Disable connector transports without peer pinning

README.md

@@ -107,7 +107,17 @@ uploads. The Seafile provider uses account-token auth and the native file
 download-link API; Nextcloud and generic WebDAV profiles use authenticated `GET`
 requests against the configured WebDAV endpoint. SMB profiles use
 `smb://server[:port]/share[/path]` endpoints and deployment-owned or encrypted
-stored credentials through `smbprotocol`.
+stored credentials through `smbprotocol`. Because that SDK cannot accept a
+preconnected socket, private-network deployments currently require an explicit
+IP address in SMB endpoints; DNS names fail closed until connection-time DNS
+pinning is supported. Public-only deployments resolve and substitute a validated
+public IP before invoking the SDK.
+
+The S3 browse/import implementation and S3 managed-storage backend currently
+fail closed before creating a `boto3` client. Botocore does not yet use the
+GovOPlaN pinned HTTP transport and may manage redirects itself, so neither an
+explicit endpoint nor SDK endpoint discovery is allowed until both peer pinning
+and redirect revalidation are enforced.
 
 Local connector development assets live in `dev/connectors/`. The compose stack
 boots Nextcloud, Seafile, WebDAV, and SMB endpoints for provider development and