From a5720fef2a3c72d371702f697854f79ed2c4d177 Mon Sep 17 00:00:00 2001
From: Alexander Nguyen <alxxander.nguyen@protonmail.com>
Date: Wed, 10 Jun 2026 01:22:28 -0700
Subject: [PATCH 01/21] docs(spec): rsync-over-ssh NAS transport design +
 implementation plan

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../2026-06-10-rsync-ssh-nas-transport.md     | 2081 +++++++++++++++++
 ...26-06-10-rsync-ssh-nas-transport-design.md |  529 +++++
 2 files changed, 2610 insertions(+)
 create mode 100644 docs/superpowers/plans/2026-06-10-rsync-ssh-nas-transport.md
 create mode 100644 docs/superpowers/specs/2026-06-10-rsync-ssh-nas-transport-design.md

diff --git a/docs/superpowers/plans/2026-06-10-rsync-ssh-nas-transport.md b/docs/superpowers/plans/2026-06-10-rsync-ssh-nas-transport.md
new file mode 100644
index 0000000..7daced4
--- /dev/null
+++ b/docs/superpowers/plans/2026-06-10-rsync-ssh-nas-transport.md
@@ -0,0 +1,2081 @@
+# rsync-over-ssh NAS Transport Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Add an `rsync_ssh` NAS transport (selected per-instance by `nas.transport`) so cluster machines — where IT blocks SMB and rclone-SFTP but allows rsync-over-ssh — can push, reconcile, verify, and probe against the Synology NAS.
+
+**Architecture:** A new `RsyncSshDriver` mirrors `RcloneDriver`'s thin-subprocess-wrapper shape behind a shared `NasTransportDriver` protocol and a `build_nas_driver` factory. Targets reuse the existing `<remote>:<path>` string (`user@host:/path` is valid rsync syntax), so `NASSyncClient`'s state machine, reconcile loop, and cleanup gate are untouched. All ops use rsync protocol primitives only (no remote command exec): push = `rsync -rt`, manifest = `--list-only` parse, verify = `--checksum` dry-run itemize, probe = non-recursive `--list-only`.
+
+**Spec:** `docs/superpowers/specs/2026-06-10-rsync-ssh-nas-transport-design.md` (all OQs resolved 2026-06-10).
+
+**Tech Stack:** Python 3.12, Pydantic v2, pytest (`asyncio_mode = "auto"`, so `async def` tests need no marker). Test runner: `uv run --extra test pytest`. Lint: `uvx ruff check`. **Run sync test suites one at a time** (they flake under CPU load).
+
+**Out of scope (deliberate):** renaming `SetupState.INCOMPLETE_NO_NAS_REMOTE` / `SetupNextAction.CONFIGURE_RCLONE_REMOTE` (kept; only UI copy changes); the `error_kind=None` → HASH_MISMATCH retry-routing debt; `ui/pages/wizard_equipment.py` copy polish; staging-hop rsync support.
+
+---
+
+## File map
+
+| File | Change |
+| --- | --- |
+| `src/exlab_wizard/constants/enums.py` | new `SyncTransport` StrEnum |
+| `src/exlab_wizard/constants/__init__.py` | export `SyncTransport` |
+| `src/exlab_wizard/config/models.py` | `NasConfig.transport/ssh_port/ssh_identity_file` + validator |
+| `src/exlab_wizard/sync/manifest.py` | new `parse_rsync_listing()` |
+| `src/exlab_wizard/sync/transports/__init__.py` | `NasTransportDriver` protocol, `build_nas_driver` factory |
+| `src/exlab_wizard/sync/transports/rclone.py` | new `lsjson_manifest()` shim |
+| `src/exlab_wizard/sync/transports/rsync_ssh.py` | **new** `RsyncSshDriver` |
+| `src/exlab_wizard/sync/nas_client.py` | factory routing + stage-mode bypass + `lsjson_manifest` |
+| `src/exlab_wizard/sync/verifier.py` | protocol typing, drop no-arg default |
+| `src/exlab_wizard/tray/dependencies.py` | transport-aware gate hydration + probe |
+| `src/exlab_wizard/paths.py` | `_missing_nas_fields` transport branch |
+| `src/exlab_wizard/ui/pages/settings.py` | transport-aware NAS-Remote section |
+| `src/exlab_wizard/ui/pages/main.py` | transport-neutral banner subline |
+| `tests/fixtures/stub_rsync.py` | **new** stub rsync binary |
+| `tests/unit/...` | per-task test files (see tasks) |
+| `tests/docker/*` | rsync-over-ssh leg + characterization tests |
+| `docs/setup/`, `design_specs/design_spec_sections/{04,07,09}_*.md`, `README.md` | docs |
+
+---
+
+### Task 1: `SyncTransport` enum
+
+**Files:**
+- Modify: `src/exlab_wizard/constants/enums.py` (after `SyncMode`, ~line 176)
+- Modify: `src/exlab_wizard/constants/__init__.py` (import list ~line 38, `__all__` ~line 264)
+- Test: `tests/unit/constants/test_enum_literal_alignment.py`, `tests/unit/constants/test_enums.py`
+
+- [ ] **Step 1: Write the failing test**
+
+Add to the `@pytest.mark.parametrize` list in `tests/unit/constants/test_enum_literal_alignment.py` (alongside the `SetupNextAction` entry):
+
+```python
+        (enums.SyncTransport, frozenset({"rclone", "rsync_ssh"})),
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `uv run --extra test pytest tests/unit/constants/test_enum_literal_alignment.py -v`
+Expected: FAIL with `AttributeError: module 'exlab_wizard.constants.enums' has no attribute 'SyncTransport'`
+
+- [ ] **Step 3: Implement the enum**
+
+In `src/exlab_wizard/constants/enums.py`, directly after the `SyncMode` class:
+
+```python
+class SyncTransport(StrEnum):
+    """Which binary the NAS sync subsystem shells out to.
+
+    rsync-over-ssh NAS transport design (2026-06-10). Selected per
+    instance by ``nas.transport``: ``rclone`` (default) drives the named
+    remote in the operator's rclone.conf; ``rsync_ssh`` drives
+    ``rsync -e ssh`` against ``nas.remote`` as a ``user@host`` target.
+    Stage-mode equipment always uses rclone regardless of this value.
+    """
+
+    RCLONE = "rclone"
+    RSYNC_SSH = "rsync_ssh"
+```
+
+In `src/exlab_wizard/constants/__init__.py`: add `SyncTransport,` to the `from exlab_wizard.constants.enums import (...)` block (alphabetical, next to `SyncMode`) and `"SyncTransport",` to `__all__` (next to `"SyncMode"`).
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+Run: `uv run --extra test pytest tests/unit/constants/ -v`
+Expected: PASS (alignment test plus the existing `test_enums.py` suite; if `test_enums.py` asserts a closed member list of the module, add `SyncTransport` there as well — check its failure output).
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/exlab_wizard/constants/ tests/unit/constants/
+git commit -m "feat(constants): add SyncTransport enum for NAS transport selection"
+```
+
+---
+
+### Task 2: `NasConfig` transport fields + validator
+
+**Files:**
+- Modify: `src/exlab_wizard/config/models.py` (`NasConfig`, ~line 273; import block ~line 36)
+- Test: `tests/unit/config/test_models.py`
+
+- [ ] **Step 1: Write the failing tests**
+
+Add to `tests/unit/config/test_models.py`:
+
+```python
+class TestNasTransport:
+    def test_transport_defaults_to_rclone(self) -> None:
+        nas = NasConfig()
+        assert nas.transport == SyncTransport.RCLONE
+        assert nas.ssh_port == 22
+        assert nas.ssh_identity_file == ""
+
+    def test_rsync_ssh_accepts_user_at_host(self) -> None:
+        nas = NasConfig(
+            transport="rsync_ssh",
+            remote="svc-sync@nas01.lab.example",
+            base_root="/volume1/lab",
+            ssh_identity_file="~/.ssh/id_exlab",
+        )
+        assert nas.transport == SyncTransport.RSYNC_SSH
+        assert nas.remote == "svc-sync@nas01.lab.example"
+
+    def test_rsync_ssh_rejects_empty_remote(self) -> None:
+        with pytest.raises(ValidationError, match="requires nas.remote"):
+            NasConfig(transport="rsync_ssh", remote="")
+
+    @pytest.mark.parametrize("bad", ["nas01", "@nas01", "svc-sync@"])
+    def test_rsync_ssh_rejects_non_user_at_host(self, bad: str) -> None:
+        with pytest.raises(ValidationError, match="user@host"):
+            NasConfig(transport="rsync_ssh", remote=bad)
+
+    def test_rclone_mode_remote_shape_unrestricted(self) -> None:
+        assert NasConfig(remote="nas01").remote == "nas01"
+
+    def test_transport_serializes_as_string(self) -> None:
+        dumped = NasConfig(
+            transport="rsync_ssh", remote="u@h"
+        ).model_dump()
+        assert dumped["transport"] == "rsync_ssh"
+```
+
+Imports needed at top of the test module (add to existing import blocks): `from pydantic import ValidationError` and `from exlab_wizard.constants import SyncTransport` (the module already imports `NasConfig` and `pytest`).
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `uv run --extra test pytest tests/unit/config/test_models.py -k TestNasTransport -v`
+Expected: FAIL with `ValidationError` ("Extra inputs are not permitted" — `extra="forbid"` rejects the unknown `transport` key).
+
+- [ ] **Step 3: Implement the fields**
+
+In `src/exlab_wizard/config/models.py`: add `SyncTransport,` to the existing `from exlab_wizard.constants import (...)` block. Then inside `NasConfig`, after the `rclone_config_path: str = ""` field:
+
+```python
+    # rsync-over-ssh NAS transport (2026-06-10 design). ``rsync_ssh`` drives
+    # ``rsync -e ssh`` with ``remote`` as a ``user@host`` target prefix;
+    # ``rclone_config_path`` and ``perf`` are rclone-only and ignored in
+    # rsync mode. Stage-mode equipment always uses rclone regardless.
+    transport: SyncTransport = SyncTransport.RCLONE
+    ssh_port: int = Field(default=22, ge=1, le=65535)
+    ssh_identity_file: str = ""
+```
+
+And after the existing fields, the serializer + validator (mirroring `EquipmentConfig._serialize_sync_mode`):
+
+```python
+    @field_serializer("transport")
+    def _serialize_transport(self, value: SyncTransport) -> str:
+        return value.value
+
+    @model_validator(mode="after")
+    def _validate_rsync_ssh(self) -> NasConfig:
+        if self.transport != SyncTransport.RSYNC_SSH:
+            return self
+        if not self.remote:
+            msg = "nas.transport 'rsync_ssh' requires nas.remote ('user@host')"
+            raise ValueError(msg)
+        user, sep, host = self.remote.partition("@")
+        if not (sep and user and host):
+            msg = (
+                f"nas.remote {self.remote!r} must be 'user@host' when "
+                "nas.transport is 'rsync_ssh'"
+            )
+            raise ValueError(msg)
+        return self
+```
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+Run: `uv run --extra test pytest tests/unit/config/test_models.py -v`
+Expected: PASS (whole module — confirms no regression in existing `NasConfig` tests).
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/exlab_wizard/config/models.py tests/unit/config/test_models.py
+git commit -m "feat(config): nas.transport selector + ssh fields on NasConfig"
+```
+
+---
+
+### Task 3: `parse_rsync_listing` manifest parser
+
+**Files:**
+- Modify: `src/exlab_wizard/sync/manifest.py`
+- Test: `tests/unit/sync/test_manifest.py`
+
+- [ ] **Step 1: Write the failing tests**
+
+Add to `tests/unit/sync/test_manifest.py`:
+
+```python
+from datetime import datetime
+
+from exlab_wizard.sync.manifest import parse_rsync_listing
+
+
+def _stamp(epoch: float) -> str:
+    """Format ``epoch`` the way the rsync client formats listing mtimes
+    (local timezone, 1 s resolution)."""
+    return datetime.fromtimestamp(epoch).strftime("%Y/%m/%d %H:%M:%S")
+
+
+class TestParseRsyncListing:
+    def test_plain_file(self) -> None:
+        raw = f"-rw-r--r--          2048 {_stamp(1_750_000_000)} data/reading_001.csv\n"
+        manifest = parse_rsync_listing(raw)
+        assert manifest.has("data/reading_001.csv")
+        assert manifest.entries["data/reading_001.csv"].size == 2048
+
+    def test_filename_with_spaces_survives(self) -> None:
+        raw = f"-rw-r--r--          1234 {_stamp(1_750_000_000)} image data 001.tif\n"
+        manifest = parse_rsync_listing(raw)
+        assert manifest.has("image data 001.tif")
+
+    def test_comma_grouped_size(self) -> None:
+        raw = f"-rw-r--r--     1,234,567 {_stamp(1_750_000_000)} big.bin\n"
+        assert parse_rsync_listing(raw).entries["big.bin"].size == 1234567
+
+    def test_mtime_roundtrips_through_local_timezone(self) -> None:
+        epoch = 1_750_000_000.0
+        raw = f"-rw-r--r--           100 {_stamp(epoch)} f.txt\n"
+        manifest = parse_rsync_listing(raw)
+        assert manifest.matches("f.txt", 100, epoch, tolerance_s=2)
+        assert not manifest.matches("f.txt", 100, epoch + 3600, tolerance_s=2)
+
+    def test_directories_and_dot_dropped(self) -> None:
+        stamp = _stamp(1_750_000_000)
+        raw = (
+            f"drwxr-xr-x          4096 {stamp} .\n"
+            f"drwxr-xr-x          4096 {stamp} data\n"
+            f"-rw-r--r--            10 {stamp} data/x.csv\n"
+        )
+        manifest = parse_rsync_listing(raw)
+        assert set(manifest.entries) == {"data/x.csv"}
+
+    def test_octal_escapes_unescaped(self) -> None:
+        raw = f"-rw-r--r--            10 {_stamp(1_750_000_000)} weird\\#012name.txt\n"
+        assert parse_rsync_listing(raw).has("weird\nname.txt")
+
+    def test_garbage_lines_ignored(self) -> None:
+        assert parse_rsync_listing("sending incremental file list\n\n") .entries == {}
+
+    def test_empty_input(self) -> None:
+        assert parse_rsync_listing("").entries == {}
+```
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `uv run --extra test pytest tests/unit/sync/test_manifest.py -k TestParseRsyncListing -v`
+Expected: FAIL with `ImportError: cannot import name 'parse_rsync_listing'`
+
+- [ ] **Step 3: Implement the parser**
+
+In `src/exlab_wizard/sync/manifest.py`: extend the imports (`from datetime import UTC, datetime`), add `"parse_rsync_listing"` to `__all__`, and append:
+
+```python
+# ``rsync --list-only`` line: perms, size (possibly digit-grouped), the
+# fixed-format timestamp, then EVERYTHING after the single separating
+# space is the path — filenames containing spaces appear literally
+# (spec-review blocker, 2026-06-10), so the line must be anchored on the
+# timestamp, never whitespace-split.
+_RSYNC_LIST_RE = re.compile(
+    r"^(?P<perms>\S+)\s+(?P<size>[\d,.]+)\s+"
+    r"(?P<date>\d{4}/\d{2}/\d{2})\s+(?P<time>\d{2}:\d{2}:\d{2})\s(?P<path>.+)$"
+)
+
+# rsync escapes unusual bytes in listings as ``\#ooo`` (3 octal digits).
+_RSYNC_ESCAPE_RE = re.compile(r"\\#([0-7]{3})")
+
+
+def _unescape_rsync_path(path: str) -> str:
+    """Decode rsync's ``\\#ooo`` octal escapes back into the real bytes."""
+    if "\\#" not in path:
+        return path
+    out = bytearray()
+    idx = 0
+    for match in _RSYNC_ESCAPE_RE.finditer(path):
+        out += path[idx : match.start()].encode("utf-8")
+        out.append(int(match.group(1), 8))
+        idx = match.end()
+    out += path[idx:].encode("utf-8")
+    return out.decode("utf-8", errors="replace")
+
+
+def parse_rsync_listing(raw: str) -> RemoteManifest:
+    """Parse ``rsync --list-only -r`` output into a :class:`RemoteManifest`.
+
+    rsync-over-ssh NAS transport (2026-06-10). Paths are already relative
+    to the listed target, so there is no ``strip_prefix``. Only regular
+    files (``-`` perm prefix) are kept — directories (including the ``.``
+    top entry) and symlinks are dropped, matching :func:`parse_lsjson`.
+    The listing timestamp has 1 s resolution and is formatted in the
+    local timezone of the process that renders the file list; it is
+    parsed as local time and stored as an RFC3339 UTC string so
+    :meth:`RemoteManifest.matches` works identically for both transports.
+    Unparseable lines are skipped (a listing we can't parse must not
+    crash the sync worker).
+    """
+    out: dict[str, RemoteEntry] = {}
+    for raw_line in raw.splitlines():
+        match = _RSYNC_LIST_RE.match(raw_line.rstrip())
+        if match is None:
+            continue
+        if not match.group("perms").startswith("-"):
+            continue
+        path = _unescape_rsync_path(match.group("path"))
+        if not path or path == ".":
+            continue
+        try:
+            size = int(re.sub(r"[,.]", "", match.group("size")))
+        except ValueError:
+            continue
+        try:
+            local_dt = datetime.strptime(  # noqa: DTZ007 -- naive-as-local is the point
+                f"{match.group('date')} {match.group('time')}", "%Y/%m/%d %H:%M:%S"
+            )
+        except ValueError:
+            continue
+        mod_time = local_dt.astimezone(UTC).isoformat().replace("+00:00", "Z")
+        out[path] = RemoteEntry(size=size, mod_time=mod_time, is_dir=False)
+    return RemoteManifest(entries=out)
+```
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+Run: `uv run --extra test pytest tests/unit/sync/test_manifest.py -v`
+Expected: PASS (new class plus all pre-existing lsjson tests).
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/exlab_wizard/sync/manifest.py tests/unit/sync/test_manifest.py
+git commit -m "feat(sync): parse rsync --list-only output into RemoteManifest"
+```
+
+---
+
+### Task 4: `NasTransportDriver` protocol + `RcloneDriver.lsjson_manifest`
+
+**Files:**
+- Modify: `src/exlab_wizard/sync/transports/__init__.py`
+- Modify: `src/exlab_wizard/sync/transports/rclone.py`
+- Test: `tests/unit/sync/test_transports.py`
+
+- [ ] **Step 1: Write the failing test**
+
+Add to `tests/unit/sync/test_transports.py`:
+
+```python
+async def test_rclone_lsjson_manifest_parses_and_strips(monkeypatch) -> None:
+    from exlab_wizard.sync.transports.rclone import RcloneDriver
+
+    raw = (
+        '[{"Path": "base/EQ1/Run_1/a.csv", "Size": 10,'
+        ' "ModTime": "2026-06-10T00:00:00Z", "IsDir": false}]'
+    )
+
+    async def fake_lsjson(self, remote, *, recursive=True):
+        return raw
+
+    monkeypatch.setattr(RcloneDriver, "lsjson", fake_lsjson)
+    manifest = await RcloneDriver().lsjson_manifest(
+        "nas01:/base/EQ1/Run_1", strip_prefix="base/EQ1/Run_1"
+    )
+    assert manifest.has("a.csv")
+
+
+def test_rclone_driver_satisfies_protocol() -> None:
+    from exlab_wizard.sync.transports import NasTransportDriver
+    from exlab_wizard.sync.transports.rclone import RcloneDriver
+
+    driver: NasTransportDriver = RcloneDriver()
+    assert driver is not None
+```
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `uv run --extra test pytest tests/unit/sync/test_transports.py -k "lsjson_manifest or protocol" -v`
+Expected: FAIL (`AttributeError: lsjson_manifest` / `ImportError: NasTransportDriver`).
+
+- [ ] **Step 3: Implement**
+
+In `src/exlab_wizard/sync/transports/__init__.py`: extend the module imports and `__all__`:
+
+```python
+from typing import TYPE_CHECKING, Protocol
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+    from exlab_wizard.sync.manifest import RemoteManifest
+    from exlab_wizard.sync.transports.rclone import AboutResult, CheckResult
+
+__all__ = [
+    "NasTransportDriver",
+    "TransportError",
+    "TransportErrorKind",
+    "TransportResult",
+]
+```
+
+and append after `TransportError`:
+
+```python
+class NasTransportDriver(Protocol):
+    """The four network ops the NAS sync subsystem consumes.
+
+    rsync-over-ssh NAS transport (2026-06-10). Implemented by
+    :class:`~exlab_wizard.sync.transports.rclone.RcloneDriver` and
+    :class:`~exlab_wizard.sync.transports.rsync_ssh.RsyncSshDriver`.
+    ``listremotes`` is deliberately NOT part of this protocol — it is
+    rclone.conf introspection, used only by the rclone-mode setup gate.
+    """
+
+    async def push(
+        self,
+        local: Path,
+        remote: str,
+        *,
+        bwlimit_kibps: int | None = None,
+        files_from: Path | None = None,
+    ) -> TransportResult: ...
+
+    async def check(
+        self, local: Path, remote: str, *, files_from: Path
+    ) -> CheckResult: ...
+
+    async def lsjson_manifest(
+        self, remote: str, *, strip_prefix: str = ""
+    ) -> RemoteManifest: ...
+
+    async def about(self, remote: str) -> AboutResult: ...
+```
+
+In `src/exlab_wizard/sync/transports/rclone.py`, add to `RcloneDriver` after `lsjson`:
+
+```python
+    async def lsjson_manifest(self, remote: str, *, strip_prefix: str = "") -> RemoteManifest:
+        """Run :meth:`lsjson` and parse it into a :class:`RemoteManifest`.
+
+        The raw-JSON wire shape is rclone-specific, so parsing lives
+        behind the driver boundary (the shared
+        :class:`~exlab_wizard.sync.transports.NasTransportDriver`
+        protocol returns manifests, never raw text).
+        """
+        from exlab_wizard.sync.manifest import parse_lsjson
+
+        raw = await self.lsjson(remote)
+        return parse_lsjson(raw, strip_prefix=strip_prefix)
+```
+
+with a `TYPE_CHECKING` import for `RemoteManifest` at the top of `rclone.py`:
+
+```python
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from exlab_wizard.sync.manifest import RemoteManifest
+```
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+Run: `uv run --extra test pytest tests/unit/sync/test_transports.py -v`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/exlab_wizard/sync/transports/ tests/unit/sync/test_transports.py
+git commit -m "feat(sync): NasTransportDriver protocol + RcloneDriver.lsjson_manifest"
+```
+
+---
+
+### Task 5: `RsyncSshDriver` — classifier, ssh args, `push`
+
+**Files:**
+- Create: `src/exlab_wizard/sync/transports/rsync_ssh.py`
+- Test: `tests/unit/sync/transports/test_rsync_ssh.py` (new)
+
+- [ ] **Step 1: Write the failing tests**
+
+Create `tests/unit/sync/transports/test_rsync_ssh.py`:
+
+```python
+"""Unit tests for the rsync-over-ssh transport driver.
+
+rsync-over-ssh NAS transport design (2026-06-10). ``run_subprocess`` is
+monkeypatched so no real binary is spawned; the docker integration leg
+covers the real wire path.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from exlab_wizard.sync.transports import TransportError, TransportErrorKind
+from exlab_wizard.sync.transports.rsync_ssh import (
+    RsyncSshDriver,
+    _classify_failure,
+)
+
+TARGET = "svc-sync@nas01:/volume1/lab/EQ1/Run_1"
+
+
+class FakeRun:
+    """Recordable stand-in for ``run_subprocess``."""
+
+    def __init__(self, rc: int = 0, stdout: str = "", stderr: str = "") -> None:
+        self.rc, self.stdout, self.stderr = rc, stdout, stderr
+        self.cmds: list[list[str]] = []
+
+    async def __call__(self, cmd: list[str]) -> tuple[int, str, str]:
+        self.cmds.append(cmd)
+        return self.rc, self.stdout, self.stderr
+
+
+@pytest.fixture
+def fake_run(monkeypatch):
+    def _install(rc: int = 0, stdout: str = "", stderr: str = "") -> FakeRun:
+        fake = FakeRun(rc, stdout, stderr)
+        monkeypatch.setattr(
+            "exlab_wizard.sync.transports.rsync_ssh.run_subprocess", fake
+        )
+        return fake
+
+    return _install
+
+
+class TestClassifyFailure:
+    @pytest.mark.parametrize(
+        "stderr",
+        [
+            "svc-sync@nas01: Permission denied (publickey,password).",
+            "Host key verification failed.",
+            "Too many authentication failures",
+        ],
+    )
+    def test_auth_markers(self, stderr: str) -> None:
+        assert _classify_failure(stderr, 255) == TransportErrorKind.AUTH
+
+    def test_ssh_failure_without_auth_marker_is_network(self) -> None:
+        assert (
+            _classify_failure("ssh: connect to host nas01: Connection refused", 255)
+            == TransportErrorKind.NETWORK
+        )
+
+    @pytest.mark.parametrize("rc", [5, 10, 12, 23, 24, 30, 35])
+    def test_protocol_and_partial_codes_are_network(self, rc: int) -> None:
+        assert _classify_failure("", rc) == TransportErrorKind.NETWORK
+
+    def test_other_nonzero_is_unknown(self) -> None:
+        assert _classify_failure("rsync: syntax error", 1) == TransportErrorKind.UNKNOWN
+
+
+class TestPush:
+    async def test_success_argv_shape(self, fake_run, tmp_path: Path) -> None:
+        run = fake_run(rc=0)
+        driver = RsyncSshDriver(ssh_port=2222, ssh_identity_file="/keys/id_exlab")
+        result = await driver.push(tmp_path, TARGET, bwlimit_kibps=512)
+        assert result.ok
+        cmd = run.cmds[0]
+        assert cmd[0] == "rsync"
+        assert "-rt" in cmd
+        assert "--bwlimit=512" in cmd
+        assert cmd[-2] == f"{tmp_path}/"
+        assert cmd[-1] == TARGET
+        ssh_arg = cmd[cmd.index("-e") + 1]
+        assert "-p 2222" in ssh_arg
+        assert "-i /keys/id_exlab" in ssh_arg
+        assert "BatchMode=yes" in ssh_arg
+
+    async def test_files_from_forwarded(self, fake_run, tmp_path: Path) -> None:
+        run = fake_run(rc=0)
+        listing = tmp_path / "files.txt"
+        listing.write_text("a.csv\n", encoding="utf-8")
+        await RsyncSshDriver().push(tmp_path, TARGET, files_from=listing)
+        assert f"--files-from={listing}" in run.cmds[0]
+
+    async def test_no_bwlimit_flag_when_unset(self, fake_run, tmp_path: Path) -> None:
+        run = fake_run(rc=0)
+        await RsyncSshDriver().push(tmp_path, TARGET)
+        assert not any(arg.startswith("--bwlimit") for arg in run.cmds[0])
+
+    async def test_auth_failure_classified(self, fake_run, tmp_path: Path) -> None:
+        fake_run(rc=255, stderr="Permission denied (publickey).")
+        result = await RsyncSshDriver().push(tmp_path, TARGET)
+        assert not result.ok
+        assert result.error_kind == TransportErrorKind.AUTH
+
+    async def test_missing_binary_raises_transport_error(
+        self, monkeypatch, tmp_path: Path
+    ) -> None:
+        async def boom(cmd):
+            raise FileNotFoundError(cmd[0])
+
+        monkeypatch.setattr(
+            "exlab_wizard.sync.transports.rsync_ssh.run_subprocess", boom
+        )
+        with pytest.raises(TransportError) as excinfo:
+            await RsyncSshDriver().push(tmp_path, TARGET)
+        assert excinfo.value.error_kind is None
+```
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `uv run --extra test pytest tests/unit/sync/transports/test_rsync_ssh.py -v`
+Expected: FAIL with `ModuleNotFoundError: ... rsync_ssh`
+
+- [ ] **Step 3: Implement the driver skeleton + push**
+
+Create `src/exlab_wizard/sync/transports/rsync_ssh.py`:
+
+```python
+"""rsync-over-ssh transport driver.
+
+rsync-over-ssh NAS transport design (2026-06-10). Mirrors
+:class:`~exlab_wizard.sync.transports.rclone.RcloneDriver`'s
+thin-wrapper philosophy: build an argv, hand it to
+:func:`~exlab_wizard.sync.transports._run.run_subprocess`, classify the
+outcome. Every op is built from rsync protocol primitives only — the
+NAS allowlists exactly the ``rsync --server`` ssh channel (no other
+remote command execution, no interactive login, no SFTP), so there is
+no ``ssh host df`` / ``find`` / ``sha256sum`` anywhere in this module.
+
+Targets are full ``user@host:/path`` strings composed by the caller
+(the same ``<remote>:<path>`` shape the rclone driver receives).
+Credentials are ssh keys only (``BatchMode=yes``); host keys are
+pre-provisioned in ``known_hosts`` via ``ssh-keyscan`` during setup.
+"""
+
+from __future__ import annotations
+
+import shlex
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+from exlab_wizard.logging import get_logger
+from exlab_wizard.sync.manifest import parse_rsync_listing
+from exlab_wizard.sync.transports import (
+    TransportError,
+    TransportErrorKind,
+    TransportResult,
+)
+from exlab_wizard.sync.transports._run import run_subprocess
+from exlab_wizard.sync.transports.rclone import AboutResult, CheckResult
+
+if TYPE_CHECKING:
+    from exlab_wizard.sync.manifest import RemoteManifest
+
+__all__ = ["RsyncSshDriver"]
+
+_log = get_logger(__name__)
+
+
+# ssh-level failures that are configuration problems, not transient
+# network errors. Matched case-insensitively against stderr.
+_AUTH_FAILURE_MARKERS: tuple[str, ...] = (
+    "permission denied",
+    "host key verification failed",
+    "too many authentication failures",
+    "no supported authentication",
+)
+
+# rsync exit codes that are transient / retryable: 5 client-server
+# protocol start, 10 socket I/O, 12 protocol data stream, 23/24 partial
+# transfer (incl. vanished source files), 30 timeout, 35 daemon-connect
+# timeout. 255 is the ssh transport itself failing.
+_NETWORK_RETURNCODES: frozenset[int] = frozenset({5, 10, 12, 23, 24, 30, 35, 255})
+
+
+def _classify_failure(stderr: str, returncode: int) -> TransportErrorKind:
+    """Map a (stderr, returncode) into a :class:`TransportErrorKind`."""
+    lowered = stderr.lower()
+    if any(marker in lowered for marker in _AUTH_FAILURE_MARKERS):
+        return TransportErrorKind.AUTH
+    if returncode in _NETWORK_RETURNCODES:
+        return TransportErrorKind.NETWORK
+    return TransportErrorKind.UNKNOWN
+
+
+class RsyncSshDriver:
+    """rsync-over-ssh transport driver (implements ``NasTransportDriver``)."""
+
+    def __init__(
+        self,
+        *,
+        binary: str = "rsync",
+        ssh_port: int = 22,
+        ssh_identity_file: str = "",
+    ) -> None:
+        self._binary = binary
+        self._ssh_port = ssh_port
+        self._ssh_identity_file = ssh_identity_file
+
+    def _ssh_command(self) -> str:
+        """Render the ``-e`` remote-shell string.
+
+        ``BatchMode=yes`` is mandatory: an unknown host key or a key
+        passphrase prompt must fail fast (classified AUTH) rather than
+        hang the sync worker. No ``StrictHostKeyChecking`` relaxation —
+        host keys are pre-provisioned via ``ssh-keyscan``.
+        """
+        parts = ["ssh", "-p", str(self._ssh_port), "-o", "BatchMode=yes"]
+        if self._ssh_identity_file:
+            parts.extend(["-i", str(Path(self._ssh_identity_file).expanduser())])
+        return shlex.join(parts)
+
+    async def push(
+        self,
+        local: Path,
+        remote: str,
+        *,
+        bwlimit_kibps: int | None = None,
+        files_from: Path | None = None,
+    ) -> TransportResult:
+        """Run ``rsync -rt`` from ``local`` to ``remote``.
+
+        ``-t`` is mandatory — the manifest reconcile tolerance and the
+        quiescence poller both depend on mtime preservation. The
+        trailing slash on the source copies the *contents* of ``local``
+        (matching ``rclone copy`` semantics). No ``--checksum`` on push:
+        integrity is owned by the verify path, not the transfer.
+        """
+        cmd: list[str] = [self._binary, "-rt", "-e", self._ssh_command()]
+        if bwlimit_kibps is not None and bwlimit_kibps > 0:
+            cmd.append(f"--bwlimit={bwlimit_kibps}")
+        if files_from is not None:
+            cmd.append(f"--files-from={files_from}")
+        cmd.extend([f"{local}/", remote])
+        _log.debug("rsync cmd: %s", shlex.join(cmd))
+
+        try:
+            rc, stdout, stderr = await run_subprocess(cmd)
+        except FileNotFoundError as exc:
+            msg = f"rsync binary not found: {self._binary!r}"
+            raise TransportError(msg) from exc
+
+        if rc == 0:
+            return TransportResult(ok=True, returncode=0, stdout=stdout, stderr=stderr)
+        kind = _classify_failure(stderr, rc)
+        _log.warning("rsync push failed rc=%d kind=%s", rc, kind.value)
+        return TransportResult(
+            ok=False, error_kind=kind, stderr=stderr, stdout=stdout, returncode=rc
+        )
+```
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+Run: `uv run --extra test pytest tests/unit/sync/transports/test_rsync_ssh.py -v`
+Expected: PASS (classifier + push tests; check/manifest/about tests come next).
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/exlab_wizard/sync/transports/rsync_ssh.py tests/unit/sync/transports/test_rsync_ssh.py
+git commit -m "feat(sync): RsyncSshDriver skeleton — classifier, ssh args, push"
+```
+
+---
+
+### Task 6: `RsyncSshDriver.check` (itemize dry-run verify)
+
+**Files:**
+- Modify: `src/exlab_wizard/sync/transports/rsync_ssh.py`
+- Test: `tests/unit/sync/transports/test_rsync_ssh.py`
+
+- [ ] **Step 1: Write the failing tests**
+
+Append to `tests/unit/sync/transports/test_rsync_ssh.py`:
+
+```python
+def _files_from(tmp_path: Path, names: list[str]) -> Path:
+    listing = tmp_path / "files-from.txt"
+    listing.write_text("".join(f"{n}\n" for n in names), encoding="utf-8")
+    return listing
+
+
+class TestCheck:
+    async def test_all_equal_when_nothing_itemized(self, fake_run, tmp_path: Path) -> None:
+        run = fake_run(rc=0, stdout="")
+        listing = _files_from(tmp_path, ["a.csv", "sub/b.csv"])
+        result = await RsyncSshDriver().check(tmp_path, TARGET, files_from=listing)
+        assert set(result.equal) == {"a.csv", "sub/b.csv"}
+        assert result.differ == () and result.missing_on_dst == ()
+        cmd = run.cmds[0]
+        assert "--checksum" in cmd
+        assert "-rni" in cmd  # dry-run + itemize
+
+    async def test_checksum_differ_flag(self, fake_run, tmp_path: Path) -> None:
+        fake_run(rc=0, stdout=">fcst...... a.csv\n")
+        listing = _files_from(tmp_path, ["a.csv", "b.csv"])
+        result = await RsyncSshDriver().check(tmp_path, TARGET, files_from=listing)
+        assert result.differ == ("a.csv",)
+        assert result.equal == ("b.csv",)
+
+    async def test_all_plus_means_missing_on_dst(self, fake_run, tmp_path: Path) -> None:
+        fake_run(rc=0, stdout=">f+++++++++ new file.csv\n")
+        listing = _files_from(tmp_path, ["new file.csv"])
+        result = await RsyncSshDriver().check(tmp_path, TARGET, files_from=listing)
+        assert result.missing_on_dst == ("new file.csv",)
+        assert result.equal == ()
+
+    async def test_short_openrsync_flags_handled(self, fake_run, tmp_path: Path) -> None:
+        # openrsync (macOS dev machines) emits 7-char itemize tails.
+        fake_run(rc=0, stdout=">f+++++++ x.csv\n")
+        listing = _files_from(tmp_path, ["x.csv"])
+        result = await RsyncSshDriver().check(tmp_path, TARGET, files_from=listing)
+        assert result.missing_on_dst == ("x.csv",)
+
+    async def test_attr_only_lines_count_as_equal(self, fake_run, tmp_path: Path) -> None:
+        # '.' update-type = no transfer needed; content equal under --checksum.
+        fake_run(rc=0, stdout=".f..t...... a.csv\n")
+        listing = _files_from(tmp_path, ["a.csv"])
+        result = await RsyncSshDriver().check(tmp_path, TARGET, files_from=listing)
+        assert result.equal == ("a.csv",)
+
+    async def test_directory_lines_ignored(self, fake_run, tmp_path: Path) -> None:
+        fake_run(rc=0, stdout="cd+++++++++ sub/\n>fcst...... sub/b.csv\n")
+        listing = _files_from(tmp_path, ["sub/b.csv"])
+        result = await RsyncSshDriver().check(tmp_path, TARGET, files_from=listing)
+        assert result.differ == ("sub/b.csv",)
+
+    async def test_nonzero_rc_raises_classified(self, fake_run, tmp_path: Path) -> None:
+        fake_run(rc=255, stderr="Permission denied (publickey).")
+        listing = _files_from(tmp_path, ["a.csv"])
+        with pytest.raises(TransportError) as excinfo:
+            await RsyncSshDriver().check(tmp_path, TARGET, files_from=listing)
+        assert excinfo.value.error_kind == TransportErrorKind.AUTH
+```
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `uv run --extra test pytest tests/unit/sync/transports/test_rsync_ssh.py -k TestCheck -v`
+Expected: FAIL with `AttributeError: ... 'check'`
+
+- [ ] **Step 3: Implement `check`**
+
+Append to `RsyncSshDriver` in `rsync_ssh.py`:
+
+```python
+    async def check(
+        self, local: Path, remote: str, *, files_from: Path
+    ) -> CheckResult:
+        """Content verify via ``rsync -rni --checksum`` dry-run (resolved OQ-1).
+
+        The remote rsync hashes whole files inside the rsync protocol
+        (the same allowlisted channel as push — no separate remote
+        command). Itemized output is synthesized into a
+        :class:`CheckResult`: checksum-differ flag → ``differ``, all-+
+        creation → ``missing_on_dst``, and ``equal`` is reconstructed as
+        the ``files_from`` list minus the itemized paths (matching files
+        are simply omitted from dry-run output). ``extra_on_dst`` is
+        always ``()`` — a push-direction dry-run cannot see remote-only
+        files; harmless, it never flips ``VerifyResult.ok``.
+
+        Raises :class:`TransportError` with a classified ``error_kind``
+        on any non-zero exit (rsync dry-runs exit 0 even when files
+        differ; non-zero means the run itself failed).
+        """
+        cmd: list[str] = [
+            self._binary,
+            "-rni",
+            "--checksum",
+            "-e",
+            self._ssh_command(),
+            f"--files-from={files_from}",
+            f"{local}/",
+            remote,
+        ]
+        _log.debug("rsync check cmd: %s", shlex.join(cmd))
+        try:
+            rc, stdout, stderr = await run_subprocess(cmd)
+        except FileNotFoundError as exc:
+            msg = f"rsync binary not found: {self._binary!r}"
+            raise TransportError(msg) from exc
+        if rc != 0:
+            kind = _classify_failure(stderr, rc)
+            msg = f"rsync check failed rc={rc} kind={kind.value}: {stderr.strip()}"
+            raise TransportError(msg, error_kind=kind)
+
+        try:
+            requested = tuple(
+                line.strip()
+                for line in files_from.read_text(encoding="utf-8").splitlines()
+                if line.strip()
+            )
+        except OSError:
+            requested = ()
+        return _synthesize_check(requested, stdout)
+```
+
+and the module-level synthesizer (after `_classify_failure`):
+
+```python
+def _synthesize_check(requested: tuple[str, ...], stdout: str) -> CheckResult:
+    """Translate dry-run itemized output into a :class:`CheckResult`.
+
+    Itemize lines are ``YXcstpoguax <path>`` — an update-type char, a
+    file-type char, then attribute flags. The attribute tail is 9 chars
+    in rsync 3.x and shorter in openrsync, so flags are read
+    positionally from the front, never by total length. Only
+    regular-file lines (``f`` at index 1) participate; ``.``-type lines
+    (no transfer needed) and unmatched lines fall through to ``equal``.
+    """
+    differ: list[str] = []
+    missing: list[str] = []
+    flagged: set[str] = set()
+    for raw_line in stdout.splitlines():
+        line = raw_line.rstrip()
+        flags, sep, path = line.partition(" ")
+        path = path.strip()
+        if not sep or not path or len(flags) < 3:
+            continue
+        if flags[0] not in "<>ch." or flags[1] != "f":
+            continue
+        tail = flags[2:]
+        if tail and all(ch == "+" for ch in tail):
+            missing.append(path)
+            flagged.add(path)
+        elif flags[2] == "c":
+            differ.append(path)
+            flagged.add(path)
+        # any other combination (e.g. ``.f..t......``) is an attr-only
+        # change: content equal under --checksum -> credited via `equal`.
+    equal = tuple(rel for rel in requested if rel not in flagged)
+    return CheckResult(
+        equal=equal, differ=tuple(differ), missing_on_dst=tuple(missing)
+    )
+```
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+Run: `uv run --extra test pytest tests/unit/sync/transports/test_rsync_ssh.py -v`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/exlab_wizard/sync/transports/rsync_ssh.py tests/unit/sync/transports/test_rsync_ssh.py
+git commit -m "feat(sync): RsyncSshDriver.check via --checksum dry-run itemize"
+```
+
+---
+
+### Task 7: `RsyncSshDriver.lsjson_manifest` + `about`
+
+**Files:**
+- Modify: `src/exlab_wizard/sync/transports/rsync_ssh.py`
+- Test: `tests/unit/sync/transports/test_rsync_ssh.py`
+
+- [ ] **Step 1: Write the failing tests**
+
+Append:
+
+```python
+class TestLsjsonManifest:
+    async def test_listing_parsed_and_prefix_ignored(self, fake_run, tmp_path: Path) -> None:
+        from datetime import datetime
+
+        stamp = datetime.fromtimestamp(1_750_000_000).strftime("%Y/%m/%d %H:%M:%S")
+        run = fake_run(
+            rc=0,
+            stdout=(
+                f"drwxr-xr-x          4096 {stamp} .\n"
+                f"-rw-r--r--          2048 {stamp} data file.csv\n"
+            ),
+        )
+        manifest = await RsyncSshDriver().lsjson_manifest(
+            TARGET, strip_prefix="volume1/lab/EQ1/Run_1"
+        )
+        assert set(manifest.entries) == {"data file.csv"}
+        cmd = run.cmds[0]
+        assert "--list-only" in cmd and "-r" in cmd and "--no-h" in cmd
+        assert cmd[-1] == f"{TARGET}/"
+
+    async def test_failure_raises_classified(self, fake_run) -> None:
+        fake_run(rc=255, stderr="ssh: connect to host nas01: Connection refused")
+        with pytest.raises(TransportError) as excinfo:
+            await RsyncSshDriver().lsjson_manifest(TARGET)
+        assert excinfo.value.error_kind == TransportErrorKind.NETWORK
+
+
+class TestAbout:
+    async def test_reachable_returns_ok_empty_info(self, fake_run) -> None:
+        run = fake_run(rc=0, stdout="drwxr-xr-x 4096 2026/06/10 00:00:00 .\n")
+        result = await RsyncSshDriver().about("svc-sync@nas01:/volume1/lab")
+        assert result.ok and result.info == {}
+        assert "-r" not in run.cmds[0]  # non-recursive probe
+
+    async def test_missing_base_root_is_config_reason(self, fake_run) -> None:
+        fake_run(rc=23, stdout="", stderr='rsync: change_dir "/volume1/lab" failed')
+        result = await RsyncSshDriver().about("svc-sync@nas01:/volume1/lab")
+        assert not result.ok
+        assert result.reason is not None
+        assert "base_root" in result.reason
+
+    async def test_auth_failure_reason(self, fake_run) -> None:
+        fake_run(rc=255, stderr="Permission denied (publickey).")
+        result = await RsyncSshDriver().about("svc-sync@nas01:/volume1/lab")
+        assert not result.ok
+        assert result.reason is not None and result.reason.startswith("auth")
+
+    async def test_missing_binary_reason(self, monkeypatch) -> None:
+        async def boom(cmd):
+            raise FileNotFoundError(cmd[0])
+
+        monkeypatch.setattr(
+            "exlab_wizard.sync.transports.rsync_ssh.run_subprocess", boom
+        )
+        result = await RsyncSshDriver().about("svc-sync@nas01:/volume1/lab")
+        assert not result.ok and result.reason == "rsync binary not found"
+```
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `uv run --extra test pytest tests/unit/sync/transports/test_rsync_ssh.py -k "TestLsjsonManifest or TestAbout" -v`
+Expected: FAIL with `AttributeError`.
+
+- [ ] **Step 3: Implement**
+
+Append to `RsyncSshDriver`:
+
+```python
+    async def lsjson_manifest(
+        self, remote: str, *, strip_prefix: str = ""
+    ) -> RemoteManifest:
+        """List the remote subtree via ``--list-only -r`` (resolved OQ-2).
+
+        ``strip_prefix`` is accepted for protocol parity but ignored —
+        rsync listings are already relative to the listed target (the
+        rclone lsjson path is run-rooted and needs stripping; this one
+        is not). Raises :class:`TransportError` with a classified
+        ``error_kind`` on non-zero exit, mirroring
+        :meth:`RcloneDriver.lsjson`.
+        """
+        del strip_prefix
+        cmd: list[str] = [
+            self._binary,
+            "--list-only",
+            "-r",
+            "--no-h",
+            "-e",
+            self._ssh_command(),
+            f"{remote}/",
+        ]
+        _log.debug("rsync list cmd: %s", shlex.join(cmd))
+        try:
+            rc, stdout, stderr = await run_subprocess(cmd)
+        except FileNotFoundError as exc:
+            msg = f"rsync binary not found: {self._binary!r}"
+            raise TransportError(msg) from exc
+        if rc != 0:
+            kind = _classify_failure(stderr, rc)
+            msg = f"rsync list failed rc={rc} kind={kind.value}: {stderr.strip()}"
+            raise TransportError(msg, error_kind=kind)
+        return parse_rsync_listing(stdout)
+
+    async def about(self, remote: str) -> AboutResult:
+        """Reachability + auth probe: non-recursive ``--list-only`` of ``remote``.
+
+        Free-space info is unobtainable without remote command exec
+        (which IT blocks), so ``info`` is always empty — the Settings
+        panel already tolerates that (resolved OQ-5). rc 23 with no
+        listing output means the path itself is absent: surfaced as a
+        configuration reason, not a retryable network error
+        (spec-review carve-out).
+        """
+        cmd: list[str] = [
+            self._binary,
+            "--list-only",
+            "--no-h",
+            "-e",
+            self._ssh_command(),
+            f"{remote}/",
+        ]
+        _log.debug("rsync about cmd: %s", shlex.join(cmd))
+        try:
+            rc, stdout, stderr = await run_subprocess(cmd)
+        except FileNotFoundError:
+            return AboutResult(ok=False, reason="rsync binary not found")
+        if rc == 0:
+            return AboutResult(ok=True, info={})
+        if rc == 23 and not stdout.strip():
+            return AboutResult(
+                ok=False, reason="base_root not found or inaccessible on the NAS"
+            )
+        kind = _classify_failure(stderr, rc)
+        return AboutResult(ok=False, reason=f"{kind.value}: {stderr.strip()}")
+```
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+Run: `uv run --extra test pytest tests/unit/sync/transports/test_rsync_ssh.py -v`
+Expected: PASS (whole module). Then lint: `uvx ruff check src/exlab_wizard/sync/transports/rsync_ssh.py` — fix anything it flags.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/exlab_wizard/sync/transports/rsync_ssh.py tests/unit/sync/transports/test_rsync_ssh.py
+git commit -m "feat(sync): RsyncSshDriver listing manifest + reachability probe"
+```
+
+---
+
+### Task 8: `build_nas_driver` factory
+
+**Files:**
+- Modify: `src/exlab_wizard/sync/transports/__init__.py`
+- Test: `tests/unit/sync/test_transports.py`
+
+- [ ] **Step 1: Write the failing tests**
+
+Add to `tests/unit/sync/test_transports.py`:
+
+```python
+class TestBuildNasDriver:
+    def test_rclone_default(self) -> None:
+        from exlab_wizard.config.models import NasConfig, RclonePerf
+        from exlab_wizard.sync.transports import build_nas_driver
+        from exlab_wizard.sync.transports.rclone import RcloneDriver
+
+        driver = build_nas_driver(NasConfig(remote="nas01"), RclonePerf())
+        assert isinstance(driver, RcloneDriver)
+
+    def test_rsync_ssh_selected(self) -> None:
+        from exlab_wizard.config.models import NasConfig, RclonePerf
+        from exlab_wizard.sync.transports import build_nas_driver
+        from exlab_wizard.sync.transports.rsync_ssh import RsyncSshDriver
+
+        nas = NasConfig(
+            transport="rsync_ssh",
+            remote="svc-sync@nas01",
+            ssh_port=2222,
+            ssh_identity_file="~/.ssh/id_exlab",
+        )
+        driver = build_nas_driver(nas, RclonePerf())
+        assert isinstance(driver, RsyncSshDriver)
+        assert driver._ssh_port == 2222
+```
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `uv run --extra test pytest tests/unit/sync/test_transports.py -k TestBuildNasDriver -v`
+Expected: FAIL with `ImportError: cannot import name 'build_nas_driver'`
+
+- [ ] **Step 3: Implement the factory**
+
+In `src/exlab_wizard/sync/transports/__init__.py`: add `"build_nas_driver",` to `__all__`, extend the `TYPE_CHECKING` block with `from exlab_wizard.config.models import NasConfig, RclonePerf`, and append:
+
+```python
+def build_nas_driver(nas: NasConfig, perf: RclonePerf) -> NasTransportDriver:
+    """Construct the NAS transport driver selected by ``nas.transport``.
+
+    The single factory every construction site routes through
+    (``nas_client``, the tray probe/gate hydration, test helpers).
+    Imports are local so importing this package stays cheap and free of
+    cycles (the driver modules import this package's DTOs).
+
+    NOTE: this selects for **nas-mode** equipment only. Stage-mode
+    equipment always uses a directly-constructed ``RcloneDriver`` (its
+    targets are rclone named remotes) — see
+    ``NASSyncClient._driver_for_equipment``.
+    """
+    from exlab_wizard.constants import SyncTransport
+
+    if nas.transport == SyncTransport.RSYNC_SSH:
+        from exlab_wizard.sync.transports.rsync_ssh import RsyncSshDriver
+
+        return RsyncSshDriver(
+            ssh_port=nas.ssh_port,
+            ssh_identity_file=nas.ssh_identity_file,
+        )
+    from exlab_wizard.sync.transports.rclone import RcloneDriver
+
+    return RcloneDriver(
+        config_path=nas.rclone_config_path or None,
+        transfers=perf.transfers,
+        checkers=perf.checkers,
+    )
+```
+
+- [ ] **Step 4: Run tests + verify no stray constructions**
+
+Run: `uv run --extra test pytest tests/unit/sync/test_transports.py -v` — Expected: PASS.
+Run: `grep -rn "RcloneDriver(\|RsyncSshDriver(" src/exlab_wizard | grep -v "sync/transports/"` — Expected (for now): hits in `nas_client.py` and `tray/dependencies.py` only; Tasks 9 and 11 remove them.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/exlab_wizard/sync/transports/__init__.py tests/unit/sync/test_transports.py
+git commit -m "feat(sync): build_nas_driver transport factory"
+```
+
+---
+
+### Task 9: `NASSyncClient` wiring (factory + stage-mode bypass + manifest op)
+
+**Files:**
+- Modify: `src/exlab_wizard/sync/nas_client.py` (imports ~lines 44-57; delete `_build_driver` ~line 132; `_driver_for_equipment` ~line 729; `_build_lsjson` ~line 786)
+- Test: `tests/unit/sync/test_nas_client.py`
+
+- [ ] **Step 1: Write the failing tests**
+
+Add to `tests/unit/sync/test_nas_client.py` (it already imports `Config`, `EquipmentConfig`, `NasConfig`, `OrchestratorConfig`, `PathsConfig`, `SyncMode`, and constructs `NASSyncClient` — follow `_client_for_target_test` at ~line 774 for the constructor shape):
+
+```python
+class TestDriverSelection:
+    # _client_for_target_test (defined ~line 774 of this module) already
+    # builds a NASSyncClient from a bare Config — reuse it.
+
+    def test_nas_mode_rsync_transport_selected(self, tmp_path: Path) -> None:
+        from exlab_wizard.sync.transports.rsync_ssh import RsyncSshDriver
+
+        config = Config(
+            paths=PathsConfig(app_root=str(tmp_path)),
+            nas=NasConfig(
+                transport="rsync_ssh", remote="svc-sync@nas01", base_root="/volume1/lab"
+            ),
+            equipment=[EquipmentConfig(id="EQ1", label="Eq 1", nas_root="/nas")],
+        )
+        client = _client_for_target_test(config, tmp_path)
+        driver = client._driver_for_equipment(config.equipment[0])
+        assert isinstance(driver, RsyncSshDriver)
+
+    def test_stage_mode_always_rclone_even_with_rsync_transport(
+        self, tmp_path: Path
+    ) -> None:
+        from exlab_wizard.sync.transports.rclone import RcloneDriver
+
+        config = Config(
+            paths=PathsConfig(app_root=str(tmp_path)),
+            nas=NasConfig(
+                transport="rsync_ssh", remote="svc-sync@nas01", base_root="/volume1/lab"
+            ),
+            orchestrator=OrchestratorConfig(
+                label="WS1", staging_remote="stagepc", staging_base_root="/staging"
+            ),
+            equipment=[
+                EquipmentConfig(
+                    id="EQ1", label="Eq 1", nas_root="/nas", sync_mode=SyncMode.STAGE
+                )
+            ],
+        )
+        client = _client_for_target_test(config, tmp_path)
+        driver = client._driver_for_equipment(config.equipment[0])
+        assert isinstance(driver, RcloneDriver)
+```
+
+(If `OrchestratorConfig` requires other fields for stage mode, follow the existing stage-mode test at ~line 785 of the same file for the exact constructor arguments.)
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `uv run --extra test pytest tests/unit/sync/test_nas_client.py -k TestDriverSelection -v`
+Expected: FAIL — `test_nas_mode_rsync_transport_selected` gets an `RcloneDriver`.
+
+- [ ] **Step 3: Rewire the client**
+
+In `src/exlab_wizard/sync/nas_client.py`:
+
+1. Imports: change `from exlab_wizard.sync.manifest import RemoteManifest, parse_lsjson` → `from exlab_wizard.sync.manifest import RemoteManifest`; change the transports import block to:
+
+```python
+from exlab_wizard.sync.transports import (
+    NasTransportDriver,
+    TransportError,
+    TransportErrorKind,
+    TransportResult,
+    build_nas_driver,
+)
+from exlab_wizard.sync.transports.rclone import RcloneDriver
+```
+
+2. Delete the module-level `_build_driver` function (~lines 132-150) entirely. Run `grep -rn "_build_driver" src tests` — update/remove any other references (expected: none outside `nas_client.py`).
+
+3. Replace `_driver_for_equipment` (~line 729):
+
+```python
+    def _driver_for_equipment(self, equipment: EquipmentConfig) -> NasTransportDriver:
+        """Build the transport driver for ``equipment``.
+
+        ``nas.transport`` selects the driver **only for nas-mode
+        equipment**. Stage-mode targets are rclone named-remote strings
+        (``<staging_remote>:<path>``), so stage-mode always gets a
+        directly-constructed :class:`RcloneDriver` regardless of
+        ``nas.transport`` — handing an rsync driver a staging target
+        would attempt ssh to a host named after the staging remote
+        (spec-review blocker, 2026-06-10). The hidden staging backend
+        must keep working (see CLAUDE.md).
+        """
+        resolution = self._resolve_remote(equipment)
+        if equipment.sync_mode == SyncMode.STAGE:
+            return RcloneDriver(
+                config_path=self._config.nas.rclone_config_path or None,
+                transfers=resolution.perf.transfers,
+                checkers=resolution.perf.checkers,
+            )
+        return build_nas_driver(self._config.nas, resolution.perf)
+```
+
+4. In `_build_lsjson` (~line 786), replace the closure body:
+
+```python
+        async def _lsjson(run: Path) -> RemoteManifest:
+            target = self._target_for_equipment(equipment, run)
+            prefix = _remote_subpath(base_root, equipment.id, run)
+            return await driver.lsjson_manifest(target, strip_prefix=prefix)
+```
+
+(the surrounding factory-injection guard and `base_root` capture are unchanged).
+
+- [ ] **Step 4: Run the sync suites (one at a time — they flake under CPU load)**
+
+```
+uv run --extra test pytest tests/unit/sync/test_nas_client.py -v
+uv run --extra test pytest tests/unit/sync/test_nas_client_extra.py -v
+uv run --extra test pytest tests/unit/sync/test_nas_client_stability.py -v
+uv run --extra test pytest tests/unit/sync/test_transports.py tests/unit/sync/test_manifest.py -v
+```
+Expected: all PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/exlab_wizard/sync/nas_client.py tests/unit/sync/test_nas_client.py
+git commit -m "feat(sync): route NASSyncClient through build_nas_driver with stage-mode rclone bypass"
+```
+
+---
+
+### Task 10: `Verifier` protocol typing
+
+**Files:**
+- Modify: `src/exlab_wizard/sync/verifier.py` (~lines 33-34, 93-107)
+
+- [ ] **Step 1: Make the change** (no construction sites exist for `Verifier()` — verified during spec review — so this is a typing-only change covered by the existing suite)
+
+In `verifier.py`: change the `TYPE_CHECKING` import to:
+
+```python
+if TYPE_CHECKING:
+    from exlab_wizard.sync.transports import NasTransportDriver
+    from exlab_wizard.sync.transports.rclone import CheckResult
+```
+
+and replace `Verifier.__init__`:
+
+```python
+    def __init__(self, driver: NasTransportDriver) -> None:
+        self._driver = driver
+```
+
+Update the class docstring's first line to "Constructed with a :class:`NasTransportDriver`; …" and delete the no-arg default branch. Update the module docstring's first sentence to note the verifier wraps the transport's ``check`` op (rclone `check --download` or the rsync `--checksum` dry-run).
+
+- [ ] **Step 2: Verify**
+
+Run: `uv run --extra test pytest tests/unit/sync/ -v --ignore=tests/unit/sync/test_nas_client.py --ignore=tests/unit/sync/test_nas_client_extra.py --ignore=tests/unit/sync/test_nas_client_stability.py`
+Expected: PASS. Then `grep -rn "Verifier(" src tests | grep -v "def \|class "` — expected: no no-arg constructions.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add src/exlab_wizard/sync/verifier.py
+git commit -m "refactor(sync): Verifier takes NasTransportDriver, drop vestigial no-arg default"
+```
+
+---
+
+### Task 11: tray gate hydration + Test-connection probe
+
+**Files:**
+- Modify: `src/exlab_wizard/tray/dependencies.py` (~lines 148-149, 622-679)
+- Test: `tests/unit/tray/test_dependencies.py`
+
+- [ ] **Step 1: Write the failing tests**
+
+Add to `tests/unit/tray/test_dependencies.py` (follow the module's existing config-stub pattern; if it builds real `Config` objects, reuse that, otherwise these `SimpleNamespace` stubs match the `getattr`-based access):
+
+```python
+class TestRsyncSshGate:
+    def _nas(self, **kw):
+        from exlab_wizard.config.models import NasConfig
+
+        return NasConfig(
+            transport="rsync_ssh", remote="svc-sync@nas01", base_root="/v1/lab", **kw
+        )
+
+    def test_hydrate_never_spawns_rclone_in_rsync_mode(self, monkeypatch) -> None:
+        from types import SimpleNamespace
+
+        from exlab_wizard.tray.dependencies import _hydrate_nas_remotes
+
+        def boom(*a, **k):
+            raise AssertionError("rclone must not be constructed in rsync mode")
+
+        monkeypatch.setattr(
+            "exlab_wizard.sync.transports.rclone.RcloneDriver", boom
+        )
+        config = SimpleNamespace(nas=self._nas())
+        assert _hydrate_nas_remotes(config) == ()
+
+    def test_predicate_true_when_identity_unset(self) -> None:
+        from types import SimpleNamespace
+
+        from exlab_wizard.tray.dependencies import _nas_available_predicate
+
+        config = SimpleNamespace(nas=self._nas())
+        predicate = _nas_available_predicate(config, ())
+        assert predicate("svc-sync@nas01") is True
+
+    def test_predicate_false_when_identity_missing(self, tmp_path) -> None:
+        from types import SimpleNamespace
+
+        from exlab_wizard.tray.dependencies import _nas_available_predicate
+
+        config = SimpleNamespace(
+            nas=self._nas(ssh_identity_file=str(tmp_path / "nope_key"))
+        )
+        predicate = _nas_available_predicate(config, ())
+        assert predicate("svc-sync@nas01") is False
+
+    def test_predicate_true_when_identity_exists(self, tmp_path) -> None:
+        from types import SimpleNamespace
+
+        from exlab_wizard.tray.dependencies import _nas_available_predicate
+
+        key = tmp_path / "id_exlab"
+        key.write_text("KEY", encoding="utf-8")
+        config = SimpleNamespace(nas=self._nas(ssh_identity_file=str(key)))
+        assert _nas_available_predicate(config, ())("svc-sync@nas01") is True
+
+    def test_rclone_predicate_unchanged(self) -> None:
+        from types import SimpleNamespace
+
+        from exlab_wizard.config.models import NasConfig
+        from exlab_wizard.tray.dependencies import _nas_available_predicate
+
+        config = SimpleNamespace(nas=NasConfig(remote="nas01"))
+        predicate = _nas_available_predicate(config, ("nas01:",))
+        assert predicate("nas01") is True
+        assert predicate("other") is False
+```
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `uv run --extra test pytest tests/unit/tray/test_dependencies.py -k TestRsyncSshGate -v`
+Expected: FAIL with `ImportError: cannot import name '_nas_available_predicate'`
+
+- [ ] **Step 3: Implement**
+
+In `src/exlab_wizard/tray/dependencies.py`:
+
+1. `_hydrate_nas_remotes` (~line 622) — insert the rsync bypass after the `nas is None` guard:
+
+```python
+    from exlab_wizard.constants import SyncTransport
+
+    if getattr(nas, "transport", SyncTransport.RCLONE) == SyncTransport.RSYNC_SSH:
+        # rsync-over-ssh transport (2026-06-10): rclone.conf is irrelevant
+        # and the rclone binary is likely absent on a cluster node — never
+        # spawn it; the gate uses the static ssh predicate instead.
+        return ()
+```
+
+2. Add the predicate helper directly below `_hydrate_nas_remotes`:
+
+```python
+def _nas_available_predicate(config: Any, remotes: tuple[str, ...]) -> Any:
+    """Build the setup-gate ``nas_remote_available`` callable by transport.
+
+    rclone mode keeps the historical "name present in the listremotes
+    snapshot" check. rsync_ssh mode is a static, offline predicate:
+    remote non-empty, and when ``ssh_identity_file`` is set the file
+    must exist. Network reachability stays behind Test-connection.
+    """
+    from exlab_wizard.constants import SyncTransport
+
+    nas = getattr(config, "nas", None)
+    if nas is not None and getattr(nas, "transport", None) == SyncTransport.RSYNC_SSH:
+
+        def _rsync_available(remote: str) -> bool:
+            if not remote:
+                return False
+            identity = str(getattr(nas, "ssh_identity_file", "") or "")
+            if identity and not Path(identity).expanduser().exists():
+                return False
+            return True
+
+        return _rsync_available
+    return lambda remote: f"{remote}:" in remotes
+```
+
+3. Replace the hydration line ~149 (`deps.nas_remote_available = lambda remote: f"{remote}:" in deps.nas_remotes`) with:
+
+```python
+    deps.nas_remote_available = _nas_available_predicate(deps.config, deps.nas_remotes)
+```
+
+4. In `_make_equipment_probe` (~line 659), replace the driver construction and the `about` call:
+
+```python
+        from exlab_wizard.sync.transports import build_nas_driver
+
+        driver = build_nas_driver(nas, nas.perf)
+        target = _probe_target(nas)
+        started = time.monotonic()
+        try:
+            about = await driver.about(target)
+```
+
+and add the target helper below `_nas_available_predicate`:
+
+```python
+def _probe_target(nas: Any) -> str:
+    """Compose the Test-connection probe target by transport.
+
+    rclone probes the bare remote root (``<remote>:``); rsync probes the
+    base root (``user@host:/<base_root>``) so a missing/locked path
+    surfaces as the configuration error it is.
+    """
+    from exlab_wizard.constants import SyncTransport
+
+    if getattr(nas, "transport", None) == SyncTransport.RSYNC_SSH:
+        base = str(getattr(nas, "base_root", "") or "").strip("/")
+        return f"{nas.remote}:/{base}" if base else f"{nas.remote}:/"
+    return f"{nas.remote}:"
+```
+
+Confirm `Path` is already imported at the top of `dependencies.py` (it is — `from pathlib import Path` per `state_dir` handling); add it if not. Update `_make_equipment_probe`'s docstring to mention both transports.
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+Run: `uv run --extra test pytest tests/unit/tray/test_dependencies.py -v`
+Expected: PASS (new class + all pre-existing probe/hydration tests — the rclone path is behavior-identical).
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/exlab_wizard/tray/dependencies.py tests/unit/tray/test_dependencies.py
+git commit -m "feat(tray): transport-aware NAS setup gate + Test-connection probe"
+```
+
+---
+
+### Task 12: `paths._missing_nas_fields` transport branch
+
+**Files:**
+- Modify: `src/exlab_wizard/paths.py` (~line 699)
+- Test: `tests/unit/test_paths.py`
+
+- [ ] **Step 1: Write the failing test**
+
+Add to `tests/unit/test_paths.py` (reuse the module's existing minimal-config builder for `INCOMPLETE_NO_NAS_REMOTE` cases; the assertions below are the contract):
+
+```python
+def test_missing_nas_fields_rsync_mode_names_identity_file() -> None:
+    from exlab_wizard.config.models import Config, EquipmentConfig, NasConfig, PathsConfig
+    from exlab_wizard.constants import SetupState
+    from exlab_wizard.paths import setup_state_missing
+
+    config = Config(
+        paths=PathsConfig(app_root="/tmp/x"),
+        nas=NasConfig(transport="rsync_ssh", remote="svc-sync@nas01"),
+        equipment=[EquipmentConfig(id="EQ1", label="Eq 1", nas_root="/nas")],
+    )
+    rows = setup_state_missing(SetupState.INCOMPLETE_NO_NAS_REMOTE, config)
+    assert rows == [
+        {"field": "nas.ssh_identity_file", "reason": "identity_file_missing"}
+    ]
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `uv run --extra test pytest tests/unit/test_paths.py -k identity_file -v`
+Expected: FAIL (reason is `not_found_in_rclone_conf`).
+
+- [ ] **Step 3: Implement**
+
+Replace `_missing_nas_fields` in `paths.py`:
+
+```python
+def _missing_nas_fields(config: Config | None) -> list[dict[str, str]]:
+    """Missing-field row(s) for ``INCOMPLETE_NO_NAS_REMOTE``.
+
+    Distinguishes an unset ``nas.remote`` (shared by both transports)
+    from the per-transport "configured but unavailable" reasons: the
+    named remote absent from rclone.conf, or (rsync_ssh) the pinned
+    ssh identity file not found on disk.
+    """
+    if config is None or not config.nas.remote:
+        return [{"field": "nas.remote", "reason": "unset"}]
+    from exlab_wizard.constants import SyncTransport
+
+    if config.nas.transport == SyncTransport.RSYNC_SSH:
+        return [
+            {"field": "nas.ssh_identity_file", "reason": "identity_file_missing"}
+        ]
+    return [{"field": "nas.remote", "reason": "not_found_in_rclone_conf"}]
+```
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+Run: `uv run --extra test pytest tests/unit/test_paths.py -v`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/exlab_wizard/paths.py tests/unit/test_paths.py
+git commit -m "feat(paths): rsync-mode missing-field reason for the NAS setup gate"
+```
+
+---
+
+### Task 13: UI — Settings NAS-Remote section + main-page banner copy
+
+**Files:**
+- Modify: `src/exlab_wizard/ui/pages/settings.py` (NAS-remote section, ~lines 780-845)
+- Modify: `src/exlab_wizard/ui/pages/main.py` (~line 172)
+- Test: `tests/unit/ui/test_settings_nas_remote.py`
+
+- [ ] **Step 1: Write the failing tests**
+
+Add to `tests/unit/ui/test_settings_nas_remote.py`, following that module's existing render-and-query pattern for the section under test (it already renders the section with a `NasConfig`-like stub and asserts on `data-testid` labels — mirror the closest existing test for setup):
+
+```python
+def test_rsync_mode_shows_transport_row_and_ssh_badge(...existing fixture args...):
+    # nas stub: transport="rsync_ssh", remote="svc-sync@nas01",
+    # base_root="/volume1/lab"; nas_remote_available returns True.
+    # Assert: a label with data-testid="settings-nas-transport" exists with
+    # text "rsync over ssh"; the status badge text is "ssh access configured".
+    ...
+
+
+def test_rsync_mode_identity_missing_badge(...existing fixture args...):
+    # Same stub but nas_remote_available returns False.
+    # Assert badge text == "Identity file missing — see setup docs".
+    ...
+
+
+def test_rclone_mode_badges_unchanged(...existing fixture args...):
+    # transport absent/"rclone": badge stays "Found in rclone.conf" /
+    # "Not found — run `rclone config`" (regression pin).
+    ...
+```
+
+Write these as real tests by copying the closest existing test in the module and changing the stub + assertions — the module's helpers dictate the exact render mechanics.
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `uv run --extra test pytest tests/unit/ui/test_settings_nas_remote.py -v`
+Expected: new tests FAIL (no transport row; rclone badge text rendered).
+
+- [ ] **Step 3: Implement the section branch**
+
+In `settings.py`'s NAS-remote section function, after `base_root = ...`:
+
+```python
+    transport = str(getattr(nas, "transport", "") or "rclone")
+    rsync_mode = transport == "rsync_ssh"
+```
+
+Replace the static description label text with:
+
+```python
+        description = (
+            "NAS sync uses rsync over ssh: `remote` is the user@host target, "
+            "authenticated by your ssh key (no password is stored here). "
+            "See the setup docs for key + known_hosts provisioning."
+            if rsync_mode
+            else "NAS sync references a single rclone remote configured in your "
+            "rclone.conf (run `rclone config` to create it). No password is "
+            "stored here."
+        )
+        ui.label(description).style(
+            "font-size: var(--text-sm); color: var(--color-muted);"
+        )
+```
+
+After the Base-root row, add a Transport row:
+
+```python
+        with ui.row().classes("items-center w-full").style("gap: 0.5rem;"):
+            ui.label("Transport").style("color: var(--color-body); min-width: 6rem;")
+            ui.label("rsync over ssh" if rsync_mode else "rclone").props(
+                'data-testid="settings-nas-transport"'
+            ).style("font-family: var(--font-mono);")
+```
+
+Replace the badge branch:
+
+```python
+        if rsync_mode:
+            badge_text = (
+                "ssh access configured"
+                if available
+                else "Identity file missing — see setup docs"
+            )
+        else:
+            badge_text = (
+                "Found in rclone.conf" if available else "Not found — run `rclone config`"
+            )
+        badge_color = "var(--color-success)" if available else "var(--color-warning)"
+```
+
+In `main.py` ~line 172, change the banner subline value:
+
+```python
+        "configure_rclone_remote": ("Configure the NAS connection (see setup docs) to begin."),
+```
+
+Then run `grep -rn "Configure the rclone remote" src tests` and update every assertion site (expect hits in `tests/unit/ui/test_pages.py` and possibly `tests/e2e/ux_catalog.py`; if the e2e UX doc is generated, regenerate it the way commit `c8c3349` did — check `git show c8c3349 --stat` for the command/files).
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+```
+uv run --extra test pytest tests/unit/ui/test_settings_nas_remote.py -v
+uv run --extra test pytest tests/unit/ui/test_pages.py tests/unit/ui/test_mount.py -v
+```
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/exlab_wizard/ui/ tests/unit/ui/ tests/e2e/
+git commit -m "feat(ui): transport-aware NAS-remote settings section + banner copy"
+```
+
+---
+
+### Task 14: `stub_rsync` fixture + driver-against-stub test
+
+**Files:**
+- Create: `tests/fixtures/stub_rsync.py`
+- Test: `tests/unit/sync/transports/test_rsync_ssh.py` (append)
+
+- [ ] **Step 1: Create the stub**
+
+Create `tests/fixtures/stub_rsync.py` (sibling of `stub_rclone.py`; same env-selected-behavior pattern):
+
+```python
+#!/usr/bin/env python3
+"""Stub ``rsync`` binary for tests.
+
+rsync-over-ssh NAS transport (2026-06-10). Behaviors are selected via
+``STUB_RSYNC_BEHAVIOR``:
+
+- ``success`` (default): push copies the ``--files-from`` subset (or the
+  whole source tree) into ``STUB_RSYNC_DEST_ROOT/<remote-path>``;
+  ``--list-only`` emits a real listing of that subtree; ``-n`` dry-runs
+  emit nothing (all equal).
+- ``network_error`` — "Connection refused" on stderr, exit 255.
+- ``auth_error`` — "Permission denied (publickey)." on stderr, exit 255.
+- ``check_differ`` — dry-run itemizes every files-from entry as
+  ``>fcst...... <path>``.
+- ``check_missing`` — dry-run itemizes every entry as ``>f+++++++++ <path>``.
+
+``STUB_RSYNC_RECORD_PATH`` appends one JSON line of argv per invocation.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import shutil
+import sys
+from datetime import datetime
+from pathlib import Path
+
+
+def _flag_value(argv: list[str], prefix: str) -> str | None:
+    for arg in argv:
+        if arg.startswith(prefix + "="):
+            return arg.split("=", 1)[1]
+    return None
+
+
+def _positional(argv: list[str]) -> list[str]:
+    out: list[str] = []
+    skip_next = False
+    for arg in argv[1:]:
+        if skip_next:
+            skip_next = False
+            continue
+        if arg == "-e":
+            skip_next = True
+            continue
+        if arg.startswith("-"):
+            continue
+        out.append(arg)
+    return out
+
+
+def _files_from_paths(argv: list[str]) -> list[str]:
+    listing = _flag_value(argv, "--files-from")
+    if listing is None:
+        return []
+    try:
+        return [
+            line.strip()
+            for line in Path(listing).read_text(encoding="utf-8").splitlines()
+            if line.strip()
+        ]
+    except OSError:
+        return []
+
+
+def _remote_path(spec: str) -> str:
+    # "user@host:/path" -> "/path"
+    return spec.split(":", 1)[1] if ":" in spec else spec
+
+
+def main() -> int:
+    argv = sys.argv
+    record = os.environ.get("STUB_RSYNC_RECORD_PATH")
+    if record:
+        with open(record, "a") as f:
+            f.write(json.dumps(argv) + "\n")
+
+    behavior = os.environ.get("STUB_RSYNC_BEHAVIOR", "success")
+    dest_root = os.environ.get("STUB_RSYNC_DEST_ROOT", "")
+
+    if behavior == "network_error":
+        sys.stderr.write("ssh: connect to host nas01: Connection refused\n")
+        return 255
+    if behavior == "auth_error":
+        sys.stderr.write("Permission denied (publickey).\n")
+        return 255
+
+    positional = _positional(argv)
+
+    # ---- list-only --------------------------------------------------------
+    if "--list-only" in argv:
+        target = _remote_path(positional[-1]).rstrip("/")
+        root = Path(dest_root) / target.lstrip("/")
+        if not root.is_dir():
+            sys.stderr.write(f'rsync: change_dir "{target}" failed\n')
+            return 23
+        recursive = "-r" in argv
+        paths = sorted(root.rglob("*")) if recursive else sorted(root.iterdir())
+        for path in [root, *paths]:
+            st = path.stat()
+            stamp = datetime.fromtimestamp(st.st_mtime).strftime("%Y/%m/%d %H:%M:%S")
+            rel = "." if path == root else path.relative_to(root).as_posix()
+            kind = "d" if path.is_dir() else "-"
+            sys.stdout.write(f"{kind}rw-r--r-- {st.st_size:>14,} {stamp} {rel}\n")
+        return 0
+
+    # ---- dry-run check ----------------------------------------------------
+    if "-n" in argv or any("n" in a for a in argv if a.startswith("-") and "=" not in a):
+        rels = _files_from_paths(argv)
+        if behavior == "check_differ":
+            for rel in rels:
+                sys.stdout.write(f">fcst...... {rel}\n")
+        elif behavior == "check_missing":
+            for rel in rels:
+                sys.stdout.write(f">f+++++++++ {rel}\n")
+        return 0
+
+    # ---- push -------------------------------------------------------------
+    if len(positional) < 2:
+        sys.stderr.write(f"stub_rsync: unexpected argv {argv!r}\n")
+        return 1
+    src = Path(positional[-2].rstrip("/"))
+    if not dest_root:
+        return 0
+    dst = Path(dest_root) / _remote_path(positional[-1]).lstrip("/")
+    rels = _files_from_paths(argv)
+    if rels:
+        for rel in rels:
+            source = src / rel
+            if not source.is_file():
+                continue
+            target = dst / rel
+            target.parent.mkdir(parents=True, exist_ok=True)
+            shutil.copy2(source, target)
+    else:
+        dst.mkdir(parents=True, exist_ok=True)
+        shutil.copytree(src, dst, dirs_exist_ok=True)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
+```
+
+- [ ] **Step 2: Write the round-trip test**
+
+Append to `tests/unit/sync/transports/test_rsync_ssh.py`:
+
+```python
+import os
+import stat
+import sys
+
+
+@pytest.fixture
+def stub_rsync(tmp_path: Path, monkeypatch) -> Path:
+    """Executable wrapper around tests/fixtures/stub_rsync.py."""
+    fixture = Path(__file__).parents[3] / "fixtures" / "stub_rsync.py"
+    wrapper = tmp_path / "rsync"
+    wrapper.write_text(f'#!/bin/sh\nexec "{sys.executable}" "{fixture}" "$@"\n')
+    wrapper.chmod(wrapper.stat().st_mode | stat.S_IEXEC)
+    monkeypatch.setenv("STUB_RSYNC_DEST_ROOT", str(tmp_path / "nas"))
+    return wrapper
+
+
+class TestAgainstStub:
+    async def test_push_then_list_roundtrip(self, stub_rsync: Path, tmp_path: Path) -> None:
+        local = tmp_path / "run"
+        (local / "data").mkdir(parents=True)
+        (local / "data" / "file with spaces.csv").write_text("x" * 10)
+        driver = RsyncSshDriver(binary=str(stub_rsync))
+
+        result = await driver.push(local, "u@h:/v1/lab/EQ1/run")
+        assert result.ok
+
+        manifest = await driver.lsjson_manifest("u@h:/v1/lab/EQ1/run")
+        assert manifest.has("data/file with spaces.csv")
+        local_stat = (local / "data" / "file with spaces.csv").stat()
+        assert manifest.matches(
+            "data/file with spaces.csv",
+            local_stat.st_size,
+            local_stat.st_mtime,
+            tolerance_s=2,
+        )
+
+    async def test_about_missing_base_root(self, stub_rsync: Path) -> None:
+        driver = RsyncSshDriver(binary=str(stub_rsync))
+        result = await driver.about("u@h:/does/not/exist")
+        assert not result.ok and "base_root" in (result.reason or "")
+```
+
+- [ ] **Step 3: Run tests to verify they pass**
+
+Run: `uv run --extra test pytest tests/unit/sync/transports/test_rsync_ssh.py -v`
+Expected: PASS (the stub's listing format must satisfy the Task 3 parser — comma-grouped sizes, spaces in names, `.` top entry dropped; if a format detail mismatches, fix the stub, not the parser).
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add tests/fixtures/stub_rsync.py tests/unit/sync/transports/test_rsync_ssh.py
+git commit -m "test(sync): stub rsync binary + driver round-trip coverage"
+```
+
+---
+
+### Task 15: docker rsync-over-ssh leg + characterization tests
+
+**Files:**
+- Modify: `tests/docker/Dockerfile`, `tests/docker/entrypoint.sh`, `tests/docker/docker-compose.yml`, `tests/docker/README.md`
+- Create: `tests/integration/test_rsync_ssh_characterization.py`
+
+This task pins the empirical questions the unit stubs cannot answer: **whose timezone formats `--list-only` output**, real `--files-from` trailing-slash semantics, real itemize flag strings, and rc behavior on missing paths — against a genuine rsync+sshd, key-auth, no-SFTP, no-shell posture mirroring the Synology.
+
+- [ ] **Step 1: Extend the SFTP container for rsync-over-ssh**
+
+In `tests/docker/Dockerfile`: add `rsync` to the `apt-get install` list. In `tests/docker/entrypoint.sh`: append provisioning for a key-only rsync user (generate `/keys/id_exlab` if absent, install `authorized_keys` with `restrict,command="rsync --server ..."`-style forced command is NOT used — Synology allows plain `rsync --server`; instead set the user's shell to `/bin/sh` but `Match User` in `sshd_config` with `ForceCommand` left unset and `Subsystem sftp` removed for that user, mirroring "rsync works, sftp does not"). Set the container `TZ=America/New_York` in `docker-compose.yml` (`environment:` of the sshd service) so it differs from typical client TZ. Document the new user/keys in `tests/docker/README.md`. Follow the existing entrypoint's user-provisioning style exactly — read it first; it already creates the SFTP user.
+
+- [ ] **Step 2: Write the characterization tests**
+
+Create `tests/integration/test_rsync_ssh_characterization.py`, gated exactly like `tests/integration/test_nas_sync.py` (open that file and copy its docker-availability skip marker/fixtures verbatim). Tests, each driving the real `RsyncSshDriver` at the container:
+
+```python
+async def test_push_list_reconcile_roundtrip(...):
+    # push a run dir containing "file with spaces.tif" and a nested dir;
+    # lsjson_manifest must return matches() == True for every file with
+    # tolerance_s=2 — THIS is the timezone characterization: it fails if
+    # --list-only formats in the server's TZ (container TZ is pinned
+    # non-UTC) and passes if it formats in the client's.
+
+async def test_check_differ_and_missing(...):
+    # corrupt one remote file's bytes (same size, same mtime, via the
+    # bind-mounted nas-data volume), delete another; check() must report
+    # exactly {corrupt} differ and {deleted} missing_on_dst.
+
+async def test_list_only_on_missing_run_dir_raises_network(...):
+    # lsjson_manifest on a nonexistent run dir -> TransportError NETWORK.
+
+async def test_about_ok_and_missing_base_root(...):
+    # about(base_root) ok; about(bogus path) reason mentions base_root.
+```
+
+Fill in the bodies using the same container connection constants the existing integration test uses (host port, user, key path from `tests/docker/.env`/compose).
+
+**If the timezone round-trip test FAILS** (meaning the listing is server-TZ-formatted): change `parse_rsync_listing` to accept a `tz_offset_s` parameter threaded from a new optional `nas.remote_tz` config field, and record the finding in the spec's risk section. Do not silently widen the tolerance.
+
+- [ ] **Step 3: Run**
+
+Run: `docker compose -f tests/docker/docker-compose.yml up -d --build`, then
+`uv run --extra test pytest tests/integration/test_rsync_ssh_characterization.py -v`
+Expected: PASS (or the documented tz contingency above).
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add tests/docker/ tests/integration/test_rsync_ssh_characterization.py
+git commit -m "test(integration): rsync-over-ssh docker leg + characterization suite"
+```
+
+---
+
+### Task 16: Documentation
+
+**Files:**
+- Create: `docs/setup/rsync-ssh-setup.md`
+- Modify: `docs/setup/rclone-remote-setup.md` (cross-link), `design_specs/design_spec_sections/09_Configuration_File.md` (new `nas.transport`/`ssh_port`/`ssh_identity_file` fields), `design_specs/design_spec_sections/07_Sync_and_Database_Integration.md` (transport matrix + verify-authority note), `design_specs/design_spec_sections/04_Backend_Architecture.md` (driver protocol + factory), `README.md` (transport mention)
+
+- [ ] **Step 1: Write `docs/setup/rsync-ssh-setup.md`** covering, with exact commands: generating a dedicated keypair (`ssh-keygen -t ed25519 -f ~/.ssh/id_exlab -N ""`), installing the public key on the Synology service account, host-key pre-provisioning (`ssh-keyscan -p <port> nas01.lab.example >> ~/.ssh/known_hosts`) **with the note that no ssh login permission is needed** (key exchange precedes auth) and an out-of-band fingerprint check against DSM (`ssh-keygen -lf <(ssh-keyscan -p <port> nas01 2>/dev/null)`), the `config.yaml` block (copy from the spec's "New (cluster instance…)" example), the degraded Test-connection (reachable-only, no free space), recording `rsync --version` from the NAS in the runbook, and the BatchMode failure modes table (Permission denied → key not installed; Host key verification failed → run ssh-keyscan; Connection refused/timeout → network/IT).
+
+- [ ] **Step 2: Update the four design-spec/docs files** per the spec's §6 — each is a focused diff: config table row additions (09), a two-row transport matrix + "verify authority differs by transport" paragraph (07), the protocol/factory sentence (04), one README line.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add docs/ design_specs/ README.md
+git commit -m "docs: rsync-over-ssh NAS transport setup walkthrough + spec sections"
+```
+
+---
+
+### Task 17: Final validation sweep
+
+- [ ] **Step 1: Lint everything**
+
+Run: `uvx ruff check src tests` and `uvx ruff format --check src tests`
+Expected: clean (fix anything flagged).
+
+- [ ] **Step 2: Full unit suites, sync suites one at a time** (flake note in memory):
+
+```
+uv run --extra test pytest tests/unit/constants tests/unit/config -v
+uv run --extra test pytest tests/unit/sync/test_manifest.py tests/unit/sync/test_transports.py -v
+uv run --extra test pytest tests/unit/sync/transports -v
+uv run --extra test pytest tests/unit/sync/test_nas_client.py -v
+uv run --extra test pytest tests/unit/sync/test_nas_client_extra.py -v
+uv run --extra test pytest tests/unit/sync/test_nas_client_stability.py -v
+uv run --extra test pytest tests/unit/sync/test_cleanup.py tests/unit/sync/test_queue.py -v
+uv run --extra test pytest tests/unit/tray tests/unit/test_paths.py tests/unit/api -v
+uv run --extra test pytest tests/unit/ui -v
+```
+Expected: all PASS.
+
+- [ ] **Step 3: e2e** — `uv run --extra test pytest tests/e2e -v` (expect the lifecycle + settings flows green; fix copy assertions if Task 13's grep missed one).
+
+- [ ] **Step 4: Spec/grep invariants**
+
+```
+grep -rn "RcloneDriver(\|RsyncSshDriver(" src/exlab_wizard | grep -v "sync/transports/\|nas_client.py"
+```
+Expected: no output (`nas_client.py` keeps one documented stage-mode construction).
+
+- [ ] **Step 5: Update the spec status line** in `docs/superpowers/specs/2026-06-10-rsync-ssh-nas-transport-design.md` to `Status: Implemented (plan: docs/superpowers/plans/2026-06-10-rsync-ssh-nas-transport.md)`, commit:
+
+```bash
+git add docs/superpowers/specs/2026-06-10-rsync-ssh-nas-transport-design.md
+git commit -m "docs(spec): mark rsync-over-ssh transport spec implemented"
+```
diff --git a/docs/superpowers/specs/2026-06-10-rsync-ssh-nas-transport-design.md b/docs/superpowers/specs/2026-06-10-rsync-ssh-nas-transport-design.md
new file mode 100644
index 0000000..0ecd28d
--- /dev/null
+++ b/docs/superpowers/specs/2026-06-10-rsync-ssh-nas-transport-design.md
@@ -0,0 +1,529 @@
+# rsync-over-ssh NAS transport
+
+- **Date:** 2026-06-10
+- **Status:** Design — decisions resolved + spec-review findings applied
+  (2026-06-10), pending implementation plan
+- **Builds on:**
+  [`2026-05-28-rclone-conf-nas-sync-design.md`](2026-05-28-rclone-conf-nas-sync-design.md)
+  (rclone stays the default transport; this spec adds a second transport, it
+  does not supersede anything).
+
+## Summary
+
+The NAS sync subsystem shells out to exactly one binary today: rclone, via
+`RcloneDriver` (`sync/transports/rclone.py`). The connection backend is chosen
+by the named remote in the operator's `rclone.conf` — the app is
+protocol-agnostic by design.
+
+That design hits an IT wall on the compute cluster:
+
+| Path | Lab acquisition PCs | Cluster nodes |
+| --- | --- | --- |
+| rclone → SMB share | ✅ allowed | ❌ outbound SMB blocked |
+| rclone → SFTP | ❌ locked by IT on the Synology NAS | ❌ same |
+| rsync over ssh | (not needed) | ✅ enabled |
+
+This spec adds an **`rsync_ssh` transport** selected per instance by a new
+`nas.transport` field. Lab PCs keep `rclone` (SMB) untouched; the cluster
+instance sets `transport: rsync_ssh` and reaches the same
+`<base_root>/<equipment_id>/<run>` layout over ssh. The four network
+operations the sync subsystem needs — push, manifest listing, content verify,
+connection probe — are all implemented from **rsync protocol primitives
+only**: IT blocks every ssh command on the NAS except the rsync server
+channel itself (rsync-over-ssh works by ssh-executing `rsync --server`, which
+is exactly what IT allowlists — confirmed 2026-06-10). The design therefore
+assumes **no remote command execution** (no `ssh host df`, `find`, or
+`sha256sum`), no interactive ssh login, and no SFTP subsystem.
+
+## Motivation / goals
+
+- **Unblock the cluster instance.** The only NAS path IT permits from cluster
+  nodes is rsync-over-ssh; today the app cannot use it at all.
+- **Keep the lab PCs untouched.** rclone-over-SMB works there and stays the
+  default; the transport choice is per-instance config, not a global change.
+- **Preserve the integrity contract.** `VERIFIED` still means "present +
+  size/mtime-reconciled on the remote"; local deletion is still gated by a
+  content verify of the proof-required files. The rsync transport must offer
+  a content-verify equivalent of `rclone check --download` (the
+  `--checksum` dry-run, resolved OQ-1 — an accepted trust-posture change,
+  see [Resolved decisions](#resolved-decisions)).
+- **Preserve the credential invariant.** The 2026-05-28 migration established
+  that the driver injects no credentials and never sees a password. ssh keeps
+  that: key-based auth only (`BatchMode=yes`), identity file managed by the
+  operator in `~/.ssh` (or pinned in config), no keyring entry, no password
+  prompt path.
+
+### Non-goals
+
+- **Runtime failover** between transports. The blockage is static per machine;
+  each instance picks one transport in config. (A future fallback design can
+  layer on top of `_resolve_remote` if ever needed.)
+- **rsync for the staging hop.** The orchestrator staging backend is dormant
+  and hidden (see `2026-05-29-hide-orchestrator-staging-design.md`);
+  `orchestrator.staging_remote` stays rclone-shaped. If staging is ever
+  re-enabled on a machine that needs rsync, that is a separate spec.
+- **Password ssh auth / ssh-agent orchestration.** Key-based only. An
+  operator who needs an agent runs one themselves; the app just invokes ssh.
+- **rsync on Windows acquisition machines.** rsync requires the binary on
+  both ends plus a sane ssh; on Windows that means cwRsync/WSL pain. The
+  cluster nodes are Linux; lab Windows PCs keep rclone. Documented assumption.
+- **Parallel-stream parity.** rsync is single-stream; `nas.perf.transfers` /
+  `checkers` are rclone-only dials and are ignored (not rejected) by the
+  rsync driver.
+
+## Decisions (from design discussion)
+
+| Question | Decision |
+| --- | --- |
+| Transport selection granularity | **Per-instance** `nas.transport` selector (`rclone` default, `rsync_ssh`). No per-equipment branch, no failover. |
+| Target-string shape | **Reuse the `<remote>:<path>` string.** `nas.remote = "user@host"` renders as `user@host:base/equip/run` — valid rsync syntax. `_target_for_equipment`, `_remote_subpath`, and the lsjson `strip_prefix` logic stay untouched. |
+| Credentials | **ssh keys only**, `BatchMode=yes`; identity file path optionally pinned in config. No keyring, no password. Mirrors the rclone.conf invariant. |
+| Remote command execution | **Assumed unavailable.** Every op is built from rsync protocol primitives (`--list-only`, dry-run itemize, transfer in either direction). |
+| mtime preservation | Push always passes `-t` — the lsjson reconcile tolerance and `orchestrator/quiescence_poller.py` both depend on transports preserving source mtime. |
+| Verify-before-delete fidelity | **Remote-side `--checksum` dry-run** (resolved OQ-1) — see [Resolved decisions](#resolved-decisions) for the accepted trust-posture change. |
+| Manifest strategy | **Parse `--list-only`** into a true `RemoteManifest` (resolved OQ-2). |
+| Host-key policy | **Pre-provision `known_hosts` via `ssh-keyscan`** (resolved OQ-3) — works with zero login permission because the host-key exchange precedes authentication/exec. |
+| Config field shape | **Reuse `nas.remote` as `user@host`** + flat `ssh_port` / `ssh_identity_file` (resolved OQ-4). |
+| Remote free-space probe | **Degraded by design** (resolved OQ-5): no remote exec exists, so Test-connection reports reachable/auth-ok only. |
+
+## Config schema
+
+### Unchanged (lab PC, rclone over SMB)
+
+```yaml
+nas:
+  remote: "nas01"              # named remote in rclone.conf (type = smb)
+  base_root: "/srv/lab"
+  # transport: "rclone"        # new field, defaults to rclone — omitted on lab PCs
+```
+
+### New (cluster instance, rsync over ssh)
+
+```yaml
+nas:
+  transport: "rsync_ssh"
+  remote: "svc-sync@nas01.lab.example"   # user@host — doubles as the target prefix
+  base_root: "/volume1/lab"              # absolute path on the NAS
+  ssh_port: 22                           # optional, default 22
+  ssh_identity_file: "~/.ssh/id_exlab"   # optional; blank = ssh default key discovery
+  mtime_tolerance_s: 2                   # reused verbatim by the rsync reconcile
+  bandwidth: { upload_mbps: null, schedule: [] }   # reused; maps to rsync --bwlimit
+  perf: { transfers: 4, checkers: 8 }    # rclone-only; ignored by rsync_ssh (single stream)
+```
+
+- **New enum:** `SyncTransport` (`constants/enums.py`): `RCLONE = "rclone"`,
+  `RSYNC_SSH = "rsync_ssh"`. (`tests/unit/constants/test_enum_literal_alignment.py`
+  gains the member.)
+- **`NasConfig` additions** (`config/models.py`): `transport: SyncTransport =
+  SyncTransport.RCLONE`, `ssh_port: int = Field(default=22, ge=1, le=65535)`,
+  `ssh_identity_file: str = ""`. A model validator rejects
+  `transport: rsync_ssh` with an empty `remote` and rejects a `remote`
+  lacking the `user@host` shape in rsync mode (resolved OQ-4).
+- `rclone_config_path` is rclone-only and ignored in rsync mode (same
+  ignore-don't-reject policy as `perf`).
+
+## Architecture by surface
+
+### 1. Transport protocol + shared factory — `sync/transports/__init__.py`
+
+`RcloneDriver` is currently named concretely in three places:
+`Verifier.__init__` (`sync/verifier.py:102`), `_build_driver` /
+`_driver_for_equipment` (`sync/nas_client.py:132,729`), and two direct
+constructions in `tray/dependencies.py` (`_snapshot_nas_remotes`,
+the Test-connection probe).
+
+- **Add a `NasTransportDriver` Protocol** to `sync/transports/__init__.py`
+  with the four network ops the sync subsystem consumes:
+
+  ```python
+  class NasTransportDriver(Protocol):
+      async def push(self, local: Path, remote: str, *,
+                     bwlimit_kibps: int | None = None,
+                     files_from: Path | None = None) -> TransportResult: ...
+      async def check(self, local: Path, remote: str, *,
+                      files_from: Path) -> CheckResult: ...
+      async def lsjson_manifest(self, remote: str, *, strip_prefix: str) -> RemoteManifest: ...
+      async def about(self, remote: str) -> AboutResult: ...
+  ```
+
+  (`listremotes` is **not** on the protocol — it is rclone.conf
+  introspection, used only by the rclone-mode setup gate, and stays a
+  concrete `RcloneDriver` method.)
+
+  Note the protocol returns a parsed `RemoteManifest`, not raw lsjson text:
+  the raw-JSON shape is rclone-specific, so parsing moves behind the driver
+  boundary. `RcloneDriver` keeps its raw `lsjson()` method and gains a thin
+  `lsjson_manifest()` that calls `parse_lsjson` — `nas_client._build_lsjson`
+  slims down accordingly. `CheckResult` / `AboutResult` move (or are
+  re-exported) from `rclone.py` into `transports/__init__.py` alongside
+  `TransportResult`, since both drivers now produce them.
+
+- **Add one shared factory** `build_nas_driver(nas: NasConfig, perf:
+  RclonePerf) -> NasTransportDriver` (in `sync/transports/__init__.py`),
+  branching on `nas.transport`. **Every** construction site routes through
+  it: `nas_client._build_driver`, both `tray/dependencies.py` sites, and any
+  test helper. **Verification:** `grep -rn "RcloneDriver(\|RsyncSshDriver("
+  src` returns hits only inside `sync/transports/`.
+
+- **Stage-mode bypass (spec-review blocker, 2026-06-10).**
+  `_driver_for_equipment` serves *all* equipment, including the dormant
+  stage-mode path, and a stage-mode target
+  (`<staging_remote>:<staging_base_root>/…` from `_resolve_remote`) is an
+  rclone named-remote string — handing it to an `RsyncSshDriver` would
+  attempt ssh to a host literally named after the staging remote.
+  `nas.transport` therefore selects the driver **only for
+  `sync_mode == NAS` equipment**; stage-mode equipment always gets a
+  `RcloneDriver` (constructed with `nas.rclone_config_path` + the staging
+  perf dials), regardless of `nas.transport`. This honors the standing
+  constraint that the hidden staging backend must not break
+  (`CLAUDE.md` / `2026-05-29-hide-orchestrator-staging-design.md`). In
+  practice a cluster `rsync_ssh` instance has no stage-mode equipment, but
+  the branch must be explicit, not accidental.
+
+- **`Verifier`** type-hints `NasTransportDriver`; its no-arg default
+  construction is removed in favor of explicit driver injection (the only
+  production caller already holds a driver).
+
+### 2. rsync driver — new `sync/transports/rsync_ssh.py`
+
+`RsyncSshDriver` mirrors `RcloneDriver`'s thin-wrapper philosophy: build an
+argv, hand it to `run_subprocess`, classify the outcome. Constructor takes
+`binary: str = "rsync"`, `ssh_port`, `ssh_identity_file`.
+
+A single `_ssh_args()` helper renders the remote-shell flag:
+
+```
+-e "ssh -p <port> [-i <identity>] -o BatchMode=yes"
+```
+
+`BatchMode=yes` is mandatory — a host-key or passphrase prompt must fail
+fast (classified `AUTH`) rather than hang the worker loop. Host keys are
+**pre-provisioned during setup via `ssh-keyscan`** (resolved OQ-3): the
+host-key exchange happens during the SSH handshake *before* authentication
+or command execution, so `ssh-keyscan nas01 >> ~/.ssh/known_hosts` works
+even though IT denies every login/exec path; the setup walkthrough has the
+operator verify the fingerprint against the one DSM displays. No
+`StrictHostKeyChecking` relaxation is passed — an unknown or changed key
+fails as `AUTH`, which is the desired posture.
+
+**Ops:**
+
+- **`push`** → `rsync -rt --files-from=<list> --bwlimit=<KiB>
+  -e <ssh> <local>/ <target>`
+  - `-t` mandatory (mtime contract); `-r` for the whole-run case.
+  - `--bwlimit` takes units of 1024 bytes since rsync 3.0, so
+    `effective_bandwidth_limit_kibps` maps directly.
+  - `--files-from` semantics match rclone's (run-relative paths against the
+    source root); implementation must pin down trailing-slash behavior with
+    a characterization test against the real binary (`tests/docker/`).
+  - No `--checksum` on push: rsync's quick-check (size+mtime) decides what to
+    send, mirroring how integrity is owned by the verify path, not the push.
+- **`lsjson_manifest`** (resolved OQ-2) → `rsync --list-only -r --no-h
+  <target>/` parsed line-by-line (perms, size, `Y/m/d H:M:S`, path) into a
+  true size+mtime `RemoteManifest`; the `matches()` reconcile predicate and
+  the cleanup `has()` probe work unchanged. **Parsing algorithm
+  (spec-review blocker, 2026-06-10): the line must be anchored on the
+  fixed-format timestamp, not whitespace-split** — filenames containing
+  spaces appear literally, unquoted and unescaped. Shape:
+  `^(\S+)\s+([\d,.]+)\s+(\d{4}/\d{2}/\d{2})\s+(\d{2}:\d{2}:\d{2})\s(.+)$`,
+  with everything after the timestamp taken as the path. Remaining
+  pitfalls, each pinned by a docker characterization test against the real
+  binary:
+  - timestamps print at 1 s resolution in a local timezone — *whose* local
+    timezone (the client formatting the received file list, or the remote
+    server) is an empirical question the characterization test must pin
+    down by running the fixture NAS under a non-UTC `TZ` while the client
+    parses under another; the parser takes the formatting timezone as a
+    tested fact, not an assumption. (A DST-repeat-hour mismatch self-heals
+    on the next sweep either way.)
+  - sizes can carry locale thousands-separators — strip `,`/`.` group
+    separators and pass `--no-h` defensively;
+  - unusual filename bytes arrive escaped as `\#ooo` octal — unescape
+    (spaces are *not* escaped, hence the timestamp anchor);
+  - directory entries (`d` perm prefix) are dropped, matching
+    `parse_lsjson`.
+- **`check`** (resolved OQ-1) → remote-side checksum dry-run:
+  `rsync -rtni --checksum --files-from=<list> -e <ssh> <local>/ <target>`.
+  The remote rsync hashes whole files (MD5, or negotiated xxh3 on ≥ 3.2)
+  inside the rsync protocol — it rides the same allowlisted
+  `rsync --server` channel, no separate remote command. The itemized output
+  is synthesized into a `CheckResult` so `VerifyResult.from_check_result`
+  and everything downstream is untouched: a line with the checksum-differs
+  flag (`c` at index 2) → `differ`; an all-`+` creation line → `missing_on_dst`;
+  **`equal` is reconstructed by the driver as (the `files_from` list) minus
+  (the itemized paths)** — the driver reads the `files_from` file it was
+  handed, since matching files are simply omitted from itemized output.
+  `extra_on_dst` is always `()` in rsync mode (a push-direction dry-run
+  cannot see remote-only files; harmless — it never flips
+  `VerifyResult.ok`). The itemize flag-string length varies across
+  implementations (9 attribute columns in rsync 3.x, fewer in openrsync on
+  macOS dev machines) — the parser matches the `YXc` prefix positionally
+  and tolerates variable tail length. No temp disk, no re-download. **Accepted trust-posture change:** deletion decisions rest
+  on "the NAS's rsync says the bytes hash equal" rather than a local
+  SHA-256 of re-downloaded bytes (see [Risks](#risks)); the durable
+  locally-computed `verified_sha256` in `sync_state.json` (Slot A) is
+  unaffected. A download-and-rehash mode equivalent to
+  `rclone check --download` was considered and can be added later as an
+  opt-in strict mode if the posture ever needs tightening.
+- **`about`** (resolved OQ-5) → reachability + auth probe only:
+  `rsync --list-only <target-base-root>` (non-recursive, cheap). Success
+  returns `AboutResult(ok=True, info={})` — free-space info is
+  unobtainable without remote exec, which IT blocks; the degradation is
+  accepted. The Settings panel already tolerates an empty `info` dict
+  (that is `RcloneDriver.about`'s JSON-decode fallback today).
+  **Classification carve-out (spec review):** a nonexistent `base_root`
+  exits rc 23 ("partial transfer"), which the generic table would call
+  retryable `NETWORK` — misleading for a config mistake. `about()`
+  special-cases rc 23 with empty listing output into
+  `reason="base_root not found or inaccessible"` so the Test-connection
+  panel surfaces a configuration error, not a phantom network problem.
+
+**Failure classification** — its own `_classify_failure(stderr, returncode)`
+(the rclone one's markers are SMB/HTTP-flavored):
+
+| Signal | Kind |
+| --- | --- |
+| rc 255 + `permission denied (publickey`, `host key verification failed`, `too many authentication failures` | `AUTH` (terminal) |
+| rc 255 otherwise (connection refused / timed out / reset) | `NETWORK` |
+| rc 5 (`error starting client-server protocol`), 10, 12, 30, 35 | `NETWORK` |
+| rc 23 / 24 (partial transfer / vanished source files) | `NETWORK` (retryable; the per-file reconcile credits what landed) |
+| anything else non-zero | `UNKNOWN` (treated as `NETWORK` by the queue) |
+
+Spawn failure (`FileNotFoundError` on the rsync binary) raises
+`TransportError` with `error_kind=None`, same contract as rclone.
+
+### 3. Sync client — `sync/nas_client.py`
+
+Deliberately minimal, thanks to the target-string reuse:
+
+- `_build_driver` delegates to the shared `build_nas_driver` factory.
+- `_build_lsjson` calls `driver.lsjson_manifest(target, strip_prefix=…)`
+  instead of `parse_lsjson(await driver.lsjson(target), …)`.
+- `_target_for_equipment`, `_remote_subpath`, `_resolve_remote`,
+  `_write_files_from`, the worker state machine, the reconcile loop, Slot A
+  SHA capture, and the whole `_maybe_cleanup` gate are **unchanged** — they
+  already speak only `TransportResult` / `CheckResult` / `RemoteManifest`.
+
+### 4. Setup gate — `paths.py`, `api/`, `tray/dependencies.py`
+
+The §4.9 gate currently asks one question: "is `nas.remote` present in
+rclone.conf?" (`_nas_remote_satisfied`, `paths.py:587`, fed by
+`RcloneDriver.listremotes()` snapshots in
+`tray/dependencies._hydrate_nas_remotes` and the
+`tray/dependencies._make_equipment_probe` Test-connection probe). That
+predicate is rclone-only. Branch by transport:
+
+- **rclone:** unchanged (listremotes presence).
+- **rsync_ssh:** static, offline predicate — `nas.remote` non-empty and, when
+  `ssh_identity_file` is set, the file exists
+  (`Path(...).expanduser().exists()`). No subprocess at boot, no network.
+  (Network reachability stays behind the explicit Test-connection button,
+  same policy as rclone mode.)
+
+**The rsync branch must bypass rclone entirely, not merely reinterpret its
+result** (spec review): on a cluster instance the rclone binary is likely
+absent, and today `_hydrate_nas_remotes` would degrade its
+`FileNotFoundError` to "no remotes" — tripping `INCOMPLETE_NO_NAS_REMOTE`
+for the wrong reason. In rsync mode `_hydrate_nas_remotes` never spawns
+rclone; the availability callable is the static predicate above.
+
+Plumbing: the `nas_remote_available: Callable[[str], bool]` parameter of
+`evaluate_setup_state` keeps its shape; `tray/dependencies.py` /
+`api/app.py` supply the transport-appropriate callable from one shared
+helper. `_missing_nas_fields` gains rsync-flavored reasons:
+`{"field": "nas.remote", "reason": "unset"}` (shared),
+`"identity_file_missing"` (new) alongside the existing
+`"not_found_in_rclone_conf"`. `SetupState.INCOMPLETE_NO_NAS_REMOTE` and
+`SetupNextAction.CONFIGURE_RCLONE_REMOTE` enum members are **kept as-is**
+(renaming them is churn across API consumers); only the UI copy keyed off
+them becomes transport-aware.
+
+### 5. UI — `ui/pages/settings.py`, `ui/mount.py`, `ui/pages/main.py`
+
+Copy-level changes only; the section stays read-only (the operator edits
+`config.yaml`, same as the rclone remote today):
+
+- Settings "NAS Remote" section: shows `transport` alongside remote +
+  base_root. Badge branches: rclone keeps "Found in rclone.conf" / "Not
+  found — run `rclone config`"; rsync_ssh shows "ssh key found" /
+  "Identity file missing — see setup docs" (the static gate predicate).
+- Test-connection button: already driver-routed once
+  `tray/dependencies.py` uses the shared factory; the result panel renders
+  `AboutResult.reason` for failures and "reachable" (no free-space figures)
+  for rsync success.
+- Main-page banner subline for `configure_rclone_remote`: transport-aware
+  variant ("Configure ssh access to the NAS (see setup docs)").
+- Equipment wizard copy ("syncs directly to the NAS using the rclone
+  remote", `wizard_equipment.py:290-332`): generalize to "the NAS
+  connection configured in Settings" — optional polish, not load-bearing.
+
+### 6. Docs
+
+- New setup-doc section **"Cluster instances: rsync over ssh"**: generating
+  a dedicated keypair, installing it on the Synology (rsync service
+  enabled, account permissions, home-dir `authorized_keys` quirks on DSM),
+  host-key pre-provisioning via `ssh-keyscan` + DSM fingerprint
+  verification (no manual `ssh` is possible — IT blocks all logins), and
+  the `BatchMode` failure modes.
+- Update `design_specs/design_spec_sections/09_Configuration_File.md`
+  (new `nas.transport` / ssh fields), `07_Sync_and_Database_Integration.md`
+  (transport matrix + verify fidelity note), `04_Backend_Architecture.md`
+  (driver protocol), `README.md`.
+
+### 7. Tests
+
+- **New fixture** `tests/fixtures/stub_rsync.py`, sibling of
+  `stub_rclone.py`: records argv, fakes `--list-only` / itemize / pull
+  output per a scripted scenario. The argv contract (flag order, `-e`
+  string, `--files-from` path) is the unit-test seam.
+- **New unit suites:** `tests/unit/sync/transports/test_rsync_ssh.py`
+  (argv building, failure classification, itemize → `CheckResult`
+  synthesis) plus `--list-only` parser tests (timezone, escaped filenames,
+  locale-size guards, directory dropping) in `test_manifest.py`.
+- **Parameterize** the transport-touching `nas_client` paths: the existing
+  suites stay green untouched (rclone default); add rsync-mode cases for
+  `_build_driver` routing, push-failure classification, and the cleanup
+  gate using canned driver stubs.
+- **Config:** `tests/unit/config/test_models.py` (new fields, rsync-mode
+  validators), `test_enum_literal_alignment.py`.
+- **Setup gate / UI / e2e:** `tests/unit/test_paths.py` (transport-branched
+  gate), `tests/unit/tray/test_dependencies.py`,
+  `test_settings_nas_remote.py` (badge variants), an e2e settings-flow
+  variant for rsync mode.
+- **Integration:** `tests/docker/` gains an `sshd + rsync` container
+  (restricted to rsync, no sftp subsystem — mirrors the Synology posture)
+  beside the existing fixture servers; `tests/integration/test_nas_sync.py`
+  runs the full push → reconcile → cleanup-gate cycle against it. This is
+  where the `--files-from` / trailing-slash / timezone characterization
+  tests live.
+
+## Verify / cleanup flow (unchanged shape, annotated)
+
+```
+push (rclone copy --checksum | rsync -rt)  ──► manifest reconcile (size + mtime±tol)
+                                                 rclone: lsjson JSON | rsync: --list-only parse
+        └─ all files credited → VERIFIED → rollup SYNCED
+maybe_cleanup (rollup == SYNCED && §7.1.6 interlocks)
+  ├─ existence probe (manifest.has)            ── missing ─► defer
+  ├─ content verify (check)                    ── mismatch ─► defer, surface
+  │    rclone: check --download | rsync: --checksum dry-run (remote-side hash)
+  └─ pass → delete local (keep_local honored) → CLEANED
+```
+
+## Memory / storage analysis (constrained machines)
+
+| Operation | rclone (today) | rsync_ssh |
+| --- | --- | --- |
+| push | ~`--transfers` × buffer RAM, no temp disk | single stream, minimal RAM, no temp disk |
+| manifest | bounded by entry count | same (text listing lines) |
+| content verify | **streams, no temp disk** (full re-download) | dry-run, **no temp disk, no re-download** (remote-side hashing) |
+
+The rsync verify is strictly cheaper than rclone's on disk and wire; the
+cost is paid in trust posture instead (see [Risks](#risks)).
+
+## Migration / breaking changes
+
+None for existing installs: `nas.transport` defaults to `rclone`, all new
+fields default inert, and no existing field changes meaning. The cluster
+instance is a **new** config, written with `transport: rsync_ssh` from the
+start. `extra="forbid"` on `NasConfig` means a config written for this
+feature does not load on an older build — acceptable (new instance, new
+build).
+
+## Resolved decisions
+
+All open questions were resolved in design discussion on 2026-06-10:
+
+1. **Verify-before-delete fidelity (OQ-1) — remote-side `--checksum`
+   dry-run.** Chosen over download-and-rehash: no temp disk, no
+   re-download, and it rides the same allowlisted rsync channel. The
+   trust-posture change (deletion gate relies on the NAS's rsync hashing
+   rather than a local SHA-256 of re-downloaded bytes) is **accepted** and
+   recorded in [Risks](#risks). The locally-computed Slot A
+   `verified_sha256` record is unaffected. A strict download-and-rehash
+   mode remains a possible later opt-in.
+2. **Manifest mechanism (OQ-2) — parse `--list-only`** into a true
+   `RemoteManifest`, keeping the `matches()` / `has()` contract unchanged;
+   the timezone/escape/locale pitfalls are pinned by docker
+   characterization tests. The dry-run-itemize verdict alternative is the
+   documented fallback if listing parsing proves brittle against real DSM
+   rsync versions.
+3. **Host-key policy (OQ-3) — pre-provisioned `known_hosts` via
+   `ssh-keyscan`.** Constraint surfaced during discussion: IT blocks *all*
+   ssh commands/logins on the NAS, so "run one manual `ssh` to accept the
+   key" is impossible. `ssh-keyscan` needs no login — the host-key exchange
+   precedes authentication — so the setup walkthrough uses
+   `ssh-keyscan <host> >> ~/.ssh/known_hosts` plus an out-of-band
+   fingerprint check against DSM. No `StrictHostKeyChecking` relaxation.
+4. **Config shape (OQ-4) — reuse `nas.remote` as `user@host`** with flat
+   `ssh_port` / `ssh_identity_file` fields and a rsync-mode `user@host`
+   shape validator. Keeps `_target_for_equipment` / `strip_prefix`
+   untouched.
+5. **Free-space probe (OQ-5) — degradation accepted.** The service account
+   is strictly rsync-only (no `df`, no `sha256sum`), so Test-connection in
+   rsync mode reports reachable/auth-ok with no free-space figures.
+
+## Full surface inventory
+
+**Transport core:** new `sync/transports/rsync_ssh.py`;
+`sync/transports/__init__.py` (protocol, factory, DTO moves);
+`sync/transports/rclone.py` (implements protocol, `lsjson_manifest` shim).
+**Sync client / verify:** `sync/nas_client.py` (`_build_driver`,
+`_build_lsjson` slimming), `sync/verifier.py` (protocol type, drop no-arg
+default), `sync/manifest.py` (rsync listing parser, per OQ-2).
+**Config:** `config/models.py` (`NasConfig` fields + validators),
+`constants/enums.py` (`SyncTransport`).
+**Setup gate:** `paths.py` (`_nas_remote_satisfied` branch,
+`_missing_nas_fields` reasons), `tray/dependencies.py` (factory routing,
+availability snapshot branch), `api/_dependencies.py`, `api/app.py`,
+`api/setup.py`.
+**UI:** `ui/pages/settings.py` (badge/copy variants), `ui/mount.py` (probe
+adapter), `ui/pages/main.py` (banner subline),
+`ui/pages/wizard_equipment.py` (copy polish, optional).
+**Tests:** new `tests/fixtures/stub_rsync.py`,
+`tests/unit/sync/transports/test_rsync_ssh.py`; updates per [§7](#7-tests);
+`tests/docker/` sshd+rsync fixture.
+**Docs:** setup walkthrough, `design_specs/design_spec_sections/{04,07,09}_*.md`,
+`README.md`, this spec.
+
+## Risks
+
+- **Listing-parse fragility.** `--list-only` output is meant for humans:
+  unquoted spaces in filenames (timestamp-anchored regex, not
+  whitespace-split), a local-timezone timestamp at 1 s resolution (*which*
+  side's timezone is pinned by the docker characterization test running
+  fixture-NAS and client under different `TZ` values — the parser encodes
+  the tested answer, not an assumption), `\#ooo` filename escaping, and
+  potential locale thousands-separators in sizes (`--no-h` forced). A
+  DST-repeat-hour mismatch (one hour, once a year) leaves files "not
+  synced" for that hour and self-heals on the next sweep.
+- **Weaker checksum authority (accepted, resolved OQ-1).** In rsync mode the
+  pre-deletion gate's authority is "the NAS's rsync reports the whole-file
+  hash (MD5/xxh3) equal", not a local SHA-256 of re-downloaded bytes.
+  Accepted trade-off for zero temp disk and no re-download; partially
+  offset by the unchanged locally-computed `verified_sha256` Slot A record.
+  If the posture ever needs tightening, a download-and-rehash strict mode
+  can be added behind a config flag without touching the state machine.
+- **Synology account posture drift.** If IT later tightens the rsync service
+  (e.g. rsync daemon-module-only, no remote-shell rsync), the
+  `user@host:path` form stops working and a daemon-module (`rsync://`)
+  variant would be a follow-up. The driver isolates this in `_ssh_args()` +
+  target rendering.
+- **Partial-transfer semantics.** rsync rc 23/24 (some files failed/vanished)
+  is classified retryable; the per-file reconcile already credits what
+  landed, so the retry loop converges — but the docker integration test must
+  cover a vanished-mid-push file to prove it. Note rc 23 also fires when
+  `lsjson_manifest` targets a not-yet-existing remote run directory —
+  consistent with rclone's missing-path behavior (retryable
+  `TransportError`), though the operator-visible reason reads "partial
+  transfer"; the integration test pins this.
+- **`error_kind=None` routing debt (pre-existing, inherited).** A missing
+  rsync binary raises `TransportError(error_kind=None)`, which the queue
+  routes through the legacy `HASH_MISMATCH` single-retry branch
+  (`transports/__init__.py:74-77`); the operator still sees the
+  binary-missing message via `last_error`, but the retry shape is
+  misleading. Same contract as rclone today; fixing the routing is a
+  follow-up, not this spec.
+- **Single stream throughput.** rsync-over-ssh will not match rclone's
+  parallel SMB streams on many-small-file runs; acceptable on the cluster
+  (no alternative path exists), and `--bwlimit` still applies for politeness.

From d36f7ac83fa8ad1aeb1e48e4da7299684b1e8a69 Mon Sep 17 00:00:00 2001
From: Alexander Nguyen <alxxander.nguyen@protonmail.com>
Date: Wed, 10 Jun 2026 01:24:59 -0700
Subject: [PATCH 02/21] feat(constants): add SyncTransport enum for NAS
 transport selection

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 src/exlab_wizard/constants/__init__.py             |  2 ++
 src/exlab_wizard/constants/enums.py                | 14 ++++++++++++++
 .../unit/constants/test_enum_literal_alignment.py  |  1 +
 3 files changed, 17 insertions(+)

diff --git a/src/exlab_wizard/constants/__init__.py b/src/exlab_wizard/constants/__init__.py
index c86e10b..3084302 100644
--- a/src/exlab_wizard/constants/__init__.py
+++ b/src/exlab_wizard/constants/__init__.py
@@ -36,6 +36,7 @@
     StagingCleanupMode,
     SyncHandleState,
     SyncMode,
+    SyncTransport,
     SyncStatus,
     TemplateType,
     Tier,
@@ -262,6 +263,7 @@
     "StagingCleanupMode",
     "SyncHandleState",
     "SyncMode",
+    "SyncTransport",
     "SyncStatus",
     "TemplateType",
     "Tier",
diff --git a/src/exlab_wizard/constants/enums.py b/src/exlab_wizard/constants/enums.py
index ffc221b..e42ae76 100644
--- a/src/exlab_wizard/constants/enums.py
+++ b/src/exlab_wizard/constants/enums.py
@@ -175,6 +175,20 @@ class SyncMode(StrEnum):
     STAGE = "stage"
 
 
+class SyncTransport(StrEnum):
+    """Which binary the NAS sync subsystem shells out to.
+
+    rsync-over-ssh NAS transport design (2026-06-10). Selected per
+    instance by ``nas.transport``: ``rclone`` (default) drives the named
+    remote in the operator's rclone.conf; ``rsync_ssh`` drives
+    ``rsync -e ssh`` against ``nas.remote`` as a ``user@host`` target.
+    Stage-mode equipment always uses rclone regardless of this value.
+    """
+
+    RCLONE = "rclone"
+    RSYNC_SSH = "rsync_ssh"
+
+
 class StagingCleanupMode(StrEnum):
     """How NAS staging directories are eventually purged. Backend Spec §13.7."""
 
diff --git a/tests/unit/constants/test_enum_literal_alignment.py b/tests/unit/constants/test_enum_literal_alignment.py
index 60b02b2..5e4eade 100644
--- a/tests/unit/constants/test_enum_literal_alignment.py
+++ b/tests/unit/constants/test_enum_literal_alignment.py
@@ -58,6 +58,7 @@
         (enums.SyncHandleState, frozenset({"queued", "blocked"})),
         (enums.PluginSourceRoot, frozenset({"bundled", "lab"})),
         (enums.TreeProjectStatus, frozenset({"active", "archived", "deleted"})),
+        (enums.SyncTransport, frozenset({"rclone", "rsync_ssh"})),
     ],
 )
 def test_enum_values_match_expected_literal_set(

From 88f3722bec53f67e925d88f34e41f449e8359181 Mon Sep 17 00:00:00 2001
From: Alexander Nguyen <alxxander.nguyen@protonmail.com>
Date: Wed, 10 Jun 2026 01:26:37 -0700
Subject: [PATCH 03/21] feat(config): nas.transport selector + ssh fields on
 NasConfig

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 src/exlab_wizard/config/models.py | 28 ++++++++++++++++++++++
 tests/unit/config/test_models.py  | 40 +++++++++++++++++++++++++++++++
 2 files changed, 68 insertions(+)

diff --git a/src/exlab_wizard/config/models.py b/src/exlab_wizard/config/models.py
index 2b6a928..182eb68 100644
--- a/src/exlab_wizard/config/models.py
+++ b/src/exlab_wizard/config/models.py
@@ -38,6 +38,7 @@
     FieldType,
     StagingCleanupMode,
     SyncMode,
+    SyncTransport,
 )
 from exlab_wizard.errors import ConfigError
 from exlab_wizard.paths import default_app_root
@@ -291,6 +292,33 @@ class NasConfig(BaseModel):
     mtime_tolerance_s: int = Field(default=2, ge=0)
     perf: RclonePerf = Field(default_factory=RclonePerf)
     bandwidth: BandwidthConfig = Field(default_factory=BandwidthConfig)
+    # rsync-over-ssh NAS transport (2026-06-10 design). ``rsync_ssh`` drives
+    # ``rsync -e ssh`` with ``remote`` as a ``user@host`` target prefix;
+    # ``rclone_config_path`` and ``perf`` are rclone-only and ignored in
+    # rsync mode. Stage-mode equipment always uses rclone regardless.
+    transport: SyncTransport = SyncTransport.RCLONE
+    ssh_port: int = Field(default=22, ge=1, le=65535)
+    ssh_identity_file: str = ""
+
+    @field_serializer("transport")
+    def _serialize_transport(self, value: SyncTransport) -> str:
+        return value.value
+
+    @model_validator(mode="after")
+    def _validate_rsync_ssh(self) -> NasConfig:
+        if self.transport != SyncTransport.RSYNC_SSH:
+            return self
+        if not self.remote:
+            msg = "nas.transport 'rsync_ssh' requires nas.remote ('user@host')"
+            raise ValueError(msg)
+        user, sep, host = self.remote.partition("@")
+        if not (sep and user and host):
+            msg = (
+                f"nas.remote {self.remote!r} must be 'user@host' when "
+                "nas.transport is 'rsync_ssh'"
+            )
+            raise ValueError(msg)
+        return self
 
 
 # ---------------------------------------------------------------------------
diff --git a/tests/unit/config/test_models.py b/tests/unit/config/test_models.py
index 924829d..783d8d2 100644
--- a/tests/unit/config/test_models.py
+++ b/tests/unit/config/test_models.py
@@ -37,6 +37,7 @@
     ValidatorConfig,
     config_with_equipment_appended,
 )
+from exlab_wizard.constants import SyncTransport
 from exlab_wizard.errors import ConfigError
 
 # ---------------------------------------------------------------------------
@@ -164,6 +165,9 @@ def _full_config_dict() -> dict:
                     },
                 ],
             },
+            "transport": "rclone",
+            "ssh_port": 22,
+            "ssh_identity_file": "",
         },
         "update_check": {"enabled": True},
     }
@@ -999,3 +1003,39 @@ def test_config_has_default_nas_block():
     cfg = Config()
     assert cfg.nas.remote == ""
     assert cfg.nas.base_root == ""
+
+
+class TestNasTransport:
+    def test_transport_defaults_to_rclone(self) -> None:
+        nas = NasConfig()
+        assert nas.transport == SyncTransport.RCLONE
+        assert nas.ssh_port == 22
+        assert nas.ssh_identity_file == ""
+
+    def test_rsync_ssh_accepts_user_at_host(self) -> None:
+        nas = NasConfig(
+            transport="rsync_ssh",
+            remote="svc-sync@nas01.lab.example",
+            base_root="/volume1/lab",
+            ssh_identity_file="~/.ssh/id_exlab",
+        )
+        assert nas.transport == SyncTransport.RSYNC_SSH
+        assert nas.remote == "svc-sync@nas01.lab.example"
+
+    def test_rsync_ssh_rejects_empty_remote(self) -> None:
+        with pytest.raises(ValidationError, match="requires nas.remote"):
+            NasConfig(transport="rsync_ssh", remote="")
+
+    @pytest.mark.parametrize("bad", ["nas01", "@nas01", "svc-sync@"])
+    def test_rsync_ssh_rejects_non_user_at_host(self, bad: str) -> None:
+        with pytest.raises(ValidationError, match="user@host"):
+            NasConfig(transport="rsync_ssh", remote=bad)
+
+    def test_rclone_mode_remote_shape_unrestricted(self) -> None:
+        assert NasConfig(remote="nas01").remote == "nas01"
+
+    def test_transport_serializes_as_string(self) -> None:
+        dumped = NasConfig(
+            transport="rsync_ssh", remote="u@h"
+        ).model_dump()
+        assert dumped["transport"] == "rsync_ssh"

From c7497e4b9b92a7738139e9f40c45529f96ed18b5 Mon Sep 17 00:00:00 2001
From: Alexander Nguyen <alxxander.nguyen@protonmail.com>
Date: Wed, 10 Jun 2026 01:29:06 -0700
Subject: [PATCH 04/21] feat(sync): parse rsync --list-only output into
 RemoteManifest

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 src/exlab_wizard/sync/manifest.py | 71 ++++++++++++++++++++++++++++++-
 tests/unit/sync/test_manifest.py  | 56 ++++++++++++++++++++++--
 2 files changed, 122 insertions(+), 5 deletions(-)

diff --git a/src/exlab_wizard/sync/manifest.py b/src/exlab_wizard/sync/manifest.py
index c1f9d4c..04e1e5b 100644
--- a/src/exlab_wizard/sync/manifest.py
+++ b/src/exlab_wizard/sync/manifest.py
@@ -10,11 +10,11 @@
 import json
 import re
 from dataclasses import dataclass
-from datetime import datetime
+from datetime import UTC, datetime
 
 from exlab_wizard.logging import get_logger
 
-__all__ = ["RemoteEntry", "RemoteManifest", "parse_lsjson"]
+__all__ = ["RemoteEntry", "RemoteManifest", "parse_lsjson", "parse_rsync_listing"]
 
 _log = get_logger(__name__)
 
@@ -120,3 +120,70 @@ def parse_lsjson(raw: str, *, strip_prefix: str = "") -> RemoteManifest:
             is_dir=False,
         )
     return RemoteManifest(entries=out)
+
+
+# ``rsync --list-only`` line: perms, size (possibly digit-grouped), the
+# fixed-format timestamp, then EVERYTHING after the single separating
+# space is the path — filenames containing spaces appear literally
+# (spec-review blocker, 2026-06-10), so the line must be anchored on the
+# timestamp, never whitespace-split.
+_RSYNC_LIST_RE = re.compile(
+    r"^(?P<perms>\S+)\s+(?P<size>[\d,.]+)\s+"
+    r"(?P<date>\d{4}/\d{2}/\d{2})\s+(?P<time>\d{2}:\d{2}:\d{2})\s(?P<path>.+)$"
+)
+
+# rsync escapes unusual bytes in listings as ``\#ooo`` (3 octal digits).
+_RSYNC_ESCAPE_RE = re.compile(r"\\#([0-7]{3})")
+
+
+def _unescape_rsync_path(path: str) -> str:
+    """Decode rsync's ``\\#ooo`` octal escapes back into the real bytes."""
+    if "\\#" not in path:
+        return path
+    out = bytearray()
+    idx = 0
+    for match in _RSYNC_ESCAPE_RE.finditer(path):
+        out += path[idx : match.start()].encode("utf-8")
+        out.append(int(match.group(1), 8))
+        idx = match.end()
+    out += path[idx:].encode("utf-8")
+    return out.decode("utf-8", errors="replace")
+
+
+def parse_rsync_listing(raw: str) -> RemoteManifest:
+    """Parse ``rsync --list-only -r`` output into a :class:`RemoteManifest`.
+
+    rsync-over-ssh NAS transport (2026-06-10). Paths are already relative
+    to the listed target, so there is no ``strip_prefix``. Only regular
+    files (``-`` perm prefix) are kept — directories (including the ``.``
+    top entry) and symlinks are dropped, matching :func:`parse_lsjson`.
+    The listing timestamp has 1 s resolution and is formatted in the
+    local timezone of the process that renders the file list; it is
+    parsed as local time and stored as an RFC3339 UTC string so
+    :meth:`RemoteManifest.matches` works identically for both transports.
+    Unparseable lines are skipped (a listing we can't parse must not
+    crash the sync worker).
+    """
+    out: dict[str, RemoteEntry] = {}
+    for raw_line in raw.splitlines():
+        match = _RSYNC_LIST_RE.match(raw_line.rstrip())
+        if match is None:
+            continue
+        if not match.group("perms").startswith("-"):
+            continue
+        path = _unescape_rsync_path(match.group("path"))
+        if not path or path == ".":
+            continue
+        try:
+            size = int(re.sub(r"[,.]", "", match.group("size")))
+        except ValueError:
+            continue
+        try:
+            local_dt = datetime.strptime(  # naive-as-local is the point
+                f"{match.group('date')} {match.group('time')}", "%Y/%m/%d %H:%M:%S"
+            )
+        except ValueError:
+            continue
+        mod_time = local_dt.astimezone(UTC).isoformat().replace("+00:00", "Z")
+        out[path] = RemoteEntry(size=size, mod_time=mod_time, is_dir=False)
+    return RemoteManifest(entries=out)
diff --git a/tests/unit/sync/test_manifest.py b/tests/unit/sync/test_manifest.py
index 8dd8478..e5a7a50 100644
--- a/tests/unit/sync/test_manifest.py
+++ b/tests/unit/sync/test_manifest.py
@@ -1,6 +1,56 @@
-from datetime import UTC
-
-from exlab_wizard.sync.manifest import RemoteEntry, parse_lsjson
+from datetime import UTC, datetime
+
+from exlab_wizard.sync.manifest import RemoteEntry, parse_lsjson, parse_rsync_listing
+
+
+def _stamp(epoch: float) -> str:
+    """Format ``epoch`` the way the rsync client formats listing mtimes
+    (local timezone, 1 s resolution)."""
+    return datetime.fromtimestamp(epoch).strftime("%Y/%m/%d %H:%M:%S")
+
+
+class TestParseRsyncListing:
+    def test_plain_file(self) -> None:
+        raw = f"-rw-r--r--          2048 {_stamp(1_750_000_000)} data/reading_001.csv\n"
+        manifest = parse_rsync_listing(raw)
+        assert manifest.has("data/reading_001.csv")
+        assert manifest.entries["data/reading_001.csv"].size == 2048
+
+    def test_filename_with_spaces_survives(self) -> None:
+        raw = f"-rw-r--r--          1234 {_stamp(1_750_000_000)} image data 001.tif\n"
+        manifest = parse_rsync_listing(raw)
+        assert manifest.has("image data 001.tif")
+
+    def test_comma_grouped_size(self) -> None:
+        raw = f"-rw-r--r--     1,234,567 {_stamp(1_750_000_000)} big.bin\n"
+        assert parse_rsync_listing(raw).entries["big.bin"].size == 1234567
+
+    def test_mtime_roundtrips_through_local_timezone(self) -> None:
+        epoch = 1_750_000_000.0
+        raw = f"-rw-r--r--           100 {_stamp(epoch)} f.txt\n"
+        manifest = parse_rsync_listing(raw)
+        assert manifest.matches("f.txt", 100, epoch, tolerance_s=2)
+        assert not manifest.matches("f.txt", 100, epoch + 3600, tolerance_s=2)
+
+    def test_directories_and_dot_dropped(self) -> None:
+        stamp = _stamp(1_750_000_000)
+        raw = (
+            f"drwxr-xr-x          4096 {stamp} .\n"
+            f"drwxr-xr-x          4096 {stamp} data\n"
+            f"-rw-r--r--            10 {stamp} data/x.csv\n"
+        )
+        manifest = parse_rsync_listing(raw)
+        assert set(manifest.entries) == {"data/x.csv"}
+
+    def test_octal_escapes_unescaped(self) -> None:
+        raw = f"-rw-r--r--            10 {_stamp(1_750_000_000)} weird\\#012name.txt\n"
+        assert parse_rsync_listing(raw).has("weird\nname.txt")
+
+    def test_garbage_lines_ignored(self) -> None:
+        assert parse_rsync_listing("sending incremental file list\n\n").entries == {}
+
+    def test_empty_input(self) -> None:
+        assert parse_rsync_listing("").entries == {}
 
 SAMPLE = """[
   {"Path":"sub/a.txt","Name":"a.txt","Size":3,"ModTime":"2026-05-28T10:00:00.000Z","IsDir":false},

From 596dde0e4add5302bf7e8b6c3d1f4763df6a19f7 Mon Sep 17 00:00:00 2001
From: Alexander Nguyen <alxxander.nguyen@protonmail.com>
Date: Wed, 10 Jun 2026 01:29:11 -0700
Subject: [PATCH 05/21] fix(lint): sort SyncTransport in __all__ + raw-string
 match pattern in test

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 src/exlab_wizard/constants/__init__.py | 4 ++--
 tests/unit/config/test_models.py       | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/exlab_wizard/constants/__init__.py b/src/exlab_wizard/constants/__init__.py
index 3084302..bf06247 100644
--- a/src/exlab_wizard/constants/__init__.py
+++ b/src/exlab_wizard/constants/__init__.py
@@ -36,8 +36,8 @@
     StagingCleanupMode,
     SyncHandleState,
     SyncMode,
-    SyncTransport,
     SyncStatus,
+    SyncTransport,
     TemplateType,
     Tier,
     TreeProjectStatus,
@@ -263,8 +263,8 @@
     "StagingCleanupMode",
     "SyncHandleState",
     "SyncMode",
-    "SyncTransport",
     "SyncStatus",
+    "SyncTransport",
     "TemplateType",
     "Tier",
     "TreeProjectStatus",
diff --git a/tests/unit/config/test_models.py b/tests/unit/config/test_models.py
index 783d8d2..2fbdcfe 100644
--- a/tests/unit/config/test_models.py
+++ b/tests/unit/config/test_models.py
@@ -1023,7 +1023,7 @@ def test_rsync_ssh_accepts_user_at_host(self) -> None:
         assert nas.remote == "svc-sync@nas01.lab.example"
 
     def test_rsync_ssh_rejects_empty_remote(self) -> None:
-        with pytest.raises(ValidationError, match="requires nas.remote"):
+        with pytest.raises(ValidationError, match=r"requires nas\.remote"):
             NasConfig(transport="rsync_ssh", remote="")
 
     @pytest.mark.parametrize("bad", ["nas01", "@nas01", "svc-sync@"])

From dfc4634a473765533f299324adca79c81d11a06d Mon Sep 17 00:00:00 2001
From: Alexander Nguyen <alxxander.nguyen@protonmail.com>
Date: Wed, 10 Jun 2026 01:32:38 -0700
Subject: [PATCH 06/21] feat(sync): NasTransportDriver protocol +
 RcloneDriver.lsjson_manifest

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 src/exlab_wizard/sync/transports/__init__.py | 38 ++++++++++++++++++++
 src/exlab_wizard/sync/transports/rclone.py   | 17 +++++++++
 tests/unit/sync/test_transports.py           | 26 ++++++++++++++
 3 files changed, 81 insertions(+)

diff --git a/src/exlab_wizard/sync/transports/__init__.py b/src/exlab_wizard/sync/transports/__init__.py
index d4d240a..b0a35e5 100644
--- a/src/exlab_wizard/sync/transports/__init__.py
+++ b/src/exlab_wizard/sync/transports/__init__.py
@@ -10,8 +10,16 @@
 
 from dataclasses import dataclass
 from enum import StrEnum
+from typing import TYPE_CHECKING, Protocol
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+    from exlab_wizard.sync.manifest import RemoteManifest
+    from exlab_wizard.sync.transports.rclone import AboutResult, CheckResult
 
 __all__ = [
+    "NasTransportDriver",
     "TransportError",
     "TransportErrorKind",
     "TransportResult",
@@ -57,6 +65,36 @@ class TransportResult:
     returncode: int = 0
 
 
+class NasTransportDriver(Protocol):
+    """The four network ops the NAS sync subsystem consumes.
+
+    rsync-over-ssh NAS transport (2026-06-10). Implemented by
+    :class:`~exlab_wizard.sync.transports.rclone.RcloneDriver` and
+    :class:`~exlab_wizard.sync.transports.rsync_ssh.RsyncSshDriver`.
+    ``listremotes`` is deliberately NOT part of this protocol — it is
+    rclone.conf introspection, used only by the rclone-mode setup gate.
+    """
+
+    async def push(
+        self,
+        local: Path,
+        remote: str,
+        *,
+        bwlimit_kibps: int | None = None,
+        files_from: Path | None = None,
+    ) -> TransportResult: ...
+
+    async def check(
+        self, local: Path, remote: str, *, files_from: Path
+    ) -> CheckResult: ...
+
+    async def lsjson_manifest(
+        self, remote: str, *, strip_prefix: str = ""
+    ) -> RemoteManifest: ...
+
+    async def about(self, remote: str) -> AboutResult: ...
+
+
 class TransportError(Exception):
     """Raised when a transport probe cannot complete.
 
diff --git a/src/exlab_wizard/sync/transports/rclone.py b/src/exlab_wizard/sync/transports/rclone.py
index 44ce4e0..d820149 100644
--- a/src/exlab_wizard/sync/transports/rclone.py
+++ b/src/exlab_wizard/sync/transports/rclone.py
@@ -23,8 +23,12 @@
 import shlex
 from dataclasses import dataclass, field
 from pathlib import Path
+from typing import TYPE_CHECKING
 
 from exlab_wizard.logging import get_logger
+
+if TYPE_CHECKING:
+    from exlab_wizard.sync.manifest import RemoteManifest
 from exlab_wizard.sync.transports import (
     TransportError,
     TransportErrorKind,
@@ -348,6 +352,19 @@ async def lsjson(self, remote: str, *, recursive: bool = True) -> str:
             raise TransportError(msg, error_kind=kind)
         return stdout
 
+    async def lsjson_manifest(self, remote: str, *, strip_prefix: str = "") -> RemoteManifest:
+        """Run :meth:`lsjson` and parse it into a :class:`RemoteManifest`.
+
+        The raw-JSON wire shape is rclone-specific, so parsing lives
+        behind the driver boundary (the shared
+        :class:`~exlab_wizard.sync.transports.NasTransportDriver`
+        protocol returns manifests, never raw text).
+        """
+        from exlab_wizard.sync.manifest import parse_lsjson
+
+        raw = await self.lsjson(remote)
+        return parse_lsjson(raw, strip_prefix=strip_prefix)
+
     async def listremotes(self) -> tuple[str, ...]:
         """Return the remote names defined in rclone.conf (each incl. trailing ``:``)
 
diff --git a/tests/unit/sync/test_transports.py b/tests/unit/sync/test_transports.py
index 0298e6a..d79ae10 100644
--- a/tests/unit/sync/test_transports.py
+++ b/tests/unit/sync/test_transports.py
@@ -435,3 +435,29 @@ async def fake_run(cmd):
     monkeypatch.setattr("exlab_wizard.sync.transports.rclone.run_subprocess", fake_run)
     with pytest.raises(TransportError):
         await RcloneDriver().lsjson("nas01:/x")
+
+
+async def test_rclone_lsjson_manifest_parses_and_strips(monkeypatch) -> None:
+    from exlab_wizard.sync.transports.rclone import RcloneDriver
+
+    raw = (
+        '[{"Path": "base/EQ1/Run_1/a.csv", "Size": 10,'
+        ' "ModTime": "2026-06-10T00:00:00Z", "IsDir": false}]'
+    )
+
+    async def fake_lsjson(self, remote, *, recursive=True):
+        return raw
+
+    monkeypatch.setattr(RcloneDriver, "lsjson", fake_lsjson)
+    manifest = await RcloneDriver().lsjson_manifest(
+        "nas01:/base/EQ1/Run_1", strip_prefix="base/EQ1/Run_1"
+    )
+    assert manifest.has("a.csv")
+
+
+def test_rclone_driver_satisfies_protocol() -> None:
+    from exlab_wizard.sync.transports import NasTransportDriver
+    from exlab_wizard.sync.transports.rclone import RcloneDriver
+
+    driver: NasTransportDriver = RcloneDriver()
+    assert driver is not None

From 775148a5771d9d4021a5eb497a103d9649b14048 Mon Sep 17 00:00:00 2001
From: Alexander Nguyen <alxxander.nguyen@protonmail.com>
Date: Wed, 10 Jun 2026 01:34:49 -0700
Subject: [PATCH 07/21] =?UTF-8?q?feat(sync):=20RsyncSshDriver=20skeleton?=
 =?UTF-8?q?=20=E2=80=94=20classifier,=20ssh=20args,=20push?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 src/exlab_wizard/sync/transports/rsync_ssh.py | 283 ++++++++++++++++++
 tests/unit/sync/transports/test_rsync_ssh.py  | 119 ++++++++
 2 files changed, 402 insertions(+)
 create mode 100644 src/exlab_wizard/sync/transports/rsync_ssh.py
 create mode 100644 tests/unit/sync/transports/test_rsync_ssh.py

diff --git a/src/exlab_wizard/sync/transports/rsync_ssh.py b/src/exlab_wizard/sync/transports/rsync_ssh.py
new file mode 100644
index 0000000..196f3bb
--- /dev/null
+++ b/src/exlab_wizard/sync/transports/rsync_ssh.py
@@ -0,0 +1,283 @@
+"""rsync-over-ssh transport driver.
+
+rsync-over-ssh NAS transport design (2026-06-10). Mirrors
+:class:`~exlab_wizard.sync.transports.rclone.RcloneDriver`'s
+thin-wrapper philosophy: build an argv, hand it to
+:func:`~exlab_wizard.sync.transports._run.run_subprocess`, classify the
+outcome. Every op is built from rsync protocol primitives only — the
+NAS allowlists exactly the ``rsync --server`` ssh channel (no other
+remote command execution, no interactive login, no SFTP), so there is
+no ``ssh host df`` / ``find`` / ``sha256sum`` anywhere in this module.
+
+Targets are full ``user@host:/path`` strings composed by the caller
+(the same ``<remote>:<path>`` shape the rclone driver receives).
+Credentials are ssh keys only (``BatchMode=yes``); host keys are
+pre-provisioned in ``known_hosts`` via ``ssh-keyscan`` during setup.
+"""
+
+from __future__ import annotations
+
+import shlex
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+from exlab_wizard.logging import get_logger
+from exlab_wizard.sync.manifest import parse_rsync_listing
+from exlab_wizard.sync.transports import (
+    TransportError,
+    TransportErrorKind,
+    TransportResult,
+)
+from exlab_wizard.sync.transports._run import run_subprocess
+from exlab_wizard.sync.transports.rclone import AboutResult, CheckResult
+
+if TYPE_CHECKING:
+    from exlab_wizard.sync.manifest import RemoteManifest
+
+__all__ = ["RsyncSshDriver"]
+
+_log = get_logger(__name__)
+
+
+# ssh-level failures that are configuration problems, not transient
+# network errors. Matched case-insensitively against stderr.
+_AUTH_FAILURE_MARKERS: tuple[str, ...] = (
+    "permission denied",
+    "host key verification failed",
+    "too many authentication failures",
+    "no supported authentication",
+)
+
+# rsync exit codes that are transient / retryable: 5 client-server
+# protocol start, 10 socket I/O, 12 protocol data stream, 23/24 partial
+# transfer (incl. vanished source files), 30 timeout, 35 daemon-connect
+# timeout. 255 is the ssh transport itself failing.
+_NETWORK_RETURNCODES: frozenset[int] = frozenset({5, 10, 12, 23, 24, 30, 35, 255})
+
+
+def _classify_failure(stderr: str, returncode: int) -> TransportErrorKind:
+    """Map a (stderr, returncode) into a :class:`TransportErrorKind`."""
+    lowered = stderr.lower()
+    if any(marker in lowered for marker in _AUTH_FAILURE_MARKERS):
+        return TransportErrorKind.AUTH
+    if returncode in _NETWORK_RETURNCODES:
+        return TransportErrorKind.NETWORK
+    return TransportErrorKind.UNKNOWN
+
+
+def _synthesize_check(requested: tuple[str, ...], stdout: str) -> CheckResult:
+    """Translate dry-run itemized output into a :class:`CheckResult`.
+
+    Itemize lines are ``YXcstpoguax <path>`` — an update-type char, a
+    file-type char, then attribute flags. The attribute tail is 9 chars
+    in rsync 3.x and shorter in openrsync, so flags are read
+    positionally from the front, never by total length. Only
+    regular-file lines (``f`` at index 1) participate; ``.``-type lines
+    (no transfer needed) and unmatched lines fall through to ``equal``.
+    """
+    differ: list[str] = []
+    missing: list[str] = []
+    flagged: set[str] = set()
+    for raw_line in stdout.splitlines():
+        line = raw_line.rstrip()
+        flags, sep, path = line.partition(" ")
+        path = path.strip()
+        if not sep or not path or len(flags) < 3:
+            continue
+        if flags[0] not in "<>ch." or flags[1] != "f":
+            continue
+        tail = flags[2:]
+        if tail and all(ch == "+" for ch in tail):
+            missing.append(path)
+            flagged.add(path)
+        elif flags[2] == "c":
+            differ.append(path)
+            flagged.add(path)
+        # any other combination (e.g. ``.f..t......``) is an attr-only
+        # change: content equal under --checksum -> credited via `equal`.
+    equal = tuple(rel for rel in requested if rel not in flagged)
+    return CheckResult(
+        equal=equal, differ=tuple(differ), missing_on_dst=tuple(missing)
+    )
+
+
+class RsyncSshDriver:
+    """rsync-over-ssh transport driver (implements ``NasTransportDriver``)."""
+
+    def __init__(
+        self,
+        *,
+        binary: str = "rsync",
+        ssh_port: int = 22,
+        ssh_identity_file: str = "",
+    ) -> None:
+        self._binary = binary
+        self._ssh_port = ssh_port
+        self._ssh_identity_file = ssh_identity_file
+
+    def _ssh_command(self) -> str:
+        """Render the ``-e`` remote-shell string.
+
+        ``BatchMode=yes`` is mandatory: an unknown host key or a key
+        passphrase prompt must fail fast (classified AUTH) rather than
+        hang the sync worker. No ``StrictHostKeyChecking`` relaxation —
+        host keys are pre-provisioned via ``ssh-keyscan``.
+        """
+        parts = ["ssh", "-p", str(self._ssh_port), "-o", "BatchMode=yes"]
+        if self._ssh_identity_file:
+            parts.extend(["-i", str(Path(self._ssh_identity_file).expanduser())])
+        return shlex.join(parts)
+
+    async def push(
+        self,
+        local: Path,
+        remote: str,
+        *,
+        bwlimit_kibps: int | None = None,
+        files_from: Path | None = None,
+    ) -> TransportResult:
+        """Run ``rsync -rt`` from ``local`` to ``remote``.
+
+        ``-t`` is mandatory — the manifest reconcile tolerance and the
+        quiescence poller both depend on mtime preservation. The
+        trailing slash on the source copies the *contents* of ``local``
+        (matching ``rclone copy`` semantics). No ``--checksum`` on push:
+        integrity is owned by the verify path, not the transfer.
+        """
+        cmd: list[str] = [self._binary, "-rt", "-e", self._ssh_command()]
+        if bwlimit_kibps is not None and bwlimit_kibps > 0:
+            cmd.append(f"--bwlimit={bwlimit_kibps}")
+        if files_from is not None:
+            cmd.append(f"--files-from={files_from}")
+        cmd.extend([f"{local}/", remote])
+        _log.debug("rsync cmd: %s", shlex.join(cmd))
+
+        try:
+            rc, stdout, stderr = await run_subprocess(cmd)
+        except FileNotFoundError as exc:
+            msg = f"rsync binary not found: {self._binary!r}"
+            raise TransportError(msg) from exc
+
+        if rc == 0:
+            return TransportResult(ok=True, returncode=0, stdout=stdout, stderr=stderr)
+        kind = _classify_failure(stderr, rc)
+        _log.warning("rsync push failed rc=%d kind=%s", rc, kind.value)
+        return TransportResult(
+            ok=False, error_kind=kind, stderr=stderr, stdout=stdout, returncode=rc
+        )
+
+    async def check(
+        self, local: Path, remote: str, *, files_from: Path
+    ) -> CheckResult:
+        """Content verify via ``rsync -rni --checksum`` dry-run (resolved OQ-1).
+
+        The remote rsync hashes whole files inside the rsync protocol
+        (the same allowlisted channel as push — no separate remote
+        command). Itemized output is synthesized into a
+        :class:`CheckResult`: checksum-differ flag → ``differ``, all-+
+        creation → ``missing_on_dst``, and ``equal`` is reconstructed as
+        the ``files_from`` list minus the itemized paths (matching files
+        are simply omitted from dry-run output). ``extra_on_dst`` is
+        always ``()`` — a push-direction dry-run cannot see remote-only
+        files; harmless, it never flips ``VerifyResult.ok``.
+
+        Raises :class:`TransportError` with a classified ``error_kind``
+        on any non-zero exit (rsync dry-runs exit 0 even when files
+        differ; non-zero means the run itself failed).
+        """
+        cmd: list[str] = [
+            self._binary,
+            "-rni",
+            "--checksum",
+            "-e",
+            self._ssh_command(),
+            f"--files-from={files_from}",
+            f"{local}/",
+            remote,
+        ]
+        _log.debug("rsync check cmd: %s", shlex.join(cmd))
+        try:
+            rc, stdout, stderr = await run_subprocess(cmd)
+        except FileNotFoundError as exc:
+            msg = f"rsync binary not found: {self._binary!r}"
+            raise TransportError(msg) from exc
+        if rc != 0:
+            kind = _classify_failure(stderr, rc)
+            msg = f"rsync check failed rc={rc} kind={kind.value}: {stderr.strip()}"
+            raise TransportError(msg, error_kind=kind)
+
+        try:
+            requested = tuple(
+                line.strip()
+                for line in files_from.read_text(encoding="utf-8").splitlines()  # noqa: ASYNC240
+                if line.strip()
+            )
+        except OSError:
+            requested = ()
+        return _synthesize_check(requested, stdout)
+
+    async def lsjson_manifest(
+        self, remote: str, *, strip_prefix: str = ""
+    ) -> RemoteManifest:
+        """List the remote subtree via ``--list-only -r`` (resolved OQ-2).
+
+        ``strip_prefix`` is accepted for protocol parity but ignored —
+        rsync listings are already relative to the listed target (the
+        rclone lsjson path is run-rooted and needs stripping; this one
+        is not). Raises :class:`TransportError` with a classified
+        ``error_kind`` on non-zero exit, mirroring
+        :meth:`RcloneDriver.lsjson`.
+        """
+        del strip_prefix
+        cmd: list[str] = [
+            self._binary,
+            "--list-only",
+            "-r",
+            "--no-h",
+            "-e",
+            self._ssh_command(),
+            f"{remote}/",
+        ]
+        _log.debug("rsync list cmd: %s", shlex.join(cmd))
+        try:
+            rc, stdout, stderr = await run_subprocess(cmd)
+        except FileNotFoundError as exc:
+            msg = f"rsync binary not found: {self._binary!r}"
+            raise TransportError(msg) from exc
+        if rc != 0:
+            kind = _classify_failure(stderr, rc)
+            msg = f"rsync list failed rc={rc} kind={kind.value}: {stderr.strip()}"
+            raise TransportError(msg, error_kind=kind)
+        return parse_rsync_listing(stdout)
+
+    async def about(self, remote: str) -> AboutResult:
+        """Reachability + auth probe: non-recursive ``--list-only`` of ``remote``.
+
+        Free-space info is unobtainable without remote command exec
+        (which IT blocks), so ``info`` is always empty — the Settings
+        panel already tolerates that (resolved OQ-5). rc 23 with no
+        listing output means the path itself is absent: surfaced as a
+        configuration reason, not a retryable network error
+        (spec-review carve-out).
+        """
+        cmd: list[str] = [
+            self._binary,
+            "--list-only",
+            "--no-h",
+            "-e",
+            self._ssh_command(),
+            f"{remote}/",
+        ]
+        _log.debug("rsync about cmd: %s", shlex.join(cmd))
+        try:
+            rc, stdout, stderr = await run_subprocess(cmd)
+        except FileNotFoundError:
+            return AboutResult(ok=False, reason="rsync binary not found")
+        if rc == 0:
+            return AboutResult(ok=True, info={})
+        if rc == 23 and not stdout.strip():
+            return AboutResult(
+                ok=False, reason="base_root not found or inaccessible on the NAS"
+            )
+        kind = _classify_failure(stderr, rc)
+        return AboutResult(ok=False, reason=f"{kind.value}: {stderr.strip()}")
diff --git a/tests/unit/sync/transports/test_rsync_ssh.py b/tests/unit/sync/transports/test_rsync_ssh.py
new file mode 100644
index 0000000..b5866dd
--- /dev/null
+++ b/tests/unit/sync/transports/test_rsync_ssh.py
@@ -0,0 +1,119 @@
+"""Unit tests for the rsync-over-ssh transport driver.
+
+rsync-over-ssh NAS transport design (2026-06-10). ``run_subprocess`` is
+monkeypatched so no real binary is spawned; the docker integration leg
+covers the real wire path.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from exlab_wizard.sync.transports import TransportError, TransportErrorKind
+from exlab_wizard.sync.transports.rsync_ssh import (
+    RsyncSshDriver,
+    _classify_failure,
+)
+
+TARGET = "svc-sync@nas01:/volume1/lab/EQ1/Run_1"
+
+
+class FakeRun:
+    """Recordable stand-in for ``run_subprocess``."""
+
+    def __init__(self, rc: int = 0, stdout: str = "", stderr: str = "") -> None:
+        self.rc, self.stdout, self.stderr = rc, stdout, stderr
+        self.cmds: list[list[str]] = []
+
+    async def __call__(self, cmd: list[str]) -> tuple[int, str, str]:
+        self.cmds.append(cmd)
+        return self.rc, self.stdout, self.stderr
+
+
+@pytest.fixture
+def fake_run(monkeypatch):
+    def _install(rc: int = 0, stdout: str = "", stderr: str = "") -> FakeRun:
+        fake = FakeRun(rc, stdout, stderr)
+        monkeypatch.setattr(
+            "exlab_wizard.sync.transports.rsync_ssh.run_subprocess", fake
+        )
+        return fake
+
+    return _install
+
+
+class TestClassifyFailure:
+    @pytest.mark.parametrize(
+        "stderr",
+        [
+            "svc-sync@nas01: Permission denied (publickey,password).",
+            "Host key verification failed.",
+            "Too many authentication failures",
+        ],
+    )
+    def test_auth_markers(self, stderr: str) -> None:
+        assert _classify_failure(stderr, 255) == TransportErrorKind.AUTH
+
+    def test_ssh_failure_without_auth_marker_is_network(self) -> None:
+        assert (
+            _classify_failure("ssh: connect to host nas01: Connection refused", 255)
+            == TransportErrorKind.NETWORK
+        )
+
+    @pytest.mark.parametrize("rc", [5, 10, 12, 23, 24, 30, 35])
+    def test_protocol_and_partial_codes_are_network(self, rc: int) -> None:
+        assert _classify_failure("", rc) == TransportErrorKind.NETWORK
+
+    def test_other_nonzero_is_unknown(self) -> None:
+        assert _classify_failure("rsync: syntax error", 1) == TransportErrorKind.UNKNOWN
+
+
+class TestPush:
+    async def test_success_argv_shape(self, fake_run, tmp_path: Path) -> None:
+        run = fake_run(rc=0)
+        driver = RsyncSshDriver(ssh_port=2222, ssh_identity_file="/keys/id_exlab")
+        result = await driver.push(tmp_path, TARGET, bwlimit_kibps=512)
+        assert result.ok
+        cmd = run.cmds[0]
+        assert cmd[0] == "rsync"
+        assert "-rt" in cmd
+        assert "--bwlimit=512" in cmd
+        assert cmd[-2] == f"{tmp_path}/"
+        assert cmd[-1] == TARGET
+        ssh_arg = cmd[cmd.index("-e") + 1]
+        assert "-p 2222" in ssh_arg
+        assert "-i /keys/id_exlab" in ssh_arg
+        assert "BatchMode=yes" in ssh_arg
+
+    async def test_files_from_forwarded(self, fake_run, tmp_path: Path) -> None:
+        run = fake_run(rc=0)
+        listing = tmp_path / "files.txt"
+        listing.write_text("a.csv\n", encoding="utf-8")
+        await RsyncSshDriver().push(tmp_path, TARGET, files_from=listing)
+        assert f"--files-from={listing}" in run.cmds[0]
+
+    async def test_no_bwlimit_flag_when_unset(self, fake_run, tmp_path: Path) -> None:
+        run = fake_run(rc=0)
+        await RsyncSshDriver().push(tmp_path, TARGET)
+        assert not any(arg.startswith("--bwlimit") for arg in run.cmds[0])
+
+    async def test_auth_failure_classified(self, fake_run, tmp_path: Path) -> None:
+        fake_run(rc=255, stderr="Permission denied (publickey).")
+        result = await RsyncSshDriver().push(tmp_path, TARGET)
+        assert not result.ok
+        assert result.error_kind == TransportErrorKind.AUTH
+
+    async def test_missing_binary_raises_transport_error(
+        self, monkeypatch, tmp_path: Path
+    ) -> None:
+        async def boom(cmd):
+            raise FileNotFoundError(cmd[0])
+
+        monkeypatch.setattr(
+            "exlab_wizard.sync.transports.rsync_ssh.run_subprocess", boom
+        )
+        with pytest.raises(TransportError) as excinfo:
+            await RsyncSshDriver().push(tmp_path, TARGET)
+        assert excinfo.value.error_kind is None

From d7b0acd204e8b54fefde8d8a7dc9d7e9faf22957 Mon Sep 17 00:00:00 2001
From: Alexander Nguyen <alxxander.nguyen@protonmail.com>
Date: Wed, 10 Jun 2026 01:35:28 -0700
Subject: [PATCH 08/21] feat(sync): RsyncSshDriver.check via --checksum dry-run
 itemize

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 tests/unit/sync/transports/test_rsync_ssh.py | 59 ++++++++++++++++++++
 1 file changed, 59 insertions(+)

diff --git a/tests/unit/sync/transports/test_rsync_ssh.py b/tests/unit/sync/transports/test_rsync_ssh.py
index b5866dd..eb98606 100644
--- a/tests/unit/sync/transports/test_rsync_ssh.py
+++ b/tests/unit/sync/transports/test_rsync_ssh.py
@@ -117,3 +117,62 @@ async def boom(cmd):
         with pytest.raises(TransportError) as excinfo:
             await RsyncSshDriver().push(tmp_path, TARGET)
         assert excinfo.value.error_kind is None
+
+
+def _files_from(tmp_path: Path, names: list[str]) -> Path:
+    listing = tmp_path / "files-from.txt"
+    listing.write_text("".join(f"{n}\n" for n in names), encoding="utf-8")
+    return listing
+
+
+class TestCheck:
+    async def test_all_equal_when_nothing_itemized(self, fake_run, tmp_path: Path) -> None:
+        run = fake_run(rc=0, stdout="")
+        listing = _files_from(tmp_path, ["a.csv", "sub/b.csv"])
+        result = await RsyncSshDriver().check(tmp_path, TARGET, files_from=listing)
+        assert set(result.equal) == {"a.csv", "sub/b.csv"}
+        assert result.differ == () and result.missing_on_dst == ()
+        cmd = run.cmds[0]
+        assert "--checksum" in cmd
+        assert "-rni" in cmd  # dry-run + itemize
+
+    async def test_checksum_differ_flag(self, fake_run, tmp_path: Path) -> None:
+        fake_run(rc=0, stdout=">fcst...... a.csv\n")
+        listing = _files_from(tmp_path, ["a.csv", "b.csv"])
+        result = await RsyncSshDriver().check(tmp_path, TARGET, files_from=listing)
+        assert result.differ == ("a.csv",)
+        assert result.equal == ("b.csv",)
+
+    async def test_all_plus_means_missing_on_dst(self, fake_run, tmp_path: Path) -> None:
+        fake_run(rc=0, stdout=">f+++++++++ new file.csv\n")
+        listing = _files_from(tmp_path, ["new file.csv"])
+        result = await RsyncSshDriver().check(tmp_path, TARGET, files_from=listing)
+        assert result.missing_on_dst == ("new file.csv",)
+        assert result.equal == ()
+
+    async def test_short_openrsync_flags_handled(self, fake_run, tmp_path: Path) -> None:
+        # openrsync (macOS dev machines) emits 7-char itemize tails.
+        fake_run(rc=0, stdout=">f+++++++ x.csv\n")
+        listing = _files_from(tmp_path, ["x.csv"])
+        result = await RsyncSshDriver().check(tmp_path, TARGET, files_from=listing)
+        assert result.missing_on_dst == ("x.csv",)
+
+    async def test_attr_only_lines_count_as_equal(self, fake_run, tmp_path: Path) -> None:
+        # '.' update-type = no transfer needed; content equal under --checksum.
+        fake_run(rc=0, stdout=".f..t...... a.csv\n")
+        listing = _files_from(tmp_path, ["a.csv"])
+        result = await RsyncSshDriver().check(tmp_path, TARGET, files_from=listing)
+        assert result.equal == ("a.csv",)
+
+    async def test_directory_lines_ignored(self, fake_run, tmp_path: Path) -> None:
+        fake_run(rc=0, stdout="cd+++++++++ sub/\n>fcst...... sub/b.csv\n")
+        listing = _files_from(tmp_path, ["sub/b.csv"])
+        result = await RsyncSshDriver().check(tmp_path, TARGET, files_from=listing)
+        assert result.differ == ("sub/b.csv",)
+
+    async def test_nonzero_rc_raises_classified(self, fake_run, tmp_path: Path) -> None:
+        fake_run(rc=255, stderr="Permission denied (publickey).")
+        listing = _files_from(tmp_path, ["a.csv"])
+        with pytest.raises(TransportError) as excinfo:
+            await RsyncSshDriver().check(tmp_path, TARGET, files_from=listing)
+        assert excinfo.value.error_kind == TransportErrorKind.AUTH

From 70ba62966948a4dc1ca729edd317b2aa2cb33bb4 Mon Sep 17 00:00:00 2001
From: Alexander Nguyen <alxxander.nguyen@protonmail.com>
Date: Wed, 10 Jun 2026 01:36:08 -0700
Subject: [PATCH 09/21] feat(sync): RsyncSshDriver listing manifest +
 reachability probe

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 tests/unit/sync/transports/test_rsync_ssh.py | 58 ++++++++++++++++++++
 1 file changed, 58 insertions(+)

diff --git a/tests/unit/sync/transports/test_rsync_ssh.py b/tests/unit/sync/transports/test_rsync_ssh.py
index eb98606..b6d0226 100644
--- a/tests/unit/sync/transports/test_rsync_ssh.py
+++ b/tests/unit/sync/transports/test_rsync_ssh.py
@@ -176,3 +176,61 @@ async def test_nonzero_rc_raises_classified(self, fake_run, tmp_path: Path) -> N
         with pytest.raises(TransportError) as excinfo:
             await RsyncSshDriver().check(tmp_path, TARGET, files_from=listing)
         assert excinfo.value.error_kind == TransportErrorKind.AUTH
+
+
+class TestLsjsonManifest:
+    async def test_listing_parsed_and_prefix_ignored(self, fake_run, tmp_path: Path) -> None:
+        from datetime import datetime
+
+        stamp = datetime.fromtimestamp(1_750_000_000).strftime("%Y/%m/%d %H:%M:%S")
+        run = fake_run(
+            rc=0,
+            stdout=(
+                f"drwxr-xr-x          4096 {stamp} .\n"
+                f"-rw-r--r--          2048 {stamp} data file.csv\n"
+            ),
+        )
+        manifest = await RsyncSshDriver().lsjson_manifest(
+            TARGET, strip_prefix="volume1/lab/EQ1/Run_1"
+        )
+        assert set(manifest.entries) == {"data file.csv"}
+        cmd = run.cmds[0]
+        assert "--list-only" in cmd and "-r" in cmd and "--no-h" in cmd
+        assert cmd[-1] == f"{TARGET}/"
+
+    async def test_failure_raises_classified(self, fake_run) -> None:
+        fake_run(rc=255, stderr="ssh: connect to host nas01: Connection refused")
+        with pytest.raises(TransportError) as excinfo:
+            await RsyncSshDriver().lsjson_manifest(TARGET)
+        assert excinfo.value.error_kind == TransportErrorKind.NETWORK
+
+
+class TestAbout:
+    async def test_reachable_returns_ok_empty_info(self, fake_run) -> None:
+        run = fake_run(rc=0, stdout="drwxr-xr-x 4096 2026/06/10 00:00:00 .\n")
+        result = await RsyncSshDriver().about("svc-sync@nas01:/volume1/lab")
+        assert result.ok and result.info == {}
+        assert "-r" not in run.cmds[0]  # non-recursive probe
+
+    async def test_missing_base_root_is_config_reason(self, fake_run) -> None:
+        fake_run(rc=23, stdout="", stderr='rsync: change_dir "/volume1/lab" failed')
+        result = await RsyncSshDriver().about("svc-sync@nas01:/volume1/lab")
+        assert not result.ok
+        assert result.reason is not None
+        assert "base_root" in result.reason
+
+    async def test_auth_failure_reason(self, fake_run) -> None:
+        fake_run(rc=255, stderr="Permission denied (publickey).")
+        result = await RsyncSshDriver().about("svc-sync@nas01:/volume1/lab")
+        assert not result.ok
+        assert result.reason is not None and result.reason.startswith("auth")
+
+    async def test_missing_binary_reason(self, monkeypatch) -> None:
+        async def boom(cmd):
+            raise FileNotFoundError(cmd[0])
+
+        monkeypatch.setattr(
+            "exlab_wizard.sync.transports.rsync_ssh.run_subprocess", boom
+        )
+        result = await RsyncSshDriver().about("svc-sync@nas01:/volume1/lab")
+        assert not result.ok and result.reason == "rsync binary not found"

From 22e440c5817262b3e2a796de17f641d6b26f1a62 Mon Sep 17 00:00:00 2001
From: Alexander Nguyen <alxxander.nguyen@protonmail.com>
Date: Wed, 10 Jun 2026 01:37:19 -0700
Subject: [PATCH 10/21] feat(sync): build_nas_driver transport factory

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 src/exlab_wizard/sync/transports/__init__.py | 33 ++++++++++++++++++++
 tests/unit/sync/test_transports.py           | 25 +++++++++++++++
 2 files changed, 58 insertions(+)

diff --git a/src/exlab_wizard/sync/transports/__init__.py b/src/exlab_wizard/sync/transports/__init__.py
index b0a35e5..2bfe929 100644
--- a/src/exlab_wizard/sync/transports/__init__.py
+++ b/src/exlab_wizard/sync/transports/__init__.py
@@ -15,6 +15,7 @@
 if TYPE_CHECKING:
     from pathlib import Path
 
+    from exlab_wizard.config.models import NasConfig, RclonePerf
     from exlab_wizard.sync.manifest import RemoteManifest
     from exlab_wizard.sync.transports.rclone import AboutResult, CheckResult
 
@@ -23,6 +24,7 @@
     "TransportError",
     "TransportErrorKind",
     "TransportResult",
+    "build_nas_driver",
 ]
 
 
@@ -123,3 +125,34 @@ def __init__(
     ) -> None:
         super().__init__(message)
         self.error_kind = error_kind
+
+
+def build_nas_driver(nas: NasConfig, perf: RclonePerf) -> NasTransportDriver:
+    """Construct the NAS transport driver selected by ``nas.transport``.
+
+    The single factory every construction site routes through
+    (``nas_client``, the tray probe/gate hydration, test helpers).
+    Imports are local so importing this package stays cheap and free of
+    cycles (the driver modules import this package's DTOs).
+
+    NOTE: this selects for **nas-mode** equipment only. Stage-mode
+    equipment always uses a directly-constructed ``RcloneDriver`` (its
+    targets are rclone named remotes) — see
+    ``NASSyncClient._driver_for_equipment``.
+    """
+    from exlab_wizard.constants import SyncTransport
+
+    if nas.transport == SyncTransport.RSYNC_SSH:
+        from exlab_wizard.sync.transports.rsync_ssh import RsyncSshDriver
+
+        return RsyncSshDriver(
+            ssh_port=nas.ssh_port,
+            ssh_identity_file=nas.ssh_identity_file,
+        )
+    from exlab_wizard.sync.transports.rclone import RcloneDriver
+
+    return RcloneDriver(
+        config_path=nas.rclone_config_path or None,
+        transfers=perf.transfers,
+        checkers=perf.checkers,
+    )
diff --git a/tests/unit/sync/test_transports.py b/tests/unit/sync/test_transports.py
index d79ae10..f024ba2 100644
--- a/tests/unit/sync/test_transports.py
+++ b/tests/unit/sync/test_transports.py
@@ -461,3 +461,28 @@ def test_rclone_driver_satisfies_protocol() -> None:
 
     driver: NasTransportDriver = RcloneDriver()
     assert driver is not None
+
+
+class TestBuildNasDriver:
+    def test_rclone_default(self) -> None:
+        from exlab_wizard.config.models import NasConfig, RclonePerf
+        from exlab_wizard.sync.transports import build_nas_driver
+        from exlab_wizard.sync.transports.rclone import RcloneDriver
+
+        driver = build_nas_driver(NasConfig(remote="nas01"), RclonePerf())
+        assert isinstance(driver, RcloneDriver)
+
+    def test_rsync_ssh_selected(self) -> None:
+        from exlab_wizard.config.models import NasConfig, RclonePerf
+        from exlab_wizard.sync.transports import build_nas_driver
+        from exlab_wizard.sync.transports.rsync_ssh import RsyncSshDriver
+
+        nas = NasConfig(
+            transport="rsync_ssh",
+            remote="svc-sync@nas01",
+            ssh_port=2222,
+            ssh_identity_file="~/.ssh/id_exlab",
+        )
+        driver = build_nas_driver(nas, RclonePerf())
+        assert isinstance(driver, RsyncSshDriver)
+        assert driver._ssh_port == 2222

From dd689097402f336bdf3a6b6987c5462d3e116cfb Mon Sep 17 00:00:00 2001
From: Alexander Nguyen <alxxander.nguyen@protonmail.com>
Date: Wed, 10 Jun 2026 01:45:34 -0700
Subject: [PATCH 11/21] feat(sync): route NASSyncClient through
 build_nas_driver with stage-mode rclone bypass

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 src/exlab_wizard/sync/nas_client.py | 56 ++++++++++++-----------------
 tests/unit/sync/test_nas_client.py  | 47 ++++++++++++++++++++++++
 2 files changed, 70 insertions(+), 33 deletions(-)

diff --git a/src/exlab_wizard/sync/nas_client.py b/src/exlab_wizard/sync/nas_client.py
index 0dee14a..4b092b8 100644
--- a/src/exlab_wizard/sync/nas_client.py
+++ b/src/exlab_wizard/sync/nas_client.py
@@ -41,7 +41,7 @@
 from exlab_wizard.sync.bandwidth import effective_bandwidth_limit_kibps
 from exlab_wizard.sync.cleanup import cleanup_interlocks_satisfied
 from exlab_wizard.sync.file_stability import wait_until_stable
-from exlab_wizard.sync.manifest import RemoteManifest, parse_lsjson
+from exlab_wizard.sync.manifest import RemoteManifest
 from exlab_wizard.sync.pre_sync_gate import is_eligible
 from exlab_wizard.sync.queue import (
     SyncJobRow,
@@ -50,9 +50,11 @@
 )
 from exlab_wizard.sync.run_delete import collect_cleanup_candidates, delete_run_files
 from exlab_wizard.sync.transports import (
+    NasTransportDriver,
     TransportError,
     TransportErrorKind,
     TransportResult,
+    build_nas_driver,
 )
 from exlab_wizard.sync.transports.rclone import RcloneDriver
 from exlab_wizard.sync.verifier import VerifyResult
@@ -129,26 +131,6 @@ def _matches_any_glob(name: str, globs: list[str]) -> bool:
     return any(fnmatch.fnmatch(name, pattern) for pattern in globs)
 
 
-def _build_driver(config_path: str, perf: RclonePerf) -> RcloneDriver:
-    """Construct a :class:`RcloneDriver` for a named remote.
-
-    The named remote lives in the operator's ``rclone.conf`` (set up with
-    ``rclone config``); the driver only needs the optional ``--config``
-    path override plus the parallelism dials. No keyring / env threading —
-    credentials are entirely the named remote's concern.
-
-    Both the NAS leg and the orchestrator stage hop share the same
-    ``rclone.conf`` (their remotes live side by side), so the config path
-    is always ``nas.rclone_config_path``; only the perf dial differs by
-    ``sync_mode`` (the ``nas:`` block's ``perf`` vs
-    ``orchestrator.staging_perf``).
-    """
-    return RcloneDriver(
-        config_path=config_path or None,
-        transfers=perf.transfers,
-        checkers=perf.checkers,
-    )
-
 
 @dataclass(frozen=True, slots=True)
 class _RemoteResolution:
@@ -726,17 +708,26 @@ def _target_for_equipment(self, equipment: EquipmentConfig, run: Path) -> str:
         subpath = _remote_subpath(resolution.base_root, equipment.id, run)
         return f"{resolution.remote}:/{subpath}"
 
-    def _driver_for_equipment(self, equipment: EquipmentConfig) -> RcloneDriver:
-        """Build the :class:`RcloneDriver` for ``equipment``.
-
-        The perf dials come from :meth:`_resolve_remote` (``staging_perf`` for
-        stage-mode, the ``nas:`` block's ``perf`` otherwise). Every equipment
-        shares ``nas.rclone_config_path`` as the ``--config`` override -- the
-        staging and NAS remotes live in the same ``rclone.conf``.
+    def _driver_for_equipment(self, equipment: EquipmentConfig) -> NasTransportDriver:
+        """Build the transport driver for ``equipment``.
+
+        ``nas.transport`` selects the driver **only for nas-mode
+        equipment**. Stage-mode targets are rclone named-remote strings
+        (``<staging_remote>:<path>``), so stage-mode always gets a
+        directly-constructed :class:`RcloneDriver` regardless of
+        ``nas.transport`` — handing an rsync driver a staging target
+        would attempt ssh to a host named after the staging remote
+        (spec-review blocker, 2026-06-10). The hidden staging backend
+        must keep working (see CLAUDE.md).
         """
-        return _build_driver(
-            self._config.nas.rclone_config_path, self._resolve_remote(equipment).perf
-        )
+        resolution = self._resolve_remote(equipment)
+        if equipment.sync_mode == SyncMode.STAGE:
+            return RcloneDriver(
+                config_path=self._config.nas.rclone_config_path or None,
+                transfers=resolution.perf.transfers,
+                checkers=resolution.perf.checkers,
+            )
+        return build_nas_driver(self._config.nas, resolution.perf)
 
     def _build_push(self, equipment: EquipmentConfig) -> Callable[..., Any]:
         """Resolve the push callable for ``equipment``.
@@ -802,9 +793,8 @@ def _build_lsjson(self, equipment: EquipmentConfig) -> Callable[..., Any]:
 
         async def _lsjson(run: Path) -> RemoteManifest:
             target = self._target_for_equipment(equipment, run)
-            raw = await driver.lsjson(target)
             prefix = _remote_subpath(base_root, equipment.id, run)
-            return parse_lsjson(raw, strip_prefix=prefix)
+            return await driver.lsjson_manifest(target, strip_prefix=prefix)
 
         return _lsjson
 
diff --git a/tests/unit/sync/test_nas_client.py b/tests/unit/sync/test_nas_client.py
index f6fa866..a06bc78 100644
--- a/tests/unit/sync/test_nas_client.py
+++ b/tests/unit/sync/test_nas_client.py
@@ -978,3 +978,50 @@ async def _push_recorded() -> bool:
         f"bandwidth cap {recorded[0]!r} KiB/s does not match "
         f"nas.bandwidth-derived cap {expected_kibps!r} KiB/s"
     )
+
+
+# ---------------------------------------------------------------------------
+# Transport driver selection (rsync-over-ssh NAS transport, 2026-06-10)
+# ---------------------------------------------------------------------------
+
+
+class TestDriverSelection:
+    # _client_for_target_test (defined ~line 774 of this module) already
+    # builds a NASSyncClient from a bare Config — reuse it.
+
+    def test_nas_mode_rsync_transport_selected(self, tmp_path: Path) -> None:
+        from exlab_wizard.sync.transports.rsync_ssh import RsyncSshDriver
+
+        config = Config(
+            paths=PathsConfig(app_root=str(tmp_path)),
+            nas=NasConfig(
+                transport="rsync_ssh", remote="svc-sync@nas01", base_root="/volume1/lab"
+            ),
+            equipment=[EquipmentConfig(id="EQ1", label="Eq 1", nas_root="/nas")],
+        )
+        client = _client_for_target_test(config, tmp_path)
+        driver = client._driver_for_equipment(config.equipment[0])
+        assert isinstance(driver, RsyncSshDriver)
+
+    def test_stage_mode_always_rclone_even_with_rsync_transport(
+        self, tmp_path: Path
+    ) -> None:
+        from exlab_wizard.sync.transports.rclone import RcloneDriver
+
+        config = Config(
+            paths=PathsConfig(app_root=str(tmp_path)),
+            nas=NasConfig(
+                transport="rsync_ssh", remote="svc-sync@nas01", base_root="/volume1/lab"
+            ),
+            orchestrator=OrchestratorConfig(
+                label="WS1", staging_remote="stagepc", staging_base_root="/staging"
+            ),
+            equipment=[
+                EquipmentConfig(
+                    id="EQ1", label="Eq 1", nas_root="/nas", sync_mode=SyncMode.STAGE
+                )
+            ],
+        )
+        client = _client_for_target_test(config, tmp_path)
+        driver = client._driver_for_equipment(config.equipment[0])
+        assert isinstance(driver, RcloneDriver)

From 9b39e2b78761a5301ce70bd85219916cdcbc5d6e Mon Sep 17 00:00:00 2001
From: Alexander Nguyen <alxxander.nguyen@protonmail.com>
Date: Wed, 10 Jun 2026 01:46:44 -0700
Subject: [PATCH 12/21] refactor(sync): Verifier takes NasTransportDriver, drop
 vestigial no-arg default

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 src/exlab_wizard/sync/verifier.py | 37 ++++++++++++++-----------------
 1 file changed, 17 insertions(+), 20 deletions(-)

diff --git a/src/exlab_wizard/sync/verifier.py b/src/exlab_wizard/sync/verifier.py
index 41b62df..7973597 100644
--- a/src/exlab_wizard/sync/verifier.py
+++ b/src/exlab_wizard/sync/verifier.py
@@ -1,18 +1,18 @@
-"""SHA-256 verifier wrapper around ``rclone check --download``.
+"""Transport check-op wrapper for NAS integrity verification.
 
-Rclone-only NAS sync migration (2026-05-26). The verifier is now a thin
-adapter over :meth:`exlab_wizard.sync.transports.rclone.RcloneDriver.check`
-that translates a :class:`CheckResult` into the :class:`VerifyResult`
-shape the queue worker already consumes. The actual integrity guarantee
-comes from ``rclone check --download --combined`` -- rclone streams the
-remote files back to the wizard, hashes them locally, and writes a
-``=/*/+/-/!`` line per file to a tempfile that the driver parses.
+rsync-over-ssh NAS transport (2026-06-10). The verifier wraps the
+transport's ``check`` op (rclone ``check --download`` or the rsync
+``--checksum`` dry-run) and translates a :class:`CheckResult` into the
+:class:`VerifyResult` shape the queue worker already consumes. The actual
+integrity guarantee comes from the transport driver's content-equality
+check — rclone streams remote files back and hashes locally; rsync runs a
+``--checksum`` dry-run over the rsync protocol channel.
 
 The Slot A SHA-256 capture (the durable
 ``sync_state.json:files[*].verified_sha256`` field) is owned by
 :func:`exlab_wizard.sync.nas_client._compute_local_shas` -- the verifier
 itself never sees a local SHA. This keeps the verifier a leaf abstraction
-that depends only on the rclone driver, and keeps the SHA-capture logic
+that depends only on the transport driver, and keeps the SHA-capture logic
 local to the one code path that has access to the freshly-read local
 bytes.
 
@@ -31,7 +31,8 @@
 from exlab_wizard.sync.transports import TransportError, TransportErrorKind
 
 if TYPE_CHECKING:
-    from exlab_wizard.sync.transports.rclone import CheckResult, RcloneDriver
+    from exlab_wizard.sync.transports import NasTransportDriver
+    from exlab_wizard.sync.transports.rclone import CheckResult
 
 __all__ = ["Verifier", "VerifyResult"]
 
@@ -91,19 +92,15 @@ def from_check_result(cls, check_result: CheckResult) -> VerifyResult:
 
 
 class Verifier:
-    """Verifier: ``rclone check`` wrapper, no Python SHA pipeline.
+    """Constructed with a :class:`NasTransportDriver`; wraps the transport's check op.
 
-    Constructed with an :class:`RcloneDriver`; production callers pass
-    the same driver instance the push path uses so subprocess settings
-    (binary path, etc.) stay consistent. Tests can pass a stub driver
-    whose ``check`` returns a canned :class:`CheckResult`.
+    Production callers pass the same driver instance the push path uses
+    so subprocess settings (binary path, etc.) stay consistent. Tests can
+    pass a stub driver whose ``check`` returns a canned
+    :class:`CheckResult`.
     """
 
-    def __init__(self, driver: RcloneDriver | None = None) -> None:
-        if driver is None:
-            from exlab_wizard.sync.transports.rclone import RcloneDriver as _Driver
-
-            driver = _Driver()
+    def __init__(self, driver: NasTransportDriver) -> None:
         self._driver = driver
 
     async def verify(

From 4897c8d668ef9ef186d784efbd159fdbe389c51c Mon Sep 17 00:00:00 2001
From: Alexander Nguyen <alxxander.nguyen@protonmail.com>
Date: Wed, 10 Jun 2026 01:49:32 -0700
Subject: [PATCH 13/21] feat(tray): transport-aware NAS setup gate +
 Test-connection probe

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 src/exlab_wizard/tray/dependencies.py | 76 +++++++++++++++++++------
 tests/unit/tray/test_dependencies.py  | 82 +++++++++++++++++++++++----
 2 files changed, 129 insertions(+), 29 deletions(-)

diff --git a/src/exlab_wizard/tray/dependencies.py b/src/exlab_wizard/tray/dependencies.py
index 8efc2fd..4e85d98 100644
--- a/src/exlab_wizard/tray/dependencies.py
+++ b/src/exlab_wizard/tray/dependencies.py
@@ -146,7 +146,7 @@ def build_production_dependencies(state_dir: Path) -> AppDependencies:
     # operator's remotes once at boot via ``rclone listremotes`` and
     # expose a sync predicate the API's setup evaluator reads.
     deps.nas_remotes = _try("nas_remotes", _hydrate_nas_remotes, deps.config) or ()
-    deps.nas_remote_available = lambda remote: f"{remote}:" in deps.nas_remotes
+    deps.nas_remote_available = _nas_available_predicate(deps.config, deps.nas_remotes)
     deps.equipment_probe = _make_equipment_probe(deps)
 
     deps.session_store_snapshot = _make_session_store_snapshot(deps)
@@ -631,6 +631,13 @@ def _hydrate_nas_remotes(config: Any) -> tuple[str, ...]:
     nas = getattr(config, "nas", None)
     if nas is None:
         return ()
+    from exlab_wizard.constants import SyncTransport
+
+    if getattr(nas, "transport", SyncTransport.RCLONE) == SyncTransport.RSYNC_SSH:
+        # rsync-over-ssh transport (2026-06-10): rclone.conf is irrelevant
+        # and the rclone binary is likely absent on a cluster node — never
+        # spawn it; the gate uses the static ssh predicate instead.
+        return ()
     from exlab_wizard.sync.transports.rclone import RcloneDriver
 
     driver = RcloneDriver(config_path=getattr(nas, "rclone_config_path", "") or None)
@@ -640,20 +647,54 @@ def _hydrate_nas_remotes(config: Any) -> tuple[str, ...]:
         return ()
 
 
+def _nas_available_predicate(config: Any, remotes: tuple[str, ...]) -> Any:
+    """Build the setup-gate ``nas_remote_available`` callable by transport.
+
+    rclone mode keeps the historical "name present in the listremotes
+    snapshot" check. rsync_ssh mode is a static, offline predicate:
+    remote non-empty, and when ``ssh_identity_file`` is set the file
+    must exist. Network reachability stays behind Test-connection.
+    """
+    from exlab_wizard.constants import SyncTransport
+
+    nas = getattr(config, "nas", None)
+    if nas is not None and getattr(nas, "transport", None) == SyncTransport.RSYNC_SSH:
+
+        def _rsync_available(remote: str) -> bool:
+            if not remote:
+                return False
+            identity = str(getattr(nas, "ssh_identity_file", "") or "")
+            return not identity or Path(identity).expanduser().exists()
+
+        return _rsync_available
+    return lambda remote: f"{remote}:" in remotes
+
+
+def _probe_target(nas: Any) -> str:
+    """Compose the Test-connection probe target by transport.
+
+    rclone probes the bare remote root (``<remote>:``); rsync probes the
+    base root (``user@host:/<base_root>``) so a missing/locked path
+    surfaces as the configuration error it is.
+    """
+    from exlab_wizard.constants import SyncTransport
+
+    if getattr(nas, "transport", None) == SyncTransport.RSYNC_SSH:
+        base = str(getattr(nas, "base_root", "") or "").strip("/")
+        return f"{nas.remote}:/{base}" if base else f"{nas.remote}:/"
+    return f"{nas.remote}:"
+
+
 def _make_equipment_probe(deps: AppDependencies) -> Any:
     """Build the ``deps.equipment_probe`` callable.
 
-    rclone.conf NAS-sync migration. The "Test connection" probe now
-    targets the configured ``nas:`` remote rather than a per-equipment
-    keyring password: it runs ``rclone about <nas.remote>:`` through the
-    driver (using the operator's rclone.conf, optionally pinned by
-    ``nas.rclone_config_path``) and returns the canonical
-    ``{"ok", "reason", "latency_ms"}`` dict the endpoint surfaces.
-
-    A missing ``nas.remote`` short-circuits with
-    ``ok=False, reason="no NAS remote configured"`` -- the probe never
-    spawns rclone in that case so the operator sees the gate reason
-    rather than an opaque rclone error.
+    The "Test connection" probe targets the configured NAS remote and
+    returns the canonical ``{"ok", "reason", "latency_ms"}`` dict the
+    endpoint surfaces. In rclone mode it calls ``rclone about
+    <nas.remote>:``; in rsync_ssh mode it calls ``rsync --list-only``
+    against the base root. A missing ``nas.remote`` short-circuits with
+    ``ok=False, reason="no NAS remote configured"`` — the probe never
+    spawns the transport binary in that case.
     """
 
     async def _probe(equipment: Any) -> dict[str, Any]:
@@ -661,14 +702,15 @@ async def _probe(equipment: Any) -> dict[str, Any]:
         if nas is None or not nas.remote:
             return {"ok": False, "reason": "no NAS remote configured"}
         # Local import keeps ``tray.dependencies`` cheap to load (the
-        # rclone driver pulls in subprocess + asyncio plumbing the tray
-        # otherwise wouldn't need until first sync).
-        from exlab_wizard.sync.transports.rclone import RcloneDriver
+        # transport drivers pull in subprocess + asyncio plumbing the
+        # tray otherwise wouldn't need until first sync).
+        from exlab_wizard.sync.transports import build_nas_driver
 
-        driver = RcloneDriver(config_path=getattr(nas, "rclone_config_path", "") or None)
+        driver = build_nas_driver(nas, nas.perf)
+        target = _probe_target(nas)
         started = time.monotonic()
         try:
-            about = await driver.about(f"{nas.remote}:")
+            about = await driver.about(target)
         except Exception as exc:
             return {"ok": False, "reason": str(exc)}
         latency_ms = int((time.monotonic() - started) * 1000)
diff --git a/tests/unit/tray/test_dependencies.py b/tests/unit/tray/test_dependencies.py
index e4deb34..b4a9596 100644
--- a/tests/unit/tray/test_dependencies.py
+++ b/tests/unit/tray/test_dependencies.py
@@ -182,22 +182,19 @@ def __init__(self, *, ok: bool, reason: str | None = None) -> None:
 def test_make_equipment_probe_targets_nas_remote_not_keyring(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None:
-    """The probe must call ``rclone about <nas.remote>:`` and ignore the keyring."""
+    """The probe must call ``driver.about`` on the NAS target and ignore the keyring."""
     import asyncio
 
-    from exlab_wizard.sync.transports import rclone as rclone_module
+    from exlab_wizard.sync import transports as transports_module
 
     calls: list[str] = []
 
     class _StubDriver:
-        def __init__(self, *, config_path: str | None = None) -> None:
-            self.config_path = config_path
-
         async def about(self, remote: str, **_kwargs: object) -> _StubAbout:
             calls.append(remote)
             return _StubAbout(ok=True)
 
-    monkeypatch.setattr(rclone_module, "RcloneDriver", _StubDriver)
+    monkeypatch.setattr(transports_module, "build_nas_driver", lambda *a, **k: _StubDriver())
 
     deps = build_production_dependencies(tmp_path)
     # No keyring password is set; the new probe must not consult it.
@@ -228,19 +225,16 @@ def test_make_equipment_probe_short_circuits_without_remote(tmp_path: Path) -> N
 def test_make_equipment_probe_surfaces_about_failure(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None:
-    """A failing ``rclone about`` surfaces as ``ok=False`` with the reason."""
+    """A failing ``driver.about`` surfaces as ``ok=False`` with the reason."""
     import asyncio
 
-    from exlab_wizard.sync.transports import rclone as rclone_module
+    from exlab_wizard.sync import transports as transports_module
 
     class _StubDriver:
-        def __init__(self, *, config_path: str | None = None) -> None:
-            self.config_path = config_path
-
         async def about(self, remote: str, **_kwargs: object) -> _StubAbout:
             return _StubAbout(ok=False, reason="auth_error: 401 Unauthorized")
 
-    monkeypatch.setattr(rclone_module, "RcloneDriver", _StubDriver)
+    monkeypatch.setattr(transports_module, "build_nas_driver", lambda *a, **k: _StubDriver())
 
     deps = build_production_dependencies(tmp_path)
     deps.config = _nas_config_with_remote("nas01")
@@ -276,3 +270,67 @@ async def listremotes(self) -> tuple[str, ...]:
     available = lambda remote: f"{remote}:" in remotes  # noqa: E731
     assert available("nas01") is True
     assert available("missing") is False
+
+
+class TestRsyncSshGate:
+    def _nas(self, **kw):
+        from exlab_wizard.config.models import NasConfig
+
+        return NasConfig(
+            transport="rsync_ssh", remote="svc-sync@nas01", base_root="/v1/lab", **kw
+        )
+
+    def test_hydrate_never_spawns_rclone_in_rsync_mode(self, monkeypatch) -> None:
+        from types import SimpleNamespace
+
+        from exlab_wizard.tray.dependencies import _hydrate_nas_remotes
+
+        def boom(*a, **k):
+            raise AssertionError("rclone must not be constructed in rsync mode")
+
+        monkeypatch.setattr(
+            "exlab_wizard.sync.transports.rclone.RcloneDriver", boom
+        )
+        config = SimpleNamespace(nas=self._nas())
+        assert _hydrate_nas_remotes(config) == ()
+
+    def test_predicate_true_when_identity_unset(self) -> None:
+        from types import SimpleNamespace
+
+        from exlab_wizard.tray.dependencies import _nas_available_predicate
+
+        config = SimpleNamespace(nas=self._nas())
+        predicate = _nas_available_predicate(config, ())
+        assert predicate("svc-sync@nas01") is True
+
+    def test_predicate_false_when_identity_missing(self, tmp_path) -> None:
+        from types import SimpleNamespace
+
+        from exlab_wizard.tray.dependencies import _nas_available_predicate
+
+        config = SimpleNamespace(
+            nas=self._nas(ssh_identity_file=str(tmp_path / "nope_key"))
+        )
+        predicate = _nas_available_predicate(config, ())
+        assert predicate("svc-sync@nas01") is False
+
+    def test_predicate_true_when_identity_exists(self, tmp_path) -> None:
+        from types import SimpleNamespace
+
+        from exlab_wizard.tray.dependencies import _nas_available_predicate
+
+        key = tmp_path / "id_exlab"
+        key.write_text("KEY", encoding="utf-8")
+        config = SimpleNamespace(nas=self._nas(ssh_identity_file=str(key)))
+        assert _nas_available_predicate(config, ())("svc-sync@nas01") is True
+
+    def test_rclone_predicate_unchanged(self) -> None:
+        from types import SimpleNamespace
+
+        from exlab_wizard.config.models import NasConfig
+        from exlab_wizard.tray.dependencies import _nas_available_predicate
+
+        config = SimpleNamespace(nas=NasConfig(remote="nas01"))
+        predicate = _nas_available_predicate(config, ("nas01:",))
+        assert predicate("nas01") is True
+        assert predicate("other") is False

From 4a17bc9053719dc132543594dfea48aa2304c9c1 Mon Sep 17 00:00:00 2001
From: Alexander Nguyen <alxxander.nguyen@protonmail.com>
Date: Wed, 10 Jun 2026 01:50:35 -0700
Subject: [PATCH 14/21] feat(paths): rsync-mode missing-field reason for the
 NAS setup gate

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 src/exlab_wizard/paths.py | 14 +++++++++++---
 tests/unit/test_paths.py  | 16 ++++++++++++++++
 2 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/src/exlab_wizard/paths.py b/src/exlab_wizard/paths.py
index 90296f7..2ba768a 100644
--- a/src/exlab_wizard/paths.py
+++ b/src/exlab_wizard/paths.py
@@ -697,13 +697,21 @@ def setup_state_missing(
 
 
 def _missing_nas_fields(config: Config | None) -> list[dict[str, str]]:
-    """Missing-``nas.remote`` row for ``INCOMPLETE_NO_NAS_REMOTE``.
+    """Missing-field row(s) for ``INCOMPLETE_NO_NAS_REMOTE``.
 
-    Distinguishes an unset ``nas.remote`` from one that is named but not
-    found in rclone.conf so the UI can tailor its guidance.
+    Distinguishes an unset ``nas.remote`` (shared by both transports)
+    from the per-transport "configured but unavailable" reasons: the
+    named remote absent from rclone.conf, or (rsync_ssh) the pinned
+    ssh identity file not found on disk.
     """
     if config is None or not config.nas.remote:
         return [{"field": "nas.remote", "reason": "unset"}]
+    from exlab_wizard.constants import SyncTransport
+
+    if config.nas.transport == SyncTransport.RSYNC_SSH:
+        return [
+            {"field": "nas.ssh_identity_file", "reason": "identity_file_missing"}
+        ]
     return [{"field": "nas.remote", "reason": "not_found_in_rclone_conf"}]
 
 
diff --git a/tests/unit/test_paths.py b/tests/unit/test_paths.py
index 73a21f0..6283af5 100644
--- a/tests/unit/test_paths.py
+++ b/tests/unit/test_paths.py
@@ -1167,3 +1167,19 @@ def __hash__(self) -> int:
 
     result = setup_state_missing(_BogusState(), None)  # type: ignore[arg-type]
     assert result == []
+
+
+def test_missing_nas_fields_rsync_mode_names_identity_file() -> None:
+    from exlab_wizard.config.models import Config, EquipmentConfig, NasConfig, PathsConfig
+    from exlab_wizard.constants import SetupState
+    from exlab_wizard.paths import setup_state_missing
+
+    config = Config(
+        paths=PathsConfig(app_root="/tmp/x"),
+        nas=NasConfig(transport="rsync_ssh", remote="svc-sync@nas01"),
+        equipment=[EquipmentConfig(id="EQ1", label="Eq 1", nas_root="/nas")],
+    )
+    rows = setup_state_missing(SetupState.INCOMPLETE_NO_NAS_REMOTE, config)
+    assert rows == [
+        {"field": "nas.ssh_identity_file", "reason": "identity_file_missing"}
+    ]

From c17cba83ec2d0cab930eadfc78cb9aea8dd226e6 Mon Sep 17 00:00:00 2001
From: Alexander Nguyen <alxxander.nguyen@protonmail.com>
Date: Wed, 10 Jun 2026 02:03:39 -0700
Subject: [PATCH 15/21] fix(security): end-of-options guard + leading-dash
 remote rejection in rsync transport

Argument-injection hardening from automated security review: every rsync
argv now passes `--` before its positional local/remote arguments so a
malformed config value beginning with `-` can never be parsed as a flag,
and NasConfig rejects rsync-mode remotes whose user or host segment
starts with `-`.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 src/exlab_wizard/config/models.py             | 5 ++++-
 src/exlab_wizard/sync/transports/rsync_ssh.py | 7 ++++++-
 tests/unit/config/test_models.py              | 4 +++-
 tests/unit/sync/transports/test_rsync_ssh.py  | 2 ++
 4 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/src/exlab_wizard/config/models.py b/src/exlab_wizard/config/models.py
index 182eb68..8962c79 100644
--- a/src/exlab_wizard/config/models.py
+++ b/src/exlab_wizard/config/models.py
@@ -312,7 +312,10 @@ def _validate_rsync_ssh(self) -> NasConfig:
             msg = "nas.transport 'rsync_ssh' requires nas.remote ('user@host')"
             raise ValueError(msg)
         user, sep, host = self.remote.partition("@")
-        if not (sep and user and host):
+        # A leading ``-`` in either segment could smuggle an argv flag into
+        # the rsync/ssh command lines, so it is rejected alongside the
+        # basic shape check.
+        if not (sep and user and host) or user.startswith("-") or host.startswith("-"):
             msg = (
                 f"nas.remote {self.remote!r} must be 'user@host' when "
                 "nas.transport is 'rsync_ssh'"
diff --git a/src/exlab_wizard/sync/transports/rsync_ssh.py b/src/exlab_wizard/sync/transports/rsync_ssh.py
index 196f3bb..8ff06e0 100644
--- a/src/exlab_wizard/sync/transports/rsync_ssh.py
+++ b/src/exlab_wizard/sync/transports/rsync_ssh.py
@@ -149,7 +149,9 @@ async def push(
             cmd.append(f"--bwlimit={bwlimit_kibps}")
         if files_from is not None:
             cmd.append(f"--files-from={files_from}")
-        cmd.extend([f"{local}/", remote])
+        # ``--`` ends option parsing: a remote/path that begins with ``-``
+        # (malformed config) must never be read as an rsync flag.
+        cmd.extend(["--", f"{local}/", remote])
         _log.debug("rsync cmd: %s", shlex.join(cmd))
 
         try:
@@ -192,6 +194,7 @@ async def check(
             "-e",
             self._ssh_command(),
             f"--files-from={files_from}",
+            "--",
             f"{local}/",
             remote,
         ]
@@ -236,6 +239,7 @@ async def lsjson_manifest(
             "--no-h",
             "-e",
             self._ssh_command(),
+            "--",
             f"{remote}/",
         ]
         _log.debug("rsync list cmd: %s", shlex.join(cmd))
@@ -266,6 +270,7 @@ async def about(self, remote: str) -> AboutResult:
             "--no-h",
             "-e",
             self._ssh_command(),
+            "--",
             f"{remote}/",
         ]
         _log.debug("rsync about cmd: %s", shlex.join(cmd))
diff --git a/tests/unit/config/test_models.py b/tests/unit/config/test_models.py
index 2fbdcfe..0c854ae 100644
--- a/tests/unit/config/test_models.py
+++ b/tests/unit/config/test_models.py
@@ -1026,7 +1026,9 @@ def test_rsync_ssh_rejects_empty_remote(self) -> None:
         with pytest.raises(ValidationError, match=r"requires nas\.remote"):
             NasConfig(transport="rsync_ssh", remote="")
 
-    @pytest.mark.parametrize("bad", ["nas01", "@nas01", "svc-sync@"])
+    @pytest.mark.parametrize(
+        "bad", ["nas01", "@nas01", "svc-sync@", "-user@nas01", "svc-sync@-nas01"]
+    )
     def test_rsync_ssh_rejects_non_user_at_host(self, bad: str) -> None:
         with pytest.raises(ValidationError, match="user@host"):
             NasConfig(transport="rsync_ssh", remote=bad)
diff --git a/tests/unit/sync/transports/test_rsync_ssh.py b/tests/unit/sync/transports/test_rsync_ssh.py
index b6d0226..0c6c58d 100644
--- a/tests/unit/sync/transports/test_rsync_ssh.py
+++ b/tests/unit/sync/transports/test_rsync_ssh.py
@@ -80,6 +80,8 @@ async def test_success_argv_shape(self, fake_run, tmp_path: Path) -> None:
         assert cmd[0] == "rsync"
         assert "-rt" in cmd
         assert "--bwlimit=512" in cmd
+        # ``--`` ends option parsing so positionals can never smuggle flags.
+        assert cmd[-3] == "--"
         assert cmd[-2] == f"{tmp_path}/"
         assert cmd[-1] == TARGET
         ssh_arg = cmd[cmd.index("-e") + 1]

From 19a6caceb0dbdd284a2a4b85257d69162eb6d41d Mon Sep 17 00:00:00 2001
From: Alexander Nguyen <alxxander.nguyen@protonmail.com>
Date: Wed, 10 Jun 2026 02:07:53 -0700
Subject: [PATCH 16/21] feat(ui): transport-aware NAS-remote settings section +
 banner copy

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 src/exlab_wizard/ui/pages/main.py         |  2 +-
 src/exlab_wizard/ui/pages/settings.py     | 36 ++++++++---
 tests/unit/ui/test_pages.py               |  5 +-
 tests/unit/ui/test_settings_nas_remote.py | 79 +++++++++++++++++++++++
 4 files changed, 111 insertions(+), 11 deletions(-)

diff --git a/src/exlab_wizard/ui/pages/main.py b/src/exlab_wizard/ui/pages/main.py
index 555f1b5..b6c5091 100644
--- a/src/exlab_wizard/ui/pages/main.py
+++ b/src/exlab_wizard/ui/pages/main.py
@@ -169,7 +169,7 @@ def setup_incomplete_banner_props(next_action: str | None = None) -> dict[str, s
     """
 
     sublines = {
-        "configure_rclone_remote": ("Configure the rclone remote (see setup docs) to begin."),
+        "configure_rclone_remote": ("Configure the NAS connection (see setup docs) to begin."),
         "configure_lims": "Open Settings → LIMS to finish configuring LIMS.",
         "test_lims": "Open Settings → LIMS to finish configuring LIMS.",
         "set_paths": "Open Settings and complete the highlighted sections to begin.",
diff --git a/src/exlab_wizard/ui/pages/settings.py b/src/exlab_wizard/ui/pages/settings.py
index edcc261..35db911 100644
--- a/src/exlab_wizard/ui/pages/settings.py
+++ b/src/exlab_wizard/ui/pages/settings.py
@@ -797,13 +797,22 @@ def _render_nas_remote_section(
     remote = getattr(nas, "remote", "") or ""
     base_root = getattr(nas, "base_root", "") or ""
     available = bool(remote) and nas_remote_available(remote)
+    transport = str(getattr(nas, "transport", "") or "rclone")
+    rsync_mode = transport == "rsync_ssh"
 
     with container:
-        ui.label(
-            "NAS sync references a single rclone remote configured in your "
+        description = (
+            "NAS sync uses rsync over ssh: `remote` is the user@host target, "
+            "authenticated by your ssh key (no password is stored here). "
+            "See the setup docs for key + known_hosts provisioning."
+            if rsync_mode
+            else "NAS sync references a single rclone remote configured in your "
             "rclone.conf (run `rclone config` to create it). No password is "
             "stored here."
-        ).style("font-size: var(--text-sm); color: var(--color-muted);")
+        )
+        ui.label(description).style(
+            "font-size: var(--text-sm); color: var(--color-muted);"
+        )
 
         with ui.row().classes("items-center w-full").style("gap: 0.5rem;"):
             ui.label("Remote").style("color: var(--color-body); min-width: 6rem;")
@@ -817,12 +826,23 @@ def _render_nas_remote_section(
                 'data-testid="settings-nas-remote-base-root"'
             ).style("font-family: var(--font-mono);")
 
-        if available:
-            badge_text = "Found in rclone.conf"
-            badge_color = "var(--color-success)"
+        with ui.row().classes("items-center w-full").style("gap: 0.5rem;"):
+            ui.label("Transport").style("color: var(--color-body); min-width: 6rem;")
+            ui.label("rsync over ssh" if rsync_mode else "rclone").props(
+                'data-testid="settings-nas-transport"'
+            ).style("font-family: var(--font-mono);")
+
+        if rsync_mode:
+            badge_text = (
+                "ssh access configured"
+                if available
+                else "Identity file missing — see setup docs"
+            )
         else:
-            badge_text = "Not found — run `rclone config`"
-            badge_color = "var(--color-warning)"
+            badge_text = (
+                "Found in rclone.conf" if available else "Not found — run `rclone config`"
+            )
+        badge_color = "var(--color-success)" if available else "var(--color-warning)"
         ui.label(badge_text).props('data-testid="settings-nas-remote-status"').style(
             f"color: {badge_color}; font-size: var(--text-sm); font-weight: 600;"
         )
diff --git a/tests/unit/ui/test_pages.py b/tests/unit/ui/test_pages.py
index a458f7b..f1496e2 100644
--- a/tests/unit/ui/test_pages.py
+++ b/tests/unit/ui/test_pages.py
@@ -99,10 +99,11 @@ def test_main_setup_incomplete_banner_uses_warning() -> None:
 
 
 def test_main_setup_banner_subline_tailored_for_rclone_remote() -> None:
-    """The rclone-remote next-action points the operator at the setup docs."""
+    """The configure-NAS-connection next-action points the operator at the setup docs."""
 
     props = main.setup_incomplete_banner_props("configure_rclone_remote")
-    assert "rclone remote" in props["subline"]
+    assert "NAS connection" in props["subline"]
+    assert "setup docs" in props["subline"]
     # The generic next-action falls back to the original subline.
     generic = main.setup_incomplete_banner_props()["subline"]
     assert props["subline"] != generic
diff --git a/tests/unit/ui/test_settings_nas_remote.py b/tests/unit/ui/test_settings_nas_remote.py
index 3c936a8..94d0ab5 100644
--- a/tests/unit/ui/test_settings_nas_remote.py
+++ b/tests/unit/ui/test_settings_nas_remote.py
@@ -68,6 +68,24 @@ def _config_with(*equipment: EquipmentConfig, remote: str = "nas01") -> Config:
     )
 
 
+def _config_rsync_with(*equipment: EquipmentConfig) -> Config:
+    return Config(
+        paths=PathsConfig(app_root="/srv/exlab"),
+        equipment=list(equipment),
+        orchestrator=OrchestratorConfig(
+            label="LAB",
+            staging_root="/staging",
+            staging_remote="stagepc",
+            staging_base_root="/staging-area",
+        ),
+        nas=NasConfig(
+            transport="rsync_ssh",
+            remote="svc-sync@nas01",
+            base_root="/volume1/lab",
+        ),
+    )
+
+
 def _testids(element: object) -> set[str]:
     return {
         tid
@@ -705,3 +723,64 @@ def blocking_import(name: str, *args: Any, **kwargs: Any) -> Any:
     assert isinstance(out, dict)
     assert out["active"] == "nas_remote"
     assert "nas_remote" in out["sections"]
+
+
+# ---------------------------------------------------------------------------
+# Transport-aware NAS-remote section (rsync_ssh vs rclone)
+# ---------------------------------------------------------------------------
+
+
+def test_rsync_mode_shows_transport_row_and_ssh_badge() -> None:
+    """rsync mode: transport row shows 'rsync over ssh', badge 'ssh access configured'."""
+    config = _config_rsync_with(_nas_equipment("EQ1"))
+    out = settings.render_settings_page(
+        config=config,
+        state=settings.SettingsState(active_section="nas_remote"),
+        on_save=lambda s: None,
+        nas_remote_available=lambda _name: True,
+        on_test_connection=lambda: None,
+    )
+    transport_text = _text_of(out, "settings-nas-transport")
+    assert transport_text == "rsync over ssh"
+    status_text = _text_of(out, "settings-nas-remote-status")
+    assert status_text == "ssh access configured"
+
+
+def test_rsync_mode_identity_missing_badge() -> None:
+    """rsync mode with unavailable: badge shows 'Identity file missing — see setup docs'."""
+    config = _config_rsync_with(_nas_equipment("EQ1"))
+    out = settings.render_settings_page(
+        config=config,
+        state=settings.SettingsState(active_section="nas_remote"),
+        on_save=lambda s: None,
+        nas_remote_available=lambda _name: False,
+        on_test_connection=lambda: None,
+    )
+    status_text = _text_of(out, "settings-nas-remote-status")
+    assert status_text == "Identity file missing — see setup docs"
+
+
+def test_rclone_mode_badges_unchanged() -> None:
+    """rclone mode: badges remain 'Found in rclone.conf' / 'Not found — run `rclone config`'."""
+    config = _config_with(_nas_equipment("EQ1"), remote="nas01")
+
+    out_found = settings.render_settings_page(
+        config=config,
+        state=settings.SettingsState(active_section="nas_remote"),
+        on_save=lambda s: None,
+        nas_remote_available=lambda _name: True,
+        on_test_connection=lambda: None,
+    )
+    assert _text_of(out_found, "settings-nas-remote-status") == "Found in rclone.conf"
+
+    out_missing = settings.render_settings_page(
+        config=config,
+        state=settings.SettingsState(active_section="nas_remote"),
+        on_save=lambda s: None,
+        nas_remote_available=lambda _name: False,
+        on_test_connection=lambda: None,
+    )
+    assert (
+        _text_of(out_missing, "settings-nas-remote-status")
+        == "Not found — run `rclone config`"
+    )

From 8b63c90eb68da476c37aa9d68fbee4106b23b79c Mon Sep 17 00:00:00 2001
From: Alexander Nguyen <alxxander.nguyen@protonmail.com>
Date: Wed, 10 Jun 2026 02:09:26 -0700
Subject: [PATCH 17/21] test(sync): stub rsync binary + driver round-trip
 coverage

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 tests/fixtures/stub_rsync.py                 | 143 +++++++++++++++++++
 tests/unit/sync/transports/test_rsync_ssh.py |  41 ++++++
 2 files changed, 184 insertions(+)
 create mode 100644 tests/fixtures/stub_rsync.py

diff --git a/tests/fixtures/stub_rsync.py b/tests/fixtures/stub_rsync.py
new file mode 100644
index 0000000..b0f2397
--- /dev/null
+++ b/tests/fixtures/stub_rsync.py
@@ -0,0 +1,143 @@
+#!/usr/bin/env python3
+"""Stub ``rsync`` binary for tests.
+
+rsync-over-ssh NAS transport (2026-06-10). Behaviors are selected via
+``STUB_RSYNC_BEHAVIOR``:
+
+- ``success`` (default): push copies the ``--files-from`` subset (or the
+  whole source tree) into ``STUB_RSYNC_DEST_ROOT/<remote-path>``;
+  ``--list-only`` emits a real listing of that subtree; ``-n`` dry-runs
+  emit nothing (all equal).
+- ``network_error`` — "Connection refused" on stderr, exit 255.
+- ``auth_error`` — "Permission denied (publickey)." on stderr, exit 255.
+- ``check_differ`` — dry-run itemizes every files-from entry as
+  ``>fcst...... <path>``.
+- ``check_missing`` — dry-run itemizes every entry as ``>f+++++++++ <path>``.
+
+``STUB_RSYNC_RECORD_PATH`` appends one JSON line of argv per invocation.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import shutil
+import sys
+from datetime import datetime
+from pathlib import Path
+
+
+def _flag_value(argv: list[str], prefix: str) -> str | None:
+    for arg in argv:
+        if arg.startswith(prefix + "="):
+            return arg.split("=", 1)[1]
+    return None
+
+
+def _positional(argv: list[str]) -> list[str]:
+    out: list[str] = []
+    skip_next = False
+    for arg in argv[1:]:
+        if skip_next:
+            skip_next = False
+            continue
+        if arg == "-e":
+            skip_next = True
+            continue
+        if arg.startswith("-"):
+            continue
+        out.append(arg)
+    return out
+
+
+def _files_from_paths(argv: list[str]) -> list[str]:
+    listing = _flag_value(argv, "--files-from")
+    if listing is None:
+        return []
+    try:
+        return [
+            line.strip()
+            for line in Path(listing).read_text(encoding="utf-8").splitlines()
+            if line.strip()
+        ]
+    except OSError:
+        return []
+
+
+def _remote_path(spec: str) -> str:
+    # "user@host:/path" -> "/path"
+    return spec.split(":", 1)[1] if ":" in spec else spec
+
+
+def main() -> int:
+    argv = sys.argv
+    record = os.environ.get("STUB_RSYNC_RECORD_PATH")
+    if record:
+        with open(record, "a") as f:
+            f.write(json.dumps(argv) + "\n")
+
+    behavior = os.environ.get("STUB_RSYNC_BEHAVIOR", "success")
+    dest_root = os.environ.get("STUB_RSYNC_DEST_ROOT", "")
+
+    if behavior == "network_error":
+        sys.stderr.write("ssh: connect to host nas01: Connection refused\n")
+        return 255
+    if behavior == "auth_error":
+        sys.stderr.write("Permission denied (publickey).\n")
+        return 255
+
+    positional = _positional(argv)
+
+    # ---- list-only --------------------------------------------------------
+    if "--list-only" in argv:
+        target = _remote_path(positional[-1]).rstrip("/")
+        root = Path(dest_root) / target.lstrip("/")
+        if not root.is_dir():
+            sys.stderr.write(f'rsync: change_dir "{target}" failed\n')
+            return 23
+        recursive = "-r" in argv
+        paths = sorted(root.rglob("*")) if recursive else sorted(root.iterdir())
+        for path in [root, *paths]:
+            st = path.stat()
+            stamp = datetime.fromtimestamp(st.st_mtime).strftime("%Y/%m/%d %H:%M:%S")
+            rel = "." if path == root else path.relative_to(root).as_posix()
+            kind = "d" if path.is_dir() else "-"
+            sys.stdout.write(f"{kind}rw-r--r-- {st.st_size:>14,} {stamp} {rel}\n")
+        return 0
+
+    # ---- dry-run check ----------------------------------------------------
+    if "-n" in argv or any("n" in a for a in argv if a.startswith("-") and "=" not in a):
+        rels = _files_from_paths(argv)
+        if behavior == "check_differ":
+            for rel in rels:
+                sys.stdout.write(f">fcst...... {rel}\n")
+        elif behavior == "check_missing":
+            for rel in rels:
+                sys.stdout.write(f">f+++++++++ {rel}\n")
+        return 0
+
+    # ---- push -------------------------------------------------------------
+    if len(positional) < 2:
+        sys.stderr.write(f"stub_rsync: unexpected argv {argv!r}\n")
+        return 1
+    src = Path(positional[-2].rstrip("/"))
+    if not dest_root:
+        return 0
+    dst = Path(dest_root) / _remote_path(positional[-1]).lstrip("/")
+    rels = _files_from_paths(argv)
+    if rels:
+        for rel in rels:
+            source = src / rel
+            if not source.is_file():
+                continue
+            target = dst / rel
+            target.parent.mkdir(parents=True, exist_ok=True)
+            shutil.copy2(source, target)
+    else:
+        dst.mkdir(parents=True, exist_ok=True)
+        shutil.copytree(src, dst, dirs_exist_ok=True)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/tests/unit/sync/transports/test_rsync_ssh.py b/tests/unit/sync/transports/test_rsync_ssh.py
index 0c6c58d..49e6fc6 100644
--- a/tests/unit/sync/transports/test_rsync_ssh.py
+++ b/tests/unit/sync/transports/test_rsync_ssh.py
@@ -236,3 +236,44 @@ async def boom(cmd):
         )
         result = await RsyncSshDriver().about("svc-sync@nas01:/volume1/lab")
         assert not result.ok and result.reason == "rsync binary not found"
+
+
+import stat  # noqa: E402
+import sys  # noqa: E402
+
+
+@pytest.fixture
+def stub_rsync(tmp_path: Path, monkeypatch) -> Path:
+    """Executable wrapper around tests/fixtures/stub_rsync.py."""
+    fixture = Path(__file__).parents[3] / "fixtures" / "stub_rsync.py"
+    wrapper = tmp_path / "rsync"
+    wrapper.write_text(f'#!/bin/sh\nexec "{sys.executable}" "{fixture}" "$@"\n')
+    wrapper.chmod(wrapper.stat().st_mode | stat.S_IEXEC)
+    monkeypatch.setenv("STUB_RSYNC_DEST_ROOT", str(tmp_path / "nas"))
+    return wrapper
+
+
+class TestAgainstStub:
+    async def test_push_then_list_roundtrip(self, stub_rsync: Path, tmp_path: Path) -> None:
+        local = tmp_path / "run"
+        (local / "data").mkdir(parents=True)
+        (local / "data" / "file with spaces.csv").write_text("x" * 10)
+        driver = RsyncSshDriver(binary=str(stub_rsync))
+
+        result = await driver.push(local, "u@h:/v1/lab/EQ1/run")
+        assert result.ok
+
+        manifest = await driver.lsjson_manifest("u@h:/v1/lab/EQ1/run")
+        assert manifest.has("data/file with spaces.csv")
+        local_stat = (local / "data" / "file with spaces.csv").stat()
+        assert manifest.matches(
+            "data/file with spaces.csv",
+            local_stat.st_size,
+            local_stat.st_mtime,
+            tolerance_s=2,
+        )
+
+    async def test_about_missing_base_root(self, stub_rsync: Path) -> None:
+        driver = RsyncSshDriver(binary=str(stub_rsync))
+        result = await driver.about("u@h:/does/not/exist")
+        assert not result.ok and "base_root" in (result.reason or "")

From 869c9ecdfc118bfa6968c9c250f96303f1634a17 Mon Sep 17 00:00:00 2001
From: Alexander Nguyen <alxxander.nguyen@protonmail.com>
Date: Wed, 10 Jun 2026 02:22:13 -0700
Subject: [PATCH 18/21] test(integration): rsync-over-ssh docker leg +
 characterization suite
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add rsync to the SFTP container Dockerfile (Debian rsync 3.2.7)
- Provision a key-auth rsync user (rsyncuser) in entrypoint.sh:
  generates ed25519 keypair into bind-mounted keys/ dir on first boot,
  installs pubkey as authorized_keys, Match User block disables SFTP
  for that user while allowing rsync --server (Synology posture)
- Set TZ=America/New_York on the nas-sftp service in docker-compose.yml
  so the container's timezone differs from the client's; this is the
  timezone characterization condition for the test suite
- Drop --no-h from RsyncSshDriver's --list-only commands: the flag is
  GNU rsync-specific and fails on macOS openrsync (the client); the
  parser already handles comma-grouped sizes so --no-h was never needed
- Add ssh_extra_opts test seam to RsyncSshDriver (keyword-only tuple,
  default empty) for injecting UserKnownHostsFile/StrictHostKeyChecking
  in integration tests without mutating developer's ~/.ssh/known_hosts;
  production config never sets it; unit test confirms argv rendering
- Create tests/integration/test_rsync_ssh_characterization.py with
  docker-gated fixtures and 4 characterization tests:
  test_push_list_reconcile_roundtrip (TZ verdict: PASSED — timestamps
  are CLIENT-TZ formatted, spec assumption confirmed),
  test_check_differ_and_missing, test_list_only_on_missing_run_dir_raises_network,
  test_about_ok_and_missing_base_root
- Document new user/keys/TZ in tests/docker/README.md

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .gitignore                                    |   3 +
 src/exlab_wizard/sync/transports/rsync_ssh.py |  20 +-
 tests/docker/.env.example                     |   7 +
 tests/docker/Dockerfile                       |  35 +-
 tests/docker/README.md                        |  58 ++-
 tests/docker/docker-compose.yml               |  24 +-
 tests/docker/entrypoint.sh                    |  40 ++-
 tests/docker/keys/.gitkeep                    |   0
 .../test_rsync_ssh_characterization.py        | 339 ++++++++++++++++++
 tests/unit/sync/transports/test_rsync_ssh.py  |  15 +-
 10 files changed, 518 insertions(+), 23 deletions(-)
 create mode 100644 tests/docker/keys/.gitkeep
 create mode 100644 tests/integration/test_rsync_ssh_characterization.py

diff --git a/.gitignore b/.gitignore
index 06f8d9e..97a074f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -40,6 +40,9 @@ state/
 # NAS emulator (tests/docker/) — keep the layout, ignore generated state
 tests/docker/nas-data/*
 !tests/docker/nas-data/.gitkeep
+# rsync-over-ssh keypair generated by entrypoint on first boot (never commit)
+tests/docker/keys/*
+!tests/docker/keys/.gitkeep
 
 # Local secrets / env (never commit)
 .env
diff --git a/src/exlab_wizard/sync/transports/rsync_ssh.py b/src/exlab_wizard/sync/transports/rsync_ssh.py
index 8ff06e0..5065198 100644
--- a/src/exlab_wizard/sync/transports/rsync_ssh.py
+++ b/src/exlab_wizard/sync/transports/rsync_ssh.py
@@ -102,7 +102,16 @@ def _synthesize_check(requested: tuple[str, ...], stdout: str) -> CheckResult:
 
 
 class RsyncSshDriver:
-    """rsync-over-ssh transport driver (implements ``NasTransportDriver``)."""
+    """rsync-over-ssh transport driver (implements ``NasTransportDriver``).
+
+    ``ssh_extra_opts`` is a **test seam only** — each entry is passed to
+    ssh as ``-o <entry>``.  Production config does not expose it and it
+    must never be set in production code paths.  The integration-test
+    fixture uses it to point ssh at a throwaway ``known_hosts`` file
+    (``UserKnownHostsFile=<tmp>``) and accept the container's first-seen
+    host key (``StrictHostKeyChecking=accept-new``) without mutating the
+    developer's real ``~/.ssh/known_hosts``.
+    """
 
     def __init__(
         self,
@@ -110,10 +119,12 @@ def __init__(
         binary: str = "rsync",
         ssh_port: int = 22,
         ssh_identity_file: str = "",
+        ssh_extra_opts: tuple[str, ...] = (),
     ) -> None:
         self._binary = binary
         self._ssh_port = ssh_port
         self._ssh_identity_file = ssh_identity_file
+        self._ssh_extra_opts = ssh_extra_opts
 
     def _ssh_command(self) -> str:
         """Render the ``-e`` remote-shell string.
@@ -122,10 +133,15 @@ def _ssh_command(self) -> str:
         passphrase prompt must fail fast (classified AUTH) rather than
         hang the sync worker. No ``StrictHostKeyChecking`` relaxation —
         host keys are pre-provisioned via ``ssh-keyscan``.
+
+        ``_ssh_extra_opts`` entries are appended as ``-o <opt>`` pairs
+        (test seam; production never sets this).
         """
         parts = ["ssh", "-p", str(self._ssh_port), "-o", "BatchMode=yes"]
         if self._ssh_identity_file:
             parts.extend(["-i", str(Path(self._ssh_identity_file).expanduser())])
+        for opt in self._ssh_extra_opts:
+            parts.extend(["-o", opt])
         return shlex.join(parts)
 
     async def push(
@@ -236,7 +252,6 @@ async def lsjson_manifest(
             self._binary,
             "--list-only",
             "-r",
-            "--no-h",
             "-e",
             self._ssh_command(),
             "--",
@@ -267,7 +282,6 @@ async def about(self, remote: str) -> AboutResult:
         cmd: list[str] = [
             self._binary,
             "--list-only",
-            "--no-h",
             "-e",
             self._ssh_command(),
             "--",
diff --git a/tests/docker/.env.example b/tests/docker/.env.example
index 5724947..5811b17 100644
--- a/tests/docker/.env.example
+++ b/tests/docker/.env.example
@@ -6,6 +6,13 @@ NAS_USER=testuser
 NAS_UID=1000
 NAS_GID=1000
 
+# rsync-over-ssh user (key-auth only, no SFTP, no password).
+# The entrypoint generates an ed25519 keypair in tests/docker/keys/ on
+# first boot and installs the pubkey as this user's authorized_keys.
+RSYNC_USER=rsyncuser
+RSYNC_UID=1001
+RSYNC_GID=1001
+
 # The password the rclone SFTP / SMB backends authenticate with. This is
 # the same secret you type into Settings -> NAS Credentials for the test
 # equipment. Pick anything; it lives only in this .env and is set on the
diff --git a/tests/docker/Dockerfile b/tests/docker/Dockerfile
index a16517d..8e1502f 100644
--- a/tests/docker/Dockerfile
+++ b/tests/docker/Dockerfile
@@ -5,9 +5,14 @@ FROM debian:bookworm-slim
 # wizard authenticates the SFTP backend with an operator-typed password;
 # this container mirrors that by enabling PasswordAuthentication and
 # setting a password on the test user. No keys, no PAM challenge flow.
+#
+# rsync-over-ssh leg (2026-06-10): a second user (RSYNC_USER) is
+# provisioned with key-only auth, no SFTP subsystem. The rsync binary
+# is installed so ``rsync --server`` over ssh works as on a Synology.
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
         openssh-server \
+        rsync \
         coreutils \
         iproute2 \
     && rm -rf /var/lib/apt/lists/* \
@@ -18,20 +23,40 @@ ARG NAS_UID=1000
 ARG NAS_GID=1000
 ENV NAS_USER=${NAS_USER}
 
+ARG RSYNC_USER=rsyncuser
+ARG RSYNC_UID=1001
+ARG RSYNC_GID=1001
+ENV RSYNC_USER=${RSYNC_USER}
+
 RUN groupadd -g ${NAS_GID} ${NAS_USER} \
     && useradd -m -u ${NAS_UID} -g ${NAS_GID} -s /bin/bash ${NAS_USER} \
     && mkdir -p /home/${NAS_USER}/data \
     && chown -R ${NAS_USER}:${NAS_USER} /home/${NAS_USER}
 
-# Password auth only: no root login, no pubkey. The test user's password
-# is set at boot by the entrypoint from ${NAS_PASSWORD} so it never has
-# to be baked into the image.
+RUN groupadd -g ${RSYNC_GID} ${RSYNC_USER} \
+    && useradd -m -u ${RSYNC_UID} -g ${RSYNC_GID} -s /bin/sh ${RSYNC_USER} \
+    && mkdir -p /home/${RSYNC_USER}/data \
+    && chown -R ${RSYNC_USER}:${RSYNC_USER} /home/${RSYNC_USER}
+
+# Password auth only for the SFTP user; no root login, no pubkey.
+# The rsync user gets pubkey-only auth (configured by entrypoint).
 RUN sed -ri 's/^#?PermitRootLogin.*/PermitRootLogin no/'                          /etc/ssh/sshd_config \
     && sed -ri 's/^#?PasswordAuthentication.*/PasswordAuthentication yes/'        /etc/ssh/sshd_config \
-    && sed -ri 's/^#?PubkeyAuthentication.*/PubkeyAuthentication no/'             /etc/ssh/sshd_config \
+    && sed -ri 's/^#?PubkeyAuthentication.*/PubkeyAuthentication yes/'            /etc/ssh/sshd_config \
     && sed -ri 's/^#?ChallengeResponseAuthentication.*/ChallengeResponseAuthentication no/' /etc/ssh/sshd_config \
     && sed -ri 's/^#?KbdInteractiveAuthentication.*/KbdInteractiveAuthentication no/' /etc/ssh/sshd_config \
-    && printf '\nAllowUsers %s\n' "${NAS_USER}" >> /etc/ssh/sshd_config
+    && printf '\nAllowUsers %s %s\n' "${NAS_USER}" "${RSYNC_USER}" >> /etc/ssh/sshd_config
+
+# Match block for the SFTP user: password auth, SFTP subsystem.
+# Match block for the rsync user: pubkey only, no password, no SFTP
+# (Synology posture: rsync --server over ssh, nothing else).
+RUN printf '\nMatch User %s\n    PasswordAuthentication yes\n    PubkeyAuthentication no\n    ForceCommand internal-sftp\n\nMatch User %s\n    PasswordAuthentication no\n    PubkeyAuthentication yes\n' \
+        "${NAS_USER}" "${RSYNC_USER}" >> /etc/ssh/sshd_config
+
+# The keys/ directory is bind-mounted from the host at runtime (see
+# docker-compose.yml). The entrypoint generates the keypair there on
+# first boot and installs the pubkey as authorized_keys for RSYNC_USER.
+RUN mkdir -p /keys && chown root:root /keys
 
 COPY entrypoint.sh /usr/local/bin/entrypoint.sh
 RUN chmod +x /usr/local/bin/entrypoint.sh
diff --git a/tests/docker/README.md b/tests/docker/README.md
index abdb5d1..914ff83 100644
--- a/tests/docker/README.md
+++ b/tests/docker/README.md
@@ -6,11 +6,18 @@ OpenSSH server for SFTP and a Samba server for SMB.
 
 ## Purpose & Scope
 
-**In scope:** password-authenticated SFTP and SMB endpoints, a
-bind-mounted data volume for inspection, teardown/reset between runs.
+**In scope:** password-authenticated SFTP and SMB endpoints, key-authenticated
+rsync-over-ssh endpoint, a bind-mounted data volume for inspection,
+teardown/reset between runs.
 
 **Out of scope:** Google Cloud bucket sync, NAS quota / snapshot
-behaviour, real host-key trust (the emulator disables host-key checking).
+behaviour.
+
+> **rsync-over-ssh:** The `nas-sftp` container also hosts a second user
+> (`rsyncuser`) with key-only auth and no SFTP subsystem, mirroring the
+> Synology posture. The container's `TZ` is set to `America/New_York` so
+> it differs from typical client timezones — this exercises the timezone
+> characterization in the integration test suite (see §rsync-over-ssh below).
 
 > **How the app connects:** ExLab-Wizard uses operator-managed rclone named
 > remotes. You configure the remote in `rclone.conf` once with `rclone config`
@@ -23,8 +30,8 @@ behaviour, real host-key trust (the emulator disables host-key checking).
 
 | Requirement      | Detail                                                       |
 |------------------|--------------------------------------------------------------|
-| Protocols        | SFTP (`${SFTP_HOST_PORT:-2222}`) + SMB (`${SMB_HOST_PORT:-1445}`) |
-| Auth             | Password only (no keys); SMB user-level security             |
+| Protocols        | SFTP (`${SFTP_HOST_PORT:-2222}`) + SMB (`${SMB_HOST_PORT:-1445}`) + rsync-over-ssh (same port as SFTP) |
+| Auth             | SFTP/SMB: password only; rsync-over-ssh: key-only (no password, no SFTP subsystem) |
 | Platform         | macOS, Linux, Windows (Docker Desktop or Engine)             |
 | Internet access  | Not required after `docker compose build` succeeds           |
 | Tooling          | Docker + Docker Compose v2 (optionally the `rclone` CLI)     |
@@ -33,15 +40,17 @@ behaviour, real host-key trust (the emulator disables host-key checking).
 
 ```
 tests/docker/
-├── Dockerfile              # debian-slim + openssh-server (password auth)
+├── Dockerfile              # debian-slim + openssh-server + rsync (SFTP + rsync-over-ssh)
 ├── Dockerfile.smb          # debian-slim + samba (password auth)
-├── entrypoint.sh           # sets the SFTP user password, generates host keys
+├── entrypoint.sh           # sets SFTP user password; generates ed25519 keypair for rsync user
 ├── entrypoint.smb.sh       # registers the Samba user + password
-├── docker-compose.yml      # nas-sftp + nas-smb services
+├── docker-compose.yml      # nas-sftp (TZ=America/New_York) + nas-smb services
 ├── .env.example            # credential / port template (committed)
 ├── .env                    # actual values incl. NAS_PASSWORD (gitignored)
 ├── nas-data/               # bind-mounted NAS state (gitignored except .gitkeep)
 │   └── .gitkeep
+├── keys/                   # generated keypair for rsync-over-ssh user (gitignored except .gitkeep)
+│   └── .gitkeep            # id_exlab + id_exlab.pub appear here after first `docker compose up`
 ├── rclone.conf             # test rclone.conf pointing at the compose containers
 ├── rclone.conf.example     # annotated example for ad-hoc shell use
 └── README.md
@@ -133,6 +142,39 @@ docker compose down                          # stop, preserve data
 docker compose down -v && rm -rf nas-data/*  # full reset to empty NAS
 ```
 
+## rsync-over-ssh (key-auth, no SFTP)
+
+The `nas-sftp` container runs a second user (`rsyncuser`, UID 1001) that mirrors
+the Synology rsync-over-ssh posture: key-only auth, no SFTP subsystem, plain
+`rsync --server` over ssh. This is the backend for the integration characterization
+suite (`tests/integration/test_rsync_ssh_characterization.py`).
+
+**Users and keys:**
+
+| Field | Value |
+|-------|-------|
+| User | `rsyncuser` (configured via `RSYNC_USER` in `.env`) |
+| UID/GID | 1001 / 1001 (configured via `RSYNC_UID` / `RSYNC_GID`) |
+| Auth | ed25519 keypair; private key at `tests/docker/keys/id_exlab` (generated on first boot) |
+| Port | Same as SFTP: `${SFTP_HOST_PORT:-2222}` |
+| SFTP | Disabled for this user (Match User block without ForceCommand `internal-sftp`) |
+| Data root | `/home/rsyncuser/data` (bind-mounted to `tests/docker/nas-data/`) |
+
+**Keypair generation:** the entrypoint generates `tests/docker/keys/id_exlab` and
+`tests/docker/keys/id_exlab.pub` on first boot (skips if already present). The
+`keys/` directory is bind-mounted into the container at `/keys/`. The integration
+test reads the private key directly from `tests/docker/keys/id_exlab`.
+
+**Timezone:** the container's `TZ` is set to `America/New_York` in
+`docker-compose.yml`. This causes `--list-only` rsync timestamps to be formatted
+in the client's local timezone, NOT the server's — confirmed by
+`test_push_list_reconcile_roundtrip`. If a future rsync version changes this
+behaviour, the test will fail by a whole-hour mtime offset, triggering the
+`nas.remote_tz` contingency in the spec.
+
+**Resetting the keypair:** delete `tests/docker/keys/id_exlab*` and restart the
+container (`docker compose up -d`). The entrypoint regenerates the keypair.
+
 ## Pytest Fixture (optional)
 
 `tests/integration/test_nas_sync.py` exercises the queue / verifier state
diff --git a/tests/docker/docker-compose.yml b/tests/docker/docker-compose.yml
index 4ba83c2..8620137 100644
--- a/tests/docker/docker-compose.yml
+++ b/tests/docker/docker-compose.yml
@@ -4,6 +4,13 @@
 #   - SFTP:  host=localhost port=${SFTP_HOST_PORT} user=${NAS_USER} password=${NAS_PASSWORD}
 #   - SMB:   host=localhost port=${SMB_HOST_PORT}  user=${NAS_USER} share=${SMB_SHARE}
 #
+# rsync-over-ssh leg (2026-06-10): the nas-sftp container also hosts the
+# rsync-over-ssh user (rsyncuser) on the same port. A bind-mounted keys/
+# dir holds the generated ed25519 keypair so the integration test can
+# locate the private key. The container's TZ is set to America/New_York
+# to make it differ from the typical client TZ — this exercises the
+# timezone characterization in test_push_list_reconcile_roundtrip.
+#
 # ExLab-Wizard uses operator-managed rclone named remotes (rclone.conf).
 # Configure the remotes in tests/docker/rclone.conf, point nas.remote and
 # nas.rclone_config_path in config.yaml at them, and run normally.
@@ -19,14 +26,29 @@ services:
         NAS_USER: ${NAS_USER}
         NAS_UID: ${NAS_UID}
         NAS_GID: ${NAS_GID}
+        RSYNC_USER: ${RSYNC_USER:-rsyncuser}
+        RSYNC_UID: ${RSYNC_UID:-1001}
+        RSYNC_GID: ${RSYNC_GID:-1001}
     image: exlab/nas-emulator-sftp:local
     container_name: exlab-nas-sftp
     env_file: .env
+    environment:
+      # Pin TZ to America/New_York so the rsync listing timestamps are
+      # formatted in a timezone that differs from the test client's local
+      # TZ. This is the key condition for the timezone characterization
+      # test: if --list-only emits server-side timestamps, mtime reconcile
+      # fails; if it emits client-side timestamps, it passes.
+      TZ: America/New_York
     ports:
       - "${SFTP_HOST_PORT:-2222}:22"
     volumes:
       # Bind-mount so the host can inspect what the sync wrote.
-      - ./nas-data:/home/${NAS_USER}/data
+      - ./nas-data:/home/${NAS_USER:-testuser}/data
+      # rsync-over-ssh data root (rsyncuser's home data dir).
+      - ./nas-data:/home/${RSYNC_USER:-rsyncuser}/data
+      # Keys dir: the entrypoint generates the keypair here on first boot.
+      # The integration test reads the private key from ./keys/id_exlab.
+      - ./keys:/keys
     restart: unless-stopped
     healthcheck:
       test: ["CMD", "sh", "-c", "ss -ltn | grep -q ':22 '"]
diff --git a/tests/docker/entrypoint.sh b/tests/docker/entrypoint.sh
index 0dea7e8..416b693 100755
--- a/tests/docker/entrypoint.sh
+++ b/tests/docker/entrypoint.sh
@@ -1,13 +1,22 @@
 #!/bin/sh
-# Entrypoint for the password-based ExLab NAS (SFTP) emulator.
-#   - sets ${NAS_USER}'s password from ${NAS_PASSWORD} on every boot
-#     (so the secret lives only in the env / .env, never in the image)
-#   - generates host keys on first boot
-#   - execs sshd in the foreground
+# Entrypoint for the password-based ExLab NAS (SFTP) + rsync-over-ssh emulator.
+#
+# SFTP user (${NAS_USER}):
+#   - sets password from ${NAS_PASSWORD} on every boot
+#   - password lives only in the env / .env, never in the image
+#
+# rsync-over-ssh user (${RSYNC_USER}):
+#   - key-only auth (no password, no SFTP)
+#   - generates an ed25519 keypair into the bind-mounted /keys/ dir on
+#     first boot (chmod 600); subsequent boots skip generation if the
+#     private key already exists
+#   - installs the public key as the user's authorized_keys
+#   - mirrors Synology posture: rsync --server over ssh works; sftp does not
 set -eu
 
 : "${NAS_USER:=testuser}"
 : "${NAS_PASSWORD:=}"
+: "${RSYNC_USER:=rsyncuser}"
 
 if [ -z "${NAS_PASSWORD}" ]; then
     echo "[entrypoint] ERROR: NAS_PASSWORD is empty; set it in tests/docker/.env" >&2
@@ -20,6 +29,27 @@ fi
 echo "${NAS_USER}:${NAS_PASSWORD}" | chpasswd
 echo "[entrypoint] set password for ${NAS_USER} (SFTP, password auth)"
 
+# rsync-over-ssh user: generate keypair on first boot, install authorized_keys.
+KEY_FILE="/keys/id_exlab"
+if [ ! -f "${KEY_FILE}" ]; then
+    echo "[entrypoint] generating ed25519 keypair for ${RSYNC_USER} -> ${KEY_FILE}"
+    mkdir -p /keys
+    ssh-keygen -t ed25519 -f "${KEY_FILE}" -N "" -C "${RSYNC_USER}@exlab-docker"
+    chmod 600 "${KEY_FILE}"
+    chmod 644 "${KEY_FILE}.pub"
+else
+    echo "[entrypoint] keypair already exists at ${KEY_FILE}, skipping generation"
+fi
+
+# Install the public key as authorized_keys for the rsync user.
+SSH_DIR="/home/${RSYNC_USER}/.ssh"
+mkdir -p "${SSH_DIR}"
+cp "${KEY_FILE}.pub" "${SSH_DIR}/authorized_keys"
+chmod 700 "${SSH_DIR}"
+chmod 600 "${SSH_DIR}/authorized_keys"
+chown -R "${RSYNC_USER}:${RSYNC_USER}" "${SSH_DIR}"
+echo "[entrypoint] installed authorized_keys for ${RSYNC_USER} (key-only, no SFTP)"
+
 # Ensure host keys exist; idempotent.
 ssh-keygen -A
 
diff --git a/tests/docker/keys/.gitkeep b/tests/docker/keys/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/tests/integration/test_rsync_ssh_characterization.py b/tests/integration/test_rsync_ssh_characterization.py
new file mode 100644
index 0000000..7ff427e
--- /dev/null
+++ b/tests/integration/test_rsync_ssh_characterization.py
@@ -0,0 +1,339 @@
+"""Characterization tests for the rsync-over-ssh transport leg.
+
+rsync-over-ssh NAS transport (2026-06-10). These tests drive the REAL
+``RsyncSshDriver`` (binary "rsync") at a live ``openssh-server`` +
+``rsync`` container that mirrors the Synology posture: key-only auth,
+no SFTP subsystem, plain ``rsync --server`` over ssh.
+
+Container TZ is pinned to ``America/New_York`` (see docker-compose.yml)
+so it differs from the typical developer's local TZ. The timezone
+characterization is embedded in ``test_push_list_reconcile_roundtrip``:
+if ``--list-only`` formats in the SERVER's timezone the mtime reconcile
+will fail (mtime off by a whole-hour multiple); if it formats in the
+CLIENT's (local) timezone the test passes. This is the empirical check
+of whether ``parse_rsync_listing``'s local-TZ assumption holds on a
+real rsync binary with a cross-TZ server.
+
+Gate: tests skip cleanly when docker is unavailable (CI without docker,
+offline dev machines). Run manually with::
+
+    docker compose -f tests/docker/docker-compose.yml up -d --build
+    uv run --extra test pytest tests/integration/test_rsync_ssh_characterization.py -v
+    docker compose -f tests/docker/docker-compose.yml down
+"""
+
+from __future__ import annotations
+
+import os
+import shutil
+import subprocess
+import time
+from pathlib import Path
+
+import pytest
+
+from exlab_wizard.sync.transports import TransportError, TransportErrorKind
+from exlab_wizard.sync.transports.rsync_ssh import RsyncSshDriver
+
+# ---------------------------------------------------------------------------
+# Constants — match docker-compose.yml / .env defaults
+# ---------------------------------------------------------------------------
+
+_DOCKER_DIR = Path(__file__).resolve().parents[2] / "tests" / "docker"
+_SSH_HOST = "localhost"
+_SSH_HOST_PORT = int(os.environ.get("SFTP_HOST_PORT", "2222"))
+_RSYNC_USER = os.environ.get("RSYNC_USER", "rsyncuser")
+_KEY_FILE = _DOCKER_DIR / "keys" / "id_exlab"
+
+# Remote data root inside the container (rsyncuser's data dir).
+_REMOTE_DATA_ROOT = f"/home/{_RSYNC_USER}/data"
+
+
+# ---------------------------------------------------------------------------
+# Docker gating — skip when the container stack is not up
+# ---------------------------------------------------------------------------
+
+
+def _docker_available() -> bool:
+    """Return True if docker is on PATH and the daemon is running."""
+    if not shutil.which("docker"):
+        return False
+    try:
+        result = subprocess.run(
+            ["docker", "info"],
+            capture_output=True,
+            timeout=10,
+        )
+        return result.returncode == 0
+    except Exception:
+        return False
+
+
+def _container_healthy(container: str = "exlab-nas-sftp") -> bool:
+    """Return True if the named container is running and healthy."""
+    try:
+        result = subprocess.run(
+            ["docker", "inspect", "--format", "{{.State.Status}}", container],
+            capture_output=True,
+            text=True,
+            timeout=10,
+        )
+        return result.returncode == 0 and result.stdout.strip() == "running"
+    except Exception:
+        return False
+
+
+def _wait_for_ssh(
+    host: str = _SSH_HOST,
+    port: int = _SSH_HOST_PORT,
+    retries: int = 30,
+    delay: float = 1.0,
+) -> bool:
+    """Poll until sshd answers a TCP connect (not full auth)."""
+    import socket
+
+    for _ in range(retries):
+        try:
+            with socket.create_connection((host, port), timeout=2):
+                return True
+        except OSError:
+            time.sleep(delay)
+    return False
+
+
+# Session-scoped fixture: bring the stack up once per pytest session and
+# yield the connection parameters; tear down after all tests in the module.
+@pytest.fixture(scope="session")
+def rsync_container():
+    """Bring up the docker compose stack and yield SSH connection params.
+
+    Skips the entire session if docker is unavailable or the container
+    fails to come up in time. The fixture does NOT call
+    ``docker compose down`` — teardown is the caller's responsibility
+    so that developers can inspect logs after a failure. The compose
+    stack started here will be stopped by the Makefile / CI workflow.
+    """
+    if not _docker_available():
+        pytest.skip("docker daemon is not available")
+
+    # Bring the stack up (build if needed). Use --no-recreate so a
+    # second pytest run in the same session is idempotent.
+    build_result = subprocess.run(
+        [
+            "docker",
+            "compose",
+            "-f",
+            str(_DOCKER_DIR / "docker-compose.yml"),
+            "up",
+            "-d",
+            "--build",
+        ],
+        cwd=_DOCKER_DIR,
+        capture_output=True,
+        text=True,
+        timeout=300,
+    )
+    if build_result.returncode != 0:
+        pytest.skip(
+            f"docker compose up failed:\n"
+            f"stdout: {build_result.stdout}\n"
+            f"stderr: {build_result.stderr}"
+        )
+
+    # Wait for sshd to answer connections.
+    if not _wait_for_ssh():
+        pytest.skip(f"sshd on port {_SSH_HOST_PORT} did not become ready in time")
+
+    # Wait for the keypair to be generated by the entrypoint.
+    for _ in range(30):
+        if _KEY_FILE.exists() and _KEY_FILE.stat().st_size > 0:
+            break
+        time.sleep(1)
+    else:
+        pytest.skip(f"keypair not found at {_KEY_FILE} after 30 s")
+
+    yield {
+        "host": _SSH_HOST,
+        "port": _SSH_HOST_PORT,
+        "user": _RSYNC_USER,
+        "key_file": str(_KEY_FILE),
+        "data_root": _REMOTE_DATA_ROOT,
+    }
+
+
+@pytest.fixture()
+def rsync_driver(rsync_container, tmp_path):
+    """Build a RsyncSshDriver pointed at the test container.
+
+    Uses a per-test throwaway known_hosts file (test seam: ssh_extra_opts)
+    so the developer's real ~/.ssh/known_hosts is never mutated. On first
+    connection, StrictHostKeyChecking=accept-new adds the container's
+    key to the throwaway file.
+    """
+    known_hosts = tmp_path / "known_hosts"
+    known_hosts.touch()
+    driver = RsyncSshDriver(
+        binary="rsync",
+        ssh_port=rsync_container["port"],
+        ssh_identity_file=rsync_container["key_file"],
+        # Test seam only — production never sets these.
+        ssh_extra_opts=(
+            f"UserKnownHostsFile={known_hosts}",
+            "StrictHostKeyChecking=accept-new",
+        ),
+    )
+    return driver, rsync_container
+
+
+@pytest.fixture()
+def remote_target(rsync_container, tmp_path):
+    """Compose a unique remote target path for this test."""
+    test_name = tmp_path.name  # pytest assigns a unique tmp_path per test
+    user = rsync_container["user"]
+    data_root = rsync_container["data_root"]
+    return f"{user}@{rsync_container['host']}:{data_root}/{test_name}"
+
+
+# ---------------------------------------------------------------------------
+# Tests
+# ---------------------------------------------------------------------------
+
+
+async def test_push_list_reconcile_roundtrip(rsync_driver, remote_target):
+    """Push a run dir, list it back, verify every file matches within 2 s.
+
+    TIMEZONE CHARACTERIZATION: the container's TZ is America/New_York
+    (pinned in docker-compose.yml) which differs from UTC and from most
+    developer TZs. ``parse_rsync_listing`` treats listing timestamps as
+    LOCAL CLIENT TIME (not server time). If rsync's ``--list-only`` output
+    is formatted in the CLIENT's timezone (which the spec assumes and the
+    unit tests confirm via stub) then ``manifest.matches(tolerance_s=2)``
+    will pass here. If it is formatted in the SERVER's TZ the mtime will
+    be off by a whole-hour multiple — the test will fail and the team
+    must apply the ``nas.remote_tz`` contingency from the spec.
+    """
+    driver, _params = rsync_driver
+    import tempfile
+
+    with tempfile.TemporaryDirectory() as _td:
+        local = Path(_td) / "run"
+        (local / "images").mkdir(parents=True)
+        # File with spaces in name — exercises listing path parsing.
+        (local / "file with spaces.tif").write_bytes(b"TIFF" * 100)
+        # File in nested subdir.
+        (local / "images" / "slice_001.tif").write_bytes(b"SLICEDATA" * 50)
+
+        result = await driver.push(local, remote_target)
+        assert result.ok, f"push failed: rc={result.returncode} stderr={result.stderr!r}"
+
+        manifest = await driver.lsjson_manifest(remote_target)
+
+        for rel_path in ("file with spaces.tif", "images/slice_001.tif"):
+            assert manifest.has(rel_path), (
+                f"manifest missing {rel_path!r}; entries: {list(manifest.entries)}"
+            )
+            local_stat = (local / rel_path.replace("/", os.sep)).stat()
+            ok = manifest.matches(rel_path, local_stat.st_size, local_stat.st_mtime, tolerance_s=2)
+            assert ok, (
+                f"mtime mismatch for {rel_path!r}: local={local_stat.st_mtime!r}, "
+                f"manifest entry={manifest.entries[rel_path]!r}. "
+                f"If offset is a whole-hour multiple, the listing is in the SERVER's "
+                f"TZ ({os.environ.get('TZ', 'client-local')}) — apply nas.remote_tz contingency."
+            )
+
+
+async def test_check_differ_and_missing(rsync_driver, remote_target, tmp_path):
+    """Push two files; corrupt one remotely, delete the other; check() finds both."""
+    driver, params = rsync_driver
+    local = tmp_path / "run"
+    local.mkdir()
+    (local / "good.bin").write_bytes(b"GOOD" * 256)
+    (local / "corrupt.bin").write_bytes(b"ORIG" * 256)
+    (local / "deleted.bin").write_bytes(b"DELETE_ME" * 100)
+
+    result = await driver.push(local, remote_target)
+    assert result.ok, f"push failed: rc={result.returncode} stderr={result.stderr!r}"
+
+    # Locate the remote files via the bind-mounted nas-data directory.
+    # remote_target is user@host:/home/rsyncuser/data/<test_name>
+    # bind mount: tests/docker/nas-data -> /home/rsyncuser/data
+    remote_sub = remote_target.split(":")[-1]
+    # Strip the leading /home/rsyncuser/data prefix to get the sub-path.
+    data_root = params["data_root"]  # /home/rsyncuser/data
+    rel_remote = remote_sub[len(data_root):].lstrip("/")
+    nas_data = _DOCKER_DIR / "nas-data" / rel_remote
+
+    corrupt_remote = nas_data / "corrupt.bin"
+    deleted_remote = nas_data / "deleted.bin"
+
+    # Corrupt the bytes but preserve the file size and mtime so rsync's
+    # modtime-only check would not catch it — only --checksum will.
+    orig_stat = corrupt_remote.stat()
+    corrupt_remote.write_bytes(b"XXXX" * 256)  # same size (1024 bytes), different content
+    os.utime(corrupt_remote, (orig_stat.st_atime, orig_stat.st_mtime))
+
+    # Delete the second file.
+    deleted_remote.unlink()
+
+    files_from = tmp_path / "files.txt"
+    files_from.write_text("corrupt.bin\ndeleted.bin\ngood.bin\n", encoding="utf-8")
+
+    check = await driver.check(local, remote_target, files_from=files_from)
+
+    assert "corrupt.bin" in check.differ, (
+        f"expected corrupt.bin in differ; got differ={check.differ!r}"
+    )
+    assert "deleted.bin" in check.missing_on_dst, (
+        f"expected deleted.bin in missing_on_dst; got {check.missing_on_dst!r}"
+    )
+    assert "good.bin" in check.equal, (
+        f"expected good.bin in equal; got equal={check.equal!r}"
+    )
+
+
+async def test_list_only_on_missing_run_dir_raises_network(rsync_driver, remote_target):
+    """lsjson_manifest on a nonexistent dir raises TransportError(NETWORK).
+
+    rsync exits 23 when the remote path doesn't exist; our driver maps
+    rc 23 to TransportErrorKind.NETWORK (partial-transfer / directory
+    missing category).
+    """
+    driver, _params = rsync_driver
+    missing_target = remote_target + "/does_not_exist_at_all_xyz"
+
+    with pytest.raises(TransportError) as excinfo:
+        await driver.lsjson_manifest(missing_target)
+
+    assert excinfo.value.error_kind == TransportErrorKind.NETWORK, (
+        f"expected NETWORK, got {excinfo.value.error_kind!r}: {excinfo.value}"
+    )
+
+
+async def test_about_ok_and_missing_base_root(rsync_driver, remote_target, tmp_path):
+    """about(existing_path) -> ok=True; about(bogus_path) -> reason mentions base_root."""
+    driver, params = rsync_driver
+
+    # First push something so the path exists.
+    local = tmp_path / "probe"
+    local.mkdir()
+    (local / "probe.bin").write_bytes(b"x")
+    push_result = await driver.push(local, remote_target)
+    assert push_result.ok, f"push failed: {push_result.stderr!r}"
+
+    # about() on the now-existing path must return ok=True.
+    ok_result = await driver.about(remote_target)
+    assert ok_result.ok, (
+        f"expected ok=True for existing path; got reason={ok_result.reason!r}"
+    )
+    assert ok_result.info == {}, f"unexpected info: {ok_result.info!r}"
+
+    # about() on a bogus path must return ok=False with base_root in reason.
+    user = params["user"]
+    host = params["host"]
+    bogus_target = f"{user}@{host}:/this/path/does/not/exist/at/all"
+    bad_result = await driver.about(bogus_target)
+    assert not bad_result.ok, "expected ok=False for bogus path"
+    assert bad_result.reason is not None, "expected a reason string"
+    assert "base_root" in bad_result.reason, (
+        f"expected 'base_root' in reason; got {bad_result.reason!r}"
+    )
diff --git a/tests/unit/sync/transports/test_rsync_ssh.py b/tests/unit/sync/transports/test_rsync_ssh.py
index 49e6fc6..ce08465 100644
--- a/tests/unit/sync/transports/test_rsync_ssh.py
+++ b/tests/unit/sync/transports/test_rsync_ssh.py
@@ -101,6 +101,19 @@ async def test_no_bwlimit_flag_when_unset(self, fake_run, tmp_path: Path) -> Non
         await RsyncSshDriver().push(tmp_path, TARGET)
         assert not any(arg.startswith("--bwlimit") for arg in run.cmds[0])
 
+    async def test_ssh_extra_opts_rendered_in_e_arg(
+        self, fake_run, tmp_path: Path
+    ) -> None:
+        """Extra ssh opts (test seam) are appended as -o pairs in the -e arg."""
+        run = fake_run(rc=0)
+        driver = RsyncSshDriver(
+            ssh_extra_opts=("UserKnownHostsFile=/tmp/kh", "StrictHostKeyChecking=accept-new")
+        )
+        await driver.push(tmp_path, TARGET)
+        ssh_arg = run.cmds[0][run.cmds[0].index("-e") + 1]
+        assert "-o UserKnownHostsFile=/tmp/kh" in ssh_arg
+        assert "-o StrictHostKeyChecking=accept-new" in ssh_arg
+
     async def test_auth_failure_classified(self, fake_run, tmp_path: Path) -> None:
         fake_run(rc=255, stderr="Permission denied (publickey).")
         result = await RsyncSshDriver().push(tmp_path, TARGET)
@@ -197,7 +210,7 @@ async def test_listing_parsed_and_prefix_ignored(self, fake_run, tmp_path: Path)
         )
         assert set(manifest.entries) == {"data file.csv"}
         cmd = run.cmds[0]
-        assert "--list-only" in cmd and "-r" in cmd and "--no-h" in cmd
+        assert "--list-only" in cmd and "-r" in cmd
         assert cmd[-1] == f"{TARGET}/"
 
     async def test_failure_raises_classified(self, fake_run) -> None:

From 079dac5739d55f22f9f12dae9ac182a942ff5d3a Mon Sep 17 00:00:00 2001
From: Alexander Nguyen <alxxander.nguyen@protonmail.com>
Date: Wed, 10 Jun 2026 02:25:21 -0700
Subject: [PATCH 19/21] docs: rsync-over-ssh NAS transport setup walkthrough +
 spec sections
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Create docs/setup/rsync-ssh-setup.md: keypair generation (ed25519,
  empty passphrase), installing pubkey on Synology service account,
  host-key pre-provisioning via ssh-keyscan with explicit note that no
  login permission is needed (host-key exchange precedes auth), out-of-band
  fingerprint verification against DSM, recording rsync --version in the
  runbook, config.yaml block (rsync_ssh example from spec), degraded
  Test-connection note, and BatchMode failure-modes table
- Add cross-link from docs/setup/rclone-remote-setup.md to rsync-ssh-setup.md
- docs/design_specs/design_spec_sections/09_Configuration_File.md: add
  nas.transport / ssh_port / ssh_identity_file fields to the nas: block
  with inline comments
- docs/design_specs/design_spec_sections/07_Sync_and_Database_Integration.md:
  add §7.1.3 transport matrix (rclone vs rsync_ssh) + verify-authority-differs-
  by-transport paragraph; update §7.1.3 header from "sole transport" to
  multi-transport framing
- docs/design_specs/design_spec_sections/04_Backend_Architecture.md: add
  sync/transports/ subtree to the package layout; add NasTransportDriver
  Protocol + build_nas_driver factory paragraph
- README.md: add one-line rsync-over-ssh transport mention + link to
  rsync-ssh-setup.md in the NAS sync setup section

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 README.md                                     |   9 +-
 .../04_Backend_Architecture.md                |   6 +
 .../07_Sync_and_Database_Integration.md       |  27 ++-
 .../09_Configuration_File.md                  |  17 +-
 docs/setup/rclone-remote-setup.md             |  12 +-
 docs/setup/rsync-ssh-setup.md                 | 173 ++++++++++++++++++
 6 files changed, 232 insertions(+), 12 deletions(-)
 create mode 100644 docs/setup/rsync-ssh-setup.md

diff --git a/README.md b/README.md
index 8eea354..c018d06 100644
--- a/README.md
+++ b/README.md
@@ -124,7 +124,10 @@ container weekly and on every merge to `main`.
 ## NAS sync setup
 
 ExLab-Wizard syncs runs to your NAS via [rclone](https://rclone.org/) named
-remotes. The app never stores NAS passwords — you configure the remote once
+remotes (default) or via `rsync` over ssh for cluster nodes where IT blocks
+SMB/SFTP. The app never stores NAS passwords or ssh key passphrases.
+
+**rclone transport (default — lab acquisition PCs):** configure the remote once
 with `rclone config` and wire the remote name into `config.yaml`:
 
 ```yaml
@@ -136,6 +139,10 @@ nas:
 Step-by-step instructions (SFTP and SMB walkthroughs, performance tuning,
 tray-service caveats): **[`docs/setup/rclone-remote-setup.md`](docs/setup/rclone-remote-setup.md)**.
 
+**rsync-over-ssh transport (cluster nodes where IT blocks rclone):** set
+`nas.transport: rsync_ssh` and `nas.remote: user@host`. Keypair provisioning
+and `known_hosts` pre-loading walkthrough: **[`docs/setup/rsync-ssh-setup.md`](docs/setup/rsync-ssh-setup.md)**.
+
 Settings → **NAS Remote** → **Test connection** verifies the remote is
 reachable before you start syncing.
 
diff --git a/docs/design_specs/design_spec_sections/04_Backend_Architecture.md b/docs/design_specs/design_spec_sections/04_Backend_Architecture.md
index 413cab4..cc4f6f4 100644
--- a/docs/design_specs/design_spec_sections/04_Backend_Architecture.md
+++ b/docs/design_specs/design_spec_sections/04_Backend_Architecture.md
@@ -130,6 +130,10 @@ exlab_wizard/
     generator.py           # merge field layers, render YAML+Markdown, write README.md + readme_fields.json
   sync/
     nas_client.py          # NASSync interface (see §7.1)
+    transports/
+      __init__.py          # NasTransportDriver Protocol (push/check/lsjson_manifest/about) + build_nas_driver factory
+      rclone.py            # RcloneDriver — default transport; thin rclone subprocess wrapper
+      rsync_ssh.py         # RsyncSshDriver — rsync-over-ssh transport for cluster nodes (2026-06-10)
   lims/
     client.py              # LIMSClient (read-only in v1; see §7.2). Uses httpx for REST + cookie session.
     schemas.py             # LIMSProject, LIMSUser as msgspec.Struct types
@@ -178,6 +182,8 @@ tests/
 
 The `ui/` package depends on `controller/` and the API schema modules but never the reverse: no backend module imports from `ui/`. This is the testability boundary — backend can be exercised without a browser.
 
+**NAS transport abstraction (2026-06-10).** `sync/transports/__init__.py` defines `NasTransportDriver`, a structural Protocol with four async methods (`push`, `check`, `lsjson_manifest`, `about`) consumed by `NASSyncClient` and the tray probe. `RcloneDriver` and `RsyncSshDriver` both implement the protocol. Every construction site routes through the `build_nas_driver(nas: NasConfig, perf: RclonePerf) -> NasTransportDriver` factory; the factory branches on `nas.transport`. Stage-mode equipment always gets a `RcloneDriver` regardless of `nas.transport` because its targets are rclone named-remote strings, not `user@host` ssh targets (see §7.1 and `CLAUDE.md`).
+
 ### 4.3.1 The `constants/` package
 
 A small set of values appears in many specifications and must stay synchronized across the codebase: schema version numbers, file names of cache files, regex patterns, keyring service identifier, enum string values. The `constants/` package is the single source of truth for these. Rules:
diff --git a/docs/design_specs/design_spec_sections/07_Sync_and_Database_Integration.md b/docs/design_specs/design_spec_sections/07_Sync_and_Database_Integration.md
index 03578e2..06fa3e8 100644
--- a/docs/design_specs/design_spec_sections/07_Sync_and_Database_Integration.md
+++ b/docs/design_specs/design_spec_sections/07_Sync_and_Database_Integration.md
@@ -60,9 +60,30 @@ QUEUED → RUNNING → AWAITING_VERIFY → VERIFIED → CLEANUP_ELIGIBLE → CLE
 
 Job rows persist across restarts. On startup, NASSync requeues any `RUNNING` or `AWAITING_VERIFY` jobs (treating them as `QUEUED` and `VERIFIED → AWAITING_VERIFY` respectively, since transport may have completed but verification didn't run).
 
-### 7.1.3 Transport driver (`RcloneDriver`)
-
-The sole transport for v1 is `RcloneDriver` (`exlab_wizard.sync.transports.rclone`),
+### 7.1.3 Transport drivers
+
+The transport used by each instance is selected by `nas.transport` in
+`config.yaml` (default: `rclone`). The factory `build_nas_driver(nas, perf)`
+in `exlab_wizard.sync.transports` returns the appropriate driver.
+
+| Transport | Selected by | Binary | Auth | Verify authority |
+|-----------|------------|--------|------|-----------------|
+| `rclone` (default) | `nas.transport: rclone` (or absent) | `rclone` | Named remote in `rclone.conf` | `rclone check --download` — pulls file bytes to the client and hashes locally |
+| `rsync_ssh` | `nas.transport: rsync_ssh` | `rsync` | ssh key (`BatchMode=yes`) | `rsync -rni --checksum` dry-run — computes checksums inside the rsync protocol on the remote side |
+
+**Verify authority differs by transport.** `RcloneDriver.check` downloads the
+remote bytes to the client to hash them locally, meaning the hash computation
+runs on the client and the network carries the full file payload. `RsyncSshDriver.check`
+invokes a dry-run with `--checksum` inside the rsync protocol, delegating the
+hash computation to the remote rsync process; only the itemize-change output
+(a handful of flag bytes per file) crosses the wire. Both signal
+"content differs" correctly, but in rsync mode the trust is placed on the
+remote-side rsync binary rather than a local hash. This is an accepted
+trust-posture change (2026-06-10 spec-review).
+
+#### `RcloneDriver`
+
+`RcloneDriver` (`exlab_wizard.sync.transports.rclone`) is the default transport,
 a thin wrapper around the `rclone` binary. The driver exposes four operations:
 
 | Method | Command | Purpose |
diff --git a/docs/design_specs/design_spec_sections/09_Configuration_File.md b/docs/design_specs/design_spec_sections/09_Configuration_File.md
index f051d7b..6e43974 100644
--- a/docs/design_specs/design_spec_sections/09_Configuration_File.md
+++ b/docs/design_specs/design_spec_sections/09_Configuration_File.md
@@ -75,13 +75,22 @@ equipment:
     sync_mode: "nas"
 
 # Top-level NAS sync configuration. A single named rclone remote covers all
-# nas-mode equipment. Credentials live entirely in rclone.conf.
+# nas-mode equipment. Credentials live entirely in rclone.conf (rclone mode)
+# or in the operator's ~/.ssh/ (rsync_ssh mode).
 nas:
-  remote: "lab-nas"                     # remote name from rclone.conf (set up with rclone config)
+  remote: "lab-nas"                     # rclone mode: remote name from rclone.conf (set up with rclone config)
+                                        # rsync_ssh mode: "user@host" target prefix
   base_root: "lab"                      # path on the remote under which equipment folders live
                                         # run target: lab-nas:/lab/<EQUIPMENT_ID>/<run-leaf>
-  rclone_config_path: ""                # optional: pin --config <path> (blank = rclone default discovery)
-  mtime_tolerance_s: 2                  # reconcile tolerance (s); absorbs SFTP/SMB modtime rounding
+  rclone_config_path: ""                # rclone mode only: optional pin --config <path> (blank = default discovery)
+  mtime_tolerance_s: 2                  # reconcile tolerance (s); absorbs SFTP/SMB/rsync modtime rounding
+  # rsync-over-ssh transport (2026-06-10). Cluster nodes where IT blocks
+  # rclone/SMB/SFTP can use rsync --server over ssh instead. Lab PCs keep
+  # the default rclone transport. See docs/setup/rsync-ssh-setup.md.
+  transport: "rclone"                   # "rclone" (default) | "rsync_ssh"
+  ssh_port: 22                          # rsync_ssh mode: ssh port on the NAS (default 22)
+  ssh_identity_file: ""                 # rsync_ssh mode: path to the ed25519 private key
+                                        # (blank = ssh default key discovery; BatchMode=yes always set)
   perf:
     transfers: 4                        # rclone --transfers; also the RAM dial on constrained machines
     checkers: 8                         # rclone --checkers
diff --git a/docs/setup/rclone-remote-setup.md b/docs/setup/rclone-remote-setup.md
index f43297e..9b8cf4a 100644
--- a/docs/setup/rclone-remote-setup.md
+++ b/docs/setup/rclone-remote-setup.md
@@ -1,9 +1,13 @@
 # Setting up your rclone remote(s)
 
-ExLab-Wizard uses [rclone](https://rclone.org/) as its NAS transport. Rather than
-storing NAS credentials inside the app, you configure a named remote once with
-`rclone config` and then tell the app which remote name to use. The app never
-sees a password — all connection details live in `rclone.conf`.
+ExLab-Wizard uses [rclone](https://rclone.org/) as its **default** NAS transport.
+Rather than storing NAS credentials inside the app, you configure a named remote
+once with `rclone config` and then tell the app which remote name to use. The app
+never sees a password — all connection details live in `rclone.conf`.
+
+> **Cluster nodes where SMB/SFTP is blocked by IT:** use the `rsync_ssh`
+> transport instead. See [`rsync-ssh-setup.md`](rsync-ssh-setup.md) for the
+> key provisioning and `config.yaml` walkthrough.
 
 ---
 
diff --git a/docs/setup/rsync-ssh-setup.md b/docs/setup/rsync-ssh-setup.md
new file mode 100644
index 0000000..736288a
--- /dev/null
+++ b/docs/setup/rsync-ssh-setup.md
@@ -0,0 +1,173 @@
+# Setting up rsync-over-ssh NAS transport
+
+ExLab-Wizard's `rsync_ssh` transport is for cluster nodes where IT blocks
+rclone (SMB/SFTP is disabled on the Synology) but allows rsync-over-ssh. Lab
+acquisition PCs keep the default `rclone` transport unchanged; only cluster
+instances need this walkthrough.
+
+> **Also see:** [`rclone-remote-setup.md`](rclone-remote-setup.md) for the
+> rclone/SMB setup used on lab acquisition PCs.
+
+---
+
+## How it works
+
+Instead of a named rclone remote, the `rsync_ssh` transport drives `rsync -e
+ssh` directly. `nas.remote` becomes `user@host` (the Synology service account),
+and the app composes the full target as `user@host:/<base_root>/<equipment_id>/<run>`.
+All four sync operations (push, manifest listing, content verify, connection
+probe) use the rsync protocol channel only — no interactive ssh login, no
+SFTP subsystem, no remote command execution. IT allowlists exactly
+`rsync --server` over ssh; that is all this transport needs.
+
+Credentials are ssh keys only (`BatchMode=yes`). No password is ever stored or
+prompted. Key exchange happens before authentication, so the host-key can be
+pre-provisioned without any login permission.
+
+---
+
+## Prerequisites
+
+- **rsync** on the cluster node (`rsync --version` should report 3.x).
+- **rsync** on the Synology NAS (installed via DSM Package Center or the
+  Synology rsync service; verify with `rsync --version` output recorded in
+  your runbook — see the "Recording rsync version" step below).
+- **OpenSSH client** (`ssh`, `ssh-keygen`, `ssh-keyscan`) on the cluster node.
+
+---
+
+## Step 1 — Generate a dedicated keypair
+
+Generate a key specifically for ExLab-Wizard NAS sync. Using a dedicated key
+lets you revoke or rotate it without affecting your personal ssh access.
+
+```bash
+ssh-keygen -t ed25519 -f ~/.ssh/id_exlab -N ""
+```
+
+- `-N ""` sets an empty passphrase so the sync worker can use the key
+  non-interactively (`BatchMode=yes` requires no passphrase prompt).
+- The private key is `~/.ssh/id_exlab`; the public key is `~/.ssh/id_exlab.pub`.
+
+Restrict permissions:
+
+```bash
+chmod 600 ~/.ssh/id_exlab
+```
+
+---
+
+## Step 2 — Install the public key on the Synology service account
+
+Copy the public key to the person who manages your Synology NAS (lab IT or
+the NAS admin). They need to append the contents of `~/.ssh/id_exlab.pub` to
+the `~/.ssh/authorized_keys` file of the NAS service account
+(`svc-sync@nas01.lab.example` in the example below).
+
+If you have temporary password ssh access to the NAS service account:
+
+```bash
+ssh-copy-id -i ~/.ssh/id_exlab.pub -p <port> svc-sync@nas01.lab.example
+```
+
+Or share the one-line `~/.ssh/id_exlab.pub` content with your NAS admin for
+manual installation.
+
+---
+
+## Step 3 — Pre-provision the NAS host key
+
+`BatchMode=yes` means ssh will fail immediately if the host key is unknown
+rather than prompting you interactively. Pre-provision the key before the
+first sync run.
+
+> **No login permission required.** The host-key exchange (Step 3) happens
+> at the TCP/cryptographic layer, before authentication. You do not need
+> shell access to the NAS to run `ssh-keyscan`.
+
+```bash
+ssh-keyscan -p <port> nas01.lab.example >> ~/.ssh/known_hosts
+```
+
+Verify the key fingerprint out-of-band against DSM or your NAS admin to
+guard against a man-in-the-middle substitution:
+
+```bash
+# Compare this fingerprint against what DSM shows under
+# Control Panel → Terminal & SNMP → SSH key fingerprints.
+ssh-keygen -lf <(ssh-keyscan -p <port> nas01.lab.example 2>/dev/null)
+```
+
+---
+
+## Step 4 — Record the NAS rsync version
+
+Record the Synology's rsync version in your runbook. Differences in rsync
+protocol versions between client and server can occasionally cause format
+quirks in listing output. Run from the cluster node after keys are installed:
+
+```bash
+ssh -p <port> -i ~/.ssh/id_exlab svc-sync@nas01.lab.example rsync --version
+# Record the first line (e.g. "rsync version 3.2.3 ...") in your lab runbook.
+```
+
+---
+
+## Step 5 — Add the `rsync_ssh` block to `config.yaml`
+
+```yaml
+nas:
+  transport: "rsync_ssh"
+  remote: "svc-sync@nas01.lab.example"   # user@host — doubles as the target prefix
+  base_root: "/volume1/lab"              # absolute path on the NAS
+  ssh_port: 22                           # optional, default 22
+  ssh_identity_file: "~/.ssh/id_exlab"  # optional; blank = ssh default key discovery
+  mtime_tolerance_s: 2                   # modtime tolerance for reconcile (seconds)
+  bandwidth:
+    upload_mbps: null                    # null = unlimited
+```
+
+The full target path for a run is:
+
+```
+svc-sync@nas01.lab.example:/volume1/lab/<EQUIPMENT_ID>/<run-directory-name>
+```
+
+---
+
+## Step 6 — Test the connection
+
+Open **Settings → NAS Remote → Test connection** in ExLab-Wizard.
+
+> **Degraded probe by design:** the rsync transport cannot query free-space
+> without remote command execution (which IT blocks). Test-connection reports
+> reachable + auth ok or a classified failure — no free-space info is shown.
+> This is expected and not a configuration error.
+
+---
+
+## Failure modes (BatchMode=yes)
+
+When ssh runs in `BatchMode=yes` it fails immediately instead of prompting.
+The error is classified by the driver and surfaced in the Settings panel and
+the log.
+
+| Symptom | Likely cause | Fix |
+|---------|-------------|-----|
+| `Permission denied (publickey)` | Key not installed on the NAS service account, or wrong identity file | Verify `ssh_identity_file` path; re-run `ssh-copy-id` |
+| `Host key verification failed` | Host key not in `~/.ssh/known_hosts` | Re-run `ssh-keyscan` (Step 3); verify fingerprint |
+| `Connection refused` / timeout | Network or IT policy blocking the port | Check firewall rules; confirm with IT that the NAS ssh port is reachable from this cluster node |
+| `Too many authentication failures` | SSH agent offering too many keys before the correct one | Set `ssh_identity_file` explicitly in config to skip key negotiation |
+
+---
+
+## Notes on `perf` and rclone-only fields
+
+`nas.perf.transfers` and `nas.perf.checkers` are rclone parallelism dials.
+They are **ignored** (not rejected) by the `rsync_ssh` transport — rsync is
+single-stream per invocation. Set them to rclone defaults for forward
+compatibility; they will be used again if you ever switch the instance back
+to rclone.
+
+`nas.rclone_config_path` is also ignored by `rsync_ssh` — there is no
+rclone involved.

From 4b8d5834648b4dd4a0981d0132ea5c2b97b53a09 Mon Sep 17 00:00:00 2001
From: Alexander Nguyen <alxxander.nguyen@protonmail.com>
Date: Wed, 10 Jun 2026 02:36:37 -0700
Subject: [PATCH 20/21] =?UTF-8?q?fix(sync):=20review=20fixes=20=E2=80=94?=
 =?UTF-8?q?=20narrow=20ssh=20auth=20marker,=20loud=20parser=20warning,=20e?=
 =?UTF-8?q?xact=20stub=20dry-run=20match?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Final-review findings: (1) the bare 'permission denied' auth marker
would terminally fail a job on a remote per-file filesystem error
('Permission denied (13)'); anchor on ssh's parenthesized auth-method
form instead. (2) An '-h'-formatted listing size silently dropped the
file from the manifest, re-queuing it forever — entry-shaped lines with
unparseable sizes now log a warning. (3) stub_rsync's dry-run detection
substring-matched 'n' in any flag; exact-match the driver's spellings.
The errors-always-empty CheckResult contract difference is now
documented in _synthesize_check.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 src/exlab_wizard/sync/manifest.py             | 27 +++++++++++++++++--
 src/exlab_wizard/sync/transports/rsync_ssh.py | 14 ++++++++--
 tests/fixtures/stub_rsync.py                  |  4 ++-
 tests/unit/sync/test_manifest.py              |  9 +++++++
 tests/unit/sync/transports/test_rsync_ssh.py  |  7 +++++
 5 files changed, 56 insertions(+), 5 deletions(-)

diff --git a/src/exlab_wizard/sync/manifest.py b/src/exlab_wizard/sync/manifest.py
index 04e1e5b..a85b40d 100644
--- a/src/exlab_wizard/sync/manifest.py
+++ b/src/exlab_wizard/sync/manifest.py
@@ -135,6 +135,14 @@ def parse_lsjson(raw: str, *, strip_prefix: str = "") -> RemoteManifest:
 # rsync escapes unusual bytes in listings as ``\#ooo`` (3 octal digits).
 _RSYNC_ESCAPE_RE = re.compile(r"\\#([0-7]{3})")
 
+# Loose shape of a listing entry whose size field did NOT parse as plain
+# digits (e.g. a human-readable "4.0K" from an rsync invoked with ``-h``).
+# Such lines must never be dropped silently: a file missing from the
+# manifest is re-queued forever with no operator-visible cause.
+_RSYNC_LIST_LOOSE_RE = re.compile(
+    r"^\S+\s+\S+\s+\d{4}/\d{2}/\d{2}\s+\d{2}:\d{2}:\d{2}\s"
+)
+
 
 def _unescape_rsync_path(path: str) -> str:
     """Decode rsync's ``\\#ooo`` octal escapes back into the real bytes."""
@@ -162,12 +170,20 @@ def parse_rsync_listing(raw: str) -> RemoteManifest:
     parsed as local time and stored as an RFC3339 UTC string so
     :meth:`RemoteManifest.matches` works identically for both transports.
     Unparseable lines are skipped (a listing we can't parse must not
-    crash the sync worker).
+    crash the sync worker), but a line that *looks* like an entry whose
+    size failed to parse — the signature of human-readable ``-h`` output
+    — is counted and surfaced as a warning, because the resulting
+    missing manifest entries would otherwise re-queue files forever with
+    no operator-visible cause.
     """
     out: dict[str, RemoteEntry] = {}
+    unparseable_entries = 0
     for raw_line in raw.splitlines():
-        match = _RSYNC_LIST_RE.match(raw_line.rstrip())
+        line = raw_line.rstrip()
+        match = _RSYNC_LIST_RE.match(line)
         if match is None:
+            if _RSYNC_LIST_LOOSE_RE.match(line):
+                unparseable_entries += 1
             continue
         if not match.group("perms").startswith("-"):
             continue
@@ -186,4 +202,11 @@ def parse_rsync_listing(raw: str) -> RemoteManifest:
             continue
         mod_time = local_dt.astimezone(UTC).isoformat().replace("+00:00", "Z")
         out[path] = RemoteEntry(size=size, mod_time=mod_time, is_dir=False)
+    if unparseable_entries:
+        _log.warning(
+            "rsync listing: %d entry-shaped line(s) had an unparseable size "
+            "field (human-readable rsync output? the client must not run "
+            "with -h); affected files will not reconcile",
+            unparseable_entries,
+        )
     return RemoteManifest(entries=out)
diff --git a/src/exlab_wizard/sync/transports/rsync_ssh.py b/src/exlab_wizard/sync/transports/rsync_ssh.py
index 5065198..246fc94 100644
--- a/src/exlab_wizard/sync/transports/rsync_ssh.py
+++ b/src/exlab_wizard/sync/transports/rsync_ssh.py
@@ -40,9 +40,13 @@
 
 
 # ssh-level failures that are configuration problems, not transient
-# network errors. Matched case-insensitively against stderr.
+# network errors. Matched case-insensitively against stderr. The
+# permission-denied marker is deliberately anchored on ssh's
+# parenthesized auth-method list ("Permission denied (publickey...") so
+# a remote per-file filesystem error -- rsync's "Permission denied (13)"
+# -- stays on the retryable rc-23 path instead of terminating the job.
 _AUTH_FAILURE_MARKERS: tuple[str, ...] = (
-    "permission denied",
+    "permission denied (publickey",
     "host key verification failed",
     "too many authentication failures",
     "no supported authentication",
@@ -74,6 +78,12 @@ def _synthesize_check(requested: tuple[str, ...], stdout: str) -> CheckResult:
     positionally from the front, never by total length. Only
     regular-file lines (``f`` at index 1) participate; ``.``-type lines
     (no transfer needed) and unmatched lines fall through to ``equal``.
+
+    Accepted contract difference vs rclone's ``CheckResult``: ``errors``
+    is always ``()`` here. rsync itemize has no per-file error line (no
+    ``!``-prefix equivalent) — failures surface on stderr with a
+    non-zero exit, which :meth:`RsyncSshDriver.check` raises as a
+    classified :class:`TransportError` before this synthesis runs.
     """
     differ: list[str] = []
     missing: list[str] = []
diff --git a/tests/fixtures/stub_rsync.py b/tests/fixtures/stub_rsync.py
index b0f2397..b17a6a4 100644
--- a/tests/fixtures/stub_rsync.py
+++ b/tests/fixtures/stub_rsync.py
@@ -106,7 +106,9 @@ def main() -> int:
         return 0
 
     # ---- dry-run check ----------------------------------------------------
-    if "-n" in argv or any("n" in a for a in argv if a.startswith("-") and "=" not in a):
+    # Exact-match the driver's dry-run spellings; a substring scan for "n"
+    # would misroute any future flag merely containing the letter.
+    if "-n" in argv or "--dry-run" in argv or "-rni" in argv:
         rels = _files_from_paths(argv)
         if behavior == "check_differ":
             for rel in rels:
diff --git a/tests/unit/sync/test_manifest.py b/tests/unit/sync/test_manifest.py
index e5a7a50..24d1a91 100644
--- a/tests/unit/sync/test_manifest.py
+++ b/tests/unit/sync/test_manifest.py
@@ -49,6 +49,15 @@ def test_octal_escapes_unescaped(self) -> None:
     def test_garbage_lines_ignored(self) -> None:
         assert parse_rsync_listing("sending incremental file list\n\n").entries == {}
 
+    def test_human_readable_size_warns_instead_of_silent_drop(self, caplog) -> None:
+        # "-h"-formatted sizes ("4.0K") must not vanish silently: the file
+        # would otherwise re-queue forever with no operator-visible cause.
+        raw = f"-rw-r--r--          4.0K {_stamp(1_750_000_000)} data.csv\n"
+        with caplog.at_level("WARNING"):
+            manifest = parse_rsync_listing(raw)
+        assert manifest.entries == {}
+        assert any("unparseable size" in rec.message for rec in caplog.records)
+
     def test_empty_input(self) -> None:
         assert parse_rsync_listing("").entries == {}
 
diff --git a/tests/unit/sync/transports/test_rsync_ssh.py b/tests/unit/sync/transports/test_rsync_ssh.py
index ce08465..1311f18 100644
--- a/tests/unit/sync/transports/test_rsync_ssh.py
+++ b/tests/unit/sync/transports/test_rsync_ssh.py
@@ -69,6 +69,13 @@ def test_protocol_and_partial_codes_are_network(self, rc: int) -> None:
     def test_other_nonzero_is_unknown(self) -> None:
         assert _classify_failure("rsync: syntax error", 1) == TransportErrorKind.UNKNOWN
 
+    def test_remote_file_permission_error_is_not_auth(self) -> None:
+        # A per-file filesystem error on the NAS ("Permission denied (13)")
+        # must stay on the retryable rc-23 path — only ssh's parenthesized
+        # auth-method form ("Permission denied (publickey...") is terminal.
+        stderr = 'rsync: send_files failed to open "/v1/lab/x.csv": Permission denied (13)'
+        assert _classify_failure(stderr, 23) == TransportErrorKind.NETWORK
+
 
 class TestPush:
     async def test_success_argv_shape(self, fake_run, tmp_path: Path) -> None:

From e1f8e5b1c42de206f649ba63cf6c1550f29bc067 Mon Sep 17 00:00:00 2001
From: Alexander Nguyen <alxxander.nguyen@protonmail.com>
Date: Wed, 10 Jun 2026 02:46:21 -0700
Subject: [PATCH 21/21] style: ruff-format branch-touched files + spec status
 -> implemented

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 ...26-06-10-rsync-ssh-nas-transport-design.md | 24 +++++++++++++++++--
 src/exlab_wizard/config/models.py             |  3 +--
 src/exlab_wizard/paths.py                     |  4 +---
 src/exlab_wizard/sync/manifest.py             |  4 +---
 src/exlab_wizard/sync/nas_client.py           |  1 -
 src/exlab_wizard/sync/transports/__init__.py  |  8 ++-----
 src/exlab_wizard/sync/transports/rsync_ssh.py | 16 ++++---------
 src/exlab_wizard/ui/pages/settings.py         | 12 +++-------
 8 files changed, 34 insertions(+), 38 deletions(-)

diff --git a/docs/superpowers/specs/2026-06-10-rsync-ssh-nas-transport-design.md b/docs/superpowers/specs/2026-06-10-rsync-ssh-nas-transport-design.md
index 0ecd28d..5fb7458 100644
--- a/docs/superpowers/specs/2026-06-10-rsync-ssh-nas-transport-design.md
+++ b/docs/superpowers/specs/2026-06-10-rsync-ssh-nas-transport-design.md
@@ -1,8 +1,28 @@
 # rsync-over-ssh NAS transport
 
 - **Date:** 2026-06-10
-- **Status:** Design — decisions resolved + spec-review findings applied
-  (2026-06-10), pending implementation plan
+- **Status:** Implemented (plan:
+  [`../plans/2026-06-10-rsync-ssh-nas-transport.md`](../plans/2026-06-10-rsync-ssh-nas-transport.md),
+  branch `feature/rsync-ssh-transport`). Implementation amendments:
+  - The docker characterization suite **empirically confirmed
+    client-side timezone formatting** of `--list-only` output (container
+    pinned to `America/New_York`, round-trip reconciled) — the parser's
+    local-tz assumption holds; no `remote_tz` contingency needed.
+  - `--no-h` was dropped from the listing/probe argvs: macOS openrsync
+    (the dev/docker client) rejects it, GNU rsync's *default* output is
+    comma-grouped digits which the parser handles, and `-h` units have
+    no implicit enablement path. The silent-failure tail risk is covered
+    instead by a parser warning on entry-shaped lines with unparseable
+    sizes.
+  - Accepted contract difference: the rsync `CheckResult.errors` is
+    always `()` (itemize has no per-file error line; failures surface as
+    stderr + non-zero rc, raised as classified `TransportError`).
+  - `RsyncSshDriver` gained a keyword-only `ssh_extra_opts` **test
+    seam** (integration fixtures point ssh at a throwaway known_hosts);
+    production config does not expose it.
+  - The ssh auth-failure marker is anchored on `permission denied
+    (publickey` so a remote per-file `Permission denied (13)` stays
+    retryable.
 - **Builds on:**
   [`2026-05-28-rclone-conf-nas-sync-design.md`](2026-05-28-rclone-conf-nas-sync-design.md)
   (rclone stays the default transport; this spec adds a second transport, it
diff --git a/src/exlab_wizard/config/models.py b/src/exlab_wizard/config/models.py
index 8962c79..00be495 100644
--- a/src/exlab_wizard/config/models.py
+++ b/src/exlab_wizard/config/models.py
@@ -317,8 +317,7 @@ def _validate_rsync_ssh(self) -> NasConfig:
         # basic shape check.
         if not (sep and user and host) or user.startswith("-") or host.startswith("-"):
             msg = (
-                f"nas.remote {self.remote!r} must be 'user@host' when "
-                "nas.transport is 'rsync_ssh'"
+                f"nas.remote {self.remote!r} must be 'user@host' when nas.transport is 'rsync_ssh'"
             )
             raise ValueError(msg)
         return self
diff --git a/src/exlab_wizard/paths.py b/src/exlab_wizard/paths.py
index 2ba768a..b228244 100644
--- a/src/exlab_wizard/paths.py
+++ b/src/exlab_wizard/paths.py
@@ -709,9 +709,7 @@ def _missing_nas_fields(config: Config | None) -> list[dict[str, str]]:
     from exlab_wizard.constants import SyncTransport
 
     if config.nas.transport == SyncTransport.RSYNC_SSH:
-        return [
-            {"field": "nas.ssh_identity_file", "reason": "identity_file_missing"}
-        ]
+        return [{"field": "nas.ssh_identity_file", "reason": "identity_file_missing"}]
     return [{"field": "nas.remote", "reason": "not_found_in_rclone_conf"}]
 
 
diff --git a/src/exlab_wizard/sync/manifest.py b/src/exlab_wizard/sync/manifest.py
index a85b40d..941d6ed 100644
--- a/src/exlab_wizard/sync/manifest.py
+++ b/src/exlab_wizard/sync/manifest.py
@@ -139,9 +139,7 @@ def parse_lsjson(raw: str, *, strip_prefix: str = "") -> RemoteManifest:
 # digits (e.g. a human-readable "4.0K" from an rsync invoked with ``-h``).
 # Such lines must never be dropped silently: a file missing from the
 # manifest is re-queued forever with no operator-visible cause.
-_RSYNC_LIST_LOOSE_RE = re.compile(
-    r"^\S+\s+\S+\s+\d{4}/\d{2}/\d{2}\s+\d{2}:\d{2}:\d{2}\s"
-)
+_RSYNC_LIST_LOOSE_RE = re.compile(r"^\S+\s+\S+\s+\d{4}/\d{2}/\d{2}\s+\d{2}:\d{2}:\d{2}\s")
 
 
 def _unescape_rsync_path(path: str) -> str:
diff --git a/src/exlab_wizard/sync/nas_client.py b/src/exlab_wizard/sync/nas_client.py
index 4b092b8..ca97757 100644
--- a/src/exlab_wizard/sync/nas_client.py
+++ b/src/exlab_wizard/sync/nas_client.py
@@ -131,7 +131,6 @@ def _matches_any_glob(name: str, globs: list[str]) -> bool:
     return any(fnmatch.fnmatch(name, pattern) for pattern in globs)
 
 
-
 @dataclass(frozen=True, slots=True)
 class _RemoteResolution:
     """The ``(remote, base_root, perf)`` an equipment's ops resolve to.
diff --git a/src/exlab_wizard/sync/transports/__init__.py b/src/exlab_wizard/sync/transports/__init__.py
index 2bfe929..24f420c 100644
--- a/src/exlab_wizard/sync/transports/__init__.py
+++ b/src/exlab_wizard/sync/transports/__init__.py
@@ -86,13 +86,9 @@ async def push(
         files_from: Path | None = None,
     ) -> TransportResult: ...
 
-    async def check(
-        self, local: Path, remote: str, *, files_from: Path
-    ) -> CheckResult: ...
+    async def check(self, local: Path, remote: str, *, files_from: Path) -> CheckResult: ...
 
-    async def lsjson_manifest(
-        self, remote: str, *, strip_prefix: str = ""
-    ) -> RemoteManifest: ...
+    async def lsjson_manifest(self, remote: str, *, strip_prefix: str = "") -> RemoteManifest: ...
 
     async def about(self, remote: str) -> AboutResult: ...
 
diff --git a/src/exlab_wizard/sync/transports/rsync_ssh.py b/src/exlab_wizard/sync/transports/rsync_ssh.py
index 246fc94..a62913b 100644
--- a/src/exlab_wizard/sync/transports/rsync_ssh.py
+++ b/src/exlab_wizard/sync/transports/rsync_ssh.py
@@ -106,9 +106,7 @@ def _synthesize_check(requested: tuple[str, ...], stdout: str) -> CheckResult:
         # any other combination (e.g. ``.f..t......``) is an attr-only
         # change: content equal under --checksum -> credited via `equal`.
     equal = tuple(rel for rel in requested if rel not in flagged)
-    return CheckResult(
-        equal=equal, differ=tuple(differ), missing_on_dst=tuple(missing)
-    )
+    return CheckResult(equal=equal, differ=tuple(differ), missing_on_dst=tuple(missing))
 
 
 class RsyncSshDriver:
@@ -194,9 +192,7 @@ async def push(
             ok=False, error_kind=kind, stderr=stderr, stdout=stdout, returncode=rc
         )
 
-    async def check(
-        self, local: Path, remote: str, *, files_from: Path
-    ) -> CheckResult:
+    async def check(self, local: Path, remote: str, *, files_from: Path) -> CheckResult:
         """Content verify via ``rsync -rni --checksum`` dry-run (resolved OQ-1).
 
         The remote rsync hashes whole files inside the rsync protocol
@@ -245,9 +241,7 @@ async def check(
             requested = ()
         return _synthesize_check(requested, stdout)
 
-    async def lsjson_manifest(
-        self, remote: str, *, strip_prefix: str = ""
-    ) -> RemoteManifest:
+    async def lsjson_manifest(self, remote: str, *, strip_prefix: str = "") -> RemoteManifest:
         """List the remote subtree via ``--list-only -r`` (resolved OQ-2).
 
         ``strip_prefix`` is accepted for protocol parity but ignored —
@@ -305,8 +299,6 @@ async def about(self, remote: str) -> AboutResult:
         if rc == 0:
             return AboutResult(ok=True, info={})
         if rc == 23 and not stdout.strip():
-            return AboutResult(
-                ok=False, reason="base_root not found or inaccessible on the NAS"
-            )
+            return AboutResult(ok=False, reason="base_root not found or inaccessible on the NAS")
         kind = _classify_failure(stderr, rc)
         return AboutResult(ok=False, reason=f"{kind.value}: {stderr.strip()}")
diff --git a/src/exlab_wizard/ui/pages/settings.py b/src/exlab_wizard/ui/pages/settings.py
index 35db911..9a16139 100644
--- a/src/exlab_wizard/ui/pages/settings.py
+++ b/src/exlab_wizard/ui/pages/settings.py
@@ -810,9 +810,7 @@ def _render_nas_remote_section(
             "rclone.conf (run `rclone config` to create it). No password is "
             "stored here."
         )
-        ui.label(description).style(
-            "font-size: var(--text-sm); color: var(--color-muted);"
-        )
+        ui.label(description).style("font-size: var(--text-sm); color: var(--color-muted);")
 
         with ui.row().classes("items-center w-full").style("gap: 0.5rem;"):
             ui.label("Remote").style("color: var(--color-body); min-width: 6rem;")
@@ -834,14 +832,10 @@ def _render_nas_remote_section(
 
         if rsync_mode:
             badge_text = (
-                "ssh access configured"
-                if available
-                else "Identity file missing — see setup docs"
+                "ssh access configured" if available else "Identity file missing — see setup docs"
             )
         else:
-            badge_text = (
-                "Found in rclone.conf" if available else "Not found — run `rclone config`"
-            )
+            badge_text = "Found in rclone.conf" if available else "Not found — run `rclone config`"
         badge_color = "var(--color-success)" if available else "var(--color-warning)"
         ui.label(badge_text).props('data-testid="settings-nas-remote-status"').style(
             f"color: {badge_color}; font-size: var(--text-sm); font-weight: 600;"