Design v2 implementation and acceptance

The local Design v2 catalog contains 110 scenes / 120 active feature entries; the commented-out CRC dialog F066 is excluded. The native implementation covers each scene family and the nine functional gaps identified in the 2026-10-14 review. This ledger distinguishes implemented interactions from live service and operating-system acceptance; it is not a claim of pixel-perfect design parity.

internal/app/testdata/design-v2-scenes.json freezes the scene IDs. TestDesignV2Scenes renders 104 application-owned scene fixtures in 5 languages × 2 themes at 900 × 620. These 1,040 checks detect missing translations and clipped close actions; they do not independently prove every interaction. make snapshots exports the English light/dark variants. D11, D12, D47, D53, D54 and D55 are OS-owned surfaces or handoffs and are excluded from the headless rendering count.

Existing capabilities

These capabilities are connected to native views and service adapters. The review follow-up records the nine completed functional groups and their regression coverage.

• Connections: AK, STS, authorization codes, HTTPS endpoint modes, requester-pays opt-in, keyring-backed keep-login, expiry/read-only enforcement, history, bookmarks and home directory.
• Browsing: list/grid, prefix search and pagination, address navigation, context menus, multiple selection, drag/drop plans and bounded image thumbnails.
• Buckets: region-dependent storage options, explicit public-ACL confirmation, empty-bucket deletion, paginated multipart search and queued cleanup.
• Objects: recursive copy/move/rename/delete, cross-bucket same-region paste, conflict confirmation, per-item outcomes, HTTP headers and metadata, symlinks, archive restoration and restore-gated previews.
• Preview: text editing/diff/unsaved-change guard, image zoom, native WebView audio/video, and explicit document/FLV/unsupported-format fallback. Text saves preserve headers, metadata, tags, ACL and storage class. Creating a copy is the default; replacing the original requires explicit opt-in and an ETag preflight.
• Sharing: public ACL validation, expiring signed URLs, custom/accelerated domains, QR generation, clipboard/browser handoff, and confirmed SMTP messages.
• Identity: RAM users and AccessKeys, user/group/role policy grants, multi-object policies, new-user codes, STS role codes and expiry. Partial grant completion is retained for retry within the dialog.
• Transfers: independent upload/download limits, bounded automatic retries, pause/resume/remove/clear, diagnostic details, durable file-transfer recovery and CRC/ETag verification.
• Preferences/distribution: an independent five-category settings dialog with automatic saving, system theme and language, searchable/clearable session diagnostics, automatic signed-package downloads, notes, progress/error/retry, confirmed installation and restart when the build has a configured update feed/key. Unconfigured builds offer manual release downloads.

Review follow-up

The 2026-10-14 review in 检查设计页面实施情况 identified nine functional gaps. The following code changes complete those groups. Paths are repository-relative; the local catalog and previews/all described in Design baseline remain the visual references.

• Source-changed download recovery — D46-changed. Both task and detail retry actions open a confirmation. Cancellation retains the failed task and partial data. Confirmation refreshes the ETag/object data, acquires the record lease, resets only that job's staging/checkpoint and retries the updated durable record. Inspection failures preserve the old partials. See internal/app/transfer_restart.go, internal/transfers/restart.go and its tests.
• Risk, overwrite and batch flows — D05, D09, D15–D17. Public ACL and multipart deletion have separate confirmation dialogs. Retrying a collision opens a source/target overwrite confirmation for that item. Batch results show progress and success/failure/stopped counts; retry-failed skips successful and canceled items and pauses for any required confirmation. See bucket_tools.go, batch_view.go, object_mutations.go under internal/app.
• Code editor and save-time Diff — D23, D28, E03. MyGo's native code editor provides highlighting and line numbers. Saving changed text requires a split Diff with an editable new side and an explicit save action. Returning to the editor keeps the draft; CRLF, size/read-only limits, copy-by-default, replacement opt-in and object attributes remain preserved. See internal/app/preview_view.go, object_view.go and design_completion_test.go.
• RAM presets and results — D33–D35. Read-only, read/write and full-control presets retain selected object resource scopes with an editable policy preview. A result dialog exposes the principal, new AccessKey ID/Secret, authorization code and copy actions. SMTP failure keeps those results and retries only mail; opening SMTP settings restores the originating result afterward. Existing secrets cannot be fetched from RAM. See internal/app/ram_result.go, ram_result_test.go and internal/identity/policy.go.
• Settings — D36. A separate dialog has left category navigation, grouped forms, units and validation. Transfer and mail drafts save after a short debounce; failures retain input with retry. Existing immediate switches remain persisted. See internal/app/settings_view.go, settings_controls.go, preferences_state.go and design_completion_test.go.
• Object rows and details — P04. List rows reuse bounded thumbnails; the detail panel loads a larger image and ACL. Sidebar RAM management and folder grant/token buttons use shared commands. Separate task generations reject stale selection callbacks. See internal/app/object_details.go, browser_view.go and the stale-selection regression test.
• Headers and metadata — D19. Common HTTP headers are form fields; metadata uses add/remove key/value rows with case-insensitive duplicate validation. The batch notice describes selection count and replacement; blank batch headers preserve existing values. See internal/app/metadata_view.go and design_completion_test.go.
• Diagnostics — D49. Case-insensitive search, copying filtered events, clearing current session events and separate empty/no-match states are available. Persisted logs, retention limits and redaction remain independent. See internal/app/system_settings.go and its filtering regression test.
• Automatic update downloads — D36-system, D50, D52. Configured builds download and verify a full archive in the background, report progress/failure/readiness and wait for explicit installation. Installation re-verifies staged bytes and needs no further network request; restart is a separate action. internal/updates implements the pinned MyGo manifest/signature format, with tests for cancellation, tampering, path confinement and bundle replacement. Unconfigured builds retain manual release links.

Scope decision: FLV playback

D25-flv retains external-open/download fallback in internal/app/preview_media.go. In-app decoding remains a separate scope decision.

Evidence and remaining acceptance

Scene fixtures now represent the independent confirmations, editable save Diff, RAM result/mail failure, settings surface, batch results and update readiness. Focused tests exercise cancellation, retained drafts/credentials, stale callbacks, duplicate metadata, scoped policies and staged updates. Some unrelated error fixtures still use generic network errors; rendering coverage alone does not prove live service behavior. Real account, codec, OS and signed-distribution acceptance remains tracked below and in Releasing.

Production boundaries

Real OSS/RAM/SMTP requests were not performed during implementation. Account credentials, Windows/Linux desktop environments and distribution signing configuration remain owner-provided acceptance inputs, as recorded in releasing. Native macOS startup is a smoke test only. WebView codec behavior, OS dialogs, keyring prompts, live archive delays and signed update installation need those environments.

Local verification

Local verification on macOS on 2026-10-14 covers the completed follow-up. It does not replace live acceptance:

• go test ./..., go test -race ./..., go vet ./... and go tool mygo vet passed.
• All 1,040 scene fixture checks passed; make snapshots exported the visual regression images.
• Native macOS launch/capture and application packaging passed. Windows/Linux cross-compilation was recorded by the earlier baseline review; desktop execution on those platforms remains pending.
• The documentation typecheck and production build passed. Go formatting and whitespace checks were clean.

Application limits

The following deliberate boundaries are visible in the application:

• Connections use HTTPS. Remote text loads are bounded to 8 MiB, editable UTF-8 to 5 MiB; image decoding is bounded to 20 megapixels. Document and FLV previews offer external open/download. Unsupported codecs depend on the installed native media engine.
• Metadata self-copy is limited to 1 GiB. Recursive plans stop at 100,000 unique keys. Server-side cross-bucket copying requires matching regions. Object mutation jobs remain session-only; file upload/download records survive reconnect.
• OSS ETag preflight followed by deletion/replacement is not atomic. Avoid concurrent writes. Forbid-overwrite semantics differ on versioned buckets. Explicit replacement can create a new object version.
• SMTP requires implicit TLS or STARTTLS. Secrets use memory or the OS credential store. RAM AccessKey secrets are displayed only when created in this dialog; existing secrets cannot be fetched from RAM.
• Multi-object grants permit listing the common parent directory so the recipient can browse; read/write object actions remain restricted to the selected resources. Review the editable policy before granting.
• Removed transfer records use tombstones so late worker completion cannot restore them. Removing a task retains resumable partials; multipart deletion is a separate confirmed operation.
• An unsigned development build cannot install updates. mygo.json must receive a trusted publisher public key and update feed during signed release preparation; no trust key is invented by this implementation.

Scene ledger

“UI” below means the scene has a native state fixture in TestDesignV2Scenes; it does not mean the design interaction or visual layout is complete. Read affected rows together with the review follow-up. Service tests use injected HTTP responses; this is not cloud acceptance. Filenames without a directory below are relative to internal/app/. The original Chinese titles are retained so IDs can be compared directly with the source catalog.

Scene	Catalog title	Implementation	Evidence / external acceptance
P01	连接 · AccessKey	connection_view.go, connection_actions.go, saved_locations.go	UI; authorization, scope and connection tests; live login/keyring pending
P02	连接 · 授权码	connection_view.go, connection_actions.go, saved_locations.go	UI; authorization, scope and connection tests; live login/keyring pending
P03	所有 Bucket	browser_view.go, browser_controls.go, saved_locations.go	UI; paging/navigation tests; live OSS pending
P04	对象浏览与详情	browser_view.go, browser_controls.go, saved_locations.go	UI; paging/navigation tests; live OSS pending
P05	上传队列 · 完整状态	transfer_controls.go, internal/transfers	UI; queue, recovery, checksum and path tests; live transfer acceptance pending
P06	下载队列	transfer_controls.go, internal/transfers	UI; queue, recovery, checksum and path tests; live transfer acceptance pending
D01	连接历史	connection_view.go, connection_actions.go, saved_locations.go	UI; authorization, scope and connection tests; live login/keyring pending
D02	退出连接确认	connection_view.go, connection_actions.go, saved_locations.go	UI; authorization, scope and connection tests; live login/keyring pending
D03	收藏管理	browser_view.go, browser_controls.go, saved_locations.go	UI; paging/navigation tests; live OSS pending
D04	创建 Bucket	bucket_tools.go, internal/ossclient/buckets.go	UI; request/scope/pagination tests; live bucket acceptance pending
D05	公开访问风险	bucket_tools.go, internal/ossclient/buckets.go	UI; request/scope/pagination tests; live bucket acceptance pending
D06	Bucket 访问权限	bucket_tools.go, internal/ossclient/buckets.go	UI; request/scope/pagination tests; live bucket acceptance pending
D07	删除空 Bucket	bucket_tools.go, internal/ossclient/buckets.go	UI; request/scope/pagination tests; live bucket acceptance pending
D08	上传碎片管理	bucket_tools.go, internal/ossclient/buckets.go	UI; request/scope/pagination tests; live bucket acceptance pending
D09	删除上传碎片	bucket_tools.go, internal/ossclient/buckets.go	UI; request/scope/pagination tests; live bucket acceptance pending
D10	新建目录	object_actions.go, object_clipboard.go	UI; recursive plan and partial mutation tests; live mutations pending
D11	选择上传文件与目录	internal/desktop, transfer_actions.go, internal/transfers/download_plan.go	Native delegation; OS picker/reveal and cancellation acceptance pending
D12	下载保存位置	internal/desktop, transfer_actions.go, internal/transfers/download_plan.go	Native delegation; OS picker/reveal and cancellation acceptance pending
D13	文件与目录重命名	object_actions.go, object_clipboard.go	UI; recursive plan and partial mutation tests; live mutations pending
D14	跨桶批量粘贴确认	object_actions.go, object_clipboard.go	UI; recursive plan and partial mutation tests; live mutations pending
D15	复制移动进度	transfer_controls.go, internal/transfers	UI; queue, recovery, checksum and path tests; live transfer acceptance pending
D16	同名覆盖确认	object_actions.go, object_clipboard.go	UI; recursive plan and partial mutation tests; live mutations pending
D17	批量删除确认	object_actions.go, object_clipboard.go	UI; recursive plan and partial mutation tests; live mutations pending
D18	对象访问权限	object_actions.go, internal/ossclient/objects.go	UI; property/ACL preservation tests; live updates pending
D19	HTTP 头与元数据	object_actions.go, internal/ossclient/objects.go	UI; property/ACL preservation tests; live updates pending
D20	创建软链接	internal/ossclient/advanced.go, object_actions.go	UI; symlink, scope and restore-state/request tests; live restoration pending
D21	恢复归档对象	internal/ossclient/advanced.go, object_actions.go	UI; symlink, scope and restore-state/request tests; live restoration pending
D22	批量恢复归档	internal/ossclient/advanced.go, object_actions.go	UI; symlink, scope and restore-state/request tests; live restoration pending
D23	文本与代码编辑	object_actions.go, preview_media.go	UI; size/integrity, unchanged/diff and discard tests
D24	图片预览	object_actions.go, preview_media.go	UI; size/integrity, unchanged/diff and discard tests
D25	视频预览	preview_media.go	UI fallback; native player/codec and external-open acceptance pending
D26	文档预览降级	preview_media.go	UI fallback; native player/codec and external-open acceptance pending
D27	不支持的文件格式	object_actions.go, preview_media.go	UI; size/integrity, unchanged/diff and discard tests
D28	保存前差异对比	object_actions.go, preview_media.go	UI; size/integrity, unchanged/diff and discard tests
D29	归档预览检查	internal/ossclient/advanced.go, object_actions.go	UI; symlink, scope and restore-state/request tests; live restoration pending
D31	私有对象签名地址	internal/ossclient/share.go, object_actions.go	UI; exact QR decode, URL encoding, ACL and signed scope tests; domain binding pending
D32	邮件发送下载地址	mail_tools.go, internal/mail	UI; address/header/cancellation tests; real TLS delivery pending
D33	简化 Policy 授权	ram_tools.go, internal/identity	UI; signed RPC, pagination, scope and code tests; live RAM/STS acceptance pending
D34	创建子用户并授权	ram_tools.go, internal/identity	UI; signed RPC, pagination, scope and code tests; live RAM/STS acceptance pending
D35	子用户授权结果	ram_tools.go, internal/identity	UI; signed RPC, pagination, scope and code tests; live RAM/STS acceptance pending
D36	设置 · 传输	settings_controls.go, system_settings.go, internal/diagnostics	UI; settings validation and log rotation tests
D37	目录临时授权码	ram_tools.go, internal/identity	UI; signed RPC, pagination, scope and code tests; live RAM/STS acceptance pending
D38	RAM 用户管理	ram_tools.go, internal/identity	UI; signed RPC, pagination, scope and code tests; live RAM/STS acceptance pending
D39	编辑 RAM 用户资料	ram_tools.go, internal/identity	UI; signed RPC, pagination, scope and code tests; live RAM/STS acceptance pending
D40	删除 RAM 用户确认	ram_tools.go, internal/identity	UI; signed RPC, pagination, scope and code tests; live RAM/STS acceptance pending
D41	AccessKey 管理	ram_tools.go, internal/identity	UI; signed RPC, pagination, scope and code tests; live RAM/STS acceptance pending
D42	禁用 AccessKey 确认	ram_tools.go, internal/identity	UI; signed RPC, pagination, scope and code tests; live RAM/STS acceptance pending
D43	删除 AccessKey 确认	ram_tools.go, internal/identity	UI; signed RPC, pagination, scope and code tests; live RAM/STS acceptance pending
D44	移除未完成任务	transfer_controls.go, internal/transfers	UI; queue, recovery, checksum and path tests; live transfer acceptance pending
D45	清空传输队列	transfer_controls.go, internal/transfers	UI; queue, recovery, checksum and path tests; live transfer acceptance pending
D46	传输详情与错误诊断	transfer_controls.go, internal/transfers	UI; queue, recovery, checksum and path tests; live transfer acceptance pending
D47	下载本地位置	internal/desktop, transfer_actions.go, internal/transfers/download_plan.go	Native delegation; OS picker/reveal and cancellation acceptance pending
D48	SMTP 测试确认	mail_tools.go, internal/mail	UI; address/header/cancellation tests; real TLS delivery pending
D49	诊断控制台	settings_controls.go, system_settings.go, internal/diagnostics	UI; settings validation and log rotation tests
D50	关于与检查更新	update.go, internal/releases, internal/updates	UI; release parsing tests; signed feed/install/restart acceptance pending
D51	版本发布说明	update.go, internal/releases, internal/updates	UI; release parsing tests; signed feed/install/restart acceptance pending
D52	安装与重启确认	update.go, internal/releases, internal/updates	UI; release parsing tests; signed feed/install/restart acceptance pending
D53	应用与系统菜单	menu.go, commands()	Native delegation; edit/window/app roles; platform menu acceptance pending
D54	单实例窗口激活	main.go, application.openWindow	Native delegation; instance lock and activation; platform acceptance pending
D55	外部帮助交接	window.openDocs, desktop.OpenURL	Native delegation; URL policy tests; browser handoff acceptance pending
P01-sts	STS 临时凭证	connection_view.go, connection_actions.go, saved_locations.go	UI; authorization, scope and connection tests; live login/keyring pending
P01-customize	自定义 Endpoint	connection_view.go, connection_actions.go, saved_locations.go	UI; authorization, scope and connection tests; live login/keyring pending
P01-cname	CNAME 自定义域连接	connection_view.go, connection_actions.go, saved_locations.go	UI; authorization, scope and connection tests; live login/keyring pending
P01-privateLink	PrivateLink 私网连接	connection_view.go, connection_actions.go, saved_locations.go	UI; authorization, scope and connection tests; live login/keyring pending
P01-invalid	连接失败与保留输入	connection_view.go, connection_actions.go, saved_locations.go	UI; authorization, scope and connection tests; live login/keyring pending
P01-loading	正在建立连接	connection_view.go, connection_actions.go, saved_locations.go	UI; authorization, scope and connection tests; live login/keyring pending
P02-expired	授权码过期	connection_view.go, connection_actions.go, saved_locations.go	UI; authorization, scope and connection tests; live login/keyring pending
P03-grid	Bucket 图标视图	browser_view.go, browser_controls.go, saved_locations.go	UI; paging/navigation tests; live OSS pending
P03-empty	没有 Bucket	browser_view.go, browser_controls.go, saved_locations.go	UI; paging/navigation tests; live OSS pending
P03-readonly	临时只读会话	browser_view.go, browser_controls.go, saved_locations.go	UI; paging/navigation tests; live OSS pending
P04-grid	对象网格视图	browser_view.go, browser_controls.go, saved_locations.go	UI; paging/navigation tests; live OSS pending
P04-search	前缀搜索与无匹配	browser_view.go, browser_controls.go, saved_locations.go	UI; paging/navigation tests; live OSS pending
P04-empty	空目录	browser_view.go, browser_controls.go, saved_locations.go	UI; paging/navigation tests; live OSS pending
P04-loading	目录正在加载	browser_view.go, browser_controls.go, saved_locations.go	UI; paging/navigation tests; live OSS pending
P04-offline	网络中断与重试	browser_view.go, browser_controls.go, saved_locations.go	UI; paging/navigation tests; live OSS pending
P04-forbidden	无权读取当前目录	browser_view.go, browser_controls.go, saved_locations.go	UI; paging/navigation tests; live OSS pending
P04-multi	多选与批量操作	browser_view.go, browser_controls.go, saved_locations.go	UI; paging/navigation tests; live OSS pending
P04-context	对象右键菜单	browser_view.go, browser_controls.go, saved_locations.go	UI; paging/navigation tests; live OSS pending
P04-large	大列表与增量列举	browser_view.go, browser_controls.go, saved_locations.go	UI; paging/navigation tests; live OSS pending
P04-clipboard	复制移动待粘贴	browser_view.go, browser_controls.go, saved_locations.go	UI; paging/navigation tests; live OSS pending
P06-failed	下载失败与恢复	transfer_controls.go, internal/transfers	UI; queue, recovery, checksum and path tests; live transfer acceptance pending
D01-clear	清空连接历史确认	connection_view.go, connection_actions.go, saved_locations.go	UI; authorization, scope and connection tests; live login/keyring pending
D07-nonempty	Bucket 非空删除失败	bucket_tools.go, internal/ossclient/buckets.go	UI; request/scope/pagination tests; live bucket acceptance pending
D15-partial	复制移动部分失败	transfer_controls.go, internal/transfers	UI; queue, recovery, checksum and path tests; live transfer acceptance pending
D17-partial	批量删除部分失败	object_actions.go, object_clipboard.go	UI; recursive plan and partial mutation tests; live mutations pending
D19-batch	批量编辑元数据	object_actions.go, internal/ossclient/objects.go	UI; property/ACL preservation tests; live updates pending
D23-readonly	只读代码预览	object_actions.go, preview_media.go	UI; size/integrity, unchanged/diff and discard tests
D23-oversize	文本超过预览上限	object_actions.go, preview_media.go	UI; size/integrity, unchanged/diff and discard tests
D25-audio	音频预览	preview_media.go	UI fallback; native player/codec and external-open acceptance pending
D25-flv	FLV 视频预览	preview_media.go	UI fallback; native player/codec and external-open acceptance pending
D27-error	预览加载失败	object_actions.go, preview_media.go	UI; size/integrity, unchanged/diff and discard tests
D31-public	公开对象地址	internal/ossclient/share.go, object_actions.go	UI; exact QR decode, URL encoding, ACL and signed scope tests; domain binding pending
D31-domain	自定义域与二维码	internal/ossclient/share.go, object_actions.go	UI; exact QR decode, URL encoding, ACL and signed scope tests; domain binding pending
D33-group	授权给用户组	ram_tools.go, internal/identity	UI; signed RPC, pagination, scope and code tests; live RAM/STS acceptance pending
D33-role	授权给角色	ram_tools.go, internal/identity	UI; signed RPC, pagination, scope and code tests; live RAM/STS acceptance pending
D33-policy	Policy JSON 预览编辑	ram_tools.go, internal/identity	UI; signed RPC, pagination, scope and code tests; live RAM/STS acceptance pending
D35-mailfailure	授权成功但邮件失败	ram_tools.go, internal/identity	UI; signed RPC, pagination, scope and code tests; live RAM/STS acceptance pending
D36-system	设置 · 系统	settings_controls.go, system_settings.go, internal/diagnostics	UI; settings validation and log rotation tests
D36-mail	设置 · 邮件	settings_controls.go, system_settings.go, internal/diagnostics	UI; settings validation and log rotation tests
D36-logs	设置 · 日志	settings_controls.go, system_settings.go, internal/diagnostics	UI; settings validation and log rotation tests
D36-other	设置 · 其他	settings_controls.go, system_settings.go, internal/diagnostics	UI; settings validation and log rotation tests
D37-generated	临时授权码已生成	ram_tools.go, internal/identity	UI; signed RPC, pagination, scope and code tests; live RAM/STS acceptance pending
D38-forbidden	RAM 列表权限不足	ram_tools.go, internal/identity	UI; signed RPC, pagination, scope and code tests; live RAM/STS acceptance pending
D46-crc	CRC 校验不匹配	transfer_controls.go, internal/transfers	UI; queue, recovery, checksum and path tests; live transfer acceptance pending
D46-changed	源对象变更重新下载	transfer_controls.go, internal/transfers	UI; queue, recovery, checksum and path tests; live transfer acceptance pending
D46-disk	本地写入失败诊断	transfer_controls.go, internal/transfers	UI; queue, recovery, checksum and path tests; live transfer acceptance pending
D50-downloading	更新下载进度	update.go, internal/releases, internal/updates	UI; release parsing tests; signed feed/install/restart acceptance pending
D50-failed	更新下载失败	update.go, internal/releases, internal/updates	UI; release parsing tests; signed feed/install/restart acceptance pending
D50-finished	更新已就绪	update.go, internal/releases, internal/updates	UI; release parsing tests; signed feed/install/restart acceptance pending
E03	放弃未保存修改确认	object_actions.go, preview_media.go	UI; size/integrity, unchanged/diff and discard tests

Protocol references

OSS storage classes, requester pays, RestoreObject, and PutSymlink. The staged updater follows the manifest/signature format of the pinned MyGo v0.4.8 module; adapted code retains its MIT notice in internal/updates/LICENSE.