wired new locations into gui, fuse acceptance with new permission based mounts

docs/ARCHITECTURE.md

@@ -76,6 +76,31 @@ sequenceDiagram
     FUSE-->>User: returns child inode metadata (attributes, TTL)
 ```
 
+### Access Classification and Enforcement
+
+Every `Entry` carries an `Access` (`Owner | Editor | Viewer | Unknown`), inherited from its parent at intern time rather than resolved per node — a child is always interned from its parent's listing, so one edge lookup answers it. A known share root takes its access from the persisted `share_access` table instead, which is also what makes the classification correct offline.
+
+Two rules decide the cases inheritance cannot:
+
+* **Not under a share, no role → `Owner` (fail open).** My Files and device folders are owned content; regressing this denies ordinary writes.
+* **Under a share with no usable role → `Viewer` (fail closed).** An unrecognised permission mask is never degraded into a guess.
+
+A node whose parent is not resident is the awkward case: a device folder's parent is the device root, which is never persisted as a node, so the whole subtree hydrates parentless. It resolves the way the persisted authority (`Db::effective_node_access`) does — a recorded share row above it wins, otherwise fail open on the mount's own volume and closed on a foreign one (`docs/BUGS.md` B79).
+
+Enforcement is three layers, and only the third closes B34:
+
+1. **Mode bits.** `attr()` returns `0o555`/`0o444` for a non-writable entry, and both mount paths set `MountOption::DefaultPermissions`, so the *kernel* refuses `open(O_WRONLY)`, `access(W_OK)` and namespace operations for any non-root process.
+2. **Handler gates.** `EACCES` in `create`/`mkdir`/`unlink`/`rmdir`/`rename` (parent-writable; both parents for a rename) and in `open`-for-write/`write`/`setattr`/`fallocate`. Covers root and stale attribute TTLs.
+3. **Queue guards.** `Core::require_uid_writable` admits a mutation only when the persisted authority *and* every live inode space agree the uid is writable. Nothing reaches `pending_op` otherwise, so the perpetual failing drain that B34 describes cannot occur even if a handler check is missed. The intersection is across mounts because a uid may be resident in more than one inode space.
+
+`EACCES`, not `EROFS`, for a read-only subtree inside a read-write mount: `EROFS` means "read-only filesystem" and misleads the heuristics in `cp`, `rsync` and `git`.
+
+### Local Locations
+
+`mount` is a presentation table: one row per local place this client occupies — the primary My Files session, and each device folder in mirror or on-demand mode. `sync_folder` remains the sync engine's own table (`sync_entry` is FK'd to it) and `MountKind::Device { sync_folder_id }` is the join. `Request::ListLocations` serves the table to `pdfs locations` and the GUI's Locations page.
+
+A mirror folder is a plain local directory with no FUSE session, so a row can legitimately describe a location that is not mounted — which is why the page is called *Locations* rather than *Mounts*. The primary mountpoint stays in `AppConfig`, with its `mount` row written at daemon start as a projection of it, so there are not two sources of truth for that path.
+
 ---
 
 ## 3. Read Path & Block Caching Pipeline

docs/BUGS.md

@@ -66,7 +66,10 @@ device-folder tree to `Viewer` in memory.
 **Tests:** `state::tests::own_volume_nodes_without_a_resident_parent_stay_owned`,
 `foreign_volume_nodes_without_a_resident_parent_fail_closed`,
 `persisted_authority_outranks_the_own_volume_fail_open`. The first fails on the
-pre-fix branch with `left: Unknown, right: Owner`.
+pre-fix branch with `left: Unknown, right: Owner`. The standing live guard is the
+`regression B79` acceptance case, which finds a mounted on-demand device folder
+through `pdfs locations --json` and writes into it (skipping when this machine
+has none).
 
 **Verified live (2026-07-31):** the packaged 1.2.1 daemon denies
 `touch ~/Documents/pdfs-b79-test`, `mkdir`, and `>` redirect while

docs/DEVELOPMENT.md

@@ -58,7 +58,9 @@ Derived from: [`BUGS.md`](BUGS.md)
 * **B56–B60 — fail-closed state and IPC fixes**: Future schemas, event cursor advancement, socket limits, private-directory validation, and atomic config saves are implemented. Malformed-schema, database-full, connection-flood, wrong-owner, and concurrent/faulted-save verification remains.
 * **B61 — credential rotation persistence**: Surface and retry keyring persistence failures so a rotated single-use refresh token cannot be lost on restart.
 * **B62–B65 — release assurance**: Clean-install package verification, complete version/protocol identity, recovery sign-off, advisory/license policy, SBOM, provenance, checksums, and signatures remain.
-* **B66–B68 — lifecycle and recovery**: Add queue flush/shutdown protection, explicit device adoption during fresh-state restore, and move profile backup below a writable remote folder.
+* **B66–B67 — lifecycle and recovery**: Add queue flush/shutdown protection and explicit device adoption during fresh-state restore.
+* **B68/B78 — profile backup**: the destination is fixed and verified live — `profile.json` now lives in `.proton-drive-linux/` under the device root, since the API refuses file creation at the root itself. What remains from B68 is making backup *health* visible (today a failure is a `WARN` in the log and nothing in the UI) and re-running the replacement-machine restore end to end.
+* **B79 — cross-mount permission classification**: fixed and verified live; the standing guard is the `regression B79` acceptance case. The second-account cases it neighbours (`regression B34`) still cannot run — see below.
 
 ---
 
@@ -76,6 +78,7 @@ Derived from: [`TESTING.md`](TESTING.md) and [`RECOVERY.md`](RECOVERY.md)
   3. Wipe the local state directory and SQLite cache.
   4. Restart the daemon.
   5. Run `pdfs sync restore` and assert the recovered filesystem matches the source byte-for-byte.
+* **Second-account sharing run (mount-architecture.md P7)**: The only outstanding verification for the mount/sharing work. One account covers `context_share_id`, the shared-with-me listing, sharing from device folders and the Locations page — all confirmed. A **second account** is required for the shared-tree rendering under a foreign volume, `accept_invitation`, `update_member_role`, the `regression B34` viewer cases (which skip cleanly today), and above all an **editor-role write into a foreign share**, the only thing that validates `membership_address_for`.
 * **Managed live mode matrix**: Before release, run `scripts/fuse-acceptance.sh --managed-live <empty-a> <empty-b>` with `PDFS_ACCEPTANCE_ONLY` unset. It validates on-demand/on-demand, on-demand/mirror, mirror/on-demand, and mirror/mirror transitions.
 * **Crash-consistency matrix**: Inject failure after scratch/sidecar sync, each staging rename, directory sync, pending-op insert/commit, and source deletion; prove that a complete discoverable copy and either the old or new queue record always survives.
 

docs/TESTING.md

@@ -83,6 +83,31 @@ guard, and it was found by exactly this mechanism: the B70 case failed, and
 narrowing it produced a smaller reproduction that has its own case now. Expect a
 red run against a real mount until it is fixed.
 
+**B79** (an on-demand device folder accepts writes) discovers its target from
+`pdfs locations --json` and skips when this machine has no mounted on-demand
+folder. It is the cheap standing guard against a *cross-mount* permission
+regression: the primary mount holds device-folder nodes too, and the queue guard
+intersects what every live inode space says about a uid, so a fail-closed
+classification in one mount denies writes in another.
+
+**B34** (a viewer-role share is read-only) and **B34b** (an editor-role share
+still writes) locate their subject through `pdfs shared-with-me --json`, which
+now carries `role` and a mount-relative `path`. Both skip when the account has no
+accepted share at that role — B34 needs a **second account** to have shared a
+folder read-only, which is the one part of the sharing suite that cannot be
+self-served. B34b degrades gracefully in the other direction: a shared *file*
+gets its mode bits and `W_OK` checked but is never written to, because it is
+someone else's document.
+
+B34's fourth assertion is the load-bearing one: `pending_uploads` and
+`pending_changes` must be **unchanged** across the refused writes. Mode bits
+alone would pass a fix that still admitted the write into `pending_op`, which is
+the actual harm — a background drain failing 403 forever.
+
+**Synthetic `Shared with me/` directory contract** asserts the virtual directory
+enumerates, reports `0555`, and refuses `mkdir`/`rmdir`/`rename`. It skips when
+the directory is absent (an account with no accepted shares).
+
 A regression case asserts against the *remote* outcome, so it must wait for the
 queue to drain before reading. Reading straight back through the mount proves
 nothing: the local attribute and content caches will happily return the bytes
@@ -149,6 +174,10 @@ During development, `PDFS_ACCEPTANCE_ONLY` runs tests whose descriptive name
 contains the supplied text (for example `PDFS_ACCEPTANCE_ONLY=namespace`). A
 release acceptance run must leave it unset so the complete contract executes.
 
+A filter naming a live-only case (every `regression B<n>` is one) selects nothing
+in the account-free reference run, which is not an error — that target simply has
+nothing to do. Only a filter matching *no case at all* fails, as the typo it is.
+
 Passing more paths runs the same filesystem suite independently against each.
 The first path must be the FUSE mount under test; later paths may be another
 FUSE mount or a normal local mirror filesystem: