docs: align Ubuntu 24.04 defaults and local lab workflows

Update English and Chinese setup, image, lifecycle and CLI documentation for
U24 defaults, detailed plans, partial status, guest metadata refresh, no-wait
and SSH passthrough behavior.

Validated with the strict Hugo build and internal link checks.

Author: Vonng

content/docs/reference/cli.md

@@ -109,7 +109,10 @@ by a second JSON/YAML document.
 
 `plan` is read-only and returns success even when its action is `recreate` or
 `blocked-removal`; automation must inspect the action and `create`, `recreate`,
-and `missing` fields. `up` creates missing nodes, starts stopped ones,
+`start`, `missing`, and `blocked` fields. Plans only read local configuration
+and catalog data, so QEMU and host networking need not be installed. They show
+exact images, total resources, change reasons, and disk effects. `up` checks
+host capabilities and address availability before applying changes. `up` creates missing nodes, starts stopped ones,
 re-checks readiness of running ones, and rewrites the SSH client configuration
 Farrow installed from the complete applied deployment. `recreate` performs the
 same full refresh; node destroy removes stale entries, and whole destroy
@@ -124,21 +127,38 @@ failure and exits 5.
 
 A multi-node operation in which some nodes failed exits 5 and reports
 `N of M node(s) failed: <node> (<stage>: <error>); ...`. Stages are `prepare`,
-`start`, `readiness`, and `stop`; a `readiness` failure adds
+`start`, `readiness`, `stop`, `status`, and `guest-metadata`; a `readiness` failure adds
 `run \`farrow logs <node>\` for the guest console`. Structured output carries
 `failures[]` with `node`, `stage`, and `error`, plus `rolled_back` when
 `--rollback` removed the prepare artifacts of nodes that never committed. See
 [A node did not become ready](../../start/troubleshooting/#a-node-did-not-become-ready).
 
-`status` reports the persisted `guest_arch` and `accelerator` for each node.
-TCG selection is therefore explicit in both text and structured output.
+`status` shows node, state, IP, exact image, and CPU/memory. Use `--verbose` for
+SSH ports, architecture, accelerator, and PID. TCG is marked in ordinary text
+as well. One degraded node does not hide its peers; status exits 5 and retains
+per-node errors and `failures[]`. Running means the VM process is running;
+status does not claim to have checked guest readiness.
+
+Starting commands also refresh Farrow hosts and control-node SSH entries in
+running guests. Stopped guests catch up when started. `--no-wait` skips guest
+readiness and that refresh; a later `up` completes both. Selected recreate
+refuses remaining peer drift before stopping or deleting disks; select the
+required nodes together as directed.
+
+The control guest's Farrow-managed SSH entries accept replacement host keys
+without recording them in known_hosts, so recreated lab nodes remain reachable.
+User-added SSH entries are preserved.
 
 ## SSH passthrough and completion
 
 `farrow ssh [node] [--] [command ...]` opens a session or runs an optional
 command. `farrow exec [node] [--] <command ...>` requires a command and passes
 through its exit status. Presentation flags before `--` belong to Farrow;
-arguments after `--` belong to OpenSSH or the remote program.
+arguments after `--` are joined with spaces and interpreted by the remote
+shell, like plain SSH. Before `--`, only zero or one known node is accepted.
+For convenience, omitting `--` uses a known first argument as the node, or
+runs all arguments as a command on the default node with a warning. Use an
+explicit `--` in scripts.
 
 Load `farrow completion bash|zsh|fish|powershell` for command and scoped-flag
 completion. It also provides command aliases, templates, image aliases, closed
@@ -159,5 +179,6 @@ specification.
 | 7 | integrity or ownership failure |
 | 130 | interrupted (SIGINT/SIGTERM) |
 
-`ssh` and `exec` pass through the remote program's exit code, except SSH's
-reserved transport-failure code 255, which Farrow maps to runtime failure 1.
+`ssh` and `exec` pass through the SSH child exit code unchanged, including
+255. That value may indicate an SSH connection failure or a remote command
+returning 255; text, JSON, and process exit status agree.

content/docs/reference/cli.zh.md

@@ -79,7 +79,7 @@ JSON/YAML 模式下，空命名空间返回结构化用法错误。显式 `--hel
 | `-d`、`--dry-run` | 只展示 setup/image 计划，不改变状态 |
 | `-y`、`--yes` | 应用已展示的宿主/setup/image 计划 |
 | `--force`（`init`、`destroy`、`recreate`） | 覆盖生成文件或跳过输入确认词；因为 `-f` 用于选择 Inventory，所以只保留长参数 |
-| `-n`、`--no-wait` | QEMU 运行后即返回，不等待 Guest 启动完成 |
+| `-n`、`--no-wait` | QEMU 运行后即返回，跳过 Guest 就绪检查与 guest 元数据刷新 |
 | `--rollback`（`up`、`reload`） | 清除本次运行中 prepare 失败节点的残留产物 |
 | `--delete-persistent` | 整体销毁时也删持久盘；不能与节点选择器一起使用 |
 | `--purge` | 整体处置：删除磁盘、密钥与 deployment 状态，保留镜像 |
@@ -99,7 +99,9 @@ Inventory 的命令中 `-f` 始终选择文件；`logs -f` 保留惯用的 `--fo
 JSON/YAML 文档。
 
 `plan` 是只读操作，即使 action 为 `recreate` 或 `blocked-removal` 也返回成功；自动化必须
-检查 action 与 `create`、`recreate`、`missing` 字段。`up` 会创建缺失节点、启动已停止
+检查 action 与 `create`、`start`、`recreate`、`missing`、`blocked` 字段。计划只读取
+本地配置和 Catalog，无需先安装 QEMU 或宿主网络；它显示精确镜像、资源总量、变更原因
+和磁盘影响。宿主能力与地址可用性由 `up` 在执行前检查。`up` 会创建缺失节点、启动已停止
 节点、复查运行中节点的就绪状态，并根据完整的 applied deployment 重写 Farrow 安装的
 SSH 客户端配置；`recreate` 同样执行全量刷新，节点级 destroy 删除旧条目，整体 destroy
 移除该配置。`start` 启动已停止节点并复查运行中节点的就绪状态，不触碰 SSH 客户端配置。
@@ -110,19 +112,31 @@ SSH 客户端配置；`recreate` 同样执行全量刷新，节点级 destroy 
 
 多节点操作中若有节点失败，退出码为 5，并报告
 `N of M node(s) failed: <node> (<stage>: <error>); ...`。阶段为 `prepare`、`start`、
-`readiness`、`stop`；`readiness` 失败会追加 `run \`farrow logs <node>\` for the guest
+`readiness`、`stop`、`status`、`guest-metadata`；`readiness` 失败会追加 `run \`farrow logs <node>\` for the guest
 console`。结构化输出携带 `failures[]`（`node`、`stage`、`error`）；当 `--rollback` 清除了
 从未提交节点的 prepare 产物时，还会带上 `rolled_back`。参见
 [节点未就绪](../../start/troubleshooting/#节点未就绪)。
 
-`status` 会为每个节点报告持久化的 `guest_arch` 与 `accelerator`；文本和结构化输出都会
-明确显示 TCG。
+`status` 默认展示节点、状态、IP、精确镜像和 CPU/内存；`--verbose` 展示 SSH 端口、
+架构、加速器与 PID。TCG 在普通文本中也有标记。一个节点异常时，仍保留其他节点的
+状态，并返回 5；结构化输出包含逐节点 `error` 和 `failures[]`。running 表示 VM
+正在运行，不代表本次 status 检查了 guest 就绪状态。
+
+启动命令完成后还会刷新运行中 guest 的 Farrow hosts 和控制节点 SSH 配置；停止中的
+节点在下次启动时更新。`--no-wait` 会跳过 guest 就绪检查和刷新，随后执行 `up` 补齐。
+局部 recreate 若仍受未选节点的配置变化影响，会在停机、删盘前拒绝；按提示一次选择
+需要重建的节点。
+
+控制节点中由 Farrow 管理的 SSH 条目不固定 guest 主机密钥，也不写入 known_hosts，
+因此重建实验节点后可以直接连接。用户自行添加的 SSH 配置会保留。
 
 ## SSH 透传与命令补全
 
 `farrow ssh [node] [--] [command ...]` 打开会话或运行可选命令；
 `farrow exec [node] [--] <command ...>` 必须给出命令并透传退出码。`--` 之前的展示参数
-属于 Farrow，之后的参数属于 OpenSSH 或远端程序。
+属于 Farrow，之后的参数会像普通 SSH 一样以空格连接，再交给远端 shell 解释。
+有 `--` 时，其前面只能是空或一个已知节点。为方便交互使用，也接受省略 `--`：已知
+首参数选节点，否则把整段当成默认节点上的命令，并显示 warning。脚本中建议明确写 `--`。
 
 加载 `farrow completion bash|zsh|fish|powershell` 可获得命令与作用域准确的参数补全，
 同时补全命令别名、模板、镜像别名、枚举参数，以及从期望/已应用规格只读解析出的节点名。
@@ -141,5 +155,5 @@ console`。结构化输出携带 `failures[]`（`node`、`stage`、`error`）；
 | 7 | 完整性或属主失败 |
 | 130 | 被中断（SIGINT/SIGTERM） |
 
-`ssh` 与 `exec` 会透传远端程序退出码；但 SSH 保留的传输失败码 255 会被 Farrow 映射为
-运行时失败 1。
+`ssh` 与 `exec` 原样透传 SSH 子进程退出码，包括 255；255 可能是 SSH 连接失败，
+也可能是远端命令返回该值。文本、JSON 与进程退出码保持一致。

content/docs/reference/configuration.md

@@ -37,7 +37,7 @@ values are errors.
 | Variable | Default | Meaning |
 |---|---|---|
 | `vm_skip` | `false` | do not virtualize this real/external host |
-| `vm_image` | `d13` | image family, channel reference, or `image@version` selector |
+| `vm_image` | `u24` | image family, channel reference, or `image@version` selector |
 | `vm_version` | unset | newest numeric version matching this prefix, such as `9` or `9.7` |
 | `vm_arch` | `native` | deployment-wide Guest architecture: `native`, `amd64`, or `arm64` |
 | `vm_cpu` | `2` | vCPU count |

content/docs/reference/configuration.zh.md

@@ -31,7 +31,7 @@ Farrow 读取主机 IP、`nodename`、`admin_ip`、`pg_cluster`、`pg_seq`、
 | 变量 | 默认值 | 含义 |
 |---|---|---|
 | `vm_skip` | `false` | 不虚拟化这台真实/外部主机 |
-| `vm_image` | `d13` | 镜像 Family、Channel 引用或 `image@version` Selector |
+| `vm_image` | `u24` | 镜像 Family、Channel 引用或 `image@version` Selector |
 | `vm_version` | 未设置 | 匹配 `9`、`9.7` 等数值前缀的最新版本 |
 | `vm_arch` | `native` | 部署级 Guest 架构：`native`、`amd64` 或 `arm64` |
 | `vm_cpu` | `2` | vCPU 数量 |

content/docs/reference/images.md

@@ -19,7 +19,7 @@ trusted.
 
 The embedded Catalog contains 9 families and 27 artifacts: `el7` is
 amd64-only; every other family has amd64 and arm64 artifacts. EL9 includes
-9.3, 9.6, 9.7, and 9.8; EL10 includes 10.0, 10.1, and 10.2. `d13:stable` on
+9.3, 9.6, 9.7, and 9.8; EL10 includes 10.0, 10.1, and 10.2. `u24:stable` (Ubuntu 24.04) on
 the native architecture is the default request.
 
 | Alias | Distribution | Architectures | Boot | Status |
@@ -55,7 +55,7 @@ For a pull, Farrow:
    embedded in this build, or the one last activated by `farrow update` or
    `image sync`;
 2. resolves `image[:channel]` or `image@version-prefix`, defaulting to
-   `d13:stable`; standalone `image pull` uses the native architecture, while
+   `u24:stable`; standalone `image pull` uses the native architecture, while
    lifecycle resolution honors `vm_arch`;
 3. reuses a local file only after size, SHA-256, and qcow2 checks pass;
 4. otherwise downloads the exact Catalog-named artifact from the selected
@@ -156,10 +156,10 @@ Catalog that Farrow embeds and signs.
 ```yaml
 schema: 1
 revision: 1
-defaults: { image: d13, channel: stable, arch: native, boot: uefi }
+defaults: { image: u24, channel: stable, arch: native, boot: uefi }
 images:
-  d13:
-    aliases: [debian13, trixie, debian]
+  u24:
+    aliases: [ubuntu24, noble, ubuntu]
     channels: { stable: "1" }
     versions:
       "1":

content/docs/reference/images.zh.md

@@ -17,7 +17,7 @@ Farrow 使用物化的静态 Catalog 与不可变 qcow2 工件。官方与 HTTP
 
 内置 Catalog 包含 9 个 Family、27 个工件：`el7` 只有 amd64，其余 Family 均有
 amd64 与 arm64。EL9 包含 9.3、9.6、9.7、9.8；EL10 包含 10.0、10.1、10.2。
-默认请求为本机架构的 `d13:stable`。
+默认请求为本机架构的 `u24:stable`（Ubuntu 24.04）。
 
 | 别名 | 发行版 | 架构 | 启动 | 状态 |
 |---|---|---|---|---|
@@ -48,7 +48,7 @@ Catalog 状态只表达支持策略，不是启动开关：`supported` 表示已
 
 1. 为整条命令读取一次当前本地 Catalog：即本次构建内置的 Catalog，或最近一次
    `farrow update`/`image sync` 激活的 Catalog；
-2. 解析 `image[:channel]` 或 `image@version-prefix`，缺省为 `d13:stable`；独立
+2. 解析 `image[:channel]` 或 `image@version-prefix`，缺省为 `u24:stable`；独立
    `image pull` 使用本机架构，生命周期解析遵循 `vm_arch`；
 3. 只有尺寸、SHA-256、qcow2 结构全部匹配时才复用本地文件；
 4. 否则只从选定仓库下载 Catalog 指定的准确工件；不可变 Upstream URL 是溯源，不是回退源。
@@ -136,10 +136,10 @@ farrow/
 ```yaml
 schema: 1
 revision: 1
-defaults: { image: d13, channel: stable, arch: native, boot: uefi }
+defaults: { image: u24, channel: stable, arch: native, boot: uefi }
 images:
-  d13:
-    aliases: [debian13, trixie, debian]
+  u24:
+    aliases: [ubuntu24, noble, ubuntu]
     channels: { stable: "1" }
     versions:
       "1":

content/docs/start/images.md

@@ -5,7 +5,7 @@ weight: 40
 icon: fa-solid fa-box-archive
 ---
 
-Normal use needs no image command first: `farrow up` resolves `d13:stable` for
+Normal use needs no image command first: `farrow up` resolves `u24:stable` for
 the native host architecture and pulls the resulting immutable version.
 Farrow uses the Catalog embedded in the installed build until you run
 `farrow update`, which fetches, verifies, and activates the repository's current
@@ -18,8 +18,8 @@ Inspect the available aliases:
 
 ```bash
 farrow image list
-farrow image info d13
-farrow image info d13:stable
+farrow image info u24
+farrow image info u24:stable
 ```
 
 Built-in families are `el7`, `el8`, `el9`, `el10`, `d12`, `d13`, `u22`,
@@ -53,9 +53,9 @@ official China repository for one command with long-only `--mirror`, or name a
 custom root with `--repo`:
 
 ```bash
-farrow image pull d13 --mirror
+farrow image pull u24 --mirror
 farrow up --mirror
-farrow image pull d13 --repo https://mirror.example/farrow
+farrow image pull u24 --repo https://mirror.example/farrow
 farrow up --repo https://mirror.example/farrow
 ```
 

content/docs/start/images.zh.md

@@ -5,7 +5,7 @@ weight: 40
 icon: fa-solid fa-box-archive
 ---
 
-正常使用不需要先执行镜像命令：`farrow up` 默认按本机架构解析 `d13:stable`，并拉取
+正常使用不需要先执行镜像命令：`farrow up` 默认按本机架构解析 `u24:stable`，并拉取
 最终对应的不可变版本。
 Farrow 一直使用已安装构建内置的 Catalog，直到你运行 `farrow update`：它会获取、校验并
 激活仓库当前的 Catalog；没有任何自动刷新。恢复时可用 `image sync` 显式激活精确 URL
@@ -17,8 +17,8 @@ Farrow 一直使用已安装构建内置的 Catalog，直到你运行 `farrow up
 
 ```bash
 farrow image list
-farrow image info d13
-farrow image info d13:stable
+farrow image info u24
+farrow image info u24:stable
 ```
 
 内置 Family 包括 `el7`、`el8`、`el9`、`el10`、`d12`、`d13`、`u22`、`u24`、
@@ -48,9 +48,9 @@ Release 构建默认使用 `https://repo.pigsty.io/farrow`。单条命令可通
 `--mirror` 选择中国官方仓库，也可以用 `--repo` 指定自定义根：
 
 ```bash
-farrow image pull d13 --mirror
+farrow image pull u24 --mirror
 farrow up --mirror
-farrow image pull d13 --repo https://mirror.example/farrow
+farrow image pull u24 --repo https://mirror.example/farrow
 farrow up --repo https://mirror.example/farrow
 ```
 

content/docs/start/operations.md

@@ -16,8 +16,9 @@ farrow logs meta --source serial
 ```
 
 Applied state is under `~/.farrow`; these commands work from any directory.
-Status includes the persisted Guest architecture and accelerator, so TCG is
-never an invisible fallback.
+Status shows images and resources; `--verbose` adds architecture, accelerator,
+SSH ports, and PID. TCG is marked in ordinary output, and a degraded node does
+not hide its peers.
 `farrow up` rebuilds the default SSH aliases from the complete applied
 deployment after the selected VMs are started, so a scoped `up` never drops
 unselected peers and plain `ssh meta` just works; `farrow ssh-config --install`
@@ -36,8 +37,12 @@ farrow reload -f farrow.yml       # stop, re-read config, converge
 ```
 
 `start` powers on stopped VMs and re-checks readiness of running ones; it does
-not refresh the SSH client configuration. `restart` uses applied state. `reload` reads the Inventory again and follows
-the complete `up` path after stopping.
+not refresh the SSH client configuration. `restart` uses applied state. `reload` reads the Inventory and checks drift and startup dependencies before
+stopping selected nodes and following the full `up` path.
+
+Starting commands also refresh Farrow hosts and control-node SSH entries in
+running guests. `--no-wait` skips readiness and this refresh; run `up` later
+to finish them.
 
 ## Change the deployment
 
@@ -50,7 +55,13 @@ farrow recreate node-1            # applies a changed VM definition
 `recreate` and `destroy` ask you to type the confirmation word on a terminal;
 pass `--force` only in scripts.
 
-Inventory changes fall into three visible fields:
+`plan` works before host setup and shows images, total resources, change reasons,
+and disk effects. CPU/memory changes still require recreate: root and ephemeral
+data disks are replaced, while persistent disks are kept. A selected recreate
+blocked by unselected peer changes refuses before deletion and names the nodes
+that need attention.
+
+Inventory changes appear in these fields:
 
 | Field | Meaning | Action |
 |---|---|---|

content/docs/start/operations.zh.md

@@ -16,7 +16,8 @@ farrow logs meta --source serial
 ```
 
 应用状态位于 `~/.farrow`，这些命令可在任意目录执行。
-Status 会显示持久化的 Guest 架构与加速器，因此 TCG 永远不是不可见回退。
+Status 默认显示镜像和资源；`--verbose` 显示架构、加速器、SSH 端口和 PID，
+TCG 在普通输出中也明确标记。异常节点不会隐藏其他节点的状态。
 `farrow up` 会在选中 VM 启动后，根据完整 applied deployment 重建默认 SSH 别名；因此
 局部 `up` 不会删除未选中节点，可直接运行 `ssh meta`；如需手工重写，使用
 `farrow ssh-config --install`。
@@ -33,8 +34,11 @@ farrow reload -f farrow.yml       # 停止、重新读配置、收敛
 ```
 
 `start` 启动已停止的 VM 并复查运行中 VM 的就绪状态，不刷新 SSH 客户端配置；`restart`
-使用已应用状态；`reload` 停止后
-重新读取 Inventory，并执行完整的 `up` 路径。
+使用已应用状态；`reload` 先读取 Inventory、检查配置变化与启动依赖，再停止选中节点
+并执行完整的 `up` 路径。
+
+`up`、`start`、`restart`、`reload`、`recreate` 还会刷新运行中 guest 的 Farrow hosts
+和控制节点 SSH 条目。`--no-wait` 跳过就绪检查与 guest 刷新，后续运行 `up` 补齐。
 
 ## 变更 deployment
 
@@ -44,7 +48,11 @@ farrow up                         # 创建/启动选中节点，并安装 SSH 
 farrow recreate node-1            # 应用某个节点的 VM 定义变化
 ```
 
-`recreate` 与 `destroy` 在终端上会要求输入确认词；只在脚本中传 `--force`。
+`plan` 无需先准备宿主，展示镜像、资源总量、变更原因与磁盘影响。CPU/内存等定义
+变化仍通过 recreate 应用，会替换根盘与非持久数据盘，持久盘保留。若多个节点同时
+变化，局部重建受未选节点影响时会提前拒绝，并列出所需节点。
+
+`recreate` 与 `destroy` 在终端上展示磁盘范围并要求输入确认词；脚本可传 `--force`。
 
 | 字段 | 含义 | 操作 |
 |---|---|---|