fix(fuse): a deleted file's trash leaves a file of the user's under the name it was sent as (B193)

docs/BUGS.md

@@ -12,6 +12,29 @@ Conventions:
 
 ---
 
+## B193 — Deleting a file whose create failed can trash a file of the user's on Drive
+
+**Status:** Fixed (unverified).
+**Found:** 2026-10-05, in the confirmation run on 1436c5f (`one_client_on_a_flaky_link` seed 6;
+no replay reproduced it). A file renamed over `y/y/d`, then emptied, was gone from Drive and
+from the local database, with nothing queued. The run kept no log. The path below explains it,
+and the test reproduces that path every time.
+
+**Where:** `Core::withdrawn_twin_in` in `crates/pdfs-fuse/src/drain.rs`.
+
+**Cause.** A delete turns a create that was sent into a trash of what it may have made, under a
+name it was sent with (B151, B184). The drain looks there for a node made in the last two
+minutes that holds bytes the create sent, or none. It did not leave out a node in the tree, so
+an empty file of the user's renamed to that name matched, and was trashed. A create's own search
+for its twin (`Core::adoptable_twin`) already left such a node out, and nodes this mount trashed
+(B162).
+
+**Fix.** The trash's search leaves out the same nodes. A file a lost answer made that a listing
+has since put in the tree stays on Drive, where the user can see and delete it.
+
+**Test:** simulation test `a_withdrawn_create_leaves_the_file_renamed_to_the_name_it_was_sent_under`
+(failed before the fix: Drive was empty).
+
 ## B192 — A new file closed empty reaches Drive only half a minute later
 
 **Status:** Fixed.

docs/MILESTONE-3.0.0-STATUS.md

@@ -9,7 +9,7 @@ Tracks `docs/MILESTONE-3.0.0.md`. Update it with every commit that moves a phase
 - **Phase 2**: local ids, inode = local id, one tree for every mount (2.10.0).
 - **Phase 3, first part**: mkdir, create, rename, unlink and rmdir on the mount are recorded
   locally and sent from the queue; `"local_first": false` brings back the old path (5e0f30c).
-- Fixes from the simulation and account runs since then: B125, B127, B130 and B141 to B192.
+- Fixes from the simulation and account runs since then: B125, B127, B130 and B141 to B193.
 - **Sync issues, first cut** (§6.2): refusals sorted into issues, shown at once in the app,
   tray and CLI; Export button and `pdfs sync export`; `pdfs sync issues`; Discard button and
   `pdfs sync discard`; a warning badge on the node in the file browser.
@@ -119,7 +119,8 @@ Tracks `docs/MILESTONE-3.0.0.md`. Update it with every commit that moves a phase
          saved just before a stop whose release the stop dropped (B190, fixed; older too). The run
          on 1436c5f found a file deleted after its failed create was written again left on Drive
          (B191, fixed). Its test for B193 found a new empty file waiting out the idle poll (B192,
-         fixed).
+         fixed), and seed 6 a deleted file's trash taking a file of the user's renamed to the name
+         its create was sent under (B193, fixed).
    - [ ] A clean account run. The one on a6f36d5 (2026-10-04, LAN: 427 passed, 12 failed)
          failed B113 and B121 on every on-demand mount, two mirror-to-mirror move cases, and
          the journal check. B121 was a bug (B149, fixed); B113's case still expected creates