DOCS: Add native access flag to example run commands

README.md

@@ -98,5 +98,41 @@ will produce "fat" JARs inside `target` subfolders.
 Use them with relevant example class entrypoints like:
 
 ```bash
-java -cp .\console\target\device-detection-java-examples.console-4.4.20-jar-with-dependencies.jar fiftyone.devicedetection.examples.console.OfflineProcessing
+java -cp ./console/target/device-detection-java-examples.console-4.4.20-jar-with-dependencies.jar fiftyone.devicedetection.examples.console.OfflineProcessing
 ```
+
+### Native library access
+
+The on-premise examples use a native library, and
+[JEP 472](https://openjdk.org/jeps/472) restricts the operations needed to load it.
+Java 24 and 25 warn once per calling module, and a later release will refuse the call.
+
+The fat JARs above bundle everything into a single jar on the classpath, so the
+permission to use is `ALL-UNNAMED`:
+
+```bash
+java -cp ./console/target/device-detection-java-examples.console-4.4.20-jar-with-dependencies.jar --enable-native-access=ALL-UNNAMED fiftyone.devicedetection.examples.console.OfflineProcessing
+```
+
+With the Maven exec plugin, use the `exec:exec` goal. `exec:java` runs in the Maven JVM
+and its `<arguments>` are passed to `main`, so a JVM flag there has no effect:
+
+```xml
+<plugin>
+    <groupId>org.codehaus.mojo</groupId>
+    <artifactId>exec-maven-plugin</artifactId>
+    <configuration>
+        <executable>java</executable>
+        <arguments>
+            <argument>--enable-native-access=ALL-UNNAMED</argument>
+            ...
+        </arguments>
+    </configuration>
+</plugin>
+```
+
+A fat jar cannot narrow this any further, because everything inside it is part of the
+unnamed module. To grant native access to 51Degrees code alone you need the individual
+jars, with `pipeline.engines.fiftyone` and `device-detection.hash.engine.on-premise` on
+the module path - see the
+[device-detection-java README](https://github.com/51Degrees/device-detection-java#native-library-access).