@synopackageland/cli 0.6.1 → 0.7.0

package/skills/reference/files.md

@@ -1,13 +1,124 @@
 # 檔案與背景工作
 
-Native-go 的 B 能力使用 `init --with files` 或 `add files`，對應 schema 2 `capabilities.files: session`。File tree 與共用 NasPicker 以 TreeView／DataGrid 顯示本人可見內容；選取路徑不建立授權。FilePicker 選瀏覽器本機檔案。上傳／下載使用 streaming transport，不把內容放進 JSON。每次以呼叫者有效 DSM session 由 File Station 判權，不需管理員進行能力設定。
+Native-go 的 B 能力使用 `init --with files` 或 `add files`，對應 schema 2 `capabilities.files: session`。File tree 與共用 NasPicker 以 TreeView／DataGrid 顯示本人可見內容；一般選取不建立授權；delegate destination 選取例外，確認即授權。FilePicker 選瀏覽器本機檔案。上傳／下載使用 streaming transport，不把內容放進 JSON。每次以呼叫者有效 DSM session 由 File Station 判權，不需管理員進行能力設定。
 
 只有 App session 沒有有效 DSM cookie 時回 `dsm_session_required`，須在同 hostname 登入 DSM。不能以套件帳號或 root 作後備存取。
 
 A 能力 `--with jobs` 使用套件帳號處理已匯入的私有副本，依可信 username／UID 綁定；一般使用者不需 admin 設定即可提交、查詢與取消自己的工作。關閉瀏覽器後繼續，不保存 cookie／SID／密碼。匯入需要本人在線 session；私有副本不是離線讀取原檔案的權限。Jobs 與 daemon 互斥。
 
-C 能力 delegate 為 P2 整合中，目前 CLI 拒絕。規劃 admin 確認一次密碼設定 executor；使用者委託／撤銷，綁定 job／operations／scope／期限。DSM runner 與降權寫檔依本人權限執行；scope 限制使用範圍，不是權限邊界。每次重驗帳號與 AppPriv，停用或拒絕即阻擋。不宣稱完整生命週期已驗證。
+
+## Permanent destination integration
+
+`init --with delegate` / `add delegate` default to `operations: [files.moveFromStaging]`,
+`destinations: [save]`, `lifetime: until-revoked`, `scope: install-selected`. Existing legacy
+TTL declarations retain their 1–3600 second service / 30-day wire ceiling and
+64 MiB / 60-second URL example. Do not apply those limits to the new move API.
+Delegate can coexist with daemon; ordinary standalone jobs cannot. Preserve
+App business route floors. Binary/compose remain unsupported.
+
+Use File Station `/home[/...]`, never `/homes/<user>`. The SDK destination picker
+selection itself grants access after fresh DSM session/UID/write verification,
+without a second consent dialog. Ordinary and administrator subjects use their
+own nonzero UID/current groups, never root. An online App can create an in-scope
+grant using a valid session; there is no trusted external consent or notification.
+
+Use the default `createBackgroundSaveFacade(ctx)` / CapabilityPanels management
+page. `delegate.status` exposes verified `disabled` and manifest mode; missing
+protected evidence must not imply enabled. `delegate.operations.list` accepts
+only `{}`, uses the backend move mirrors, and returns the caller's username+UID
+operations only, including for admins. Mirrors are not completion receipts:
+query original `delegate.operations.get` and show Saved only for committed with
+a receipt. Cancel by the same reference; revoke by grant ID. Never resubmit
+uncertain/interrupted work. Revoke, scope change and disable store their reason (`grant-revoked`,
+`scope-changed`, `integration-disabled`) the same way: a copy in flight answers
+`CANCEL_REQUESTED` with it and settles `canceled` with it across a restart. A
+copy the executor stops without a cancel ends `interrupted`/`EXECUTOR_PAUSED`
+(`interrupted`/`interrupted` after a crash), never `WRITE_FAILED`. A lost publish receipt (or a restart after publish
+intent) settles to committed only when the recorded part inode is the final name;
+otherwise it stays uncertain. Nothing is copied twice. Admin disable is protected and revokes grants;
+enable/mailbox start does not resurrect them. Keep IDs, never session credentials.
+
+App-owned daemon completion and scheduled CSV export call configured Go
+`Service.MoveFromStaging` with `delegation_id`, stable `job_id`, private relative
+`staging`, `name`, `size`. No owner/UID selector. Bounds: 16 GiB/file, queued16,
+active1/package, 24-hour attempt, 5-second revalidation ticks (one check at a time, 30-second complete-check deadline; proven timeouts retain private copying, publication still revalidates), 10 MiB operation records,
+50 MiB audit. Scope is a usage restriction, not hard subtree confinement.
+Local production-executor fixtures use fake DSM/peer/bulk writer; do not claim
+NAS ACL, actual writer UID, logout/reboot or full lifecycle acceptance from them.
+Gopeed product wiring remains a separate task.
+
+Admission recovery (per job): on `EXECUTOR_UNAVAILABLE`, `EXECUTOR_TIMEOUT`,
+`EXECUTOR_PROTOCOL`, `canceled`, `EXECUTOR_PAUSED`, `queue-full`,
+`STORAGE_ERROR`, `ADMISSION_PENDING`, `jobs_busy` or `jobs_unavailable` (the
+package journal was busy or failed transiently; a caller deadline or cancel
+spent waiting for it is `canceled`), call `MoveFromStaging` again later with
+the same exact params. It queries the original reference first and re-sends
+admission only when the executor does not know it and the pinned source is
+unchanged; executor tuple deduplication keeps one operation, so a lost reply or a
+racing caller never copies twice. At most 10 possibly-delivered sends, 2 s
+backoff doubling to 5 min; the worker sweep does the same. Terminal, do not
+retry: `APP_DENIED`, `DELEGATION_DENIED`, `operation-conflict`, `disabled`,
+`SCOPE_DENIED` and other executor refusals, `STAGING_CHANGED`,
+`ADMISSION_EXHAUSTED`, `spool_unsafe` and `journal_corrupt` (repair the package
+spool first), and `operation-not-found` for an accepted operation.
+Never change job/grant IDs, delete mirrors or call the socket directly to retry.
+
+Cancellation (per job): `CancelOperation` / `delegate.operations.cancel` with the
+original ref is idempotent; repeat it with the same ref after any retryable
+error or a lost reply. A reply `queued`→`canceled` is final at once. A copy in
+flight answers `copying` with code `CANCEL_REQUESTED`: the cancel is accepted and
+durable, not finished; poll `OperationStatus` on the same ref until terminal
+(repeating the cancel is harmless). `canceled` (`OPERATION_CANCELED`) guarantees the writer
+stopped, its part file is removed, nothing was published and staging is kept; it
+stays canceled across executor crash, package stop/start and logout. `committed`
+means publication won the race: the file stays (cancel never removes it) and only
+the app record may be dropped. `uncertain` means a publish attempt failed before
+the cancel; keep querying. A cancel of a ref the executor has not admitted yet
+(reserved/sent mirror) returns `canceled` and leaves a tombstone, so a late or
+recovered admission of that ref returns `canceled` and never copies; a producer
+cancel is also written to the mirror first, so `MoveFromStaging` and the worker
+sweep forward the cancel instead of admitting it.
+
 
 容器使用固定 DSM run-as 使用者與掛載，不代表瀏覽器本人 ACL。容器路徑依 Compose／映像的 upstream target，保留 target、ro/rw，只替換 host source；管理員在安裝時選擇 Share（共用資料夾）。不要對既有資料 chown。App Data 使用 package var；共用資料夾與 named volume 分別備份。`posix_all_shares` 僅為部署時快照，不會自動加入新資料夾。
 
 `install.sharedFolder` 使用套件帳號：select 模式安裝後可能須管理員手動授予權限，create 由 DSM data-share 建立；都不是逐使用者 session access。移除不刪共用資料夾。Delete App Data 不是完整清理證明，須讀回殘留。
+
+
+### Install-selected scope and the destination API
+
+- The DSM install wizard dynamically lists local shares (`SYNO.Core.Share list`
+  via `api_store`) and offers home. It saves only a package-owned pre-selection
+  in `var/delegate-install.json`; never trust that file for authority.
+- The existing administrator PasswordConfirm form displays this pre-selection
+  at first enable. `ctx.executor.authorize(password, selectedScope)` confirms it
+  through a pinned, exact-readback one-time root task. Settings changes use the
+  same form/password path; no App CGI route may set protected scope directly.
+  A change on a running, pin-verified executor never restarts it; copies in
+  flight end `canceled`/`scope-changed`. A `blocked` reply with `requested:
+  {scope, generation}` may still land: poll `ctx.executor.status()` until
+  `selection` shows that scope above that generation; resubmitting is safe.
+- The executor trusts `/usr/local/etc/synopkgland/<pkg>/delegations/selected-scope.record`
+  only. Its scope/generation are runtime protected state; shipped policy pins
+  lock the selection mode and operations. Changes revoke old grants and cancel
+  pending writes. Change-away-and-back never revives an old grant.
+- Follow `selection` from verified `delegate.status` / `sdk.destination(key)`.
+  If the draft differs, display the difference and follow the protected value.
+  Home and fixed `shared:<name>` manifests stay compatible.
+- Frontend: `const sdk = createBackgroundSaveFacade(ctx); const current = await
+  sdk.destination('save')` returns typed `{key, selection, destination, status}`.
+  `selection` contains `{scope, root, generation}`; `destination` is this caller's
+  grant or null. Handle active/missing/reselection-required/needs-scope-confirmation/disabled.
+- Go: `Service.Destination(ctx, caller, request, key)` verifies the fresh DSM
+  session and username+UID. Capture its active grant ID into the App job. The
+  offline producer uses existing `Service.MoveFromStaging`; no user/UID selector,
+  cookie, token, or browser path cache. Executor revalidates at use/publication.
+- The generated Background saves page includes a working **Save example file**
+  (`sdk.exportExample({key, job_id})`, `delegate.example.export`). Go
+  `ExportExample` creates a private JSON file, calls `MoveFromStaging` once, and
+  repeats the original request on repeated IDs. Review `example.go` to
+  adapt a real producer; show Saved only from a protected committed receipt.
+- Wizard support is measured on vt-nas DSM 7.4 via a session-only SSH local
+  forward. This is not proof of other DSM releases or full writer/reboot behavior.
+
+The pinned scope-selection task also binds the protected generation observed before confirmation. The executor compares it under the publish lock and refuses stale tasks, so a retained task cannot replay an older selection after another confirmation.

package/skills/reference/identity.md

@@ -2,10 +2,79 @@
 
 Native-go validates the caller's DSM session per package. Business route permissions come from backend/internal/api/permissions.json; SDK-owned route policy is protected separately. Capabilities describe execution/resources and do not grant business route access. Never trust a request username as owner.
 
+Entry: omit `entry` for legacy access; `entry: admin-only` admits administrators only and is the floor of every route: SDK routes a capability adds (files, jobs, portal, delegate, rootOps) refuse ordinary users with `admin_required`, the launcher is hidden, and an app route marked `authenticated` or `public` in permissions.json fails validate/build with `STANDALONE_ENTRY_WIDENED` (only the public `identity: standalone` login routes stay public; they admit no one by themselves). The SPK records the mode in `sdk-package.json`; `inspect` prints it and flags `ENTRY_LAUNCHER_MISMATCH`; `entry: app-privilege` also admits accounts DSM Application Privileges allows for `SYNO.SDS.<package>.Instance` (native-go only, needs an `authenticated` route). DSM evaluates user/group/everyone rules, allow/deny precedence and IP ranges; one CGI check covers every route, failures refuse with `app_privilege_denied`, and decisions are cached at most 30 seconds. DSM's install default allows administrators only, so declaring or upgrading never opens the app to everyone. The delegate executor applies the same entry rule to every protected and producer move: once DSM no longer allows a user, new moves under that user's still-valid grant are refused (`APP_DENIED`, grant invalidated); files already saved stay. Guard global settings in shared routes with Go `api.RequireAdmin(caller)` (`admin_required`); the frontend `ctx.user?.isAdmin` only hides controls.
+
 I capability: init --with login or add login enables Go-native standalone identity and Vue login. Same-host DSM cookies can be reused across ports after backend verification. Missing cookies use an HTTPS DSM account/password/OTP fallback; passwords and DSM credentials are not persisted. Plain UI is unsupported. App sessions last at most 15 minutes; sensitive operations revalidate live DSM cookies and local UID. Password-only sessions permit only basic app.status/greeting.get reads. Missing revalidation returns session_revalidation_required; files return dsm_session_required. Sign in to DSM on the same hostname. Web Station portal/proxy acceptance remains pending.
 
 B files needs the current user's DSM session. A jobs processes owner-bound private copies as the package account without administrator setup. Neither App identity nor login alone grants offline File Station access.
 
-C delegate is P2 integration in progress and rejected by the current CLI. Planned grants bind verified subject/uid, job, operations, scope and expiry. The executor rechecks account enablement and AppPriv and dispatches with the user's own permissions. User/admin revocation is required. R exposes only fixed admin operations; current approval is per operation. P2 shares one-time password-confirmed, digest-locked executor setup and reboot boot task between C/R. Do not invent final API names or claim complete cleanup before integration acceptance.
+
+## Permanent destination integration
+
+`init --with delegate` / `add delegate` default to `operations: [files.moveFromStaging]`,
+`destinations: [save]`, `lifetime: until-revoked`, `scope: home`. Existing legacy
+TTL declarations retain their 1–3600 second service / 30-day wire ceiling and
+64 MiB / 60-second URL example. Do not apply those limits to the new move API.
+Delegate can coexist with daemon; ordinary standalone jobs cannot. Preserve
+App business route floors. Binary/compose remain unsupported.
+
+Use File Station `/home[/...]`, never `/homes/<user>`. The SDK destination picker
+selection itself grants access after fresh DSM session/UID/write verification,
+without a second consent dialog. Ordinary and administrator subjects use their
+own nonzero UID/current groups, never root. An online App can create an in-scope
+grant using a valid session; there is no trusted external consent or notification.
+
+Use the default `createBackgroundSaveFacade(ctx)` / CapabilityPanels management
+page. `delegate.status` exposes verified `disabled` and manifest mode; missing
+protected evidence must not imply enabled. `delegate.operations.list` accepts
+only `{}`, uses the backend move mirrors, and returns the caller's username+UID
+operations only, including for admins. Mirrors are not completion receipts:
+query original `delegate.operations.get` and show Saved only for committed with
+a receipt. Cancel by the same reference; revoke by grant ID. Never resubmit
+uncertain/interrupted work. Admin disable is protected and revokes grants;
+enable/mailbox start does not resurrect them. Keep IDs, never session credentials.
+
+App-owned daemon completion and scheduled CSV export call configured Go
+`Service.MoveFromStaging` with `delegation_id`, stable `job_id`, private relative
+`staging`, `name`, `size`. No owner/UID selector. Bounds: 16 GiB/file, queued16,
+active1/package, 24-hour attempt, 5-second revalidation ticks (one check at a time, 30-second complete-check deadline; proven timeouts retain private copying, publication still revalidates), 10 MiB operation records,
+50 MiB audit. Scope is a usage restriction, not hard subtree confinement.
+Local production-executor fixtures use fake DSM/peer/bulk writer; do not claim
+NAS ACL, actual writer UID, logout/reboot or full lifecycle acceptance from them.
+Gopeed product wiring remains a separate task.
+
+Admission recovery (per job): on `EXECUTOR_UNAVAILABLE`, `EXECUTOR_TIMEOUT`,
+`EXECUTOR_PROTOCOL`, `canceled`, `EXECUTOR_PAUSED`, `queue-full`,
+`STORAGE_ERROR`, `ADMISSION_PENDING`, `jobs_busy` or `jobs_unavailable` (the
+package journal was busy or failed transiently; a caller deadline or cancel
+spent waiting for it is `canceled`), call `MoveFromStaging` again later with
+the same exact params. It queries the original reference first and re-sends
+admission only when the executor does not know it and the pinned source is
+unchanged; executor tuple deduplication keeps one operation, so a lost reply or a
+racing caller never copies twice. At most 10 possibly-delivered sends, 2 s
+backoff doubling to 5 min; the worker sweep does the same. Terminal, do not
+retry: `APP_DENIED`, `DELEGATION_DENIED`, `operation-conflict`, `disabled`,
+`SCOPE_DENIED` and other executor refusals, `STAGING_CHANGED`,
+`ADMISSION_EXHAUSTED`, `spool_unsafe` and `journal_corrupt` (repair the package
+spool first), and `operation-not-found` for an accepted operation.
+Never change job/grant IDs, delete mirrors or call the socket directly to retry.
+
+Cancellation (per job): `CancelOperation` / `delegate.operations.cancel` with the
+original ref is idempotent; repeat it with the same ref after any retryable
+error or a lost reply. A reply `queued`→`canceled` is final at once. A copy in
+flight answers `copying` with code `CANCEL_REQUESTED`: the cancel is accepted and
+durable, not finished; poll `OperationStatus` on the same ref until terminal
+(repeating the cancel is harmless). `canceled` (`OPERATION_CANCELED`) guarantees the writer
+stopped, its part file is removed, nothing was published and staging is kept; it
+stays canceled across executor crash, package stop/start and logout. `committed`
+means publication won the race: the file stays (cancel never removes it) and only
+the app record may be dropped. `uncertain` means a publish attempt failed before
+the cancel; keep querying. A cancel of a ref the executor has not admitted yet
+(reserved/sent mirror) returns `canceled` and leaves a tombstone, so a late or
+recovered admission of that ref returns `canceled` and never copies; a producer
+cancel is also written to the mirror first, so `MoveFromStaging` and the worker
+sweep forward the cancel instead of admitting it.
+
+RootOps/delegate share PasswordConfirm-approved digest-pinned setup with exact task readback and health. Pins changes require reapproval. The separate native authorization-sdk adapter must not mix its tasks with generated executor tasks.
 
 Compose uses its DSM gateway plus upstream authentication. A fixed service UID/GID identifies the service, not the browser user. Do not infer general SSO or per-user file authority from a service mount.

package/skills/reference/portal.md

@@ -0,0 +1,17 @@
+# DSM Application Portal
+
+Declare: native-go/binary `portal: {}` or `portal: {alias: my-app}` in dsm-package.yaml (`synopkgland add portal`); Compose `integration.web.portal: {}` only for a DSM-window app behind the DSM auth gateway. The alias defaults to the package name in lowercase. Aliases are 1–64 lowercase letters, digits or `-`, not starting or ending with `-`, and not a DSM path or Synology App alias (`webman`, `file`, …). The native-layout `backend: {kind: native}` owns its conf/scripts: the SDK does not register a portal for it.
+
+Build: the SPK carries `etc/portal.json` (every field DSM's app-portal worker needs) and `etc/portal.mustache`, `conf/resource` registers them, and the install wizard adds a prefilled alias step. preinst validates the answer; postinst stores it as the package's own draft and default alias. Nothing is active until an administrator applies it. `inspect <spk> --json` reports `portal: {appId, alias}` and refuses any other portal content.
+
+Activate: DSM owns the saved setting. Administrators use the app's portal panel (`ctx.portal.apply(alias)` / `disable()`, DSM `SYNO.Core.AppPortal set` with their own session; DSM refuses non-administrators with 105) or Control Panel > Login Portal > Applications (`ctx.portal.openControlPanel()`). DSM errors map to `portal_alias_invalid`, `portal_alias_reserved`, `portal_alias_in_use`, `admin_required`, `portal_unavailable`.
+
+Read: ordinary users call the Go backend's `portal.status` (`authenticated`), which reads `/var/packages/<package>/etc/AppPortal.json` read-only, bounded (64 KiB, no symlinks, one JSON object, matching app id). Anything else is `unavailable` and the UI shows "ask an administrator". A binary CGI must implement the same `{state, alias}` answer itself or ordinary users never see the link.
+
+DSM floor: os_min_ver must be 7.3.2-86009 or later. DSM 7.1.1-42962 refuses an unsigned SPK whose conf/resource carries web-config app-portal (Package Center error 320, "non-synology-signed package should not use internal worker"); 7.3.2-86009 and 7.4 install it; 7.2 and 7.3.0/7.3.1 are untested (unknown). validate/build fail with `STANDALONE_PORTAL_MIN_DSM` / `CONTRACT_PORTAL_MIN_DSM`, `--min-dsm` cannot go below it, `add portal` raises a lower os_min_ver, and inspect flags a lower INFO os_min_ver. Fix: raise os_min_ver or remove the portal.
+
+Capability: beyond that floor, no version gate. The panel needs SYNO.API.Info to list `SYNO.Core.AppPortal` (v2) and the app's registration to exist; otherwise administrators get only the Control Panel shortcut.
+
+UI: plain JS calls `ctx.portal && ctx.portal.mountPanel(element)` and disposes it on unmount; Vue renders `portal/PortalSettings.vue`. `ctx.portal.messages` carries the SDK text in all nine languages.
+
+Never: write `AppPortal.json`, `@appconf/<package>` or `/usr/syno/etc/www/app.d`; add a backend route that changes the alias; relay QuickConnect responses or build QuickConnect links; reboot or change other packages' portal entries while testing. DSM keeps the alias across upgrades and removes the entry on uninstall.

package/skills/reference/ui-vue.md

@@ -69,3 +69,15 @@ handlers; it does not replace the Vue build, tests or actual-app screenshots.
 Finally run the project's `check --json`, `build --json` and
 `inspect <spk> --json` workflow from AGENTS.md. Fix errors, warnings and layout
 issues before handing over the app.
+
+
+## Delegate scope Settings
+
+Default delegate uses `install-selected`. Keep ExecutorSettings and BackgroundSavePanel
+in the existing Settings surface. Show the installer draft only as a pre-selection;
+follow protected `selection` from `delegate.status` / `sdk.destination(key)`. Use
+`ctx.executor.authorize(password, scope)` for both first enable and scope changes,
+with the same PasswordConfirm form and no extra dialog. Mismatch must be explicit.
+Restrict the existing NasPicker to `selection.root`; do not grant via cached paths.
+The default facade includes typed `destination(key)` and `exportExample({key,job_id})`;
+use original operation references and display Saved only for protected receipts.

package/templates/_daemon/main_test.go

@@ -41,9 +41,15 @@ func fixture(t *testing.T, mode string) (string, string, string) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(dest, "daemon/payload/app"), raw, 0755); err != nil {
+	app := filepath.Join(dest, "daemon/payload/app")
+	if err := os.WriteFile(app, raw, 0755); err != nil {
 		t.Fatal(err)
 	}
+	// macOS verifies a newly written executable on its first exec, which takes
+	// seconds on a loaded host; pay it here, not inside a one-second budget.
+	if raw, err := exec.Command(app, "cleanup").CombinedOutput(); err != nil {
+		t.Fatalf("payload warm-up: %v %s", err, raw)
+	}
 	cfg := config{Package: "DaemonFixture", Exec: "app", Args: []string{"${SYNOPKG_PKGVAR}/a space", "$(touch BAD)'", "${SYNOPKG_PKGDEST}"}, Env: map[string]string{"APP_MODE": mode}, Timeouts: deadlines{Start: 2, Stop: 2, Status: 1}}
 	if os.Geteuid() == 0 {
 		cfg.Package = "nobody"
@@ -91,22 +97,69 @@ func runControl(control, action, dest, data string) (int, string) {
 	return -1, err.Error()
 }
 
+// Readiness only proves the child stayed alive for a second, not that it reached
+// main: on a loaded host a stop can kill it before it writes its line. Spawn
+// identity therefore comes from the inventory, and log content is awaited.
+func recordedChild(t *testing.T, data string) int {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join(data, "daemon/daemon.pid"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var r record
+	if err := json.Unmarshal(raw, &r); err != nil || r.Child < 1 {
+		t.Fatalf("daemon inventory: %v %s", err, raw)
+	}
+	return r.Child
+}
+
+func awaitChildLines(t *testing.T, data string, want int) {
+	t.Helper()
+	path := filepath.Join(data, "daemon/daemon.log")
+	for deadline := time.Now().Add(10 * time.Second); ; time.Sleep(20 * time.Millisecond) {
+		raw, _ := os.ReadFile(path)
+		if got := strings.Count(string(raw), `"uid":`); got >= want || time.Now().After(deadline) {
+			if got != want {
+				t.Fatalf("child lines=%d want=%d: %s", got, want, raw)
+			}
+			return
+		}
+	}
+}
+
 func TestDaemonLifecycle(t *testing.T) {
 	control, dest, data := fixture(t, "normal")
-	for _, step := range []struct {
-		action string
-		want   int
-	}{{"status", 3}, {"stop", 0}, {"start", 0}, {"status", 0}, {"start", 0}, {"restart", 0}, {"stop", 0}, {"stop", 0}, {"status", 3}, {"unknown", 1}} {
-		if rc, out := runControl(control, step.action, dest, data); rc != step.want {
-			t.Fatalf("%s rc=%d want=%d: %s", step.action, rc, step.want, out)
+	step := func(action string, want int) {
+		t.Helper()
+		if rc, out := runControl(control, action, dest, data); rc != want {
+			t.Fatalf("%s rc=%d want=%d: %s", action, rc, want, out)
 		}
 	}
+	step("status", 3)
+	step("stop", 0)
+	step("start", 0)
+	awaitChildLines(t, data, 1)
+	first := recordedChild(t, data)
+	step("status", 0)
+	step("start", 0)
+	if child := recordedChild(t, data); child != first {
+		t.Fatalf("duplicate start spawned another child: %d replaced %d", child, first)
+	}
+	step("restart", 0)
+	if child := recordedChild(t, data); child == first {
+		t.Fatalf("restart kept child %d", child)
+	}
+	awaitChildLines(t, data, 2)
+	step("stop", 0)
+	step("stop", 0)
+	step("status", 3)
+	step("unknown", 1)
 	raw, err := os.ReadFile(filepath.Join(data, "daemon/daemon.log"))
 	if err != nil {
 		t.Fatal(err)
 	}
 	if strings.Count(string(raw), `"uid":`) != 2 {
-		t.Fatalf("duplicate start spawned another child: %s", raw)
+		t.Fatalf("unexpected child spawn: %s", raw)
 	}
 	if strings.Contains(string(raw), "must-not-leak") {
 		t.Fatalf("ambient environment leaked: %s", raw)

package/templates/_executor/README.md

@@ -7,9 +7,16 @@ including newline at most 65536 bytes). Socket access additionally requires exac
 Linux SO_PEERCRED UID equality, even for another member of the package group.
 Non-Linux builds support portable tests and refuse privileged service operations.
 
+Fixed writer children verify `no_new_privs` with `PR_GET_NO_NEW_PRIVS` on their
+locked Linux thread. DSM kernel 4.4 supports this flag but omits its proc status
+field; a failed syscall or a value other than one still refuses the write.
+Saved IDs and zero capabilities remain mandatory. The parent passes the pinned
+package-owned private source as a read-only FD; destination creation and publish
+remain under the subject UID, and source cleanup runs under the package UID.
+
 ## Protected inventory and policy
 
-Setup must copy the digest-pinned executor, policy and root scripts into:
+Setup must copy the INFO-anchored executor, policy-pinned policy and root scripts into:
 
 ```
 /usr/local/etc/synopkgland/<package>/             root:root 0700
@@ -74,7 +81,7 @@ operations and policy-excluded operations are rejected. Replies follow §2.4.
 
 | Operation | Parameters | Result |
 | --- | --- | --- |
-| status | none | executor_digest, policy_digest, version, ready |
+| status | none | executor_digest, policy_digest, version, ready, disabled |
 | delegate.create | job_id, ops[], scope, path, ttl_seconds | delegation_id, subject {username, uid}, expires_at (RFC3339) |
 | delegate.list | none | delegations[] with public metadata, including revoked/expired records |
 | delegate.revoke | delegation_id; job_id required without cookie | revoked |
@@ -86,7 +93,7 @@ operations and policy-excluded operations are rejected. Replies follow §2.4.
 Create/list require a cookie and SynoToken. Revoke accepts the subject/admin session pair or a matching
 package job ID. Root operations require the session pair independently verified as an
 active administrators member. Delegated operations recheck the account, UID,
-expired=`normal`, non-admin membership, App and File Station privileges, scope,
+expired=`normal`, App and File Station privileges, scope,
 job, operation, expiry and revocation. UIDs below 1024 are excluded as system
 accounts. TTL must be 1–2592000 seconds. No cookie/SynoToken/SID/password is persisted.
 
@@ -94,22 +101,26 @@ Paths use File Station spellings `/home[/...]` or `/<share>[/...]`. A delegation
 binds the requested directory's canonical path. Symlinks resolving outside that
 directory are denied. `files.write` opens package-owned, singly linked regular
 staging files with no symlink components; its fresh child checks setgroups,
-setresgid and setresuid in order, then all real/effective IDs and groups. The child
+setresgid and setresuid in order, then real/effective/saved/filesystem IDs and groups, empty capability sets and
+`no_new_privs`. Admin users retain their own nonzero UID and current groups. The child
 opens the destination after dropping identity, verifies its pinned directory and
 scope, and copies into an exclusive hidden `.synopkgland-<job_id>-<random>.part`
 file. After fsync it publishes the complete file with a hard link, then removes
 the temporary name. Existing files and symlinks are never overwritten. The
 executor cleans the exact temporary name as the subject user after a canceled or
 killed child, using a retained directory descriptor; startup performs no scan.
-Successful writes delete staging. DSM ACL inheritance can
+Successful writes request exact source cleanup in a separate package-UID child;
+cleanup failure retains the source and never downgrades a committed receipt. DSM ACL inheritance can
 produce a mode different from the requested 0600 (observed 0711 on vt-nas).
 
 File Station CheckPermission uses v3 with a fixed non-overwriting probe filename
 and size zero; it creates no file. Missing/failed API data is denied. DSM output
 and root script output are capped at 1 MiB; commands have 20-second deadlines,
 connection read/write deadlines are 15/5 seconds and request execution is bounded
-by 30 seconds. At most 16 connections are admitted. Execution/revocation are
-serialized. Linux command timeouts kill the entire command process group.
+by 30 seconds. At most 16 connections are admitted. Legacy runner APIs use short
+admission leases; revoke/disable persist the fence then drain accepted legacy
+calls outside the commit lock before acknowledging. Bulk copy holds no commit
+lock. Linux command timeouts kill the entire command process group.
 
 File Station APIs resolve path strings inside DSM after executor scope validation;
 there is no atomic DSM API for binding that subsequent lookup to our directory
@@ -122,13 +133,20 @@ items, not assertions of complete race freedom.
 
 ```
 executor serve --package com.example.downloader
+executor supervise --package com.example.downloader
 executor control start --package com.example.downloader
 executor control stop --package com.example.downloader
 executor control purge --package com.example.downloader
 ```
 
 Root control start launches asynchronously; the caller reads socket status to
-establish readiness. A held flock pidfile refuses duplicate serve. Root's pinned
+establish readiness. It starts `executor supervise`, a root supervisor that runs
+`serve` as its child and restarts it after an abnormal end (signal or non-zero
+exit) with a 1 s backoff doubling to 60 s, reset after a minute of healthy run.
+A restarted `serve --revived` honors a `stop` already in the mailbox. Exit 0
+(root replacement, shutdown, purge), exit 3 (another monitor holds the pidfile)
+or a removed runtime end supervision. A held flock pidfile refuses duplicate
+serve. Root's pinned
 boot/control start can validate and terminate a previous monitor before launching
 its replacement; package-account start only writes the mailbox and cannot replace
 runtime. Stop pauses the listener while the monitor continues. Purge removes this
@@ -136,7 +154,8 @@ package's protected state and deletes only its verified recorded scheduler tasks
 
 Run `go test -race ./...` and `bash scripts/ci/gate.sh native-go`. The gate adds
 Linux amd64/arm64 vet, static binary builds and test compilation. Linux-specific
-syscall tests also run on vt-nas from a cross-compiled test executable. The
+syscall tests require a disposable Linux root fixture. This revision was tested
+on a Linux VM; DSM ACL, logout and reboot behavior remain unverified. The
 `testdata/live_probe.py` harness expects isolated disposable accounts and a
 manually copied runtime, reads passwords only from stdin, and logs no credentials.
 The live harness uses DSM's registered `SYNO.Desktop` AppPriv ID as a stand-in for
@@ -148,12 +167,17 @@ an installed App; installed-package AppPriv integration belongs to setup testing
 Package-account hooks atomically write `stop` before upgrades/stops, `start` on
 install/upgrade completion and package start, and `purge` before uninstall.
 `stop` cancels/drains requests and removes the listener without ending the root
-monitor. `start` resumes only if both package executor and policy hashes equal
-the approved runtime pins; otherwise the service stays paused for administrator
-approval. Only root's pinned boot/control path can replace a monitor or runtime.
+monitor. `start` resumes if both package executor and policy hashes equal the approved
+runtime pins. If only the executor changed, the policy hash is unchanged and the
+executor hash equals the single `synopkgland_executor_sha256` key in the
+root-owned `/var/packages/<package>/INFO`, the root monitor copies it into
+`runtime/`, verifies the copy and runs root `control start`, which replaces the
+monitor without reapproval. Any other change stays paused for administrator
+approval. Only root's pinned boot/control path or this anchored install can
+replace a monitor or runtime.
 
 At start, scheduler readback must exactly match the canonical lifecycle scripts
-regenerated from the package identity and approved executor/policy pins. Package
+regenerated from the package identity and approved policy pin. Package
 setup metadata supplies hints only. The verified names, pins and script hashes
 are stored in root:root 0600 `runtime/tasks.json`. Purge regenerates the scripts
 and revalidates each current definition before EventScheduler v1
@@ -188,9 +212,10 @@ and `purge` clears state immediately. A root-approved new monitor ignores the
 stop file already present at startup; that exception ends after an absence.
 
 The boot task checks pending purge/package disappearance before accessing source.
-It verifies retained pins and protected copies again before offline purge. Normal
-boot installs verified copies and calls root control start to replace a previous
-monitor. Scripts stay within 1 KiB with no percent characters, including the
+It verifies the retained policy pin before offline purge from the root-only
+runtime. Normal boot verifies the copies against the policy pin and the INFO
+executor anchor, installs them and calls root control start to replace a
+previous monitor. Scripts stay within 1 KiB with no percent characters, including the
 longest package name. Partial/tampered retained state requires administrator
 review. All nine uninstall wizard locales name the two tasks and disclose the
 retained DSM storage/infrastructure. `inspect`/`status` cleanup guidance is
@@ -202,3 +227,89 @@ a directory descriptor and verified with fstat, so boot umask 0077 cannot reduce
 validated and never repaired/adopted. The package directory must already have
 root/package-group ownership. The socket is set to root/package-group 0660 and
 verified using Linux O_PATH + fstat on its filesystem inode.
+
+## Explicit long-running v1 extension
+
+The pinned policy opts in with top-level `destinations: ["save"]` and
+`lifetime: "until-revoked"`, together with `files.moveFromStaging` in the
+operation allowlist. Destination keys match `^[a-z][a-z0-9_-]{0,63}$`; unknown
+keys/lifetimes fail closed. Legacy policies/TTL grants never become permanent.
+The existing v1 envelope, peer UID check, protected runtime and session verifier
+remain unchanged. `root.run` is independent and is never a writer fallback.
+
+| Operation | Parameters | Result |
+| --- | --- | --- |
+| delegate.create (permanent) | scope, ops:[files.moveFromStaging], path, destination, lifetime:until-revoked | delegation_id, subject, path, destination, lifetime; zero expiry |
+| files.moveFromStaging | delegation_id, job_id, staging, name, size | job_id, state |
+| files.operationStatus | original delegation_id, job_id | job_id, state, optional code/receipt |
+| files.cancelOperation | original delegation_id, job_id | current operation state |
+| delegate.disable / delegate.enable | none; live administrator session | disabled |
+| delegate.audit | none; live owner/admin session | latest bounded events |
+
+Permanent create needs the current user's cookie and SynoToken and a successful
+File Station write check. The executor derives username/UID and exact directory
+identity itself. Permanent revoke is owner-bound even for administrators; admins
+can disable the entire package. Auth-less operation submission/status/cancel is
+for the trusted package producer holding the grant reference and original job ID.
+If credentials are supplied, both must verify and the owner must match; failed
+caller auth never falls back to offline authority. A compromised package backend
+can use all valid grants it holds, as documented in the approved trust model.
+
+Grants survive service restart in the protected store. The disabled flag also
+survives; mailbox start/boot never clears it. Disable persists first and revokes
+all legacy/permanent grants. Enable checks the live admin session and completes
+revocation before clearing the flag; it never restores old grants. Repeated enable
+while already enabled is a no-op.
+
+Operations are separate `operation-<sha256(job_id)>.record` files, root:root 0600.
+They bind immutable grant/job/staging/name/size and move through queued, copying,
+committed, canceled, interrupted or uncertain. Queued resumes without credentials;
+copying becomes interrupted on restart, or uncertain after durable publish intent.
+Neither state is replayed. Changed input for the same job is `operation-conflict`.
+Committed status alone includes `receipt:{path,size}`. Cleanup failures retain
+committed and add `CLEANUP_PENDING`. No same-name/hash guessing establishes receipt.
+
+Limits: 16 GiB per file, actual size+1 read, 16 queued, one active copy per package,
+24-hour attempt, 10 MiB operation metadata. Full journals reject new admissions;
+terminal records are retained to prevent replay. Bulk input bypasses job spools
+and the old 64 MiB wrapper limit. Long copies revalidate account/AppPriv/ACL/path
+with five-second polling and bounded checks; publish revalidates again. A failed
+identity/ACL/path check invalidates the grant and requires a new selection.
+
+The fixed child drops identity before opening the destination and creating any
+inode. Every component uses FD-relative O_NOFOLLOW; ancestors use O_PATH so only
+search rights are required. Source is package-owned, regular and singly linked;
+destination is the exact granted device/inode, never a caller-supplied path.
+Part metadata is durable before copying. Publish links the open part inode with
+no replacement, refusing files/symlinks/FIFOs at the final name. Revoke, disable
+and publish share the commit lock. Lost/malformed publish replies drain the child
+before releasing that lock and produce uncertain; a confirmed no-side-effect
+refusal such as `destination-exists` remains interrupted. The lock covers bounded
+publish handshake/fsync, never the bulk copy. During the copy the child watches
+its control pipe: if `serve` dies the pipe closes, so the child stops within one
+1 MiB chunk and unlinks its part (no `PR_SET_PDEATHSIG`, which the identity drop
+clears; works on kernel 3.10). Kernel-blocked filesystem I/O can
+still delay draining; it cannot be declared safely complete by a timeout.
+Legacy `files.write` uses this same child and publish handshake; the executor
+has no other writer, so no child can publish after `serve` is gone.
+
+Destination/part cleanup runs as the owner; source cleanup runs as package UID.
+Restart cleans only journaled exact part identity as the current eligible owner;
+changed/missing/inaccessible directories are retained for review, never scanned
+or deleted as root. Subject-controlled directory moves after the final check
+can still complete in the pinned directory object. DSM ACL changes and publication
+are not atomic, and silent UID/inode reuse is not universally detected. A subject
+who owns the destination can mutate its own output; this is not a content sandbox.
+
+Structured audit lives in protected `audit.jsonl`/`audit.previous`, at most 50 MiB
+combined, separate from authority. Events include package, username/UID, operation,
+job, location and result; no session credentials. Owner queries are filtered,
+admins can view this package's events. Replies contain at most 256 events/1 MiB.
+Admission events are labeled `admitting` because a subsequent durable write can
+fail. The operation journal, not an admission audit event, establishes completion.
+
+The existing status operation reads `Store.Disabled`; protected-store errors set
+`ready:false` rather than assuming enabled. Backend `delegate.status` exposes the
+verified boolean and `disabled` capability state. Backend `delegate.operations.list`
+is strictly empty-params, freshly owner/UID-filtered move-mirror metadata; it is
+not an executor operation. Live completion remains `files.operationStatus`.