@synopackageland/cli 0.7.0 → 0.7.2

package/dist/standalone/root-window.js

@@ -1,23 +1,47 @@
 import { bootDefinition, controlDefinition } from '../runtime/executor-tasks.js';
 import { executorScopeTask } from '../runtime/executor-scope-task.js';
+import { versionUnsupported } from '../runtime/dsm-version.js';
 export { executorTasks as rootTasks } from '../runtime/executor-tasks.js';
 /** Exact readback is authoritative. PasswordConfirm tokens are reused immediately,
  * across both Root APIs, and never persisted (DSM validity is about 300 seconds). */
 export const ROOT_RUNTIME = `function createRootAccess(options) {
   var eventAPI = "SYNO.Core.EventScheduler", taskAPI = "SYNO.Core.TaskScheduler";
-  var busy = null;
-  function fail(code) { var e = new Error(code); e.code = code; return e; }
+  var busy = null, legacy = false;
+  var versionUnsupported = ${versionUnsupported.toString()};
+  function fail(code, detail) { var e = new Error(code); e.code = code; if (detail) e.detail = detail; return e; }
   function reason(e) {
     var code = String(e && e.code || "executor_bad_response");
+    if (e && e.passwordConfirm) return code + (code === "dsm_3121" ? ": DSM rejected the administrator password." : ": administrator password confirmation failed.") + " Nothing was created.";
+    if (e && e.detail) return code + ": " + e.detail;
     return code + (code === "105" || code === "dsm_105" ? ": DSM denied administrator scheduler access. Check the DSM session and scheduler; a NAS restart resolved this on the measured DSM. No automatic retry was made." : ": scheduler readback or operation failed.");
   }
   // AppWindow.sendWebAPI encodes JSON parameters. Preserve their native types;
   // pre-encoding turns objects/booleans into strings and DSM rejects create.
   function send(api, method, version, params) { return options.send(api, method, version, params || {}); }
+  // DSM 7.1 has no Root APIs: TaskScheduler stops at list v2 (offset) and get v3.
+  // Only an unsupported method version on a read selects that profile, which
+  // then creates through the plain scheduler APIs. Writes never fall back.
+  function taskRead(method, version, params, legacyVersion, legacyParams) {
+    if (legacy) return send(taskAPI, method, legacyVersion, legacyParams);
+    return send(taskAPI, method, version, params).catch(function (e) {
+      if (!versionUnsupported(e && e.code)) throw e;
+      legacy = true;
+      return send(taskAPI, method, legacyVersion, legacyParams);
+    });
+  }
+  function create(boot, params, confirmation) {
+    if (legacy) return send(boot ? eventAPI : taskAPI, "create", boot ? 1 : 3, params);
+    params.SynoConfirmPWToken = confirmation.token;
+    return send(boot ? eventAPI + ".Root" : taskAPI + ".Root", "create", boot ? 1 : 4, params);
+  }
+  function remove(task, ref) {
+    var boot = task.kind === "boot";
+    return send(boot ? eventAPI : taskAPI, "delete", boot ? 1 : 2, boot ? ref : {tasks: [ref]});
+  }
   function admin() { if (!options.user() || options.user().admin !== true) throw fail("admin_required"); }
   function find(task) {
     var boot = task.kind === "boot";
-    return send(boot ? eventAPI : taskAPI, "list", boot ? 1 : 3, boot ? {} : {start: 0, limit: 500}).then(function (data) {
+    return (boot ? send(eventAPI, "list", 1, {}) : taskRead("list", 3, {start: 0, limit: 500}, 2, {offset: 0, limit: 500})).then(function (data) {
       var records = boot ? data : data && data.tasks;
       if (!Array.isArray(records) || records.length > 500 || (!boot && (!Number.isInteger(data.total) || data.total !== records.length))) throw fail("executor_bad_response");
       var named = records.filter(function (r) { return r && (boot ? r.task_name : r.name) === task.name; });
@@ -26,7 +50,7 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
       var summary = named[0];
       if (!boot && !/^[0-9]+$/.test(String(summary.id))) throw fail("executor_bad_response");
       var ref = boot ? {task_name: task.name} : {id: summary.id, real_owner: "root"};
-      var detail = send(boot ? eventAPI : taskAPI, "get", boot ? 1 : 4, ref);
+      var detail = boot ? send(eventAPI, "get", 1, ref) : taskRead("get", 4, ref, 3, ref);
       return detail.then(function (r) {
         var owner = r && r.owner;
         var root = owner === "root" || (boot && owner && owner["0"] === "root");
@@ -49,6 +73,16 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
       return result;
     });
   }
+  // Removes, newest first, the tasks one approval created and still reads as
+  // exactly ours. Resolves with the last refusal's reason, if any.
+  function withdraw(created) {
+    var failed;
+    return created.reduceRight(function (withdrawn, task) {
+      return withdrawn.then(function () { return find(task); }).then(function (current) {
+        if (current.state === "ready") return remove(task, current.ref);
+      }).catch(function (e) { failed = reason(e); });
+    }, Promise.resolve()).then(function () { return failed; });
+  }
   function definition(task) { return task.kind === "boot" ? (${bootDefinition.toString()})(task) : (${controlDefinition.toString()})(task); }
   function approve(password, selectedScope) {
     var selectionTask;
@@ -56,10 +90,13 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
     return read().then(function (before) {
       if (before.state === "blocked" || before.state === "unsupported") return before;
       if (before.state === "ready" && !selectionTask) return start(before);
-      return options.confirmPassword(password).then(function (confirmation) {
+      return options.confirmPassword(password).catch(function (e) {
+        throw {code: e && e.code, passwordConfirm: true};
+      }).then(function (confirmation) {
         if (!confirmation || confirmation.confirmed !== true) return {state: "cancelled", tasks: before.tasks};
-        if (typeof confirmation.token !== "string" || !confirmation.token) throw fail("executor_confirmation_missing");
-        var errors = {};
+        // DSM 7.1 confirms the password server-side but issues no create token.
+        if (!legacy && (typeof confirmation.token !== "string" || !confirmation.token)) throw fail("executor_confirmation_missing");
+        var errors = {}, created = [], withdrawFailed;
         // Delete only a verified, same-header outdated task, then create the pinned
         // replacement. set has no measured wire contract. Re-read before each write.
         var chain = Promise.resolve();
@@ -68,22 +105,35 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
             return find(task).then(function (current) {
               if (current.state === "ready") return;
               if (current.state === "blocked") throw fail(current.reason);
-              var boot = task.kind === "boot";
-              var removed = current.ref ? send(boot ? eventAPI : taskAPI, "delete", boot ? 1 : 2, boot ? current.ref : {tasks: [current.ref]}) : Promise.resolve();
-              return removed.then(function () {
-                var params = definition(task); params.SynoConfirmPWToken = confirmation.token;
-                return send(boot ? eventAPI + ".Root" : taskAPI + ".Root", "create", boot ? 1 : 4, params);
-              });
+              var removed = current.ref ? remove(task, current.ref) : Promise.resolve();
+              return removed.then(function () { return create(task.kind === "boot", definition(task), confirmation); }).then(function () { created.push(task); });
             }).catch(function (e) { errors[task.kind] = reason(e); });
           });
         });
-        return chain.then(read).then(function (after) {
+        // A partial approval must not leave an enabled root bootup task that no
+        // control task or uninstall inventory owns: withdraw what it created.
+        return chain.then(function () {
+          if (Object.keys(errors).length) return withdraw(created).then(function (failed) { withdrawFailed = failed; });
+        }).then(read).then(function (after) {
           Object.keys(errors).forEach(function (kind) {
             if (after.tasks[kind].state !== "ready") { after.tasks[kind].state = "blocked"; after.tasks[kind].reason = errors[kind]; after.state = "blocked"; after.reason = errors[kind]; }
           });
+          if (withdrawFailed) { after.state = "blocked"; after.reason = (after.reason ? after.reason + " " : "") + "Withdrawing the tasks this approval created failed: " + withdrawFailed; }
           // A scope change must not restart a running executor: the boot task
           // stops it, which interrupts in-flight copies instead of canceling them.
           return after.state === "ready" ? (selectionTask ? running(after) : Promise.resolve(null)).then(function (live) { return live || start(after); }).then(function (started) {
+            // Without a running executor there is no task inventory, so uninstall
+            // cannot find these tasks: withdraw what this approval created.
+            if (started.state === "ready" || !created.length) return started;
+            return withdraw(created).then(function (failed) {
+              return read().then(function (current) {
+                current.state = "blocked";
+                current.reason = started.reason + (failed ? " Withdrawing the tasks this approval created failed: " + failed : " The tasks this approval created were withdrawn.");
+                current.retry = !failed;
+                return current;
+              });
+            });
+          }).then(function (started) {
             if (!selectionTask || started.state !== "ready") return started;
             var generation = started.executor.selection ? started.executor.selection.generation : 0;
             if (started.executor.selection && (!Number.isSafeInteger(generation) || generation <= 0)) throw fail("executor_selection_invalid");
@@ -102,23 +152,20 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
   function selectScope(task, confirmation, verified, selectedScope) {
     function removeExact() {
       return find(task).then(function (current) {
-        if (current.state === "ready") return send(taskAPI, "delete", 2, {tasks: [current.ref]});
+        if (current.state === "ready") return remove(task, current.ref);
         if (current.ref) throw fail("executor_selection_cleanup_conflict");
       });
     }
     return find(task).then(function (current) {
       if (current.state === "blocked" || current.state === "unsupported") throw fail("executor_selection_conflict");
-      var removed = current.ref ? send(taskAPI, "delete", 2, {tasks: [current.ref]}) : Promise.resolve();
-      return removed.then(function () {
-        var params = definition(task); params.SynoConfirmPWToken = confirmation.token;
-        return send(taskAPI + ".Root", "create", 4, params);
-      });
+      var removed = current.ref ? remove(task, current.ref) : Promise.resolve();
+      return removed.then(function () { return create(false, definition(task), confirmation); });
     }).then(function () { return find(task); }).then(function (current) {
       if (current.state !== "ready") throw fail("executor_selection_readback_mismatch");
       return send(taskAPI, "run", 2, {tasks: [current.ref]});
     }).then(function () {
       function readSelection(attempts) {
-        return health(verified, 1).then(function (current) {
+        return health(verified, 0).then(function (current) {
           if (current.state === "ready" && current.executor.selection && current.executor.selection.scope === selectedScope && Number.isSafeInteger(current.executor.selection.generation) && current.executor.selection.generation > 0) return current;
           if (attempts > 1 && options.wait) return options.wait(500).then(function () { verified.state = "ready"; return readSelection(attempts - 1); });
           throw fail("executor_selection_unconfirmed");
@@ -129,21 +176,35 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
       return removeExact().then(function () { throw error; });
     });
   }
-  function pinned(status) { return !!status && status.ready === true && !!options.pins && status.executor_digest === options.pins.executorDigest && status.policy_digest === options.pins.policyDigest; }
+  // Why a status reply is not the approved, running executor; null when it is.
+  function mismatch(status) {
+    if (!status || status.ready !== true) return "the approved executor is not answering" + (status && (status.reason || status.state) ? " (" + (status.reason || status.state) + ")" : "") + ".";
+    if (!options.pins || status.executor_digest !== options.pins.executorDigest || status.policy_digest !== options.pins.policyDigest) return "the running executor reports other digests than this package pins.";
+    return null;
+  }
+  function pinned(status) { return mismatch(status) === null; }
   function running(verified) {
     return options.call("executor.status", {}).then(function (status) {
       if (!pinned(status)) return null;
       verified.executor = status; return verified;
     }, function () { return null; });
   }
-  function health(verified, attempts) {
+  // budget: how long to keep asking after a start (ms). The wait doubles from
+  // 500 ms to 2 s so an open window does not poll the executor twice a second.
+  function health(verified, budget, delay) {
     if (verified.state !== "ready") return Promise.resolve(verified);
+    delay = Math.min(delay || 500, 2000);
     return options.call("executor.status", {}).then(function (status) {
-      if (!pinned(status)) throw fail("executor_status_mismatch");
+      var why = mismatch(status);
+      if (why) throw fail("executor_status_mismatch", why);
       verified.executor = status; return verified;
+    }, function (e) {
+      throw fail(e && e.code, "the executor status request failed.");
     }).catch(function (e) {
-      if (attempts > 1 && options.wait) return options.wait(500).then(function () { return health(verified, attempts - 1); });
-      verified.state = "blocked"; verified.reason = reason(e); return verified;
+      if (budget >= delay && options.wait) return options.wait(delay).then(function () { return health(verified, budget - delay, delay * 2); });
+      // The tasks are approved: approving again runs start, which restarts the
+      // executor without a password, so the panel offers it.
+      verified.state = "blocked"; verified.reason = reason(e); verified.retry = true; return verified;
     });
   }
   function start(verified) {
@@ -151,13 +212,17 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
       return send(eventAPI, "run", 1, verified.tasks.boot.ref);
     }).then(function () {
       // run can succeed for a nonexistent task. Read both definitions again.
-      return read().then(function (after) { return health(after, 20); });
+      return read().then(function (after) { return health(after, 10000); });
     }).catch(function (e) { verified.state = "blocked"; verified.reason = reason(e); return verified; });
   }
+  // The window panel and the app's own settings share this access; each
+  // result reaches every view so neither shows a stale state.
+  var listeners = [];
+  function publish(result) { listeners.forEach(function (listener) { listener(result); }); return result; }
   return {
-    status: function () { return read().then(function (verified) { return health(verified, 1); }); },
+    status: function () { return read().then(function (verified) { return health(verified, 0); }).then(publish); },
     authorize: function (password, selectedScope) {
-      if (!busy) busy = Promise.resolve().then(function () { return approve(password, selectedScope); }).catch(function (e) { return {state: "blocked", reason: reason(e), tasks: {}}; }).then(function (r) { busy = null; return r; });
+      if (!busy) busy = Promise.resolve().then(function () { return approve(password, selectedScope); }).catch(function (e) { return {state: "blocked", reason: reason(e), tasks: {}, retry: !!(e && e.passwordConfirm)}; }).then(function (r) { busy = null; return publish(r); });
       return busy;
     },
     control: function (action) {
@@ -166,9 +231,10 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
         if (verified.state !== "ready") throw fail("executor_not_ready");
         return options.call("executor.control", {action: action}).then(function () {
           return send(taskAPI, "run", 2, {tasks: [verified.tasks.control.ref]});
-        }).then(read).then(function (after) { return action === "start" ? health(after, 20) : after; });
-      });
-    }
+        }).then(read).then(function (after) { return action === "start" ? health(after, 10000) : after; });
+      }).then(publish);
+    },
+    subscribe: function (listener) { listeners.push(listener); }
   };
 }`;
 export const ROOT_PANEL = `function mountRootPanel(host, access, i18n, tasks, admin) {
@@ -176,9 +242,53 @@ export const ROOT_PANEL = `function mountRootPanel(host, access, i18n, tasks, ad
   var status = document.createElement("p"), approve = document.createElement("button"), retry = document.createElement("button");
   approve.textContent = "Approve background access"; retry.textContent = "Check status";
   host.appendChild(status); host.appendChild(approve); host.appendChild(retry);
-  function show(result) { status.textContent = result.state + (result.reason ? ": " + result.reason : ""); approve.hidden = result.state !== "needs-admin-approval"; }
+  function show(result) { status.textContent = result.state + (result.reason ? ": " + result.reason : ""); approve.hidden = result.state !== "needs-admin-approval" && result.retry !== true; }
   function run(fn) { approve.disabled = retry.disabled = true; return fn().then(show, function(e) { show({state: "blocked", reason: e.message || e.code}); }).then(function() { approve.disabled = retry.disabled = false; }); }
+  access.subscribe(show);
   approve.onclick = function() { return run(function() { return access.authorize(); }); };
   retry.onclick = function() { return run(function() { return access.status(); }); };
   run(function() { return access.status().then(function(result) { return result.tasks && result.tasks.boot && result.tasks.control && result.tasks.boot.state === "ready" && result.tasks.control.state === "ready" ? access.control("start") : result; }); });
 }`;
+/** Administrator password confirmation in the window's own session: a supplied
+ * password, or a masked form when none is given. */
+export const PASSWORD_CONFIRM = `function createPasswordConfirm(win) {
+  var versionUnsupported = ${versionUnsupported.toString()};
+  function send(password, version) {
+    return new Promise(function (resolve, reject) {
+      win.sendWebAPI({api: "SYNO.Core.User.PasswordConfirm", method: "auth", version: version, params: {password: password}, scope: win,
+        callback: function (success, response) {
+          if (!success) reject({code: "dsm_" + ((response && response.code) || "error")});
+          else resolve({confirmed: true, token: response && response.SynoConfirmPWToken});
+        }
+      });
+    });
+  }
+  // DSM 7.1 has PasswordConfirm v1 only, which checks the password but issues no
+  // token. Only an unsupported version is retried; a wrong password is not.
+  function auth(password) {
+    return send(password, 2).catch(function (error) {
+      if (!versionUnsupported(error.code)) throw error;
+      return send(password, 1);
+    });
+  }
+  return function (suppliedPassword) {
+    if (typeof suppliedPassword === "string" && suppliedPassword) return auth(suppliedPassword);
+    return new Promise(function (resolve, reject) {
+      var form = document.createElement("form"), label = document.createElement("label"), input = document.createElement("input");
+      var submit = document.createElement("button"), cancel = document.createElement("button");
+      label.textContent = "Confirm your DSM administrator password";
+      input.type = "password"; input.autocomplete = "current-password"; input.required = true;
+      label.appendChild(input); form.appendChild(label);
+      submit.type = "submit"; submit.textContent = "Approve"; form.appendChild(submit);
+      cancel.type = "button"; cancel.textContent = "Cancel"; form.appendChild(cancel);
+      win.body.dom.appendChild(form); input.focus();
+      function close() { input.value = ""; if (form.parentNode) form.parentNode.removeChild(form); }
+      cancel.onclick = function () { close(); resolve({confirmed: false}); };
+      form.onsubmit = function (event) {
+        event.preventDefault(); submit.disabled = cancel.disabled = true;
+        var password = input.value; input.value = "";
+        auth(password).then(function (result) { close(); resolve(result); }, function (error) { close(); reject(error); });
+      };
+    });
+  };
+}`;

package/dist/standalone/spk.js

@@ -4,7 +4,7 @@ import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync,
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { infoArchValue } from "../build-spk/dsm-arch.js";
-import { writeDsmWindowIcons, writePackageCenterIcons } from "../build-spk/dsm-icons.js";
+import { packageIcons, writeDsmWindowIcons, writePackageCenterIcons } from "../build-spk/dsm-icons.js";
 import { renderNativePrivilege } from "../build-spk/native-lifecycle.js";
 import { renderUninstallWizardFiles } from "../build-spk/uninstall-wizard.js";
 import { renderInstallWizardFiles, renderNativeInstallWizard } from "../build-spk/install-wizard.js";
@@ -13,7 +13,8 @@ import { renderDelegateScopeSteps } from '../build-spk/delegate-scope.js';
 import { createReproducibleTar } from "../build-spk/reproducible-archive.js";
 import { renderStandaloneScript } from "./lifecycle.js";
 import { DSM_LANGS, LOCALES } from "./i18n.js";
-import { CGI_PAYLOAD_PATH, renderUiConfig, renderWindowScript, windowScriptName } from "./dsm-window.js";
+import { appTitle, CGI_PAYLOAD_PATH, renderUiConfig, renderWindowScript, windowScriptName } from "./dsm-window.js";
+import { writeUiTexts } from "../build-spk/ui-texts.js";
 import { copyStandaloneNotices } from "../build-spk/notices.js";
 import { hostScriptName, renderHostAdapterScript } from "./host-adapter.js";
 import { copyDaemonPayload } from "./daemon.js";
@@ -54,6 +55,7 @@ export async function assembleStandaloneSpk(options) {
     try {
         if ((manifest.capabilities.rootOps || manifest.capabilities.delegate) && !options.executor)
             throw new StandaloneBuildError("EXECUTOR_PIN_REQUIRED", "Executor artifact required.");
+        const icons = packageIcons(manifest.icon);
         const uiRoot = join(staging, "package", "ui");
         const appDir = join(uiRoot, "app");
         copyUiTree(manifest.ui.dir, appDir);
@@ -61,7 +63,8 @@ export async function assembleStandaloneSpk(options) {
         writeFile(join(uiRoot, "config"), renderUiConfig(manifest));
         writeFile(join(uiRoot, windowScriptName(manifest)), renderWindowScript(manifest, assetVersion));
         writeFile(join(uiRoot, hostScriptName(manifest.build)), renderHostAdapterScript(manifest.package));
-        writeDsmWindowIcons(uiRoot);
+        writeDsmWindowIcons(uiRoot, icons);
+        writeUiTexts(uiRoot, appTitle(manifest));
         const cgiTarget = join(staging, "package", CGI_PAYLOAD_PATH);
         mkdirSync(dirname(cgiTarget), { recursive: true });
         copyFileSync(options.cgiPath, cgiTarget);
@@ -129,7 +132,7 @@ export async function assembleStandaloneSpk(options) {
             ...(folder ? renderSharedFolderUpgradeWizardFiles(manifest.package, folder) : {}),
             ...renderUninstallWizardFiles(manifest.package, "native", { executor: Boolean(options.executor) }),
         });
-        writePackageCenterIcons(staging);
+        writePackageCenterIcons(staging, icons);
         mkdirSync(dirname(options.outputPath), { recursive: true });
         await createReproducibleTar(staging, options.outputPath);
     }

package/dist/templates/_daemon/go.mod

@@ -2,4 +2,4 @@ module synopkgland-daemon
 
 go 1.24
 
-toolchain go1.26.8
+toolchain go1.26.9

package/dist/templates/_daemon/main.go

@@ -28,6 +28,9 @@ type deadlines struct {
 	Start  int `json:"start"`
 	Stop   int `json:"stop"`
 	Status int `json:"status"`
+	// Uninstall bounds uninstall_args separately from Stop: a revoke on a
+	// loaded NAS can take longer than stopping the daemon.
+	Uninstall int `json:"uninstall"`
 }
 type config struct {
 	Package       string            `json:"package"`
@@ -88,7 +91,7 @@ func load(dest, data string) (*controller, error) {
 	if cfg.Exec == "" || filepath.IsAbs(cfg.Exec) || filepath.Clean(cfg.Exec) != cfg.Exec || strings.HasPrefix(cfg.Exec, "../") {
 		return nil, errors.New("invalid fixed executable")
 	}
-	if cfg.Timeouts.Start < 2 || cfg.Timeouts.Start > 120 || cfg.Timeouts.Stop < 2 || cfg.Timeouts.Stop > 120 || cfg.Timeouts.Status < 1 || cfg.Timeouts.Status > 10 {
+	if cfg.Timeouts.Start < 2 || cfg.Timeouts.Start > 120 || cfg.Timeouts.Stop < 2 || cfg.Timeouts.Stop > 120 || cfg.Timeouts.Status < 1 || cfg.Timeouts.Status > 10 || cfg.Timeouts.Uninstall < 2 || cfg.Timeouts.Uninstall > 120 {
 		return nil, errors.New("invalid daemon deadlines")
 	}
 	hash := sha256.Sum256(raw)
@@ -162,7 +165,7 @@ func (c *controller) run(action string) (int, error) {
 		budget += c.Timeouts.Start
 	}
 	if action == "uninstall" {
-		budget += c.Timeouts.Stop + 1
+		budget += c.Timeouts.Uninstall + 2
 	}
 	if action != "start" && action != "stop" && action != "status" && action != "restart" && action != "uninstall" {
 		return 1, errors.New("unsupported daemon action")
@@ -414,7 +417,7 @@ func (c *controller) uninstall() error {
 	select {
 	case err := <-done:
 		return err
-	case <-time.After(time.Duration(c.Timeouts.Stop-1) * time.Second):
+	case <-time.After(time.Duration(c.Timeouts.Uninstall) * time.Second):
 		cmd.Process.Signal(syscall.SIGTERM)
 	}
 	select {

package/dist/templates/_daemon/main_test.go

@@ -50,7 +50,7 @@ func fixture(t *testing.T, mode string) (string, string, string) {
 	if raw, err := exec.Command(app, "cleanup").CombinedOutput(); err != nil {
 		t.Fatalf("payload warm-up: %v %s", err, raw)
 	}
-	cfg := config{Package: "DaemonFixture", Exec: "app", Args: []string{"${SYNOPKG_PKGVAR}/a space", "$(touch BAD)'", "${SYNOPKG_PKGDEST}"}, Env: map[string]string{"APP_MODE": mode}, Timeouts: deadlines{Start: 2, Stop: 2, Status: 1}}
+	cfg := config{Package: "DaemonFixture", Exec: "app", Args: []string{"${SYNOPKG_PKGVAR}/a space", "$(touch BAD)'", "${SYNOPKG_PKGDEST}"}, Env: map[string]string{"APP_MODE": mode}, Timeouts: deadlines{Start: 2, Stop: 2, Status: 1, Uninstall: 2}}
 	if os.Geteuid() == 0 {
 		cfg.Package = "nobody"
 	} else {
@@ -250,6 +250,26 @@ func TestUninstallCleanup(t *testing.T) {
 	}
 }
 
+// A revoke on uninstall can outlast the stop deadline on a loaded NAS; it has
+// its own budget instead of Stop-1.
+func TestUninstallCommandHasItsOwnBudget(t *testing.T) {
+	control, dest, data := fixture(t, "normal")
+	path := filepath.Join(dest, "daemon/config.json")
+	raw, _ := os.ReadFile(path)
+	var cfg config
+	json.Unmarshal(raw, &cfg)
+	cfg.UninstallArgs = []string{"cleanup-slow"}
+	cfg.Timeouts.Uninstall = 5
+	raw, _ = json.Marshal(cfg)
+	os.WriteFile(path, raw, 0644)
+	if rc, out := runControl(control, "start", dest, data); rc != 0 {
+		t.Fatalf("start: %d %s", rc, out)
+	}
+	if rc, out := runControl(control, "uninstall", dest, data); rc != 0 {
+		t.Fatalf("slow uninstall within its budget failed: %d %s", rc, out)
+	}
+}
+
 func TestPackageAccountIdentity(t *testing.T) {
 	control, dest, data := fixture(t, "normal")
 	path := filepath.Join(dest, "daemon/config.json")

package/dist/templates/_daemon/testdata/child.go

@@ -14,6 +14,9 @@ func main() {
 		switch os.Args[1] {
 		case "cleanup":
 			os.Exit(0)
+		case "cleanup-slow":
+			time.Sleep(2500 * time.Millisecond)
+			os.Exit(0)
 		case "cleanup-fail":
 			os.Exit(2)
 		case "cleanup-hang":

package/dist/templates/_executor/README.md

@@ -174,7 +174,10 @@ root-owned `/var/packages/<package>/INFO`, the root monitor copies it into
 `runtime/`, verifies the copy and runs root `control start`, which replaces the
 monitor without reapproval. Any other change stays paused for administrator
 approval. Only root's pinned boot/control path or this anchored install can
-replace a monitor or runtime.
+replace a monitor or runtime. To exercise this path on a NAS without a real
+executor change, the repository's `scripts/test/executor-bump.py` makes a
+build+1 SPK whose executor differs by one byte and rewrites the INFO anchor,
+`executor/setup.json` and the window script's embedded pins together.
 
 At start, scheduler readback must exactly match the canonical lifecycle scripts
 regenerated from the package identity and approved policy pin. Package

package/dist/templates/_executor/anchor.go

@@ -84,6 +84,11 @@ func installAnchored(ctx context.Context, source, info string, trusted func(os.F
 	if err != nil {
 		return err
 	}
+	// DSM links the package target to the volume; openRegular refuses links.
+	source, err = filepath.EvalSymlinks(source)
+	if err != nil {
+		return err
+	}
 	src, err := openRegular(filepath.Join(source, "executor"))
 	if err != nil {
 		return err
@@ -129,7 +134,12 @@ func startInstalled(runtime, pkg string) error {
 	return cmd.Process.Release()
 }
 
+// An anchored upgrade is handed to root start, which replaces this monitor:
+// only differing pins are an approval request, and only they say so.
 func approvedPins(state pinState, install, start func() error, log func(string)) bool {
+	if state == pinsDiffer {
+		log("executor paused: package pins require administrator approval")
+	}
 	if state != pinsAnchored {
 		return state == pinsMatch
 	}

package/dist/templates/_executor/anchor_test.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
+	"reflect"
 	"strings"
 	"testing"
 )
@@ -101,6 +102,8 @@ func TestInstallAnchoredReplacesOnlyTheProtectedExecutorWithVerifiedBytes(t *tes
 	}
 }
 
+// The pause message names administrator approval only when the pins differ:
+// an anchored handover is a finished upgrade, not a request for approval.
 func TestApprovedPinsHandOverAnAnchoredUpgradeToRootStart(t *testing.T) {
 	for _, tc := range []struct {
 		name       string
@@ -109,18 +112,50 @@ func TestApprovedPinsHandOverAnAnchoredUpgradeToRootStart(t *testing.T) {
 		open       bool
 		installs   int
 		starts     int
+		logged     string
 	}{
-		{"match", pinsMatch, nil, true, 0, 0},
-		{"differ", pinsDiffer, nil, false, 0, 0},
-		{"anchored", pinsAnchored, nil, false, 1, 1},
-		{"install failed", pinsAnchored, errors.New("digest"), false, 1, 0},
+		{"match", pinsMatch, nil, true, 0, 0, ""},
+		{"differ", pinsDiffer, nil, false, 0, 0, "executor paused: package pins require administrator approval"},
+		{"anchored", pinsAnchored, nil, false, 1, 1, "executor upgrade: INFO-anchored executor installed under the approved policy"},
+		{"install failed", pinsAnchored, errors.New("digest"), false, 1, 0, "executor upgrade refused: INFO-anchored executor could not be installed"},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			installs, starts := 0, 0
-			open := approvedPins(tc.state, func() error { installs++; return tc.installErr }, func() error { starts++; return nil }, func(string) {})
+			var logged []string
+			open := approvedPins(tc.state, func() error { installs++; return tc.installErr }, func() error { starts++; return nil }, func(s string) { logged = append(logged, s) })
 			if open != tc.open || installs != tc.installs || starts != tc.starts {
 				t.Fatal("handover", open, installs, starts)
 			}
+			if want := []string{tc.logged}; tc.logged == "" {
+				if len(logged) != 0 {
+					t.Fatal("matching pins logged", logged)
+				}
+			} else if !reflect.DeepEqual(logged, want) {
+				t.Fatal("log", logged, want)
+			}
 		})
 	}
 }
+
+// DSM: /var/packages/<pkg>/target links to /volume1/@appstore/<pkg>.
+func TestInstallAnchoredFollowsTheDSMTargetLink(t *testing.T) {
+	ctx := context.Background()
+	anchor := hashBytes([]byte("new executor"))
+	appstore, info := anchoredPackage(t, "new executor", "approved policy", anchor)
+	link := filepath.Join(filepath.Dir(info), "linked-target")
+	if err := os.Symlink(filepath.Dir(appstore), link); err != nil {
+		t.Fatal(err)
+	}
+	runtime := realTestPath(t, t.TempDir())
+	os.WriteFile(filepath.Join(runtime, "executor"), []byte("approved executor"), 0700)
+	target := filepath.Join(link, "executor")
+	if state := packagePins(ctx, target, info, trustAll, hashBytes([]byte("approved executor")), hashBytes([]byte("approved policy"))); state != pinsAnchored {
+		t.Fatal("pin state", state)
+	}
+	if err := installAnchored(ctx, target, info, trustAll, runtime); err != nil {
+		t.Fatal("anchored executor behind the target link refused", err)
+	}
+	if b, _ := os.ReadFile(filepath.Join(runtime, "executor")); string(b) != "new executor" {
+		t.Fatal("installed", string(b))
+	}
+}

package/dist/templates/_executor/digest_review_test.go

@@ -32,7 +32,7 @@ func TestReviewLargePackageHashDoesNotBlockShutdown(t *testing.T) {
 		done <- manageService(ctx, make(chan string), func() (func(), error) { return func() {}, nil }, func(ctx context.Context) bool {
 			close(entered)
 			return samePackagePins(ctx, dir, strings.Repeat("a", 64), strings.Repeat("b", 64))
-		}, func() error { return nil }, func(string) {})
+		}, func() error { return nil })
 	}()
 	<-entered
 	time.Sleep(20 * time.Millisecond)
@@ -93,7 +93,7 @@ func TestLifecycleCancelsPendingPinCheck(t *testing.T) {
 			actions := make(chan string)
 			done := make(chan error, 1)
 			go func() {
-				done <- manageService(ctx, actions, func() (func(), error) { t.Error("opened during canceled check"); return func() {}, nil }, func(ctx context.Context) bool { close(entered); <-ctx.Done(); close(canceled); return false }, func() error { return nil }, func(string) {})
+				done <- manageService(ctx, actions, func() (func(), error) { t.Error("opened during canceled check"); return func() {}, nil }, func(ctx context.Context) bool { close(entered); <-ctx.Done(); close(canceled); return false }, func() error { return nil })
 			}()
 			<-entered
 			if action == "shutdown" {

package/dist/templates/_executor/dsm.go

@@ -78,11 +78,32 @@ type envelope struct {
 	Data    json.RawMessage `json:"data"`
 }
 
+// dsmError keeps the DSM error code of a refused call; the message stays generic.
+type dsmError struct{ Code int }
+
+func (*dsmError) Error() string { return "DSM refused" }
+
 func decodeEnvelope(b []byte) (json.RawMessage, error) {
+	data, err := decodeSuccess(b)
+	if err == nil && (len(data) == 0 || string(data) == "null") {
+		return nil, &dsmError{}
+	}
+	return data, err
+}
+
+// decodeSuccess accepts a success without data: scheduler deletes answer
+// {"success":true}, sometimes with httpd_restart, and that confirms the delete.
+func decodeSuccess(b []byte) (json.RawMessage, error) {
 	var r envelope
 	d := json.NewDecoder(bytes.NewReader(b))
-	if uniqueValue(d, false) != nil || hasDSMError(b) || json.Unmarshal(b, &r) != nil || !r.Success || len(r.Data) == 0 || string(r.Data) == "null" {
-		return nil, errors.New("DSM refused")
+	if uniqueValue(d, false) != nil || hasDSMError(b) || json.Unmarshal(b, &r) != nil || !r.Success {
+		var refused struct {
+			Error struct {
+				Code int `json:"code"`
+			} `json:"error"`
+		}
+		json.Unmarshal(b, &refused)
+		return nil, &dsmError{Code: refused.Error.Code}
 	}
 	return r.Data, nil
 }
@@ -117,6 +138,22 @@ func (d *liveDSM) Verify(ctx context.Context, cookie, token string) (string, err
 	return out.Username, nil
 }
 func (d *liveDSM) call(ctx context.Context, api, method, version, runner string, params map[string]any) (json.RawMessage, error) {
+	b, err := d.exec(ctx, api, method, version, runner, params)
+	if err != nil {
+		return nil, err
+	}
+	return decodeEnvelope(b)
+}
+
+// mutate runs a call whose success carries no data, such as a scheduler delete.
+func (d *liveDSM) mutate(ctx context.Context, api, method, version string, params map[string]any) error {
+	b, err := d.exec(ctx, api, method, version, "", params)
+	if err == nil {
+		_, err = decodeSuccess(b)
+	}
+	return err
+}
+func (d *liveDSM) exec(ctx context.Context, api, method, version, runner string, params map[string]any) ([]byte, error) {
 	args := []string{"--exec", "api=" + api, "method=" + method, "version=" + version}
 	if runner != "" {
 		args = append(args, "runner="+runner)
@@ -140,7 +177,7 @@ func (d *liveDSM) call(ctx context.Context, api, method, version, runner string,
 		}
 		return nil, errors.New("DSM command")
 	}
-	return decodeEnvelope(b)
+	return b, nil
 }
 func (d *liveDSM) Account(ctx context.Context, name string) (Subject, error) {
 	s, err := d.Accounts.Lookup(name)

package/dist/templates/_executor/go.mod

@@ -1,3 +1,5 @@
 module synopkgland/executor
 
 go 1.23
+
+toolchain go1.26.9