diff --git a/docs/reference/secret-placeholder-conventions.md b/docs/reference/secret-placeholder-conventions.md
index 01cfd94c4b3e..bc071c298627 100644
--- a/docs/reference/secret-placeholder-conventions.md
+++ b/docs/reference/secret-placeholder-conventions.md
@@ -18,7 +18,7 @@ Use placeholders that are human-readable but do not resemble real secrets.
 
 ## Avoid these patterns in docs
 
-- Private key sentinels such as `-----BEGIN PRIVATE KEY-----`.
+- Literal PEM private-key header or footer text.
 - Prefixes that resemble live credentials, for example `sk-...`, `xoxb-...`, `AKIA...`.
 - Realistic-looking bearer tokens copied from runtime logs.
 
diff --git a/extensions/signal/src/daemon.test.ts b/extensions/signal/src/daemon.test.ts
index 66aa2b9b52f8..5d993dcd0eb9 100644
--- a/extensions/signal/src/daemon.test.ts
+++ b/extensions/signal/src/daemon.test.ts
@@ -1,12 +1,12 @@
 import os from "node:os";
 import path from "node:path";
 import { describe, expect, it } from "vitest";
-import { __testing } from "./daemon.js";
+import { testApi } from "./daemon.js";
 
 describe("signal daemon args", () => {
   it("expands home-relative configPath before passing it to signal-cli", () => {
     expect(
-      __testing.buildDaemonArgs({
+      testApi.buildDaemonArgs({
         cliPath: "signal-cli",
         configPath: "~/.openclaw/signal-cli",
         httpHost: "127.0.0.1",
diff --git a/extensions/signal/src/daemon.ts b/extensions/signal/src/daemon.ts
index a26e2ce4e131..6e5c877481ac 100644
--- a/extensions/signal/src/daemon.ts
+++ b/extensions/signal/src/daemon.ts
@@ -163,7 +163,7 @@ export function spawnSignalDaemon(opts: SignalDaemonOpts): SignalDaemonHandle {
   };
 }
 
-export const __testing = {
+export const testApi = {
   buildDaemonArgs,
   resolveSignalCliConfigPath,
 } as const;