fix(fuse,cli): keep a pass going past a failed listing, report skipped restores

A listing that failed anywhere in the remote walk ended the whole pass,
so a first sync of a large folder on a flaky link walked the tree again
and again and never downloaded anything (B271, issue #46). A failed
listing below the root now records that folder as a gap: nothing under
it is deleted, the rest of the pass applies, and the report names it.

A restore that skipped every folder was logged as a successful activity
(B269). The daemon now gets the restored and skipped folders back, logs
any skip as a failed activity with the reasons, and sends the Rewatch
for folders already restored when the database insert fails partway.
`pdfs devices join` points to `pdfs activity` for the outcome.

crates/pdfs-fuse/src/sync.rs

@@ -1135,14 +1135,22 @@ impl Core {
         let uids = self
             .rt
             .block_on(self.drive.enumerate_folder_children_node_uids(folder))
-            .map_err(|e| format!("enumerate {folder}: {e}"))?;
+            .map_err(|e| format!("enumerate {folder}: {e}"));
+        let uids = match unlisted_gap(walk, prefix, uids)? {
+            Some(uids) => uids,
+            None => return Ok(()),
+        };
         if uids.is_empty() {
             return Ok(());
         }
         let nodes = self
             .rt
             .block_on(self.drive.enumerate_nodes_light(&uids))
-            .map_err(|e| format!("resolve nodes: {e}"))?;
+            .map_err(|e| format!("resolve nodes: {e}"));
+        let nodes = match unlisted_gap(walk, prefix, nodes)? {
+            Some(nodes) => nodes,
+            None => return Ok(()),
+        };
         // The SDK leaves out a node it cannot decrypt, and says so only in its
         // log. Its name went with it, so all this can record is the folder.
         if nodes.len() < uids.len() {
@@ -1186,10 +1194,14 @@ impl Core {
         let sized: HashMap<String, (i64, Option<String>)> = if stale.is_empty() {
             HashMap::new()
         } else {
-            self.rt
+            let full = self
+                .rt
                 .block_on(self.drive.enumerate_nodes(&stale))
-                .map_err(|e| format!("resolve nodes: {e}"))?
-                .iter()
+                .map_err(|e| format!("resolve nodes: {e}"));
+            let Some(full) = unlisted_gap(walk, prefix, full)? else {
+                return Ok(());
+            };
+            full.iter()
                 .map(|n| {
                     (
                         n.uid.to_string(),
@@ -2007,6 +2019,34 @@ struct RemoteWalk<'a> {
     gaps: &'a mut RemoteGaps,
 }
 
+/// A listing call's result in [`Core::walk_remote`]. A failure below the root
+/// records `prefix` as unlisted and returns `None`, so the walk goes on
+/// without that folder. A failure at the root still fails the pass, since
+/// nothing would be left to compare.
+///
+/// One listing error, after the SDK's own retries, used to fail the whole
+/// walk. Nothing is applied before the walk ends, so on a link that drops a
+/// request now and then a large first sync started over from nothing on
+/// every pass and never got past it (`docs/BUGS.md` B271).
+fn unlisted_gap<T>(
+    walk: &mut RemoteWalk<'_>,
+    prefix: &str,
+    result: Result<T, String>,
+) -> Result<Option<T>, PassAbort> {
+    match result {
+        Ok(value) => Ok(Some(value)),
+        Err(error) if prefix.is_empty() => Err(error.into()),
+        Err(error) => {
+            warn!(
+                folder = prefix,
+                error, "sync: a folder on Drive could not be listed; leaving it out of this pass"
+            );
+            walk.gaps.unlisted(prefix);
+            Ok(None)
+        }
+    }
+}
+
 /// Whether the file at `path` is no longer what the scan saw as `planned`.
 /// A file that is gone has nothing left to lose, so it has not changed.
 fn changed_since_scan(path: &Path, planned: &LocalItem) -> bool {