diff --git a/server/proxy/deploy-proxy.sh b/server/proxy/deploy-proxy.sh
index 7fba7999..d82b748a 100644
--- a/server/proxy/deploy-proxy.sh
+++ b/server/proxy/deploy-proxy.sh
@@ -300,7 +300,8 @@ update() {
 
         # 移除旧的SSL配置 (不再通过Xray回落提供HTTPS)
         for conf in /etc/nginx/sites-enabled/ssl-*.conf; do
-            if [ -f "$conf" ] && grep -q "listen.*443\|listen.*8443" "$conf" 2>/dev/null; then
+            [ -e "$conf" ] || continue
+            if grep -q "listen.*443\|listen.*8443" "$conf" 2>/dev/null; then
                 echo "  移除旧SSL配置: $conf"
                 rm -f "$conf"
             fi
diff --git a/server/proxy/service/subscription-server.js b/server/proxy/service/subscription-server.js
index 4f26ebea..17774048 100644
--- a/server/proxy/service/subscription-server.js
+++ b/server/proxy/service/subscription-server.js
@@ -148,6 +148,8 @@ function generateClashYaml(keys, serverHost) {
   const cnRelayPort = getCnRelayPort();
 
   // CN中转节点 (如果已配置)
+  // 注: CN中转是透明TCP转发(CN:2053 → SG:443)，所以Reality设置仍指向SG的配置
+  // servername/public-key/short-id 与SG直连节点完全相同，因为TLS握手实际发生在SG端
   const cnProxyBlock = cnRelayHost ? `
   - name: "🇨🇳 铸渊专线-CN中转"
     type: vless
diff --git a/server/proxy/setup/setup-cn-relay.sh b/server/proxy/setup/setup-cn-relay.sh
index 85434c6e..68dc64c1 100644
--- a/server/proxy/setup/setup-cn-relay.sh
+++ b/server/proxy/setup/setup-cn-relay.sh
@@ -22,6 +22,8 @@
 # ═══════════════════════════════════════════════
 
 set -uo pipefail
+# 注意: 不使用 set -e，因为 grep/nc 等命令在无匹配时返回非零
+# 关键步骤手动检查错误
 
 # 颜色
 RED='\033[0;31m'