSM certificate that Node does not trust failed with only
+  `fetch failed`. The CLI now reports `DSM_TLS_UNTRUSTED` with the origin and
+  certificate error and points to `NODE_EXTRA_CA_CERTS`; certificate checks
+  stay on.
+- Docs: on DSM 7.1 the purge timing lines are only in the journal
+  (`journalctl -t synopkgland-executor`); `init -t native-go` does not include
+  `armv7` in `arches`, so add it for an armv7 NAS.
+
+### Deploy and status fixes
+
+- `status` no longer reports `blocked` for every `identity: standalone`
+  project. It opens a short-lived App session from the administrator's DSM
+  session, reads `executor.status`, then logs out. That needs an `https://`
+  host; over `http://` the capability stays `blocked` and the reason says so.
+- `deploy` accepts the install wizard values of an `install-selected`
+  delegate: `--param delegate_share=<Shared Folder>` or
+  `--param delegate_home=true`. A first install without one now fails with
+  `DEPLOY_PARAM_REQUIRED` and a usage line before anything is built, instead
+  of failing inside DSM. Invalid values fail with `DEPLOY_PARAM_TYPE_INVALID`.
+- `deploy` and `status` work on a native layout (existing native product).
+  `deploy` builds the NAS architecture only; an `aarch64` NAS uses a declared
+  `armv8`.
+- The deploy note no longer says every upgrade needs approval: an
+  executor-only upgrade stays ready; a policy digest change needs approval.
+- Uninstall logs per-phase purge timing with the package name to the system
+  log (`synopkgland-executor`): `task cleanup timing` per task and
+  `purge timing` for the task and file phases. The executor digest changes.
+- `add root-ops` and `add portal` print a notice on stderr when they raise
+  `os_min_ver`.
+- `inspect` on an executor SPK describes the root boot and control tasks
+  instead of saying the package needs no root privileges.
+
+### DSM 7.1: root-ops and delegate approval work
+
+- DSM 7.1.1 has no `SYNO.Core.TaskScheduler.Root` or
+  `SYNO.Core.EventScheduler.Root`, TaskScheduler stops at v3 and
+  PasswordConfirm at v1, so approval failed with "Background file access is
+  unavailable" and `status`/`deploy` showed `rootOps: unsupported — DSM 103`
+  or `DSM 104`. DSM 7.1.1 answers a version above the API's maximum with 104
+  (PasswordConfirm v2, TaskScheduler `get` v4) and a method missing at an
+  existing version with 103 (TaskScheduler `list` v3). When DSM answers a
+  scheduler read or the password check with 103 or 104, the app now uses
+  PasswordConfirm v1, TaskScheduler `list` v2/`get` v3 and creates
+  the tasks with EventScheduler `create` v1 and TaskScheduler `create` v3.
+  The password is still confirmed first and both tasks are still read back
+  exactly before anything runs. Other errors (such as 105, 119, 102 or a
+  wrong password, 3121) never fall back, and a create is never retried. DSM
+  7.1 does not bind task creation to the password check; see the root-ops
+  guide.
+- `status` and `deploy` read the control task the same way.
+- Uninstall on DSM 7.1 now removes the boot and control tasks. The executor
+  looked the control task up with TaskScheduler `get` v4, which DSM 7.1.1
+  refuses with 104, so it wrote no task inventory and left both tasks behind.
+- If approval stops after it created a task (for example, the boot task was
+  created and the control task was not), the app deletes the tasks it created
+  in that attempt instead of leaving an enabled root boot task that nothing
+  owns. Tasks from an earlier approval stay.
+- A failed approval shows its reason and DSM error code in the app's settings
+  instead of only "Background file access is unavailable", and a refused
+  password reads as a password failure, not a scheduler failure.
+- After the app's settings approve, the window's status line no longer shows
+  "needs-admin-approval: Task is missing" until a reload; the window panel and
+  the settings now follow each other's results.
+
+### DSM 7.1: jobs import and file downloads
+
+- DSM 7.1.1 sends `SYNO.FileStation.Download` v2 replies without
+  `Content-Disposition`, so `bg.jobs.submit` and downloads failed with
+  `unavailable`. With no such header, a body of at most 4 KiB that decodes
+  as a DSM reply is still refused as that reply; any other body is the file.
+
+### Docs: build your own armv7 Go code with Go 1.26.9
+
+- On armv7 DSM 7.1.1 (kernel 3.10), a program built with Go 1.26.0 crashed
+  at start (`futexwakeup returned -22`, SIGSEGV) and Go 1.26.9 ran. Other
+  1.26 releases were not tested.
+
+### init: next steps install frontend dependencies
+
+- `init -t native-go` with a Vue frontend now lists `(cd frontend && npm ci)`
+  before `synopkgland build`; without it the build fails with
+  `STANDALONE_UI_BUILD_FAILED`. `build` still does not install dependencies.
+
+### Executor, daemon and gateway build with exactly Go 1.26.9
+
+- The CLI builds the executor, lifecycle helper, daemon controller and gateway
+  with `GOTOOLCHAIN=go1.26.9`, ignoring your `GOTOOLCHAIN`, `GOFLAGS`,
+  `GOEXPERIMENT`, `GOWORK` and `GOAMD64`/`GOARM64`, so every builder produces
+  the same executor digest. Go 1.21 or later downloads go1.26.9 when needed;
+  offline without it the build fails and names go1.26.9. A binary whose Go
+  build info names another release is refused.
+- Template go.mod files now say `toolchain go1.26.9`. The executor digest
+  changes; it is anchored in INFO, so an upgrade with an unchanged policy needs
+  no new approval.
+
+### INFO arch: four more DSM platforms
+
+- x86_64 SPKs now also list `broadwellntb`, `coffeelake` and `skylaked`, and
+  aarch64 SPKs list `rtd1619` (DSM Developer Guide Appendix A family members).
+  INFO `arch` now matches the platforms the package source maps to each family.
+
+### 繁體中文摘要
+
+- 升級後重新建置套件；executor digest 改變。**從 0.7.0 建的套件升級需管理員再核准一次**（0.7.0 的
+  executor 開啟套件 `target` symlink 時未跟隨連結，無法自行安裝錨定的 executor）；之後 0.7.1 起的
+  executor-only 升級不需核准。
+- executor：kernel 3.10（DSM 7.1，如 DS416 armv7）上 executor-only 升級與執行中再核准不再出現
+  `pid executable mismatch`；INFO 錨定升級不再誤報 `executor upgrade refused`，也不再先印
+  「paused: 需管理員核准」；`executor.status` 暫停時回 `paused`／`executor_not_listening` 與下一步。
+- 面板：executor 不回應時可再按一次「Approve background access」免密碼重啟；
+  `executor_status_mismatch` 會寫出原因（不回應／digest 不同／status 請求失敗）；
+  啟動後的 `executor.status` 等待改為 500 ms→2 s 退避，10 s 預算不變。
+- `daemon.timeouts` 預設改為 `{start: 30, stop: 30, status: 5, uninstall: 60}`，新增 `timeouts.uninstall`。
+- `identity: standalone`：DSM 網頁 session（SynoToken）下「Continue with DSM」與 root-ops 核准修正；
+  核准建立 task 後 executor 未啟動時自動撤回本次建立的 task；卸載不再誤記 `task cleanup unconfirmed`。
+- 原生 root window 等待上限改為 10 分鐘並回報進度；`DSM_TLS_UNTRUSTED` 指向 `NODE_EXTRA_CA_CERTS`。
+- `status`／`deploy`：standalone 專案的 status 改用短期 App session；`deploy` 接受
+  install-selected delegate 的精靈參數；支援 native layout；卸載記錄 purge timing。
+- DSM 7.1：無 Root API 時改走 PasswordConfirm v1／TaskScheduler v2–v3／EventScheduler create v1，
+  卸載會移除 boot／control task；`SYNO.FileStation.Download` v2 無 `Content-Disposition` 的下載修正。
+- 建置：executor、lifecycle、daemon、gateway 一律以 Go 1.26.9 建置（armv7 kernel 3.10 上 1.26.0 會當機）；
+  INFO `arch` 新增 `broadwellntb`、`coffeelake`、`skylaked`、`rtd1619`。
+- 測試工具：`scripts/test/executor-bump.py` 收進 repo，會一併改寫視窗腳本內嵌的 executor pin。
+
+## 0.7.0 (2026-10-10)
+
+Rebuild packages to pick up template, hook and executor changes. The executor
+digest changed: apps approved under an earlier CLI need one administrator
+approval after upgrading.
+
+### Delegate: save destinations that last until revoked
+
+- `init --with delegate` / `add delegate` now declare `operations:
+  [files.moveFromStaging]`, `destinations: [save]`, `lifetime: until-revoked`,
+  `scope: install-selected`. Existing TTL declarations (`files.list` …
+  `files.write`, `scope: home`) keep their API and limits.
+- The install wizard pre-selects home or a local share and an administrator
+  confirms it once. Choosing a destination in the SDK NasPicker grants it until
+  revoked, after fresh DSM session, UID and write checks; administrators run as
+  their own UID, never root. Read the choice from `delegate.status`
+  `selection`, `sdk.destination(key)` or Go `Service.Destination`.
+- Daemon and export producers save through Go `Service.MoveFromStaging`. The
+  generated Background saves page (`createBackgroundSaveFacade`) lists, cancels
+  and revokes them and includes a working example (`ExportExample`). Daemon can
+  combine with an until-revoked delegate worker.
+- Retrying `MoveFromStaging` with the same params never copies twice. Journal
+  errors `canceled`, `jobs_busy` and `jobs_unavailable` are retryable;
+  `spool_unsafe` and `journal_corrupt` are terminal.
+- Cancel is idempotent per reference and survives executor crash, package
+  restart and logout. Revoke, scope change and disable settle copies in flight
+  as `canceled` with that reason (for example `scope-changed`); a scope change
+  no longer restarts the executor. Poll `ctx.executor.status()` while a change
+  answers `blocked`.
+- Full device lifecycle acceptance (install → setup → reboot → upgrade → revoke
+  → uninstall) is still pending.
+
+### Executor
+
+- Upgrades keep approval: each SPK writes its executor SHA-256 into INFO
+  (`synopkgland_executor_sha256`), and a new executor that matches it installs
+  without PasswordConfirm as long as the policy is unchanged. Policy changes
+  (operations, scope, destinations, root scripts) still need approval. `inspect`
+  refuses a missing, duplicated or different anchor.
+- A root supervisor restarts the monitor after a crash or kill (1–60 s
+  backoff), so delegate and rootOps recover without a reboot.
+- Every write publishes only through the executor handshake. A copy whose
+  executor died stops within 1 MiB and removes its `.part`; a lost publish
+  receipt settles `committed` without copying again.
+- A package without an executor can add one in place on upgrade. Upgrade does
+  not approve an install-selected scope; confirm it in Settings.
+- Uninstalling a stopped package no longer leaves root tasks and the monitor
+  running for ten minutes; the hook waits at most 50 s for the executor to clean
+  up.
+
+### Native layout: per-architecture INFO trust anchors
+
+- `layout.anchors` maps `<key>_sha256` to a payload file. `build` writes that
+  architecture's SHA-256 of the file into INFO, so a product root helper can
+  trust a new build through the root-owned INFO instead of reapproval. Keys
+  match `^[a-z][a-z0-9_]{0,48}_sha256$`, the `synopkgland_` prefix is reserved,
+  and at most 16 are allowed. `inspect` refuses a changed, duplicated, missing
+  or undeclared anchor.
+
+### App entry and Application Privileges
+
+- `entry: admin-only` admits administrators only, on every route including the
+  SDK routes; ordinary users get `admin_required`. `entry: app-privilege`
+  registers the app in Control Panel > Application Privileges and gates every
+  route on DSM's decision (`app_privilege_denied`). Omitting `entry` keeps the
+  previous behaviour and byte-identical SPKs.
+- With an `entry`, an app route marked `authenticated` or `public` fails with
+  `STANDALONE_ENTRY_WIDENED`. `inspect` prints the entry mode and flags
+  `ENTRY_LAUNCHER_MISMATCH`.
+- The executor applies the same rule: moves for a user DSM no longer allows are
+  refused (`APP_DENIED`).
+- `ctx.user = {name, isAdmin}` lets UIs hide administrator settings; guard them
+  on the server with Go `api.RequireAdmin(caller)`.
+- On Linux 3.10 kernels without `memfd_create` (DSM 7 on x86_64 avoton,
+  braswell, bromolow, grantley) the administrator and App Privileges bridges run
+  from an unlinked file in the package's own tmp instead of failing. That path
+  has no memfd seal. Verified on DSM 7.1.1 with an armv7 build only; no x86_64
+  Linux 3.10 model has been tested.
+
+### Application Portal
+
+- `portal: {}` or `portal: {alias}` (native) and `integration.web.portal`
+  (Compose DSM-window apps); `synopkgland add portal` adds it. The install
+  wizard prefills the alias, upgrades keep it and an administrator activates it.
+- `ctx.portal.mountPanel(element)` shows the link, or the alias form to
+  administrators; the Vue and plain starters mount it.
+- A portal needs `os_min_ver` 7.3.2-86009 or later (DSM 7.1.1 rejects it with
+  error 320; 7.2 is untested). validate/build fail with
+  `STANDALONE_PORTAL_MIN_DSM` / `CONTRACT_PORTAL_MIN_DSM`, and `add portal`
+  raises a lower `os_min_ver`.
+
+### Catalog metadata
+
+- An optional `metadata:` block (contact/support email, homepage, source and
+  issues URLs, license, localized long description, changelog, screenshots) is
+  validated and written to INFO for the package catalog.
+- `metadata.changelog` may be a per-language map. Package Center shows one line
+  in the NAS language, so put the most important change first.
+
+### Native authorization
+
+- `authorization_required` gains `reason: upgrade_reapproval` when an upgrade
+  revoked the old grant; the Gate template explains the next step in nine
+  languages. Products that sync the Gate need their helper to write and clear
+  the reason-only tombstone, which grants nothing.
+
+### Lifecycle
+
+- Background packages restart a package user systemd manager that lost its
+  runtime socket; a failed worker start names the unit, exit code and socket
+  state.
+- Stopping the worker is idempotent, fixing uninstall failure 314 for
+  delegate+daemon+jobs.
+
+### Templates in nine languages
+
+- All template UI text and install, upgrade and uninstall wizard messages come
+  from catalogs in the nine DSM languages and follow DSM glossary wording. Sizes
+  use DSM's 1024-based KB/MB/GB. Rebuilt Vue and binary SPKs change bytes;
+  plain-UI SPKs are unchanged.
+- Vue templates pin public `@synopackageland/ui@0.8.1`; the upload FilePicker
+  states `max 16 GB`.
+
+### armv7 (32-bit ARM) for native-go and binary packages
+
+- `arches` accepts `armv7` (INFO `alpine alpine4k armada38x monaco`, DSM 7.2+);
+  the default stays `[x86_64, aarch64]`. It covers the Go CGI (plain or Vue UI),
+  `backend.kind: binary`, jobs, daemon, root-ops and delegate. Container
+  projects refuse it with `CONTAINER_ARCH_UNSUPPORTED`.
+- The plain native-go CGI was verified on a DS416 (DSM 7.1.1, `alpine4k`).
+  armv7 jobs, daemon, executor and lifecycle helper are built and checked but
+  not yet verified on a NAS; `armada38x` and `monaco` are untested.
+- `deploy` detects armv7 from an Annapurna Labs CPU and asks for `--arch` on a
+  Marvell CPU. x86_64 and aarch64 bridge, executor and lifecycle bytes are
+  unchanged by the armv7 work.
+
+### Packaging
+
+- The npm tarball includes this CHANGELOG.md.
+
+### 繁體中文摘要
+
+- 升級後重新建置套件；executor digest 改變，舊版 CLI 核准過的 app 需要管理員再核准一次。
+- delegate：預設改為長期存檔目的地（`files.moveFromStaging`、安裝時選 scope、管理員確認一次、
+  在 NasPicker 選目的地即授權至撤銷）；Background saves 頁、`MoveFromStaging` 重送不重複複製、
+  取消跨重啟保留。完整裝置生命週期驗收仍待完成。
+- executor：INFO 錨定 executor SHA-256，policy 不變的升級免再核准；root supervisor 異常後自動重啟；
+  卸載已停止的套件不再殘留 root task。
+- 原生 layout：`layout.anchors` 依架構把 payload 檔 SHA-256 寫進 INFO，作為產品 root helper 的信任錨點。
+- `entry: admin-only | app-privilege`（DSM 應用程式權限）、`ctx.user.isAdmin`、`api.RequireAdmin`；
+  未宣告 entry 的 SPK 不變。Linux 3.10 無 memfd_create 時 bridge 改由套件 tmp 執行（無 memfd seal）。
+- Application Portal（`portal:`、`add portal`、`ctx.portal`），需 os_min_ver 7.3.2-86009 以上；
+  目錄 `metadata:` 寫入 INFO，`metadata.changelog` 可依語言分開。
+- 授權契約新增 `reason: upgrade_reapproval`；背景套件 user manager 恢復、卸載 314 修正。
+- 範本與安裝精靈全部九語系並依 DSM 用語；Vue 範本固定 UI 0.8.1。
+- armv7（DSM 7.2+）支援 native-go 與 binary；plain CGI 已在 DS416 實機驗證，jobs／daemon／executor 尚未實機驗證。
+- npm 套件附 CHANGELOG.md。
+
+## 0.6.1
+
+- Restore native product packaging as a formal schema 2 `backend: {kind: native}`
+  route. Keep project-owned multi-binary payload/metadata layout, prepare/compile
+  argv hooks, HTTPS/SHA-256 toolkit acquisition and x86_64/aarch64/armv8/armv7.
+  `check`, `build` and `inspect --json` preserve package-only lifecycle/systemd
+  registration and reject root service accounts, privileged execution prefixes,
+  symlinks, setuid files and corrupt toolkit/payload inventories.
+- Restore `@synopackageland/cli/authorization-sdk` as an explicit native-product
+  adapter with exact pinned-task identity, fresh administrator approval and
+  withdrawal-before-task-removal; do not change generated Go executor semantics.
+  Export `./native-layout` and retain direct `./dist/*` imports.
+- Document field migration from schema 1 without changing product bootstrap pins,
+  per-build revocation/reapproval or dynamic DSM ABI declarations. Schema 1 remains
+  rejected; no compatibility aliases for retired CLI commands. Generated schema 2
+  check/build/status/logs and Connect/Gopeed APIs remain unchanged.
+- Align SKILL.md with the shipped delegate/rootOps executor implementation and
+  its documented device acceptance boundaries.
+- 正式補回 schema 2 原生產品 layout／hooks／toolkit／三架構及 authorization SDK。
+  lifecycle／systemd 維持 package account；root 僅由產品明確核准 digest，
+  不自動授權、不取消逐 build 撤權再授權。新增 Reclaim 欄位 migration 指引。
+
+## 0.6.0
+
+- Adopt UI 0.8.0 and its renamed `syno-pkg-land-ui` executable (no old alias).
+  Pin generated Vue apps and all overlays to the public npm artifact and integrity.
+  Skills discover the installed prompt/catalog/describe contract with
+  `npx --no syno-pkg-land-ui`; one-off use explicitly selects the npm package.
+  Render defaults to `syno-pkg-land-ui-render`. CSS/data selectors use the
+  `syno-pkg-land-ui` namespace without old aliases (including select attributes).
+  Add a regression audit for executable names and retired CSS/data selectors in
+  skills, templates, source, tests, docs and scripts; only released history is exempt.
+  跟進 UI 0.8.0 的 CLI 改名及公開 npm integrity；AI 指引維持版本無關，
+  使用已安裝契約，並防止指令名與 selector 回退。預設截圖目錄改為
+  `syno-pkg-land-ui-render`；CSS／data selector 全面使用新 namespace，不保留 alias。
+
+- Add version-independent Vue UI guidance alongside JSON UI guidance. All
+  generated projects include AGENTS.md and a CLAUDE.md pointer to discover the
+  bundled skills and run local check/build/inspect before authorized NAS work.
+  Template design notes use installed UI contracts while dependency pins remain.
+  新增 Vue UI skill；所有 scaffold 提供 AI 入口與本機驗證流程，設計文件依已安裝
+  SDK 契約，依賴鎖定不變。
+
+- **Breaking: remove `./authorization-sdk` and the legacy root authorization
+  templates and adapters.** Use delegate/root-ops capabilities and the protected
+  executor with one-time administrator approval; no compatibility exports remain.
+  **不保留相容**：移除 `./authorization-sdk` 與舊 root authorization 模板／adapter，
+  改用 delegate／root-ops 能力及受保護 executor 的一次管理員核准。
+
+- Pin generated Vue apps to public `@synopackageland/ui@0.8.0` with its npm
+  integrity; keep bounded app-local modal roots, embedded CSS and unique mount
+  ID prefixes, and explicitly retain DSM window layout at wide sizes.
+  Add `skill show ui-json` with installed prompt/catalog/schema discovery,
+  strict validation and screenshot/layout checks through the published `syno-pkg-land-ui`
+  package bin. Update the template
+  DOM test dependency and website configuration to remove gate warnings.
+  Vue 模板固定公開 UI 0.8.0 與 integrity，維持 DSM 的 app scope、embedded CSS、
+  唯一 mount ID 與 window layout；新增不固定版本的 JSON UI skill，依已安裝
+  catalog／schema 產生、嚴格驗證並 render，直接使用套件的 `syno-pkg-land-ui` bin。
+
+- **Delegate (C), P2/v10 (through 26030e74):** `init --with delegate` / `add delegate` imply jobs;
+  manifest operations use the five fixed files.* IDs with home/shared scope.
+  The worker stages downloads and writes as the consenting user after browser
+  close, without overwriting existing files or retaining DSM credentials.
+  C/R share one-password boot/control task setup and digest approval; stop pauses,
+  start resumes identical pins, changed policy requires reapproval, and uninstall
+  requests asynchronous own-task/protected-state purge (normally seconds with a
+  healthy monitor), with manual cleanup guidance. Task deletion requires byte-for-byte
+  equality with canonical scripts regenerated from package identity and approved pins.
+  Purge reapproval recreates tasks and writes `start` before boot; mailbox failure
+  blocks boot. Local fake-DSM/real-executor lifecycle tests cover this recovery.
+  Package-directory/INFO identity absence immediately pauses the socket/requests,
+  retaining the monitor, approved runtime, delegations and tasks. Polling every
+  500 ms must confirm 10 continuous minutes of absence before fallback purge;
+  reappearance or unverifiable absence resets the timer, with uncertainty staying paused.
+  Recovery rereads even an unchanged mailbox: matching-pin `start` resumes,
+  changed pins stay paused/needs-admin-approval, `stop` stays paused, and `purge`
+  immediately clears state. Temporary DSM-upgrade gaps preserve protected state;
+  preuninst purge remains immediate, with asynchronous cleanup. Boot's absent-package
+  retained-pin purge remains immediate. Local tests cover upgrade gaps, recovery,
+  timer/reset rules and immediate preuninst purge; device acceptance remains separate.
+  Malformed AppPriv responses fail closed, including duplicate keys/target entries,
+  null/missing data and nested error keys. Matching token header aliases are allowed;
+  conflicting/repeated headers, duplicate id cookies and controls are refused.
+  Empty/partial caller auth never falls back to worker revoke. Job admission reserves
+  before creating grants outside the journal lock; retry `jobs_busy` with the same key.
+  Writes fsync an exclusive hidden temporary then publish a hard link without overwrite;
+  cancellation cleans the temporary and leaves no partial final file.
+  Add bilingual developer and administrator guides covering typed Files, stable
+  errors, AppPriv defaults/denies and DSM-retained directories/accounts.
+  Full device lifecycle acceptance remains separate from source/local tests.
+  Delegate 隱含 jobs；以本人身分離線寫檔、不覆寫、不保存 DSM 憑證。
+  C／R 共用一次密碼設定與 digest 核准；中英文文件說明委託／撤銷、
+  typed Files、穩定錯誤碼、paused／purge、手動清理與 DSM 保留界線。
+  AppPriv 異常回應 fail-closed；token alias 同值允許、衝突／重複及控制字元拒絕，
+  空／不完整 caller auth 不降級為 worker。`jobs_busy` 沿用相同 key 重試。
+  隱藏暫存檔 fsync 後以 hard link 發布，不覆寫、取消不留半個正式檔。
+  特權清理非同步，monitor 正常時通常數秒完成；刪 task 前完整 script 須逐字相符。
+  Purge 後重新確認密碼、重建 task，boot 前 mailbox 重設 `start`；寫入失敗不執行 boot。
+  套件目錄／INFO identity 消失立即關 socket、取消／drain 請求並暫停，保留 monitor、
+  核准 runtime、委託與 task；每 500 ms 輪詢確認連續消失達 10 分鐘才後備 purge。
+  重新出現或無法確認消失皆重設計時；無法確認時維持 paused。
+  恢復時重讀未變 mailbox：`start` 且 pins 相同才恢復，pins 改變維持 paused／
+  needs-admin-approval，`stop` 維持暫停，`purge` 立即清理。DSM 升級短暫空窗不誤清；
+  preuninst purge 仍立即處理、非同步清理；boot 套件不存在時驗 retained pins 立即 purge 不變。
+  本機測試涵蓋升級空窗、恢復、計時／重設及 preuninst 立即 purge，不代表裝置驗收。
+
+- **Breaking: schema 2 and task-based CLI, with no compatibility layer.**
+  Native-go and binary now use dsm-package.yaml schema 2 with backend.kind and
+  declared capabilities. Use init → check → build → deploy → status, positional
+  inspect <spk> and logs. The former build-spk/validate/info/log commands, native
+  layout/native.yaml, native privilege/background/fileStation fields and old
+  capability flags are removed; there are no aliases or migration shims.
+  Schema 2 uses --with files,jobs,delegate,login,root-ops or add to extend native-go:
+  private owner-bound data/jobs (A), live caller-session files/tree/transfers (B),
+  standalone identity (I), offline delegation (C), and fixed administrator
+  operations (R). C/R share one-time protected executor approval.
+  Manifest delegate.operations uses
+  files.list/files.info/files.createFolder/files.checkPermission/files.write
+  directly. Check/build/inspect/deploy/status support structured JSON results.
+  Compose retains its separate contract and uses init -t compose, optionally
+  importing with --from. No publish or signing command is added.
+  **不保留相容**：native-go／binary 改用 schema 2；CLI 依工作流程改名，
+  移除舊欄位、旗標、指令與 native layout，不提供 alias 或 shim。
+  A／B／I／C／R 以能力宣告選用；C／R 共用 executor 一次核准。
+
+- Generate background submit/schedule keys with cryptographic getRandomValues,
+  which works on DSM HTTP; do not require secure-context randomUUID.
+  背景工作及排程以 getRandomValues 產生請求鍵，可在 DSM HTTP 使用；
+  不再依賴僅限安全環境的 randomUUID。
+
+- Give interactive File Station uploads their own bounded twenty-minute
+  response-header deadline without changing the shared metadata transport.
+  互動 File Station 上傳使用獨立的二十分鐘回應標頭期限，不修改共用查詢 transport；
+  保留目前 session、不覆寫、不重試及寫入結果不確定契約。
+
+- Frame native-Go CGI JSON with exact byte lengths, including Unicode and
+  refusal/serialization failures; retain DSM's HTTP-200 JSON error convention.
+  native-Go CGI JSON（含 Unicode、拒絕及序列化失敗）提供精確位元組長度，
+  並保留 DSM 的 HTTP 200 JSON 錯誤契約。
+
+- Replace R2 publication with a private GitHub catalog and streamed Release SPKs.
+- Serve live bilingual catalog pages and architecture-specific manual downloads.
+- Remove the two web demo templates; retain native-go, binary and the single compose template.
+
+## 0.5.3
+
+- Ship the native-go root authorization template with build-pinned plans,
+  the canonical Vue gate and nine language catalogs, explicit native approval,
+  exact disabled tasks, bounded legacy terminal proof and lifecycle withdrawal.
+- Export `@synopackageland/cli/authorization-sdk` for reviewed native-layout
+  adapters to consume the same host runtimes and canonical template resources.
+- Let an explicitly supplied native-layout withdrawal callback finish before
+  removing tasks; failed or missing callbacks abort withdrawal.
+- Legacy DSM authorization has no server-enforced one-use create token;
+  modern DSM keeps its native one-use PasswordConfirm token contract.
+- Isolate packed Docker runtime smoke in temporary share directories and its
+  own Compose project, including owned-volume cleanup. The 0.5.1 release tag
+  did not publish because the existing smoke omitted installer share values.
+- Use a pinned long-running imported runtime fixture for readiness smoke;
+  the default hello-world demo exits immediately. The 0.5.2 workflow was
+  cancelled before publication when CI exposed that fixture race.
+- Retain bounded artifact-test diagnostics up to eight MiB and propagate
+  real frontend test failures rather than hitting Node's default buffer limit.
+
+## 0.5.0
+
+- Add opt-in native layout packaging for existing products: argv-only build hooks,
+  checksum-pinned HTTPS toolkit caching, custom package-user metadata/payload
+  layouts, explicit ELF linkage assertions, DSM armv8/armv7 and build overrides.
+- Inspect native layouts with complete payload hash/mode and INFO checksum checks;
+  generated templates retain their existing privilege and architecture contracts.
+
+- **GitHub CI and tag-based npm releases** (CI-LAND). Add shared full gates, Docker
+  runtime/tarball smoke and credential-free release dry runs for both npm packages.
+  Version tags require matching metadata, default-branch ancestry, an unpublished
+  version and versioned CHANGELOG notes. Push scripts now use the existing GitHub
+  origin; `push:all` preserves the separate Community Apps synchronization.
+
+- **Vue templates pin UI 0.5.7 and let the UI text follow the app locale**
+  (TEMPLATE-UI-057). Every `native-go --ui vue` project pins
+  `@synopackageland/ui@0.5.7` (integrity `sha512-egHKoU4J...`). Each app root now wraps
+  its content in `ConfigProvider locale`, set from the DSM language by the template's
+  existing `uiLocale()` mapping, so the UI's built-in text follows it in the nine
+  built-in locales. The template drops the per-control `FilePicker` locale and the
+  `Link` `download-label` that only repeated those defaults; a template test requires
+  the provider and rejects those overrides. 0.5.7 also resolves `FormItem`
+  `direction="auto"` by the item's own width, stacks `SettingsRow` below 520px and
+  keeps `KeyValueRow` values wrapping; the template needed no mitigation for any of
+  these. Existing 0.5.6 projects upgrade by regenerating, or by changing the pin and
+  re-running `npm ci`.
+- **Vue templates use the UI controls instead of native form elements**
+  (TEMPLATE-SELECT). The job form's worker and operation pickers and the
+  background schedule interval are now `Select`; the schedule consent is a
+  `Checkbox`; the job, schedule, sample-note and folder forms are `Form` +
+  `FormItem` + `FormActions` (vertical, controls capped at `md`), and the
+  hand-written `.integration-field` label CSS is gone. Labels are wired to
+  `Input` and `Textarea` through the FormItem control id. A template test now
+  fails when any `.vue` file renders a native `<select>`, `<option>`,
+  `<textarea>` or `<label>`, or a `FormItem` outside a vertical `Form`. Three UI
+  gaps remain and are not worked around with custom components: `Select` does
+  not take the FormItem control id (each Select carries a labelled
+  `role="group"` so it keeps an accessible name), the upload stays a native
+  `<input type="file">` because `FilePicker` hard-codes English "Choose files" and
+  "max" text, and the file download keeps a native `<a>` (no link component).
+  Existing projects pick this up only by regenerating; nothing changes in the
+  manifest, routes or backend.
+- **Tarball smoke covers the default Vue UI and explicit plain UI**
+  (SMOKE-PACK-VUE). Install each generated Vue frontend with its lockfile before
+  building; keep both architectures and explicit root fixtures, then binary and
+  container packaging. The container smoke now selects `--arch x86_64` for
+  `-o app.spk` and its deployment plan, as explicit output requires one arch.
+  Docker runtime QA is opt-in with `smoke-pack.sh --docker`
+  and is explicitly skipped otherwise. Failed npm UI builds without installed
+  dependencies now name the UI directory and suggest `npm ci` (or `npm install`
+  without a lockfile) before retrying `build`; builds never install implicitly.
+
+- **Vue templates pin UI 0.5.5 and use PageContent** (TEMPLATE-UI-055). Every
+  `native-go --ui vue` project pins `@synopackageland/ui@0.5.5` (integrity
+  `sha512-pLQmZqNH...`). The sidebar shell now wraps the page header and the page
+  content in the library `PageContent`, so a maximised window keeps both on the
+  same left and right edges; the page area scrolls inside it. 0.5.5 also adds
+  `CardGrid`, `FormActions`, `RepeatRows` and `fieldWidth`; the template has no
+  card lists or custom width CSS, so it needs none of them. Default change to
+  know when upgrading: form controls are capped at `md` (320px) unless you pass
+  `field-width="full"`. Existing 0.5.4 projects upgrade by re-running `npm ci`
+  after the pin change.
+
+- **Vue templates pin UI 0.5.4** (TEMPLATE-UI-054). Every `native-go --ui vue`
+  project now pins `@synopackageland/ui@0.5.4` (integrity `sha512-mzuGUO+8...`).
+  0.5.4 is visual only and changes nothing in the template source: under the
+  embedded theme, Card, EmptyState, PageHeader and WizardStep titles no longer
+  carry a default margin, the expand buttons of SettingsSection, Card and
+  ExpandableItem lose their grey box, and dashed separators draw only the bottom
+  edge. Existing 0.5.3 projects upgrade by re-running `npm ci` after the pin change.
+
+- **Root tasks retain DSM 7.1 support.** Probe `list v3` and use the legacy
+  `create v3`, `list v2`, `get v3`, `run/delete v2`, and `view v1` only on code
+  103. Preserve native password confirmation while distinguishing tokenless
+  success from cancellation; DSM 7.1 has no server-side root-creation password
+  token. Require a new successful completion record within a bounded deadline,
+  exact task identity, and no mutation retries. Root init, validation, and build
+  keep a consistent minimum of DSM 7.1-42661.
+- **Vue templates pin UI 0.5.3** (TEMPLATE-UI-053). Every `native-go --ui vue`
+  project pins `@synopackageland/ui@0.5.3` in `frontend/package.json` and its
+  npmjs lockfile (integrity `sha512-ieKdf0nB...`). 0.4.2 to 0.5.3 is additive for
+  the template: new components (Select search and groups, Combobox,
+  MultipleSelect, SuperboxSelect, Grid/Row/Col, Space, Affix, Breadcrumb,
+  Pagination, SegmentControl, Card, Panel, Fieldset, Form, Notification, and more),
+  DataGrid grouping/expansion/reorder, checkable and draggable TreeView, DropdownMenu
+  submenus, and `Input`/`Dialog`/`SettingsSection`/`Callout` options with unchanged
+  defaults. Visual changes: Tabs and SectionTabs share a sliding marker with a
+  160ms panel fade, the Spinner is a full rotating ring (both honour
+  `prefers-reduced-motion`), selected tab labels are blue, and the DataGrid footer
+  draws both borders and fills its flex container. The template needed no API
+  change; it now uses the library `Checkbox` and `Input` for the consent and limit
+  fields instead of native inputs. Existing 0.4.2 projects upgrade by re-running
+  `npm ci` after the pin change.
+
+- **Templates never copy a local `node_modules`/`dist`** (TEMPLATE-COPY). A
+  template checkout used for development could leak its own install directory or
+  build output into a generated project, shadowing the project's `npm ci`.
+
+- **Vue templates pin UI 0.4.2** (TEMPLATE-UI-042). Every `native-go --ui vue`
+  project pins `@synopackageland/ui@0.4.2` in `frontend/package.json` and its
+  npmjs lockfile. 0.4.1/0.4.2 are visual, backward-compatible control changes with
+  no API change: controls share the `--ui-control-*` tokens and
+  `--ui-radius-control`, so overriding `--ui-radius-sm`/`--ui-radius-md` no longer
+  reshapes them; a disabled grey button keeps its surface, a loading button keeps
+  full strength, and the Switch track padding is reset. Existing 0.4.0 projects
+  upgrade by re-running `npm ci` after the pin change.
+
+- **Private-copy background schedules (S1-a)**: hourly/daily/weekly owner-scoped
+  creation, disable/delete, 8-definition limit, durable atomic trigger checkpoints,
+  missed-without-catch-up recovery, revision mismatch disable and explicit admin
+  re-enable. The Vue panel covers nine locales. Imported/pinned copies count toward
+  quotas; completed results never replay and owner purge also removes schedules.
+  Package account only, no stored credentials or offline personal ACL access.
+  Evidence: local gates and vt-nas DSM 7.4 x86_64 controlled-due-time tests
+  (two runs per owner, stop/start, +1 upgrade, disable and fresh normal1 browser
+  readback). This is not an hour-long cadence or reboot guarantee.
+
+- **Minimum DSM 7.1 and multiple architectures** (DSM-COMPAT). Every template now declares
+  `os_min_ver: "7.1-42661"` (DSM 7.1; before: `7.2-64570`, `7.2-69057` or `7.2-60000`).
+  `init --min-dsm` and `build --min-dsm` take `7.0`, `7.1`, `7.2` or a full
+  `7.x-build` to override it. `build --arch` accepts a comma-separated list
+- **Per-runtime minimum DSM and multiple architectures** (DSM-COMPAT, DSM-COMPAT-2).
+  `native-go` and `binary` declare `os_min_ver: "7.1-42661"` (DSM 7.1; before:
+  `7.2-64570`, `7.2-69057` or `7.2-60000`). The container templates declare
+  `7.2.1-69057` (DSM 7.2.1), and `init --min-dsm`/`build --min-dsm` refuse a
+  container value below it (`MIN_DSM_CONTAINER_FLOOR`) because Container Manager's
+  docker-project worker only exists from DSM 7.2.1; `inspect` reports the same
+  gap on an already-built container SPK. `--min-dsm` takes `7.0`, `7.1`, `7.2`,
+  `7.2.1` or a full `7.x-build`. `build --arch` accepts a comma-separated list
+  (`x86_64,aarch64`); without it every family is built, one SPK per family (binary and
+  gateway container Apps used to require `--arch`). `inspect` flags an INFO `arch`
+  that mixes families or names an unknown platform, a CGI built for another family than
+  INFO declares, and an `os_min_ver` that is not a DSM 7 `<version>-<build>`. The
+  x86_64 INFO platform list now includes `kvmcloud`, `epyc7003` and `epyc7003ntb`.
+  Only DSM 7.4 x86_64 has been run.
+- **Ordinary-user background jobs (U1)**: administrators may independently enable
+  `allowOrdinaryUsers`. Fresh DSM username/UID ownership isolates list/get/cancel/result,
+  counts and idempotency keys; unknown UIDs fail closed. Per-owner admission is bounded
+  to 2 pending jobs and 1 MiB including reserved results, under the same spool lock.
+  Administrators can cancel all jobs and explicitly purge an exact owner with durable
+  audit and running-job drain. The Vue panel and all nine locales cover both roles.
+  No root or stored user credentials; S1-a adds private-copy schedules below.
+
+- **Container gateway directory groups** (GW-DIRECTORY-GROUPS). Accounts absent
+  from `/etc/passwd` now resolve groups through DSM NSS using the fixed `/usr/bin/id`
+  as the package account. Qualified `DOMAIN\group` and `group@domain` names retain
+  their exact domain and case, including internal spaces; lookup failure denies.
+  The SDK caches nothing (TTL 0); DSM NSS caches and already-open streams remain
+  limitations. AD resolver allow/deny checks passed in a non-root DSM 7.4 package
+  CGI; LDAP, AD-user browser login and group-removal propagation remain unverified.
+  Rebuild container SPKs to obtain the change.
+
+- **`synopkgland images pin` resolves and writes container image digests**
+  (IMAGE-DIGEST-CLI). It reads every service image in `compose.yaml`, asks the
+  registry for the current multi-arch manifest digest over the OCI Distribution
+  API (anonymous Bearer token flow for Docker Hub and ghcr; no Docker daemon or
+  `buildx`), and rewrites the reference to `tag@sha256:…` in place, keeping
+  comments and file layout. `--check` reports unpinned and stale pins without
+  writing and exits non-zero. `inspect`'s unpinned-image finding now points at
+  the command. Evidence: local unit tests against a fake registry plus one manual
+  Docker Hub resolution of `busybox:1.36`; not verified on a real DSM.
+- **Container upgrade wizard no longer breaks on an untouched Run-as control; numeric
+  command arguments are rejected for every Compose route** (WIZARD-LIVE-CHECK).
+  Measured on vt-nas (DSM 7.4-90069) with the `compose-import` template: an untouched
+  upgrade submitted `RUN_AS` pre-filled with the name of the first Shared Folder, `preinst`
+  failed, and DSM, which removes the old version before it runs the new `preinst`, left the
+  package not installed (data kept). A `dsm_user` now has the same "Change Container Run-as"
+  box as a Shared Folder: on an upgrade the submitted user only counts when that box (or
+  `deploy --run-as`) is set; otherwise the installed user is kept. Also on vt-nas: the
+  Docker Project worker drops YAML quotes, so `command: ["sleep", "3600"]` ended the
+  install as broken (`failed to acquire postinst worker`). `synopkgland check` and
+  `build` already rejected that on the static route; the dynamic route (install
+  parameters, which includes `compose-import`) now rejects it too
+  (`COMPOSE_NUMERIC_COMMAND_ARG_FORBIDDEN`).
+- **`install.sharedFolder`** (T-0120): native-go packages can declare a Shared Folder (`select` wizard or `create`
+  via DSM `data-share`), stored by name in `var/config.json`; `init --shared-folder select|create` and an `inspect`
+  check are included. In `select` mode the administrator grants the package account access afterwards.
+- **Container gateway accepts a query SynoToken; known limit with DSM CSRF protection on**
+  (GW-QUERY-TOKEN). On `GET`, `HEAD` and `OPTIONS` with an empty `X-SYNO-TOKEN`, the
+  gateway hands a `?SynoToken=` value to `authenticate.cgi` (header wins; still stripped
+  upstream); state-changing methods are unchanged. Measured on DSM 7.4 with "Improve
+  protection against cross-site request forgery attacks" on: opening a container App
+  from the DSM desktop sends no token at all, so the gateway answers `401`
+  `session_required`. Known limitation: turn the setting off or use the `native-go`
+  template.
+- **Container gateway: readable errors, SSE and WebSocket** (GW-ERRORS-WS). DSM's web
+  server replaces the body and headers of any CGI reply with status `403`, `404`,
+  `500`, `502`, `503` or `504` by its generic error page (measured on DSM 7.4-90069;
+  every other status passes whole). The gateway therefore no longer sends those
+  statuses itself: `forbidden` and `token_required` arrive as `401`, a stopped
+  container as `521` with `Retry-After`, a timeout as `524`, an invalid reply as
+  `520`; every gateway error carries `X-Synopkgland-Error` (the code) and, for a
+  stand-in, `X-Synopkgland-Status` (the status it replaces). **Behaviour change:**
+  those statuses were `403`/`503`/`504`/`502`/`500` before. A request header
+  `X-Synopkgland-Keep-Error-Body: 1` makes the same swap for the container's own
+  error replies so an App can read its JSON error bodies. Server-Sent Events pass
+  through unbuffered and **WebSocket now works** (it answered `501`): DSM hands both
+  directions of an upgraded connection to the CGI, which the gateway uses; the
+  handshake must pass the same same-origin check as a state-changing request
+  (`cross_site_blocked`), because a browser cannot add `X-SYNO-TOKEN` to a handshake. Other protocol upgrades stay
+  `501`. See [Container access control](/docs/guides/container-access/).
+- Fix: **`dsm-groups` with `groups: [users]` let nobody in.** DSM keeps no member
+  list for `users` (every local account has it as its primary group), so the gateway,
+  which only read member lists from `/etc/group`, answered `403` to everyone, including
+  administrators (reproduced on vt-nas). The gateway now also counts the primary gid
+  from `/etc/passwd` as membership and fails closed if it cannot read that file.
+  Rebuild the SPK to pick it up. Real-account `dsm-groups`/`dsm-admins` checks passed on
+  vt-nas (x86_64); the aarch64 gateway is verified in an arm64 Linux VM only, not on an
+  aarch64 DSM NAS.
+- **Gateway CSRF check no longer relies on the SynoToken value** (GW-TOKEN). On a NAS
+  where DSM's "Improve protection against cross-site request forgery attacks" is off (vt-nas: `enable_syno_token="no"`), DSM
+  issues one fixed placeholder token to every session and validates nothing. The container
+  gateway now also requires `Sec-Fetch-Site: same-origin` and/or an `Origin` equal to the
+  request `Host` for `POST`/`PUT`/`PATCH`/`DELETE` (answer `cross_site_blocked`, sent as `401` because DSM replaces `403` bodies) and a
+  well-formed `X-SYNO-TOKEN`; safe methods are unchanged. Browsers that send neither
+  header on a state-changing request are refused. Verified on a real DSM 7.4 as an
+  administrator and an ordinary user (foreign `Origin`, `null`, `Sec-Fetch-Site`
+  cross-site/same-site, missing evidence refused; same-origin passes). The token path with
+  the DSM setting on is untested. Rebuild container SPKs to pick it up. See
+  [Container access](/docs/guides/container-access/).
+- **Container templates pin their image by digest** (CONTAINER-PULL): `hello-files` and `compose-import` now use
+  `image: <tag>@sha256:…`. `build` writes `force_pull: false` into the
+  `docker-project` resource when every service image is digest-pinned and keeps
+  `force_pull: true` while any image is a bare tag, so an install no longer
+  re-resolves a moving tag that other containers share. `inspect` reports each
+  service whose image is not digest-pinned. Behaviour for projects with unpinned
+  images is unchanged. Not verified on a real DSM.
+- **Breaking: container Apps are DSM-authenticated by default.** A container App
+  with an `adminport` is now served through a gateway CGI
+  (`/webman/3rdparty/<package>/cgi/gateway.cgi/…`) that runs as the package
+  account, checks the DSM session and forwards to the container. Without a valid
+  session it answers `401`; unsafe methods need `X-SYNO-TOKEN`; a stopped container
+  gives `521` with `Retry-After` (not `503`: DSM would replace its body). New `integration.web.access`: `dsm-users`
+  (default), `dsm-admins`, `dsm-groups` (+ `groups`), `public`. No Web Station
+  portal is registered unless `public`. The container port must be bound to
+  loopback (`127.0.0.1:<adminport>:<port>`): `check` fails with
+  `COMPOSE_GATEWAY_PORT_EXPOSED`, and `inspect`/`inspect` report
+  `CONTAINER_PORT_EXPOSED` and `CONTAINER_ANONYMOUS_PORTAL`. The gateway is
+  compiled Go, so building such an App needs Go and `--arch`, and the SPK is no
+  longer `noarch`. Privilege stays `run-as: package` with no root task.
+  **Migration:** bind the Compose port to `127.0.0.1`, rebuild with a higher
+  `build` and an `--arch`, then upgrade (the old `/<alias>/` portal and bookmarks
+  go away); or set `integration.web.access: public` to keep the anonymous
+  behaviour. See `website` guide “Container access control”.
+- Add best-effort `revealFile` selection recovery using File Station 1.4.x
+  private structures, with feature detection and silent cancellation on absent or
+  throwing APIs. One AppLaunch binds its callback receiver; only that receiver's
+  model may be selected once. Interaction, navigation away, close, disposal and
+  replacement requests cancel observers. Named bounds are 5000 ms total, 100 ms
+  checks and 300 ms quiet time, without device latency proof. `requested` still
+  does not mean `selected`. Actual effectiveness on DSM 7.4 / File Station 1.4.4
+  awaits a rebuilt-SPK device matrix; no device fix is claimed.
+
+- Fix `ctx.host.activateWindow()` to prefer DSM `toFront()`, calling `show()`
+  first for hidden/minimized windows; `activate()` remains a compatibility
+  fallback. `requestClose()` follows DSM standalone truthiness: falsy values
+  (including desktop `undefined`) permit the normal close path, while a truthy
+  standalone-main check refuses it. `canClose === false` and host listeners still
+  veto. Both methods return `requested`, not completion proof; rebuilt-SPK DSM
+  validation remains pending. Source: `7553c24`, `2842634`.
+- Add opt-in package-owned foreground `daemon` to native manifests, with
+  generated supervision and lifecycle hooks. Daemon-free packages keep their
+  existing lifecycle; no machine-wide service is required.
+- Add per-mount `ctx.host` platform/title adapters, guarded window activation
+  and close requests, app/external-URL navigation, resize/reopen subscription
+  cleanup, and File Station folder navigation/file reveal. Standalone web uses
+  explicit fallbacks; file reveal is not preview. File preview/details/settings
+  and host theme/language subscriptions remain unsupported. Final DSM runtime
+  behavior and ordinary-user navigation permissions still need NAS validation.
+- Fix SPK inspection to read the build-specific unique window bundle.
+
+### Known limitations
+
+- **File reveal remains a request:** on DSM 7.4-90069 with File Station
+  1.4.4-2221, one `ctx.host.revealFile()` call was observed opening the correct
+  folder without selecting/highlighting the file. A new synthetic fixture retest
+  selected the file with both `/home` and `/homes/admin` inputs, once each
+  (confidence **high**). The earlier non-selection was not reproduced; its cause
+  remains **unknown**. `requested` only means a selection request was issued;
+  it does not guarantee selection, preview, existence or ACL access. No runtime
+  fix is claimed. Source: V1 device validation and fixture retest, 2026-10-04.
+- Vue templates pin public `@synopackageland/ui@0.4.0`, including app-scoped
+  modals and unique mount IDs, with npmjs-only lockfiles and imports. External
+  developers do not need an internal registry account.
+- CLI 0.4.0 targets npmjs `latest`; versions 0.1.0–0.3.10 remain available without
+  deprecation or unpublishing.