docs(notes): record slskd's API as read from its source

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017HJiuc3ZZhxsPXz3ozTirT

.planning/NOTES.md

@@ -5097,3 +5097,36 @@ beside what they explain. These three did not:
   The drawer-style gutter would buy the affordance by taking width off a
   full-screen surface on a 424px viewport; back and a 44px close button
   answer it instead.
+
+## slskd's API, read from its source rather than a live daemon (2026-09-26)
+
+`backend/download/provider_slskd.go` had never run against a real slskd
+when #263–#272 shipped, so its assumptions were checked against slskd
+0.26.0's source. One was wrong, and one design was only safe by luck.
+These are properties of someone else's server; re-check on an upgrade.
+`TestSlskdLive` (env-gated, see its comment) is the way to confirm them
+against a running one.
+
+- **`searchTimeout` is seconds, from the last response**, minimum 5
+  (`SearchRequest.cs`). We sent milliseconds (#274). The other search
+  options — `responseLimit`, `fileLimit`, `filterResponses`,
+  `minimumResponseFileCount`, `maximumPeerQueueLength` — are named as we
+  send them; slskd's defaults are 100 responses, 10 000 files, queue
+  1 000 000.
+- **`GET /searches/{id}/responses` exists**, and `DELETE
+  /transfers/downloads/{user}/{id}?remove=true` cancels and removes.
+- **A finished download is moved to `<downloads>/<Subdirectory>/`**,
+  where `Destination.Subdirectory` defaults to `${SOURCE_DIRECTORY}`
+  (the remote leaf folder) and is user-configurable. A taken name is
+  written as `name_<ticks>.ext` (`Destination.Exists = rename`, the
+  default). No transfer record says where the file went.
+- **Batch enqueue (`POST /transfers/downloads/batches`) is new in 0.26.0**
+  and is the only way to choose where a file lands: `options.destination`
+  overrides the subdirectory pattern. A batch's files land flat in it,
+  so one batch per disc. On an older daemon that path is routed to the
+  per-user enqueue as username "batches" and the object body is
+  rejected with 400 — which is why 400 means "no batches" here.
+- **`GET .../downloads/{user}/{id}/position` asks the peer** and returns
+  a bare integer. slskd's own comment on `PlaceInQueue` is "may be
+  wildly innacurate to the point of uselessness", which is why #275 acts
+  only on two readings in a row.