@synopackageland/templates 0.35.5 → 0.36.0

package/README.md

@@ -22,8 +22,8 @@ daemon:
     window_seconds: 300
 ```
 
-Templates 0.35.3 pin UI 0.16.1 and SDK 0.38.2 in native and Compose projects.
-Use CLI 0.41.2. The Vue `AppShell` shows a
+Templates 0.36.0 pin UI 0.16.1 and SDK 0.40.0 in native and Compose projects.
+Use a CLI that supports executor manifest format 1. The Vue `AppShell` shows a
 non-blocking **Reload** notice when an upgrade replaced the UI an open page
 loaded. Go Apps select
 their controller from their Go SDK requirement; an identity gateway selects it
@@ -33,8 +33,9 @@ override does not waive that version check.
 
 The SDK owns backoff, the sliding retry cap and stop cancellation. Keep existing
 stop-before-upgrade/uninstall hooks; do not add retry loops in App scripts.
-Clean exits do not restart; initial startup retains its original fail-fast
-deadline. Compose keeps its own supervision. An App backend may map SDK
+Clean exits do not restart; failures before the first successful startup use
+the same bounded recovery policy as later exits. Compose keeps its own supervision.
+An App backend may map SDK
 `status-json` state/reason to its authenticated status UI; no new status panel is
 generated. See the CLI's [daemon policy guide](https://github.com/synopackageland/syno-pkg-land-cli/blob/main/docs/daemon.md)
 for declaration bounds, SDK selection, build/inspect checks and diagnostics.
@@ -81,20 +82,21 @@ calls each one from the generated script of the same name (`synopkgland skill sh
 The placeholders `__PACKAGE__` (also the Go module path), `__DISPLAY_NAME__` and
 `__BACKGROUND_ENABLED__` are substituted by `init`.
 
-`backend/go.mod` requires `github.com/synopackageland/syno-pkg-land-sdk v0.38.2`; that line is
+`backend/go.mod` requires `github.com/synopackageland/syno-pkg-land-sdk v0.40.0`; that line is
 the single source of the SDK version and `frontend/package.json` pins
 `@synopackageland/sdk` to the same version. Python and Node.js name it in
 `backend.sdk`, Rust in the `syno-pkg-land-app` tag of `backend/Cargo.toml`
-(and `Cargo.lock`); all of them pin 0.38.2. The Vue frontend pins
-`@synopackageland/ui` 0.16.1. SDK 0.38.2 accepts UI `>=0.10.1 <0.18.0`,
+(and `Cargo.lock`); all of them pin 0.40.0. The Vue frontend pins
+`@synopackageland/ui` 0.16.1. SDK 0.40.0 accepts UI `>=0.10.1 <0.19.0`,
 so no UI peer override is needed. Tests use jsdom 30 for UI floating-layer styles.
 
 Interactive NAS file operations use same-origin browser calls.
 Custom file handlers use the SDK's
-[session transport migration](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.38.2/docs/dsm-session-transport.md).
-CLI 0.41.5 reads SDK 0.38.2's release manifest, which names immutable
-executor/v0.38.2 and its executor digests. Its `~0.35.3` templates
-dependency selects this release.
+[session transport migration](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.40.0/docs/dsm-session-transport.md).
+The CLI reads SDK 0.40.0's release manifest, which names immutable
+executor/v0.39.0 and its executor digests. CLI distributions must resolve
+templates 0.36.x before default scaffolds use this release; a `~0.35.3`
+templates dependency remains on the older minor.
 
 Every App method must appear in the permissions table, including methods whose
 permission equals `default: administrators`. Dynamic method names and custom
@@ -108,7 +110,7 @@ Keep punctuation between sentences and intentional loading ellipses.
 
 ## Request deadlines and background work
 
-SDK/App 0.38.2 defaults to 300 seconds for cooperative requests and 302 seconds
+SDK/App 0.40.0 defaults to 300 seconds for cooperative requests and 302 seconds
 for the TS client and generated DSM window. The CLI reads the selected SDK's
 timeout spec; `backend.timeout_seconds` explicitly overrides it for native
 backends, and an earlier parent deadline still wins. Go assembly should fall
@@ -140,7 +142,7 @@ caps, approved root policy/program budgets and credential lifetimes retain
 their existing limits; long root work uses `root.start` / `root.jobs.*`.
 The independent ctl transport keeps its 62-second default: use an explicit
 `--timeout` for long synchronous calls, or an existing nonblocking job flow.
-See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.38.2/docs/request-deadlines.md).
+See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.40.0/docs/request-deadlines.md).
 
 ## Hyper Backup
 
@@ -286,9 +288,12 @@ Native Node Apps use the official [`Node.js_v22`](https://www.synology.com/en-us
 
 The jobs overlays submit files the App's own producer has already imported into
 its private data directory. Submit `{key, name, input}` through `bg.jobs.submit`
-(Go) or `hash.submit` (Python, Node.js and Rust); `input` is the absolute path of
-that App-owned file. The Go handler and the bridge runtime confine reads to the
-App data directory and keep the SDK's bounded private-copy input contract.
+(Go) or `hash.submit` (Python, Node.js and Rust). In Go, a trusted producer writes
+into `BackgroundInbox(dataDir, background.Submitter{User: verifiedName, UID: verifiedUID})`;
+`input` must be an absolute path inside that exact owner's inbox, including for
+administrators. The name and UID both scope the inbox, so a recreated account
+gets another directory. Symlinks cannot escape it. Jobs and schedules retain a
+bounded private copy. Bridge-language job producers retain their SDK input contract.
 There is no NAS browse/import example or automatic file submission in either UI shell.
 
 Keep the job controls and package-account workers for progress, cancellation and
@@ -299,7 +304,7 @@ The bridge examples expose submission, lookup and cancellation through
 
 ## External access
 
-With CLI 0.40.0 and SDK 0.38.2, a gateway App may declare `identity_gateway.external_access: {connect: optional, origin_change: confirm, single_origin: true}` for an upstream that signs in on one fixed URL. The policy is forwarded to the packaged gateway. A single-origin App's `manual_origin` accepts an explicit HTTPS port; the `external-origin` installation setting remains restricted to port 443. The DSM launcher selects a provider destination, probes `/_spl/ping` for up to eight seconds, and explains failures before offering **Open anyway**. A configured single-origin App always opens its primary external origin.
+With a compatible CLI and SDK 0.40.0, a gateway App may declare `identity_gateway.external_access: {connect: optional, origin_change: confirm, single_origin: true}` for an upstream that signs in on one fixed URL. The policy is forwarded to the packaged gateway. A single-origin App's `manual_origin` accepts an explicit HTTPS port; the `external-origin` installation setting remains restricted to port 443. The DSM launcher selects a provider destination, probes `/_spl/ping` for up to eight seconds, and explains failures before offering **Open anyway**. A configured single-origin App always opens its primary external origin.
 
 
 Compose templates declare an app-named dedicated shared folder by default. DSM
@@ -332,3 +337,15 @@ marker with their own. Use `entry` only for a configured entry override. An
 entry declared upstream-authenticated in the manifest also needs `publicLogin`
 to identify its own login page. A DSM-gated entry cannot opt out of the gate.
 This smoke checks opening only; it does not install packages or change accounts.
+
+
+The delegate report example scopes staging to
+`owners/<sha256(username + NUL + delegationID)>/` and scopes its executor job ID
+to SHA-256 of username, NUL, delegation ID, NUL and its producer job ID, followed
+by a hyphen and the first 32 hex characters of the owner hash. The SDK verifies
+this owner-and-grant suffix on admission. Repeated
+saves by the same owner and grant reuse their original file; other owners and
+grants get different sources. A newly created report refused with
+`DELEGATION_DENIED` is removed. An ambiguous transport failure keeps the source
+for retry because the executor may already have admitted it. Other settled
+sources use the SDK's explicit discard operation when the App deletes the job.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/templates",
-  "version": "0.35.5",
+  "version": "0.36.0",
   "description": "Project templates for synopkgland init: native-go, native-python, native-node and native-rust (plain or Vue, with jobs, delegate and root-ops overlays), binary and compose.",
   "license": "MIT",
   "repository": {

package/templates/compose/dsm-package.yaml

@@ -23,7 +23,7 @@ compose:
   web: {service: web, port: 8080, health: {path: /, status: 200}}
   network: {egress: isolated}
 identity_gateway:
-  sdk: 0.38.2
+  sdk: 0.40.0
   mode: none
   listen: {http: 28000}
 # Web Apps default to new-page through the shared app-launch resolver.

package/templates/native-go/README.md

@@ -17,7 +17,7 @@ DSM main menu → DSM window (ui/app.js)
 
 ## Requests and long work
 
-SDK/App 0.38.2 defaults to 300-second requests and a 302-second browser wait.
+SDK/App 0.40.0 defaults to 300-second requests and a 302-second browser wait.
 Explicit `backend.timeout_seconds` and earlier parent deadlines still apply;
 rebuild the App to use the new SDK. For long NAS work, enable the existing jobs
 capability: return admission and the original job ID promptly, execute in the
@@ -27,7 +27,7 @@ last queued/running state intact. After a lost admission reply, reuse the same
 idempotency key and input instead of replaying a mutation with a new key.
 Jobs default to 30 minutes; approved executor limits remain separate. ctl keeps
 its 62-second transport default; use an explicit `--timeout` or an existing
-nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.38.2/docs/request-deadlines.md).
+nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.40.0/docs/request-deadlines.md).
 
 ## Quick start
 

package/templates/native-go/backend/THIRD_PARTY_NOTICES.txt

@@ -1,6 +1,6 @@
 Native Go package build dependencies
 
-github.com/synopackageland/syno-pkg-land-sdk v0.38.2 (MIT)
+github.com/synopackageland/syno-pkg-land-sdk v0.40.0 (MIT)
 
 Copyright (c) 2026 synopkgland
 

package/templates/native-go/backend/go.mod

@@ -4,6 +4,6 @@ go 1.25.0
 
 toolchain go1.26.10
 
-require github.com/synopackageland/syno-pkg-land-sdk v0.38.2
+require github.com/synopackageland/syno-pkg-land-sdk v0.40.0
 
 require golang.org/x/sys v0.44.0 // indirect

package/templates/native-go/backend/go.sum

@@ -1,4 +1,4 @@
-github.com/synopackageland/syno-pkg-land-sdk v0.38.2 h1:UJh6tbUxhmcRdy8Y6qqJYHcxZtYkShE9UxtXjbN5vV8=
-github.com/synopackageland/syno-pkg-land-sdk v0.38.2/go.mod h1:8GwREGbczc8mAk4Gv8FUHaukXXCUstjzkovQrNV59Cc=
+github.com/synopackageland/syno-pkg-land-sdk v0.40.0 h1:3PBmIbiMkoEc4W3blLeRHdOeuF54hD2lGEQu3Mt0SJ4=
+github.com/synopackageland/syno-pkg-land-sdk v0.40.0/go.mod h1:8GwREGbczc8mAk4Gv8FUHaukXXCUstjzkovQrNV59Cc=
 golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
 golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

package/templates/native-go/backend/internal/app/background.go

@@ -10,7 +10,6 @@ import (
 	"os"
 	"os/user"
 	"path/filepath"
-	"strings"
 	"syscall"
 	"time"
 
@@ -125,7 +124,7 @@ func (b backgroundAPI) submit(ctx context.Context, _ api.Caller, _ *http.Request
 	if !access.Owner.Valid() {
 		return nil, &api.Error{Code: "identity_unavailable", Message: "DSM user UID could not be resolved"}
 	}
-	data, err := b.readInput(in.Input)
+	data, err := b.readInput(in.Input, access.Owner)
 	if err != nil {
 		return nil, err
 	}
@@ -138,20 +137,19 @@ func (b backgroundAPI) submit(ctx context.Context, _ api.Caller, _ *http.Request
 	return map[string]any{"job": job, "duplicate": duplicate}, nil
 }
 
-// readInput accepts only an existing regular file inside the App data directory,
-// outside the job spool.
-// The App's producer imports it first; jobs and schedules retain a private copy.
-func (b backgroundAPI) readInput(input string) ([]byte, error) {
-	bad := api.BadRequest("input must be a regular file in the App data directory")
-	rel, err := filepath.Rel(b.dataDir, input)
-	if err != nil || !filepath.IsAbs(input) || !filepath.IsLocal(rel) {
+// readInput opens only the authenticated owner's producer inbox. os.Root
+// confines symlinks as well as lexical paths to that inbox, including for admins.
+func (b backgroundAPI) readInput(input string, owner background.Submitter) ([]byte, error) {
+	bad := api.BadRequest("input must be a regular file in your App inbox")
+	inbox, err := BackgroundInbox(b.dataDir, owner)
+	if err != nil {
 		return nil, bad
 	}
-	// The job spool keeps other owners' private copies; it is never an input.
-	if first, _, _ := strings.Cut(filepath.ToSlash(rel), "/"); first == "background" {
+	rel, err := filepath.Rel(inbox, input)
+	if err != nil || !filepath.IsAbs(input) || !filepath.IsLocal(rel) {
 		return nil, bad
 	}
-	root, err := os.OpenRoot(b.dataDir)
+	root, err := os.OpenRoot(inbox)
 	if err != nil {
 		return nil, bad
 	}

package/templates/native-go/backend/internal/app/background_inbox_test.go

@@ -0,0 +1,37 @@
+package app
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/synopackageland/syno-pkg-land-sdk/background"
+)
+
+func TestBackgroundSubmitRefusesOtherOwnerInboxAndAppFiles(t *testing.T) {
+	e := ordinaryEnv(t)
+	private := filepath.Join(e.dataDir, "private-settings")
+	if err := os.WriteFile(private, []byte("private"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	for _, input := range []string{private, e.inputPath("alice")} {
+		p, _ := json.Marshal(map[string]string{"key": "stolen", "name": "copy", "input": input})
+		if code, _ := e.call(bob, "bg.jobs.submit", string(p)); code != "bad_request" {
+			t.Fatal("cross-owner import accepted", code)
+		}
+	}
+	own := e.inputPath("bob")
+	if err := os.Symlink(private, filepath.Join(filepath.Dir(own), "escape")); err != nil {
+		t.Fatal(err)
+	}
+	p, _ := json.Marshal(map[string]string{"key": "link", "name": "copy", "input": filepath.Join(filepath.Dir(own), "escape")})
+	if code, _ := e.call(bob, "bg.jobs.submit", string(p)); code != "bad_request" {
+		t.Fatal("inbox symlink escaped", code)
+	}
+	old, _ := BackgroundInbox(e.dataDir, background.Submitter{User: "bob", UID: "1025"})
+	current, _ := BackgroundInbox(e.dataDir, background.Submitter{User: "bob", UID: "2048"})
+	if old == current {
+		t.Fatal("recreated user retained its inbox")
+	}
+}

package/templates/native-go/backend/internal/app/background_owner.go

@@ -2,10 +2,13 @@ package app
 
 import (
 	"context"
+	"crypto/sha256"
+	"encoding/hex"
 	"encoding/json"
 	"github.com/synopackageland/syno-pkg-land-sdk/api"
 	"github.com/synopackageland/syno-pkg-land-sdk/background"
 	"net/http"
+	"path/filepath"
 )
 
 type backgroundAccessKey struct{}
@@ -36,3 +39,14 @@ func (b backgroundAPI) purge(ctx context.Context, c api.Caller, _ *http.Request,
 	}
 	return audit, nil
 }
+
+// BackgroundInbox is the private input directory a trusted App producer fills
+// for an authenticated owner. Both account name and UID are part of its key.
+func BackgroundInbox(dataDir string, owner background.Submitter) (string, error) {
+	if !owner.Valid() {
+		return "", api.BadRequest("exact owner is required")
+	}
+	raw, _ := json.Marshal([2]string{owner.User, owner.UID})
+	key := sha256.Sum256(raw)
+	return filepath.Join(dataDir, "inbox", hex.EncodeToString(key[:])), nil
+}

package/templates/native-go/backend/internal/app/background_owner_test.go

@@ -28,7 +28,7 @@ var carol = stubAuth{identity: api.Identity{User: "carol"}}
 
 func ownerSubmit(t *testing.T, e *bgEnv, a api.Authenticator, key string) string {
 	t.Helper()
-	code, out := e.call(a, "bg.jobs.submit", e.submitParams(key))
+	code, out := e.call(a, "bg.jobs.submit", e.submitParams(key, a.(stubAuth).identity.User))
 	if code != "" {
 		t.Fatalf("submit %s: %s %v", key, code, out)
 	}
@@ -103,7 +103,7 @@ func TestBackgroundPersonalQuotaAndAdminPurge(t *testing.T) {
 	}
 	ownerSubmit(t, e, bob, "one")
 	ownerSubmit(t, e, bob, "two")
-	if code, _ := e.call(bob, "bg.jobs.submit", e.submitParams("three")); code != "owner-queue-full" {
+	if code, _ := e.call(bob, "bg.jobs.submit", e.submitParams("three", "bob")); code != "owner-queue-full" {
 		t.Fatal(code)
 	}
 	ownerSubmit(t, e, carol, "one")

package/templates/native-go/backend/internal/app/background_test.go

@@ -28,10 +28,9 @@ func newBgEnv(t *testing.T) *bgEnv {
 	t.Cleanup(func() { lookupSubmitterUID = osLookupUID })
 	dir := t.TempDir()
 	store := background.NewStore(filepath.Join(dir, "background"))
-	if err := os.WriteFile(filepath.Join(dir, "input.txt"), []byte("hello"), 0600); err != nil {
-		t.Fatal(err)
-	}
-	return &bgEnv{t: t, store: store, dataDir: dir, srv: map[string]*api.Server{}}
+	e := &bgEnv{t: t, store: store, dataDir: dir, srv: map[string]*api.Server{}}
+	e.inputPath("alice")
+	return e
 }
 
 func (e *bgEnv) call(auth api.Authenticator, method, params string) (string, map[string]any) {
@@ -128,8 +127,28 @@ func TestBackgroundStatusReportsLimitsAndWorker(t *testing.T) {
 	}
 }
 
-func (e *bgEnv) submitParams(key string) string {
-	p, err := json.Marshal(map[string]string{"key": key, "name": "a.txt", "input": filepath.Join(e.dataDir, "input.txt")})
+func (e *bgEnv) inputPath(user string) string {
+	inbox, err := BackgroundInbox(e.dataDir, background.Submitter{User: user, UID: lookupSubmitterUID(user)})
+	if err != nil {
+		e.t.Fatal(err)
+	}
+	if err = os.MkdirAll(inbox, 0700); err != nil {
+		e.t.Fatal(err)
+	}
+	input := filepath.Join(inbox, "input.txt")
+	if _, err = os.Stat(input); os.IsNotExist(err) {
+		if err = os.WriteFile(input, []byte("hello"), 0600); err != nil {
+			e.t.Fatal(err)
+		}
+	}
+	return input
+}
+func (e *bgEnv) submitParams(key string, users ...string) string {
+	user := "alice"
+	if len(users) > 0 {
+		user = users[0]
+	}
+	p, err := json.Marshal(map[string]string{"key": key, "name": "a.txt", "input": e.inputPath(user)})
 	if err != nil {
 		e.t.Fatal(err)
 	}
@@ -155,7 +174,7 @@ func TestBackgroundSubmitImportsAppInputAndIsIdempotent(t *testing.T) {
 	if data(again)["duplicate"] != true || data(again)["job"].(map[string]any)["id"] != job["id"] {
 		t.Fatal(again)
 	}
-	if err := os.WriteFile(filepath.Join(e.dataDir, "input.txt"), []byte("other"), 0600); err != nil {
+	if err := os.WriteFile(e.inputPath("alice"), []byte("other"), 0600); err != nil {
 		t.Fatal(err)
 	}
 	if code, _ := e.call(alice, "bg.jobs.submit", params); code != "conflict" {
@@ -189,7 +208,7 @@ func TestBackgroundSubmitRejectsExternalAndOversizedInput(t *testing.T) {
 			t.Fatalf("%s: %s", input, code)
 		}
 	}
-	if err := os.WriteFile(filepath.Join(e.dataDir, "input.txt"), make([]byte, background.MaxInputBytes+1), 0600); err != nil {
+	if err := os.WriteFile(e.inputPath("alice"), make([]byte, background.MaxInputBytes+1), 0600); err != nil {
 		t.Fatal(err)
 	}
 	if code, _ := e.call(alice, "bg.jobs.submit", e.submitParams("big")); code != "limit-exceeded" {

package/templates/native-go-vue/frontend/package-lock.json

@@ -7,7 +7,7 @@
       "name": "native-dsm-vue-app",
       "dependencies": {
         "@lucide/vue": "1.48.0",
-        "@synopackageland/sdk": "0.38.2",
+        "@synopackageland/sdk": "0.40.0",
         "@synopackageland/ui": "0.16.1",
         "vue": "3.5.43"
       },
@@ -1152,13 +1152,13 @@
       }
     },
     "node_modules/@synopackageland/sdk": {
-      "version": "0.38.2",
-      "resolved": "https://registry.npmjs.org/@synopackageland/sdk/-/sdk-0.38.2.tgz",
-      "integrity": "sha512-ZSZKn5T8TbOpUF+PYMgq0IU+czw9HG4O9C4JuCeaT8Xoa3gMNiHbv6N1+VdRfxm46GtbtFNHzdQBoZ3mbmvKKg==",
+      "version": "0.40.0",
+      "resolved": "https://registry.npmjs.org/@synopackageland/sdk/-/sdk-0.40.0.tgz",
+      "integrity": "sha512-eV/CvRqxHSIMQm38EJI7dYxqzLEKVt3ExFb69W8w2eLMEvCH6PfwCJbari9Fg2W8zV1Q5vvPsH5/THJF/rJGJA==",
       "license": "MIT",
       "peerDependencies": {
         "@lucide/vue": "^1.48.0",
-        "@synopackageland/ui": ">=0.10.1 <0.18.0",
+        "@synopackageland/ui": ">=0.10.1 <0.19.0",
         "vue": "^3.5.0"
       },
       "peerDependenciesMeta": {

package/templates/native-go-vue/frontend/package.json

@@ -8,7 +8,7 @@
   },
   "dependencies": {
     "@lucide/vue": "1.48.0",
-    "@synopackageland/sdk": "0.38.2",
+    "@synopackageland/sdk": "0.40.0",
     "@synopackageland/ui": "0.16.1",
     "vue": "3.5.43"
   },

package/templates/native-node/README.md

@@ -17,7 +17,7 @@ DSM main menu → DSM window (ui/app.js)
 
 ## Requests and long work
 
-SDK/App 0.38.2 defaults to 300-second requests and a 302-second browser wait.
+SDK/App 0.40.0 defaults to 300-second requests and a 302-second browser wait.
 Explicit `backend.timeout_seconds` and earlier parent deadlines still apply;
 rebuild the App to use the new SDK. For long NAS work, enable the existing jobs
 capability: return admission and the original job ID promptly, execute in the
@@ -27,7 +27,7 @@ last queued/running state intact. After a lost admission reply, reuse the same
 idempotency key and input instead of replaying a mutation with a new key.
 Jobs default to 30 minutes; approved executor limits remain separate. ctl keeps
 its 62-second transport default; use an explicit `--timeout` or an existing
-nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.38.2/docs/request-deadlines.md).
+nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.40.0/docs/request-deadlines.md).
 
 ## Quick start
 

package/templates/native-node/backend/package-lock.json

@@ -49,10 +49,10 @@
       "license": "MIT"
     },
     "vendor/@synopackageland/app": {
-      "version": "0.0.0",
+      "version": "0.40.0",
       "license": "MIT",
       "engines": {
-        "node": ">=18"
+        "node": ">=22"
       }
     }
   }

package/templates/native-node/dsm-package.yaml

@@ -49,7 +49,7 @@ backend:
   runtime: node
   dir: backend/app
   entry: main.js
-  sdk: 0.38.2
+  sdk: 0.40.0
   node: { package: Node.js_v22 }
 
 ui:

package/templates/native-node-delegate/backend/src/delegate.ts

@@ -2,10 +2,11 @@
 //
 // The browser picks the destination with the SDK's Background saves page and
 // sends its delegation ID; the executor checks that it is the caller's grant
-// and writes the file as the caller, never as root. A save that failed may be
-// repeated with the same job ID: the same file is sent again, and the executor
-// copies it at most once.
-import { mkdirSync, statSync, writeFileSync } from 'node:fs'
+// and writes the file as the caller, never as root. An admitted or uncertain
+// save retries the same file and job ID; the executor copies it at most once.
+// A new source rejected because its delegation is denied is removed.
+import { createHash } from 'node:crypto'
+import { mkdirSync, statSync, writeFileSync, unlinkSync } from 'node:fs'
 import { join } from 'node:path'
 import { AppError, type App, type Context } from '@synopackageland/app'
 import { strings } from './params.js'
@@ -18,18 +19,29 @@ export function register(app: App, cfg: Config): void {
   app.method('report.save', (ctx, params) => save(cfg, ctx, params))
 }
 
-function save(cfg: Config, ctx: Context, params: unknown) {
+async function save(cfg: Config, ctx: Context, params: unknown) {
   const { delegation_id, job_id } = strings(params, 'delegation_id', 'job_id')
-  if (!JOB_ID.test(job_id)) throw AppError.badRequest("job_id must be 1 to 128 letters, digits, '.', '_' or '-'")
+  if (!JOB_ID.test(job_id) || !JOB_ID.test(delegation_id)) throw AppError.badRequest("job_id must be 1 to 128 letters, digits, '.', '_' or '-'")
   const name = `report-${job_id}.txt`
   // The runtime's delegate service moves files from here.
-  const staging = join(cfg.dataDir, 'executor-staging')
+  const owner = createHash('sha256').update(`${ctx.user}\0${delegation_id}`).digest('hex')
+  const scopedJob = createHash('sha256').update(`${ctx.user}\0${delegation_id}\0${job_id}`).digest('hex') + `-${owner.slice(0, 32)}`
+  const relative = `owners/${owner}/${name}`
+  const staging = join(cfg.dataDir, 'executor-staging', 'owners', owner)
   mkdirSync(staging, { recursive: true, mode: 0o700 })
   const path = join(staging, name)
+  let created = false
   try {
     writeFileSync(path, `Report for ${ctx.user}, ${new Date().toISOString().replace(/\.\d+Z$/, 'Z')}\n`, { flag: 'wx', mode: 0o600 })
+    created = true
   } catch (e) {
     if ((e as NodeJS.ErrnoException).code !== 'EEXIST') throw e
   }
-  return service(ctx, 'delegate.move_from_staging', { delegation_id, job_id, staging: name, name, size: statSync(path).size })
+  try {
+    return await service(ctx, 'delegate.move_from_staging', { delegation_id, job_id: scopedJob, staging: relative, name, size: statSync(path).size })
+  } catch (e) {
+    // A transport failure may already have been admitted; keep its source.
+    if (created && e instanceof AppError && e.code === 'DELEGATION_DENIED') unlinkSync(path)
+    throw e
+  }
 }

package/templates/native-node-delegate/backend/test/delegate.test.ts

@@ -1,5 +1,5 @@
 import assert from 'node:assert/strict'
-import { existsSync, mkdtempSync, readFileSync, rmSync, statSync } from 'node:fs'
+import { existsSync, mkdtempSync, readFileSync, rmSync, statSync, readdirSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, test } from 'node:test'
@@ -23,23 +23,32 @@ const save = (user = 'alice', move: Services[string] = () => SAVED) =>
 test('report.save moves a private report to the caller\'s destination', async () => {
   const reply = await save()
   assert.deepEqual(reply.data, SAVED)
-  const path = join(staging, 'report-job-1.txt')
+  const path = join(staging, (reply.services[0][1] as {staging: string}).staging)
   assert.match(readFileSync(path, 'utf8'), /alice/)
   assert.equal(statSync(path).mode & 0o777, 0o600)
-  const move = { delegation_id: 'd1', job_id: 'job-1', staging: 'report-job-1.txt', name: 'report-job-1.txt', size: statSync(path).size }
+  const move = { delegation_id: 'd1', job_id: (reply.services[0][1] as {job_id: string}).job_id, staging: (reply.services[0][1] as {staging: string}).staging, name: 'report-job-1.txt', size: statSync(path).size }
   assert.deepEqual(reply.services, [['delegate.move_from_staging', move]])
+  assert.ok(move.job_id.endsWith(`-${move.staging.split('/')[1].slice(0, 32)}`))
 })
 
-test('a repeated report.save sends the same file again', async () => {
+test('retries reuse only the same owner and grant source', async () => {
   const first = (await save()).services
-  const report = readFileSync(join(staging, 'report-job-1.txt'), 'utf8')
-  assert.deepEqual((await save('bob')).services, first)
-  assert.equal(readFileSync(join(staging, 'report-job-1.txt'), 'utf8'), report)
+  const params = first[0][1] as {staging: string; job_id: string}
+  const report = readFileSync(join(staging, params.staging), 'utf8')
+  assert.deepEqual((await save()).services, first)
+  const other = (await save('bob')).services[0][1] as {staging: string; job_id: string}
+  assert.notEqual(other.staging, params.staging)
+  assert.notEqual(other.job_id, params.job_id)
+  assert.match(readFileSync(join(staging, other.staging), 'utf8'), /bob/)
+  assert.equal(readFileSync(join(staging, params.staging), 'utf8'), report)
 })
 
-test('report.save passes on the executor\'s refusal', async () => {
-  const reply = await save('alice', () => { throw new Refusal('DELEGATION_DENIED', 'The destination is no longer allowed.') })
+test('definitive rejection removes new source but a timeout keeps it', async () => {
+  const reply = await save('alice', () => { throw new Refusal('DELEGATION_DENIED', 'The destination is no longer allowed') })
   assert.equal(reply.error?.code, 'DELEGATION_DENIED')
+  assert.equal(readdirSync(staging, { recursive: true }).filter(p => String(p).endsWith('.txt')).length, 0)
+  const unknown = await save('alice', () => { throw new Refusal('EXECUTOR_TIMEOUT', 'The outcome is unknown') })
+  assert.equal(existsSync(join(staging, (unknown.services[0][1] as {staging: string}).staging)), true)
 })
 
 test('report.save refuses invalid params before writing', async () => {

package/templates/native-python/README.md

@@ -17,7 +17,7 @@ DSM main menu → DSM window (ui/app.js)
 
 ## Requests and long work
 
-SDK/App 0.38.2 defaults to 300-second requests and a 302-second browser wait.
+SDK/App 0.40.0 defaults to 300-second requests and a 302-second browser wait.
 Explicit `backend.timeout_seconds` and earlier parent deadlines still apply;
 rebuild the App to use the new SDK. For long NAS work, enable the existing jobs
 capability: return admission and the original job ID promptly, execute in the
@@ -27,7 +27,7 @@ last queued/running state intact. After a lost admission reply, reuse the same
 idempotency key and input instead of replaying a mutation with a new key.
 Jobs default to 30 minutes; approved executor limits remain separate. ctl keeps
 its 62-second transport default; use an explicit `--timeout` or an existing
-nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.38.2/docs/request-deadlines.md).
+nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.40.0/docs/request-deadlines.md).
 
 ## Quick start
 

package/templates/native-python/dsm-package.yaml

@@ -47,7 +47,7 @@ backend:
   runtime: python
   dir: backend/app
   entry: main.py
-  sdk: 0.38.2
+  sdk: 0.40.0
 
 ui:
   # Non-UI-SDK frontends open a full page; Portal is a separate opt-in.

package/templates/native-python-delegate/backend/app/delegate.py

@@ -2,11 +2,12 @@
 
 The browser picks the destination with the SDK's Background saves page and
 sends its delegation ID; the executor checks that it is the caller's grant
-and writes the file as the caller, never as root. A save that failed may be
-repeated with the same job ID: the same file is sent again, and the executor
-copies it at most once.
+and writes the file as the caller, never as root. An admitted or uncertain
+save retries the same file and job ID; the executor copies it at most once.
+A new source rejected because its delegation is denied is removed.
 """
 
+import hashlib
 import os
 import re
 import time
@@ -24,19 +25,30 @@ def register(app, cfg):
 
 def save(cfg, ctx, params):
     p = fields(params, delegation_id=str, job_id=str)
-    if not JOB_ID.match(p["job_id"]):
+    if not JOB_ID.match(p["job_id"]) or not JOB_ID.match(p["delegation_id"]):
         raise Error.bad_request("job_id must be 1 to 128 letters, digits, '.', '_' or '-'")
     name = "report-%s.txt" % p["job_id"]
     # The runtime's delegate service moves files from here.
-    staging = os.path.join(cfg.data_dir, "executor-staging")
+    owner = hashlib.sha256((ctx.user + "\0" + p["delegation_id"]).encode("utf-8")).hexdigest()
+    job_id = hashlib.sha256((ctx.user + "\0" + p["delegation_id"] + "\0" + p["job_id"]).encode("utf-8")).hexdigest() + "-" + owner[:32]
+    relative = "owners/%s/%s" % (owner, name)
+    staging = os.path.join(cfg.data_dir, "executor-staging", "owners", owner)
     os.makedirs(staging, mode=0o700, exist_ok=True)
     path = os.path.join(staging, name)
+    created = False
     try:
         fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
     except FileExistsError:
         pass
     else:
+        created = True
         with os.fdopen(fd, "w", encoding="utf-8") as f:
             f.write("Report for %s, %s\n" % (ctx.user, time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())))
-    move = {"delegation_id": p["delegation_id"], "job_id": p["job_id"], "staging": name, "name": name, "size": os.path.getsize(path)}
-    return ctx.runtime("delegate.move_from_staging", move)
+    move = {"delegation_id": p["delegation_id"], "job_id": job_id, "staging": relative, "name": name, "size": os.path.getsize(path)}
+    try:
+        return ctx.runtime("delegate.move_from_staging", move)
+    except Error as err:
+        # A transport failure may already have been admitted; keep its source.
+        if created and err.code == "DELEGATION_DENIED":
+            os.unlink(path)
+        raise

package/templates/native-python-delegate/backend/tests/test_delegate.py

@@ -24,27 +24,37 @@ class DelegateTest(unittest.TestCase):
     def test_save_moves_a_private_report_to_the_callers_destination(self):
         reply = self.save()
         self.assertEqual(reply.data, SAVED)
-        path = os.path.join(self.staging, "report-job-1.txt")
+        path = os.path.join(self.staging, reply.services[0][1]["staging"])
         with open(path, encoding="utf-8") as f:
             self.assertIn("alice", f.read())
         self.assertEqual(stat.S_IMODE(os.stat(path).st_mode), 0o600)
-        move = {"delegation_id": "d1", "job_id": "job-1", "staging": "report-job-1.txt", "name": "report-job-1.txt", "size": os.path.getsize(path)}
+        move = {"delegation_id": "d1", "job_id": reply.services[0][1]["job_id"], "staging": reply.services[0][1]["staging"], "name": "report-job-1.txt", "size": os.path.getsize(path)}
         self.assertEqual(reply.services, [("delegate.move_from_staging", move)])
+        self.assertTrue(move["job_id"].endswith("-" + move["staging"].split("/")[1][:32]))
 
-    def test_a_repeated_save_sends_the_same_file_again(self):
+    def test_retries_reuse_only_the_same_owners_file(self):
         first = self.save().services
-        path = os.path.join(self.staging, "report-job-1.txt")
+        path = os.path.join(self.staging, first[0][1]["staging"])
         with open(path, encoding="utf-8") as f:
             report = f.read()
-        self.assertEqual(self.save(user="bob").services, first)
+        self.assertEqual(self.save().services, first)
+        other = self.save(user="bob").services
+        self.assertNotEqual(other[0][1]["staging"], first[0][1]["staging"])
+        self.assertNotEqual(other[0][1]["job_id"], first[0][1]["job_id"])
+        with open(os.path.join(self.staging, other[0][1]["staging"]), encoding="utf-8") as f:
+            self.assertIn("bob", f.read())
         with open(path, encoding="utf-8") as f:
             self.assertEqual(f.read(), report)
 
-    def test_save_passes_on_the_executors_refusal(self):
+    def test_definitive_refusal_cleans_new_source_but_timeout_keeps_retry(self):
         def denied(params):
-            raise Error("DELEGATION_DENIED", "The destination is no longer allowed.")
-
+            raise Error("DELEGATION_DENIED", "The destination is no longer allowed")
         self.assertEqual(self.save(move=denied).error["code"], "DELEGATION_DENIED")
+        self.assertEqual([f for _, _, files in os.walk(self.staging) for f in files], [])
+        def timeout(params):
+            raise Error("EXECUTOR_TIMEOUT", "The outcome is unknown")
+        reply = self.save(move=timeout)
+        self.assertTrue(os.path.isfile(os.path.join(self.staging, reply.services[0][1]["staging"])))
 
     def test_save_refuses_invalid_params_before_writing(self):
         for params in [None, {"delegation_id": "d1"}, {"delegation_id": "d1", "job_id": "../x"}, {"delegation_id": "d1", "job_id": ""}, {"delegation_id": 1, "job_id": "j"}]:

package/templates/native-rust/README.md

@@ -17,7 +17,7 @@ DSM main menu → DSM window (ui/app.js)
 
 ## Requests and long work
 
-SDK/App 0.38.2 defaults to 300-second requests and a 302-second browser wait.
+SDK/App 0.40.0 defaults to 300-second requests and a 302-second browser wait.
 Explicit `backend.timeout_seconds` and earlier parent deadlines still apply;
 rebuild the App to use the new SDK. For long NAS work, enable the existing jobs
 capability: return admission and the original job ID promptly, execute in the
@@ -27,7 +27,7 @@ last queued/running state intact. After a lost admission reply, reuse the same
 idempotency key and input instead of replaying a mutation with a new key.
 Jobs default to 30 minutes; approved executor limits remain separate. ctl keeps
 its 62-second transport default; use an explicit `--timeout` or an existing
-nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.38.2/docs/request-deadlines.md).
+nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.40.0/docs/request-deadlines.md).
 
 ## Quick start
 

package/templates/native-rust/backend/Cargo.lock

@@ -104,8 +104,8 @@ dependencies = [
 
 [[package]]
 name = "syno-pkg-land-app"
-version = "0.38.2"
-source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.38.2#103014ec9ec31e91062053d7678b4d2b115be71e"
+version = "0.40.0"
+source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.40.0#e96f3f0eb6ec5bbb171fb2205f6669d3c75e3913"
 dependencies = [
  "libc",
  "serde",

package/templates/native-rust/backend/Cargo.toml

@@ -9,7 +9,7 @@ libc = "0.2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 # The SDK version is the tag; `synopkgland check` reads it from Cargo.lock.
-syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.38.2" }
+syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.40.0" }
 
 [profile.release]
 # A handler panic becomes an "internal" reply; abort would end the App without one.

package/templates/native-rust-delegate/backend/Cargo.lock

@@ -0,0 +1,203 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "app"
+version = "0.1.0"
+dependencies = [
+ "libc",
+ "serde",
+ "serde_json",
+ "sha2",
+ "syno-pkg-land-app",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "libc"
+version = "0.2.190"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.154"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d78c8dee4c7bf0e14673097256fed6142ce9d3b85a408189d07482442145823b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syno-pkg-land-app"
+version = "0.40.0"
+source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.40.0#e96f3f0eb6ec5bbb171fb2205f6669d3c75e3913"
+dependencies = [
+ "libc",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2c754d6c33795a1c324727428e5a7dedb5b06195f9890bdbcba760d3e246563"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"

package/templates/native-rust-delegate/backend/Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "app"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+sha2 = "0.10"
+libc = "0.2"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+# The SDK version is the tag; `synopkgland check` reads it from Cargo.lock.
+syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.40.0" }
+
+[profile.release]
+# A handler panic becomes an "internal" reply; abort would end the App without one.
+panic = "unwind"

package/templates/native-rust-delegate/backend/src/delegate.rs

@@ -6,6 +6,7 @@
 use crate::routes::{Config, internal, utc_now};
 use serde::Deserialize;
 use serde_json::{Value, json};
+use sha2::{Digest, Sha256};
 use std::fs::OpenOptions;
 use std::io::{ErrorKind, Write};
 use std::os::unix::fs::{DirBuilderExt, OpenOptionsExt};
@@ -31,12 +32,25 @@ fn valid_job_id(id: &str) -> bool {
 
 fn save(cfg: &Config, ctx: &Context, params: &Params) -> Result<Value, Error> {
     let p: SaveReport = params.decode()?;
-    if !valid_job_id(&p.job_id) {
+    if !valid_job_id(&p.job_id) || !valid_job_id(&p.delegation_id) {
         return Err(Error::bad_request(
             "job_id must be 1 to 128 letters, digits, '.', '_' or '-'",
         ));
     }
-    let staging = cfg.data_dir.join("executor-staging");
+    let owner = format!(
+        "{:x}",
+        Sha256::digest(format!("{}\0{}", ctx.user, p.delegation_id).as_bytes())
+    );
+    let job_id = format!(
+        "{:x}-{}",
+        Sha256::digest(format!("{}\0{}\0{}", ctx.user, p.delegation_id, p.job_id).as_bytes()),
+        &owner[..32]
+    );
+    let staging = cfg
+        .data_dir
+        .join("executor-staging")
+        .join("owners")
+        .join(&owner);
     std::fs::DirBuilder::new()
         .recursive(true)
         .mode(0o700)
@@ -44,7 +58,8 @@ fn save(cfg: &Config, ctx: &Context, params: &Params) -> Result<Value, Error> {
         .map_err(internal)?;
     let name = format!("report-{}.txt", p.job_id);
     let path = staging.join(&name);
-    // A retried save sends the file it wrote the first time.
+    // An admitted or uncertain save retries the original source.
+    let mut created = false;
     match OpenOptions::new()
         .write(true)
         .create_new(true)
@@ -52,6 +67,7 @@ fn save(cfg: &Config, ctx: &Context, params: &Params) -> Result<Value, Error> {
         .open(&path)
     {
         Ok(mut file) => {
+            created = true;
             let report = format!("Report for {}, {}\n", ctx.user, utc_now());
             file.write_all(report.as_bytes()).map_err(internal)?;
         }
@@ -59,10 +75,20 @@ fn save(cfg: &Config, ctx: &Context, params: &Params) -> Result<Value, Error> {
         Err(e) => return Err(internal(e)),
     }
     let size = std::fs::metadata(&path).map_err(internal)?.len();
-    ctx.runtime(
+    let result: Result<Value, Error> = ctx.runtime(
         "delegate.move_from_staging",
-        &json!({"delegation_id": p.delegation_id, "job_id": p.job_id, "staging": name, "name": name, "size": size}),
-    )
+        &json!({"delegation_id": p.delegation_id, "job_id": job_id, "staging": format!("owners/{owner}/{name}"), "name": name, "size": size}),
+    );
+    // A transport failure may already have been admitted; keep its source.
+    if created
+        && result
+            .as_ref()
+            .err()
+            .is_some_and(|e| e.code == "DELEGATION_DENIED")
+    {
+        std::fs::remove_file(&path).map_err(internal)?;
+    }
+    result
 }
 
 #[cfg(test)]
@@ -106,11 +132,26 @@ mod tests {
         let (_dir, cfg) = setup();
         let reply = save(&cfg, "alice", &moved());
         assert_eq!(reply.data, json!({"state": "queued"}));
-        let path = cfg.data_dir.join("executor-staging/report-job-1.txt");
+        let path = cfg
+            .data_dir
+            .join("executor-staging")
+            .join(reply.services[0].1["staging"].as_str().unwrap());
         assert!(std::fs::read_to_string(&path).unwrap().contains("alice"));
         let meta = std::fs::metadata(&path).unwrap();
         assert_eq!(meta.permissions().mode() & 0o777, 0o600);
-        let params = json!({"delegation_id": "d1", "job_id": "job-1", "staging": "report-job-1.txt", "name": "report-job-1.txt", "size": meta.len()});
+        let owner = reply.services[0].1["staging"]
+            .as_str()
+            .unwrap()
+            .split('/')
+            .nth(1)
+            .unwrap();
+        assert!(
+            reply.services[0].1["job_id"]
+                .as_str()
+                .unwrap()
+                .ends_with(&format!("-{}", &owner[..32]))
+        );
+        let params = json!({"delegation_id": "d1", "job_id": reply.services[0].1["job_id"], "staging": reply.services[0].1["staging"], "name": "report-job-1.txt", "size": meta.len()});
         assert_eq!(
             reply.services,
             vec![("delegate.move_from_staging".to_string(), params)]
@@ -118,29 +159,43 @@ mod tests {
     }
 
     #[test]
-    fn a_repeated_save_sends_the_same_file_again() {
+    fn retries_reuse_only_the_same_owner_and_grant_source() {
         let (_dir, cfg) = setup();
         let first = save(&cfg, "alice", &moved()).services;
-        let path = cfg.data_dir.join("executor-staging/report-job-1.txt");
+        let path = cfg
+            .data_dir
+            .join("executor-staging")
+            .join(first[0].1["staging"].as_str().unwrap());
         let report = std::fs::read_to_string(&path).unwrap();
-        assert_eq!(save(&cfg, "bob", &moved()).services, first);
+        assert_eq!(save(&cfg, "alice", &moved()).services, first);
+        let other = save(&cfg, "bob", &moved()).services;
+        assert_ne!(other[0].1["staging"], first[0].1["staging"]);
+        assert_ne!(other[0].1["job_id"], first[0].1["job_id"]);
+        let other_path = cfg
+            .data_dir
+            .join("executor-staging")
+            .join(other[0].1["staging"].as_str().unwrap());
+        assert!(std::fs::read_to_string(other_path).unwrap().contains("bob"));
         assert_eq!(std::fs::read_to_string(&path).unwrap(), report);
     }
 
     #[test]
-    fn save_passes_on_the_executors_refusal() {
+    fn rejection_removes_new_source_but_timeout_keeps_retry() {
         let (_dir, cfg) = setup();
-        let services: Services = [(
-            "delegate.move_from_staging",
-            Box::new(|_: &Value| {
-                Err(Error::new(
-                    "DELEGATION_DENIED",
-                    "The destination is no longer allowed.",
-                ))
-            }) as _,
-        )]
-        .into();
-        assert_eq!(save(&cfg, "alice", &services).code(), "DELEGATION_DENIED");
+        for (code, retained) in [("DELEGATION_DENIED", false), ("EXECUTOR_TIMEOUT", true)] {
+            let services: Services = [(
+                "delegate.move_from_staging",
+                Box::new(move |_: &Value| Err(Error::new(code, "Save failed"))) as _,
+            )]
+            .into();
+            let reply = save(&cfg, "alice", &services);
+            assert_eq!(reply.code(), code);
+            let path = cfg
+                .data_dir
+                .join("executor-staging")
+                .join(reply.services[0].1["staging"].as_str().unwrap());
+            assert_eq!(path.exists(), retained);
+        }
     }
 
     #[test]