@synopackageland/cli 0.7.0 → 0.7.1

package/dist/templates/_executor/README.md

@@ -174,7 +174,10 @@ root-owned `/var/packages/<package>/INFO`, the root monitor copies it into
 `runtime/`, verifies the copy and runs root `control start`, which replaces the
 monitor without reapproval. Any other change stays paused for administrator
 approval. Only root's pinned boot/control path or this anchored install can
-replace a monitor or runtime.
+replace a monitor or runtime. To exercise this path on a NAS without a real
+executor change, the repository's `scripts/test/executor-bump.py` makes a
+build+1 SPK whose executor differs by one byte and rewrites the INFO anchor,
+`executor/setup.json` and the window script's embedded pins together.
 
 At start, scheduler readback must exactly match the canonical lifecycle scripts
 regenerated from the package identity and approved policy pin. Package

package/dist/templates/_executor/anchor.go

@@ -84,6 +84,11 @@ func installAnchored(ctx context.Context, source, info string, trusted func(os.F
 	if err != nil {
 		return err
 	}
+	// DSM links the package target to the volume; openRegular refuses links.
+	source, err = filepath.EvalSymlinks(source)
+	if err != nil {
+		return err
+	}
 	src, err := openRegular(filepath.Join(source, "executor"))
 	if err != nil {
 		return err
@@ -129,7 +134,12 @@ func startInstalled(runtime, pkg string) error {
 	return cmd.Process.Release()
 }
 
+// An anchored upgrade is handed to root start, which replaces this monitor:
+// only differing pins are an approval request, and only they say so.
 func approvedPins(state pinState, install, start func() error, log func(string)) bool {
+	if state == pinsDiffer {
+		log("executor paused: package pins require administrator approval")
+	}
 	if state != pinsAnchored {
 		return state == pinsMatch
 	}

package/dist/templates/_executor/anchor_test.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
+	"reflect"
 	"strings"
 	"testing"
 )
@@ -101,6 +102,8 @@ func TestInstallAnchoredReplacesOnlyTheProtectedExecutorWithVerifiedBytes(t *tes
 	}
 }
 
+// The pause message names administrator approval only when the pins differ:
+// an anchored handover is a finished upgrade, not a request for approval.
 func TestApprovedPinsHandOverAnAnchoredUpgradeToRootStart(t *testing.T) {
 	for _, tc := range []struct {
 		name       string
@@ -109,18 +112,50 @@ func TestApprovedPinsHandOverAnAnchoredUpgradeToRootStart(t *testing.T) {
 		open       bool
 		installs   int
 		starts     int
+		logged     string
 	}{
-		{"match", pinsMatch, nil, true, 0, 0},
-		{"differ", pinsDiffer, nil, false, 0, 0},
-		{"anchored", pinsAnchored, nil, false, 1, 1},
-		{"install failed", pinsAnchored, errors.New("digest"), false, 1, 0},
+		{"match", pinsMatch, nil, true, 0, 0, ""},
+		{"differ", pinsDiffer, nil, false, 0, 0, "executor paused: package pins require administrator approval"},
+		{"anchored", pinsAnchored, nil, false, 1, 1, "executor upgrade: INFO-anchored executor installed under the approved policy"},
+		{"install failed", pinsAnchored, errors.New("digest"), false, 1, 0, "executor upgrade refused: INFO-anchored executor could not be installed"},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			installs, starts := 0, 0
-			open := approvedPins(tc.state, func() error { installs++; return tc.installErr }, func() error { starts++; return nil }, func(string) {})
+			var logged []string
+			open := approvedPins(tc.state, func() error { installs++; return tc.installErr }, func() error { starts++; return nil }, func(s string) { logged = append(logged, s) })
 			if open != tc.open || installs != tc.installs || starts != tc.starts {
 				t.Fatal("handover", open, installs, starts)
 			}
+			if want := []string{tc.logged}; tc.logged == "" {
+				if len(logged) != 0 {
+					t.Fatal("matching pins logged", logged)
+				}
+			} else if !reflect.DeepEqual(logged, want) {
+				t.Fatal("log", logged, want)
+			}
 		})
 	}
 }
+
+// DSM: /var/packages/<pkg>/target links to /volume1/@appstore/<pkg>.
+func TestInstallAnchoredFollowsTheDSMTargetLink(t *testing.T) {
+	ctx := context.Background()
+	anchor := hashBytes([]byte("new executor"))
+	appstore, info := anchoredPackage(t, "new executor", "approved policy", anchor)
+	link := filepath.Join(filepath.Dir(info), "linked-target")
+	if err := os.Symlink(filepath.Dir(appstore), link); err != nil {
+		t.Fatal(err)
+	}
+	runtime := realTestPath(t, t.TempDir())
+	os.WriteFile(filepath.Join(runtime, "executor"), []byte("approved executor"), 0700)
+	target := filepath.Join(link, "executor")
+	if state := packagePins(ctx, target, info, trustAll, hashBytes([]byte("approved executor")), hashBytes([]byte("approved policy"))); state != pinsAnchored {
+		t.Fatal("pin state", state)
+	}
+	if err := installAnchored(ctx, target, info, trustAll, runtime); err != nil {
+		t.Fatal("anchored executor behind the target link refused", err)
+	}
+	if b, _ := os.ReadFile(filepath.Join(runtime, "executor")); string(b) != "new executor" {
+		t.Fatal("installed", string(b))
+	}
+}

package/dist/templates/_executor/digest_review_test.go

@@ -32,7 +32,7 @@ func TestReviewLargePackageHashDoesNotBlockShutdown(t *testing.T) {
 		done <- manageService(ctx, make(chan string), func() (func(), error) { return func() {}, nil }, func(ctx context.Context) bool {
 			close(entered)
 			return samePackagePins(ctx, dir, strings.Repeat("a", 64), strings.Repeat("b", 64))
-		}, func() error { return nil }, func(string) {})
+		}, func() error { return nil })
 	}()
 	<-entered
 	time.Sleep(20 * time.Millisecond)
@@ -93,7 +93,7 @@ func TestLifecycleCancelsPendingPinCheck(t *testing.T) {
 			actions := make(chan string)
 			done := make(chan error, 1)
 			go func() {
-				done <- manageService(ctx, actions, func() (func(), error) { t.Error("opened during canceled check"); return func() {}, nil }, func(ctx context.Context) bool { close(entered); <-ctx.Done(); close(canceled); return false }, func() error { return nil }, func(string) {})
+				done <- manageService(ctx, actions, func() (func(), error) { t.Error("opened during canceled check"); return func() {}, nil }, func(ctx context.Context) bool { close(entered); <-ctx.Done(); close(canceled); return false }, func() error { return nil })
 			}()
 			<-entered
 			if action == "shutdown" {

package/dist/templates/_executor/dsm.go

@@ -78,11 +78,32 @@ type envelope struct {
 	Data    json.RawMessage `json:"data"`
 }
 
+// dsmError keeps the DSM error code of a refused call; the message stays generic.
+type dsmError struct{ Code int }
+
+func (*dsmError) Error() string { return "DSM refused" }
+
 func decodeEnvelope(b []byte) (json.RawMessage, error) {
+	data, err := decodeSuccess(b)
+	if err == nil && (len(data) == 0 || string(data) == "null") {
+		return nil, &dsmError{}
+	}
+	return data, err
+}
+
+// decodeSuccess accepts a success without data: scheduler deletes answer
+// {"success":true}, sometimes with httpd_restart, and that confirms the delete.
+func decodeSuccess(b []byte) (json.RawMessage, error) {
 	var r envelope
 	d := json.NewDecoder(bytes.NewReader(b))
-	if uniqueValue(d, false) != nil || hasDSMError(b) || json.Unmarshal(b, &r) != nil || !r.Success || len(r.Data) == 0 || string(r.Data) == "null" {
-		return nil, errors.New("DSM refused")
+	if uniqueValue(d, false) != nil || hasDSMError(b) || json.Unmarshal(b, &r) != nil || !r.Success {
+		var refused struct {
+			Error struct {
+				Code int `json:"code"`
+			} `json:"error"`
+		}
+		json.Unmarshal(b, &refused)
+		return nil, &dsmError{Code: refused.Error.Code}
 	}
 	return r.Data, nil
 }
@@ -117,6 +138,22 @@ func (d *liveDSM) Verify(ctx context.Context, cookie, token string) (string, err
 	return out.Username, nil
 }
 func (d *liveDSM) call(ctx context.Context, api, method, version, runner string, params map[string]any) (json.RawMessage, error) {
+	b, err := d.exec(ctx, api, method, version, runner, params)
+	if err != nil {
+		return nil, err
+	}
+	return decodeEnvelope(b)
+}
+
+// mutate runs a call whose success carries no data, such as a scheduler delete.
+func (d *liveDSM) mutate(ctx context.Context, api, method, version string, params map[string]any) error {
+	b, err := d.exec(ctx, api, method, version, "", params)
+	if err == nil {
+		_, err = decodeSuccess(b)
+	}
+	return err
+}
+func (d *liveDSM) exec(ctx context.Context, api, method, version, runner string, params map[string]any) ([]byte, error) {
 	args := []string{"--exec", "api=" + api, "method=" + method, "version=" + version}
 	if runner != "" {
 		args = append(args, "runner="+runner)
@@ -140,7 +177,7 @@ func (d *liveDSM) call(ctx context.Context, api, method, version, runner string,
 		}
 		return nil, errors.New("DSM command")
 	}
-	return decodeEnvelope(b)
+	return b, nil
 }
 func (d *liveDSM) Account(ctx context.Context, name string) (Subject, error) {
 	s, err := d.Accounts.Lookup(name)

package/dist/templates/_executor/go.mod

@@ -1,3 +1,5 @@
 module synopkgland/executor
 
 go 1.23
+
+toolchain go1.26.9

package/dist/templates/_executor/main.go

@@ -360,7 +360,7 @@ func serve(e *Executor, uid, gid int, revived bool) error {
 	purge := func() error {
 		return purgeProtected(ctx, d, e.Policy.Package, filepath.Join(stateBase, e.Policy.Package), runtime, sockDir)
 	}
-	return manageService(ctx, actions, open, samePins, purge, func(s string) { log.Print(s) })
+	return manageService(ctx, actions, open, samePins, purge)
 }
 
 func openService(parent context.Context, e *Executor, uid, gid int, sock string) (func(), error) {
@@ -438,11 +438,12 @@ func openService(parent context.Context, e *Executor, uid, gid int, sock string)
 	}, nil
 }
 func purgeProtected(ctx context.Context, d *liveDSM, pkg, state, runtime, socket string) error {
+	logf := purgeLogger()
 	inv, err := readTaskInventory(runtime)
 	if err != nil {
-		log.Print("task cleanup skipped: protected inventory unavailable")
+		logf("task cleanup skipped: protected inventory unavailable: package=" + pkg)
 	} else {
-		return purgeWithInventory(ctx, d, pkg, inv, state, runtime, socket, func(s string) { log.Print(s) })
+		return purgeWithInventory(ctx, d, pkg, inv, state, runtime, socket, logf)
 	}
 	return finishControl(state, runtime, socket, true)
 }
@@ -515,8 +516,13 @@ func verifiedPID(f *os.File, runtime string) (int, error) {
 	if err != nil || pid <= 1 {
 		return 0, errors.New("pid")
 	}
-	actual, err := os.Readlink(fmt.Sprintf("/proc/%d/exe", pid))
-	if err != nil || strings.TrimSuffix(actual, " (deleted)") != filepath.Join(runtime, "executor") {
+	exe := fmt.Sprintf("/proc/%d/exe", pid)
+	link, err := os.Readlink(exe)
+	if err != nil {
+		return 0, errors.New("pid executable mismatch")
+	}
+	running, err := os.Stat(exe)
+	if err != nil || !approvedExecutable(link, running, runtime, rootOwnedReadOnly) {
 		return 0, errors.New("pid executable mismatch")
 	}
 	return pid, nil

package/dist/templates/_executor/managed.go

@@ -22,8 +22,9 @@ func samePackagePins(ctx context.Context, dir, executorDigest, policyDigest stri
 }
 
 // The process and monitor outlive its listener. A package start can only expose
-// the already-approved runtime when the shipped bytes still match both pins.
-func manageService(ctx context.Context, actions <-chan string, open func() (func(), error), samePins func(context.Context) bool, purge func() error, log func(string)) error {
+// the already-approved runtime when the shipped bytes still match both pins;
+// samePins reports why it refused.
+func manageService(ctx context.Context, actions <-chan string, open func() (func(), error), samePins func(context.Context) bool, purge func() error) error {
 	var closeService func()
 	var checking <-chan bool
 	var cancelCheck context.CancelFunc
@@ -62,7 +63,6 @@ func manageService(ctx context.Context, actions <-chan string, open func() (func
 				return nil
 			}
 			if !matches {
-				log("executor paused: package pins require administrator approval")
 				continue
 			}
 			var err error

package/dist/templates/_executor/managed_test.go

@@ -15,7 +15,7 @@ import (
 func TestPauseResumeOnlyApprovedPinsAndPurgeWhilePaused(t *testing.T) {
 	for _, changed := range []bool{false, true} {
 		t.Run(map[bool]string{false: "same pins", true: "different policy"}[changed], func(t *testing.T) {
-			dir := t.TempDir()
+			dir := realTestPath(t, t.TempDir())
 			os.WriteFile(filepath.Join(dir, "executor"), []byte("approved executable"), 0600)
 			os.WriteFile(filepath.Join(dir, "policy.json"), []byte("approved policy"), 0600)
 			ed, _ := digestFile(context.Background(), filepath.Join(dir, "executor"), maxExecutorBytes)
@@ -34,7 +34,7 @@ func TestPauseResumeOnlyApprovedPinsAndPurgeWhilePaused(t *testing.T) {
 					}
 					opened.Add(1)
 					return func() { listener.Close(); closed.Add(1) }, nil
-				}, func(ctx context.Context) bool { return samePackagePins(ctx, dir, ed, pd) }, func() error { purged.Add(1); return nil }, func(string) {})
+				}, func(ctx context.Context) bool { return samePackagePins(ctx, dir, ed, pd) }, func() error { purged.Add(1); return nil })
 			}()
 			await := func(v *atomic.Int32, want int32) {
 				t.Helper()
@@ -105,7 +105,7 @@ func TestRootControlSignalsPauseThenPurgeWithoutMailbox(t *testing.T) {
 	var opened, closed, purged atomic.Int32
 	done := make(chan error, 1)
 	go func() {
-		done <- manageService(ctx, actions, func() (func(), error) { opened.Add(1); return func() { closed.Add(1) }, nil }, func(context.Context) bool { return true }, func() error { purged.Add(1); return nil }, func(string) {})
+		done <- manageService(ctx, actions, func() (func(), error) { opened.Add(1); return func() { closed.Add(1) }, nil }, func(context.Context) bool { return true }, func() error { purged.Add(1); return nil })
 	}()
 	wait := func(value *atomic.Int32) {
 		t.Helper()

package/dist/templates/_executor/path_test.go

@@ -15,3 +15,21 @@ func realTestPath(t *testing.T, p string) string {
 	return p
 }
 func makeTestDir(p string) error { return os.Mkdir(p, 0700) }
+
+// DSM links /var/packages/<pkg>/target to the volume. Every platform must
+// refuse a symlinked ancestor so tests catch callers that skip EvalSymlinks.
+func TestOpenRegularRefusesASymlinkedAncestor(t *testing.T) {
+	dir := realTestPath(t, t.TempDir())
+	os.MkdirAll(filepath.Join(dir, "appstore"), 0755)
+	os.WriteFile(filepath.Join(dir, "appstore", "executor"), []byte("x"), 0755)
+	os.Symlink(filepath.Join(dir, "appstore"), filepath.Join(dir, "target"))
+	if f, err := openRegular(filepath.Join(dir, "target", "executor")); err == nil {
+		f.Close()
+		t.Fatal("symlinked ancestor accepted")
+	}
+	f, err := openRegular(filepath.Join(dir, "appstore", "executor"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	f.Close()
+}

package/dist/templates/_executor/pid.go

@@ -0,0 +1,37 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+)
+
+// approvedExecutable reports whether a /proc/<pid>/exe link and the inode it
+// runs (stat of that link) belong to an executor root installed in runtime.
+// The inode decides, not the name: kernel 3.10 (DSM 7.1) names a
+// rename-replaced inode after the rename source, so a monitor whose executor
+// was replaced reads as .executor (control.sh) or .executor-* (installAnchored)
+// "(deleted)". Only root writes runtime (root:root 0700), and a replaced inode
+// must be unlinked on the runtime's device.
+func approvedExecutable(link string, running os.FileInfo, runtime string, trusted func(os.FileInfo) bool) bool {
+	name, deleted := strings.CutSuffix(link, " (deleted)")
+	base := filepath.Base(name)
+	if filepath.Dir(name) != runtime || (base != "executor" && !strings.HasPrefix(base, ".executor")) {
+		return false
+	}
+	if !running.Mode().IsRegular() || !trusted(running) {
+		return false
+	}
+	if !deleted {
+		current, err := os.Lstat(filepath.Join(runtime, "executor"))
+		return err == nil && os.SameFile(running, current)
+	}
+	dir, err := os.Stat(runtime)
+	if err != nil {
+		return false
+	}
+	st, ok := running.Sys().(*syscall.Stat_t)
+	dt, dirOK := dir.Sys().(*syscall.Stat_t)
+	return ok && dirOK && st.Nlink == 0 && st.Dev == dt.Dev
+}

package/dist/templates/_executor/pid_test.go

@@ -0,0 +1,113 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// runningExecutor installs runtime/executor and keeps it open, as a live monitor.
+func runningExecutor(t *testing.T) (string, *os.File) {
+	t.Helper()
+	runtime := t.TempDir()
+	path := filepath.Join(runtime, "executor")
+	if err := os.WriteFile(path, []byte("old"), 0700); err != nil {
+		t.Fatal(err)
+	}
+	f, err := os.Open(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { f.Close() })
+	return runtime, f
+}
+
+// replaceExecutor renames a new copy over runtime/executor, as control.sh and
+// installAnchored do; the running inode is unlinked.
+func replaceExecutor(t *testing.T, runtime, staged string) {
+	t.Helper()
+	if err := os.WriteFile(filepath.Join(runtime, staged), []byte("new"), 0700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Rename(filepath.Join(runtime, staged), filepath.Join(runtime, "executor")); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func stat(t *testing.T, f *os.File) os.FileInfo {
+	t.Helper()
+	info, err := f.Stat()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return info
+}
+
+func TestApprovedExecutableAcceptsTheLiveRuntimeExecutor(t *testing.T) {
+	runtime, f := runningExecutor(t)
+	if !approvedExecutable(filepath.Join(runtime, "executor"), stat(t, f), runtime, trustAll) {
+		t.Fatal("live runtime executor refused")
+	}
+}
+
+// Kernel 3.10 (DSM 7.1 armv7) names a rename-replaced inode after the rename
+// source: control.sh stages .executor, installAnchored stages .executor-*.
+func TestApprovedExecutableAcceptsAReplacedExecutorUnderItsSwappedName(t *testing.T) {
+	for _, staged := range []string{".executor", ".executor-123456"} {
+		runtime, f := runningExecutor(t)
+		replaceExecutor(t, runtime, staged)
+		for _, name := range []string{staged, "executor"} {
+			link := filepath.Join(runtime, name) + " (deleted)"
+			if !approvedExecutable(link, stat(t, f), runtime, trustAll) {
+				t.Fatalf("replaced executor refused: %s", link)
+			}
+		}
+	}
+}
+
+func TestApprovedExecutableRefusesAnotherInode(t *testing.T) {
+	runtime, _ := runningExecutor(t)
+	other := filepath.Join(runtime, ".executor")
+	if err := os.WriteFile(other, []byte("other"), 0700); err != nil {
+		t.Fatal(err)
+	}
+	f, err := os.Open(other)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer f.Close()
+	running := stat(t, f)
+	// Still linked: not the installed executor, whatever the link claims.
+	for _, link := range []string{other, other + " (deleted)", filepath.Join(runtime, "executor"), filepath.Join(runtime, "executor") + " (deleted)"} {
+		if approvedExecutable(link, running, runtime, trustAll) {
+			t.Fatalf("linked non-executor accepted as %s", link)
+		}
+	}
+}
+
+func TestApprovedExecutableRefusesAnUnlinkedInodeOutsideTheRuntime(t *testing.T) {
+	runtime, f := runningExecutor(t)
+	replaceExecutor(t, runtime, ".executor")
+	running := stat(t, f)
+	for _, link := range []string{
+		filepath.Join(t.TempDir(), "executor") + " (deleted)",
+		filepath.Join(runtime, "sh") + " (deleted)",
+		filepath.Join(runtime, ".executor"), // unlinked yet not reported deleted
+	} {
+		if approvedExecutable(link, running, runtime, trustAll) {
+			t.Fatalf("unlinked inode accepted as %s", link)
+		}
+	}
+}
+
+func TestApprovedExecutableRefusesAnUntrustedInode(t *testing.T) {
+	runtime, f := runningExecutor(t)
+	refuse := func(os.FileInfo) bool { return false }
+	if approvedExecutable(filepath.Join(runtime, "executor"), stat(t, f), runtime, refuse) {
+		t.Fatal("untrusted live executor accepted")
+	}
+	replaceExecutor(t, runtime, ".executor")
+	if approvedExecutable(filepath.Join(runtime, ".executor")+" (deleted)", stat(t, f), runtime, refuse) {
+		t.Fatal("untrusted replaced executor accepted")
+	}
+}

package/dist/templates/_executor/platform_other.go

@@ -8,6 +8,7 @@ import (
 	"net"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"strings"
 	"syscall"
 )
@@ -19,7 +20,14 @@ var errLinux = errors.New("executor requires Linux")
 func ownedByRoot(os.FileInfo) bool  { return false }
 func configureProcess(*exec.Cmd)    {}
 func peerUID(net.Conn) (int, error) { return -1, errLinux }
+
+// Like Linux openBeneath, refuse a symlink in any component, not only the last.
 func openRegular(path string) (*os.File, error) {
+	for dir := filepath.Dir(path); dir != filepath.Dir(dir); dir = filepath.Dir(dir) {
+		if info, err := os.Lstat(dir); err != nil || info.Mode()&os.ModeSymlink != 0 {
+			return nil, errors.New("path")
+		}
+	}
 	info, err := os.Lstat(path)
 	if err != nil {
 		return nil, err

package/dist/templates/_executor/purge_log.go

@@ -0,0 +1,18 @@
+package main
+
+import (
+	"log"
+	"log/syslog"
+)
+
+// Purge removes executor.log with the protected state, so its diagnostics
+// also go to the system log, where they survive the uninstall.
+func purgeLogger() func(string) {
+	system, err := syslog.New(syslog.LOG_NOTICE|syslog.LOG_DAEMON, "synopkgland-executor")
+	return func(s string) {
+		log.Print(s)
+		if err == nil {
+			_ = system.Notice(s)
+		}
+	}
+}

package/dist/templates/_executor/tasks.go

@@ -6,10 +6,12 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strconv"
 	"synopkgland/executor/internal/taskscript"
+	"time"
 )
 
 type approvedTask struct {
@@ -51,8 +53,7 @@ func taskReference(ctx context.Context, d *liveDSM, task approvedTask, expected
 	boot := task.Kind == "boot"
 	if !boot {
 		api = "SYNO.Core.TaskScheduler"
-		version = "4"
-		b, err := d.call(ctx, api, "list", "3", "", map[string]any{"start": 0, "limit": 500})
+		b, err := listControlTasks(ctx, d)
 		if err != nil {
 			return "", "", nil, err
 		}
@@ -83,7 +84,14 @@ func taskReference(ctx context.Context, d *liveDSM, task approvedTask, expected
 		}
 		ref = map[string]any{"id": id, "real_owner": "root"}
 	}
-	b, err := d.call(ctx, api, "get", version, "", ref)
+	var b json.RawMessage
+	var err error
+	if boot {
+		b, err = d.call(ctx, api, "get", version, "", ref)
+	} else {
+		b, err = onUnsupportedVersion(func() (json.RawMessage, error) { return d.call(ctx, api, "get", "4", "", ref) },
+			func() (json.RawMessage, error) { return d.call(ctx, api, "get", "3", "", ref) })
+	}
 	if err != nil {
 		return "", "", nil, err
 	}
@@ -225,20 +233,24 @@ func purgeTasks(ctx context.Context, d *liveDSM, pkg string, inv taskInventory,
 				expected = canonical.Script
 			}
 		}
+		started := time.Now()
 		api, version, ref, err := taskReference(ctx, d, task, expected)
 		if err != nil {
 			log("task cleanup skipped: " + task.Kind + " definition mismatch or unavailable")
 			continue
 		}
-		if _, err = d.call(ctx, api, "delete", version, "", ref); err != nil {
+		looked := time.Now()
+		if err = d.mutate(ctx, api, "delete", version, ref); err != nil {
 			log("task cleanup unconfirmed: " + task.Kind)
 		}
+		deleted := time.Now()
 		// The scheduler has no conditional delete. Accept the admin edit window,
 		// delete exactly once, and observe the name afterward without another delete.
 		if taskRemains(ctx, d, task) {
 			log("task cleanup: " + task.Kind + " same-named task remains after delete")
 		}
-
+		log(fmt.Sprintf("task cleanup timing: package=%s kind=%s lookup_ms=%d delete_ms=%d verify_ms=%d", pkg, task.Kind,
+			looked.Sub(started).Milliseconds(), deleted.Sub(looked).Milliseconds(), time.Since(deleted).Milliseconds()))
 	}
 }
 
@@ -246,8 +258,12 @@ func purgeWithInventory(ctx context.Context, d *liveDSM, pkg string, inv taskInv
 	if runtime != filepath.Join(state, "runtime") {
 		return errors.New("runtime outside package protected state")
 	}
+	started := time.Now()
 	purgeTasks(ctx, d, pkg, inv, log)
-	return finishControl(state, runtime, socket, true)
+	cleaned := time.Now()
+	err := finishControl(state, runtime, socket, true)
+	log(fmt.Sprintf("purge timing: package=%s tasks_ms=%d files_ms=%d", pkg, cleaned.Sub(started).Milliseconds(), time.Since(cleaned).Milliseconds()))
+	return err
 }
 
 func taskRemains(ctx context.Context, d *liveDSM, task approvedTask) bool {
@@ -261,7 +277,7 @@ func taskRemains(ctx context.Context, d *liveDSM, task approvedTask) bool {
 		}
 		return json.Unmarshal(b, &got) == nil && got.Name == task.Name
 	}
-	b, err := d.call(ctx, "SYNO.Core.TaskScheduler", "list", "3", "", map[string]any{"start": 0, "limit": 500})
+	b, err := listControlTasks(ctx, d)
 	if err != nil {
 		return false
 	}
@@ -280,3 +296,25 @@ func taskRemains(ctx context.Context, d *liveDSM, task approvedTask) bool {
 	}
 	return false
 }
+
+// DSM 7.1 has TaskScheduler list v2 (offset) and get v3 only. A read falls back
+// solely when DSM reports the method version unsupported; any other refusal stands.
+func onUnsupportedVersion(current, legacy func() (json.RawMessage, error)) (json.RawMessage, error) {
+	b, err := current()
+	var refused *dsmError
+	if errors.As(err, &refused) && versionUnsupported(refused.Code) {
+		return legacy()
+	}
+	return b, err
+}
+
+// DSM 7.1.1 returns 104 for a version above maxVersion (get v4) and 103 for a
+// method absent at an existing version (list v3).
+func versionUnsupported(code int) bool { return code == 103 || code == 104 }
+func listControlTasks(ctx context.Context, d *liveDSM) (json.RawMessage, error) {
+	return onUnsupportedVersion(func() (json.RawMessage, error) {
+		return d.call(ctx, "SYNO.Core.TaskScheduler", "list", "3", "", map[string]any{"start": 0, "limit": 500})
+	}, func() (json.RawMessage, error) {
+		return d.call(ctx, "SYNO.Core.TaskScheduler", "list", "2", "", map[string]any{"offset": 0, "limit": 500})
+	})
+}