fix(fuse,core): key conflict detection on revision id, stop transient-name seals (B69, B70)

B69 — spurious `(sync-conflict)` copies came from `(mtime, size)` being used as a
revision identity. The server re-stamps a sealed revision with its own commit
time, so the drain diverted a write into a conflict copy of its own base; and
`plan_file` classified a no-baseline (local, remote) pair as `Conflict`, forking
every pre-existing file on first reconcile.

- `Baseline` carries `revision_id` (from the SDK's new `active_revision_id`),
  captured at write-open and preserved across supersede/rebaseline.
  `revision_changed` trusts the id and only falls back to `(mtime, size)` for
  old sidecars.
- Planner gains `FilePlan::AdoptBaseline`: equal-size no-baseline pairs are
  recorded, not conflicted. Divergent sizes stay a real conflict.
- New `sweep.rs` (`pdfs-conflict-sweep`, 5-min cadence) removes conflict copies
  proven identical by size + `content_sha1` and surfaces divergent ones once as
  an `ActivityKind::Conflict` entry. Never removes what it cannot prove.

B70 — browsers downloading into an on-demand mount had their in-flight temps
sealed as canonical revisions, exiling the finished file to a conflict copy.
`syncignore::is_transient_name` now recognises download/scratch temps, and the
on-demand `release`/`rename` paths hold them (`set_create_hold`) instead of
sealing until the name is finalized.

Workspace deps bumped to proton-sdk/proton-drive-rs 0.2.2 (registry, no patch).

Live validation against a real account still pending for both.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V8P42asymU158CPnhjRwri

crates/pdfs-core/src/db/mod.rs

@@ -42,7 +42,7 @@ pub use local::LocalFileHit;
 pub use maintenance::{DbStats, VacuumOutcome};
 pub use nodes::{SearchHit, StoredNode};
 pub use ops::{
-    AttachedBlob, LOCAL_VOLUME, OP_CREATE, OP_MKDIR, OP_RENAME, OP_REVISION, OP_TRASH,
+    AttachedBlob, LOCAL_VOLUME, OP_CREATE, OP_MKDIR, OP_RENAME, OP_REVISION, OP_TRASH, PARK_UNTIL,
     PendingCounts, PendingOp, op_supersedes,
 };
 pub use photos::{StoredPhoto, THUMB_HAVE, THUMB_NONE, THUMB_UNKNOWN};

crates/pdfs-core/src/db/ops.rs

@@ -63,6 +63,16 @@ pub fn op_supersedes(kind: &str) -> bool {
 /// drain replaces it with the uid the server assigns.
 pub const LOCAL_VOLUME: &str = "local";
 
+/// A `next_attempt_at` far enough in the future that [`Db::next_due_op`] never
+/// selects the op (ms since epoch, ≈ year 2223). Used to *park* a queued create
+/// for a transient file — a browser's in-flight `*.crdownload`/`*.part`, an
+/// editor's `*.swp` — so its bytes never upload while it wears that name. A
+/// rename to the finished name un-parks it (see [`Db::set_create_hold`]), which
+/// is the only moment the completed file is meant to reach Drive. Without the
+/// park, every partial and every abandoned temp would upload and, on a
+/// stall+resume, fork a `(sync-conflict)` copy (docs/BUGS.md B70).
+pub const PARK_UNTIL: i64 = 8_000_000_000_000;
+
 /// A mutation that has been accepted locally but not yet performed against the
 /// API — the durable half of the write-back queue (offline.md Phase 3).
 ///
@@ -183,11 +193,18 @@ impl Db {
         let Some((id, superseded)) = existing else {
             return Ok(None);
         };
+        // Clearing the backoff lets the fresh bytes be tried promptly — except
+        // when the create is *parked* (a transient file, next_attempt_at at the
+        // PARK_UNTIL sentinel). Attaching a new revision to a still-growing
+        // download must not wake it; only the finalize rename does. So preserve a
+        // park and reset an ordinary backoff.
         conn.execute(
             "UPDATE pending_op
-             SET blob_path = ?2, meta_json = ?3, attempts = 0, next_attempt_at = 0
+             SET blob_path = ?2, meta_json = ?3, attempts = 0,
+                 next_attempt_at = CASE WHEN next_attempt_at >= ?4
+                                        THEN next_attempt_at ELSE 0 END
              WHERE id = ?1",
-            params![id, blob_path, meta_json],
+            params![id, blob_path, meta_json, PARK_UNTIL],
         )?;
         Ok(Some(AttachedBlob { id, superseded }))
     }
@@ -233,6 +250,25 @@ impl Db {
         Ok(n > 0)
     }
 
+    /// Park or un-park a queued create/mkdir for `uid`, returning whether a row
+    /// was touched.
+    ///
+    /// Parking sets `next_attempt_at` to [`PARK_UNTIL`] so [`Db::next_due_op`]
+    /// skips it indefinitely; un-parking sets it due now. Used to keep a
+    /// transient file's bytes off Drive until it is renamed to its finished name
+    /// (docs/BUGS.md B70). Un-parking a create that was never parked is harmless:
+    /// it just makes the create due immediately, which for a normal local node it
+    /// already is.
+    pub fn set_create_hold(&self, uid: &str, held: bool) -> Result<bool> {
+        let conn = self.conn.lock();
+        let n = conn.execute(
+            "UPDATE pending_op SET next_attempt_at = ?2
+             WHERE uid = ?1 AND kind IN (?3, ?4)",
+            params![uid, if held { PARK_UNTIL } else { 0 }, OP_CREATE, OP_MKDIR],
+        )?;
+        Ok(n > 0)
+    }
+
     /// Check if a queued create or mkdir op exists for `uid`.
     pub fn has_create_op(&self, uid: &str) -> Result<bool> {
         let conn = self.conn.lock();

crates/pdfs-core/src/db/tests.rs

@@ -1615,6 +1615,58 @@ fn next_due_op_skips_ops_blocked_on_a_local_parent() {
     assert_eq!(db.next_due_op(10).unwrap().unwrap().uid, "vol~link3");
 }
 
+/// B70: a transient file's create is parked so its bytes never upload while it
+/// wears that name, the park survives a write attaching its blob, and the
+/// finalize rename (un-park) is what finally makes the completed file due.
+#[test]
+fn a_parked_transient_create_stays_off_the_drain_until_finalized() {
+    let db = Db::open_in_memory().unwrap();
+    let node = uid("dl").to_string();
+    let parent = uid("root").to_string();
+    db.enqueue_op(&PendingOp {
+        id: 0,
+        kind: OP_CREATE.to_string(),
+        uid: node.clone(),
+        parent_uid: Some(parent),
+        name: Some("movie.mkv.part".to_string()),
+        blob_path: None,
+        meta_json: None,
+        created_at: 1,
+        attempts: 0,
+        last_error: None,
+        next_attempt_at: PARK_UNTIL,
+    })
+    .unwrap();
+
+    // Parked: never selected, however far the clock advances.
+    assert!(
+        db.next_due_op(PARK_UNTIL - 1).unwrap().is_none(),
+        "a parked create is never due"
+    );
+
+    // A write attaches its blob to the create but must not wake it.
+    let attached = db
+        .attach_blob_to_create(&node, "/staging/blob1", "{}")
+        .unwrap();
+    assert!(attached.is_some(), "the blob attached to the create");
+    assert!(
+        db.next_due_op(PARK_UNTIL - 1).unwrap().is_none(),
+        "still parked after a write attaches"
+    );
+
+    // Finalize: un-park, and the completed file is due to upload with its bytes.
+    assert!(
+        db.set_create_hold(&node, false).unwrap(),
+        "a create row was un-parked"
+    );
+    let due = db
+        .next_due_op(1_000)
+        .unwrap()
+        .expect("the un-parked create is due");
+    assert_eq!(due.uid, node);
+    assert_eq!(due.blob_path.as_deref(), Some("/staging/blob1"));
+}
+
 /// Backoff still gates: nothing is returned before an op is due.
 #[test]
 fn next_due_op_respects_backoff() {
@@ -1806,6 +1858,8 @@ fn test_db_has_children_and_trashed_filtering() {
             media_type: "text/plain".into(),
             total_size_on_storage: 10,
             active_revision_state: None,
+            active_revision_id: None,
+            content_sha1: None,
             claimed_size: Some(10),
             claimed_modification_time: None,
         },