diff --git a/client/macos/PacketTunnel/PacketTunnel.entitlements b/client/macos/PacketTunnel/PacketTunnel.entitlements
index 0dfbb92..3482818 100644
--- a/client/macos/PacketTunnel/PacketTunnel.entitlements
+++ b/client/macos/PacketTunnel/PacketTunnel.entitlements
@@ -2,11 +2,15 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-	<!-- Packet Tunnel Provider(System Extension 形态:站外 Developer ID 分发用 -systemextension 后缀)。
-	     在 Identifiers → com.pangolin.pangolin.tunnel 勾 Network Extensions 即获得此权限。 -->
+	<!-- 开发期:App Extension 变体,Apple Development 自动签名即可编/签/本机调试。
+	     ⚠️ 上线(站外 Developer ID 分发)时改为 System Extension:
+	        - 把本值换成 packet-tunnel-provider-systemextension
+	        - target 产物类型转 System Extension(.systemextension)
+	        - 用 Developer ID 手动签名 + 公证;首启 systemextensionsctl developer on
+	     Swift 代码两形态一致,仅打包/签名不同。详见 docs/p1-macos-system-extension.md。 -->
 	<key>com.apple.developer.networking.networkextension</key>
 	<array>
-		<string>packet-tunnel-provider-systemextension</string>
+		<string>packet-tunnel-provider</string>
 	</array>
 	<!-- 与主 app 共享配置/状态(同一 App Group) -->
 	<key>com.apple.security.application-groups</key>