@synopackageland/cli 0.7.0 → 0.7.1

package/dist/templates/native-go-root-ops/backend/internal/app/executor_test.go

@@ -1,8 +1,10 @@
 package app
 
 import (
+	"net"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 )
 
@@ -51,3 +53,65 @@ func TestExecutorRootRunRequiresCurrentDSMCookie(t *testing.T) {
 		t.Fatal("root.run accepted absent DSM cookie")
 	}
 }
+
+// The executor closes its listener while paused (package stopped, or pins
+// awaiting administrator approval). Status then answers, not "internal".
+func TestExecutorStatusReportsAPausedExecutor(t *testing.T) {
+	cfg := testConfig(t)
+	previous := executorSocketBase
+	// A short base: unix socket paths are limited to about 100 bytes.
+	base, err := os.MkdirTemp("/tmp", "exec")
+	if err != nil {
+		t.Fatal(err)
+	}
+	executorSocketBase = base
+	defer func() { executorSocketBase = previous; os.RemoveAll(base) }()
+	check := func(name string) {
+		t.Helper()
+		code, envelope := call(t, cfg, alice, "executor.status", `{}`)
+		out, _ := envelope["data"].(map[string]any)
+		if code != "" || out["ready"] != false || out["state"] != "paused" || out["reason"] != "executor_not_listening" || out["next"] == "" || out["next"] == nil {
+			t.Fatalf("%s: %s %v", name, code, out)
+		}
+	}
+	check("no socket")
+	if code, _ := call(t, cfg, bob, "executor.status", `{}`); code != "" {
+		t.Fatal("authenticated user cannot read a paused status", code)
+	}
+	dir := filepath.Join(executorSocketBase, cfg.PackageID)
+	os.MkdirAll(dir, 0700)
+	ln, err := net.ListenUnix("unix", &net.UnixAddr{Name: filepath.Join(dir, "executor.sock"), Net: "unix"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	ln.SetUnlinkOnClose(false)
+	ln.Close()
+	check("closed listener")
+}
+
+// next follows the last lifecycle request: a running package needs approval
+// again, not a start.
+func TestExecutorStatusNextFollowsTheLifecycleRequest(t *testing.T) {
+	cfg := testConfig(t)
+	previous := executorSocketBase
+	executorSocketBase = t.TempDir()
+	defer func() { executorSocketBase = previous }()
+	next := func() string {
+		t.Helper()
+		_, envelope := call(t, cfg, alice, "executor.status", `{}`)
+		out, _ := envelope["data"].(map[string]any)
+		s, _ := out["next"].(string)
+		return s
+	}
+	if !strings.HasPrefix(next(), "Start the package.") {
+		t.Fatal("no request:", next())
+	}
+	mailbox := filepath.Join(cfg.DataDir, "executor")
+	os.MkdirAll(mailbox, 0700)
+	for request, start := range map[string]bool{"stop\n": true, "start\n": false, "start": false} {
+		os.WriteFile(filepath.Join(mailbox, "control"), []byte(request), 0600)
+		if got := next(); strings.HasPrefix(got, "Start the package") != start || got == "" {
+			t.Fatalf("%q: %s", request, got)
+		}
+	}
+}

package/dist/templates/native-go-vue/frontend/src/delegate/ExecutorSettings.vue

@@ -47,16 +47,17 @@ async function authorize(){
  catch{if(!disposed)error.value=true}
  finally{if(!disposed)busy.value=false}
 }
-onMounted(()=>void refresh());onBeforeUnmount(()=>{disposed=true;password.value=''})
+onMounted(()=>{setup.subscribe?.(next=>{if(!disposed)status.value=next});void refresh()});onBeforeUnmount(()=>{disposed=true;password.value=''})
 </script>
 <template>
  <SettingsSection v-if="admin" :title="copy.setupTitle" :collapsible="false" :aria-busy="busy">
   <p>{{ copy.setupHelp }}</p>
   <Callout v-if="error" tone="danger" role="alert">{{ copy.setupError }}</Callout>
   <p role="status">{{ status?.state==='ready'?(needsScope?copy.scopeNeeds:copy.ready):status?.state==='needs-admin-approval'?copy.needs:copy.blocked }}</p>
+  <p v-if="status?.reason&&(status.state==='blocked'||status.state==='unsupported')">{{ copy.details }}: {{ status.reason }}</p>
   <p v-if="scope?.selection">{{ copy.protectedScope }}: {{ scope.selection.root }}</p>
   <Callout v-if="scope?.mismatch" tone="warning">{{ copy.scopeMismatch }} {{ copy.preselection }}: {{ scope.preselection }} · {{ copy.protectedScope }}: {{ scope.selection?.root }}</Callout>
-  <Form v-if="status?.state==='needs-admin-approval'||dynamic&&status?.state==='ready'" @submit.prevent="authorize">
+  <Form v-if="status?.state==='needs-admin-approval'||status?.retry||dynamic&&status?.state==='ready'" @submit.prevent="authorize">
    <template v-if="dynamic">
     <p>{{ scope?.selection?copy.scopeChangeHelp:copy.preselectionHelp }}</p>
     <FormItem :label="copy.scopeLabel" label-for="delegate-scope"><Select id="delegate-scope" v-model="chosen" :options="options" :disabled="busy||error" /></FormItem>

package/dist/templates/native-go-vue/frontend/src/delegate/executor-settings.test.ts

@@ -0,0 +1,23 @@
+// @vitest-environment jsdom
+import {expect,test} from 'vitest'
+import {createApp,h,nextTick} from 'vue'
+import {AppRoot} from '@synopackageland/ui'
+import ExecutorSettings from './ExecutorSettings.vue'
+import {ExecutorSetupKey,type CapabilityStatus} from './executor-setup'
+const settle=async()=>{for(let i=0;i<10;i++){await nextTick();await new Promise(r=>setTimeout(r))}}
+// t-0237: a wrong password left only "Check status"; a retryable result keeps the form.
+test('a retryable blocked approval keeps the password form for another try',async()=>{
+ const blocked:CapabilityStatus&{retry:boolean}={state:'blocked',reason:'dsm_3121: DSM rejected the administrator password. Nothing was created.',retry:true}
+ const setup={async status():Promise<CapabilityStatus>{return {state:'needs-admin-approval'}},async authorize(){return blocked},async control(){return blocked}}
+ const root=document.createElement('div');document.body.append(root)
+ const app=createApp({render:()=>h(AppRoot,{},()=>h(ExecutorSettings,{admin:true,locale:'en'}))})
+ app.provide(ExecutorSetupKey,setup)
+ try{
+  app.mount(root);await settle()
+  const input=root.querySelector<HTMLInputElement>('#delegate-password')!
+  input.value='wrong';input.dispatchEvent(new Event('input'));await settle()
+  root.querySelector('form')!.dispatchEvent(new Event('submit'));await settle()
+  expect(root.textContent).toContain('dsm_3121')
+  expect(root.querySelector('#delegate-password')).not.toBeNull()
+ }finally{app.unmount();root.remove()}
+})

package/dist/templates/native-go-vue/frontend/src/delegate/executor-setup.ts

@@ -2,13 +2,17 @@ import {inject,type InjectionKey} from 'vue'
 export type CapabilityState='unsupported'|'needs-admin-approval'|'ready'|'blocked'|'incompatible'
 // requested: a scope change whose root task may still land; it applied once
 // status() reports that scope with a generation above this one.
-export interface CapabilityStatus {state:CapabilityState;reason?:string;requested?:{scope:string;generation:number}}
+// retry: approving again may succeed: nothing of this approval is left behind, or
+// the approved tasks remain and approving again restarts the executor.
+export interface CapabilityStatus {state:CapabilityState;reason?:string;requested?:{scope:string;generation:number};retry?:boolean}
 // p2-setup supplies the implementation through app.provide(ExecutorSetupKey, setup).
 // Passwords belong only to this call and must never be persisted or logged.
 export interface ExecutorSetup {
  status():Promise<CapabilityStatus>
  authorize(password:string,selectedScope?:string):Promise<CapabilityStatus>
  control(action:'start'|'stop'|'purge'):Promise<CapabilityStatus>
+ // Results of calls made elsewhere (the DSM window panel) on the same access.
+ subscribe?(listener:(status:CapabilityStatus)=>void):void
 }
 export const ExecutorSetupKey:InjectionKey<ExecutorSetup>=Symbol('executor-setup')
 export function useExecutorSetup():ExecutorSetup {

package/dist/templates/native-go-vue/frontend/src/delegate/i18n/de.json

@@ -10,6 +10,7 @@
   "ready": "Der Dateizugriff im Hintergrund ist bereit.",
   "needs": "Ein Administrator muss den Dateizugriff im Hintergrund genehmigen.",
   "blocked": "Der Dateizugriff im Hintergrund ist nicht verfügbar. Bitten Sie einen Administrator, die App-Einrichtung zu prüfen.",
+  "details": "Details",
   "refresh": "Aktualisieren",
   "revoke": "Widerrufen",
   "cancel": "Auftrag abbrechen",

package/dist/templates/native-go-vue/frontend/src/delegate/i18n/en.json

@@ -10,6 +10,7 @@
   "ready": "Background file access is ready.",
   "needs": "An administrator must approve background file access.",
   "blocked": "Background file access is unavailable. Ask an administrator to check the app setup.",
+  "details": "Details",
   "refresh": "Refresh",
   "revoke": "Revoke",
   "cancel": "Cancel job",

package/dist/templates/native-go-vue/frontend/src/delegate/i18n/es.json

@@ -10,6 +10,7 @@
   "ready": "El acceso a archivos en segundo plano está listo.",
   "needs": "Un administrador debe aprobar el acceso a archivos en segundo plano.",
   "blocked": "El acceso a archivos en segundo plano no está disponible. Pida a un administrador que revise la configuración de la aplicación.",
+  "details": "Detalles",
   "refresh": "Actualizar",
   "revoke": "Revocar",
   "cancel": "Cancelar tarea",

package/dist/templates/native-go-vue/frontend/src/delegate/i18n/fr.json

@@ -10,6 +10,7 @@
   "ready": "L’accès aux fichiers en arrière-plan est prêt.",
   "needs": "Un administrateur doit approuver l’accès aux fichiers en arrière-plan.",
   "blocked": "L’accès aux fichiers en arrière-plan n’est pas disponible. Demandez à un administrateur de vérifier la configuration de l’application.",
+  "details": "Détails",
   "refresh": "Actualiser",
   "revoke": "Révoquer",
   "cancel": "Annuler la tâche",

package/dist/templates/native-go-vue/frontend/src/delegate/i18n/it.json

@@ -10,6 +10,7 @@
   "ready": "L’accesso ai file in background è pronto.",
   "needs": "Un amministratore deve approvare l’accesso ai file in background.",
   "blocked": "L’accesso ai file in background non è disponibile. Chiedere a un amministratore di controllare la configurazione dell’app.",
+  "details": "Dettagli",
   "refresh": "Aggiorna",
   "revoke": "Revoca",
   "cancel": "Annulla processo",

package/dist/templates/native-go-vue/frontend/src/delegate/i18n/ja.json

@@ -10,6 +10,7 @@
   "ready": "バックグラウンドのファイルアクセスを利用できます。",
   "needs": "バックグラウンドのファイルアクセスには管理者の承認が必要です。",
   "blocked": "バックグラウンドのファイルアクセスを利用できません。アプリの設定を確認するよう管理者に依頼してください。",
+  "details": "詳細",
   "refresh": "最新の情報に更新",
   "revoke": "取り消す",
   "cancel": "ジョブをキャンセル",

package/dist/templates/native-go-vue/frontend/src/delegate/i18n/ko.json

@@ -10,6 +10,7 @@
   "ready": "백그라운드 파일 액세스를 사용할 수 있습니다.",
   "needs": "백그라운드 파일 액세스는 관리자의 승인이 필요합니다.",
   "blocked": "백그라운드 파일 액세스를 사용할 수 없습니다. 관리자에게 앱 설정을 확인하도록 요청하십시오.",
+  "details": "세부 사항",
   "refresh": "새로 고침",
   "revoke": "취소",
   "cancel": "작업 취소",

package/dist/templates/native-go-vue/frontend/src/delegate/i18n/zh-CN.json

@@ -10,6 +10,7 @@
   "ready": "后台文件访问已就绪。",
   "needs": "需要管理员批准后台文件访问。",
   "blocked": "后台文件访问不可用，请管理员检查 App 设置。",
+  "details": "详情",
   "refresh": "刷新",
   "revoke": "撤销",
   "cancel": "取消任务",

package/dist/templates/native-go-vue/frontend/src/delegate/i18n/zh-TW.json

@@ -10,6 +10,7 @@
   "ready": "背景檔案存取已就緒。",
   "needs": "需要管理員核准背景檔案存取。",
   "blocked": "背景檔案存取無法使用，請管理員檢查 App 設定。",
+  "details": "詳情",
   "refresh": "重新整理",
   "revoke": "撤銷",
   "cancel": "取消工作",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {

package/templates/_daemon/go.mod

@@ -2,4 +2,4 @@ module synopkgland-daemon
 
 go 1.24
 
-toolchain go1.26.8
+toolchain go1.26.9

package/templates/_daemon/main.go

@@ -28,6 +28,9 @@ type deadlines struct {
 	Start  int `json:"start"`
 	Stop   int `json:"stop"`
 	Status int `json:"status"`
+	// Uninstall bounds uninstall_args separately from Stop: a revoke on a
+	// loaded NAS can take longer than stopping the daemon.
+	Uninstall int `json:"uninstall"`
 }
 type config struct {
 	Package       string            `json:"package"`
@@ -88,7 +91,7 @@ func load(dest, data string) (*controller, error) {
 	if cfg.Exec == "" || filepath.IsAbs(cfg.Exec) || filepath.Clean(cfg.Exec) != cfg.Exec || strings.HasPrefix(cfg.Exec, "../") {
 		return nil, errors.New("invalid fixed executable")
 	}
-	if cfg.Timeouts.Start < 2 || cfg.Timeouts.Start > 120 || cfg.Timeouts.Stop < 2 || cfg.Timeouts.Stop > 120 || cfg.Timeouts.Status < 1 || cfg.Timeouts.Status > 10 {
+	if cfg.Timeouts.Start < 2 || cfg.Timeouts.Start > 120 || cfg.Timeouts.Stop < 2 || cfg.Timeouts.Stop > 120 || cfg.Timeouts.Status < 1 || cfg.Timeouts.Status > 10 || cfg.Timeouts.Uninstall < 2 || cfg.Timeouts.Uninstall > 120 {
 		return nil, errors.New("invalid daemon deadlines")
 	}
 	hash := sha256.Sum256(raw)
@@ -162,7 +165,7 @@ func (c *controller) run(action string) (int, error) {
 		budget += c.Timeouts.Start
 	}
 	if action == "uninstall" {
-		budget += c.Timeouts.Stop + 1
+		budget += c.Timeouts.Uninstall + 2
 	}
 	if action != "start" && action != "stop" && action != "status" && action != "restart" && action != "uninstall" {
 		return 1, errors.New("unsupported daemon action")
@@ -414,7 +417,7 @@ func (c *controller) uninstall() error {
 	select {
 	case err := <-done:
 		return err
-	case <-time.After(time.Duration(c.Timeouts.Stop-1) * time.Second):
+	case <-time.After(time.Duration(c.Timeouts.Uninstall) * time.Second):
 		cmd.Process.Signal(syscall.SIGTERM)
 	}
 	select {

package/templates/_daemon/main_test.go

@@ -50,7 +50,7 @@ func fixture(t *testing.T, mode string) (string, string, string) {
 	if raw, err := exec.Command(app, "cleanup").CombinedOutput(); err != nil {
 		t.Fatalf("payload warm-up: %v %s", err, raw)
 	}
-	cfg := config{Package: "DaemonFixture", Exec: "app", Args: []string{"${SYNOPKG_PKGVAR}/a space", "$(touch BAD)'", "${SYNOPKG_PKGDEST}"}, Env: map[string]string{"APP_MODE": mode}, Timeouts: deadlines{Start: 2, Stop: 2, Status: 1}}
+	cfg := config{Package: "DaemonFixture", Exec: "app", Args: []string{"${SYNOPKG_PKGVAR}/a space", "$(touch BAD)'", "${SYNOPKG_PKGDEST}"}, Env: map[string]string{"APP_MODE": mode}, Timeouts: deadlines{Start: 2, Stop: 2, Status: 1, Uninstall: 2}}
 	if os.Geteuid() == 0 {
 		cfg.Package = "nobody"
 	} else {
@@ -250,6 +250,26 @@ func TestUninstallCleanup(t *testing.T) {
 	}
 }
 
+// A revoke on uninstall can outlast the stop deadline on a loaded NAS; it has
+// its own budget instead of Stop-1.
+func TestUninstallCommandHasItsOwnBudget(t *testing.T) {
+	control, dest, data := fixture(t, "normal")
+	path := filepath.Join(dest, "daemon/config.json")
+	raw, _ := os.ReadFile(path)
+	var cfg config
+	json.Unmarshal(raw, &cfg)
+	cfg.UninstallArgs = []string{"cleanup-slow"}
+	cfg.Timeouts.Uninstall = 5
+	raw, _ = json.Marshal(cfg)
+	os.WriteFile(path, raw, 0644)
+	if rc, out := runControl(control, "start", dest, data); rc != 0 {
+		t.Fatalf("start: %d %s", rc, out)
+	}
+	if rc, out := runControl(control, "uninstall", dest, data); rc != 0 {
+		t.Fatalf("slow uninstall within its budget failed: %d %s", rc, out)
+	}
+}
+
 func TestPackageAccountIdentity(t *testing.T) {
 	control, dest, data := fixture(t, "normal")
 	path := filepath.Join(dest, "daemon/config.json")

package/templates/_daemon/testdata/child.go

@@ -14,6 +14,9 @@ func main() {
 		switch os.Args[1] {
 		case "cleanup":
 			os.Exit(0)
+		case "cleanup-slow":
+			time.Sleep(2500 * time.Millisecond)
+			os.Exit(0)
 		case "cleanup-fail":
 			os.Exit(2)
 		case "cleanup-hang":

package/templates/_executor/README.md

@@ -174,7 +174,10 @@ root-owned `/var/packages/<package>/INFO`, the root monitor copies it into
 `runtime/`, verifies the copy and runs root `control start`, which replaces the
 monitor without reapproval. Any other change stays paused for administrator
 approval. Only root's pinned boot/control path or this anchored install can
-replace a monitor or runtime.
+replace a monitor or runtime. To exercise this path on a NAS without a real
+executor change, the repository's `scripts/test/executor-bump.py` makes a
+build+1 SPK whose executor differs by one byte and rewrites the INFO anchor,
+`executor/setup.json` and the window script's embedded pins together.
 
 At start, scheduler readback must exactly match the canonical lifecycle scripts
 regenerated from the package identity and approved policy pin. Package

package/templates/_executor/anchor.go

@@ -84,6 +84,11 @@ func installAnchored(ctx context.Context, source, info string, trusted func(os.F
 	if err != nil {
 		return err
 	}
+	// DSM links the package target to the volume; openRegular refuses links.
+	source, err = filepath.EvalSymlinks(source)
+	if err != nil {
+		return err
+	}
 	src, err := openRegular(filepath.Join(source, "executor"))
 	if err != nil {
 		return err
@@ -129,7 +134,12 @@ func startInstalled(runtime, pkg string) error {
 	return cmd.Process.Release()
 }
 
+// An anchored upgrade is handed to root start, which replaces this monitor:
+// only differing pins are an approval request, and only they say so.
 func approvedPins(state pinState, install, start func() error, log func(string)) bool {
+	if state == pinsDiffer {
+		log("executor paused: package pins require administrator approval")
+	}
 	if state != pinsAnchored {
 		return state == pinsMatch
 	}

package/templates/_executor/anchor_test.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
+	"reflect"
 	"strings"
 	"testing"
 )
@@ -101,6 +102,8 @@ func TestInstallAnchoredReplacesOnlyTheProtectedExecutorWithVerifiedBytes(t *tes
 	}
 }
 
+// The pause message names administrator approval only when the pins differ:
+// an anchored handover is a finished upgrade, not a request for approval.
 func TestApprovedPinsHandOverAnAnchoredUpgradeToRootStart(t *testing.T) {
 	for _, tc := range []struct {
 		name       string
@@ -109,18 +112,50 @@ func TestApprovedPinsHandOverAnAnchoredUpgradeToRootStart(t *testing.T) {
 		open       bool
 		installs   int
 		starts     int
+		logged     string
 	}{
-		{"match", pinsMatch, nil, true, 0, 0},
-		{"differ", pinsDiffer, nil, false, 0, 0},
-		{"anchored", pinsAnchored, nil, false, 1, 1},
-		{"install failed", pinsAnchored, errors.New("digest"), false, 1, 0},
+		{"match", pinsMatch, nil, true, 0, 0, ""},
+		{"differ", pinsDiffer, nil, false, 0, 0, "executor paused: package pins require administrator approval"},
+		{"anchored", pinsAnchored, nil, false, 1, 1, "executor upgrade: INFO-anchored executor installed under the approved policy"},
+		{"install failed", pinsAnchored, errors.New("digest"), false, 1, 0, "executor upgrade refused: INFO-anchored executor could not be installed"},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			installs, starts := 0, 0
-			open := approvedPins(tc.state, func() error { installs++; return tc.installErr }, func() error { starts++; return nil }, func(string) {})
+			var logged []string
+			open := approvedPins(tc.state, func() error { installs++; return tc.installErr }, func() error { starts++; return nil }, func(s string) { logged = append(logged, s) })
 			if open != tc.open || installs != tc.installs || starts != tc.starts {
 				t.Fatal("handover", open, installs, starts)
 			}
+			if want := []string{tc.logged}; tc.logged == "" {
+				if len(logged) != 0 {
+					t.Fatal("matching pins logged", logged)
+				}
+			} else if !reflect.DeepEqual(logged, want) {
+				t.Fatal("log", logged, want)
+			}
 		})
 	}
 }
+
+// DSM: /var/packages/<pkg>/target links to /volume1/@appstore/<pkg>.
+func TestInstallAnchoredFollowsTheDSMTargetLink(t *testing.T) {
+	ctx := context.Background()
+	anchor := hashBytes([]byte("new executor"))
+	appstore, info := anchoredPackage(t, "new executor", "approved policy", anchor)
+	link := filepath.Join(filepath.Dir(info), "linked-target")
+	if err := os.Symlink(filepath.Dir(appstore), link); err != nil {
+		t.Fatal(err)
+	}
+	runtime := realTestPath(t, t.TempDir())
+	os.WriteFile(filepath.Join(runtime, "executor"), []byte("approved executor"), 0700)
+	target := filepath.Join(link, "executor")
+	if state := packagePins(ctx, target, info, trustAll, hashBytes([]byte("approved executor")), hashBytes([]byte("approved policy"))); state != pinsAnchored {
+		t.Fatal("pin state", state)
+	}
+	if err := installAnchored(ctx, target, info, trustAll, runtime); err != nil {
+		t.Fatal("anchored executor behind the target link refused", err)
+	}
+	if b, _ := os.ReadFile(filepath.Join(runtime, "executor")); string(b) != "new executor" {
+		t.Fatal("installed", string(b))
+	}
+}

package/templates/_executor/digest_review_test.go

@@ -32,7 +32,7 @@ func TestReviewLargePackageHashDoesNotBlockShutdown(t *testing.T) {
 		done <- manageService(ctx, make(chan string), func() (func(), error) { return func() {}, nil }, func(ctx context.Context) bool {
 			close(entered)
 			return samePackagePins(ctx, dir, strings.Repeat("a", 64), strings.Repeat("b", 64))
-		}, func() error { return nil }, func(string) {})
+		}, func() error { return nil })
 	}()
 	<-entered
 	time.Sleep(20 * time.Millisecond)
@@ -93,7 +93,7 @@ func TestLifecycleCancelsPendingPinCheck(t *testing.T) {
 			actions := make(chan string)
 			done := make(chan error, 1)
 			go func() {
-				done <- manageService(ctx, actions, func() (func(), error) { t.Error("opened during canceled check"); return func() {}, nil }, func(ctx context.Context) bool { close(entered); <-ctx.Done(); close(canceled); return false }, func() error { return nil }, func(string) {})
+				done <- manageService(ctx, actions, func() (func(), error) { t.Error("opened during canceled check"); return func() {}, nil }, func(ctx context.Context) bool { close(entered); <-ctx.Done(); close(canceled); return false }, func() error { return nil })
 			}()
 			<-entered
 			if action == "shutdown" {

package/templates/_executor/dsm.go

@@ -78,11 +78,32 @@ type envelope struct {
 	Data    json.RawMessage `json:"data"`
 }
 
+// dsmError keeps the DSM error code of a refused call; the message stays generic.
+type dsmError struct{ Code int }
+
+func (*dsmError) Error() string { return "DSM refused" }
+
 func decodeEnvelope(b []byte) (json.RawMessage, error) {
+	data, err := decodeSuccess(b)
+	if err == nil && (len(data) == 0 || string(data) == "null") {
+		return nil, &dsmError{}
+	}
+	return data, err
+}
+
+// decodeSuccess accepts a success without data: scheduler deletes answer
+// {"success":true}, sometimes with httpd_restart, and that confirms the delete.
+func decodeSuccess(b []byte) (json.RawMessage, error) {
 	var r envelope
 	d := json.NewDecoder(bytes.NewReader(b))
-	if uniqueValue(d, false) != nil || hasDSMError(b) || json.Unmarshal(b, &r) != nil || !r.Success || len(r.Data) == 0 || string(r.Data) == "null" {
-		return nil, errors.New("DSM refused")
+	if uniqueValue(d, false) != nil || hasDSMError(b) || json.Unmarshal(b, &r) != nil || !r.Success {
+		var refused struct {
+			Error struct {
+				Code int `json:"code"`
+			} `json:"error"`
+		}
+		json.Unmarshal(b, &refused)
+		return nil, &dsmError{Code: refused.Error.Code}
 	}
 	return r.Data, nil
 }
@@ -117,6 +138,22 @@ func (d *liveDSM) Verify(ctx context.Context, cookie, token string) (string, err
 	return out.Username, nil
 }
 func (d *liveDSM) call(ctx context.Context, api, method, version, runner string, params map[string]any) (json.RawMessage, error) {
+	b, err := d.exec(ctx, api, method, version, runner, params)
+	if err != nil {
+		return nil, err
+	}
+	return decodeEnvelope(b)
+}
+
+// mutate runs a call whose success carries no data, such as a scheduler delete.
+func (d *liveDSM) mutate(ctx context.Context, api, method, version string, params map[string]any) error {
+	b, err := d.exec(ctx, api, method, version, "", params)
+	if err == nil {
+		_, err = decodeSuccess(b)
+	}
+	return err
+}
+func (d *liveDSM) exec(ctx context.Context, api, method, version, runner string, params map[string]any) ([]byte, error) {
 	args := []string{"--exec", "api=" + api, "method=" + method, "version=" + version}
 	if runner != "" {
 		args = append(args, "runner="+runner)
@@ -140,7 +177,7 @@ func (d *liveDSM) call(ctx context.Context, api, method, version, runner string,
 		}
 		return nil, errors.New("DSM command")
 	}
-	return decodeEnvelope(b)
+	return b, nil
 }
 func (d *liveDSM) Account(ctx context.Context, name string) (Subject, error) {
 	s, err := d.Accounts.Lookup(name)

package/templates/_executor/go.mod

@@ -1,3 +1,5 @@
 module synopkgland/executor
 
 go 1.23
+
+toolchain go1.26.9

package/templates/_executor/main.go

@@ -360,7 +360,7 @@ func serve(e *Executor, uid, gid int, revived bool) error {
 	purge := func() error {
 		return purgeProtected(ctx, d, e.Policy.Package, filepath.Join(stateBase, e.Policy.Package), runtime, sockDir)
 	}
-	return manageService(ctx, actions, open, samePins, purge, func(s string) { log.Print(s) })
+	return manageService(ctx, actions, open, samePins, purge)
 }
 
 func openService(parent context.Context, e *Executor, uid, gid int, sock string) (func(), error) {
@@ -438,11 +438,12 @@ func openService(parent context.Context, e *Executor, uid, gid int, sock string)
 	}, nil
 }
 func purgeProtected(ctx context.Context, d *liveDSM, pkg, state, runtime, socket string) error {
+	logf := purgeLogger()
 	inv, err := readTaskInventory(runtime)
 	if err != nil {
-		log.Print("task cleanup skipped: protected inventory unavailable")
+		logf("task cleanup skipped: protected inventory unavailable: package=" + pkg)
 	} else {
-		return purgeWithInventory(ctx, d, pkg, inv, state, runtime, socket, func(s string) { log.Print(s) })
+		return purgeWithInventory(ctx, d, pkg, inv, state, runtime, socket, logf)
 	}
 	return finishControl(state, runtime, socket, true)
 }
@@ -515,8 +516,13 @@ func verifiedPID(f *os.File, runtime string) (int, error) {
 	if err != nil || pid <= 1 {
 		return 0, errors.New("pid")
 	}
-	actual, err := os.Readlink(fmt.Sprintf("/proc/%d/exe", pid))
-	if err != nil || strings.TrimSuffix(actual, " (deleted)") != filepath.Join(runtime, "executor") {
+	exe := fmt.Sprintf("/proc/%d/exe", pid)
+	link, err := os.Readlink(exe)
+	if err != nil {
+		return 0, errors.New("pid executable mismatch")
+	}
+	running, err := os.Stat(exe)
+	if err != nil || !approvedExecutable(link, running, runtime, rootOwnedReadOnly) {
 		return 0, errors.New("pid executable mismatch")
 	}
 	return pid, nil

package/templates/_executor/managed.go

@@ -22,8 +22,9 @@ func samePackagePins(ctx context.Context, dir, executorDigest, policyDigest stri
 }
 
 // The process and monitor outlive its listener. A package start can only expose
-// the already-approved runtime when the shipped bytes still match both pins.
-func manageService(ctx context.Context, actions <-chan string, open func() (func(), error), samePins func(context.Context) bool, purge func() error, log func(string)) error {
+// the already-approved runtime when the shipped bytes still match both pins;
+// samePins reports why it refused.
+func manageService(ctx context.Context, actions <-chan string, open func() (func(), error), samePins func(context.Context) bool, purge func() error) error {
 	var closeService func()
 	var checking <-chan bool
 	var cancelCheck context.CancelFunc
@@ -62,7 +63,6 @@ func manageService(ctx context.Context, actions <-chan string, open func() (func
 				return nil
 			}
 			if !matches {
-				log("executor paused: package pins require administrator approval")
 				continue
 			}
 			var err error

package/templates/_executor/managed_test.go

@@ -15,7 +15,7 @@ import (
 func TestPauseResumeOnlyApprovedPinsAndPurgeWhilePaused(t *testing.T) {
 	for _, changed := range []bool{false, true} {
 		t.Run(map[bool]string{false: "same pins", true: "different policy"}[changed], func(t *testing.T) {
-			dir := t.TempDir()
+			dir := realTestPath(t, t.TempDir())
 			os.WriteFile(filepath.Join(dir, "executor"), []byte("approved executable"), 0600)
 			os.WriteFile(filepath.Join(dir, "policy.json"), []byte("approved policy"), 0600)
 			ed, _ := digestFile(context.Background(), filepath.Join(dir, "executor"), maxExecutorBytes)
@@ -34,7 +34,7 @@ func TestPauseResumeOnlyApprovedPinsAndPurgeWhilePaused(t *testing.T) {
 					}
 					opened.Add(1)
 					return func() { listener.Close(); closed.Add(1) }, nil
-				}, func(ctx context.Context) bool { return samePackagePins(ctx, dir, ed, pd) }, func() error { purged.Add(1); return nil }, func(string) {})
+				}, func(ctx context.Context) bool { return samePackagePins(ctx, dir, ed, pd) }, func() error { purged.Add(1); return nil })
 			}()
 			await := func(v *atomic.Int32, want int32) {
 				t.Helper()
@@ -105,7 +105,7 @@ func TestRootControlSignalsPauseThenPurgeWithoutMailbox(t *testing.T) {
 	var opened, closed, purged atomic.Int32
 	done := make(chan error, 1)
 	go func() {
-		done <- manageService(ctx, actions, func() (func(), error) { opened.Add(1); return func() { closed.Add(1) }, nil }, func(context.Context) bool { return true }, func() error { purged.Add(1); return nil }, func(string) {})
+		done <- manageService(ctx, actions, func() (func(), error) { opened.Add(1); return func() { closed.Add(1) }, nil }, func(context.Context) bool { return true }, func() error { purged.Add(1); return nil })
 	}()
 	wait := func(value *atomic.Int32) {
 		t.Helper()

package/templates/_executor/path_test.go

@@ -15,3 +15,21 @@ func realTestPath(t *testing.T, p string) string {
 	return p
 }
 func makeTestDir(p string) error { return os.Mkdir(p, 0700) }
+
+// DSM links /var/packages/<pkg>/target to the volume. Every platform must
+// refuse a symlinked ancestor so tests catch callers that skip EvalSymlinks.
+func TestOpenRegularRefusesASymlinkedAncestor(t *testing.T) {
+	dir := realTestPath(t, t.TempDir())
+	os.MkdirAll(filepath.Join(dir, "appstore"), 0755)
+	os.WriteFile(filepath.Join(dir, "appstore", "executor"), []byte("x"), 0755)
+	os.Symlink(filepath.Join(dir, "appstore"), filepath.Join(dir, "target"))
+	if f, err := openRegular(filepath.Join(dir, "target", "executor")); err == nil {
+		f.Close()
+		t.Fatal("symlinked ancestor accepted")
+	}
+	f, err := openRegular(filepath.Join(dir, "appstore", "executor"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	f.Close()
+}