fixed fuse bugs from BUGS.md

- Durable scratch/staging publication and preservation on failure.
      - Transactional pending-operation supersession.
      - Conflict copies cannot overwrite older copies or lose the source.
      - Single-entry wipe protection and incomplete-scan aborts.
      - Failed local deletion retains its baseline.
      - Downloads are fsynced before baseline settlement.
      - Future database schemas are refused.
      - Event cursors advance only after successful invalidation and persistence.
      - IPC frame, timeout, and concurrency limits.
      - Atomic config saves; malformed configs are preserved.
      - Sensitive directories require correct ownership, real directories, and 0700.
      - Debian package now includes service and tray autostart files.
      - Release workflow enforces versions, tests, lint, formatting, and offline acceptance.
      - CI now runs offline filesystem acceptance.

crates/pdfs-fuse/src/lib.rs

@@ -1548,8 +1548,32 @@ impl Core {
                 );
             }
             Err(e) => {
-                error!(%uid, error = %e, "staging write failed; bytes lost");
-                let _ = std::fs::remove_file(src);
+                // `src` is the only known copy of bytes the kernel already
+                // accepted.  A failure to publish them into staging must never
+                // turn into permission to delete them: leave the scratch file
+                // in place so startup recovery or a human can still salvage it.
+                error!(
+                    %uid,
+                    error = %e,
+                    scratch = %src.display(),
+                    "staging write failed; retaining the only scratch copy"
+                );
+                let name = {
+                    let st = self.state.lock();
+                    st.entries
+                        .get(&ino)
+                        .map(|entry| entry.node.name.clone())
+                        .unwrap_or_default()
+                };
+                self.log_activity(
+                    ActivityKind::Upload,
+                    &name,
+                    format!(
+                        "write not queued and could not be staged; recovery copy retained at {}",
+                        src.display()
+                    ),
+                    false,
+                );
             }
         }
     }