@synopackageland/cli 0.4.0 → 0.5.0

package/templates/native-go-vue/README.md

@@ -1,6 +1,6 @@
 # __DISPLAY_NAME__ — Vue DSM package
 
-This is the existing native-go template with the shared UI **0.4.0**. It uses
+This is the existing native-go template with the shared UI **0.5.7**. It uses
 AppRoot, the DSM embedded theme, Dialog, SettingsSection, Callout and existing
 controls. The generated `dsm-package.yaml` remains the only package manifest.
 
@@ -14,11 +14,20 @@ synopkgland build-spk
 synopkgland inspect --spk dist/__PACKAGE__-0.1.0-0001-x86_64.spk
 ```
 
-The pinned `@synopackageland/ui@0.4.0` dependency is public on
+The pinned `@synopackageland/ui@0.5.7` dependency is public on
 `https://registry.npmjs.org`, selected by `frontend/.npmrc`. No registry account
 or credentials are required. Dependencies are installed and UI bundled on the
 build machine; the NAS never downloads npm packages. Commit your lockfiles.
 
+Vitest is pinned to **4.1.11** to fix CVE-2026-47429 and CVE-2026-84373.
+It and `@vitest/mocker` are development-only tools, excluded from the shipped
+browser bundle and SPK. Run `npm audit` separately to check the full lockfile;
+`npm audit --omit=dev` checks only production dependencies. These checks are
+snapshots of the advisory database, not a guarantee against future advisories.
+Keep the `--ignore-scripts` install above: npm install-script policy warnings
+are separate from vulnerability findings and do not require approving scripts
+for this template's test/build workflow.
+
 ## Optional integration (experimental)
 
 **Experimental integration — DSM 7.4 known limitation:** DSM ignores a
@@ -28,14 +37,18 @@ first, verify the helper is no longer ready, then Stop the package. V1 found
 this on a real NAS; the M1e investigation is ongoing.
 
 Generate with `synopkgland init -t native-go --ui vue --integration go <dir>`.
-This automatically chooses root privilege and adds only the existing M1a
-`integration: {protocol: 1, workers: {}}` contract. The native-go baseline without
+This keeps `privilege: none`: the private note and status screen run as the
+package account, with no helper, scheduler task or precheck hook, and
+`integration.status` reports `ready / package-only`. Add `--privilege root` to
+get the privileged helper described below (the existing M1a
+`integration: {protocol: 1, workers: {}}` contract). The helper brings only its
+five `helper_*` tasks, not the `whoami` demo. The native-go baseline without
 these options remains unchanged. Vue alone keeps the original Go 1.24 module;
 integration uses Go **1.25+** for fd-rooted atomic storage updates.
 
 Open the app as a DSM administrator. **Approve and activate** uses the existing
 DSM PasswordConfirm and exact-task readback, then `helper_enable`. Recover,
-Teardown and Disable call the other fixed public operations. Status always
+Teardown, Disable and Repair cleanup call the other fixed public operations. Status always
 comes from `integration.status`; scheduler approval is not helper readiness.
 Package running is `unknown`, scheduler `not-probed`: this backend has no fresh
 Package Center/scheduler probe. Use Package Center separately to read that state.
@@ -55,6 +68,53 @@ unsafe file metadata, serialize CGI readers/writers, and limit UTF-8 input to
 4096 bytes. Failed writes must be inspected/retried; no multi-file transaction,
 version history or general filesystem permission is implied.
 
+## NAS picker and grants (S4 mock preview)
+
+The Vue template includes `NasPathPicker` and `NasGrantSettings`, built from UI
+0.5.7's Dialog, TreeView, DataGrid, Button and SettingsSection. The existing
+browser `FilePicker` still represents local `File[]`; NAS selections return
+opaque directory grant handles. The new UI has catalogs for en, zh-TW, zh-CN,
+ja, ko, de, fr, es and it, selected from `ctx.locale` with English fallback.
+
+There is **no default NAS provider** and no new CGI/helper route. The existing
+DSM loader's two-argument mount remains unchanged and hides the NAS section.
+A development host can explicitly inject an in-memory fixture:
+
+```ts
+import {mount} from './src/main'
+import {createMockNasService} from './src/nas/mock-provider'
+
+const fixtures = createMockNasService({appName: 'My package', drained: false})
+const app = mount(root, ctx, {nasProvider: fixtures.connect('normal1')})
+// Another window can use fixtures.connect('normal2'); private grants stay separate.
+// Call app.unmount() when its window closes or its native subject changes.
+```
+
+Only `normal1`, `normal2` and `admin` are synthetic fixture subjects. The service
+uses S0 protocol-2 display projections and S1 discovery-anchor shape, not native
+identity proofs or filesystem authority. Candidate contexts expire in 60 seconds;
+one-use review intents expire in 30 seconds. Picker cancellation invalidates that
+context and creates no grant. Read-only actions are fixed; shared consent and
+shared revoke require the fixture's current administrator role. Fixture references
+and digest-shaped summary tokens are random; these are **not** S3 authenticated
+digests, durable storage, DSM ACL validation, or transferable grants.
+
+Grant state is separate from helper readiness. Revocation shows R (new access
+refused) separately from Q (transfers drained), including pending cleanup from a
+provider snapshot. It does not undo sent/written data. All fixture state disappears
+when this service instance is discarded. Neither mock success nor abort/timeout
+proves a NAS operation stopped. Each UI request is bounded to five seconds;
+close/unmount aborts pending work and ignores late results. A package/account
+change reported by app status discards the injected UI until the host remounts
+with a new per-session provider. Real adapters must validate the current session, local UID/username, enabled
+account, complete groups and App privilege on every call. Session switches
+require a new provider; relaxed mode accepts same-UID/same-name recreation.
+
+The mock is imported only by tests/development hosts and is not activated or
+bundled by the default entry point. Later S3/S5/S8 work must supply production
+adapters, durable/fence/ACL proofs and capability integration before connecting
+NAS data. Go-only and the existing protocol-1 manifest remain unchanged.
+
 ## Optional Better Auth
 
 Generate with `--ui vue --integration better-auth`. This is the only option that
@@ -86,7 +146,7 @@ clears instance/session state and stale reopen callbacks become no-ops.
 IDs, overlay roots, reopen/unmount, errors and empty data with jsdom. Real
 unsigned artifact tests additionally cross-compile Go and bundle UI/Node.
 
-UI **0.4.0** enables `<AppRoot modal-scope="app">`. Each mount assigns a
+UI **0.5.7** enables `<AppRoot modal-scope="app">`. Each mount assigns a
 package-prefixed, instance-unique Vue `idPrefix` before mounting. The sizing
 class on the mount element fills the existing bounded DSM fit-layout body;
 AppRoot fills that element and owns the background scroll container and local
@@ -108,3 +168,88 @@ reused before reaping. Startup still requires a live handshake within two second
 Lost supervisors preserve failed/cleanup-required; the controller never signals a
 recorded PID. Rebuild after M1d and approve the new payload digest before use.
 Uninstall retains disabled gate/cache/history by policy.
+
+
+## Repair after supervisor loss (R2)
+
+An administrator can choose **Repair cleanup** through the existing DSM
+PasswordConfirm and exact `helper_repair` task. Every Repair run asks for fresh
+password confirmation and rechecks the task afterward; cancellation runs nothing. A protected epoch lifetime lock,
+held by both the supervisor and its child until kernel exit, must be obtainable
+before cleanup. Repair clears only verified helper runtime residue, commits a
+private completion proof and preserves the approval/disabled gate. It never
+signals a recorded PID or restarts integration; use Recover or Approve and
+activate separately afterward. Missing, replaced or busy witnesses and foreign
+or live runtime paths refuse cleanup. Repeating Repair safely retries an
+interrupted cleanup transaction.
+
+Pre-R2 builds, including M1d/0001 Alpha and pre-R2 M1g, did not create this
+witness. Upgrading cannot supply historical proof: retain their residue and use
+the separately authorized reboot/Disable flow before upgrading. See
+`docs/m1a-helper-lifecycle-contract.md` in the SDK repository. R2 has local and
+isolated Linux systemd VM evidence; DSM 4.4 acceptance is still unknown.
+
+
+## M2 S1R build policy and unavailable delivery
+
+The S8 source candidate also accepts `--integration-protocol 2` with
+`--integration go` or `better-auth`, and only together with `--privilege root`. The default stays protocol 1. The manifest,
+compiled helper/CGI inventory, payload/worker digests, inspector and lifecycle
+approval pin the same protocol. A change requires exact new approval, never
+protocol 1 data fallback.
+
+Use `--data-access relaxed` with explicit protocol 2 to emit
+`integration.dataAccess: relaxed`. Omission keeps unavailable behavior; explicit
+`unavailable` is also accepted for protocol 2. The setting is bound into helper/CGI
+inventory, digests and root approval. Rebuild and obtain new approval to change it.
+It does not install missing adapters, enable write gates or certify NAS access.
+
+Relaxed identity records UID and username. Recreated accounts with the same pair
+may retain grants; changing either invalidates all grants for that identity and
+requires new authorization. Disabled accounts and revoked App access are denied.
+File operations use permanent dropped credentials and remain limited by NAS
+permissions and grant scope. See `docs/m2-s1r-relaxed-identity.md` in the SDK repo.
+
+NAS folder grants and file operations are not available for ordinary users or
+administrators. Production DSM identity, permission and scope adapters are not yet certified.
+Managed account pilot B is superseded by the relaxed UID/username contract. Enabling or
+recovering integration, or signing in again, does not unlock NAS access.
+Production shows this state in nine languages and supplies no picker/consent/
+file CTA. Only dev/test builds accept an injected mock provider with a preview
+banner; production ignores provider injection. No public data adapter is installed. Caller/admin/path fields never supply
+trusted session, UID, groups or App permission.
+
+Unknown NAS methods return `unknown_method`; the valid nil binary read route
+returns `unsupported`. Missing native proof is `unavailable`, wrong peer is
+`denied`, and unknown/stale/replay controls retain their own safe codes.
+Anonymous/expired DSM sessions return `session_required`; authentication failure
+returns `auth_unavailable`. Relogin restores only the ordinary app session.
+Positive NAS functionality, ACL and final DSM SPK acceptance remain blocked /
+unknown; local refusal and QEMU fixtures do not certify them.
+
+
+## Interactive jobs after an observer pause
+
+The opt-in workers session API refuses requests with `revalidating` while the
+existing bounded reload/query observer checks are pending. Admission stays
+closed, running jobs are conservatively canceled, and no attach lease is
+extended. Sticky fences still return `fenced`. After a valid session-mode status
+reply confirms recovery, new submissions can proceed; canceled jobs never resume.
+
+JobsPanel keeps the revalidation message until recovery is confirmed and explains
+`canceled` jobs with `safeReason: "fenced"` in all nine locales. Resubmit is an
+explicit user action: the connected provider uses a mount-local plan snapshot
+and calls fresh prepare/submit for a new intent and job ID, rechecking permissions.
+There is no automatic resubmission. A lost submit reply locks further submission
+and offers lookup of the new intent. Reopening the view loses the local plan;
+select inputs again instead of inferring them from history. Existing initial
+picker/submission form wiring remains outside this template.
+
+See `docs/m3-adapt-simple-session-jobs.md` in the SDK repository for the full
+contract and the distinction between local evidence and DSM acceptance.
+
+## Interactive NAS picker and job submission
+
+For the opt-in SDK-workers entry, see [frontend/README-JOBS.md](frontend/README-JOBS.md).
+It connects the existing File Station folder/file picker, session selection and
+fixed read plan to prepare/submit, progress, cancel and explicit fenced resubmission.

package/templates/native-go-vue/frontend/DESIGN.md

@@ -1,6 +1,6 @@
 ---
 name: Native DSM Vue integration template
-description: Existing package settings UI using Syno Package Land UI 0.4.0.
+description: Existing package settings UI using Syno Package Land UI 0.5.7.
 typography:
   body:
     fontFamily: "var(--ui-font-sans)"
@@ -24,7 +24,7 @@ spacing:
 
 This records the built template, not a new visual identity. The settings surface operates inside a DSM package window: users inspect integration health, administrators approve maintenance operations, and each account edits its own synthetic sample note. Its usage mode is **Operate**; preserve the compact, readable hierarchy and existing native component behavior.
 
-Visual authority is `@synopackageland/ui` **0.4.0**, its public exports and `themes/dsm7-embedded.css`, plus the application styles in `src/style.css`. `AppRoot` scopes the component world. Local synthetic browser screenshots (`ui-desktop.png`, `ui-minimum.png`, `ui-user-failed.png`) support this description; they do not establish DSM runtime acceptance.
+Visual authority is `@synopackageland/ui` **0.5.7**, its public exports and `themes/dsm7-embedded.css`, plus the application styles in `src/style.css`. `AppRoot` scopes the component world. Local synthetic browser screenshots (`ui-desktop.png`, `ui-minimum.png`, `ui-user-failed.png`) support this description; they do not establish DSM runtime acceptance.
 
 ## Colors
 
@@ -51,12 +51,12 @@ The application adds no shadows or elevation system. Surface, overlay and dialog
 ## Components
 
 - **AppRoot and lifecycle:** `mount(root, ctx)` creates a fresh Vue instance per DSM window. Reopen refreshes its status. Unmount marks the instance disposed and clears its app cookie, note text and opaque note ID; pending responses must not repopulate a disposed instance. Do not share user/session state between mounts.
-- **SettingsSection and status:** integration is always visible; sample data appears only in `ready`. Keep the six existing labels and descriptions from `context.ts`: `not-enabled` → Not enabled; `ready` → Ready; `needs-approval` → Approval required; `incompatible` → Incompatible; `stopped` → Stopped; `failed` → Failed. Show cleanup-required guidance and the returned package/scheduler values, including `unknown` or `not-probed`.
+- **SettingsSection and status:** integration is always visible; sample data appears only in `ready`. Keep the existing labels and descriptions from `context.ts`: `not-enabled` → Not enabled; `ready` → Ready; `needs-approval` → Approval required; `incompatible` → Incompatible; `stopped` → Stopped; `failed` → Failed; `pending` → Temporarily revalidating (localized safe copy). Pending hides sample authority and does not request administrator recovery. Show cleanup-required guidance and the returned package/scheduler values, including `unknown` or `not-probed`.
 - **Permissions and Button:** root controls appear only for an administrator with `ctx.root` and configured integration. Other accounts receive administrator guidance when integration is not ready. Activation/recovery/teardown/disable follow authorization before execution; cancelled approval reports that no operation ran.
 - **Loading, empty and mutation states:** Refresh and mutations disable competing controls; the main region exposes `aria-busy` and textual status. Failed status loading offers Refresh. A ready integration with no note ID shows the “No sample data” Callout. A labeled Textarea and Save button appear when a note exists. Completion notices use `role=status`; error copy uses `role=alert` and identifies a recovery action. Optional app identity appears only when its route reports `better-auth`.
 - **Dialog:** Disable opens the library confirmation dialog, explains refusal of new requests and retention of existing data/output, and presents Cancel plus danger Confirm disable. No application modal replacement is provided.
 
-**App-local modality:** consume UI 0.4.0's `AppRoot modal-scope="app"`.
+**App-local modality:** consume UI 0.5.7's `AppRoot modal-scope="app"`.
 Each independent mount sets a package-prefixed, unique Vue `idPrefix` before
 mounting. The mount sizing class and AppRoot use `height: 100%` inside the
 existing bounded DSM fit-layout body. AppRoot owns background scrolling and
@@ -70,9 +70,21 @@ custom out-of-root portals. Other UI versions/modal libraries, Safari/iOS and
 manual screen-reader acceptance remain unvalidated. Test the generated final
 SPK on DSM separately from local jsdom/Chromium evidence.
 
+### Opt-in background schedules (S1-a)
+
+The `native-go-background` overlay extends this **Operate** surface within the inherited `AppRoot`, embedded theme, `SettingsSection`, Button and Callout system. It introduces no new palette or global tokens.
+
+- **Private-copy consent:** “Schedule this copy” is available for the signed-in owner's retained, successful, unscheduled job copy. “Private copy: {name}” identifies the input; “Repeat every” offers “Hour”, “Day” and “Week”. “Create schedule” stays disabled until the user checks “I agree to keep and reprocess this fixed copy as the package user. No new source files or personal ACLs are read.” The help explains the eight-schedule limit and that missed runs are recorded, never replayed.
+- **Ownership and recovery:** preserve user-and-UID owner isolation. Administrator rows expose “Owner: {user} (UID {uid})”. A worker change shows “The worker revision changed. An administrator must review and explicitly enable this schedule.” Only administrators, while background mode is on, see “Enable schedule”. Its confirmation names the exact private copy: “Enable the schedule for {name} with the current worker revision? I agree to reprocess this fixed copy. Past runs will not be replayed.” Actions are “Confirm enable” and “Cancel”.
+- **Layout:** schedule name/state, owner, next run, missed runs and warnings stack above a grouped, wrapping action row. Long names and copy wrap within the available width. Keep the inherited vertical scrolling at the minimum window size; do not squeeze schedules into one viewport. The labeled select and consent checkbox retain visible keyboard focus using existing theme tokens.
+- **Errors and cleanup:** danger alerts map known error codes to localized safe copy, with a localized fallback rather than raw server text. The catalogs cover nine locales. Preserve per-mount disposal: stop polling, dispose the picker, revoke result download URLs and prevent pending responses from restoring disposed state. Deletion confirmation explains that queued jobs cancel, running jobs drain and finished results remain.
+
+Evidence: `.herdr-project/syno-package-land-sdk-t-0129/library/ui-desktop.png` and `ui-minimum.png` are local component-fixture captures. The finish review disposition is **ship**, with all three material findings resolved. A fresh `normal1` NAS browser readback passed before the final UI adjustments; these captures validate the final adjustments locally and do not establish final DSM visual acceptance.
+
 ## Do's and Don'ts
 
 - Do use existing public UI components, embedded theme tokens and state/recovery copy.
 - Do retain permission gating, readable loading/empty/error states and per-instance cleanup.
+- Do use the library's `Select`, `Checkbox`, `Input`, `Textarea`, `Form`, `FormItem`, `FilePicker` (`variant="compact"`, in the app locale) and `Link` for controls; there is no native `<input>` or `<a>`. Leave `Form` on its automatic direction (labels stack below 520px of container width) and let a `FormItem` bind its control, with no `direction="vertical"`, `role="group"` or `field.controlId`.
 - Don't claim trusted helper readiness from scheduler values or treat app identity as native session/filesystem authorization.
 - Don't introduce a separate palette, component system or modal workaround around the library contract.

package/templates/native-go-vue/frontend/README-JOBS.md

@@ -0,0 +1,75 @@
+# Interactive NAS picker → job (experimental)
+
+Use the existing `native-go --ui vue --integration go` project, then opt in to
+protocol 2, relaxed File Station session access and a fixed SDK read worker:
+
+```yaml
+integration:
+  protocol: 2
+  dataAccess: relaxed
+  workers: {}
+  sdkWorkers:
+    scan:
+      kind: sdk-read-plan
+      workerRevision: 1
+      actions: [nas.files.list, nas.files.stat, nas.files.read]
+      modes: [interactive]
+```
+
+Install frontend dependencies and run `synopkgland build-spk` as usual. The
+builder sets `SYNOPKGLAND_SDK_WORKERS=1` from the manifest and chooses
+`src/sdk-main.ts`. Leave `SYNOPKGLAND_M2_SIMPLE` unset: that flag deliberately
+selects the separate session-only file-operation entry without job controls.
+For a standalone frontend check use `SYNOPKGLAND_SDK_WORKERS=1 npm run build`.
+
+An administrator uses the existing exact-payload approval and activation flow.
+The session SDK surface hides the native personal-note sample, whose routes
+are absent from this protocol-2 build.
+Each user opens the package in their own DSM session. The jobs panel enables
+the source picker only after a fresh `jobs.status` reports session availability.
+Choose a file or folder, confirm selection, select the worker and operation,
+set its bound where required, then submit once. Progress refreshes every 2.5 s
+while this page contains active jobs; errors stop polling and require Refresh.
+Cancel uses the existing owner/revision checks. Closing the window requests
+cancellation and stops renewal. Observer revalidation pauses submission;
+fenced jobs stay canceled and require an explicit fresh submission after
+recovery. Nothing resumes or retries automatically.
+
+`jobs.status.workers` projects only interactive workers with session-supported
+list/stat/read actions, exact registry revision and the smaller of the worker's
+bounded/total byte limits and 512 KiB. It contains no compiled bindings or
+credentials. This is display metadata: prepare still verifies the registry,
+selection, session and current permissions. Missing metadata in an older owner
+leaves the form disabled. The form submits one step; list is 1–100 entries,
+read is 1–the projected byte limit, and stat has no byte/entry argument.
+This read-only worker requires no destination and discards content, returning
+only counters. Background jobs remain unsupported even if the manifest lists
+background mode. Writes and custom executables are not part of this form.
+
+`M2PathPicker` extends the existing Dialog/TreeView/DataGrid composition with
+`select-files` and `read-only` props and a `source` event (`M2JobSource`). Folder
+picks return an empty segment list. File picks call the existing
+`nas.grants.confirm` for the containing folder with `writable:false`, then use
+one relative filename in `jobs.prepare.input`. The `folder` grant therefore
+records consent for that containing folder, not a file-only authority. Existing
+folder-only consumers and their `selected` event are unchanged. These selections
+remain path based; they do not pin inodes or confine symlink/rename races.
+
+The SDK mount provides both `M2ProviderKey` and `JobsProviderKey` per window.
+`JobsProvider.interactive` exposes `workers`, `prepareInteractive` and
+`submitInteractive`; applications can reuse this interface with their own form.
+Transport stays in the existing `ctx.call`, which carries the current DSM
+session and CSRF token. Never put credentials in form fields, persistent
+storage, logs or an administrator-session fallback.
+
+A missing submit reply freezes the form with its original intent. **Check
+original job** calls `jobs.lookup`; it never submits or acquires a replacement
+lease. If the job is found, status shows its actual outcome. Without the lost
+attach receipt it may expire after 6 s. Unmount or an account/package change
+clears selection and pending input, disconnects the provider, and discards late
+responses. Refreshing cannot certify remote rollback or completed cleanup.
+The attach contract remains 2 s renewal / 6 s TTL.
+
+Nine catalogs cover en, zh-TW, zh-CN, ja, ko, de, fr, es and it via `ctx.locale`.
+Unit and browser fixtures are synthetic; DSM compatibility must be established
+on the final generated SPK with each user's session and File Station permissions.

package/templates/native-go-vue/frontend/README-M2.md

@@ -0,0 +1,64 @@
+# Interactive File Station UI (experimental)
+
+This optional entry uses the package CGI's `ctx.call` transport and the current
+user's DSM session. It does not borrow an administrator session, request root
+helper approval, cache DSM credentials or install a mock provider.
+
+The existing `main.ts` and SDK worker entry remain the default. To select this
+session-only UI in a generated `native-go --ui vue` project:
+
+1. Enable `integration: {protocol: 2, workers: {}}` in `dsm-package.yaml`.
+2. Set `SYNOPKGLAND_M2_SIMPLE=1` in `frontend/.env.production.local`.
+3. Run the existing `synopkgland build-spk` workflow and inspect the final SPK.
+
+You can also build the frontend with `SYNOPKGLAND_M2_SIMPLE=1 npm run build`.
+The flag selects `src/m2-main.ts` before the existing SDK-workers entry; it
+selects a session-only surface, without background job or root-maintenance UI.
+It does not change backend permissions. Protocol 1 / no integration lacks the
+required routes and the UI shows that the adapter is unavailable. Without this
+flag, generated artifacts retain their previous bytes.
+
+## SDK display contract
+
+`src/nas/m2-contract.ts` exports `M2Provider`, `M2Selection`, `M2Entry`,
+`M2Page`, `M2Session`, safe codes and the 512 KiB / 100-entry bounds.
+`createM2Provider(ctx)` implements status, discovery, confirmation, saved
+selection listing/revocation, relative list/stat/read, mkdir and upload.
+Pass an AbortSignal per operation and call `dispose()` on unmount. Each mount
+owns its provider and clears its UI after account/package change or pagehide.
+
+`M2Selection.writable` records consent to attempt writes; it is not a File
+Station permission probe. The backend validates the actual session and current
+File Station permissions on every operation. A selection is an opaque handle
+with a display path, not the native helper's prepare/digest/revision grant.
+User/UID fields in backend records are stripped from the frontend projection.
+Selections use relaxed username/UID identity: recreating both may preserve a
+selection. Paths do not pin inodes or provide symlink/rename confinement.
+
+Discovery supports files in returned pages but shows only folders in the
+picker. Pagination advances by the full server page, not the filtered count;
+rendering is bounded to the latest 200 entries. Writes require explicit
+writable consent. Upload creates a new file and does not overwrite. Read and
+upload are limited to 512 KiB; read bytes become a local binary download, never
+HTML or an inline preview.
+
+Requests are observed for at most 22 seconds (backend handler: 20 seconds).
+The existing `ctx.call` does not expose transport abort: closing or canceling
+suppresses late display updates but does not establish server rollback or Q.
+No operation is retried automatically. A lost mutation response reports
+`commit-uncertain`; inspect saved selections or the destination before
+resubmitting. Session expiry requires signing into DSM again and refreshing.
+Background/offline work, streaming and atomic publish remain unsupported.
+
+## Local checks
+
+Copy `../../_shared/third-party-notices.mjs` into this folder before `npm ci`,
+`npm test`, `npx vue-tsc --noEmit` and `npm run build`. Also build with the M2
+flag. Remove the copied notice tool, `node_modules` and `dist` before root
+repository tests or generating fixtures: the generator copies template files.
+
+`test/m2-preview.html` serves synthetic `ctx.call` responses for local browser
+QA. It does not access a NAS and is not the production provider's backend.
+Local unit/jsdom/Chromium tests do not establish DSM compatibility. Actual DSM
+session, File Station ACL, multipart upload and download validation belongs to
+the backend/device-validation thread. No public support claim is made here.