diff --git a/CHANGELOG.md b/CHANGELOG.md
index d402ea3..5666a4d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,8 @@
 
 ### Changed
 
+- **Document the full set of v2-pinned DSM APIs in CLAUDE.md** (#90) — closes #42. The "Version pinning" bullet under `## Key Conventions → DSM API Client` previously named only CopyMove, Delete, and Search as v2-pinned. Audit of `src/` (`grep -rn "max_version=2\|min(.*max_version, 2)"`) found two additional pins that the convention bullet didn't mention: `SYNO.FileStation.Upload` (`core/client.py::upload_file`, line 354 — pinned because Upload is a multipart POST not routed through `request()`, and v3 advertises a JSON body the multipart code can't speak) and `SYNO.FileStation.List getinfo` (`modules/filestation/metadata.py`, added by PR #77 to dodge the v3 multipath quirk that surfaced as #68). Bullet now lists all five with file pointers and the rationale ("removing any of these pins reintroduces silent failures on DSM 7.x"), so a future refactor can't innocently strip a pin and rediscover the bug.
+
 - **Remove Glama integration** (#88) — drops the Glama score badge from `README.md` and deletes the `glama.json` config file at the repo root. Glama's "Maintenance" sub-score is driven primarily by `issues responded to in the last N months`, which conflicts with this project's use of GitHub issues as a planned roadmap (the baggage tracker #51 + per-item issues are TODOs, not unanswered support requests). The badge therefore mis-represents project health to anyone landing on the README, and the heuristic isn't tunable from our side. Removing both rather than gaming the metric or adding a workflow note. PyPI / GitHub release / MCP registry remain the canonical distribution and discovery surfaces; the README still carries the standard PyPI / Python-versions / License / Tests / Coverage / Downloads badges plus per-installer and per-OS download breakdowns from `cmeans/pypi-winnow-downloads`.
 
 ## 0.5.2 (2026-05-01)
diff --git a/CLAUDE.md b/CLAUDE.md
index 1bdb508..7bbf704 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -92,7 +92,7 @@ uv run pytest --cov=mcp_synology           # Tests with coverage
 - Thin wrapper — knows DSM request/response conventions, nothing about specific APIs
 - **Always use GET** — never POST. DSM reports `requestFormat=JSON` on all FileStation APIs (even v2), but this is metadata not a mandate. POST causes silent failures on DSM 7.1
 - Calls `SYNO.API.Info` with `query=ALL` at startup; caches API name → path/version map
-- **Version pinning:** CopyMove, Delete, and Search are pinned to v2 (`negotiate_version(..., max_version=2)`) to avoid v3 JSON request format issues
+- **Version pinning:** CopyMove, Delete, Search, Upload, and `List getinfo` are pinned to v2 to avoid v3 JSON request format issues. CopyMove/Delete/Search use `negotiate_version(..., max_version=2)` from their handlers; Upload's pin lives in `core/client.py::upload_file` (`min(info.max_version, 2)` default) because Upload is a special-case multipart POST not routed through `request()`; `List getinfo` is pinned in `modules/filestation/metadata.py` (added by #77 to dodge the v3 multipath quirk that surfaced as #68). Removing any of these pins will reintroduce silent failures on DSM 7.x — the v3 request format DSM advertises is metadata, not a mandate
 - Session ID injection and comma/backslash escaping in multi-path params are transparent to modules
 
 ### Config