w00c00 · w00c00 · Aug 9, 2026 · Aug 9, 2026 · Aug 9, 2026
diff --git a/.github/workflows/release-desktop.yml b/.github/workflows/release-desktop.yml
@@ -32,9 +32,9 @@ jobs:
             platform: linux
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
@@ -218,7 +218,7 @@ jobs:
       - name: Record artifact hashes
         run: node scripts/write-release-checksums.mjs release-assets "${{ matrix.platform }}"
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: desktop-${{ matrix.platform }}
           path: release-assets/*
@@ -232,9 +232,9 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           pattern: desktop-*
           path: release-assets

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.2.6 — 2026-08-09
+
+- Updated the default SHA-256-pinned official SilverScript compiler to `cb34aa5e6a598f9e461c4ad7014279ba89251d8d`; the `2a3961c` legacy profile remains available for reproducibility.
+- Added compatibility findings and compiler-backed regression tests for duplicate function names, entry parameters that shadow contract fields, and non-numeric ordered comparisons; documented the new `g16.verify` Groth16 builtin.
+- Recompiled every built-in template with realistic constructor arguments against the new compiler and retained TN10-only, fail-closed deployment policy for experimental templates and KCC721.
+- Fixed a false-positive `SS002` warning for same-input `scriptPubKey` continuation checks.
+- Fixed stale toolchain commit text, stale “no work open” state, and non-localized template project names; applying a template now preserves the user's project name.
+- Improved wallet onboarding after the one-time recovery backup by selecting the new wallet and explicitly focusing the password-to-connect step without retaining the password.
+- Updated vulnerable transitive `postcss` and `nanoid` versions; `npm audit` now reports zero known vulnerabilities.
+- Updated the official GitHub Actions used by the desktop release pipeline to their current Node 24-based majors.
+
+## 0.2.6 — 2026-08-09（中文）
+
+- 默认官方 SilverScript 编译器升级并固定到 `cb34aa5e6a598f9e461c4ad7014279ba89251d8d`，继续保留 `2a3961c` 旧版复现档案；所有二进制均校验 SHA-256。
+- 增加重复函数名、入口参数遮蔽契约字段、非数值有序比较的兼容性提示与编译器回归测试，并记录新的 `g16.verify` Groth16 内建函数。
+- 使用真实构造参数和新编译器重新完整编译全部内置模板；实验模板与 KCC721 继续仅限 TN10，并保持部署失效关闭。
+- 修复同一输入 `scriptPubKey` 延续检查被错误报告为 `SS002` 的误报。
+- 修复工具链提交号陈旧、已打开项目仍显示“没有打开的工作”、模板项目名称未本地化；应用模板时不再覆盖用户自定义项目名。
+- 改进一次性助记词备份后的钱包引导：自动选中新钱包并聚焦重新输入密码连接，同时不保留钱包密码。
+- 更新存在安全公告的间接依赖 `postcss` 与 `nanoid`；`npm audit` 现为零已知漏洞。
+- 将桌面发布流水线使用的 GitHub 官方 Actions 升级到当前基于 Node 24 的主版本。
+
 ## 0.2.5 — 2026-08-07
 
 - Added the minimum macOS Hardened Runtime JIT entitlement required by the bundled Node/V8 sidecar, fixing immediate `SIGTRAP` termination and local-service startup failure on Apple Silicon.

diff --git a/README.md b/README.md
@@ -35,7 +35,7 @@ AI 只负责生成候选方案和辅助审查，不能解锁钱包、签名交
 - 中英文界面；首次启动自动读取系统语言，并在系统语言既非中文也非英文时使用时区辅助判断。
 - 用户手动切换语言后，本机选择优先于自动识别。
 - 本地项目工作区，可创建、切换和删除未使用的工作。
-- 双编译器兼容档案：默认固定 `kaspanet/silverscript@4b0e1cd69739934f92c3ac4df1bb13d912418b2b`，并保留 `2a3961c` 旧版用于复现；两者都校验二进制 SHA-256。
+- 双编译器兼容档案：默认固定 `kaspanet/silverscript@cb34aa5e6a598f9e461c4ad7014279ba89251d8d`，并保留 `2a3961c` 旧版用于复现；两者都校验二进制 SHA-256。
 - 内置破坏性变更扫描与安全迁移，识别 `entry`、`checkMsgSig`、`outpointTxId`、artifact `bytecode` 等升级差异；无法安全自动迁移的 `.reverse()` 和位运算会要求人工审查。
 - 固定 Kascov 来源提交构建的本地交易预检引擎。
 - 支持 OpenAI、Anthropic、Gemini、OpenRouter、Ollama 和 OpenAI-compatible 接口。
@@ -149,7 +149,7 @@ npm run desktop:build
 - 固定版本本地预检引擎。
 - Kaspa WASM、契约模板、知识库和第三方许可证。
 
-原生安装包必须在对应系统上构建和测试，macOS、Windows 和 Linux 的二进制不能互相替代。v0.2.5 发布流程在原生 GitHub Runner 上分别生成 macOS Apple Silicon DMG、Windows x64 NSIS/MSI，以及 Linux x86_64 DEB/AppImage，并附带 SHA-256 校验文件。macOS 包必须使用已签名 sidecar 通过 V8、健康接口和模板接口测试；Windows 包必须通过安装资源启动、健康接口和模板接口测试。
+原生安装包必须在对应系统上构建和测试，macOS、Windows 和 Linux 的二进制不能互相替代。发布流程在原生 GitHub Runner 上分别生成 macOS Apple Silicon DMG、Windows x64 NSIS/MSI，以及 Linux x86_64 DEB/AppImage，并附带 SHA-256 校验文件。macOS 包必须使用已签名 sidecar 通过 V8、健康接口和模板接口测试；Windows 包必须通过安装资源启动、健康接口和模板接口测试。
 
 公开包目前没有商业代码签名：macOS 使用 ad-hoc 签名且未公证，Windows 未进行 Authenticode 签名，Linux 未进行发行版签名。首次启动可能出现系统安全提示；请只从本仓库 Release 下载并核对 SHA-256。
 
@@ -288,7 +288,7 @@ AI is limited to candidate generation and review assistance. It cannot unlock wa
 - Chinese and English UI with automatic system-language detection and time-zone fallback.
 - A manual language choice always overrides future automatic detection.
 - Local project workspace with explicit create, switch, and delete actions.
-- Dual compiler profiles: the default is pinned to `kaspanet/silverscript@4b0e1cd69739934f92c3ac4df1bb13d912418b2b`, while `2a3961c` remains available for reproducible legacy builds; both binaries are SHA-256 verified.
+- Dual compiler profiles: the default is pinned to `kaspanet/silverscript@cb34aa5e6a598f9e461c4ad7014279ba89251d8d`, while `2a3961c` remains available for reproducible legacy builds; both binaries are SHA-256 verified.
 - Built-in breaking-change detection and safe migration for `entry`, `checkMsgSig`, `outpointTxId`, and artifact `bytecode`; removed `.reverse()` and bitwise typing changes require manual review.
 - Pinned Kascov-derived local transaction preflight engine.
 - OpenAI, Anthropic, Gemini, OpenRouter, Ollama, and OpenAI-compatible providers.
@@ -375,7 +375,7 @@ npm run desktop:build
 
 The desktop bundle contains the frontend, local Node.js sidecar, pinned `silverc`, pinned local preflight engine, Kaspa WASM, templates, knowledge resources, and third-party license notices.
 
-Native installers must be built and tested on their target operating systems; macOS, Windows, and Linux binaries are not interchangeable. The v0.2.5 release pipeline produces a macOS Apple Silicon DMG, Windows x64 NSIS/MSI packages, and Linux x86_64 DEB/AppImage packages on native GitHub Runners, with SHA-256 checksum files. The macOS package must pass signed-sidecar V8, health-endpoint, and template-endpoint tests; the Windows package must pass packaged-resource startup, health-endpoint, and template-endpoint tests.
+Native installers must be built and tested on their target operating systems; macOS, Windows, and Linux binaries are not interchangeable. The release pipeline produces a macOS Apple Silicon DMG, Windows x64 NSIS/MSI packages, and Linux x86_64 DEB/AppImage packages on native GitHub Runners, with SHA-256 checksum files. The macOS package must pass signed-sidecar V8, health-endpoint, and template-endpoint tests; the Windows package must pass packaged-resource startup, health-endpoint, and template-endpoint tests.
 
 The public packages are not commercially code-signed: macOS is ad-hoc signed and not notarized, Windows is not Authenticode-signed, and Linux is not distribution-signed. The operating system may show a warning on first launch. Download only from this repository's Releases and verify the SHA-256 checksum.
 

diff --git a/config/compiler-profiles.json b/config/compiler-profiles.json
@@ -1,21 +1,24 @@
 {
-  "defaultProfileId": "latest-4b0e1cd",
+  "defaultProfileId": "latest-cb34aa5",
   "profiles": [
     {
-      "id": "latest-4b0e1cd",
-      "label": "SilverScript latest (4b0e1cd)",
-      "upstreamCommit": "4b0e1cd69739934f92c3ac4df1bb13d912418b2b",
+      "id": "latest-cb34aa5",
+      "label": "SilverScript latest (cb34aa5)",
+      "upstreamCommit": "cb34aa5e6a598f9e461c4ad7014279ba89251d8d",
       "binary": "bin/silverc-latest",
       "artifactBytecodeField": "bytecode",
       "syntaxGeneration": 2,
       "status": "experimental",
       "networkPolicy": "tn10-only",
-      "releasedAt": "2026-08-03",
+      "releasedAt": "2026-08-09",
       "notes": [
         "Uses entry syntax for public entrypoints",
         "Exposes transaction introspection as outpointTxId",
         "Uses checkMsgSig for arbitrary-message signatures",
-        "Compiler JSON calls the emitted program bytecode"
+        "Compiler JSON calls the emitted program bytecode",
+        "Rejects duplicate function names and entry parameters that shadow contract fields",
+        "Restricts ordered comparisons to numeric operands",
+        "Adds the variable-input g16.verify Groth16 verifier builtin"
       ]
     },
     {
@@ -40,7 +43,7 @@
       "severity": "error",
       "introducedBy": "0f99803",
       "fromProfile": "legacy-2a3961c",
-      "toProfile": "latest-4b0e1cd",
+      "toProfile": "latest-cb34aa5",
       "pattern": "\\bentrypoint\\s+function\\b",
       "messageZh": "公开入口语法已从 entrypoint function 改为 entry。",
       "messageEn": "Public entrypoint syntax changed from entrypoint function to entry.",
@@ -51,7 +54,7 @@
       "severity": "error",
       "introducedBy": "782a4d7",
       "fromProfile": "legacy-2a3961c",
-      "toProfile": "latest-4b0e1cd",
+      "toProfile": "latest-cb34aa5",
       "pattern": "\\bcheckSigFromStack\\b",
       "messageZh": "任意消息签名内建函数已改名为 checkMsgSig。",
       "messageEn": "The arbitrary-message signature builtin was renamed to checkMsgSig.",
@@ -62,7 +65,7 @@
       "severity": "error",
       "introducedBy": "65421cf",
       "fromProfile": "legacy-2a3961c",
-      "toProfile": "latest-4b0e1cd",
+      "toProfile": "latest-cb34aa5",
       "pattern": "\\.outpointTransactionHash\\b",
       "messageZh": "输入 outpoint 字段已改名为 outpointTxId。",
       "messageEn": "The input outpoint field was renamed to outpointTxId.",
@@ -73,7 +76,7 @@
       "severity": "error",
       "introducedBy": "6869e7d",
       "fromProfile": "legacy-2a3961c",
-      "toProfile": "latest-4b0e1cd",
+      "toProfile": "latest-cb34aa5",
       "pattern": "\\.reverse\\s*\\(",
       "messageZh": ".reverse() 已删除，必须显式重写字节顺序逻辑并重新测试。",
       "messageEn": ".reverse() was removed; rewrite byte ordering explicitly and retest it.",
@@ -84,7 +87,7 @@
       "severity": "integration",
       "introducedBy": "4d88ded",
       "fromProfile": "legacy-2a3961c",
-      "toProfile": "latest-4b0e1cd",
+      "toProfile": "latest-cb34aa5",
       "pattern": null,
       "messageZh": "编译产物 JSON 字段由 script 改为 bytecode；外部工具必须兼容两个字段。",
       "messageEn": "The compiler artifact JSON field changed from script to bytecode; integrations must support both.",
@@ -95,7 +98,7 @@
       "severity": "manual-review",
       "introducedBy": "8b74812",
       "fromProfile": "legacy-2a3961c",
-      "toProfile": "latest-4b0e1cd",
+      "toProfile": "latest-cb34aa5",
       "pattern": "(?:^|[^&|])(?:<<|>>|\\^|&|\\|)(?:[^&|]|$)",
       "messageZh": "位运算现在仅接受 bytes；请人工确认操作数类型。",
       "messageEn": "Bitwise operators now accept bytes only; review operand types manually.",

diff --git a/docs/kcc721-experimental.md b/docs/kcc721-experimental.md
@@ -6,7 +6,7 @@ Studio 内置的 KCC721 包改编自 `KaspaHUB21/KCC721` v0.2 社区草案，保
 
 本包只允许 `tn10`，风险等级为 `high-experimental`。普通单 Covenant 部署路径被明确禁用，因为 Collection/Ticket/NFT 创世需要专用的多合约 builder 正确计算模板片段、模板哈希、Covenant ID 和 output binding。当前完成的是：
 
-- 四份源码在官方 `silverc@4b0e1cd` 下完整编译。
+- 四份源码在官方 `silverc@cb34aa5` 下完整编译。
 - 模板使用三步配置向导，不再要求用户手填元数据摘要。名称、描述、图片 URI、外部链接和属性会先规范化为确定性 JSON，再由前后端分别计算并核对 SHA-256。
 - “新集合”明确标记为编译预览，内部使用不可部署的全零哨兵；只有“导入已有 TN10 集合”模式接受从真实创世输出核验的 Collection Covenant ID。
 - NFT 所有者变更绑定独立 P2PK co-spend 输入。
@@ -34,7 +34,7 @@ The bundled KCC721 pack is adapted from the community `KaspaHUB21/KCC721` v0.2 d
 
 The pack is restricted to `tn10` and marked `high-experimental`. Ordinary single-covenant deployment is explicitly blocked because Collection/Ticket/NFT genesis requires a dedicated multi-contract builder to calculate template segments, template hashes, covenant IDs, and output bindings correctly. The current implementation provides:
 
-- Full compilation of all four sources with official `silverc@4b0e1cd`.
+- Full compilation of all four sources with official `silverc@cb34aa5`.
 - A three-step setup wizard that no longer asks users to type a metadata digest. Name, description, image URI, external URL, and attributes are canonicalized into deterministic JSON, then SHA-256 is independently recomputed by the client and server.
 - A clearly labeled new-collection compile preview with a non-deployable internal all-zero sentinel. Only the existing-TN10-collection path accepts a Collection covenant ID verified from a real genesis output.
 - NFT ownership transitions bound to a separate P2PK co-spend input.

diff --git a/docs/releases/v0.2.6.md b/docs/releases/v0.2.6.md
@@ -0,0 +1,51 @@
+## Kaspa SilverScript Studio v0.2.6
+
+This release updates Studio to the current official experimental SilverScript compiler snapshot and tightens compatibility, security, and desktop usability without widening mainnet access.
+
+### Compiler and covenant verification
+
+- Pins official `kaspanet/silverscript@cb34aa5e6a598f9e461c4ad7014279ba89251d8d` and verifies the packaged compiler by SHA-256.
+- Detects duplicate function names, entry parameters that shadow contract fields, and obvious non-numeric ordered comparisons before compilation.
+- Documents the new variable-input `g16.verify` Groth16 builtin.
+- Fully compiles all built-in templates with realistic constructor arguments on the new toolchain.
+- Keeps the legacy `2a3961c` profile for reproducible historical builds.
+- Keeps experimental templates and the KCC721 research pack TN10-only and fail-closed for unsupported deployment paths.
+
+### Reliability, security, and usability
+
+- Removes a false `SS002` warning from valid same-input `scriptPubKey` continuation checks.
+- Shows the actual current toolchain commit in the sidebar.
+- Correctly restores “Saved locally” when a project opens and localizes new template project names.
+- Preserves a user's project name when applying a different template.
+- Makes the post-backup wallet connection step explicit without caching the wallet password.
+- Updates transitive `postcss` and `nanoid` packages; the release lockfile passes `npm audit` with zero known vulnerabilities.
+- Moves the desktop release workflow to the current Node 24-based official GitHub Actions.
+
+Mainnet remains disabled by default. SilverScript itself remains experimental, so this release is not a claim that arbitrary contracts are mainnet-ready.
+
+---
+
+## 中文说明
+
+本版将 Studio 升级到当前官方 SilverScript 实验版编译器快照，并加强兼容性检查、安全性与桌面端易用性；不会扩大主网权限。
+
+### 编译器与契约验证
+
+- 固定官方 `kaspanet/silverscript@cb34aa5e6a598f9e461c4ad7014279ba89251d8d`，打包编译器继续执行 SHA-256 校验。
+- 编译前检查重复函数名、入口参数遮蔽契约字段，以及明显的非数值有序比较。
+- 记录新的可变公共输入 `g16.verify` Groth16 内建函数。
+- 使用真实构造参数在新工具链上完整编译全部内置模板。
+- 保留 `2a3961c` 旧版档案，用于历史项目复现。
+- 实验模板与 KCC721 研究包继续仅限 TN10；不受支持的部署路径保持失效关闭。
+
+### 稳定性、安全与易用性
+
+- 消除有效的同一输入 `scriptPubKey` 延续检查产生的 `SS002` 误报。
+- 侧栏显示真实的当前工具链提交号。
+- 打开项目后正确恢复“已保存到本机”，新模板项目名称会跟随界面语言。
+- 将模板应用到已有项目时保留用户自己的项目名称。
+- 助记词备份完成后明确引导重新输入密码连接，同时不缓存钱包密码。
+- 更新间接依赖 `postcss` 与 `nanoid`；发布锁文件通过 `npm audit`，已知漏洞为零。
+- 桌面发布流水线升级到当前基于 Node 24 的 GitHub 官方 Actions。
+
+主网继续默认禁用。SilverScript 本身仍处于实验阶段，因此本次发布不代表任意契约已经可以安全用于主网。
diff --git a/docs/studio-0.2-architecture.md b/docs/studio-0.2-architecture.md
@@ -4,7 +4,7 @@
 
 ### 编译器兼容档案
 
-`config/compiler-profiles.json` 是可提交的兼容性清单，`config/compiler.json` 是本机生成的二进制路径、构建时间和 SHA-256 清单。默认档案固定官方 SilverScript `4b0e1cd69739934f92c3ac4df1bb13d912418b2b`，旧版 `2a3961cadc76bb16a425042172ffe32481da89b5` 只用于复现已有项目。
+`config/compiler-profiles.json` 是可提交的兼容性清单，`config/compiler.json` 是本机生成的二进制路径、构建时间和 SHA-256 清单。默认档案固定官方 SilverScript `cb34aa5e6a598f9e461c4ad7014279ba89251d8d`，旧版 `2a3961cadc76bb16a425042172ffe32481da89b5` 只用于复现已有项目。
 
 升级检查会报告已知变化，并只自动替换无歧义的名称。`.reverse()` 删除、字节序、位运算类型和任何状态布局变化必须人工审查。迁移后仍必须使用真实构造参数完整编译并进行对抗性交易测试。
 
@@ -48,7 +48,7 @@ Studio 当前依次尝试：节点原生 Covenant ID 查询（节点支持时）
 
 ### Compiler compatibility profiles
 
-`config/compiler-profiles.json` is the committed compatibility catalog. The generated `config/compiler.json` records local binary paths, build times, and SHA-256 hashes. The default profile pins official SilverScript commit `4b0e1cd69739934f92c3ac4df1bb13d912418b2b`; `2a3961cadc76bb16a425042172ffe32481da89b5` is retained only for reproducible legacy builds.
+`config/compiler-profiles.json` is the committed compatibility catalog. The generated `config/compiler.json` records local binary paths, build times, and SHA-256 hashes. The default profile pins official SilverScript commit `cb34aa5e6a598f9e461c4ad7014279ba89251d8d`; `2a3961cadc76bb16a425042172ffe32481da89b5` is retained only for reproducible legacy builds.
 
 Compatibility checks report known changes and automatically apply only unambiguous renames. Removed `.reverse()`, byte ordering, bitwise typing, and any state-layout change require manual review. Every migration still requires a full compile with realistic constructor arguments and adversarial transaction tests.