feat(fuse,core,cli,gui): move between locations without transferring content

A move request with two absolute paths is resolved against every
location (My files, on-demand and mirror synced folders) and made as a
server-side move_node. The local side is levelled afterwards: mounts
forget and re-list, a mirror folder renames its copy and baseline along
or drops the copy once Drive holds it.

Anything only this disk holds is refused up front: queued ops, open
writes, unsynced or ignored mirror files and symlinks. The GUI Move
dialog gains a top-level list of locations.

docs/ARCHITECTURE.md

@@ -539,6 +539,18 @@ A restore is expanded before it is sent (`expand_restore`, `pdfs-fuse/src/lib.rs
 
 The trash view's restore and permanent-delete use the SDK's **streaming** variants (`restore_nodes_streaming` / `delete_nodes_streaming`) and apply local state per node as each batch lands rather than after the last one. For a permanent delete — which is irreversible — that means a daemon interrupted mid-batch has forgotten exactly the nodes the server destroyed, no more and no fewer. Both report per-node failures and count only what actually succeeded; only a batch where nothing succeeded is an error.
 
+### Moves Between Locations
+**Files**: [`relocate.rs`](../crates/pdfs-fuse/src/relocate.rs), [`control.rs`](../crates/pdfs-fuse/src/control.rs), [`browser.rs`](../crates/pdfs-gui/src/app/pages/browser.rs)
+
+The primary mount and every on-demand folder are separate FUSE sessions, and a mirror folder has no session at all. The kernel answers `rename(2)` between two mounts with `EXDEV` before the daemon hears of it, so `mv` copies and deletes. On Proton Drive the same move is one `move_node`, because My files and this device's folders are on the main volume.
+
+`Request::Move` with two absolute paths is therefore resolved by `Core::move_between` against every location: a live mount through `rooted_at`, otherwise the mirror folder with the longest `local_path` prefix, whose uids come from the `sync_entry` baseline. Two paths in one inode space still go to `move_to`. Relative paths keep their old meaning.
+
+- **Nothing that exists only on this disk may be lost.** A mounted source is refused while it or anything under it has a queued op or a file open for writing. A mirror source is refused unless every file under it matches its baseline and every baseline row still has its file (`mirror_subtree_unsynced`); ignored names and symlinks count as unsynced, because the local copy is removed after the move.
+- **Mirror to mirror renames along.** The local copy is renamed first and its baseline rows are moved with `sync_entries_move`, so neither folder's next pass has anything to do. If `move_node` fails, the rename is undone. `EXDEV` between two filesystems falls back to the check above, then drops the source copy.
+- **Sync passes are held off.** Every mirror folder involved is locked through `sync_lock`, by ascending id, with a five-second bound. A folder that is still busy is reported rather than waited on.
+- **The local side is levelled afterwards.** A mounted source forgets the node in every inode space and notifies the kernel. A mounted destination has its listing cleared. A mirror destination that received nothing locally gets a reconcile, which downloads the node.
+
 ### Open-for-Write Deferral for Mirror Sync
 **File**: [`sync.rs`](../crates/pdfs-fuse/src/sync.rs)
 

docs/CHANGELOG.md

@@ -11,6 +11,16 @@ scratch (user data in `staging/` and `recovery/` is never touched by this).
 
 ## [Unreleased]
 
+### Added
+- **Moves between locations without transferring content.** `pdfs move` and the app's
+  **Move to…** now take a file or folder from My files into a synced folder, or between two
+  synced folders, on-demand or mirrored. The move happens on Proton Drive, so nothing is
+  downloaded or uploaded again. `mv` between two locations still copies, because the kernel
+  refuses a rename between two mounts. The app's Move dialog lists every location at its top
+  level. A move is refused, with the reason, when the source still has changes that are not on
+  Proton Drive, when the two locations are on different volumes, or when a synced folder stays
+  busy with a sync pass.
+
 ## [2.6.2] — 2026-09-28
 
 Schema: **35** (unchanged).

docs/CLI.md

@@ -53,7 +53,7 @@ talks to the running service (`proton-drive.service`); `login`, `logout`, `mount
 | `pdfs search QUERY [--in FOLDER] [--limit N]` | Search names in the local index. |
 | `pdfs mkdir PARENT NAME` | Create a folder. |
 | `pdfs rename PATH NEW_NAME` | Rename a file or folder. |
-| `pdfs move PATH NEW_PARENT` | Move into another folder. |
+| `pdfs move PATH NEW_PARENT` | Move into another folder. The two may be in different locations (My files, an on-demand or a mirrored synced folder); the move happens on Proton Drive, without downloading or uploading anything. |
 | `pdfs rm PATH` | Move to the Trash. |
 | `pdfs upload SOURCES... [-t FOLDER]` | Upload local files and folders (recursively) in the background. Follow with `pdfs transfers`. |
 | `pdfs refresh [TARGET] [--full]` | Forget a cached listing so the next read fetches it again. `TARGET` is a folder, `trash` or `photos`; `--full` with `photos` re-reads every photo's metadata. |

docs/USER_GUIDE.md

@@ -95,6 +95,23 @@ of the folder, so the files stay visible but take no disk space until opened. Sw
 **Synced / Online only** switch on the folder's card, or `pdfs sync mode <id> ondemand` and back
 with `pdfs sync mode <id> mirror`. `pdfs locations` lists every local place the service occupies.
 
+### Moving between synced folders and My files
+
+`~/ProtonDrive` and each online-only folder are separate mounts, and a mirrored folder is a plain
+folder on disk. `mv`, and dragging in a file manager, cannot rename across them, so they copy
+and then delete: every file is downloaded, uploaded again, and the original goes to the Trash.
+
+Use `pdfs move <path> <folder>` or **Move to…** in the app instead. The move happens on Proton
+Drive, so it takes seconds whatever the size. For example:
+
+```sh
+pdfs move ~/Documents/Scans ~/ProtonDrive/Archive
+```
+
+A move out of a synced folder waits until its files are on Proton Drive. A file that is still
+uploading, has changes that are not uploaded, or is excluded by `.pdfsignore` stops the move,
+and the message names it.
+
 Removing a synced folder (**Stop Syncing** or `pdfs sync rm <id>`) keeps the local files and the
 copy on Proton Drive. Add `--delete-remote` (or tick **Also delete from Proton Drive**) to delete
 the copy on Proton Drive as well.