@synopackageland/cli 0.10.2 → 0.10.4

package/dist/standalone/root-ops.d.ts

@@ -27,8 +27,9 @@ export declare function loadRootOps(dir: string): RootOpsResult;
 export declare function rootBinaryProblem(ops: readonly RootOp[], settings: RootSettings | undefined, arches: readonly NativeArchFamily[]): string | undefined;
 /**
  * dsm-package.yaml `root`: `programs.<name>` gives a root/ program its kind,
- * params schema and run or job limits; `stop` names the program the executor
- * runs at package stop and upgrade; `state: true` gives root programs a
+ * params schema and run or job limits; `start` names the program the executor
+ * runs once after each install or upgrade, `stop` the one it runs at package
+ * stop and upgrade; `state: true` gives root programs a
  * directory only root can read. Returns why the settings are refused.
  */
 export declare function readRootSettings(value: unknown, ops: readonly RootOp[] | undefined): {

package/dist/standalone/root-ops.js

@@ -91,12 +91,13 @@ function readRootOp(path, file) {
     }
     return { name, body };
 }
-const ROOT_SETTINGS_FIELDS = ["programs", "stop", "state"];
+const ROOT_SETTINGS_FIELDS = ["programs", "start", "stop", "state"];
 const PROGRAM_FIELDS = ["kind", "schema", "run", "job"];
 /**
  * dsm-package.yaml `root`: `programs.<name>` gives a root/ program its kind,
- * params schema and run or job limits; `stop` names the program the executor
- * runs at package stop and upgrade; `state: true` gives root programs a
+ * params schema and run or job limits; `start` names the program the executor
+ * runs once after each install or upgrade, `stop` the one it runs at package
+ * stop and upgrade; `state: true` gives root programs a
  * directory only root can read. Returns why the settings are refused.
  */
 export function readRootSettings(value, ops) {
@@ -118,6 +119,11 @@ export function readRootSettings(value, ops) {
         if (problem)
             return fail(`programs.${name}: ${problem}`);
     }
+    if (raw.start !== undefined && (typeof raw.start !== "string" || !names.has(raw.start)))
+        return fail(`start must be a program name in root/, not ${JSON.stringify(raw.start)}.`);
+    const start = typeof raw.start === "string" ? programs[raw.start] : undefined;
+    if (start && (start.run !== undefined || start.job !== undefined))
+        return fail(`start: root program ${raw.start} runs once after each install or upgrade and cannot also declare run or job; give the session work another program name.`);
     if (raw.stop !== undefined && (typeof raw.stop !== "string" || !names.has(raw.stop)))
         return fail(`stop must be a program name in root/, not ${JSON.stringify(raw.stop)}.`);
     if (raw.state !== undefined && raw.state !== true)

package/dist/standalone/root-window.d.ts

@@ -3,13 +3,13 @@ export { type ExecutorTask as RootTask } from '../runtime/executor-tasks.js';
  * across both Root APIs, and never persisted (DSM validity is about 300 seconds). */
 export declare const ROOT_RUNTIME: string;
 type PanelLocale = "en" | "zh-TW" | "zh-CN" | "ja" | "ko" | "de" | "fr" | "es" | "it";
-/** The plain-UI window panel's text; a state's reason stays the runtime's English detail. */
+/** The plain-UI window panel's text: a state, and a result's code and outcome; reason stays the runtime's English detail. */
 export declare const ROOT_PANEL_MESSAGES: Record<string, Record<PanelLocale, string>>;
 /** ROOT_PANEL_MESSAGES as createI18n catalogs, one per locale. */
 export declare function rootPanelCatalogs(): Record<string, Record<string, string>>;
 /** The plain-UI approval panel: it asks for the password itself and passes it
  * to `access.authorize`, the same PasswordConfirm path as ExecutorSettings. */
-export declare const ROOT_PANEL = "function mountRootPanel(host, access, t, admin) {\n  if (!admin) return;\n  function el(tag, className) { var e = document.createElement(tag); if (className) e.className = className; return e; }\n  var panel = el(\"div\", \"dsmapp-rootpanel\"), title = el(\"h2\"), status = el(\"p\"), reason = el(\"p\", \"dsmapp-rootpanel-hint\");\n  var form = el(\"form\"), label = el(\"label\"), password = el(\"input\"), actions = el(\"div\", \"dsmapp-rootpanel-actions\");\n  var approve = el(\"button\", \"dsmapp-rootpanel-primary\"), check = el(\"button\");\n  title.textContent = t(\"title\"); label.textContent = t(\"password\");\n  password.type = \"password\"; password.autocomplete = \"current-password\";\n  approve.type = \"submit\"; approve.textContent = t(\"approve\");\n  check.type = \"button\"; check.textContent = t(\"check\");\n  label.appendChild(password); actions.appendChild(approve); actions.appendChild(check);\n  form.appendChild(label); form.appendChild(actions);\n  panel.appendChild(title); panel.appendChild(status); panel.appendChild(reason); panel.appendChild(form);\n  host.appendChild(panel);\n  function show(result) {\n    status.textContent = t(\"state.\" + result.state);\n    reason.textContent = result.reason || \"\"; reason.hidden = !result.reason;\n    label.hidden = approve.hidden = result.state !== \"needs-admin-approval\" && result.retry !== true;\n  }\n  function run(fn) { approve.disabled = check.disabled = true; return fn().then(show, function(e) { show({state: \"blocked\", reason: e.message || e.code}); }).then(function() { approve.disabled = check.disabled = false; }); }\n  access.subscribe(show);\n  form.onsubmit = function(event) {\n    if (event) event.preventDefault();\n    var entered = password.value; password.value = \"\";\n    if (!entered) return Promise.resolve();\n    return run(function() { return access.authorize(entered); });\n  };\n  check.onclick = function() { return run(function() { return access.status(); }); };\n  run(function() { return access.status().then(function(result) { return result.tasks && result.tasks.boot && result.tasks.control && result.tasks.boot.state === \"ready\" && result.tasks.control.state === \"ready\" ? access.control(\"start\") : result; }); });\n}";
+export declare const ROOT_PANEL = "function mountRootPanel(host, access, t, admin) {\n  if (!admin) return;\n  function el(tag, className) { var e = document.createElement(tag); if (className) e.className = className; return e; }\n  var panel = el(\"div\", \"dsmapp-rootpanel\"), title = el(\"h2\"), status = el(\"p\"), reason = el(\"p\", \"dsmapp-rootpanel-hint\");\n  var form = el(\"form\"), label = el(\"label\"), password = el(\"input\"), actions = el(\"div\", \"dsmapp-rootpanel-actions\");\n  var approve = el(\"button\", \"dsmapp-rootpanel-primary\"), check = el(\"button\");\n  title.textContent = t(\"title\"); label.textContent = t(\"password\");\n  password.type = \"password\"; password.autocomplete = \"current-password\";\n  approve.type = \"submit\"; approve.textContent = t(\"approve\");\n  check.type = \"button\"; check.textContent = t(\"check\");\n  label.appendChild(password); actions.appendChild(approve); actions.appendChild(check);\n  form.appendChild(label); form.appendChild(actions);\n  panel.appendChild(title); panel.appendChild(status); panel.appendChild(reason); panel.appendChild(form);\n  host.appendChild(panel);\n  // The code and outcome in the DSM language, then the DSM code the English reason starts with.\n  function explain(result) {\n    if (!result.reason && !result.code) return \"\";\n    var parts = [t(\"reason.\" + (result.code || \"failed\"))];\n    if (result.outcome) parts.push(t(\"outcome.\" + result.outcome));\n    var detail = /^([A-Za-z0-9_]+):/.exec(result.reason || \"\");\n    if (detail) parts.push(\"(\" + detail[1] + \")\");\n    return parts.reduce(function (text, part) { return text + (/[\u3000-\u30FF\u4E00-\u9FFF\uAC00-\uD7AF\uFF00-\uFFEF]$/.test(text) ? \"\" : \" \") + part; });\n  }\n  function show(result) {\n    status.textContent = t(\"state.\" + result.state);\n    reason.textContent = explain(result); reason.hidden = !reason.textContent;\n    label.hidden = approve.hidden = result.state !== \"needs-admin-approval\" && result.retry !== true;\n  }\n  // A start step can hold the background service for up to a minute.\n  function run(fn) { approve.disabled = check.disabled = true; reason.textContent = t(\"working\"); reason.hidden = false; return fn().then(show, function(e) { show({state: \"blocked\", reason: e && e.code ? e.code + \":\" : \"\", code: \"failed\"}); }).then(function() { approve.disabled = check.disabled = false; }); }\n  access.subscribe(show);\n  form.onsubmit = function(event) {\n    if (event) event.preventDefault();\n    var entered = password.value; password.value = \"\";\n    if (!entered) return Promise.resolve();\n    return run(function() { return access.authorize(entered); });\n  };\n  check.onclick = function() { return run(function() { return access.status(); }); };\n  run(function() { return access.status().then(function(result) { return result.tasks && result.tasks.boot && result.tasks.control && result.tasks.boot.state === \"ready\" && result.tasks.control.state === \"ready\" ? access.control(\"start\") : result; }); });\n}";
 /** Administrator password confirmation in the window's own session, for the
  * password an approval panel collected. */
 export declare const PASSWORD_CONFIRM: string;

package/dist/standalone/root-window.js

@@ -12,8 +12,29 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
     var code = String(e && e.code || "executor_bad_response");
     if (e && e.passwordConfirm) return code + (code === "dsm_3121" ? ": DSM rejected the administrator password." : ": administrator password confirmation failed.") + " Nothing was created.";
     if (e && e.detail) return code + ": " + e.detail;
+    if (["dsm_106","dsm_107","dsm_119"].indexOf(code) >= 0) return code + ": the DSM session ended. Sign in to DSM again, then approve again.";
     return code + (code === "105" || code === "dsm_105" ? ": DSM denied administrator scheduler access. Check the DSM session and scheduler; a NAS restart resolved this on the measured DSM. No automatic retry was made." : ": scheduler readback or operation failed.");
   }
+  // What a result's code says, for the window panel and the SDK to translate;
+  // reason keeps the English detail. fallback names a step's own failure.
+  function codeOf(e, fallback) {
+    var code = String(e && e.code || "");
+    if (e && e.passwordConfirm) return code === "dsm_3121" ? "password_rejected" : code === "password_required" ? "password_required" : ["dsm_106","dsm_107","dsm_119"].indexOf(code) >= 0 ? "session_ended" : "password_confirm_failed";
+    if (e && e.task) return e.task;
+    if (["dsm_106","dsm_107","dsm_119"].indexOf(code) >= 0) return "session_ended";
+    if (code === "admin_required") return code;
+    if (code === "executor_confirmation_missing") return "password_confirm_failed";
+    if (code === "executor_starting") return code;
+    if (e && e.detail) return /other digests/.test(e.detail) ? "executor_mismatch" : "executor_unreachable";
+    if (code.indexOf("executor_selection") === 0) return "selection_failed";
+    if (fallback) return fallback;
+    if (code === "105" || code === "dsm_105") return "scheduler_denied";
+    if (["102","103","104","dsm_102","dsm_103","dsm_104"].indexOf(code) >= 0) return "scheduler_unsupported";
+    return "scheduler_failed";
+  }
+  function block(result, e, fallback) { result.state = "blocked"; result.reason = reason(e); result.code = codeOf(e, fallback); return result; }
+  // A find result that stops an approval, with its code.
+  function refused(current) { var e = fail(current.reason); e.task = current.code; return e; }
   // AppWindow.sendWebAPI encodes JSON parameters. Preserve their native types;
   // pre-encoding turns objects/booleans into strings and DSM rejects create.
   function send(api, method, version, params) { return options.send(api, method, version, params || {}); }
@@ -37,37 +58,62 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
     var boot = task.kind === "boot";
     return send(boot ? eventAPI : taskAPI, "delete", boot ? 1 : 2, boot ? ref : {tasks: [ref]});
   }
-  function admin() { if (!options.user() || options.user().admin !== true) throw fail("admin_required"); }
-  function find(task) {
+  function isAdmin() { return !!options.user() && options.user().admin === true; }
+  function admin() { if (!isAdmin()) throw fail("admin_required"); }
+  function missing() { return {state: "needs-admin-approval", reason: "Task is missing.", code: "task_missing"}; }
+  // EventScheduler keys a task by its name (DSM refuses a second one with 117
+  // DUPLICATE_PRIMARY_KEY) and get answers no data for a missing name, so get
+  // alone finds it. Task Scheduler names repeat: a list finds the id and
+  // refuses duplicates, and later cached reads get that id until it fails.
+  var listed = {};
+  function locate(task, cached) {
+    if (task.kind === "boot") return Promise.resolve({task_name: task.name});
+    if (cached && listed[task.name] !== undefined) return Promise.resolve({id: listed[task.name], real_owner: "root", cached: true});
+    return taskRead("list", 3, {start: 0, limit: 500}, 2, {offset: 0, limit: 500}).then(function (data) {
+      var records = data && data.tasks;
+      if (!Array.isArray(records) || records.length > 500 || !Number.isInteger(data.total) || data.total !== records.length) throw fail("executor_bad_response");
+      var named = records.filter(function (r) { return r && r.name === task.name; });
+      delete listed[task.name];
+      if (!named.length) return null;
+      if (named.length !== 1) return {duplicate: true};
+      if (!/^[0-9]+$/.test(String(named[0].id))) throw fail("executor_bad_response");
+      listed[task.name] = named[0].id;
+      return {id: named[0].id, real_owner: "root"};
+    });
+  }
+  // cached: get the control task by the id an earlier list in this window showed.
+  function find(task, cached) {
     var boot = task.kind === "boot";
-    return (boot ? send(eventAPI, "list", 1, {}) : taskRead("list", 3, {start: 0, limit: 500}, 2, {offset: 0, limit: 500})).then(function (data) {
-      var records = boot ? data : data && data.tasks;
-      if (!Array.isArray(records) || records.length > 500 || (!boot && (!Number.isInteger(data.total) || data.total !== records.length))) throw fail("executor_bad_response");
-      var named = records.filter(function (r) { return r && (boot ? r.task_name : r.name) === task.name; });
-      if (!named.length) return {state: "needs-admin-approval", reason: "Task is missing."};
-      if (named.length !== 1) return {state: "blocked", reason: "Duplicate task names."};
-      var summary = named[0];
-      if (!boot && !/^[0-9]+$/.test(String(summary.id))) throw fail("executor_bad_response");
-      var ref = boot ? {task_name: task.name} : {id: summary.id, real_owner: "root"};
+    return locate(task, cached).then(function (located) {
+      if (!located) return missing();
+      if (located.duplicate) return {state: "blocked", reason: "Duplicate task names.", code: "task_duplicate"};
+      var ref = boot ? located : {id: located.id, real_owner: "root"};
       var detail = boot ? send(eventAPI, "get", 1, ref) : taskRead("get", 4, ref, 3, ref);
+      // A cached id that is gone or now names another task is listed again.
+      if (located.cached) detail = detail.then(function (r) { if (!r || r.name !== task.name || String(r.id) !== String(ref.id)) throw {relist: true}; return r; });
       return detail.then(function (r) {
+        if (boot && (r === undefined || r === null || (typeof r === "object" && !Object.keys(r).length))) return missing();
         var owner = r && r.owner;
         var root = owner === "root" || (boot && owner && owner["0"] === "root");
         var script = boot ? r && r.operation : r && r.extra && r.extra.script;
-        if (!r || (boot ? r.task_name !== task.name : String(r.id) !== String(ref.id) || r.name !== task.name) || !root || (!boot && (r.real_owner !== "root" || r.enable !== false || r.type !== "script")) || (boot && (r.enable !== true || r.event !== "bootup" || r.operation_type !== "script")) || typeof script !== "string") return {state: "blocked", reason: "Task ownership or definition cannot be verified."};
+        if (!r || (boot ? r.task_name !== task.name : String(r.id) !== String(ref.id) || r.name !== task.name) || !root || (!boot && (r.real_owner !== "root" || r.enable !== false || r.type !== "script")) || (boot && (r.enable !== true || r.event !== "bootup" || r.operation_type !== "script")) || typeof script !== "string") return {state: "blocked", reason: "Task ownership or definition cannot be verified.", code: "task_unverified"};
         if (script === task.script) return {state: "ready", ref: ref};
-        if (script.indexOf(task.header) === 0) return {state: "needs-admin-approval", ref: ref, reason: "Approved digests differ."};
-        return {state: "blocked", reason: "Same-named task has an unrelated script."};
+        if (script.indexOf(task.header) === 0) return {state: "needs-admin-approval", ref: ref, script: script, reason: "Approved digests differ.", code: "task_outdated"};
+        return {state: "blocked", reason: "Same-named task has an unrelated script.", code: "task_conflict"};
+      }, function (e) {
+        if (!located.cached || !(e && (e.relist || e.code === "dsm_4801"))) throw e;
+        delete listed[task.name];
+        return find(task, false);
       });
-    }).catch(function (e) { return {state: ["102","103","104","dsm_102","dsm_103","dsm_104"].indexOf(String(e && e.code)) >= 0 ? "unsupported" : "blocked", reason: reason(e)}; });
+    }).catch(function (e) { return {state: ["102","103","104","dsm_102","dsm_103","dsm_104"].indexOf(String(e && e.code)) >= 0 ? "unsupported" : "blocked", reason: reason(e), code: codeOf(e)}; });
   }
-  function read() {
-    try { admin(); } catch (e) { return Promise.resolve({state: "blocked", reason: reason(e), tasks: {}}); }
-    return Promise.all(options.tasks.map(find)).then(function (found) {
+  function read(cached) {
+    try { admin(); } catch (e) { return Promise.resolve(block({tasks: {}}, e)); }
+    return Promise.all(options.tasks.map(function (task) { return find(task, cached === true); })).then(function (found) {
       var result = {state: "ready", tasks: {}};
       options.tasks.forEach(function (t, i) {
         result.tasks[t.kind] = found[i];
-        if (found[i].state === "blocked" || (found[i].state !== "ready" && result.state === "ready")) { result.state = found[i].state; result.reason = found[i].reason; }
+        if (found[i].state === "blocked" || (found[i].state !== "ready" && result.state === "ready")) { result.state = found[i].state; result.reason = found[i].reason; result.code = found[i].code; }
       });
       return result;
     });
@@ -82,6 +128,18 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
       }).catch(function (e) { failed = reason(e); });
     }, Promise.resolve()).then(function () { return failed; });
   }
+  // Undoes one approval: withdraws what it created, then recreates, newest
+  // first, the earlier approval's tasks it removed. Resolves like withdraw.
+  function rollback(created, removed, confirmation) {
+    return withdraw(created).then(function (failed) {
+      return removed.reduceRight(function (restored, earlier) {
+        return restored.then(function () { return find(earlier); }).then(function (current) {
+          if (current.state === "blocked") throw refused(current);
+          if (!current.ref) return create(earlier.kind === "boot", definition(earlier), confirmation);
+        }).catch(function (e) { failed = reason(e); });
+      }, Promise.resolve()).then(function () { return failed; });
+    });
+  }
   function definition(task) { return task.kind === "boot" ? (${bootDefinition.toString()})(task) : (${controlDefinition.toString()})(task); }
   function approve(password, selectedScope) {
     var selectionTask;
@@ -95,29 +153,44 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
         if (!confirmation || confirmation.confirmed !== true) return {state: "cancelled", tasks: before.tasks};
         // DSM 7.1 confirms the password server-side but issues no create token.
         if (!legacy && (typeof confirmation.token !== "string" || !confirmation.token)) throw fail("executor_confirmation_missing");
-        var errors = {}, created = [], withdrawFailed;
+        var errors = {}, created = [], removed = [], withdrawFailed;
         // Delete only a verified, same-header outdated task, then create the pinned
-        // replacement. set has no measured wire contract. Re-read before each write.
+        // replacement. set has no measured wire contract, and a same-named task
+        // cannot be created first. The boot task keeps this approval's first
+        // read: EventScheduler get by name is the whole lookup, it was made in
+        // this step moments ago, and delete and create address the name. A
+        // control task to delete is read again by the id that read listed
+        // (spec/scheduler/v1); a missing one keeps the first read: DSM refuses a
+        // second boot task name, and the readback after the writes lists control
+        // tasks for duplicates. Stop at the first error.
         var chain = Promise.resolve();
         options.tasks.forEach(function (task) {
           chain = chain.then(function () {
-            return find(task).then(function (current) {
+            if (Object.keys(errors).length) return;
+            var first = before.tasks[task.kind];
+            return (first.ref && task.kind !== "boot" ? find(task, true) : Promise.resolve(first)).then(function (current) {
               if (current.state === "ready") return;
-              if (current.state === "blocked") throw fail(current.reason);
-              var removed = current.ref ? remove(task, current.ref) : Promise.resolve();
-              return removed.then(function () { return create(task.kind === "boot", definition(task), confirmation); }).then(function () { created.push(task); });
-            }).catch(function (e) { errors[task.kind] = reason(e); });
+              if (current.state === "blocked") throw refused(current);
+              var deleted = current.ref ? remove(task, current.ref).then(function () { removed.push({kind: task.kind, name: task.name, header: task.header, script: current.script}); }) : Promise.resolve();
+              return deleted.then(function () { return create(task.kind === "boot", definition(task), confirmation); }).then(function () { created.push(task); });
+            }).catch(function (e) { errors[task.kind] = e; });
           });
         });
         // A partial approval must not leave an enabled root bootup task that no
-        // control task or uninstall inventory owns: withdraw what it created.
+        // control task or uninstall inventory owns, nor lose the earlier approval:
+        // roll back to it. A retry converges from whatever the rollback left.
         return chain.then(function () {
-          if (Object.keys(errors).length) return withdraw(created).then(function (failed) { withdrawFailed = failed; });
-        }).then(read).then(function (after) {
+          if (Object.keys(errors).length) return rollback(created, removed, confirmation).then(function (failed) { withdrawFailed = failed; });
+        }).then(function () { return read(true); }).then(function (after) {
           Object.keys(errors).forEach(function (kind) {
-            if (after.tasks[kind].state !== "ready") { after.tasks[kind].state = "blocked"; after.tasks[kind].reason = errors[kind]; after.state = "blocked"; after.reason = errors[kind]; }
+            if (after.tasks[kind].state !== "ready") { block(after.tasks[kind], errors[kind]); block(after, errors[kind]); }
           });
-          if (withdrawFailed) { after.state = "blocked"; after.reason = (after.reason ? after.reason + " " : "") + "Withdrawing the tasks this approval created failed: " + withdrawFailed; }
+          if (withdrawFailed) { after.state = "blocked"; after.reason = (after.reason ? after.reason + " " : "") + (removed.length ? "Restoring the earlier approval failed: " : "Withdrawing the tasks this approval created failed: ") + withdrawFailed; after.outcome = removed.length ? "restore_failed" : "withdraw_failed"; }
+          else if (Object.keys(errors).length && after.state !== "ready") {
+            var restored = Object.keys(before.tasks).some(function (kind) { return before.tasks[kind].ref; });
+            after.reason += restored ? " The earlier approval was restored." : " The tasks this approval created were withdrawn.";
+            after.outcome = restored ? "restored" : "withdrawn"; after.retry = true;
+          }
           // A scope change must not restart a running executor: the boot task
           // stops it, which interrupts in-flight copies instead of canceling them.
           return after.state === "ready" ? (selectionTask ? running(after) : Promise.resolve(null)).then(function (live) { return live || start(after); }).then(function (started) {
@@ -128,6 +201,7 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
               return read().then(function (current) {
                 current.state = "blocked";
                 current.reason = started.reason + (failed ? " Withdrawing the tasks this approval created failed: " + failed : " The tasks this approval created were withdrawn.");
+                current.code = started.code; current.outcome = failed ? "withdraw_failed" : "withdrawn";
                 current.retry = !failed;
                 return current;
               });
@@ -141,7 +215,7 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
             // app converge by readback: applied once status().executor.selection
             // shows this scope above this generation. A resubmit is pinned and safe.
             return selectScope(selectionTask, confirmation, started, selectedScope).catch(function (e) {
-              return {state: "blocked", reason: reason(e), tasks: started.tasks, requested: {scope: selectedScope, generation: generation}};
+              return block({tasks: started.tasks, requested: {scope: selectedScope, generation: generation}}, e, "selection_failed");
             });
           }) : after;
         });
@@ -157,9 +231,10 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
     }
     // The task waits up to 35 s for the executor, whose account, AppPriv and
     // share lookups took 16-20 s on a measured NAS: read back for 40 s,
-    // backing off from 500 ms to 2 s like health.
+    // backing off from 500 ms to 1 s, so the window closes within a second
+    // of the selection landing.
     function readSelection(budget, delay) {
-      delay = Math.min(delay || 500, 2000);
+      delay = Math.min(delay || 500, 1000);
       verified.state = "ready";
       return health(verified, 0).then(function (current) {
         if (current.state === "ready" && current.executor.selection && current.executor.selection.scope === selectedScope && Number.isSafeInteger(current.executor.selection.generation) && current.executor.selection.generation > 0) return current;
@@ -203,65 +278,118 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
   // A started executor answered only after its own DSM lookups, which took
   // 16-20 s on a measured NAS; giving up withdraws a fresh approval.
   var startBudget = 30000;
-  // budget: how long to keep asking after a start (ms). The wait doubles from
-  // 500 ms to 2 s so an open window does not poll the executor twice a second.
-  function health(verified, budget, delay) {
-    if (verified.state !== "ready") return Promise.resolve(verified);
-    delay = Math.min(delay || 500, 2000);
+  // The pinned executor listens before its package start step, which runs as
+  // root for at most 60 s and answers state "starting" until it ends.
+  var stepBudget = 75000;
+  function starting(status) { return !!status && status.state === "starting" && status.executor_digest === (options.pins && options.pins.executorDigest) && status.policy_digest === options.pins.policyDigest; }
+  // The approved executor's status. budget: how long to keep asking after a
+  // start (ms); a start step's own wait is step. An executor without a start
+  // step answered 1.8-3 s after run on a measured NAS: ask every 500 ms for
+  // the first 4 s, then double to 2 s so an open window does not poll the
+  // executor twice a second.
+  function alive(budget, delay, step, waited) {
+    waited = waited || 0;
+    delay = waited < 4000 ? 500 : Math.min(delay * 2, 2000);
+    step = step === undefined ? stepBudget : step;
     return options.call("executor.status", {}).then(function (status) {
+      if (starting(status)) throw fail("executor_starting", "the executor's start step has not ended.");
       var why = mismatch(status);
       if (why) throw fail("executor_status_mismatch", why);
-      verified.executor = status; return verified;
+      return status;
     }, function (e) {
       throw fail(e && e.code, "the executor status request failed.");
     }).catch(function (e) {
-      if (budget >= delay && options.wait) return options.wait(delay).then(function () { return health(verified, budget - delay, delay * 2); });
+      var steps = e.code === "executor_starting";
+      if ((steps ? step : budget) >= delay && options.wait) return options.wait(delay).then(function () { return steps ? alive(budget, delay, step - delay, waited + delay) : alive(budget - delay, delay, step, waited + delay); });
+      throw e;
+    });
+  }
+  function health(verified, budget) {
+    if (verified.state !== "ready") return Promise.resolve(verified);
+    return settle(verified, alive(budget));
+  }
+  function settle(verified, status) {
+    return status.then(function (current) { verified.executor = current; return verified; }, function (e) {
       // The tasks are approved: approving again runs start, which restarts the
       // executor without a password, so the panel offers it.
-      verified.state = "blocked"; verified.reason = reason(e); verified.retry = true; return verified;
+      block(verified, e); verified.retry = true; return verified;
     });
   }
   function start(verified) {
     return options.call("executor.control", {action: "start"}).then(function () {
       return send(eventAPI, "run", 1, verified.tasks.boot.ref);
-    }).then(function () {
-      // run can succeed for a nonexistent task. Read both definitions again.
-      return read().then(function (after) { return health(after, startBudget); });
-    }).catch(function (e) { verified.state = "blocked"; verified.reason = reason(e); return verified; });
+    }).then(function () { return started(verified); }).catch(function (e) { return block(verified, e, "executor_start_failed"); });
   }
+  // Every run follows an exact readback of both tasks in the same step, and a
+  // run of a missing task leaves no pinned executor to answer: only the
+  // executor status is asked after it.
+  function started(verified) { return settle(verified, alive(startBudget)); }
   // The window panel and the app's own settings share this access; each
   // result reaches every view so neither shows a stale state.
   var listeners = [];
   function publish(result) { listeners.forEach(function (listener) { listener(result); }); return result; }
+  // TaskScheduler answers administrators only. Anyone else reads the approved
+  // executor through the App's executor.status, which answers every user: the
+  // pinned, running executor is ready; otherwise an administrator is needed.
+  function userStatus() {
+    var needed = block({tasks: {}}, fail("admin_required"));
+    return options.call("executor.status", {}).then(function (status) {
+      return pinned(status) ? {state: "ready", tasks: {}, executor: status} : needed;
+    }, function () { return needed; });
+  }
   return {
-    status: function () { return read().then(function (verified) { return health(verified, 0); }).then(publish); },
+    status: function () { return (isAdmin() ? read().then(function (verified) { return health(verified, 0); }) : userStatus()).then(publish); },
     authorize: function (password, selectedScope) {
-      if (!busy) busy = Promise.resolve().then(function () { return approve(password, selectedScope); }).catch(function (e) { return {state: "blocked", reason: reason(e), tasks: {}, retry: !!(e && e.passwordConfirm)}; }).then(function (r) { busy = null; return publish(r); });
+      if (!busy) busy = Promise.resolve().then(function () { return approve(password, selectedScope); }).catch(function (e) { var r = block({tasks: {}}, e); r.retry = !!(e && e.passwordConfirm); return r; }).then(function (r) { busy = null; return publish(r); });
       return busy;
     },
     control: function (action) {
       if (["start", "stop", "purge"].indexOf(action) < 0) return Promise.reject(fail("executor_control_invalid"));
-      return read().then(function (verified) {
+      return read(true).then(function (verified) {
         if (verified.state !== "ready") throw fail("executor_not_ready");
         return options.call("executor.control", {action: action}).then(function () {
           return send(taskAPI, "run", 2, {tasks: [verified.tasks.control.ref]});
-        }).then(read).then(function (after) { return action === "start" ? health(after, startBudget) : after; });
+        }).then(function () { return action === "start" ? started(verified) : read(true); });
       }).then(publish);
     },
     subscribe: function (listener) { listeners.push(listener); }
   };
 }`;
-/** The plain-UI window panel's text; a state's reason stays the runtime's English detail. */
+/** The plain-UI window panel's text: a state, and a result's code and outcome; reason stays the runtime's English detail. */
 export const ROOT_PANEL_MESSAGES = {
     title: { en: "Background access", "zh-TW": "背景存取", "zh-CN": "后台访问", ja: "バックグラウンドアクセス", ko: "백그라운드 액세스", de: "Hintergrundzugriff", fr: "Accès en arrière-plan", es: "Acceso en segundo plano", it: "Accesso in background" },
     password: { en: "DSM administrator password", "zh-TW": "DSM 管理員密碼", "zh-CN": "DSM 管理员密码", ja: "DSM 管理者パスワード", ko: "DSM 관리자 비밀번호", de: "DSM-Administratorkennwort", fr: "Mot de passe administrateur DSM", es: "Contraseña de administrador de DSM", it: "Password amministratore DSM" },
     approve: { en: "Approve", "zh-TW": "核准", "zh-CN": "批准", ja: "承認", ko: "승인", de: "Genehmigen", fr: "Approuver", es: "Aprobar", it: "Approva" },
     check: { en: "Check status", "zh-TW": "檢查狀態", "zh-CN": "检查状态", ja: "状態を確認", ko: "상태 확인", de: "Status prüfen", fr: "Vérifier l'état", es: "Comprobar estado", it: "Verifica stato" },
+    working: { en: "Waiting for the background service. This can take up to a minute while it starts.", "zh-TW": "正在等候背景服務，啟動時最多可能需要一分鐘。", "zh-CN": "正在等候后台服务，启动时最多可能需要一分钟。", ja: "バックグラウンドサービスを待機しています。開始時は最大 1 分かかることがあります。", ko: "백그라운드 서비스를 기다리는 중입니다. 시작할 때 최대 1분이 걸릴 수 있습니다.", de: "Warten auf den Hintergrunddienst. Beim Start kann dies bis zu einer Minute dauern.", fr: "En attente du service en arrière-plan. Son démarrage peut prendre jusqu'à une minute.", es: "Esperando al servicio en segundo plano. Al iniciarse puede tardar hasta un minuto.", it: "In attesa del servizio in background. All'avvio può richiedere fino a un minuto." },
     "state.ready": { en: "Approved and running.", "zh-TW": "已核准，正在執行。", "zh-CN": "已批准，正在运行。", ja: "承認済みで、実行中です。", ko: "승인되었으며 실행 중입니다.", de: "Genehmigt und aktiv.", fr: "Approuvé et actif.", es: "Aprobado y en ejecución.", it: "Approvato e in esecuzione." },
     "state.needs-admin-approval": { en: "Needs administrator approval.", "zh-TW": "需要管理員核准。", "zh-CN": "需要管理员批准。", ja: "管理者の承認が必要です。", ko: "관리자 승인이 필요합니다.", de: "Genehmigung durch einen Administrator erforderlich.", fr: "Approbation d'un administrateur requise.", es: "Requiere la aprobación de un administrador.", it: "Richiede l'approvazione di un amministratore." },
     "state.blocked": { en: "Not available.", "zh-TW": "目前無法使用。", "zh-CN": "目前无法使用。", ja: "現在は利用できません。", ko: "현재 사용할 수 없습니다.", de: "Derzeit nicht verfügbar.", fr: "Indisponible pour le moment.", es: "No disponible por ahora.", it: "Non disponibile al momento." },
     "state.unsupported": { en: "This DSM does not support background access.", "zh-TW": "這台 DSM 不支援背景存取。", "zh-CN": "此 DSM 不支持后台访问。", ja: "この DSM はバックグラウンドアクセスに対応していません。", ko: "이 DSM은 백그라운드 액세스를 지원하지 않습니다.", de: "Dieses DSM unterstützt keinen Hintergrundzugriff.", fr: "Ce DSM ne prend pas en charge l'accès en arrière-plan.", es: "Este DSM no admite el acceso en segundo plano.", it: "Questo DSM non supporta l'accesso in background." },
     "state.cancelled": { en: "Approval was cancelled.", "zh-TW": "已取消核准。", "zh-CN": "已取消批准。", ja: "承認はキャンセルされました。", ko: "승인이 취소되었습니다.", de: "Genehmigung abgebrochen.", fr: "Approbation annulée.", es: "Aprobación cancelada.", it: "Approvazione annullata." },
+    "reason.password_rejected": { en: "DSM rejected the administrator password. Nothing was changed.", "zh-TW": "DSM 拒絕了管理員密碼，沒有做任何變更。", "zh-CN": "DSM 拒绝了管理员密码，没有做任何更改。", ja: "DSM が管理者パスワードを拒否しました。何も変更されていません。", ko: "DSM에서 관리자 비밀번호를 거부했습니다. 변경된 내용은 없습니다.", de: "DSM hat das Administratorkennwort abgelehnt. Es wurde nichts geändert.", fr: "DSM a refusé le mot de passe administrateur. Rien n'a été modifié.", es: "DSM rechazó la contraseña de administrador. No se ha cambiado nada.", it: "DSM ha rifiutato la password amministratore. Non è stato modificato nulla." },
+    "reason.password_required": { en: "Enter the DSM administrator password.", "zh-TW": "請輸入 DSM 管理員密碼。", "zh-CN": "请输入 DSM 管理员密码。", ja: "DSM 管理者パスワードを入力してください。", ko: "DSM 관리자 비밀번호를 입력하십시오.", de: "Geben Sie das DSM-Administratorkennwort ein.", fr: "Saisissez le mot de passe administrateur DSM.", es: "Introduzca la contraseña de administrador de DSM.", it: "Immettere la password amministratore DSM." },
+    "reason.password_confirm_failed": { en: "DSM could not confirm the administrator password. Nothing was changed.", "zh-TW": "DSM 無法確認管理員密碼，沒有做任何變更。", "zh-CN": "DSM 无法确认管理员密码，没有做任何更改。", ja: "DSM で管理者パスワードを確認できませんでした。何も変更されていません。", ko: "DSM에서 관리자 비밀번호를 확인할 수 없습니다. 변경된 내용은 없습니다.", de: "DSM konnte das Administratorkennwort nicht bestätigen. Es wurde nichts geändert.", fr: "DSM n'a pas pu confirmer le mot de passe administrateur. Rien n'a été modifié.", es: "DSM no pudo confirmar la contraseña de administrador. No se ha cambiado nada.", it: "DSM non ha potuto confermare la password amministratore. Non è stato modificato nulla." },
+    "reason.session_ended": { en: "The DSM session ended. Sign in to DSM again, then approve again.", "zh-TW": "DSM 工作階段已結束。請重新登入 DSM 後再核准一次。", "zh-CN": "DSM 会话已结束。请重新登录 DSM 后再批准一次。", ja: "DSM セッションが終了しました。DSM に再度サインインしてから、もう一度承認してください。", ko: "DSM 세션이 종료되었습니다. DSM에 다시 로그인한 후 다시 승인하십시오.", de: "Die DSM-Sitzung ist abgelaufen. Melden Sie sich erneut bei DSM an und genehmigen Sie dann erneut.", fr: "La session DSM a expiré. Reconnectez-vous à DSM, puis approuvez de nouveau.", es: "La sesión de DSM ha finalizado. Vuelva a iniciar sesión en DSM y apruebe de nuevo.", it: "La sessione DSM è terminata. Accedere di nuovo a DSM, quindi approvare di nuovo." },
+    "reason.admin_required": { en: "Only a DSM administrator can approve.", "zh-TW": "只有 DSM 管理員可以核准。", "zh-CN": "只有 DSM 管理员可以批准。", ja: "承認できるのは DSM 管理者のみです。", ko: "DSM 관리자만 승인할 수 있습니다.", de: "Nur ein DSM-Administrator kann genehmigen.", fr: "Seul un administrateur DSM peut approuver.", es: "Solo un administrador de DSM puede aprobar.", it: "Solo un amministratore DSM può approvare." },
+    "reason.scheduler_denied": { en: "DSM denied the administrator access to Task Scheduler. Check the DSM session; restarting the NAS resolved this before.", "zh-TW": "DSM 拒絕了管理員對任務排程表的存取。請檢查 DSM 工作階段；先前重新啟動 NAS 可解決此問題。", "zh-CN": "DSM 拒绝了管理员对任务计划的访问。请检查 DSM 会话；之前重新启动 NAS 可解决此问题。", ja: "DSM が管理者のタスクスケジューラへのアクセスを拒否しました。DSM セッションを確認してください。以前は NAS の再起動で解決しました。", ko: "DSM에서 관리자의 작업 스케줄러 액세스를 거부했습니다. DSM 세션을 확인하십시오. 이전에는 NAS를 다시 시작하여 해결되었습니다.", de: "DSM hat dem Administrator den Zugriff auf den Aufgabenplaner verweigert. Prüfen Sie die DSM-Sitzung; ein Neustart des NAS hat dies bisher behoben.", fr: "DSM a refusé à l'administrateur l'accès au Planificateur de tâches. Vérifiez la session DSM ; un redémarrage du NAS a déjà résolu ce problème.", es: "DSM denegó al administrador el acceso al Programador de tareas. Compruebe la sesión de DSM; reiniciar el NAS lo resolvió anteriormente.", it: "DSM ha negato all'amministratore l'accesso a Utilità di pianificazione. Controllare la sessione DSM; in passato il riavvio del NAS ha risolto il problema." },
+    "reason.scheduler_failed": { en: "Reading or changing the scheduled tasks failed.", "zh-TW": "讀取或變更排程任務失敗。", "zh-CN": "读取或更改计划任务失败。", ja: "スケジュール済みタスクの読み取りまたは変更に失敗しました。", ko: "예약된 작업을 읽거나 변경하지 못했습니다.", de: "Die geplanten Aufgaben konnten nicht gelesen oder geändert werden.", fr: "La lecture ou la modification des tâches planifiées a échoué.", es: "No se pudieron leer ni cambiar las tareas programadas.", it: "Impossibile leggere o modificare le attività pianificate." },
+    "reason.scheduler_unsupported": { en: "This DSM's Task Scheduler does not offer what background access needs.", "zh-TW": "這台 DSM 的任務排程表不提供背景存取所需的功能。", "zh-CN": "此 DSM 的任务计划不提供后台访问所需的功能。", ja: "この DSM のタスクスケジューラには、バックグラウンドアクセスに必要な機能がありません。", ko: "이 DSM의 작업 스케줄러는 백그라운드 액세스에 필요한 기능을 제공하지 않습니다.", de: "Der Aufgabenplaner dieses DSM bietet nicht, was der Hintergrundzugriff benötigt.", fr: "Le Planificateur de tâches de ce DSM n'offre pas ce dont l'accès en arrière-plan a besoin.", es: "El Programador de tareas de este DSM no ofrece lo que necesita el acceso en segundo plano.", it: "L'Utilità di pianificazione di questo DSM non offre quanto necessario all'accesso in background." },
+    "reason.task_missing": { en: "The approved tasks are not in Task Scheduler.", "zh-TW": "任務排程表中沒有已核准的任務。", "zh-CN": "任务计划中没有已批准的任务。", ja: "承認済みのタスクがタスクスケジューラにありません。", ko: "승인된 작업이 작업 스케줄러에 없습니다.", de: "Die genehmigten Aufgaben fehlen im Aufgabenplaner.", fr: "Les tâches approuvées ne figurent pas dans le Planificateur de tâches.", es: "Las tareas aprobadas no están en el Programador de tareas.", it: "Le attività approvate non sono presenti in Utilità di pianificazione." },
+    "reason.task_duplicate": { en: "Task Scheduler has several tasks with this package's task name.", "zh-TW": "任務排程表中有多個任務使用此套件的任務名稱。", "zh-CN": "任务计划中有多个任务使用此套件的任务名称。", ja: "タスクスケジューラに、このパッケージのタスク名を持つタスクが複数あります。", ko: "작업 스케줄러에 이 패키지의 작업 이름을 가진 작업이 여러 개 있습니다.", de: "Im Aufgabenplaner gibt es mehrere Aufgaben mit dem Aufgabennamen dieses Pakets.", fr: "Le Planificateur de tâches contient plusieurs tâches portant le nom de tâche de ce paquet.", es: "El Programador de tareas tiene varias tareas con el nombre de tarea de este paquete.", it: "Utilità di pianificazione contiene più attività con il nome attività di questo pacchetto." },
+    "reason.task_unverified": { en: "The owner or definition of a scheduled task cannot be verified.", "zh-TW": "無法驗證排程任務的擁有者或定義。", "zh-CN": "无法验证计划任务的所有者或定义。", ja: "スケジュール済みタスクの所有者または定義を検証できません。", ko: "예약된 작업의 소유자 또는 정의를 확인할 수 없습니다.", de: "Besitzer oder Definition einer geplanten Aufgabe lassen sich nicht überprüfen.", fr: "Le propriétaire ou la définition d'une tâche planifiée ne peut pas être vérifié.", es: "No se puede verificar el propietario o la definición de una tarea programada.", it: "Impossibile verificare il proprietario o la definizione di un'attività pianificata." },
+    "reason.task_outdated": { en: "The package changed since the last approval.", "zh-TW": "套件在上次核准後已變更。", "zh-CN": "套件在上次批准后已更改。", ja: "前回の承認以降にパッケージが変更されました。", ko: "마지막 승인 이후 패키지가 변경되었습니다.", de: "Das Paket hat sich seit der letzten Genehmigung geändert.", fr: "Le paquet a changé depuis la dernière approbation.", es: "El paquete ha cambiado desde la última aprobación.", it: "Il pacchetto è cambiato dall'ultima approvazione." },
+    "reason.task_conflict": { en: "A scheduled task with this package's task name runs another script.", "zh-TW": "有個使用此套件任務名稱的排程任務執行的是其他指令碼。", "zh-CN": "有个使用此套件任务名称的计划任务运行的是其他脚本。", ja: "このパッケージのタスク名を持つスケジュール済みタスクが、別のスクリプトを実行します。", ko: "이 패키지의 작업 이름을 가진 예약된 작업이 다른 스크립트를 실행합니다.", de: "Eine geplante Aufgabe mit dem Aufgabennamen dieses Pakets führt ein anderes Skript aus.", fr: "Une tâche planifiée portant le nom de tâche de ce paquet exécute un autre script.", es: "Una tarea programada con el nombre de tarea de este paquete ejecuta otro script.", it: "Un'attività pianificata con il nome attività di questo pacchetto esegue un altro script." },
+    "reason.executor_unreachable": { en: "The background service of this package does not answer.", "zh-TW": "此套件的背景服務沒有回應。", "zh-CN": "此套件的后台服务没有响应。", ja: "このパッケージのバックグラウンドサービスが応答しません。", ko: "이 패키지의 백그라운드 서비스가 응답하지 않습니다.", de: "Der Hintergrunddienst dieses Pakets antwortet nicht.", fr: "Le service en arrière-plan de ce paquet ne répond pas.", es: "El servicio en segundo plano de este paquete no responde.", it: "Il servizio in background di questo pacchetto non risponde." },
+    "reason.executor_mismatch": { en: "The running background service is not the one this package approved.", "zh-TW": "正在執行的背景服務不是此套件核准的版本。", "zh-CN": "正在运行的后台服务不是此套件批准的版本。", ja: "実行中のバックグラウンドサービスは、このパッケージが承認したものではありません。", ko: "실행 중인 백그라운드 서비스는 이 패키지가 승인한 서비스가 아닙니다.", de: "Der laufende Hintergrunddienst ist nicht der von diesem Paket genehmigte.", fr: "Le service en arrière-plan en cours n'est pas celui approuvé par ce paquet.", es: "El servicio en segundo plano en ejecución no es el aprobado por este paquete.", it: "Il servizio in background in esecuzione non è quello approvato da questo pacchetto." },
+    "reason.executor_start_failed": { en: "The background service of this package could not be started.", "zh-TW": "無法啟動此套件的背景服務。", "zh-CN": "无法启动此套件的后台服务。", ja: "このパッケージのバックグラウンドサービスを開始できませんでした。", ko: "이 패키지의 백그라운드 서비스를 시작할 수 없습니다.", de: "Der Hintergrunddienst dieses Pakets konnte nicht gestartet werden.", fr: "Le service en arrière-plan de ce paquet n'a pas pu être démarré.", es: "No se pudo iniciar el servicio en segundo plano de este paquete.", it: "Impossibile avviare il servizio in background di questo pacchetto." },
+    "reason.executor_starting": { en: "The background service of this package is still running its start step. Check the status again in a moment.", "zh-TW": "此套件的背景服務仍在執行啟動步驟。請稍後再檢查狀態。", "zh-CN": "此套件的后台服务仍在运行启动步骤。请稍后再检查状态。", ja: "このパッケージのバックグラウンドサービスは、まだ開始ステップを実行中です。しばらくしてから状態を確認してください。", ko: "이 패키지의 백그라운드 서비스가 아직 시작 단계를 실행 중입니다. 잠시 후 상태를 다시 확인하십시오.", de: "Der Hintergrunddienst dieses Pakets führt noch seinen Startschritt aus. Prüfen Sie den Status gleich noch einmal.", fr: "Le service en arrière-plan de ce paquet exécute encore son étape de démarrage. Vérifiez l'état de nouveau dans un instant.", es: "El servicio en segundo plano de este paquete aún está ejecutando su paso de inicio. Vuelva a comprobar el estado en un momento.", it: "Il servizio in background di questo pacchetto sta ancora eseguendo il passaggio di avvio. Verificare di nuovo lo stato tra poco." },
+    "reason.selection_failed": { en: "The selected shared folder was not confirmed.", "zh-TW": "未能確認所選的共用資料夾。", "zh-CN": "未能确认所选的共享文件夹。", ja: "選択した共有フォルダを確認できませんでした。", ko: "선택한 공유 폴더를 확인하지 못했습니다.", de: "Der ausgewählte freigegebene Ordner wurde nicht bestätigt.", fr: "Le dossier partagé sélectionné n'a pas été confirmé.", es: "No se confirmó la carpeta compartida seleccionada.", it: "La cartella condivisa selezionata non è stata confermata." },
+    "reason.failed": { en: "The operation failed.", "zh-TW": "操作失敗。", "zh-CN": "操作失败。", ja: "操作に失敗しました。", ko: "작업에 실패했습니다.", de: "Der Vorgang ist fehlgeschlagen.", fr: "L'opération a échoué.", es: "La operación ha fallado.", it: "L'operazione non è riuscita." },
+    "outcome.restored": { en: "The earlier approval was restored.", "zh-TW": "已還原先前的核准。", "zh-CN": "已还原先前的批准。", ja: "以前の承認を復元しました。", ko: "이전 승인을 복원했습니다.", de: "Die frühere Genehmigung wurde wiederhergestellt.", fr: "L'approbation précédente a été restaurée.", es: "Se restauró la aprobación anterior.", it: "L'approvazione precedente è stata ripristinata." },
+    "outcome.withdrawn": { en: "The tasks this approval created were withdrawn.", "zh-TW": "已撤回這次核准建立的任務。", "zh-CN": "已撤回这次批准创建的任务。", ja: "この承認で作成したタスクを取り消しました。", ko: "이번 승인으로 생성한 작업을 철회했습니다.", de: "Die von dieser Genehmigung erstellten Aufgaben wurden zurückgezogen.", fr: "Les tâches créées par cette approbation ont été retirées.", es: "Se retiraron las tareas que creó esta aprobación.", it: "Le attività create da questa approvazione sono state ritirate." },
+    "outcome.restore_failed": { en: "Restoring the earlier approval failed.", "zh-TW": "還原先前的核准失敗。", "zh-CN": "还原先前的批准失败。", ja: "以前の承認を復元できませんでした。", ko: "이전 승인을 복원하지 못했습니다.", de: "Die frühere Genehmigung konnte nicht wiederhergestellt werden.", fr: "La restauration de l'approbation précédente a échoué.", es: "No se pudo restaurar la aprobación anterior.", it: "Impossibile ripristinare l'approvazione precedente." },
+    "outcome.withdraw_failed": { en: "Withdrawing the tasks this approval created failed.", "zh-TW": "撤回這次核准建立的任務失敗。", "zh-CN": "撤回这次批准创建的任务失败。", ja: "この承認で作成したタスクを取り消せませんでした。", ko: "이번 승인으로 생성한 작업을 철회하지 못했습니다.", de: "Die von dieser Genehmigung erstellten Aufgaben konnten nicht zurückgezogen werden.", fr: "Le retrait des tâches créées par cette approbation a échoué.", es: "No se pudieron retirar las tareas que creó esta aprobación.", it: "Impossibile ritirare le attività create da questa approvazione." },
 };
 /** ROOT_PANEL_MESSAGES as createI18n catalogs, one per locale. */
 export function rootPanelCatalogs() {
@@ -288,12 +416,22 @@ export const ROOT_PANEL = `function mountRootPanel(host, access, t, admin) {
   form.appendChild(label); form.appendChild(actions);
   panel.appendChild(title); panel.appendChild(status); panel.appendChild(reason); panel.appendChild(form);
   host.appendChild(panel);
+  // The code and outcome in the DSM language, then the DSM code the English reason starts with.
+  function explain(result) {
+    if (!result.reason && !result.code) return "";
+    var parts = [t("reason." + (result.code || "failed"))];
+    if (result.outcome) parts.push(t("outcome." + result.outcome));
+    var detail = /^([A-Za-z0-9_]+):/.exec(result.reason || "");
+    if (detail) parts.push("(" + detail[1] + ")");
+    return parts.reduce(function (text, part) { return text + (/[\u3000-\u30ff\u4e00-\u9fff\uac00-\ud7af\uff00-\uffef]$/.test(text) ? "" : " ") + part; });
+  }
   function show(result) {
     status.textContent = t("state." + result.state);
-    reason.textContent = result.reason || ""; reason.hidden = !result.reason;
+    reason.textContent = explain(result); reason.hidden = !reason.textContent;
     label.hidden = approve.hidden = result.state !== "needs-admin-approval" && result.retry !== true;
   }
-  function run(fn) { approve.disabled = check.disabled = true; return fn().then(show, function(e) { show({state: "blocked", reason: e.message || e.code}); }).then(function() { approve.disabled = check.disabled = false; }); }
+  // A start step can hold the background service for up to a minute.
+  function run(fn) { approve.disabled = check.disabled = true; reason.textContent = t("working"); reason.hidden = false; return fn().then(show, function(e) { show({state: "blocked", reason: e && e.code ? e.code + ":" : "", code: "failed"}); }).then(function() { approve.disabled = check.disabled = false; }); }
   access.subscribe(show);
   form.onsubmit = function(event) {
     if (event) event.preventDefault();

package/dist/standalone/sdk-check.js

@@ -1,7 +1,7 @@
 import { readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { CLI_VERSION } from "../cli-version.js";
-import { appSdkVersion, SDK_DEPENDENCY, SDK_PACKAGE } from "../runtime/sdk-source.js";
+import { appSdkVersion, SDK_DEPENDENCY, SDK_FLOOR, SDK_PACKAGE, sdkBelowFloor } from "../runtime/sdk-source.js";
 const minorLine = (version) => version.split(".").slice(0, 2).join(".");
 /** The file that names each backend kind's SDK version. */
 const SDK_VERSION_FILE = { go: "backend/go.mod", rust: "Cargo.lock", python: "backend.sdk", node: "backend.sdk" };
@@ -29,6 +29,9 @@ export function sdkProblems(backend, frontendDir, needsSdk, cliVersion = CLI_VER
     if (minorLine(version) !== minorLine(cliVersion)) {
         problems.push({ code: "SDK_UNSUPPORTED", message: `${file} requires SDK ${version}; CLI ${cliVersion} supports only SDK ${minorLine(cliVersion)}.x. Use the matching CLI, or raise the SDK to ${minorLine(cliVersion)}.x.` });
     }
+    else if (sdkBelowFloor(version)) {
+        problems.push({ code: "SDK_UNSUPPORTED", message: `${file} requires SDK ${version}; CLI ${cliVersion} supports SDK ${SDK_FLOOR} or later. Raise the SDK to ${SDK_FLOOR} or later.` });
+    }
     const frontend = frontendDir === undefined ? undefined : frontendSdkVersion(frontendDir);
     if (frontend && frontend.version !== version) {
         problems.push({ code: "SDK_VERSION_MISMATCH", message: `frontend/package.json has ${SDK_PACKAGE} ${frontend.spec} (${frontend.version ?? "version unreadable"}), while ${file} requires ${version}; the two must match.` });

package/dist/standalone/spk.d.ts

@@ -1,6 +1,7 @@
 import { type NativeArchFamily } from "../build-spk/dsm-arch.js";
 import type { StandaloneManifest } from "./manifest.js";
 import { type ExecutorArtifact } from "../runtime/executor-build.js";
+import type { PortalCatalogs } from "./portal-window.js";
 export declare const LIFECYCLE_SCRIPTS: readonly ["preinst", "postinst", "preuninst", "postuninst", "preupgrade", "postupgrade", "start-stop-status"];
 export declare class StandaloneBuildError extends Error {
     readonly code: string;
@@ -18,6 +19,8 @@ export interface AssembleOptions {
     backgroundWorker?: string;
     /** A Python, Node or Rust App's finished directory, installed as target/app. */
     app?: string;
+    /** The SDK's portal panel text, required exactly when the manifest declares a portal. */
+    portalText?: PortalCatalogs;
 }
 /**
  * Packs an unsigned Standalone Package SPK. DSM runs installation/lifecycle

package/dist/standalone/spk.js

@@ -12,10 +12,12 @@ import { writeWizardUiFiles } from "../build-spk/wizard-i18n.js";
 import { renderDelegateScopeSteps } from '../build-spk/delegate-scope.js';
 import { createReproducibleTar } from "../build-spk/reproducible-archive.js";
 import { renderStandaloneScript } from "./lifecycle.js";
+import { APP_SCRIPTS_DIR, APP_SCRIPTS_SPK_DIR } from "./app-scripts.js";
 import { codedMessage } from "../errors.js";
 import { DSM_LANGS, LOCALES } from "./i18n.js";
 import { appTitle, CGI_PAYLOAD_PATH, renderUiConfig, renderWindowScript, windowScriptName } from "./dsm-window.js";
 import { writeUiTexts } from "../build-spk/ui-texts.js";
+import { loginStyleAssets } from "../build-spk/login-style.js";
 import { copyStandaloneNotices } from "../build-spk/notices.js";
 import { copyAppTree } from "./bridge-app.js";
 import { isBridgeBackend } from "./bridge-backend.js";
@@ -65,8 +67,11 @@ export async function assembleStandaloneSpk(options) {
         const appDir = join(uiRoot, "app");
         copyUiTree(manifest.ui.dir, appDir);
         const assetVersion = digestTree(appDir).slice(0, 12);
-        writeFile(join(uiRoot, "config"), renderUiConfig(manifest, icons));
-        writeFile(join(uiRoot, windowScriptName(manifest)), renderWindowScript(manifest, assetVersion, icons));
+        const login = manifest.portal ? loginStyleAssets(manifest.loginStyle) : undefined;
+        writeFile(join(uiRoot, "config"), renderUiConfig(manifest, icons, login?.fields));
+        for (const [path, bytes] of login?.files ?? [])
+            writeFile(join(uiRoot, path), bytes);
+        writeFile(join(uiRoot, windowScriptName(manifest)), renderWindowScript(manifest, assetVersion, icons, options.portalText));
         writeFile(join(uiRoot, hostScriptName(manifest.build)), renderHostAdapterScript(manifest.package));
         writeDsmWindowIcons(uiRoot, icons);
         writeUiTexts(uiRoot, appTitle(manifest));
@@ -141,6 +146,8 @@ export async function assembleStandaloneSpk(options) {
         for (const name of LIFECYCLE_SCRIPTS) {
             writeFile(join(staging, "scripts", name), renderStandaloneScript(name, manifest), EXEC_MODE);
         }
+        for (const name of manifest.appScripts ?? [])
+            copyExecutable(join(manifest.root, APP_SCRIPTS_DIR, name), join(staging, APP_SCRIPTS_SPK_DIR, name));
         const folder = manifest.sharedFolder;
         const steps = manifest.capabilities.delegate?.scope === 'install-selected'
             ? (t) => [...renderDelegateScopeSteps(t), ...(folder ? sharedFolderInstallSteps(manifest.package, folder)(t) : [])]
@@ -171,7 +178,7 @@ function copyExecutable(source, target) {
 }
 function writeFile(path, content, mode = FILE_MODE) {
     mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(path, content, "utf8");
+    writeFileSync(path, content);
     chmodSync(path, mode);
 }
 function quote(value) {

package/dist/validate.js

@@ -9,6 +9,7 @@ import { classifyComposeRoute, collectComposeInterpolations, collectVolumeSource
 import { usesAuthGateway } from "./contract/web-launch.js";
 import { isNativeLayout, loadNativeLayout } from "./standalone/native-layout.js";
 import { loadStandaloneManifest } from "./standalone/manifest.js";
+import { APP_SCRIPTS_DIR, readAppScripts } from "./standalone/app-scripts.js";
 import { manifestPolicyProblem } from "./runtime/executor-policy-check.js";
 import { COMPOSE_FILENAME, CONTRACT_FILENAME, DSM_PACKAGE_FILENAME, } from "./discovery.js";
 import { declaredPrivilegeFlags } from "./compose/privilege.js";
@@ -43,6 +44,7 @@ export function validateProject(project, options = {}) {
     if (capabilities !== undefined) {
         errors.push(makeError("CAPABILITY_UNSUPPORTED", contractSpan(contractFile, 1, 1, "capabilities"), "A compose project does not support capabilities.", "Remove capabilities, or use a dsm-package.yaml native-go project."));
     }
+    readAppScripts(project.root, e => errors.push({ ...e, span: { file: APP_SCRIPTS_DIR, line: 1, column: 1 }, suggestion: getErrorCode(e.code).suggestion }));
     if (profile === "listing") {
         for (const { name, type, code } of findListingUnsupportedInstallTypes(parsed.contract)) {
             const pos = getValuePosition(parsed.doc, ["install", name, "type"]) ??