v1.0.27

• An update is called with PATCH again; a read and a create stay POST. All three take a flat JSON body and nothing in the URL. The method must be the action's own: any other answers 405 invalid_request with Allow naming the one method (POST or PATCH), so a POST to an update is refused and does nothing. A query string on an action path is still 400 invalid_request. A write still needs an Idempotency-Key; a read ignores it.
• Each entry of the action index has a method (POST or PATCH) beside its operation (read, create or update).
• The bundled clients' write takes the action's operation after the action name (write(deviceId, system, action, 'create' | 'update', key, input)) and sends POST for a create and PATCH for an update; PendingWrite carries it as operation. Reads are unchanged. Idempotency handling is unchanged.
• The skill's references describe the contract.