fix(fuse): stop a sync pass when nearly all of a large folder vanishes

The wipe guards refused a pass only when every synced path was missing
on one side. One surviving file cleared them, so a half-mounted disk,
a restored backup that brought back one file, or a script that emptied
the folder and wrote one back made the next pass trash everything else
on Drive, and on every computer syncing the folder (B270).

Both guards now also refuse when nine in ten or more of the tracked
paths of a folder with at least 20 are missing at once. A smaller
folder still stops only on a total loss, since an ordinary cleanup can
delete most of it. The reason now gives the count.

B270 stays partly fixed: a smaller loss still goes through, and the
app does not yet offer to confirm the deletions.

docs/BUGS.md

@@ -70,7 +70,6 @@ original wording.
 |---|---|---|
 | [B275](#b275--on-a-slow-link-a-files-last-write-can-land-only-in-a-conflict-copy) | On a slow link, a file's last write can land only in a conflict copy | Cause not found; seen once in CI |
 | [B273](#b273--a-restore-proposes-another-computers-paths-when-the-two-share-a-hostname) | A restore proposes another computer's paths when the two share a hostname | Not fixed |
-| [B270](#b270--one-file-left-in-a-mirror-folder-clears-the-wipe-guard-for-all-the-others) | One file left in a mirror folder clears the wipe guard for all the others | Not fixed |
 | [B267](#b267--a-key-failure-at-a-start-from-a-warm-cache-shows-as-offline-for-good) | A key failure at a start from a warm cache shows as offline for good | Not fixed |
 | [B134](#b134--a-file-deleted-online-while-the-drain-checks-its-write-is-kept-as-a-conflict-copy) | A file deleted online while the drain checks its write is kept as a conflict copy | Only with `local_first` off |
 | [B91](#b91--the-daemon-hung-overnight-and-nothing-could-say-what-it-was-waiting-on) | The daemon hung overnight, and nothing could say what it was waiting on | The cause is not diagnosed; the daemon now reports where it is stuck and is restarted |
@@ -84,6 +83,7 @@ original wording.
 
 | Entry | Title | What is left |
 |---|---|---|
+| [B270](#b270--one-file-left-in-a-mirror-folder-clears-the-wipe-guard-for-all-the-others) | One file left in a mirror folder clears the wipe guard for all the others | A loss under nine in ten still goes through; no choice offered in the app |
 | [B269](#b269--a-restore-that-skipped-every-folder-reports-success) | A restore that skipped every folder reports success | The app shows the result only in the activity feed; no offer to replace or reset the folder in the way |
 | [B268](#b268--pdfs-diagnose-says-no-problems-found-while-sync-is-stuck) | `pdfs diagnose` says "No problems found" while sync is stuck | The sync engine's state is not checked |
 | [B263](#b263--a-mount-that-can-never-succeed-retries-every-5-s-and-tells-only-the-journal) | A mount that can never succeed retries every 5 s and tells only the journal | Errors no retry fixes back off like network errors |
@@ -600,7 +600,7 @@ nothing left to apply. The progress count inside one large folder is unchanged.
 
 ### B270 — One file left in a mirror folder clears the wipe guard for all the others
 
-**Status:** Open
+**Status:** Partly fixed
 **Found:** 2026-10-31, code audit after issue #46, whose reporter emptied a synced folder
 several times.
 **Where:** `guard_local_wipe` and `guard_remote_wipe` in `crates/pdfs-fuse/src/sync/planner.rs`
@@ -614,8 +614,20 @@ that two computers sync, the other computer then deletes its copies too.
 path is enough to clear it, so it guards against an empty folder and nothing short of that.
 The remote guard has the same shape.
 
-**Fix.** Not done. Also refuse when most of a large baseline is missing at once, and leave the
-choice to the user: delete on the other side, or sync from scratch.
+**Fix.** Both guards also refuse a pass when nine in ten or more of the tracked paths of a
+folder with at least 20 are missing at once (`looks_like_a_wipe`). The folder goes into error with
+the count in its reason, `pdfs diagnose` reports it, and **Sync From Scratch…** brings the files
+back. A smaller folder still stops only on a total loss, since an ordinary cleanup can delete most
+of it.
+
+**What is left.** A loss under nine in ten, such as a disk that is half there, still goes
+through. The app does not offer the choice yet: confirm the deletions on the other side, or sync
+from scratch.
+
+**Test:** `one_survivor_of_a_large_folder_does_not_clear_the_wipe_guards`,
+`a_small_folder_trips_the_wipe_guards_only_when_everything_is_gone` in
+`crates/pdfs-fuse/src/sync/planner.rs`.
+
 
 ---
 

docs/CHANGELOG.md

@@ -20,6 +20,13 @@ scratch (user data in `staging/` and `recovery/` is never touched by this).
   files in it. **After upgrading:** if your `~/ProtonDrive` has files underneath, for example
   saved there while the service was stopped, My files does not open until you move them out.
 
+- **A synced folder stops instead of deleting when nearly all of it vanishes at once** (B270).
+  The guard against a lost folder, such as a disk that is not mounted, stopped a pass only when
+  every synced file was gone. One file left over was enough to clear it, and the next pass
+  trashed everything else on Proton Drive, and on every other computer syncing the folder. A
+  folder with 20 or more files and folders now also stops when nine in ten of them are missing,
+  on this computer or on Proton Drive. **Sync From Scratch…** brings them back.
+
 - **A new file reads without the network as soon as `pdfs status` shows nothing queued**
   (B257). A new file's upload counted as done before its bytes were cached, so a script that
   waited for an empty queue and then went offline could not read it. A new file deleted while

docs/TROUBLESHOOTING.md

@@ -248,9 +248,10 @@ Check that:
 
 ### A synced folder stays in error and nothing downloads
 
-The log says `every one of the N synced paths is missing locally; refusing to trash them on
-Drive`. The folder synced before, and now none of its files are on this computer. The sync
-stops so that it does not delete them on Proton Drive too. Check that the folder is the right
+The log says `M of the N synced paths are missing locally; refusing to trash them on Drive`.
+The folder synced before, and now all or nearly all of its files are gone from this computer:
+everything, or nine in ten of a folder with 20 or more files and folders. The sync stops so that
+it does not delete them on Proton Drive too. Check that the folder is the right
 one and that its disk is mounted. To get the files back, choose **Sync From Scratch…** in the
 folder's menu on **Sync → Folders**, or run: