synology: live-verify against cascadesDS, fix services method + pipe handling

First live exercise of the skill against the Cascades DS718+ (DSM 7.2.1, VPN up).
- Fix `services`: SYNO.Core.Service.list 103s on DSM 7.2.1 -> method is `get`.
- Fix `apis | head` BrokenPipeError traceback -> caught, clean exit.
- SKILL.md status PLUMBED -> VERIFIED 2026-06-25 with live device facts.
- wiki/cascades-tucson: add NAS specs, resolve model/RAM/DSM TODO.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/skills/synology/SKILL.md

@@ -110,12 +110,19 @@ log via `.claude/scripts/log-skill-error.sh` before surfacing. Handled condition
 VPN-down connect error surfaced to the user, a method refused for lack of --confirm) are NOT logged.
 
 ## Status / verification
-- **[PLUMBED]** Built from a 5-agent scan of the DSM 7 help tree + the authoritative API sources
-  (kwent device-extracted `_full.json`, N4S4/synology-api, Synology's Web API guides) — see
-  `references/dsm-api.md`. Auth (sid + synotoken CSRF), API discovery, version-by-maxVersion routing,
-  session-expiry re-login (codes 106/119), the mutating-verb gate, and the generic-error map are all
-  coded to spec but **not yet live-exercised** against the device (needs the Cascades VPN up). First
-  live `test` confirms endpoint shapes + fills the model/DSM-version wiki TODO. Mark verified then.
+- **[VERIFIED 2026-06-25 — HOWARD-HOME, Cascades VPN up]** First live exercise against the device.
+  Confirmed working: auth (sid + synotoken CSRF), API discovery (`apis`), version-by-maxVersion
+  routing, and reads `test` / `storage` / `shares` / `packages` / `services` / `apis`. Device is
+  **DS718+, DSM 7.2.1-69057 Update 11, 6 GB RAM, serial 1920PEN537202**; ext4, 2x WD10EZEX 1 TB.
+  10 shares (incl. hidden `pacs`, `Activities`, `chat`, `Sandra Fish`); 30 packages running incl.
+  **Active Backup for Business 3.1.0, Synology Drive Server 3.5.0, Chat, VPN Server, Hybrid Share**.
+  Session-expiry re-login (106/119), the mutating-verb gate, and the generic-error map are coded to
+  spec but not yet exercised against a live write (no mutating call made yet — gate verified only by
+  the read path). Built originally from a 5-agent scan of the DSM 7 help tree + authoritative API
+  sources (kwent `_full.json`, N4S4/synology-api, Synology Web API guides) — see `references/dsm-api.md`.
+- **Live fixes from this run (2026-06-25):** `services` used `SYNO.Core.Service.list` which 103s on
+  DSM 7.2.1 — corrected to `get` (returns `{"service":[...]}`). `apis | head` raised a
+  `BrokenPipeError` traceback — now caught and exits cleanly.
 - **DSM 7.2.x reboot/shutdown 103:** the Web-API `reboot`/`shutdown` can return error 103 on some
   builds. Fallback is the SSH `reboot|shutdown --confirm` recipe (`synoshutdown -r|-s`).
 - **Param-schema caveat:** method names + versions in the reference are device-authoritative, but many

.claude/skills/synology/scripts/syno_client.py

@@ -332,7 +332,8 @@ def main(argv):
         elif args.cmd == "packages":
             _print(c.call("SYNO.Core.Package", "list", additional='["status","installed_info"]'))
         elif args.cmd == "services":
-            _print(c.call("SYNO.Core.Service", "list"))
+            # DSM 7.2.x: SYNO.Core.Service enumerates via `get` (not `list`); returns {"service":[...]}
+            _print(c.call("SYNO.Core.Service", "get"))
         elif args.cmd == "connections":
             _print(c.call("SYNO.Core.CurrentConnection", "list"))
         elif args.cmd == "ls":
@@ -375,4 +376,12 @@ def main(argv):
 
 
 if __name__ == "__main__":
-    sys.exit(main(sys.argv[1:]))
+    try:
+        sys.exit(main(sys.argv[1:]))
+    except BrokenPipeError:
+        # downstream pipe closed (e.g. `apis | head`) -- exit cleanly, no traceback
+        try:
+            sys.stdout.close()
+        except Exception:
+            pass
+        os._exit(0)