fix(sync): isolate My files attachments

Schema 45 separates attachments from device backups so stopping sync or
changing mode cannot trash My files folders or evict their local data.
Exclude attachments from device profiles and validate device restores.

Verify attached roots before each pass and cover both local views,
concurrent edits, removal guards, and root loss across daemon restarts.

Refs #77

docs/CHANGELOG.md

@@ -11,10 +11,15 @@ scratch (user data in `staging/` and `recovery/` is never touched by this).
 
 ## [Unreleased]
 
+Schema: **45**. Synced folders now distinguish device backups from My files attachments.
+Existing folders remain device backups; older builds cannot open the upgraded database.
+
 ### Added
 
 - `pdfs sync attach PATH --to REMOTE` connects an existing local directory to an existing
   My files folder. The first sync preserves one-sided files and differing versions (#67).
+  Attachments stay in mirror mode, are excluded from device profiles, and cannot delete
+  the remote root when syncing is stopped.
 
 ## [3.7.0] — 2026-11-02
 

docs/CLI.md

@@ -79,8 +79,8 @@ commands are for scripts and for cases where the mount is not available.
 
 | Command | Description |
 |---|---|
-| `pdfs sync attach PATH --to REMOTE` | Merge a real local folder with an existing My files folder, keeping both versions on initial conflicts. |
 | `pdfs sync add PATH` | Back up a local folder under this computer and keep it in sync. |
+| `pdfs sync attach PATH --to REMOTE` | Merge a real local folder with an existing My files folder, keeping both versions on initial conflicts. |
 | `pdfs sync list` | List synced folders with their IDs and state. |
 | `pdfs sync rm ID [--delete-remote]` | Stop syncing. Local files stay; `--delete-remote` also removes the copy on Proton Drive. |
 | `pdfs sync mode ID mirror\|ondemand` | Switch between a full local copy (`mirror`) and online only (`ondemand`). |

docs/SYNCED_FOLDERS.md

@@ -5,6 +5,7 @@ up to Proton Drive and kept in step with it. This page covers adding one, what t
 that should not be backed up, changes that are still waiting to upload, conflicts, and pausing.
 
 - [Add a folder](#add-a-folder)
+- [Attach an existing My files folder](#attach-an-existing-my-files-folder)
 - [Synced or online only](#synced-or-online-only)
 - [Move files between synced folders and My files](#move-files-between-synced-folders-and-my-files)
 - [Stop syncing a folder](#stop-syncing-a-folder)
@@ -74,7 +75,8 @@ again when they move into a synced one.
 
 **Stop Syncing** in the app, or `pdfs sync rm ID`, keeps both the local files and the copy on
 Proton Drive. To delete the copy on Proton Drive as well, tick **Also delete from Proton Drive**,
-or add `--delete-remote`.
+or add `--delete-remote`. Attached My files folders always keep the cloud copy;
+`--delete-remote` is refused for them.
 
 ## Sync a folder from scratch
 
@@ -183,5 +185,14 @@ bidirectional sync, including deletions and the existing wipe guards.
 
 The My files root, shared folders, overlapping sync roots, and local paths inside
 or containing the cloud mount are refused. Use `pdfs sync list` to find the new
-folder's ID and monitor its state. `pdfs sync rm ID` stops syncing; adding
-`--delete-remote` also trashes the linked cloud folder.
+folder's ID and monitor its state. `pdfs sync rm ID` stops syncing and keeps both
+copies. `--delete-remote` is refused for attached folders.
+
+Attached folders support **mirror** mode only. Use the main My files mount for online-only
+access. They are listed separately from device backups and are not included in the device
+profile used to restore another computer.
+
+On the first sync, the remote version keeps the original name when both versions differ.
+The local version is preserved as a conflict copy next to it and is uploaded too. If the
+remote root is trashed or moved outside My files, syncing stops with an error and local
+files are kept.