@synopackageland/cli 0.9.7 → 0.10.1

package/dist/error-registry.js

@@ -1,762 +1,785 @@
 export const ERROR_REGISTRY = {
     "NATIVE_LAYOUT_INVALID": {
         code: "NATIVE_LAYOUT_INVALID",
-        description: "native layout 的 manifest、hook、toolkit 或產物違反 package-only 契約。",
-        suggestion: "使用 schema 2 與 backend.kind: native；檢查路徑、ELF 連結與 checksum pin。"
+        description: "The native layout's manifest, hooks, toolkit or artifacts violate the package-only contract.",
+        suggestion: "Use schema 2 with backend.kind: native; check paths, ELF linkage and checksum pins."
     },
     "COMPOSE_ROUTE_UNSUPPORTED": {
         "code": "COMPOSE_ROUTE_UNSUPPORTED",
-        "description": "Compose 沒有可用的 DSM resource worker 執行路徑。",
-        "suggestion": "使用 prebuilt image 與支援的安裝參數；移除不支援的特權、secret 或 build 設定。"
+        "description": "Compose has no supported DSM resource worker execution path.",
+        "suggestion": "Use a prebuilt image and supported install parameters; remove unsupported privileges, secrets or build settings."
     },
     "LOCAL_SPK_INSTALL_FAILED": {
         "code": "LOCAL_SPK_INSTALL_FAILED",
-        "description": "DSM 本機 SPK 安裝失敗。",
-        "suggestion": "查看 DSM Package Center 安裝錯誤，確認套件版本及需求。"
+        "description": "The local SPK install in DSM failed.",
+        "suggestion": "Check the DSM Package Center install error and confirm the package version and requirements."
     },
     "CONTRACT_SCHEMA_UNSUPPORTED": {
         "code": "CONTRACT_SCHEMA_UNSUPPORTED",
-        "description": "synology-app.yaml 的 schema 版本不受支援。",
-        "suggestion": "請將 synology-app.yaml 的 schema 欄位設為 1。"
+        "description": "The schema version in synology-app.yaml is not supported.",
+        "suggestion": "Set the schema field in synology-app.yaml to 1."
     },
     "CONTRACT_MISSING_FIELD": {
         "code": "CONTRACT_MISSING_FIELD",
-        "description": "synology-app.yaml 缺少必填欄位。",
-        "suggestion": "請在 synology-app.yaml 補上缺少的必填欄位（例如 package, version, displayname 等）。"
+        "description": "synology-app.yaml is missing a required field.",
+        "suggestion": "Add the missing required fields to synology-app.yaml (for example package, version, displayname)."
     },
     "CONTRACT_SCHEMA_INVALID": {
         "code": "CONTRACT_SCHEMA_INVALID",
-        "description": "synology-app.yaml 格式與 JSON Schema 規格不符。",
-        "suggestion": "請修正 synology-app.yaml 的欄位格式以符合規範。"
+        "description": "synology-app.yaml does not match the JSON Schema.",
+        "suggestion": "Fix the field formats in synology-app.yaml so they match the schema."
     },
     "PACKAGE_IDENTITY_TOO_LONG": {
         "code": "PACKAGE_IDENTITY_TOO_LONG",
-        "description": "Package Identity 超過長度上限（正式身分上限 28 字元，最終身分上限 32 字元）。",
-        "suggestion": "請縮短 synology-app.yaml 中的 package 名稱（正式身分至多 28 字元，以保留 4 字元供 .dev 開發後綴使用）。"
+        "description": "The Package Identity exceeds the length limit (28 characters for a formal identity, 32 for the final identity).",
+        "suggestion": "Shorten the package name in synology-app.yaml (at most 28 characters for the formal identity, leaving 4 characters for the .dev suffix)."
     },
     "CONTRACT_PACKAGE_TOO_LONG": {
         "code": "CONTRACT_PACKAGE_TOO_LONG",
-        "description": "Package Identity 超過 DSM 上限 32 字元。",
-        "suggestion": "請縮短 synology-app.yaml 中的 package 名稱至 32 字元以內。"
+        "description": "The Package Identity exceeds the DSM limit of 32 characters.",
+        "suggestion": "Shorten the package name in synology-app.yaml to 32 characters or fewer."
     },
     "CONTRACT_ADMINPORT_INVALID": {
         "code": "CONTRACT_ADMINPORT_INVALID",
-        "description": "adminport 必須是整數。",
-        "suggestion": "請在 synology-app.yaml 提供與 Compose published port 對應的整數 adminport。"
+        "description": "adminport must be an integer.",
+        "suggestion": "Provide an integer adminport in synology-app.yaml that matches the Compose published port."
     },
     "CONTRACT_ADMINPORT_UNMAPPED": {
         "code": "CONTRACT_ADMINPORT_UNMAPPED",
-        "description": "adminport 未在 Compose ports 宣告中對應到容器 port。",
-        "suggestion": "請在 compose.yaml 的 ports 區塊宣告與 adminport 對應的連接埠映射（例如 \"8080:80\"）。"
+        "description": "adminport does not map to a container port in the Compose ports declaration.",
+        "suggestion": "Declare a port mapping for adminport in the compose.yaml ports block (for example \"8080:80\")."
     },
     "CONTRACT_LAUNCH_INVALID": {
         "code": "CONTRACT_LAUNCH_INVALID",
-        "description": "integration.web.launch 模式無效。",
-        "suggestion": "請改為 dsm-window（DSM 視窗，預設）或 new-page（新分頁），Headless App 請省略此欄位。"
+        "description": "The integration.web.launch mode is invalid.",
+        "suggestion": "Use dsm-window (DSM window, the default) or new-page (new tab); omit this field for a headless App."
     },
     "CONTRACT_LAUNCH_REQUIRES_WEB": {
         "code": "CONTRACT_LAUNCH_REQUIRES_WEB",
-        "description": "Headless App 不需要宣告 Web Launch Mode。",
-        "suggestion": "請省略 integration.web.launch，或補上對應 Compose published port 的 adminport。"
+        "description": "A headless App does not declare a Web Launch Mode.",
+        "suggestion": "Remove integration.web.launch, or add the adminport that matches the Compose published port."
     },
     "CONTRACT_PORTAL_REQUIRES_EXECUTOR": {
         "code": "CONTRACT_PORTAL_REQUIRES_EXECUTOR",
-        "description": "Compose App 宣告了 integration.web.portal；Compose App 沒有 executor，登入入口別名在解除安裝後要 root 才能讓 nginx 停止提供。",
-        "suggestion": "請移除 integration.web.portal；需要登入入口別名時，由管理員在 DSM 手動設定反向代理。"
+        "description": "The Compose App declares integration.web.portal, but a Compose App has no executor; removing the sign-in alias after uninstall needs root so nginx stops serving it.",
+        "suggestion": "Remove integration.web.portal; for a sign-in alias, ask an administrator to configure a reverse proxy in DSM instead."
     },
     "CONTRACT_ACCESS_INVALID": {
         "code": "CONTRACT_ACCESS_INVALID",
-        "description": "integration.web.access 模式無效。",
-        "suggestion": "請改為 dsm-users（已登入的 DSM 使用者，預設）、dsm-admins、dsm-groups（需搭配 groups），或明確選 public 以保留匿名 Web Station 入口。"
+        "description": "The integration.web.access mode is invalid.",
+        "suggestion": "Use dsm-users (signed-in DSM users, the default), dsm-admins, dsm-groups (with groups), or public to keep an anonymous Web Station entry."
     },
     "CONTRACT_ACCESS_GROUPS_INVALID": {
         "code": "CONTRACT_ACCESS_GROUPS_INVALID",
-        "description": "integration.web.groups 缺少、格式不符，或沒有搭配 access: dsm-groups。",
-        "suggestion": "請改用 access: dsm-groups 並列出 DSM 群組名稱，或移除 groups。"
+        "description": "integration.web.groups is missing, malformed, or not combined with access: dsm-groups.",
+        "suggestion": "Use access: dsm-groups and list DSM group names, or remove groups."
     },
     "CONTRACT_ACCESS_REQUIRES_WEB": {
         "code": "CONTRACT_ACCESS_REQUIRES_WEB",
-        "description": "Headless App 不需要宣告 Web access 規則。",
-        "suggestion": "請省略 integration.web.access／groups，或補上對應 Compose published port 的 adminport。"
+        "description": "A headless App does not declare Web access rules.",
+        "suggestion": "Remove integration.web.access/groups, or add the adminport that matches the Compose published port."
     },
     "COMPOSE_GATEWAY_PORT_EXPOSED": {
         "code": "COMPOSE_GATEWAY_PORT_EXPOSED",
-        "description": "DSM 驗證閘道是容器的唯一入口，但 adminport 對應的 Compose port 綁在所有網路介面上。",
-        "suggestion": "請把 ports 改成只綁 loopback（例如 \"127.0.0.1:18333:18333\"），或在 integration.web.access 明確選 public。"
+        "description": "The DSM verification gateway is the container's only entry point, but the Compose port behind adminport binds to every network interface.",
+        "suggestion": "Bind ports to loopback only (for example \"127.0.0.1:18333:18333\"), or choose public explicitly in integration.web.access."
     },
     "GATEWAY_ARCH_FAMILY_REQUIRED": {
         "code": "GATEWAY_ARCH_FAMILY_REQUIRED",
-        "description": "DSM 驗證閘道是原生執行檔，SPK 必須指定目標架構。",
-        "suggestion": "請加上 --arch x86_64 或 --arch aarch64（deploy 會由 NAS 判定）；不需要 DSM 驗證的 App 才可在 integration.web.access 選 public。"
+        "description": "The DSM verification gateway is a native binary, so the SPK must name its target architecture.",
+        "suggestion": "Add --arch x86_64 or --arch aarch64 (deploy detects it from the NAS); only Apps without DSM verification may choose public in integration.web.access."
     },
     "GATEWAY_GO_MISSING": {
         "code": "GATEWAY_GO_MISSING",
-        "description": "建置 DSM 驗證閘道需要 Go，但找不到 go 指令。",
-        "suggestion": "請安裝 Go 1.21 以上版本（https://go.dev/dl/，建置時固定使用 go1.26.9），或在 integration.web.access 明確選 public。"
+        "description": "Building the DSM verification gateway needs Go, but the go command was not found.",
+        "suggestion": "Install Go 1.21 or later (https://go.dev/dl/, builds pin go1.26.9), or choose public explicitly in integration.web.access."
     },
     "GATEWAY_BUILD_FAILED": {
         "code": "GATEWAY_BUILD_FAILED",
-        "description": "DSM 驗證閘道建置失敗或產出不是對應架構的靜態 ELF。",
-        "suggestion": "請查看 go build 輸出；閘道固定以 go1.26.9 建置，離線時請安裝 go1.26.9 或讓 GOPROXY 可提供 golang.org/toolchain，並確認 CLI 套件的 assets/go/gateway 未被修改。"
+        "description": "The DSM verification gateway failed to build, or the output is not a static ELF for the target architecture.",
+        "suggestion": "Check the go build output; the gateway always builds with go1.26.9, so install go1.26.9 offline or let GOPROXY serve golang.org/toolchain, and confirm assets/go/gateway in the CLI package is unmodified."
     },
     "CONTRACT_INVALID_STRING": {
         "code": "CONTRACT_INVALID_STRING",
-        "description": "合約字串含有不允許的控制字元或未允許的插值語法。",
-        "suggestion": "請移除控制字元與 ${ 插值語法，安裝參數請在 install 區塊宣告。"
+        "description": "A contract string contains a control character or the ${ interpolation syntax, which is not allowed.",
+        "suggestion": "Remove control characters and ${ interpolation; declare install parameters in the install block."
     },
     "CONTRACT_DSM_USER_DUPLICATE": {
         "code": "CONTRACT_DSM_USER_DUPLICATE",
-        "description": "每顆 App 至多宣告一個 dsm_user 安裝參數。",
-        "suggestion": "請在 synology-app.yaml 只保留一個 Container Run-as 參數。"
+        "description": "Each App may declare at most one dsm_user install parameter.",
+        "suggestion": "Keep only one Container Run-as parameter in synology-app.yaml."
     },
     "INSTALL_STRING_TOO_LONG": {
         "code": "INSTALL_STRING_TOO_LONG",
-        "description": "Install Parameter 字串預設值超過 256 字元。",
-        "suggestion": "請縮短 synology-app.yaml 中 install 參數的預設字串長度。"
+        "description": "An Install Parameter string default exceeds 256 characters.",
+        "suggestion": "Shorten the default string of the install parameter in synology-app.yaml."
     },
     "INSTALL_STRING_INVALID": {
         "code": "INSTALL_STRING_INVALID",
-        "description": "Install Parameter 字串值含有不合法字元或插值。",
-        "suggestion": "請移除 install 參數預設值中的控制字元與 ${ 插值語法。"
+        "description": "An Install Parameter string value contains an invalid character or interpolation.",
+        "suggestion": "Remove control characters and ${ interpolation from the install parameter default."
     },
     "CONTRACT_SECRET_UNSUPPORTED": {
         "code": "CONTRACT_SECRET_UNSUPPORTED",
-        "description": "install.<NAME>.type: secret 目前沒有可用的安裝路徑：無論是否在 Compose 引用，Package Center 安裝都以 DSM broken／150 結束，且不建立 Container Manager project。",
-        "suggestion": "請改用 type: string（非敏感值），或把敏感值改成 App 啟動後自行取得／由管理員放進 ${SYNO_APP_SECRETS_DIR} 的檔案。在 DSM worker 的失敗原因可觀測之前，secret 型別不會開放。"
+        "description": "install.<NAME>.type: secret has no usable install path today: whether or not Compose references it, Package Center install ends in DSM broken/150 and creates no Container Manager project.",
+        "suggestion": "Use type: string (non-sensitive), or have the App fetch the secret itself at startup or read a file an administrator places in ${SYNO_APP_SECRETS_DIR}. The secret type stays closed until the DSM worker failure reason is observable."
     },
     "CONTRACT_HOMES_UNSUPPORTED": {
         "code": "CONTRACT_HOMES_UNSUPPORTED",
-        "description": "install.<NAME>.type: homes 目前沒有可用的安裝路徑：安裝精靈不產生輸入控制項，Package Center 安裝以 DSM broken／150 結束；CLI deploy 能解析出 /volume1/homes，但 DSM 於 compound install 回 4540 拒絕。",
-        "suggestion": "若 App 需要一個由管理員選定的資料夾，請改用 type: shared_folder。在補齊安裝精靈控制項與 preinst 路徑解析之前，homes 型別不會開放。"
+        "description": "install.<NAME>.type: homes has no usable install path today: the install wizard generates no input control and Package Center install ends in DSM broken/150; CLI deploy can resolve /volume1/homes, but DSM rejects the compound install with 4540.",
+        "suggestion": "If the App needs an administrator-chosen folder, use type: shared_folder instead. The homes type stays closed until the wizard control and preinst path resolution exist."
     },
     "INSTALL_PARAMETER_UNREFERENCED": {
         "code": "INSTALL_PARAMETER_UNREFERENCED",
-        "description": "install 宣告的參數未在 Compose 中被引用。",
-        "suggestion": "請在 compose.yaml 以 ${參數名稱} 引用該參數，或從 synology-app.yaml 移除未使用的宣告。"
+        "description": "An install parameter is declared but not referenced in Compose.",
+        "suggestion": "Reference the parameter in compose.yaml as ${NAME}, or remove the unused declaration from synology-app.yaml."
     },
     "CONTRACT_HOMES_PATH_FORBIDDEN": {
         "code": "CONTRACT_HOMES_PATH_FORBIDDEN",
-        "description": "homes Install Parameter 不得在契約中寫入 NAS 實體路徑或預設值。",
-        "suggestion": "請只宣告 type: homes 並在 Compose 引用該參數，由套件 在安裝時解析這台 NAS 的 User Home 路徑。"
+        "description": "A homes Install Parameter must not write a NAS physical path or default value into the contract.",
+        "suggestion": "Declare only type: homes, reference the parameter in Compose, and let the package resolve this NAS's User Home path at install time."
     },
     "CONTRACT_POSIX_ALL_SHARES_VALUE_FORBIDDEN": {
         "code": "CONTRACT_POSIX_ALL_SHARES_VALUE_FORBIDDEN",
-        "description": "POSIX all-shares 參數不得在契約中指定 default 或 NAS 實體路徑。",
-        "suggestion": "請只宣告 type: posix_all_shares，讓 wizard／CLI 在安裝時取得當下的 Share snapshot。"
+        "description": "A POSIX all-shares parameter must not specify a default or NAS physical path in the contract.",
+        "suggestion": "Declare only type: posix_all_shares and let the wizard/CLI take the current Share snapshot at install time."
     },
     "CONTRACT_POSIX_ALL_SHARES_LISTING_UNSUPPORTED": {
         "code": "CONTRACT_POSIX_ALL_SHARES_LISTING_UNSUPPORTED",
-        "description": "posix_all_shares 需要 CLI 在安裝時以管理員 session 取得這台 NAS 的 Share 清單快照；Package Center 與 Package Source listing 無法履行此合約。",
-        "suggestion": "請使用 synopkgland deploy --host <name>，由管理員 session 在安裝時取得 Share 清單快照；此型別不能透過 Package Center 或 Package Source listing 上架。"
+        "description": "posix_all_shares requires the CLI to take a Share list snapshot of this NAS with an administrator session at install time; Package Center and Package Source listing cannot fulfill this contract.",
+        "suggestion": "Use synopkgland deploy --host <name> so an administrator session takes the Share list snapshot at install time; this type cannot ship through Package Center or Package Source listing."
     },
     "DSM_USER_REQUIRED": {
         "code": "DSM_USER_REQUIRED",
-        "description": "有 Shared Folder 時必須宣告恰好一個 dsm_user 作為 Container Run-as。",
-        "suggestion": "請在 synology-app.yaml 新增 install.<NAME>.type: dsm_user，並在 Compose 引用 ${NAME_UID}:${NAME_GID}。"
+        "description": "A Shared Folder requires exactly one dsm_user as the Container Run-as.",
+        "suggestion": "Add install.<NAME>.type: dsm_user to synology-app.yaml and reference ${NAME_UID}:${NAME_GID} in Compose."
     },
     "PROJECT_RUNTIME_EXCLUSIVE": {
         "code": "PROJECT_RUNTIME_EXCLUSIVE",
-        "description": "專案同時存在 compose.yaml 與 dsm-package.yaml，兩者互斥。",
-        "suggestion": "請選擇使用 compose.yaml（容器 App）或 dsm-package.yaml（原生 App），並刪除另一個檔案。"
+        "description": "The project has both compose.yaml and dsm-package.yaml, which are mutually exclusive.",
+        "suggestion": "Choose compose.yaml (container App) or dsm-package.yaml (native App) and delete the other file."
     },
     "COMPOSE_MISSING": {
         "code": "COMPOSE_MISSING",
-        "description": "找不到 compose.yaml 或 dsm-package.yaml。",
-        "suggestion": "請在專案根目錄建立 compose.yaml 或 dsm-package.yaml。"
+        "description": "compose.yaml or dsm-package.yaml was not found.",
+        "suggestion": "Create compose.yaml or dsm-package.yaml in the project root."
     },
     "COMPOSE_SERVICE_NOT_FOUND": {
         "code": "COMPOSE_SERVICE_NOT_FOUND",
-        "description": "depends_on 引用的服務不存在於 compose.yaml 中。",
-        "suggestion": "請修正 compose.yaml 中的 depends_on，指向正確已定義的 service 名稱。"
+        "description": "A service referenced by depends_on does not exist in compose.yaml.",
+        "suggestion": "Fix depends_on in compose.yaml to point at a defined service name."
     },
     "COMPOSE_NUMERIC_COMMAND_ARG_FORBIDDEN": {
         "code": "COMPOSE_NUMERIC_COMMAND_ARG_FORBIDDEN",
-        "description": "會走 DSM Docker Project resource worker 的 Compose command/entrypoint 陣列含純數字字串，可能在 worker YAML round-trip 後變成整數而無法 acquire。",
-        "suggestion": "請把整個命令包成單一字串，例如 command: [\"sh\", \"-c\", \"httpd -f -p 8080 -h /srv\"]，或與 flag 併寫成 \"-p8080\"。"
+        "description": "A Compose command/entrypoint array that goes through the DSM Docker Project resource worker contains a pure numeric string, which a YAML round-trip may turn into an integer and fail to acquire.",
+        "suggestion": "Wrap the whole command in one string, for example command: [\"sh\", \"-c\", \"httpd -f -p 8080 -h /srv\"], or join it with the flag as \"-p8080\"."
     },
     "COMPOSE_DYNAMIC_ROUTE_UNSUPPORTED": {
         "code": "COMPOSE_DYNAMIC_ROUTE_UNSUPPORTED",
-        "description": "Compose dynamic route 超出 D1/D2 白名單，或使用 DSM worker 不會載入的 secret/config 來源。",
-        "suggestion": "請只使用 string/boolean wizard answer 的 ${NAME} interpolation；secret/config 因 DSM worker 不讀 docker-compose.override.yml 而拒收。"
+        "description": "A Compose dynamic route is outside the D1/D2 allowlist, or uses a secret/config source the DSM worker does not load.",
+        "suggestion": "Use only ${NAME} interpolation of string/boolean wizard answers; secret/config are rejected because the DSM worker does not read docker-compose.override.yml."
     },
     "COMPOSE_BUILD_FORBIDDEN": {
         "code": "COMPOSE_BUILD_FORBIDDEN",
-        "description": "D0 Compose route 禁止在 NAS install-time 使用 build:；build capability 永久拒收。",
-        "suggestion": "請移除 build:，改用已存在的 image（最好使用 image@sha256:... 固定 digest），再重新執行 check。"
+        "description": "The D0 Compose route forbids build: at NAS install time; the build capability is permanently rejected.",
+        "suggestion": "Remove build: and use an existing image (preferably pinned with image@sha256:...), then run check again."
     },
     "COMPOSE_SOCKET_MOUNT_FORBIDDEN": {
         "code": "COMPOSE_SOCKET_MOUNT_FORBIDDEN",
-        "description": "嚴禁掛載 Docker Socket 或系統敏感 Socket。",
-        "suggestion": "請從 compose.yaml 移除 docker.sock 掛載；如需存取檔案請改用 shared_folder 或 App 自己的檔案 API。"
+        "description": "Mounting the Docker socket or sensitive system sockets is forbidden.",
+        "suggestion": "Remove the docker.sock mount from compose.yaml; for file access use a shared_folder or the App's own file API."
     },
     "COMPOSE_BIND_SOURCE_FORBIDDEN": {
         "code": "COMPOSE_BIND_SOURCE_FORBIDDEN",
-        "description": "掛載來源路徑不合法或屬於受保護的系統路徑。",
-        "suggestion": "請使用受控的 ${SYNOPKG_PKGVAR}、${SYNO_APP_SECRETS_DIR} 或已宣告的 ${SHARED_FOLDER} 槽位。"
+        "description": "A mount source path is invalid or is a protected system path.",
+        "suggestion": "Use the controlled ${SYNOPKG_PKGVAR}, ${SYNO_APP_SECRETS_DIR}, or a declared ${SHARED_FOLDER} slot."
     },
     "COMPOSE_BIND_SOURCE_UNDECLARED": {
         "code": "COMPOSE_BIND_SOURCE_UNDECLARED",
-        "description": "Volume 掛載使用了未宣告的 Shared Folder 變數。",
-        "suggestion": "請先在 synology-app.yaml 的 install 區塊宣告該 shared_folder 參數。"
+        "description": "A volume mount uses an undeclared Shared Folder variable.",
+        "suggestion": "Declare the shared_folder parameter in the synology-app.yaml install block first."
     },
     "COMPOSE_BIND_SUFFIX_INVALID": {
         "code": "COMPOSE_BIND_SUFFIX_INVALID",
-        "description": "Shared Folder 子路徑格式不合法（含有 .. 或控制字元）。",
-        "suggestion": "請改用合法的相對子路徑，例如 ${MEDIA_SHARE}/data:/data。"
+        "description": "A Shared Folder subpath is invalid (it contains .. or a control character).",
+        "suggestion": "Use a valid relative subpath, for example ${MEDIA_SHARE}/data:/data."
     },
     "COMPOSE_POSIX_ALL_SHARES_UNDECLARED": {
         "code": "COMPOSE_POSIX_ALL_SHARES_UNDECLARED",
-        "description": "Compose 使用了未宣告的 POSIX all-shares marker。",
-        "suggestion": "請宣告 type: posix_all_shares，讓 package-only wizard／CLI 取得安裝當下的 Share snapshot。"
+        "description": "Compose uses an undeclared POSIX all-shares marker.",
+        "suggestion": "Declare type: posix_all_shares so the package-only wizard/CLI takes the Share snapshot at install time."
     },
     "COMPOSE_POSIX_ALL_SHARES_SUFFIX_FORBIDDEN": {
         "code": "COMPOSE_POSIX_ALL_SHARES_SUFFIX_FORBIDDEN",
-        "description": "POSIX all-shares marker 不得附加 Share 子路徑。",
-        "suggestion": "請只使用完整的 ${ALL_SHARES} source；每個 Share 的 container target 由 package-only preinst 展開。"
+        "description": "A POSIX all-shares marker must not carry a Share subpath.",
+        "suggestion": "Use the complete ${ALL_SHARES} source only; the package-only preinst expands each Share's container target."
     },
     "COMPOSE_HOST_BIND_FORBIDDEN": {
         "code": "COMPOSE_HOST_BIND_FORBIDDEN",
-        "description": "禁止直接硬編碼本機路徑（例如 /volume1/... 或 ./）。",
-        "suggestion": "請在 synology-app.yaml 宣告 shared_folder 參數，並在 Compose 改用 ${SLOT} 引用。"
+        "description": "Hard-coded host paths (for example /volume1/... or ./) are forbidden.",
+        "suggestion": "Declare a shared_folder parameter in synology-app.yaml and reference it as ${SLOT} in Compose."
     },
     "COMPOSE_NAMED_VOLUME_UNDECLARED": {
         "code": "COMPOSE_NAMED_VOLUME_UNDECLARED",
-        "description": "服務使用了未在頂層 volumes 宣告的 Named Volume。",
-        "suggestion": "請在 compose.yaml 頂層 volumes 區塊補上該 Volume 宣告，或改用受控目錄。"
+        "description": "A service uses a Named Volume that is not declared in the top-level volumes.",
+        "suggestion": "Add the volume declaration to the top-level volumes block in compose.yaml, or use a controlled directory."
     },
     "COMPOSE_USER_ROOT_FORBIDDEN": {
         "code": "COMPOSE_USER_ROOT_FORBIDDEN",
-        "description": "容器以 root (0:0) 執行，違反最小權限原則。",
-        "suggestion": "請在 synology-app.yaml 宣告 dsm_user 並在 Compose 使用 ${USER_UID}:${USER_GID}。"
+        "description": "The container runs as root (0:0), violating least privilege.",
+        "suggestion": "Declare dsm_user in synology-app.yaml and use ${USER_UID}:${USER_GID} in Compose."
     },
     "COMPOSE_USER_CONFLICTS_DSM_USER": {
         "code": "COMPOSE_USER_CONFLICTS_DSM_USER",
-        "description": "Compose 服務自定義了 user 欄位，與 contract 宣告的 dsm_user 衝突。",
-        "suggestion": "請移除 Compose 中的 user 欄位，交由 dsm_user 自動注入 ${NAME_UID}:${NAME_GID} 與 group_add。"
+        "description": "The Compose service defines its own user field, which conflicts with the dsm_user declared in the contract.",
+        "suggestion": "Remove the user field from Compose; dsm_user injects ${NAME_UID}:${NAME_GID} and group_add automatically."
     },
     "COMPOSE_USER_NUMERIC_FORBIDDEN": {
         "code": "COMPOSE_USER_NUMERIC_FORBIDDEN",
-        "description": "禁止在 compose.yaml 硬編碼數字 uid:gid。",
-        "suggestion": "請在 synology-app.yaml 宣告 dsm_user，並在 Compose 引用 ${NAME_UID}:${NAME_GID}。"
+        "description": "Hard-coding a numeric uid:gid in compose.yaml is forbidden.",
+        "suggestion": "Declare dsm_user in synology-app.yaml and reference ${NAME_UID}:${NAME_GID} in Compose."
     },
     "COMPOSE_PRIVILEGED_FORBIDDEN": {
         "code": "COMPOSE_PRIVILEGED_FORBIDDEN",
-        "description": "使用了 privileged: true 但未在合約宣告。",
-        "suggestion": "請在 synology-app.yaml 加上 privilege.privileged: true，或移除 privileged: true。"
+        "description": "privileged: true is used but not declared in the contract.",
+        "suggestion": "Add privilege.privileged: true to synology-app.yaml, or remove privileged: true."
     },
     "COMPOSE_HOST_NETWORK_FORBIDDEN": {
         "code": "COMPOSE_HOST_NETWORK_FORBIDDEN",
-        "description": "使用了 host network 模式但未在合約宣告。",
-        "suggestion": "請在 synology-app.yaml 加上 privilege.host_network: true，或改用受控網路模式。"
+        "description": "host network mode is used but not declared in the contract.",
+        "suggestion": "Add privilege.host_network: true to synology-app.yaml, or use a controlled network mode."
     },
     "COMPOSE_HOST_PID_FORBIDDEN": {
         "code": "COMPOSE_HOST_PID_FORBIDDEN",
-        "description": "使用了 pid: host 但未在合約宣告。",
-        "suggestion": "請在 synology-app.yaml 加上 privilege.host_pid: true，或移除 pid: host。"
+        "description": "pid: host is used but not declared in the contract.",
+        "suggestion": "Add privilege.host_pid: true to synology-app.yaml, or remove pid: host."
     },
     "COMPOSE_HOST_IPC_FORBIDDEN": {
         "code": "COMPOSE_HOST_IPC_FORBIDDEN",
-        "description": "使用了 ipc: host 但未在合約宣告。",
-        "suggestion": "請在 synology-app.yaml 加上 privilege.host_ipc: true，或移除 ipc: host。"
+        "description": "ipc: host is used but not declared in the contract.",
+        "suggestion": "Add privilege.host_ipc: true to synology-app.yaml, or remove ipc: host."
     },
     "COMPOSE_DEVICES_FORBIDDEN": {
         "code": "COMPOSE_DEVICES_FORBIDDEN",
-        "description": "使用了 devices 裝置存取但未在合約宣告。",
-        "suggestion": "請在 synology-app.yaml 加上 privilege.devices: true，或移除 devices 區塊。"
+        "description": "Device access is used but not declared in the contract.",
+        "suggestion": "Add privilege.devices: true to synology-app.yaml, or remove the devices block."
     },
     "COMPOSE_CAP_ADD_FORBIDDEN": {
         "code": "COMPOSE_CAP_ADD_FORBIDDEN",
-        "description": "使用了 cap_add 權限提升但未在合約宣告。",
-        "suggestion": "請在 synology-app.yaml 加上 privilege.cap_add: true，或移除 cap_add 區塊。"
+        "description": "cap_add privilege escalation is used but not declared in the contract.",
+        "suggestion": "Add privilege.cap_add: true to synology-app.yaml, or remove the cap_add block."
     },
     "COMPOSE_ENV_MISSING": {
         "code": "COMPOSE_ENV_MISSING",
-        "description": "專案缺少必要的環境變數目錄結構。",
-        "suggestion": "請確認 SYNOPKG_PKGVAR 與 secrets 目錄已正確建立。"
+        "description": "The project is missing the required environment variable directory structure.",
+        "suggestion": "Make sure SYNOPKG_PKGVAR and the secrets directory are created correctly."
     },
     "COMPOSE_NOT_HEALTHY": {
         "code": "COMPOSE_NOT_HEALTHY",
-        "description": "Compose 服務未能於時限內通過 healthcheck 達到 healthy 狀態。",
-        "suggestion": "請檢查容器健康檢查設定與應用程式日誌：synopkgland logs --host <nas>。"
+        "description": "The Compose service did not reach healthy within the time limit.",
+        "suggestion": "Check the container healthcheck and application logs: synopkgland logs --host <nas>."
     },
     "COMPOSE_NOT_RUNNING": {
         "code": "COMPOSE_NOT_RUNNING",
-        "description": "Compose 服務未能於時限內維持 running 狀態。",
-        "suggestion": "請檢查容器啟動腳本與日誌以排除崩潰原因：synopkgland logs --host <nas>。"
+        "description": "The Compose service did not stay running within the time limit.",
+        "suggestion": "Check the container start script and logs for the crash cause: synopkgland logs --host <nas>."
     },
     "BUILD_SPK_FAILED": {
         "code": "BUILD_SPK_FAILED",
-        "description": "SPK 打包流程失敗。",
-        "suggestion": "請檢查 check 錯誤與目錄檔案權限後重試。"
+        "description": "The SPK packaging flow failed.",
+        "suggestion": "Fix the check errors and file permissions, then retry."
     },
     "VALIDATION_FAILED": {
         "code": "VALIDATION_FAILED",
-        "description": "專案未通過契約或安全驗證，終止部署。",
-        "suggestion": "請先執行 synopkgland check 排除合約與 Compose 錯誤。"
+        "description": "The project failed contract or security validation; deploy stopped.",
+        "suggestion": "Run synopkgland check first to fix contract and Compose errors."
     },
     "DEPLOY_FAILED": {
         "code": "DEPLOY_FAILED",
-        "description": "部署至 NAS 時發生未分類錯誤。",
-        "suggestion": "請檢查 NAS 網路連線與日誌：synopkgland logs --host <nas>。"
+        "description": "An unclassified error occurred while deploying to the NAS.",
+        "suggestion": "Check NAS connectivity and logs: synopkgland logs --host <nas>."
     },
     "SHARE_VALUE_REQUIRED": {
         "code": "SHARE_VALUE_REQUIRED",
-        "description": "部署時缺少合約中宣告的 shared_folder 實際路徑映射。",
-        "suggestion": "請使用 --share <SLOT>=<邏輯名> 提供對應的 Shared Folder 名稱。"
+        "description": "Deploy is missing the physical path mapping for a shared_folder declared in the contract.",
+        "suggestion": "Provide the matching Shared Folder name with --share <SLOT>=<logical name>."
     },
     "SHARE_LOGICAL_NAME_REQUIRED": {
         "code": "SHARE_LOGICAL_NAME_REQUIRED",
-        "description": "Share 參數必須提供邏輯名稱，禁止使用 /volume1/... 等實體路徑。",
-        "suggestion": "請指定 DSM 控制台中的 Shared Folder 邏輯名稱，例如 --share MEDIA_SHARE=photos。"
+        "description": "A Share parameter needs a logical name; physical paths such as /volume1/... are forbidden.",
+        "suggestion": "Give the Shared Folder logical name from DSM Control Panel, for example --share MEDIA_SHARE=photos."
     },
     "SHARE_NOT_FOUND": {
         "code": "SHARE_NOT_FOUND",
-        "description": "在目標 NAS 上找不到指定的 Shared Folder。",
-        "suggestion": "請在 DSM 控制台建立該 Shared Folder，或檢查名稱拼字。"
+        "description": "The named Shared Folder was not found on the target NAS.",
+        "suggestion": "Create the Shared Folder in DSM Control Panel, or check the spelling."
     },
     "HOMES_NOT_ENABLED": {
         "code": "HOMES_NOT_ENABLED",
-        "description": "目標 NAS 未啟用 User Home，或無法解析 homes 的實體 bind source。",
-        "suggestion": "請在這台 NAS 啟用 DSM User Home，並確認 DSM API 能回傳解析後的路徑，再重新部署。"
+        "description": "The target NAS has User Home disabled, or the homes physical bind source cannot be resolved.",
+        "suggestion": "Enable DSM User Home on this NAS, confirm the DSM API returns the resolved path, then deploy again."
     },
     "DSM_USER_LOGICAL_NAME_REQUIRED": {
         "code": "DSM_USER_LOGICAL_NAME_REQUIRED",
-        "description": "dsm_user 參數必須提供 DSM 使用者邏輯名稱，禁止使用數字 UID。",
-        "suggestion": "請在 --run-as 指定 DSM 使用者帳號名稱（例如 --run-as RUN_AS=alice）。"
+        "description": "A dsm_user parameter needs a DSM user logical name; a numeric UID is forbidden.",
+        "suggestion": "Pass the DSM account name with --run-as (for example --run-as RUN_AS=alice)."
     },
     "SHARE_RUN_AS_NO_ACCESS": {
         "code": "SHARE_RUN_AS_NO_ACCESS",
-        "description": "deploy 的安裝前檢查發現選定的 Container Run-as 使用者對選定的 Shared Folder 沒有權限（或被明確拒絕）。容器會以該使用者掛載該 Share，安裝會成功但 runtime 讀寫會拿到 Permission denied。",
-        "suggestion": "請在 DSM 控制台把該 Shared Folder 的權限授予該使用者（或其群組），或改選別的使用者／Share，再重新部署。此檢查只在 deploy 進行；Package Center 安裝精靈不經過這裡，ACL 仍是管理員的前提責任。"
+        "description": "The deploy pre-install check found that the chosen Container Run-as user has no permission on the chosen Shared Folder (or is explicitly denied). The container mounts the Share as that user, so the install succeeds but runtime reads and writes get Permission denied.",
+        "suggestion": "Grant that user (or their group) permission on the Shared Folder in DSM Control Panel, or choose another user/Share, then deploy again. This check only runs in deploy; the Package Center install wizard does not go through it, and ACLs remain the administrator's responsibility."
     },
     "PORT_ALREADY_IN_USE": {
         "code": "PORT_ALREADY_IN_USE",
-        "description": "deploy 的安裝前檢查發現 Compose published TCP port 已被其他服務或容器佔用。",
-        "suggestion": "請更換 synology-app.yaml／compose.yaml 的 published host port；同一 Package Identity 的既有容器會在升級或重裝時放行。"
+        "description": "The deploy pre-install check found the Compose published TCP port already taken by another service or container.",
+        "suggestion": "Change the published host port in synology-app.yaml/compose.yaml; existing containers of the same Package Identity are allowed during upgrade or reinstall."
     },
     "CATALOG_INSTALL_FAILED": {
         "code": "CATALOG_INSTALL_FAILED",
-        "description": "NAS Package Center 安裝套件失敗。",
-        "suggestion": "請至 DSM Package Center 檢查安裝日誌或手動嘗試安裝。"
+        "description": "NAS Package Center failed to install the package.",
+        "suggestion": "Check the install log in DSM Package Center or try installing manually."
     },
     "DEPLOY_PARAM_UNDECLARED": {
         "code": "DEPLOY_PARAM_UNDECLARED",
-        "description": "deploy --param 提供了契約未宣告的 Install Parameter，或 native-go／binary 套件沒有的安裝精靈值。",
-        "suggestion": "Compose 請只傳 synology-app.yaml install 中宣告的 string 或 boolean 名稱；native-go／binary 只接受 install-selected delegate 的 delegate_share 或 delegate_home。"
+        "description": "deploy --param provided an Install Parameter the contract does not declare, or an install wizard value that a native-go/binary package does not have.",
+        "suggestion": "For Compose pass only string or boolean names declared in synology-app.yaml install; native-go/binary accept only delegate_share or delegate_home from the install-selected delegate."
     },
     "DEPLOY_PARAM_REQUIRED": {
         "code": "DEPLOY_PARAM_REQUIRED",
-        "description": "首次安裝 install-selected delegate 套件時沒有提供安裝精靈的範圍值，preinst 會拒絕安裝。",
-        "suggestion": "加上 --param delegate_share=<共用資料夾> 或 --param delegate_home=true 再部署。"
+        "description": "The first install of an install-selected delegate package did not provide the install wizard scope value, so preinst rejects the install.",
+        "suggestion": "Add --param delegate_share=<shared folder> or --param delegate_home=true and deploy again."
     },
     "DEPLOY_PARAM_TYPE_INVALID": {
         "code": "DEPLOY_PARAM_TYPE_INVALID",
-        "description": "deploy --param 的值不符合契約宣告的 string 或 boolean 型別。",
-        "suggestion": "string 請傳非空字串；boolean 請只傳 true 或 false。"
+        "description": "The deploy --param value does not match the string or boolean type declared in the contract.",
+        "suggestion": "Pass a non-empty string for string; pass only true or false for boolean."
     },
     "DEPLOY_POSIX_ALL_SHARES_LOOKUP_FAILED": {
         "code": "DEPLOY_POSIX_ALL_SHARES_LOOKUP_FAILED",
-        "description": "無法以管理員 session 列出部署當下的 Shared Folder 清單。",
-        "suggestion": "請確認 DSM 管理員 session 可呼叫 SYNO.Core.Share list，或用 --param NAME=... 明確提供清單。"
+        "description": "The Shared Folder list at deploy time could not be listed with an administrator session.",
+        "suggestion": "Confirm the DSM administrator session can call SYNO.Core.Share list, or provide the list explicitly with --param NAME=...."
     },
     "DSM_DEPENDENCY_CONFLICT": {
         "code": "DSM_DEPENDENCY_CONFLICT",
-        "description": "DSM 複合安裝請求因執行中的依賴套件而拒絕。",
-        "suggestion": "請先停止列出的依賴套件再重試升級。"
+        "description": "DSM rejected the compound install request because of running dependent packages.",
+        "suggestion": "Stop the listed dependent packages, then retry the upgrade."
     },
     "DSM_COMPOUND_FAILED": {
         "code": "DSM_COMPOUND_FAILED",
-        "description": "DSM 複合安裝請求的子步驟失敗。",
-        "suggestion": "請檢查回應中的 api、method、errorCode 與 DSM Package Center 日誌後重試。"
+        "description": "A substep of the DSM compound install request failed.",
+        "suggestion": "Check the api, method and errorCode in the response and the DSM Package Center log, then retry."
     },
     "DSM_REQUEST_FAILED": {
         "code": "DSM_REQUEST_FAILED",
-        "description": "DSM SYNO.Entry.Request 複合請求失敗。",
-        "suggestion": "請檢查 DSM session、請求參數與 Package Center 日誌後重試。"
+        "description": "The DSM SYNO.Entry.Request compound request failed.",
+        "suggestion": "Check the DSM session, request parameters and Package Center log, then retry."
     },
     "NOT_INSTALLED": {
         "code": "NOT_INSTALLED",
-        "description": "套件尚未在目標 NAS 上安裝部署。",
-        "suggestion": "請先執行 synopkgland deploy --host <nas> 安裝套件。"
+        "description": "The package is not installed on the target NAS yet.",
+        "suggestion": "Run synopkgland deploy --host <nas> to install the package first."
     },
     "STANDALONE_MANIFEST_MISSING": {
         "code": "STANDALONE_MANIFEST_MISSING",
-        "description": "找不到 dsm-package.yaml。",
-        "suggestion": "請在專案根目錄執行，或以 synopkgland init -t native-go 建立專案。"
+        "description": "dsm-package.yaml was not found.",
+        "suggestion": "Run from the project root, or create a project with synopkgland init -t native-go."
     },
     "STANDALONE_MANIFEST_YAML": {
         "code": "STANDALONE_MANIFEST_YAML",
-        "description": "dsm-package.yaml 不是合法的 YAML 物件。",
-        "suggestion": "請修正 dsm-package.yaml 的 YAML 語法。"
+        "description": "dsm-package.yaml is not a valid YAML object.",
+        "suggestion": "Fix the YAML syntax in dsm-package.yaml."
     },
     "STANDALONE_FIELD_UNKNOWN": {
         "code": "STANDALONE_FIELD_UNKNOWN",
-        "description": "dsm-package.yaml 含有不支援的欄位。",
-        "suggestion": "請移除該欄位；Standalone Package 不接受自訂 lifecycle scripts 或 DSM conf。"
+        "description": "dsm-package.yaml contains an unsupported field.",
+        "suggestion": "Remove the field; a Standalone Package does not accept custom lifecycle scripts or DSM conf."
     },
     "STANDALONE_SCHEMA_INVALID": {
         "code": "STANDALONE_SCHEMA_INVALID",
-        "description": "dsm-package.yaml 的 schema 版本不受支援。",
-        "suggestion": "請將 schema 設為 2，改用 backend.kind 與 capabilities。"
+        "description": "The schema version in dsm-package.yaml is not supported.",
+        "suggestion": "Set schema to 2 and use backend.kind and capabilities."
     },
     "STANDALONE_ROOT_OPS_MISSING": {
         "code": "STANDALONE_ROOT_OPS_MISSING",
-        "description": "capabilities.rootOps: true 但沒有任何 root 操作。",
-        "suggestion": "請在 root/ 放至少一個 <名稱>.sh，或改為 省略 capabilities.rootOps。"
+        "description": "capabilities.rootOps: true is set but there are no root operations.",
+        "suggestion": "Put at least one <name>.sh in root/, or drop capabilities.rootOps."
     },
     "STANDALONE_DAEMON_INVALID": {
         "code": "STANDALONE_DAEMON_INVALID",
-        "description": "套件 daemon 的宣告不符合固定 argv、環境與生命週期契約。",
-        "suggestion": "核對 daemon.exec、各架構 targets、args、env、uninstall_args 與整數秒 timeouts；移除 shell、user 與自訂 conf。"
+        "description": "The package daemon declaration does not match the fixed argv, environment and lifecycle contract.",
+        "suggestion": "Check daemon.exec, the per-architecture targets, args, env, uninstall_args and integer-second timeouts; remove shell, user and custom conf."
     },
     "UNINSTALL_INVALID": {
         "code": "UNINSTALL_INVALID",
-        "description": "uninstall 的宣告不符合固定 exec、argv、環境與逾時契約。",
-        "suggestion": "核對 uninstall.purge 的 exec（套件內、不在 executor/ 或 root/）、args、env（不可用 SYNOPKGLAND_*）與 2–120 秒 timeout，以及 state.items 的唯一 key。"
+        "description": "The uninstall declaration does not match the fixed exec, argv, environment and timeout contract.",
+        "suggestion": "Check uninstall.purge's exec (inside the package, not in executor/ or root/), args, env (SYNOPKGLAND_* not allowed) and 2-120 second timeout, and the unique keys of state.items."
     },
     "UNINSTALL_STATE_REQUIRES_PURGE": {
         "code": "UNINSTALL_STATE_REQUIRES_PURGE",
-        "description": "uninstall.state 沒有可刪除狀態的 App 卸載 hook。",
-        "suggestion": "加上 uninstall.purge，由 App 在 SYNOPKGLAND_DELETE_STATE=1 時刪除所列狀態；或移除 uninstall.state。"
+        "description": "uninstall.state has no App uninstall hook that could delete the state.",
+        "suggestion": "Add uninstall.purge so the App deletes the listed state when SYNOPKGLAND_DELETE_STATE=1, or remove uninstall.state."
     },
     "UNINSTALL_STATE_TEXT_MISSING": {
         "code": "UNINSTALL_STATE_TEXT_MISSING",
-        "description": "卸載精靈無法列出 uninstall.state 項目的文字。",
-        "suggestion": "在 i18n.messages 的 en.json（與其他語言）加入 uninstall.state.<key>。"
+        "description": "The uninstall wizard cannot list the text of the uninstall.state items.",
+        "suggestion": "Add uninstall.state.<key> to i18n.messages en.json (and the other languages)."
     },
     "UNINSTALL_ROOT_REQUIRES_ROOT_OPS": {
         "code": "UNINSTALL_ROOT_REQUIRES_ROOT_OPS",
-        "description": "uninstall.purge.root 需要管理員核准的 root 操作。",
-        "suggestion": "宣告 capabilities.rootOps: true 並提供 root/<名稱>.sh，或移除 uninstall.purge.root。"
+        "description": "uninstall.purge.root needs administrator-approved root operations.",
+        "suggestion": "Declare capabilities.rootOps: true and provide root/<name>.sh, or remove uninstall.purge.root."
     },
     "UNINSTALL_ROOT_OP_MISSING": {
         "code": "UNINSTALL_ROOT_OP_MISSING",
-        "description": "uninstall.purge.root 指向不存在的 root 操作。",
-        "suggestion": "新增 root/<名稱>.sh，或把 uninstall.purge.root 改成既有的 root 操作名稱。"
+        "description": "uninstall.purge.root points at a root operation that does not exist.",
+        "suggestion": "Add root/<name>.sh, or change uninstall.purge.root to an existing root operation name."
     },
     "UNINSTALL_EXEC_MISSING": {
         "code": "UNINSTALL_EXEC_MISSING",
-        "description": "uninstall.purge.exec 不是建置後套件內可執行的一般檔案。",
-        "suggestion": "指向套件內的執行檔，例如 ui/cgi/api.cgi、background/worker 或 daemon/payload/ 下具執行權限的檔案。"
+        "description": "uninstall.purge.exec is not a regular executable file inside the built package.",
+        "suggestion": "Point at an executable in the package, for example ui/cgi/api.cgi, background/worker, or an executable file under daemon/payload/."
     },
     "UNINSTALL_EXEC_UNSAFE": {
         "code": "UNINSTALL_EXEC_UNSAFE",
-        "description": "uninstall.purge.exec 是嘗試取得 root 的 shell script。",
-        "suggestion": "hook 一律以套件帳號執行；需要 root 的清理請放在 root/<名稱>.sh 並以 uninstall.purge.root 宣告。"
+        "description": "uninstall.purge.exec is a shell script that tries to gain root.",
+        "suggestion": "Hooks always run as the package account; put cleanup that needs root in root/<name>.sh and declare it with uninstall.purge.root."
     },
     "STANDALONE_DAEMON_BUILD_FAILED": {
         "code": "STANDALONE_DAEMON_BUILD_FAILED",
-        "description": "無法建置套件 daemon 的 Go supervisor。",
-        "suggestion": "安裝 Go 1.21 以上（建置固定使用 go1.26.9，離線時請先備妥）並檢查 compiler stderr；NAS 不需要 Go toolchain。"
+        "description": "The package daemon's Go supervisor could not be built.",
+        "suggestion": "Install Go 1.21 or later (builds pin go1.26.9 and need it offline) and check the compiler stderr; the NAS does not need a Go toolchain."
     },
     "STANDALONE_DAEMON_PAYLOAD_INVALID": {
         "code": "STANDALONE_DAEMON_PAYLOAD_INVALID",
-        "description": "daemon payload 不是專案內的有界、無連結目錄。",
-        "suggestion": "重建各架構 bundle；移除 symlink、特殊檔與 setid，並將大小限制在 512 MiB。"
+        "description": "The daemon payload is not a bounded, link-free directory inside the project.",
+        "suggestion": "Rebuild the per-architecture bundles; remove symlinks, special files and setid bits, and keep the size under 512 MiB."
     },
     "STANDALONE_DAEMON_ARTIFACT_REQUIRED": {
         "code": "STANDALONE_DAEMON_ARTIFACT_REQUIRED",
-        "description": "組裝 daemon SPK 時缺少已建置的 supervisor。",
-        "suggestion": "透過 synopkgland build 建置完整產物，不直接呼叫缺少 controller 的 assembler。"
+        "description": "The built supervisor is missing while assembling the daemon SPK.",
+        "suggestion": "Build the complete artifacts with synopkgland build; do not call the assembler directly without the controller."
     },
     "STANDALONE_SHARED_FOLDER_INVALID": {
         "code": "STANDALONE_SHARED_FOLDER_INVALID",
-        "description": "dsm-package.yaml 的 install.sharedFolder 宣告不合法。",
-        "suggestion": "寫 install: { sharedFolder: { mode: select|create, key: <小寫英數與底線>, permission: ro|rw } }；create 需另加 name（DSM 共用資料夾名稱），select 不可有 name。"
+        "description": "The install.sharedFolder declaration in dsm-package.yaml is invalid.",
+        "suggestion": "Write install: { sharedFolder: { mode: select|create, key: <lowercase alphanumeric and underscore>, permission: ro|rw } }; create also needs name (the DSM shared folder name) and select must not have one."
     },
     "STANDALONE_BACKGROUND_INVALID": {
         "code": "STANDALONE_BACKGROUND_INVALID",
-        "description": "套件背景工作的宣告不符合固定 worker 契約。",
-        "suggestion": "只寫 capabilities.jobs: true 或 { worker: sha256-v1 }，使用 backend.kind: go，且不要與 daemon 或 integration 並用；背景程序固定以套件帳號執行。"
+        "description": "The package background job declaration does not match the fixed worker contract.",
+        "suggestion": "Write only capabilities.jobs: true or { worker: sha256-v1 }, use backend.kind: go, and do not combine it with daemon or integration; background processes always run as the package account."
     },
     "STANDALONE_BACKGROUND_BUILD_FAILED": {
         "code": "STANDALONE_BACKGROUND_BUILD_FAILED",
-        "description": "無法建置套件的背景 worker。",
-        "suggestion": "安裝 Go 1.25 以上，確認 backend 含 cmd/background-worker（可用 synopkgland init -t native-go --with jobs 建立），並檢查 compiler stderr。"
+        "description": "The package background worker could not be built.",
+        "suggestion": "Install Go 1.25 or later, confirm the backend has cmd/background-worker (create it with synopkgland init -t native-go --with jobs), and check the compiler stderr."
     },
     "STANDALONE_BACKGROUND_ARTIFACT_REQUIRED": {
         "code": "STANDALONE_BACKGROUND_ARTIFACT_REQUIRED",
-        "description": "組裝背景工作 SPK 時缺少已建置的 worker。",
-        "suggestion": "透過 synopkgland build 建置完整產物，不直接呼叫缺少 worker 的 assembler。"
+        "description": "The built worker is missing while assembling the background job SPK.",
+        "suggestion": "Build the complete artifacts with synopkgland build; do not call the assembler directly without the worker."
     },
     "STANDALONE_ROOT_OP_INVALID": {
         "code": "STANDALONE_ROOT_OP_INVALID",
-        "description": "root/ 內有不合法的 root 操作檔案。",
-        "suggestion": "每個檔案必須是 root/<小寫名稱>.sh 一般檔案、以 #!/bin/sh 開頭、16 KiB 以內。"
+        "description": "root/ contains an invalid root operation file.",
+        "suggestion": "A script must be a regular root/<lowercase name>.sh starting with #!/bin/sh and under 16 KiB; a binary must be root/<arch>/<lowercase name>, an ELF for that architecture, under 64 MiB, and must not share a script's name."
+    },
+    "STANDALONE_ROOT_PROGRAMS_INVALID": {
+        "code": "STANDALONE_ROOT_PROGRAMS_INVALID",
+        "description": "The root settings in dsm-package.yaml are invalid, or the executor does not accept them.",
+        "suggestion": "root accepts only programs (<name>: {kind, schema, run, job} matching root/<name>.sh or root/<arch>/<name>), stop (a program in root/) and state: true, and requires capabilities.rootOps: true."
     },
     "STANDALONE_ROOT_OPS_UNUSED": {
         "code": "STANDALONE_ROOT_OPS_UNUSED",
-        "description": "專案有 root/ 資料夾，但 capabilities.rootOps 未啟用。",
-        "suggestion": "要使用 root 操作請設 capabilities.rootOps: true；不需要就刪除 root/。"
+        "description": "The project has a root/ directory but capabilities.rootOps is not enabled.",
+        "suggestion": "Set capabilities.rootOps: true to use root operations, or delete root/."
     },
     "STANDALONE_PACKAGE_INVALID": {
         "code": "STANDALONE_PACKAGE_INVALID",
-        "description": "package 名稱不合法。",
-        "suggestion": "請使用英文字母開頭、只含英數字的 2–64 字名稱，例如 PhotoTagger。"
+        "description": "The package name is invalid.",
+        "suggestion": "Use a 2-64 character name that starts with a letter and contains only alphanumerics, for example PhotoTagger."
     },
     "STANDALONE_VERSION_INVALID": {
         "code": "STANDALONE_VERSION_INVALID",
-        "description": "version 不是數字版本。",
-        "suggestion": "請使用 1.2.0 這類版本，build 號碼另外填在 build。"
+        "description": "version is not a numeric version.",
+        "suggestion": "Use a version such as 1.2.0 and put the build number in build."
     },
     "STANDALONE_BUILD_INVALID": {
         "code": "STANDALONE_BUILD_INVALID",
-        "description": "build 不是 1–9999 的整數。",
-        "suggestion": "請將 build 設為 1–9999 的整數，每次發出 SPK 時遞增。"
+        "description": "build is not an integer from 1 to 9999.",
+        "suggestion": "Set build to an integer from 1 to 9999 and increment it for each SPK release."
     },
     "STANDALONE_OS_MIN_VER_INVALID": {
         "code": "STANDALONE_OS_MIN_VER_INVALID",
-        "description": "os_min_ver 格式不正確。",
-        "suggestion": "請使用 <major>.<minor>-<build>，例如 7.2-64570。"
+        "description": "os_min_ver has the wrong format.",
+        "suggestion": "Use <major>.<minor>-<build>, for example 7.2-64570."
     },
     "STANDALONE_TEXT_INVALID": {
         "code": "STANDALONE_TEXT_INVALID",
-        "description": "顯示文字欄位不合法。",
-        "suggestion": "請使用單行、非空且不含 \" 或 \\ 的文字。"
+        "description": "A display text field is invalid.",
+        "suggestion": "Use single-line, non-empty text without \" or \\."
     },
     "STANDALONE_ARCHES_INVALID": {
         "code": "STANDALONE_ARCHES_INVALID",
-        "description": "arches 不合法。",
-        "suggestion": "請列出不重複的 x86_64、aarch64 或 armv7，至少一個。"
+        "description": "arches is invalid.",
+        "suggestion": "List one or more unique values from x86_64, aarch64 or armv7."
     },
     "STANDALONE_ARCH_NOT_DECLARED": {
         "code": "STANDALONE_ARCH_NOT_DECLARED",
-        "description": "要求建置的架構不在 arches 內。",
-        "suggestion": "請把該架構加入 dsm-package.yaml 的 arches，或改用已宣告的 --arch。"
+        "description": "The requested build architecture is not in arches.",
+        "suggestion": "Add the architecture to arches in dsm-package.yaml, or use a declared --arch."
     },
     "STANDALONE_BACKEND_INVALID": {
         "code": "STANDALONE_BACKEND_INVALID",
-        "description": "backend 設定不合法。",
-        "suggestion": "backend 需恰好包含 go（dir 與 ./ 開頭的 main）或 binary（以架構為 key）其中之一。"
+        "description": "The backend configuration is invalid.",
+        "suggestion": "backend must contain exactly one of go (dir and a ./ main) or binary (keyed by architecture)."
     },
     "STANDALONE_BINARY_ARCH_MISSING": {
         "code": "STANDALONE_BINARY_ARCH_MISSING",
-        "description": "arches 宣告的架構沒有對應的 backend.files 執行檔。",
-        "suggestion": "請在 backend.files 補上該架構的執行檔，或從 arches 移除它。"
+        "description": "An architecture declared in arches has no backend.files executable.",
+        "suggestion": "Add the executable for that architecture to backend.files, or remove it from arches."
     },
     "STANDALONE_BINARY_MISSING": {
         "code": "STANDALONE_BINARY_MISSING",
-        "description": "找不到 backend 執行檔。",
-        "suggestion": "請確認 backend.files 指向的檔案存在。"
+        "description": "The backend executable was not found.",
+        "suggestion": "Confirm the file backend.files points at exists."
     },
     "STANDALONE_BINARY_NOT_REGULAR": {
         "code": "STANDALONE_BINARY_NOT_REGULAR",
-        "description": "backend 執行檔不是一般檔案。",
-        "suggestion": "請改用實際檔案，不可是 symlink、目錄或特殊檔案。"
+        "description": "The backend executable is not a regular file.",
+        "suggestion": "Use a real file; no symlinks, directories or special files."
     },
     "STANDALONE_BINARY_TOO_LARGE": {
         "code": "STANDALONE_BINARY_TOO_LARGE",
-        "description": "backend 執行檔超過 256 MiB。",
-        "suggestion": "請縮小執行檔（例如 -ldflags \"-s -w\"）。"
+        "description": "The backend executable exceeds 256 MiB.",
+        "suggestion": "Shrink the executable (for example -ldflags \"-s -w\")."
     },
     "STANDALONE_BINARY_NOT_ELF": {
         "code": "STANDALONE_BINARY_NOT_ELF",
-        "description": "backend 執行檔不是該架構需要的 little-endian Linux ELF（x86_64、aarch64 為 64-bit，armv7 為 32-bit）。",
-        "suggestion": "請提供為 Linux 編譯的 x86_64、aarch64 或 armv7 執行檔。"
+        "description": "The backend executable is not the little-endian Linux ELF the architecture needs (64-bit for x86_64 and aarch64, 32-bit for armv7).",
+        "suggestion": "Provide an x86_64, aarch64 or armv7 executable built for Linux."
     },
     "STANDALONE_BINARY_ARCH_MISMATCH": {
         "code": "STANDALONE_BINARY_ARCH_MISMATCH",
-        "description": "backend 執行檔的 CPU 架構與目標不符。",
-        "suggestion": "請為該架構重新編譯，或修正 backend.files 的對應。"
+        "description": "The backend executable's CPU architecture does not match the target.",
+        "suggestion": "Rebuild for that architecture, or fix the backend.files mapping."
     },
     "STANDALONE_BINARY_DYNAMIC": {
         "code": "STANDALONE_BINARY_DYNAMIC",
-        "description": "backend 執行檔是動態連結。",
-        "suggestion": "請靜態連結（Go 用 CGO_ENABLED=0），DSM 各機型的 libc 版本不同。"
+        "description": "The backend executable is dynamically linked.",
+        "suggestion": "Link statically (set CGO_ENABLED=0 for Go); the libc version differs across DSM models."
     },
     "STANDALONE_PATH_INVALID": {
         "code": "STANDALONE_PATH_INVALID",
-        "description": "路徑欄位不是專案內的相對路徑。",
-        "suggestion": "請使用相對於專案根目錄的路徑。"
+        "description": "The path field is not a relative path inside the project.",
+        "suggestion": "Use a path relative to the project root."
     },
     "STANDALONE_PATH_OUTSIDE_PROJECT": {
         "code": "STANDALONE_PATH_OUTSIDE_PROJECT",
-        "description": "路徑指向專案目錄之外。",
-        "suggestion": "請把檔案放在專案目錄內（symlink 解析後也必須在專案內）。"
+        "description": "The path points outside the project directory.",
+        "suggestion": "Keep the files inside the project directory (also after resolving symlinks)."
     },
     "STANDALONE_UI_INVALID": {
         "code": "STANDALONE_UI_INVALID",
-        "description": "ui 設定不合法。",
-        "suggestion": "請提供 ui.dir。"
+        "description": "The ui configuration is invalid.",
+        "suggestion": "Provide ui.dir."
     },
     "STANDALONE_UI_BUILD_INVALID": {
         "code": "STANDALONE_UI_BUILD_INVALID",
-        "description": "ui.build 設定不合法。",
-        "suggestion": "ui.build.command 必須是 argv 字串陣列（不經 shell），例如 [npm, run, build]。"
+        "description": "The ui.build configuration is invalid.",
+        "suggestion": "ui.build.command must be an argv string array (not going through a shell), for example [npm, run, build]."
+    },
+    "STANDALONE_TIMEOUT_UNSUPPORTED": {
+        "code": "STANDALONE_TIMEOUT_UNSUPPORTED",
+        "description": "backend.timeout_seconds needs a Go main that reads the requestTimeout the build passes.",
+        "suggestion": "Declare var requestTimeout = \"\" in main.go and pass its seconds to api.WithRequestDeadline(handler, api.Timeout(...)), or remove timeout_seconds."
+    },
+    "STANDALONE_UI_WINDOW_INVALID": {
+        "code": "STANDALONE_UI_WINDOW_INVALID",
+        "description": "ui.window does not give a valid DSM window size.",
+        "suggestion": "Give width and height as whole numbers from 320 to 3840 and 240 to 2160, keep minWidth and minHeight (700 and 420 by default) no larger than them, and write only the fields you change."
     },
     "STANDALONE_UI_BUILD_FAILED": {
         "code": "STANDALONE_UI_BUILD_FAILED",
-        "description": "UI build 指令失敗。",
-        "suggestion": "請在 ui.build.cwd 安裝 UI 依賴（有 package-lock.json 用 npm ci，否則 npm install），再執行 UI build 指令並修正錯誤。"
+        "description": "The UI build command failed.",
+        "suggestion": "Install the UI dependencies in ui.build.cwd (npm ci when package-lock.json exists, otherwise npm install), then run the UI build command and fix the errors."
     },
     "STANDALONE_UI_ENTRY_MISSING": {
         "code": "STANDALONE_UI_ENTRY_MISSING",
-        "description": "UI 目錄缺少 app.js 或 app.css。",
-        "suggestion": "請讓 ui.dir（或 UI build 輸出）包含 app.js 與 app.css。"
+        "description": "The UI directory is missing app.js or app.css.",
+        "suggestion": "Make ui.dir (or the UI build output) contain app.js and app.css."
     },
     "STANDALONE_UI_SYMLINK": {
         "code": "STANDALONE_UI_SYMLINK",
-        "description": "UI 目錄含有 symlink。",
-        "suggestion": "請以實際檔案取代 symlink。"
+        "description": "The UI directory contains a symlink.",
+        "suggestion": "Replace the symlink with a real file."
     },
     "STANDALONE_UI_SPECIAL_FILE": {
         "code": "STANDALONE_UI_SPECIAL_FILE",
-        "description": "UI 目錄含有特殊檔案。",
-        "suggestion": "UI 目錄只能有一般檔案與目錄。"
+        "description": "The UI directory contains a special file.",
+        "suggestion": "The UI directory may contain only regular files and directories."
     },
     "STANDALONE_UI_TOO_LARGE": {
         "code": "STANDALONE_UI_TOO_LARGE",
-        "description": "UI 檔案總大小超過 64 MiB。",
-        "suggestion": "請縮小 UI 資產。"
+        "description": "The total UI file size exceeds 64 MiB.",
+        "suggestion": "Shrink the UI assets."
     },
     "STANDALONE_GO_MISSING": {
         "code": "STANDALONE_GO_MISSING",
-        "description": "找不到 go 指令。",
-        "suggestion": "請安裝 Go 1.25 以上版本（https://go.dev/dl/），或改用 backend.files 打包既有執行檔。"
+        "description": "The go command was not found.",
+        "suggestion": "Install Go 1.25 or later (https://go.dev/dl/), or package an existing executable with backend.files."
     },
     "STANDALONE_GO_BUILD_FAILED": {
         "code": "STANDALONE_GO_BUILD_FAILED",
-        "description": "go build 失敗。",
-        "suggestion": "請在 backend 目錄執行 go build ./... 並修正錯誤。取不到 github.com/synopackageland/syno-pkg-land-sdk 時，設定 GOPRIVATE=github.com/synopackageland/* 並讓 git 能以憑證讀 github.com。"
-    },
-    "STANDALONE_RUST_BUILD_FAILED": {
-        "code": "STANDALONE_RUST_BUILD_FAILED",
-        "description": "cargo build 失敗。",
-        "suggestion": "請在 backend 目錄執行 cargo build --release --locked 並修正錯誤；Cargo.lock 必須已提交。取不到 github.com/synopackageland/syno-pkg-land-sdk 時，設定 CARGO_NET_GIT_FETCH_WITH_CLI=true 並讓 git 能以憑證讀 github.com。"
+        "description": "go build failed.",
+        "suggestion": "Run go build ./... in the backend directory and fix the errors. If github.com/synopackageland/syno-pkg-land-sdk is unreachable, set GOPRIVATE=github.com/synopackageland/* and make sure git can read github.com with credentials."
     },
     "STANDALONE_PORTAL_INVALID": {
         "code": "STANDALONE_PORTAL_INVALID",
-        "description": "dsm-package.yaml 的 portal 格式或 alias 不正確。",
-        "suggestion": "請使用 portal: {} 或 portal: { alias: my-app }；alias 為 1–64 個小寫英數字或 -，且不是 DSM 保留路徑。"
+        "description": "The portal format or alias in dsm-package.yaml is invalid.",
+        "suggestion": "Use portal: {} or portal: { alias: my-app }; alias is 1-64 lowercase alphanumerics or -, and not a DSM reserved path."
     },
     "STANDALONE_PORTAL_REQUIRES_EXECUTOR": {
         "code": "STANDALONE_PORTAL_REQUIRES_EXECUTOR",
-        "description": "沒有 executor（capabilities.rootOps 或 delegate）的 App 宣告了 portal。",
-        "suggestion": "登入入口別名在解除安裝後要 root 才能讓 nginx 停止提供，而無升權 App 任何階段都不使用 root。請加 capabilities.rootOps 或 delegate（executor 層級），或移除 portal，改由管理員在 DSM 手動設定反向代理。"
+        "description": "An App without an executor (capabilities.rootOps or delegate) declares portal.",
+        "suggestion": "Removing the sign-in alias after uninstall needs root so nginx stops serving it, but an App without escalation uses no root at any stage. Add capabilities.rootOps or delegate (executor level), or remove portal and let an administrator configure a reverse proxy in DSM."
     },
     "STANDALONE_I18N_INVALID": {
         "code": "STANDALONE_I18N_INVALID",
-        "description": "dsm-package.yaml 的 i18n 設定不合法。",
-        "suggestion": "i18n 只接受 messages、glossary 與 info；info 以 zh-TW、ja 等支援語言為 key（英文寫在頂層）。"
+        "description": "The i18n configuration in dsm-package.yaml is invalid.",
+        "suggestion": "i18n accepts only messages, glossary and info; info is keyed by a supported language such as zh-TW or ja (English goes at the top level)."
     },
     "STANDALONE_I18N_MESSAGES_MISSING": {
         "code": "STANDALONE_I18N_MESSAGES_MISSING",
-        "description": "i18n.messages 目錄缺少 en.json。",
-        "suggestion": "請加入 en.json；它是所有語言的後備文字與 key 清單。"
+        "description": "The i18n.messages directory is missing en.json.",
+        "suggestion": "Add en.json; it is the fallback text and key list for every language."
     },
     "STANDALONE_I18N_LOCALE_UNSUPPORTED": {
         "code": "STANDALONE_I18N_LOCALE_UNSUPPORTED",
-        "description": "訊息檔的語言不在支援的九種語言內。",
-        "suggestion": "請使用 en、zh-TW、zh-CN、ja、ko、de、fr、es、it；其他 DSM 語言會顯示英文。"
+        "description": "A message file's language is not one of the nine supported locales.",
+        "suggestion": "Use en, zh-TW, zh-CN, ja, ko, de, fr, es, it; every other DSM language shows English."
     },
     "STANDALONE_I18N_CATALOG_INVALID": {
         "code": "STANDALONE_I18N_CATALOG_INVALID",
-        "description": "訊息檔不是扁平的 key → 文字 JSON 物件。",
-        "suggestion": "請改成 { \"greeting.save\": \"Save\" } 這種格式。"
+        "description": "A message file is not a flat key -> text JSON object.",
+        "suggestion": "Use a format like { \"greeting.save\": \"Save\" }."
     },
     "STANDALONE_I18N_KEYS_MISMATCH": {
         "code": "STANDALONE_I18N_KEYS_MISMATCH",
-        "description": "某語言的訊息 key 與 en.json 不同。",
-        "suggestion": "請讓每個語言檔都恰好有 en.json 的所有 key。"
+        "description": "One language's message keys differ from en.json.",
+        "suggestion": "Give every language file exactly the keys of en.json."
     },
     "STANDALONE_I18N_PLACEHOLDER_MISMATCH": {
         "code": "STANDALONE_I18N_PLACEHOLDER_MISMATCH",
-        "description": "翻譯少了或多了 {placeholder}。",
-        "suggestion": "請保留 en.json 文字中的每個 {name} 佔位符。"
+        "description": "A translation has a missing or extra {placeholder}.",
+        "suggestion": "Keep every {name} placeholder from the en.json text."
     },
     "STANDALONE_I18N_GLOSSARY_INVALID": {
         "code": "STANDALONE_I18N_GLOSSARY_INVALID",
-        "description": "用語表格式錯誤，或指向不存在的訊息 key。",
-        "suggestion": "請修正 glossary.json 的 terms（id、text、keys）。"
+        "description": "The glossary format is wrong, or it points at a message key that does not exist.",
+        "suggestion": "Fix the terms (id, text, keys) in glossary.json."
     },
     "STANDALONE_I18N_GLOSSARY_MISMATCH": {
         "code": "STANDALONE_I18N_GLOSSARY_MISMATCH",
-        "description": "訊息沒有使用用語表中的 DSM 介面用語。",
-        "suggestion": "請改用 glossary.json 中該語言的用語，與 DSM 介面保持一致。"
+        "description": "A message does not use the DSM interface term from the glossary.",
+        "suggestion": "Use that language's term from glossary.json to stay consistent with the DSM interface."
     },
     "DEPLOY_VERSION_INVALID": {
         "code": "DEPLOY_VERSION_INVALID",
-        "description": "套件版本無效或低於已安裝版本。",
-        "suggestion": "設定更高的有效 version/build 再部署。"
+        "description": "The package version is invalid or lower than the installed version.",
+        "suggestion": "Set a higher valid version/build and deploy again."
     }
 };
 for (const [code, description, suggestion] of [
-    ["CAPABILITY_INVALID", "能力宣告不合法。", "使用 files: session、jobs: true 或 {worker: sha256-v1}、identity: standalone、rootOps: true。"],
-    ["CAPABILITY_UNSUPPORTED", "這個 runtime 不支援所選能力。", "files、jobs、identity 需要 backend.kind: go；compose 不支援原生能力。"],
-    ["CAPABILITY_COMBINATION_INVALID", "能力與 runtime 或 UI 組合不合法。", "daemon 不能搭配 capabilities.jobs；identity/login 需要 vue UI（--ui vue）。"],
-    ["ADD_FILE_CONFLICT", "既有檔案與 SDK overlay 衝突。", "先移動或合併列出的衝突檔案再執行 add；CLI 不覆寫不同內容。"],
+    ["CAPABILITY_INVALID", "The capability declaration is invalid.", "Use files: session, jobs: true or {worker: sha256-v1}, identity: standalone, rootOps: true."],
+    ["CAPABILITY_UNSUPPORTED", "This runtime does not support the chosen capability.", "files, jobs and identity need backend.kind: go; compose does not support native capabilities."],
+    ["CAPABILITY_COMBINATION_INVALID", "The capability combination with the runtime or UI is invalid.", "daemon cannot combine with capabilities.jobs; identity/login needs a vue UI (--ui vue)."],
+    ["ADD_FILE_CONFLICT", "Existing files conflict with the SDK overlay.", "Move or merge the listed conflicting files before running add; the CLI never overwrites different content."],
 ])
     ERROR_REGISTRY[code] = { code, description, suggestion };
-ERROR_REGISTRY["ADD_LAYOUT_UNSUPPORTED"] = { "code": "ADD_LAYOUT_UNSUPPORTED", "description": "SDK overlay 需要標準 backend 目錄。", "suggestion": "使用 backend.dir: backend，或手動合併 SDK overlay。" };
-ERROR_REGISTRY["MIN_DSM_CONTAINER_FLOOR"] = { "code": "MIN_DSM_CONTAINER_FLOOR", "description": "Compose 最低 DSM 版本過低。", "suggestion": "Compose 需要 DSM 7.2.1-69057 或以上。" };
-ERROR_REGISTRY.STANDALONE_PORTAL_ENTRY_INVALID = { "code": "STANDALONE_PORTAL_ENTRY_INVALID", "description": "os_min_ver 低於 DSM 7.2-64570 時由 executor 註冊 portal，套件名稱或 displayname 不符合它的規則。", "suggestion": "套件名稱只能用英數字，以 . _ - 分隔，最多 64 字；displayname 1–64 個字，不可含控制字元。" };
-ERROR_REGISTRY.STANDALONE_PORTAL_MIN_DSM = { "code": "STANDALONE_PORTAL_MIN_DSM", "description": "宣告 portal 的套件 os_min_ver 低於 DSM 7.1-42661。", "suggestion": "DSM 7.2-64570 以前由 executor 寫入 DSM 的 app.d 註冊入口，這個格式只在 DSM 7.1 起驗證過。把 os_min_ver 提高到 7.1-42661 以上，或移除 portal。" };
-ERROR_REGISTRY["MIN_DSM_INVALID"] = { "code": "MIN_DSM_INVALID", "description": "最低 DSM 版本格式不合法。", "suggestion": "指定 7.x release 或完整 7.x-build。" };
-ERROR_REGISTRY["NOTICE_UNSAFE"] = { "code": "NOTICE_UNSAFE", "description": "授權檔案不符合一般檔案限制。", "suggestion": "移除 symlink、特殊檔與超大授權檔案。" };
-ERROR_REGISTRY["NOTICE_MISSING"] = { "code": "NOTICE_MISSING", "description": "缺少第三方授權資訊。", "suggestion": "重新安裝模板依賴並產生 third-party notices。" };
-ERROR_REGISTRY["PROJECT_NOT_FOUND"] = { "code": "PROJECT_NOT_FOUND", "description": "找不到專案 manifest。", "suggestion": "在專案根目錄執行或使用 --project。" };
-ERROR_REGISTRY["CLI_OPTION_INVALID"] = { "code": "CLI_OPTION_INVALID", "description": "指令選項不合法。", "suggestion": "使用 --help 核對選項與可用 runtime。" };
-ERROR_REGISTRY["CLI_OUTPUT_ARCH_REQUIRED"] = { "code": "CLI_OUTPUT_ARCH_REQUIRED", "description": "輸出單一檔案需要指定架構。", "suggestion": "-o 搭配單一 --arch，或使用 --out-dir。" };
-ERROR_REGISTRY["HOST_REQUIRED"] = { "code": "HOST_REQUIRED", "description": "沒有指定 NAS。", "suggestion": "使用 --host <profile>；deploy 本地檢查可用 --dry-run。" };
-ERROR_REGISTRY["NAS_CREDENTIALS_MISSING"] = { "code": "NAS_CREDENTIALS_MISSING", "description": "找不到 NAS 憑證。", "suggestion": "設定 synoagentcli profile 或 DSM_URL／DSM_PASSWORD。" };
-ERROR_REGISTRY["NATIVE_LAYOUT_SCRIPT_NOT_EXECUTABLE"] = { "code": "NATIVE_LAYOUT_SCRIPT_NOT_EXECUTABLE", "description": "native layout metadata 的 scripts/ 生命週期腳本沒有執行權限（inspect 的 SPK_SCRIPT_NOT_EXECUTABLE）。", "suggestion": "在 layout metadata 目錄對該腳本執行 chmod +x 後重新 build。" };
-ERROR_REGISTRY["NATIVE_TOOLKIT_TAR_UNSUPPORTED"] = { "code": "NATIVE_TOOLKIT_TAR_UNSUPPORTED", "description": "解開 native.toolkits 需要 GNU tar 或 bsdtar，但 PATH 上的 tar 兩者都不是。", "suggestion": "讓 PATH 上的 tar 指向 GNU tar 或 bsdtar（macOS 內建 bsdtar、多數 Linux 是 GNU tar）後重新 build。" };
-ERROR_REGISTRY["SPK_INSPECTION_FAILED"] = { "code": "SPK_INSPECTION_FAILED", "description": "SPK 不符合 DSM 7 套件格式（dsm.errors），或 synopkgland 建置的 SPK 不符合建置合約（findings）。", "suggestion": "依 SPK_* 規則碼與 findings 修正後重新打包；warnings 不影響結果。" };
-ERROR_REGISTRY["IMAGE_PIN_REQUIRED"] = { "code": "IMAGE_PIN_REQUIRED", "description": "映像 digest 尚未固定。", "suggestion": "執行 images pin。" };
-ERROR_REGISTRY["INIT_TEMPLATE_REQUIRED"] = { "code": "INIT_TEMPLATE_REQUIRED", "description": "未指定模板。", "suggestion": "使用 -t native-go、binary 或 compose。" };
-ERROR_REGISTRY["INIT_TEMPLATE_UNKNOWN"] = { "code": "INIT_TEMPLATE_UNKNOWN", "description": "未知模板。", "suggestion": "使用 -t native-go、binary 或 compose。" };
-ERROR_REGISTRY["CLI_ARCH_INVALID"] = { "code": "CLI_ARCH_INVALID", "description": "架構選項不合法。", "suggestion": "使用 x86_64、aarch64 或 armv7（armv7 用於 native-go 與 binary，不用於 Container Manager App）。" };
-ERROR_REGISTRY["CLI_JOBS_INVALID"] = { "code": "CLI_JOBS_INVALID", "description": "--jobs 不是正整數。", "suggestion": "使用 --jobs 1（預設）或更大的整數。" };
-ERROR_REGISTRY["BUILD_NOT_REPRODUCIBLE"] = { "code": "BUILD_NOT_REPRODUCIBLE", "description": "build --verify-reproducible 再建置一次的 SPK 與第一次不同。", "suggestion": "查看列出的 payload 與 metadata 檔案，移除每次建置都會變的內容（時間戳、隨機或絕對路徑、未鎖定的依賴）。" };
-ERROR_REGISTRY["REPRODUCIBLE_INVALID"] = { "code": "REPRODUCIBLE_INVALID", "description": "reproducible 設定格式不對，或列出的 input 不是專案內的檔案。", "suggestion": "使用 reproducible: {inputs: [檔案...], clean: [路徑...]}，路徑相對於專案；{arch} 只能用在 clean。" };
-ERROR_REGISTRY["NATIVE_ARCH_UNDETERMINED"] = { "code": "NATIVE_ARCH_UNDETERMINED", "description": "無法判定 NAS 架構。", "suggestion": "指定 --arch x86_64、aarch64 或 armv7。" };
-ERROR_REGISTRY["DEVELOPMENT_INSTANCE_UNSUPPORTED"] = { "code": "DEVELOPMENT_INSTANCE_UNSUPPORTED", "description": "原生專案不支援 --dev。", "suggestion": "init 時指定不同 package ID。" };
-ERROR_REGISTRY["INIT_OPTIONS_UNSUPPORTED"] = { "code": "INIT_OPTIONS_UNSUPPORTED", "description": "選項不適用於這個模板。", "suggestion": "--from 僅 compose；--ui 僅 native-go。" };
-ERROR_REGISTRY["INIT_TARGET_NOT_EMPTY"] = { "code": "INIT_TARGET_NOT_EMPTY", "description": "init 目錄已有衝突檔案。", "suggestion": "使用空目錄；既有專案新增能力使用 add。" };
-ERROR_REGISTRY["INIT_COMPOSE_INVALID"] = { "code": "INIT_COMPOSE_INVALID", "description": "匯入的 Compose 不合法。", "suggestion": "--from 指向有 services 的 YAML 檔案。" };
-ERROR_REGISTRY["INIT_BINARY_BUILD_FAILED"] = { "code": "INIT_BINARY_BUILD_FAILED", "description": "binary 範例編譯失敗。", "suggestion": "安裝 Go 或提供自己的靜態 CGI ELF。" };
-ERROR_REGISTRY["INIT_SHARED_FOLDER_INVALID"] = { "code": "INIT_SHARED_FOLDER_INVALID", "description": "共用資料夾選項不合法。", "suggestion": "使用 select 或 create；create 加上 --shared-folder-name。" };
-ERROR_REGISTRY["INIT_UI_INVALID"] = { "code": "INIT_UI_INVALID", "description": "UI 選項不合法。", "suggestion": "使用 --ui vue 或 plain。" };
-ERROR_REGISTRY["INIT_PACKAGE_INVALID"] = { "code": "INIT_PACKAGE_INVALID", "description": "套件名稱不合法。", "suggestion": "使用英文字母開頭的 2–64 字英數字名稱。" };
-ERROR_REGISTRY["INIT_DISPLAY_NAME_INVALID"] = { "code": "INIT_DISPLAY_NAME_INVALID", "description": "顯示名稱不合法。", "suggestion": "使用單行且不含引號或反斜線的文字。" };
-ERROR_REGISTRY["STANDALONE_API_PERMISSIONS_CHANGED"] = { "code": "STANDALONE_API_PERMISSIONS_CHANGED", "description": "建置中 API policy 變動。", "suggestion": "固定 permissions.json 後重新 check/build。" };
-ERROR_REGISTRY["STANDALONE_API_PERMISSIONS_INVALID"] = { "code": "STANDALONE_API_PERMISSIONS_INVALID", "description": "API policy 不合法。", "suggestion": "修正 backend/internal/api/permissions.json。" };
-ERROR_REGISTRY["CLI_OPTION_UNKNOWN"] = { "code": "CLI_OPTION_UNKNOWN", "description": "未知 CLI 選項。", "suggestion": "使用 --help 查看目前支援的選項。" };
-ERROR_REGISTRY["CLI_ARGUMENT_MISSING"] = { "code": "CLI_ARGUMENT_MISSING", "description": "缺少指令引數。", "suggestion": "使用 --help 查看必填引數。" };
-ERROR_REGISTRY["CLI_OPTION_MISSING"] = { "code": "CLI_OPTION_MISSING", "description": "缺少必要選項。", "suggestion": "使用 --help 查看必要選項。" };
-ERROR_REGISTRY["CLI_OPTION_ARGUMENT_MISSING"] = { "code": "CLI_OPTION_ARGUMENT_MISSING", "description": "選項缺少值。", "suggestion": "補上選項需要的值。" };
-ERROR_REGISTRY["CLI_COMMAND_UNKNOWN"] = { "code": "CLI_COMMAND_UNKNOWN", "description": "未知指令。", "suggestion": "使用 synopkgland --help 查看指令。" };
-ERROR_REGISTRY["COMMAND_FAILED"] = { "code": "COMMAND_FAILED", "description": "指令執行失敗。", "suggestion": "查看 message 與 stderr，修正問題後重試。" };
-ERROR_REGISTRY["DEPLOY_PLAN_INVALID"] = { "code": "DEPLOY_PLAN_INVALID", "description": "部署計畫與 runtime 不符。", "suggestion": "重新 check 並產生部署計畫。" };
-ERROR_REGISTRY["DEPLOY_ARCH_UNDETERMINED"] = { "code": "DEPLOY_ARCH_UNDETERMINED", "description": "無法判定 NAS 架構。", "suggestion": "使用 --arch x86_64、aarch64 或 armv7。" };
-ERROR_REGISTRY["CONTAINER_ARCH_UNSUPPORTED"] = { "code": "CONTAINER_ARCH_UNSUPPORTED", "description": "Container Manager App 只支援 x86_64 與 aarch64；DSM 不為 armv7 提供 Container Manager。", "suggestion": "改用 --arch x86_64 或 aarch64，或改用 native-go 模板。" };
-ERROR_REGISTRY["DEPLOY_BUILD_OUTPUT_INVALID"] = { "code": "DEPLOY_BUILD_OUTPUT_INVALID", "description": "部署建置輸出數量不符。", "suggestion": "指定單一架構並重新 build。" };
+ERROR_REGISTRY["ADD_LAYOUT_UNSUPPORTED"] = { "code": "ADD_LAYOUT_UNSUPPORTED", "description": "The SDK overlay needs the standard backend directory.", "suggestion": "Use backend.dir: backend, or merge the SDK overlay manually." };
+ERROR_REGISTRY["MIN_DSM_CONTAINER_FLOOR"] = { "code": "MIN_DSM_CONTAINER_FLOOR", "description": "The Compose minimum DSM version is too low.", "suggestion": "Compose needs DSM 7.2.1-69057 or later." };
+ERROR_REGISTRY.STANDALONE_PORTAL_ENTRY_INVALID = { "code": "STANDALONE_PORTAL_ENTRY_INVALID", "description": "When os_min_ver is below DSM 7.2-64570 the executor registers the portal, and the package name or displayname does not match its rules.", "suggestion": "The package name may contain only alphanumerics separated by . _ -, at most 64 characters; displayname is 1-64 characters without control characters." };
+ERROR_REGISTRY.STANDALONE_PORTAL_MIN_DSM = { "code": "STANDALONE_PORTAL_MIN_DSM", "description": "A package that declares portal has os_min_ver below DSM 7.1-42661.", "suggestion": "Before DSM 7.2-64570 the executor writes the entry into DSM's app.d, and that format is only verified from DSM 7.1. Raise os_min_ver to 7.1-42661 or later, or remove portal." };
+ERROR_REGISTRY["MIN_DSM_INVALID"] = { "code": "MIN_DSM_INVALID", "description": "The minimum DSM version format is invalid.", "suggestion": "Specify a 7.x release or a full 7.x-build." };
+ERROR_REGISTRY["NOTICE_UNSAFE"] = { "code": "NOTICE_UNSAFE", "description": "A license file does not meet the regular-file limits.", "suggestion": "Remove symlinks, special files and oversized license files." };
+ERROR_REGISTRY["NOTICE_MISSING"] = { "code": "NOTICE_MISSING", "description": "Third-party license information is missing.", "suggestion": "Reinstall the template dependencies and generate the third-party notices." };
+ERROR_REGISTRY["PROJECT_NOT_FOUND"] = { "code": "PROJECT_NOT_FOUND", "description": "The project manifest was not found.", "suggestion": "Run from the project root or use --project." };
+ERROR_REGISTRY["CLI_OPTION_INVALID"] = { "code": "CLI_OPTION_INVALID", "description": "A command option is invalid.", "suggestion": "Use --help to check the options and the available runtime." };
+ERROR_REGISTRY["CLI_OUTPUT_ARCH_REQUIRED"] = { "code": "CLI_OUTPUT_ARCH_REQUIRED", "description": "Writing a single file needs an architecture.", "suggestion": "Combine -o with a single --arch, or use --out-dir." };
+ERROR_REGISTRY["HOST_REQUIRED"] = { "code": "HOST_REQUIRED", "description": "No NAS was specified.", "suggestion": "Use --host <profile>; for a local deploy check use --dry-run." };
+ERROR_REGISTRY["NAS_CREDENTIALS_MISSING"] = { "code": "NAS_CREDENTIALS_MISSING", "description": "NAS credentials were not found.", "suggestion": "Set a synoagentcli profile or DSM_URL/DSM_PASSWORD." };
+ERROR_REGISTRY["NATIVE_LAYOUT_SCRIPT_NOT_EXECUTABLE"] = { "code": "NATIVE_LAYOUT_SCRIPT_NOT_EXECUTABLE", "description": "A scripts/ lifecycle script in the native layout metadata is not executable (inspect's SPK_SCRIPT_NOT_EXECUTABLE).", "suggestion": "chmod +x the script in the layout metadata directory, then build again." };
+ERROR_REGISTRY["NATIVE_TOOLKIT_TAR_UNSUPPORTED"] = { "code": "NATIVE_TOOLKIT_TAR_UNSUPPORTED", "description": "Extracting native.toolkits needs GNU tar or bsdtar, but the tar on PATH is neither.", "suggestion": "Point the tar on PATH at GNU tar or bsdtar (macOS ships bsdtar, most Linux distros GNU tar), then build again." };
+ERROR_REGISTRY["SPK_INSPECTION_FAILED"] = { "code": "SPK_INSPECTION_FAILED", "description": "The SPK does not match the DSM 7 package format (dsm.errors), or a synopkgland-built SPK does not match the build contract (findings).", "suggestion": "Fix the SPK_* rule codes and findings, then repackage; warnings do not affect the result." };
+ERROR_REGISTRY["IMAGE_PIN_REQUIRED"] = { "code": "IMAGE_PIN_REQUIRED", "description": "The image digest is not pinned.", "suggestion": "Run images pin." };
+ERROR_REGISTRY["INIT_TEMPLATE_REQUIRED"] = { "code": "INIT_TEMPLATE_REQUIRED", "description": "No template was specified.", "suggestion": "Use -t native-go, native-python, native-node, native-rust, binary or compose." };
+ERROR_REGISTRY["INIT_TEMPLATE_UNKNOWN"] = { "code": "INIT_TEMPLATE_UNKNOWN", "description": "Unknown template.", "suggestion": "Use -t native-go, native-python, native-node, native-rust, binary or compose." };
+ERROR_REGISTRY["CLI_ARCH_INVALID"] = { "code": "CLI_ARCH_INVALID", "description": "The architecture option is invalid.", "suggestion": "Use x86_64, aarch64 or armv7 (armv7 is for native-go and binary, not for Container Manager Apps)." };
+ERROR_REGISTRY["CLI_JOBS_INVALID"] = { "code": "CLI_JOBS_INVALID", "description": "--jobs is not a positive integer.", "suggestion": "Use --jobs 1 (the default) or a larger integer." };
+ERROR_REGISTRY["BUILD_NOT_REPRODUCIBLE"] = { "code": "BUILD_NOT_REPRODUCIBLE", "description": "A second SPK built by build --verify-reproducible differs from the first.", "suggestion": "Look at the listed payload and metadata files and remove anything that changes per build (timestamps, random or absolute paths, unpinned dependencies)." };
+ERROR_REGISTRY["REPRODUCIBLE_INVALID"] = { "code": "REPRODUCIBLE_INVALID", "description": "The reproducible configuration is malformed, or a listed input is not a file inside the project.", "suggestion": "Use reproducible: {inputs: [files...], clean: [paths...]} with project-relative paths; {arch} is only allowed in clean." };
+ERROR_REGISTRY["NATIVE_ARCH_UNDETERMINED"] = { "code": "NATIVE_ARCH_UNDETERMINED", "description": "The NAS architecture could not be determined.", "suggestion": "Specify --arch x86_64, aarch64 or armv7." };
+ERROR_REGISTRY["DEVELOPMENT_INSTANCE_UNSUPPORTED"] = { "code": "DEVELOPMENT_INSTANCE_UNSUPPORTED", "description": "A native project does not support --dev.", "suggestion": "Use a different package ID when running init." };
+ERROR_REGISTRY["INIT_OPTIONS_UNSUPPORTED"] = { "code": "INIT_OPTIONS_UNSUPPORTED", "description": "The option does not apply to this template.", "suggestion": "--from is compose only; --ui is native templates only (native-go, native-python, native-node, native-rust)." };
+ERROR_REGISTRY["INIT_TARGET_NOT_EMPTY"] = { "code": "INIT_TARGET_NOT_EMPTY", "description": "The init directory already has conflicting files.", "suggestion": "Use an empty directory; add capabilities to an existing project with add." };
+ERROR_REGISTRY["INIT_COMPOSE_INVALID"] = { "code": "INIT_COMPOSE_INVALID", "description": "The imported Compose is invalid.", "suggestion": "Point --from at a YAML file with services." };
+ERROR_REGISTRY["INIT_BINARY_BUILD_FAILED"] = { "code": "INIT_BINARY_BUILD_FAILED", "description": "The binary example failed to compile.", "suggestion": "Install Go or provide your own static CGI ELF." };
+ERROR_REGISTRY["INIT_SHARED_FOLDER_INVALID"] = { "code": "INIT_SHARED_FOLDER_INVALID", "description": "The shared folder option is invalid.", "suggestion": "Use select or create; add --shared-folder-name with create." };
+ERROR_REGISTRY["INIT_UI_INVALID"] = { "code": "INIT_UI_INVALID", "description": "The UI option is invalid.", "suggestion": "Use --ui vue or plain." };
+ERROR_REGISTRY["INIT_PACKAGE_INVALID"] = { "code": "INIT_PACKAGE_INVALID", "description": "The package name is invalid.", "suggestion": "Use a 2-64 character alphanumeric name that starts with a letter." };
+ERROR_REGISTRY["INIT_DISPLAY_NAME_INVALID"] = { "code": "INIT_DISPLAY_NAME_INVALID", "description": "The display name is invalid.", "suggestion": "Use single-line text without quotes or backslashes." };
+ERROR_REGISTRY["STANDALONE_API_PERMISSIONS_CHANGED"] = { "code": "STANDALONE_API_PERMISSIONS_CHANGED", "description": "The API policy changed during the build.", "suggestion": "Freeze permissions.json, then run check/build again." };
+ERROR_REGISTRY["STANDALONE_API_PERMISSIONS_INVALID"] = { "code": "STANDALONE_API_PERMISSIONS_INVALID", "description": "The API policy is invalid.", "suggestion": "Fix backend/internal/api/permissions.json." };
+ERROR_REGISTRY["CLI_OPTION_UNKNOWN"] = { "code": "CLI_OPTION_UNKNOWN", "description": "Unknown CLI option.", "suggestion": "Use --help to see the currently supported options." };
+ERROR_REGISTRY["CLI_ARGUMENT_MISSING"] = { "code": "CLI_ARGUMENT_MISSING", "description": "A command argument is missing.", "suggestion": "Use --help to see the required arguments." };
+ERROR_REGISTRY["CLI_OPTION_MISSING"] = { "code": "CLI_OPTION_MISSING", "description": "A required option is missing.", "suggestion": "Use --help to see the required options." };
+ERROR_REGISTRY["CLI_OPTION_ARGUMENT_MISSING"] = { "code": "CLI_OPTION_ARGUMENT_MISSING", "description": "An option is missing its value.", "suggestion": "Pass the value the option needs." };
+ERROR_REGISTRY["CLI_COMMAND_UNKNOWN"] = { "code": "CLI_COMMAND_UNKNOWN", "description": "Unknown command.", "suggestion": "Use synopkgland --help to see the commands." };
+ERROR_REGISTRY["COMMAND_FAILED"] = { "code": "COMMAND_FAILED", "description": "The command failed.", "suggestion": "Check the message and stderr, fix the problem and retry." };
+ERROR_REGISTRY["DEPLOY_PLAN_INVALID"] = { "code": "DEPLOY_PLAN_INVALID", "description": "The deploy plan does not match the runtime.", "suggestion": "Run check again and regenerate the deploy plan." };
+ERROR_REGISTRY["DEPLOY_ARCH_UNDETERMINED"] = { "code": "DEPLOY_ARCH_UNDETERMINED", "description": "The NAS architecture could not be determined.", "suggestion": "Use --arch x86_64, aarch64 or armv7." };
+ERROR_REGISTRY["CONTAINER_ARCH_UNSUPPORTED"] = { "code": "CONTAINER_ARCH_UNSUPPORTED", "description": "Container Manager Apps support only x86_64 and aarch64; DSM does not provide Container Manager for armv7.", "suggestion": "Use --arch x86_64 or aarch64, or switch to the native-go template." };
+ERROR_REGISTRY["DEPLOY_BUILD_OUTPUT_INVALID"] = { "code": "DEPLOY_BUILD_OUTPUT_INVALID", "description": "The number of deploy build outputs does not match.", "suggestion": "Specify a single architecture and build again." };
 export function getErrorCode(code) {
     return ERROR_REGISTRY[code];
 }
 for (const [code, description, suggestion] of [
-    ["EXECUTOR_BUILD_FAILED", "從 App 相依的 SDK 版本編譯 executor 或 lifecycle helper 失敗。", "確認已安裝 Go 1.21 以上且可取得 go1.26.9（離線時請先備妥），查看訊息中的編譯器輸出。"],
-    ["EXECUTOR_DIGEST_MISMATCH", "由 SDK 版本建出的 executor 與 CLI 內建的 sha256 表不符，或表中沒有這個 SDK 版本。", "確認 backend/go.mod 的 github.com/synopackageland/syno-pkg-land-sdk 是正式版本且 Go 為 go1.26.9；表中沒有該版本時升級 CLI。"],
-    ["EXECUTOR_DIGEST_UNVERIFIED", "SYNOPKGLAND_SDK_DIR 指向本機 SDK，executor 未對照 sha256 表（警告）。", "只用於開發；要發佈的 SPK 請取消 SYNOPKGLAND_SDK_DIR 後重新 build。"],
-    ["SDK_REQUIRED", "rootOps 或 delegate 需要 SDK，但後端沒有相依 syno-pkg-land-sdk（Go：backend/go.mod；Rust：backend/Cargo.toml）。", "Go 在 backend/go.mod 加入 require github.com/synopackageland/syno-pkg-land-sdk；Rust 在 backend/Cargo.toml 以 git＋tag 相依 syno-pkg-land-sdk；版本與 CLI 同一 minor，或改用 init 產生的後端。"],
-    ["SDK_TAG_REQUIRED", "Rust 後端的 backend/Cargo.lock 沒有以正式 release tag 鎖定唯一一個 syno-pkg-land-sdk（branch、rev、path、registry 或多個版本都不接受）。", "在 backend/Cargo.toml 寫 syno-pkg-land-sdk = { git = \"https://github.com/synopackageland/syno-pkg-land-sdk\", tag = \"vX.Y.Z\" }，執行 cargo update -p syno-pkg-land-sdk 並提交 Cargo.lock。"],
-    ["SDK_VERSION_MISMATCH", "frontend/package.json 的 @synopackageland/sdk 與後端（backend/go.mod 或 backend/Cargo.lock）要求的 SDK 版本不同。", "把兩邊改成同一個版本；file: 相依時，比對的是該目錄 package.json 的 version。"],
-    ["SDK_UNSUPPORTED", "後端（backend/go.mod 或 backend/Cargo.lock）要求的 SDK 不是這個 CLI 的 minor 版本線。", "改用與 SDK 同一 minor 的 CLI，或把 SDK 升到 CLI 支援的版本線（訊息列出）。"],
-    ["SDK_DIR_NOT_READY", "SYNOPKGLAND_SDK_DIR 指向的 SDK checkout 根目錄缺少 go.mod，或 Vue 專案需要的 ts 套件尚未建置（沒有 ts/dist）。", "指向 syno-pkg-land-sdk checkout；Vue 專案先在 $SYNOPKGLAND_SDK_DIR/ts 執行 npm ci && npm run build（npm 安裝 file: 套件時不會替它 build）。"],
-    ["SDK_DOWNLOAD_FAILED", "go mod download 取不到 backend/go.mod 要求的 SDK 版本。", "SDK repo 目前是 private，不能經 proxy.golang.org 取得：設定 GOPRIVATE=github.com/synopackageland/*（例如 go env -w），並讓 git 能以憑證讀 github.com（git ls-remote 可驗證）；再確認版本存在。離線時先在同一台機器 go mod download 一次。"],
-    ["TEMPLATES_MISSING", "找不到 @synopackageland/templates。", "重新安裝 @synopackageland/cli，或把 SYNOPKGLAND_TEMPLATES_DIR 指向 templates checkout。"],
-    ["EXECUTOR_PIN_REQUIRED", "宣告 rootOps 或 delegate 的套件建置時沒有 executor 產物。", "使用 synopkgland build，讓 CLI 編譯並 pin executor；不要直接呼叫低階 SPK API。"],
-    ["EXECUTOR_POLICY", "capabilities.delegate 的 operations 或 scope 不合法，無法產生 executor policy。", "改用 init／add 產生的 delegate 宣告，或依 manifest 參考修正 scope 與 operations。"],
-    ["EXECUTOR_PACKAGE", "pin 進 root task 的套件名稱不合法。", "package 必須以英文字母開頭，只含英數字（2–64 字）。"],
-    ["EXECUTOR_DIGEST", "executor 或 policy 的 sha256 pin 格式不合法。", "重新 build，讓 CLI 重新計算 pin；不要手改 SPK 內的 pin。"],
-    ["EXECUTOR_TASK_PERCENT", "root task 腳本含有 %，DSM 工作排程器無法保存。", "從 root/ 腳本移除 % 字元（例如 date 格式改用其他寫法）。"],
-    ["EXECUTOR_TASK_LENGTH", "root task 腳本超過 DSM 工作排程器的長度上限。", "縮短 root/ 腳本，把邏輯移到套件內的檔案再由腳本呼叫。"],
+    ["EXECUTOR_BUILD_FAILED", "Compiling the executor or lifecycle helper from the App's SDK version failed.", "Confirm Go 1.21 or later is installed and go1.26.9 is available (prepare it offline), and check the compiler output in the message."],
+    ["EXECUTOR_DIGEST_MISMATCH", "The executor built from the SDK version does not match the sha256 table bundled in the CLI, or the table has no entry for this SDK version.", "Confirm github.com/synopackageland/syno-pkg-land-sdk in backend/go.mod is a release version and Go is go1.26.9; upgrade the CLI when the table has no entry for that version."],
+    ["EXECUTOR_DIGEST_UNVERIFIED", "SYNOPKGLAND_SDK_DIR points at a local SDK, so the executor was not checked against the sha256 table (warning).", "Development only; for a publishable SPK unset SYNOPKGLAND_SDK_DIR and build again."],
+    ["SDK_REQUIRED", "Python, Node and Rust Apps, and rootOps or delegate, need the SDK, but the backend does not name an SDK version (Go: backend/go.mod; Python and Node: backend.sdk; Rust: syno-pkg-land-app in Cargo.toml).", "In Go add require github.com/synopackageland/syno-pkg-land-sdk to backend/go.mod; in Python and Node write backend.sdk in dsm-package.yaml; in Rust depend on syno-pkg-land-app by git+tag in the App's Cargo.toml; keep the version on the same minor as the CLI."],
+    ["SDK_TAG_REQUIRED", "The Rust App's Cargo.lock does not pin exactly one syno-pkg-land-app to a release tag (branch, rev, path, registry and multiple versions are all rejected).", "Write syno-pkg-land-app = { git = \"https://github.com/synopackageland/syno-pkg-land-sdk\", tag = \"vX.Y.Z\" } in Cargo.toml, run cargo update -p syno-pkg-land-app and commit Cargo.lock."],
+    ["SDK_VERSION_MISMATCH", "The @synopackageland/sdk in frontend/package.json differs from the SDK version the backend requires (backend/go.mod or backend/Cargo.lock).", "Make both sides the same version; for a file: dependency the comparison uses that directory's package.json version."],
+    ["SDK_UNSUPPORTED", "The SDK the backend requires (backend/go.mod or backend/Cargo.lock) is not on this CLI's minor line.", "Use a CLI on the same minor as the SDK, or raise the SDK to a version line the CLI supports (listed in the message)."],
+    ["SDK_DIR_NOT_READY", "The SDK checkout SYNOPKGLAND_SDK_DIR points at has no go.mod, or the ts package a Vue project needs is not built (no ts/dist).", "Point at a syno-pkg-land-sdk checkout; for a Vue project first run npm ci && npm run build in $SYNOPKGLAND_SDK_DIR/ts (npm does not build file: packages for you)."],
+    ["SDK_DOWNLOAD_FAILED", "go mod download cannot fetch the SDK version backend/go.mod requires.", "The SDK repo is private and cannot go through proxy.golang.org: set GOPRIVATE=github.com/synopackageland/* (for example go env -w) and make sure git can read github.com with credentials (verify with git ls-remote); then confirm the version exists. Offline, run go mod download once on the same machine first."],
+    ["TEMPLATES_MISSING", "@synopackageland/templates was not found.", "Reinstall @synopackageland/cli, or point SYNOPKGLAND_TEMPLATES_DIR at a templates checkout."],
+    ["EXECUTOR_PIN_REQUIRED", "A package that declares rootOps or delegate was built without the executor artifact.", "Use synopkgland build so the CLI compiles and pins the executor; do not call the low-level SPK API directly."],
+    ["EXECUTOR_POLICY", "capabilities.delegate has invalid operations or scope, or a binary root program lacks the file for this architecture, so the executor policy cannot be generated.", "Use the delegate declaration init/add produces and fix scope and operations against the manifest reference; for binary root programs provide root/<arch>/<name> for every arch in arches."],
+    ["EXECUTOR_ROOT_PROGRAMS_UNSUPPORTED", "The root settings in dsm-package.yaml need an executor that supports root program settings, which the App's SDK version lacks.", "Use an SDK with root programs, stop and root_state (executor/stop_step.go), or remove the root settings."],
+    ["EXECUTOR_PACKAGE", "The package name pinned into the root task is invalid.", "package must start with a letter and contain only alphanumerics (2-64 characters)."],
+    ["EXECUTOR_DIGEST", "The sha256 pin for the executor or policy is malformed.", "Build again so the CLI recomputes the pin; do not hand-edit pins inside the SPK."],
+    ["EXECUTOR_TASK_PERCENT", "The root task script contains %, which the DSM task scheduler cannot store.", "Remove % from the root/ scripts (for example rewrite the date format)."],
+    ["EXECUTOR_TASK_LENGTH", "The root task script exceeds the DSM task scheduler's length limit.", "Shorten the root/ scripts; move the logic into a file inside the package and call it from the script."],
+])
+    ERROR_REGISTRY[code] = { code, description, suggestion };
+ERROR_REGISTRY["STANDALONE_ENTRY_INVALID"] = { "code": "STANDALONE_ENTRY_INVALID", "description": "The entry configuration is invalid.", "suggestion": "Set entry to admin-only or app-privilege; app-privilege needs at least one authenticated route." };
+ERROR_REGISTRY["STANDALONE_ENTRY_WIDENED"] = { "code": "STANDALONE_ENTRY_WIDENED", "description": "entry: admin-only conflicts with routes that widen access.", "suggestion": "Change the authenticated or public routes in permissions.json to administrators; to open it to regular users use entry: app-privilege or omit entry." };
+ERROR_REGISTRY["STANDALONE_ENTRY_UNSUPPORTED"] = { "code": "STANDALONE_ENTRY_UNSUPPORTED", "description": "The backend cannot enforce the entry mode.", "suggestion": "Use a Go backend: require github.com/synopackageland/syno-pkg-land-sdk in backend/go.mod and wrap the authenticator with dsm.NewEntryGate in the main.go of backend.main (init defaults to cmd/app/main.go)." };
+ERROR_REGISTRY["DSM_TLS_UNTRUSTED"] = { "code": "DSM_TLS_UNTRUSTED", "description": "The DSM TLS certificate is not trusted by this computer (self-signed, expired or a name mismatch).", "suggestion": "Export the NAS certificate or its CA as PEM and run with NODE_EXTRA_CA_CERTS=<file>; or give DSM a trusted certificate whose name matches the host profile. Do not disable certificate verification." };
+ERROR_REGISTRY["STANDALONE_ICON_INVALID"] = { "code": "STANDALONE_ICON_INVALID", "description": "The icon in dsm-package.yaml is not a usable package icon.", "suggestion": "Set icon to a square PNG inside the project (at least 256x256), or a directory of icon_<size>.png including icon_256.png; omit it to use the SDK default icon." };
+ERROR_REGISTRY["CONTRACT_ICON_INVALID"] = { "code": "CONTRACT_ICON_INVALID", "description": "The icon in synology-app.yaml is not a usable package icon.", "suggestion": "Set icon to a square PNG inside the project (at least 256x256), or a directory of icon_<size>.png including icon_256.png; omit it to use the SDK default icon." };
+ERROR_REGISTRY["CONTRACT_I18N_INVALID"] = { "code": "CONTRACT_I18N_INVALID", "description": "The i18n configuration in synology-app.yaml is invalid.", "suggestion": "i18n accepts only info; info is keyed by a supported language such as zh-TW or ja with single-line displayname / description values without \" or \\ (English goes at the top level)." };
+for (const [code, description, suggestion] of [
+    ["STANDALONE_BRIDGE_APP_IN_UI", "The backend.dir and ui.dir of a Python, Node or Rust App overlap; DSM serves the files under ui/ directly.", "Put the App in a directory outside ui.dir (for example app/); neither may contain the other."],
+    ["STANDALONE_BRIDGE_METHODS_MISMATCH", "The App's methods do not match permissions.json, or use an SDK method name; the runtime refuses to start.", "permissions.json lists only the App's own methods; an App method must not share a name with an SDK method (nas.*, identity.*, portal.status and others)."],
+    ["STANDALONE_RUNTIME_BUILD_FAILED", "Compiling the bridge runtime (bridge/cmd/runtime) from the App's SDK version failed, or the result was not built with go1.26.9.", "Confirm Go 1.21 or later is installed and go1.26.9 is available; that SDK version must contain the bridge runtime; check the compiler output in the message."],
+    ["STANDALONE_BRIDGE_DESCRIBE_FAILED", "There is no backend.methods, so build starts the App to read hello, but the App did not answer a v1 hello.", "Install python3 or node on the build machine and make sure the App starts; or list backend.methods in dsm-package.yaml."],
+    ["STANDALONE_NODE_DEPENDENCY_MISSING", "The Node App's package.json dependencies are not installed in the App's node_modules.", "Run npm ci --omit=dev in the App directory and build again; the CLI places @synopackageland/app, so it does not need installing."],
+    ["STANDALONE_BRIDGE_APP_INVALID", "The App directory contains a symlink or special file, or exceeds 256 MiB.", "Keep only regular files and directories in the App directory; move large data out of it."],
+    ["STANDALONE_RUST_BUILD_FAILED", "The Rust App's cargo zigbuild cross-compile failed, or it produced no binary for backend.entry.", "Install Rust with rustup and the three targets (x86_64/aarch64-unknown-linux-musl, armv7-unknown-linux-gnueabihf), install cargo-zigbuild and zig; set backend.entry to the Cargo binary name; check the compiler output in the message."],
+    ["STANDALONE_BRIDGE_MANIFEST_INVALID", "The bridge.json the CLI produced does not match spec/bridge/v1 manifest.schema.json.", "Check backend.entry, methods and node.package; if it still fails, report the CLI bug."],
+    ["STANDALONE_NODE_SDK_NOT_BUILT", "The App's SDK version has no built Node SDK (node/dist).", "Run npm ci && npm run build in node/ of the SYNOPKGLAND_SDK_DIR checkout first; a release SDK must contain node/dist."],
 ])
     ERROR_REGISTRY[code] = { code, description, suggestion };
-ERROR_REGISTRY["STANDALONE_ENTRY_INVALID"] = { "code": "STANDALONE_ENTRY_INVALID", "description": "entry 設定不合法。", "suggestion": "entry 填 admin-only 或 app-privilege；app-privilege 需要至少一個 authenticated route。" };
-ERROR_REGISTRY["STANDALONE_ENTRY_WIDENED"] = { "code": "STANDALONE_ENTRY_WIDENED", "description": "entry: admin-only 與放寬權限的 route 設定衝突。", "suggestion": "把 permissions.json 中 authenticated 或 public 的 route 改為 administrators；要開放給一般使用者請改用 entry: app-privilege 或省略 entry。" };
-ERROR_REGISTRY["STANDALONE_ENTRY_UNSUPPORTED"] = { "code": "STANDALONE_ENTRY_UNSUPPORTED", "description": "backend 無法強制 entry 模式。", "suggestion": "使用 Go backend：backend/go.mod require github.com/synopackageland/syno-pkg-land-sdk，並在 backend.main 的 main.go（init 預設為 cmd/app/main.go）以 dsm.NewEntryGate 包住 authenticator。" };
-ERROR_REGISTRY["DSM_TLS_UNTRUSTED"] = { "code": "DSM_TLS_UNTRUSTED", "description": "DSM 的 TLS 憑證不受這台電腦信任（自簽、過期或名稱不符）。", "suggestion": "把 NAS 憑證或其 CA 匯出成 PEM，用 NODE_EXTRA_CA_CERTS=<該檔> 執行；或讓 DSM 使用與 host profile 名稱相符的受信任憑證。不要關閉憑證驗證。" };
-ERROR_REGISTRY["STANDALONE_ICON_INVALID"] = { "code": "STANDALONE_ICON_INVALID", "description": "dsm-package.yaml 的 icon 不是可用的套件圖示。", "suggestion": "icon 填專案內的正方形 PNG（至少 256×256），或含 icon_256.png 的 icon_<size>.png 目錄；省略則使用 SDK 預設圖示。" };
-ERROR_REGISTRY["CONTRACT_ICON_INVALID"] = { "code": "CONTRACT_ICON_INVALID", "description": "synology-app.yaml 的 icon 不是可用的套件圖示。", "suggestion": "icon 填專案內的正方形 PNG（至少 256×256），或含 icon_256.png 的 icon_<size>.png 目錄；省略則使用 SDK 預設圖示。" };
-ERROR_REGISTRY["CONTRACT_I18N_INVALID"] = { "code": "CONTRACT_I18N_INVALID", "description": "synology-app.yaml 的 i18n 設定不合法。", "suggestion": "i18n 只接受 info；info 以 zh-TW、ja 等支援語言為 key，值為單行、不含 \" 或 \\ 的 displayname / description（英文寫在頂層）。" };