test(fuse): start the size batch clock before the worker

The worker thread's sleeps could begin before the test read the clock, so the elapsed time came out a few milliseconds under the 90 ms bound on a busy runner. Reading the clock first makes the bound hold.

.github/ISSUE_TEMPLATE/config.yml

@@ -3,6 +3,9 @@ contact_links:
   - name: Security vulnerability
     url: https://github.com/narrrl/proton-drive-linux/security/advisories/new
     about: Report privately — never in a public issue.
+  - name: Troubleshooting and FAQ
+    url: https://github.com/narrrl/proton-drive-linux/wiki/Troubleshooting
+    about: Fixes for common problems, and what to include in a bug report.
   - name: Known issues
     url: https://github.com/narrrl/proton-drive-linux/blob/main/docs/BUGS.md
     about: The authoritative ledger of tracked bugs and their status.

.github/PULL_REQUEST_TEMPLATE.md

@@ -21,6 +21,7 @@ cargo test --workspace --locked
 - [ ] Touches recovery, staging, or anything that can be the only copy of user data
 - [ ] Changes packaging, the systemd unit, or desktop entries
 - [ ] Changes the control protocol (daemon and front ends updated together)
+- [ ] Adds or renames a page in `docs/` (listed in `SECTIONS` in `scripts/publish-wiki.sh`, which publishes it to the wiki)
 - [ ] None of the above
 
 <!-- Screenshots for GTK changes. -->

.github/workflows/aur.yml

@@ -67,7 +67,13 @@ jobs:
             User aur
           EOF
           # Pin the host key to the fingerprint published on aur.archlinux.org.
-          ssh-keyscan -t ed25519 aur.archlinux.org > "$HOME/.ssh/known_hosts"
+          # The scan sometimes returns nothing from the runner, so retry it.
+          for attempt in 1 2 3 4 5; do
+            ssh-keyscan -T 15 -t ed25519 aur.archlinux.org > "$HOME/.ssh/known_hosts" &&
+              [ -s "$HOME/.ssh/known_hosts" ] && break
+            echo "ssh-keyscan attempt $attempt returned no key; retrying"
+            sleep 10
+          done
           ssh-keygen -lf "$HOME/.ssh/known_hosts" | grep -q 'SHA256:RFzBCUItH9LZS0cKB5UE6ceAYhBD5C8GeOBip8Z11+4'
           chown -R builder: "$HOME/.ssh"
           chmod 600 "$HOME/.ssh/aur"

.github/workflows/ci.yml

@@ -45,7 +45,7 @@ jobs:
         run: cargo fmt --all -- --check
 
       - name: Lints
-        run: cargo clippy --workspace --all-targets -- -D warnings
+        run: cargo clippy --workspace --all-targets --locked -- -D warnings
 
       - name: Unit tests
         run: cargo test --workspace --locked
@@ -64,6 +64,54 @@ jobs:
   # Real Proton credentials and /dev/fuse deliberately do not run on pull
   # requests. Follow docs/TESTING.md on a dedicated test-account runner.
 
+  # The seeded simulation runs (docs/TESTING.md): real FUSE
+  # daemons against an in-memory Drive, so they need /dev/fuse but no account.
+  # They run on pull requests too: most data-loss fixes are only exercised
+  # here, and a change that breaks one should not reach main first.
+  simulation:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install native dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            pkg-config \
+            fuse3 \
+            libfuse3-dev \
+            libgtk-4-dev \
+            libadwaita-1-dev \
+            libwebkitgtk-6.0-dev \
+            libsecret-1-dev \
+            libdbus-1-dev
+
+      - name: Install minimum supported Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: '1.96'
+          cache: false
+
+      - uses: swatinem/rust-cache@v2
+        with:
+          shared-key: debug
+          save-if: false
+
+      - name: Simulation runs
+        run: 'cargo test -p pdfs-fuse --lib --locked sim:: -- --ignored --test-threads=1'
+
+      # A hung step writes every daemon thread's stack next to the run's
+      # state; without them a hang that does not replay cannot be told apart.
+      - name: Keep the stacks of a hung run
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: simulation-stacks
+          path: /tmp/pdfs-sim-*/stacks.txt
+          if-no-files-found: ignore
+
   # Keeps the release-profile dependencies cached on main, where the release
   # workflow can restore them; a tag cannot reuse the caches of earlier tags.
   release-cache:

.github/workflows/copr.yml

@@ -0,0 +1,66 @@
+name: COPR
+
+on:
+  # Called by release.yml once the GitHub release and its assets exist: COPR
+  # downloads the tag archive and the vendored crates from the release.
+  workflow_call:
+    inputs:
+      version:
+        required: true
+        type: string
+    secrets:
+      COPR_CONFIG:
+        required: true
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Release to build, such as 3.5.0. It must already have its vendor tarball.'
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: copr
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Build in COPR
+    runs-on: ubuntu-24.04
+    container: fedora:latest
+    env:
+      VERSION: ${{ inputs.version }}
+      COPR_PROJECT: narl-rs/proton-drive-linux
+
+    steps:
+      - name: Install packaging tools
+        run: dnf -y install copr-cli rpm-build rpmdevtools
+
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Configure COPR access
+        env:
+          COPR_CONFIG: ${{ secrets.COPR_CONFIG }}
+        run: |
+          install -d -m700 ~/.config
+          printf '%s\n' "$COPR_CONFIG" > ~/.config/copr
+          chmod 600 ~/.config/copr
+
+      # COPR rebuilds the source package without our --define, so the version
+      # has to be written into the spec itself.
+      - name: Build the source package
+        run: |
+          version="${VERSION#v}"
+          spec=packaging/proton-drive-linux.spec
+          sed -i -E "s/^(%\{!\?version: %global version )[^}]*\}/\1${version}}/" "$spec"
+          grep -qF "%global version ${version}}" "$spec"
+          mkdir -p rpmbuild/SOURCES
+          spectool -g -C rpmbuild/SOURCES "$spec"
+          rpmbuild -bs --define "_topdir $PWD/rpmbuild" "$spec"
+
+      # Waits for the build, so a failed COPR build fails this job.
+      - name: Submit to COPR
+        run: copr-cli build "$COPR_PROJECT" rpmbuild/SRPMS/*.src.rpm

.github/workflows/nix.yml

@@ -0,0 +1,59 @@
+name: Nix
+
+# Builds the flake (docs/INSTALL.md#nixos-flake) whenever its recipe, the lock
+# files or the code change, so a NixOS user's `nix build` keeps working. Run it
+# from the Actions tab for any branch to get a build to try.
+on:
+  push:
+    paths:
+      - 'flake.nix'
+      - 'flake.lock'
+      - 'packaging/nix/**'
+      - 'Cargo.lock'
+      - 'Cargo.toml'
+      - 'crates/**'
+      - 'po/**'
+      - '.github/workflows/nix.yml'
+  pull_request:
+    paths:
+      - 'flake.nix'
+      - 'flake.lock'
+      - 'packaging/nix/**'
+      - 'Cargo.lock'
+      - '.github/workflows/nix.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: nix-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: cachix/install-nix-action@v31
+
+      # Pulls from the project's binary cache, and pushes what this run built
+      # when the token is there; a fork's pull request has none and only pulls.
+      - uses: cachix/cachix-action@v17
+        with:
+          name: proton-drive-linux
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+      - name: Check the flake
+        run: nix flake check --print-build-logs --no-build
+
+      - name: Build the package
+        run: nix build --print-build-logs .#proton-drive-linux
+
+      - name: Smoke test
+        run: |
+          ./result/bin/pdfs --version
+          for bin in pdfs-app pdfs-tray pdfs-prompt; do test -x "result/bin/$bin"; done
+          grep -q "ExecStart=$(readlink -f result)/bin/pdfs" result/lib/systemd/user/proton-drive.service
+          ls result/share/locale/*/LC_MESSAGES/pdfs.mo

.github/workflows/release.yml

@@ -52,8 +52,10 @@ jobs:
           tag_version="${GITHUB_REF_NAME#v}"
           manifest_version="$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | head -n1)"
           pkgbuild_version="$(sed -n 's/^pkgver=//p' packaging/PKGBUILD | head -n1)"
+          spec_version="$(sed -n 's/^%{!?version: %global version \([^}]*\)}/\1/p' packaging/proton-drive-linux.spec)"
           test "$tag_version" = "$manifest_version"
           test "$tag_version" = "$pkgbuild_version"
+          test "$tag_version" = "$spec_version"
 
       - name: Release quality gates
         run: |
@@ -129,6 +131,12 @@ jobs:
           # Create tarball
           tar -czf proton-drive-linux-${{ env.VERSION }}-x86_64.tar.gz -C dist/binaries .
 
+      # Every crate the build needs, so COPR can build the spec without network.
+      - name: Package vendored crates (.tar.xz)
+        run: |
+          cargo vendor --locked dist/vendor > /dev/null
+          tar -cJf proton-drive-linux-vendor-${{ env.VERSION }}.tar.xz -C dist vendor
+
       - name: Package Debian package (.deb)
         run: |
           mkdir -p deb/DEBIAN
@@ -153,6 +161,9 @@ jobs:
           cp LICENSE deb/usr/share/licenses/proton-drive-linux/
           po/build.sh deb/usr/share/locale
 
+          # Stops the running daemon before removal, so the mount stops mirroring deletes
+          install -m755 packaging/deb/prerm deb/DEBIAN/prerm
+
           # Calculate Installed-Size in KB for the control file
           INSTALLED_SIZE=$(du -sk deb | cut -f1)
 
@@ -227,27 +238,75 @@ jobs:
           path: |
             *.deb
             *.tar.gz
+            *.tar.xz
             *.rpm
           if-no-files-found: error
 
+  # The flake is the Nix release: a tag is what `github:narrrl/proton-drive-linux/vX.Y.Z`
+  # pins, so it has to build before the release is announced.
+  nix:
+    name: Build the Nix package
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: cachix/install-nix-action@v31
+
+      # Pulls from the project's binary cache, and pushes what this run built
+      # when the token is there; a fork's pull request has none and only pulls.
+      - uses: cachix/cachix-action@v17
+        with:
+          name: proton-drive-linux
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+      - name: Build the flake
+        run: nix build --print-build-logs .#proton-drive-linux
+
+      - name: Check the version
+        run: |
+          built="$(./result/bin/pdfs --version)"
+          echo "$built"
+          case "$GITHUB_REF" in
+            refs/tags/v*) grep -qF "${GITHUB_REF_NAME#v}" <<< "$built" ;;
+          esac
+
   publish:
     name: Create GitHub Release
-    needs: [checks, build-release]
+    needs: [checks, build-release, nix]
     if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-24.04
 
     steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
       - name: Download packages
         uses: actions/download-artifact@v8
         with:
           name: proton-drive-linux-builds
 
+      # The release notes are this version's section of the changelog, from its
+      # heading up to the next one.
+      - name: Extract release notes
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          awk -v heading="## [$version]" \
+            'index($0, heading) == 1 { found = 1; print; next }
+             found && /^## \[/ { exit }
+             found' docs/CHANGELOG.md > release-notes.md
+          if [ ! -s release-notes.md ]; then
+            echo "::error::docs/CHANGELOG.md has no section for $version"
+            exit 1
+          fi
+
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v3
         with:
+          body_path: release-notes.md
           files: |
             *.deb
             *.tar.gz
+            *.tar.xz
             *.rpm
           draft: false
           prerelease: false
@@ -263,3 +322,21 @@ jobs:
       version: ${{ github.ref_name }}
     secrets:
       AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+
+  copr:
+    name: Build COPR packages
+    needs: publish
+    if: startsWith(github.ref, 'refs/tags/')
+    uses: ./.github/workflows/copr.yml
+    with:
+      version: ${{ github.ref_name }}
+    secrets:
+      COPR_CONFIG: ${{ secrets.COPR_CONFIG }}
+
+  wiki:
+    name: Publish the wiki
+    needs: publish
+    if: startsWith(github.ref, 'refs/tags/')
+    uses: ./.github/workflows/wiki.yml
+    with:
+      ref: ${{ github.ref_name }}

.github/workflows/test-build.yml

@@ -0,0 +1,121 @@
+name: Test build
+
+# On-demand Fedora RPM of any branch, for someone to try a fix before it ships.
+# Run it from the Actions tab ("Run workflow", pick the branch). Built inside a
+# Fedora container so the binaries link against Fedora's own GTK, libadwaita and
+# WebKitGTK, not the Ubuntu ones the release RPM is built against.
+#
+# The RPM is unsigned and versioned `<Cargo version>-1.test.<sha>`, so it sorts
+# below the release it precedes and `dnf` replaces it when that ships.
+on:
+  workflow_dispatch:
+    inputs:
+      fedora:
+        description: 'Fedora release to build on'
+        required: false
+        default: '44'
+        type: string
+      prerelease:
+        description: 'Also publish a pre-release anyone can download without a GitHub login'
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+
+concurrency:
+  group: test-build-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  rpm:
+    name: Fedora ${{ inputs.fedora }} RPM
+    runs-on: ubuntu-24.04
+    container: fedora:${{ inputs.fedora }}
+    steps:
+      - name: Install build dependencies
+        run: |
+          dnf install -y --setopt=install_weak_deps=False \
+            git rpm-build gcc gcc-c++ make gettext curl \
+            pkgconf-pkg-config fuse3-devel gtk4-devel libadwaita-devel \
+            libsecret-devel dbus-devel glib2-devel webkitgtk6.0-devel
+
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      # Fedora's packaged Rust can trail the workspace's minimum (1.96).
+      - name: Set up Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: '1.96'
+          cache: false
+
+      - name: Cache Cargo target
+        uses: swatinem/rust-cache@v2
+        with:
+          shared-key: fedora-test-build
+          save-if: false
+
+      - name: Build release binaries
+        run: cargo build --release --locked
+
+      - name: Package RPM
+        run: |
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          VERSION=$(grep -m1 '^version' Cargo.toml | cut -d'"' -f2)
+          SHORT=${GITHUB_SHA::7}
+          mkdir -p rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS,BUILDROOT,db}
+          rpmbuild -bb \
+            --nodeps \
+            --define "_topdir $PWD/rpmbuild" \
+            --define "_sourcedir $PWD" \
+            --define "git_dir $PWD" \
+            --define "prebuilt 1" \
+            --define "version ${VERSION}" \
+            --define "dist .test.${SHORT}" \
+            --define "_dbpath $PWD/rpmbuild/db" \
+            packaging/proton-drive-linux.spec
+          mkdir -p out
+          cp rpmbuild/RPMS/x86_64/*.rpm out/
+          # The bare binaries, for trying one without installing anything.
+          tar -czf "out/proton-drive-linux-${VERSION}-${SHORT}-fedora${{ inputs.fedora }}-x86_64.tar.gz" \
+            -C target/release pdfs pdfs-tray pdfs-app pdfs-prompt
+          ls -l out
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: proton-drive-linux-fedora${{ inputs.fedora }}-${{ github.sha }}
+          path: out/*
+          retention-days: 14
+          if-no-files-found: error
+
+  prerelease:
+    name: Publish pre-release
+    needs: rpm
+    if: inputs.prerelease
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    steps:
+      - name: Download build
+        uses: actions/download-artifact@v8
+        with:
+          path: out
+          merge-multiple: true
+
+      # One rolling pre-release per branch: a new run replaces the last one, so
+      # the link a tester was given keeps pointing at the newest build.
+      - name: Publish
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          TAG="test-$(echo "${GITHUB_REF_NAME}" | tr -c 'A-Za-z0-9._\n' '-')"
+          gh release delete "$TAG" --cleanup-tag --yes 2>/dev/null || true
+          gh release create "$TAG" out/* \
+            --target "$GITHUB_SHA" \
+            --prerelease \
+            --title "Test build of ${GITHUB_REF_NAME} (${GITHUB_SHA::7})" \
+            --notes "Unsigned test build of branch \`${GITHUB_REF_NAME}\` at ${GITHUB_SHA}. Not a release; replaced by the next test build of this branch."

.github/workflows/wiki.yml

@@ -0,0 +1,77 @@
+name: Wiki
+
+# docs/ is the source of the GitHub wiki (docs/DEVELOPMENT.md#common-changes).
+# Every change to the documentation checks its links; release.yml calls this
+# once the release is published, so the wiki documents the latest release. Run
+# it from the Actions tab to publish main in between.
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'docs/**'
+      - 'images/**'
+      - 'README.md'
+      - 'CONTRIBUTING.md'
+      - 'SECURITY.md'
+      - 'scripts/publish-wiki.sh'
+      - '.github/workflows/wiki.yml'
+  pull_request:
+    paths:
+      - 'docs/**'
+      - 'images/**'
+      - 'README.md'
+      - 'CONTRIBUTING.md'
+      - 'SECURITY.md'
+      - 'scripts/publish-wiki.sh'
+      - '.github/workflows/wiki.yml'
+  workflow_call:
+    inputs:
+      ref:
+        description: 'Tag or branch to publish'
+        required: true
+        type: string
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Tag or branch to publish'
+        required: false
+        default: 'main'
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    name: Check documentation links
+    if: inputs.ref == ''
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Check links
+        run: scripts/publish-wiki.sh --check "$RUNNER_TEMP"
+
+  publish:
+    name: Publish to the wiki
+    # Set only by release.yml and the Actions tab, so pushes and pull requests
+    # never publish.
+    if: inputs.ref != ''
+    runs-on: ubuntu-24.04
+    concurrency:
+      group: wiki-publish
+      cancel-in-progress: false
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.ref }}
+
+      - name: Publish
+        env:
+          WIKI_REMOTE: https://x-access-token:${{ github.token }}@github.com/${{ github.repository }}.wiki.git
+        run: |
+          git config --global user.name 'github-actions[bot]'
+          git config --global user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          scripts/publish-wiki.sh --push "$RUNNER_TEMP"

.gitignore

@@ -3,3 +3,5 @@
 *.pdb
 .env
 /rpmbuild
+/result
+/result-*

CONTRIBUTING.md

@@ -6,10 +6,10 @@ deliberately high — everything else is ordinary Rust review.
 
 ## Before you start
 
-- Read [`AGENTS.md`](AGENTS.md) for repository conventions,
-  [`docs/DEVELOPMENT.md`](docs/DEVELOPMENT.md) for building, running and debugging from source,
-  and [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) for how the daemon, front ends, and SDK fit
-  together. [`docs/README.md`](docs/README.md) indexes the rest.
+- Read [`docs/DEVELOPMENT.md`](docs/DEVELOPMENT.md) for building, running and debugging from
+  source, and [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) for how the daemon, front ends, and
+  SDK fit together. [`docs/README.md`](docs/README.md) indexes the rest. The same pages are on
+  the [wiki](https://github.com/narrrl/proton-drive-linux/wiki).
 - Check [`docs/BUGS.md`](docs/BUGS.md) — it is the authoritative issue ledger, and your problem may
   already be tracked there with context.
 - For anything larger than a fix, open an issue first so the design can be discussed before you
@@ -39,9 +39,9 @@ cargo test --workspace --locked
 scripts/fuse-acceptance.sh --offline-only
 ```
 
-Changes to the FUSE layer, sync, or the pending-operation queue should also be exercised against a
-real mount before review — see [`docs/TESTING.md`](docs/TESTING.md). Live runs are destructive:
-use a dedicated test account, never one holding data you cannot lose.
+Changes to the FUSE layer, sync, or the queue should also pass the simulation runs and be
+exercised against a real mount before review — see [`docs/TESTING.md`](docs/TESTING.md). Live
+runs are destructive: use a dedicated test account, never one holding data you cannot lose.
 
 ## Making changes
 
@@ -58,8 +58,10 @@ use a dedicated test account, never one holding data you cannot lose.
   catalog in `po/LINGUAS` in the same change. See [`docs/TRANSLATING.md`](docs/TRANSLATING.md).
   The CLI and daemon messages stay in English.
 - **Document what users see.** A new command, setting or behaviour belongs in the matching page
-  under `docs/` (user guide, CLI reference or configuration) and in the `[Unreleased]` section of
-  [`docs/CHANGELOG.md`](docs/CHANGELOG.md).
+  under `docs/` (a user guide topic, the CLI reference or configuration) and in the `[Unreleased]`
+  section of [`docs/CHANGELOG.md`](docs/CHANGELOG.md). Each release publishes `docs/` to the
+  wiki. A new page goes into `SECTIONS` in `scripts/publish-wiki.sh`, and
+  `scripts/publish-wiki.sh --check` must pass. CI runs it on every change to `docs/`.
 
 ## Commits and pull requests
 

Cargo.lock

@@ -3474,7 +3474,7 @@ checksum = "2ee67f1008b1ba2321834326597b8e186293b049a023cdef258527550b9935b4"
 
 [[package]]
 name = "pdfs-cli"
-version = "2.8.0"
+version = "3.6.0"
 dependencies = [
  "anyhow",
  "clap",
@@ -3485,16 +3485,19 @@ dependencies = [
  "tokio",
  "tracing",
  "tracing-subscriber",
+ "zeroize",
 ]
 
 [[package]]
 name = "pdfs-core"
-version = "2.8.0"
+version = "3.6.0"
 dependencies = [
  "async-trait",
+ "base64 0.23.1",
  "dbus-secret-service-keyring-store",
  "directories",
  "ignore",
+ "kamadak-exif",
  "keyring-core",
  "libc",
  "parking_lot",
@@ -3508,13 +3511,15 @@ dependencies = [
  "thiserror 2.0.20",
  "tokio",
  "tracing",
+ "zeroize",
  "zip",
 ]
 
 [[package]]
 name = "pdfs-fuse"
-version = "2.8.0"
+version = "3.6.0"
 dependencies = [
+ "async-trait",
  "base64 0.23.1",
  "fuser",
  "futures",
@@ -3528,12 +3533,13 @@ dependencies = [
  "sha1 0.11.0",
  "tokio",
  "tracing",
+ "tracing-subscriber",
  "zip",
 ]
 
 [[package]]
 name = "pdfs-gui"
-version = "2.8.0"
+version = "3.6.0"
 dependencies = [
  "anyhow",
  "async-channel",
@@ -3570,9 +3576,9 @@ checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
 name = "pgp"
-version = "0.20.0"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1cfa4743b28656065ff4c0ba09e46b357a65e8c00fc2341e89084b82f87cbdf1"
+checksum = "ae70f4d9325a391db30d115d6191a7bb67cec856aa0bba131290f0c4e09a532a"
 dependencies = [
  "aead 0.5.2",
  "aes 0.8.4",
@@ -3773,9 +3779,9 @@ dependencies = [
 
 [[package]]
 name = "proton-drive-rs"
-version = "0.7.1"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8807e007328fd08cad9fe93c84dd7cdb38dc97469250edf3d6b58c6df0ac0d4f"
+checksum = "8f70318394b2815b009c52f804d75747086db93a338ceb6eae62541f2b25d5bf"
 dependencies = [
  "async-trait",
  "base64 0.23.1",
@@ -3800,9 +3806,9 @@ dependencies = [
 
 [[package]]
 name = "proton-sdk"
-version = "0.7.1"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "085cd6506a49d8892a2b7ed6b5db3909750d9844610178f55979ed330d9fe715"
+checksum = "4196392032f56b3bbaac0bb1f24eea62fa7e2a0af72004de8d08e518d14720fb"
 dependencies = [
  "aes-gcm 0.11.1",
  "async-trait",
@@ -3829,6 +3835,7 @@ dependencies = [
  "thiserror 2.0.20",
  "tokio",
  "tracing",
+ "zeroize",
 ]
 
 [[package]]

Cargo.toml

@@ -3,7 +3,7 @@ resolver = "2"
 members = ["crates/pdfs-core", "crates/pdfs-fuse", "crates/pdfs-cli", "crates/pdfs-gui"]
 
 [workspace.package]
-version = "2.8.0"
+version = "3.6.0"
 edition = "2024"
 license = "MIT"
 authors = ["Nils Pukropp <contact@narl.io>"]
@@ -15,8 +15,8 @@ keywords = ["proton", "drive", "fuse", "sync", "linux"]
 categories = ["filesystem", "command-line-utilities"]
 
 [workspace.dependencies]
-proton-sdk = { version = "0.7.1" }
-proton-drive-rs = { version = "0.7.1" }
+proton-sdk = { version = "0.10.0" }
+proton-drive-rs = { version = "0.10.0" }
 
 # Internal crates.
 pdfs-core = { path = "crates/pdfs-core" }
@@ -26,6 +26,7 @@ tokio = { version = "1", features = ["rt-multi-thread", "macros", "sync", "fs",
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 base64 = "0.23"
+zeroize = "1"
 thiserror = "2"
 anyhow = "1"
 # Non-poisoning mutexes. A handler that panics while holding a lock must not
@@ -60,3 +61,15 @@ async-trait = "0.1"
 futures = "0.3"
 fuser = "0.18"
 libc = "0.2"
+
+[profile.release]
+# No package ships a separate debug package (the PKGBUILD sets `!debug`, the
+# RPM spec sets `debug_package` to nil), and the unstripped binaries weighed
+# 43 MB (`pdfs`), 24 MB (`pdfs-app`) and 12 MB (`pdfs-tray`).
+strip = "symbols"
+# Off on purpose: LTO has broken GTK links for this workspace, which is why
+# the packages turn it off as well.
+lto = false
+# `Workers` and the thumbnail build catch panics to keep the daemon alive, so
+# unwinding must stay on.
+panic = "unwind"

README.md

@@ -15,6 +15,7 @@ scriptable CLI.
 [![AUR](https://img.shields.io/aur/version/proton-drive-for-linux)](https://aur.archlinux.org/packages/proton-drive-for-linux)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Rust 1.96+](https://img.shields.io/badge/rust-1.96%2B-orange.svg)](https://www.rust-lang.org)
+[![Buy me a coffee](https://img.shields.io/badge/Buy%20me%20a%20coffee-FFDD00?logo=buymeacoffee&logoColor=black)](https://buymeacoffee.com/narl)
 
 <img src="images/files.png" alt="My files in the Proton Drive app" width="820">
 
@@ -38,8 +39,9 @@ scriptable CLI.
 - **Synced folders.** Back up folders such as `~/Documents` under your computer in Proton Drive,
   as a full two-way copy or online only. Gitignore-style `.pdfsignore` rules, conflict copies
   instead of overwrites, pause and bandwidth limits.
-- **Safe writes.** Changes are staged on disk and queued before they are acknowledged, so they
-  survive a lost connection, a crash or a reboot and upload when they can.
+- **Works at local speed.** Making, renaming and deleting files and folders returns at once, online
+  or offline. Changes are staged on disk and queued before they are acknowledged, so they survive
+  a lost connection, a crash or a reboot and reach Drive when they can.
 
 **Desktop app**
 
@@ -50,7 +52,8 @@ scriptable CLI.
 - **Sharing.** Invite people as viewer, editor or admin, create public links with password and
   expiry, accept invitations.
 - **Sync overview.** What is uploading, what is waiting, what failed and why, and a history of
-  what happened.
+  what happened. A change Drive refuses (storage full, access taken away) shows at once, on the
+  file too, and can be exported or discarded.
 - **Tray icon** with status, pause and quick actions, and a **search launcher** (`pdfs-prompt`)
   that searches Proton Drive and your home folder together, as its own window, through fuzzel,
   rofi or wofi, or live in `fzf`.
@@ -70,15 +73,30 @@ scriptable CLI.
 
 | Distribution | Package |
 |---|---|
-| Debian, Ubuntu 24.04 or newer | `.deb` from the [latest release](https://github.com/narrrl/proton-drive-linux/releases/latest) |
-| Fedora 44 or newer | `.rpm` from the [latest release](https://github.com/narrrl/proton-drive-linux/releases/latest) |
+| Fedora 44 or newer | [`narl-rs/proton-drive-linux`](https://copr.fedorainfracloud.org/coprs/narl-rs/proton-drive-linux/) in COPR, updated with `dnf upgrade` |
 | Arch Linux | [`proton-drive-for-linux`](https://aur.archlinux.org/packages/proton-drive-for-linux) (also `-bin` and `-git`) in the AUR |
+| Debian, Ubuntu 24.04 or newer | `.deb` from the [latest release](https://github.com/narrrl/proton-drive-linux/releases/latest) |
+| NixOS | The flake in this repository: see [Installation → NixOS](docs/INSTALL.md#nixos-flake) |
 | Anything else | [Build from source](docs/INSTALL.md#build-from-source) |
 
+**Fedora**
+
 ```bash
-sudo apt install ./proton-drive-linux_*.deb        # Debian, Ubuntu
-sudo dnf install ./proton-drive-linux-*.rpm        # Fedora
-paru -S proton-drive-for-linux                     # Arch
+sudo dnf copr enable narl-rs/proton-drive-linux
+sudo dnf install proton-drive-linux
+```
+
+**Arch Linux**
+
+```bash
+paru -S proton-drive-for-linux
+```
+
+**Debian and Ubuntu:** download the `.deb` from the
+[latest release](https://github.com/narrrl/proton-drive-linux/releases/latest), then:
+
+```bash
+sudo apt install ./proton-drive-linux_*_amd64.deb
 ```
 
 Then open **Proton Drive** from your applications menu and sign in. The app starts the background
@@ -93,18 +111,25 @@ systemctl --user enable --now proton-drive.service
 pdfs status
 ```
 
-[docs/INSTALL.md](docs/INSTALL.md) has the requirements, optional extras (tray on GNOME, RAW and
-video thumbnails), headless use and uninstalling.
+New to the client? [Getting started](docs/GETTING_STARTED.md) walks through the first steps.
+[Installation](docs/INSTALL.md) has the optional extras (tray on GNOME, RAW and video
+thumbnails), updating, headless use and uninstalling.
 
 ## Documentation
 
+The documentation is in [`docs/`](docs/README.md) and on the
+[wiki](https://github.com/narrrl/proton-drive-linux/wiki).
+
 | | |
 |---|---|
+| [Getting started](docs/GETTING_STARTED.md) | From installing to your first synced folder |
 | [User guide](docs/USER_GUIDE.md) | Everything the app, tray and launcher do |
+| [FAQ](docs/FAQ.md) | Short answers to common questions |
 | [Command-line reference](docs/CLI.md) | Every `pdfs` command and scripting with `--json` |
 | [Configuration](docs/CONFIGURATION.md) | `config.json`, file locations, environment variables, the service |
 | [Troubleshooting](docs/TROUBLESHOOTING.md) | Diagnosing problems and fixing common ones |
 | [Recovering on a new computer](docs/RECOVERY.md) | Getting your synced folders back after a reinstall or a lost machine |
+| [Security model](docs/SECURITY_MODEL.md) | What protects your files, what stays on this computer, what the client connects to |
 | [Changelog](docs/CHANGELOG.md) | What changed in each release |
 
 For contributors: [development guide](docs/DEVELOPMENT.md), [architecture](docs/ARCHITECTURE.md),
@@ -146,7 +171,8 @@ keys before it leaves the machine, through a Rust implementation of Proton's Dri
 
 Files you open are decrypted into a local cache so programs can read them. What that means for
 the security of the machine is spelled out in the
-[threat model](docs/ARCHITECTURE.md#8-threat-model-what-this-client-writes-to-disk-in-plaintext).
+[security model](docs/SECURITY_MODEL.md#what-is-kept-on-this-computer), and in full detail in
+the [threat model](docs/ARCHITECTURE.md#10-threat-model-what-this-client-writes-to-disk-in-plaintext).
 
 ## Contributing
 
@@ -154,6 +180,13 @@ Bug reports, translations and patches are welcome. See [CONTRIBUTING.md](CONTRIB
 workflow and the checks CI runs, and [SECURITY.md](SECURITY.md) to report a vulnerability
 privately.
 
+## Support
+
+Proton Drive Linux is free and built in spare time. If it saves you a few headaches, you can
+[buy me a coffee](https://buymeacoffee.com/narl).
+
+<a href="https://buymeacoffee.com/narl"><img src="https://img.shields.io/badge/Buy%20me%20a%20coffee-FFDD00?logo=buymeacoffee&logoColor=black" alt="Buy me a coffee"></a>
+
 ## License
 
 Released under the [MIT License](LICENSE).

SECURITY.md

@@ -4,6 +4,9 @@
 
 Fixes land on the latest release. Please reproduce on the most recent version before reporting.
 
+For what the client protects and what it does not, written for users, see the
+[security model](docs/SECURITY_MODEL.md).
+
 ## Reporting a vulnerability
 
 **Do not open a public issue.** Report privately through GitHub's
@@ -31,7 +34,7 @@ the interesting boundaries are:
   or the wrong key material to Proton.
 
 What the client deliberately keeps in plaintext on disk, and why, is documented in the
-[threat model](docs/ARCHITECTURE.md#8-threat-model-what-this-client-writes-to-disk-in-plaintext).
+[threat model](docs/ARCHITECTURE.md#10-threat-model-what-this-client-writes-to-disk-in-plaintext).
 Behaviour described there is known and not a vulnerability by itself; a way to make it worse
 than described is.
 

crates/pdfs-cli/Cargo.toml

@@ -23,3 +23,4 @@ tracing-subscriber.workspace = true
 clap.workspace = true
 rpassword.workspace = true
 serde_json.workspace = true
+zeroize.workspace = true

crates/pdfs-core/Cargo.toml

@@ -28,3 +28,6 @@ dbus-secret-service-keyring-store.workspace = true
 parking_lot.workspace = true
 async-trait.workspace = true
 libc.workspace = true
+zeroize.workspace = true
+base64.workspace = true
+exif = { version = "0.6", package = "kamadak-exif" }

crates/pdfs-core/src/cache.rs

@@ -91,7 +91,7 @@ const TOUCH_FLUSH_AT: usize = 256;
 ///
 /// Public because it is the *contract* a block has to satisfy, not a detail of
 /// this cache: the network read path validates against it too, so a block that
-/// comes back short is refused before it can truncate a file (bugs.md B84).
+/// comes back short is refused before it can truncate a file (`docs/BUGS.md` B84).
 pub fn block_len(size: u64, idx: u64) -> u64 {
     let start = idx.saturating_mul(BLOCK_SIZE);
     size.saturating_sub(start).min(BLOCK_SIZE)
@@ -311,8 +311,7 @@ struct PinFile {
     pins: BTreeMap<String, Pin>,
 }
 
-/// What a staged file actually contains, written beside it as `<name>.json`
-/// (offline.md Phase 2).
+/// What a staged file actually contains, written beside it as `<name>.json`.
 ///
 /// A staged file is **not** necessarily valid whole-file content, and that is
 /// the whole reason this exists. A partial overwrite commits by filling the
@@ -365,6 +364,14 @@ pub struct StagedWrite {
     pub based_on: Option<Baseline>,
 }
 
+impl StagedWrite {
+    /// Whether `authored` ranges cover a file of `len` bytes, so the staged
+    /// bytes are its complete new content. An empty file has nothing to cover.
+    pub fn covers(authored: &[(u64, u64)], len: u64) -> bool {
+        len == 0 || authored == [(0, len)]
+    }
+}
+
 /// The identity of a remote revision, as far as we can observe it.
 ///
 /// `revision_id` is the authoritative identity when present: the server assigns a
@@ -431,9 +438,9 @@ pub struct ContentCache {
     /// Subdirectory for write-handle scratch files (disk-backed write buffers).
     /// Emptied on open so a crashed run leaves no orphans.
     scratch_dir: PathBuf,
-    /// Subdirectory holding the bytes of writes that have not been uploaded yet
-    /// (offline.md Phase 2/3) — every released write passes through here, since
-    /// the upload is a queued op performed later. Unlike `scratch_dir` this is
+    /// Subdirectory holding the bytes of writes that have not been uploaded yet.
+    /// Every released write passes through here, since the upload is a queued
+    /// op performed later. Unlike `scratch_dir` this is
     /// **never** emptied on open: these are the only copy of content the user
     /// authored, and the whole point is that they outlive the daemon.
     staging_dir: PathBuf,
@@ -468,7 +475,7 @@ pub struct ContentCache {
     thumb_bytes: AtomicU64,
     /// Unified metadata DB. Its `cache_entries` table is the LRU index: every
     /// store/read/evict updates it, and the budget enforcers query it instead of
-    /// scanning the cache directories (plan.md P4).
+    /// scanning the cache directories.
     db: Arc<Db>,
     /// LRU touches not yet written to `cache_entries`, keyed by cache key.
     ///
@@ -837,6 +844,9 @@ impl ContentCache {
         }
         let bytes = std::fs::metadata(&tmp)?.len();
         std::fs::rename(&tmp, &blob)?;
+        // Linked from the blob already cached, the temp name was a second name
+        // of it, and the rename did nothing (`docs/BUGS.md` B187).
+        let _ = std::fs::remove_file(&tmp);
         let meta = serde_json::to_vec(&Meta { mtime, size })?;
         std::fs::write(self.meta_path(uid), meta)?;
         self.db
@@ -978,7 +988,7 @@ impl ContentCache {
     /// a miss ([`cached_block`](Self::cached_block) checks), so a bad block
     /// cannot escape this cache even though this does not check. Validating a
     /// block is the *reader's* job, at the point it is fetched — see
-    /// `Core::read_block` (bugs.md B84).
+    /// `Core::read_block` (`docs/BUGS.md` B84).
     pub fn store_block(
         &self,
         uid: &NodeUid,
@@ -1480,9 +1490,8 @@ impl ContentCache {
     /// This is what makes a write survive its upload: the caller is releasing a
     /// write handle and would otherwise delete the file, so until the bytes are
     /// on the remote, staging holds the only copy. Every dirty handle goes
-    /// through here — the upload is a queued op performed later (offline.md
-    /// Phase 3), and a staged file is also what a human can recover from if the
-    /// queue never drains.
+    /// through here — the upload is a queued op performed later, and a staged
+    /// file is also what a human can recover from if the queue never drains.
     ///
     /// Falls back to a copy when the rename crosses a filesystem boundary; a
     /// failure here means we could not save the bytes at all, so it is reported
@@ -2056,6 +2065,17 @@ mod tests {
         NodeUid::new(VolumeId::from("vol"), LinkId::from(link))
     }
 
+    #[test]
+    fn an_empty_write_covers_the_file_and_a_gap_does_not() {
+        assert!(
+            StagedWrite::covers(&[], 0),
+            "an empty file has nothing to cover"
+        );
+        assert!(StagedWrite::covers(&[(0, 7)], 7));
+        assert!(!StagedWrite::covers(&[(0, 3), (4, 7)], 7));
+        assert!(!StagedWrite::covers(&[], 7));
+    }
+
     /// A unique temp directory removed on drop; avoids a dev-dependency.
     struct TempDir(PathBuf);
     impl TempDir {
@@ -2178,6 +2198,24 @@ mod tests {
         assert_eq!(c.read_range(&u, 200, 5, 0, 5).unwrap(), b"newer");
     }
 
+    /// A landed create and the revision after it can adopt the same staged
+    /// blob. The link to the temp name is then a second name of the cached
+    /// blob, and a rename between two names of one file does nothing: the
+    /// temp name stayed until the next start swept it (`docs/BUGS.md` B187).
+    #[test]
+    fn store_file_twice_from_the_same_blob_leaves_no_temp_file() {
+        let (c, d) = cache();
+        let u = uid("a");
+        let src = d.path().join("staged-blob");
+        std::fs::write(&src, b"staged").unwrap();
+
+        c.store_file(&u, 100, 6, &src).unwrap();
+        c.store_file(&u, 100, 6, &src).unwrap();
+
+        assert!(!c.blob_path(&u).with_extension("tmp").exists());
+        assert_eq!(c.read_range(&u, 100, 6, 0, 6).unwrap(), b"staged");
+    }
+
     #[test]
     fn reconcile_rebuilds_index_from_disk() {
         let dir = TempDir::new();
@@ -2271,42 +2309,26 @@ mod tests {
     /// call also needs.
     #[test]
     fn budget_check_is_free_when_under_budget() {
-        use std::time::Instant;
-
         // Cap far above what we store, so every store stays under budget.
         let (c, _d) = cache_capped(1 << 30);
         let payload = vec![0u8; 4096];
-
-        // Cost of a store against a near-empty index...
-        let t = Instant::now();
-        for i in 0..500u64 {
+        for i in 0..8u64 {
             c.store_block(&uid("a"), 1, 1 << 30, blk(1 << 30, i), &payload)
                 .unwrap();
         }
-        let empty = t.elapsed() / 500;
 
-        // ...and against one with a few thousand entries in it.
-        for i in 500..2500u64 {
-            c.store_block(&uid("a"), 1, 1 << 30, blk(1 << 30, i), &payload)
-                .unwrap();
-        }
-        let t = Instant::now();
-        for i in 2500..3000u64 {
-            c.store_block(&uid("a"), 1, 1 << 30, blk(1 << 30, i), &payload)
-                .unwrap();
-        }
-        let full = t.elapsed() / 500;
+        // Plant an index row far over the cap behind the running total's back,
+        // and older than every real block. Any budget check that consults the
+        // index would see the pool over budget, evict, and reseed the total.
+        c.db.cache_touch("planted", KIND_BLOCK, 1 << 40, 0).unwrap();
 
-        println!("B4: store_block under budget — {empty:?} at ~0 entries, {full:?} at 2500");
-        // A ratio, not a wall-clock bound: the claim is that the under-budget
-        // path does not grow with the index, and only a ratio tests that. An
-        // absolute threshold measures the machine's load instead, and this test
-        // runs alongside the rest of the suite.
-        assert!(
-            full < empty * 3,
-            "under-budget store should not scale with the index: \
-             {empty:?} at ~0 entries vs {full:?} at 2500"
-        );
+        c.store_block(&uid("a"), 1, 1 << 30, blk(1 << 30, 8), &payload)
+            .unwrap();
+
+        // Not a timing ratio: that measured the CI runner's load and flaked.
+        assert_eq!(c.block_bytes.load(Ordering::Relaxed), 9 * 4096);
+        let entries = c.db.cache_entries_by_kind(KIND_BLOCK).unwrap();
+        assert_eq!(entries.len(), 10, "under-budget store evicted: {entries:?}");
     }
 
     /// The running totals are a fast path, not a second source of truth: after
@@ -2667,7 +2689,7 @@ mod tests {
     }
 
     /// The geometry the whole read path validates against, here and over the
-    /// network (bugs.md B84): full blocks, then whatever is left.
+    /// network (`docs/BUGS.md` B84): full blocks, then whatever is left.
     #[test]
     fn block_len_is_full_blocks_then_the_remainder() {
         let size = BLOCK_SIZE * 2 + 17;
@@ -2747,7 +2769,7 @@ mod tests {
     /// A cached block is addressed by the range it covers, not by its index
     /// alone. Re-planning a file onto its real geometry must therefore miss the
     /// blocks the uniform fallback cached, rather than serve their bytes at the
-    /// wrong offset (bugs.md B85).
+    /// wrong offset (`docs/BUGS.md` B85).
     #[test]
     fn a_cached_block_is_not_served_to_a_different_geometry() {
         let (c, _d) = cache();
@@ -2814,7 +2836,7 @@ mod tests {
 
     /// A block of the wrong length cannot escape the cache even though the
     /// store does not check: the read validates it and reports a miss, so the
-    /// next read refetches rather than serving a hole (bugs.md B84).
+    /// next read refetches rather than serving a hole (`docs/BUGS.md` B84).
     #[test]
     fn a_block_of_the_wrong_length_reads_as_a_miss() {
         let (c, _d) = cache();
@@ -2879,7 +2901,7 @@ mod tests {
         );
     }
 
-    /// A failed upload must never cost the user their bytes (offline.md Phase 2):
+    /// A failed upload must never cost the user their bytes:
     /// the scratch file moves to staging intact, and staging survives a reopen
     /// the way scratch deliberately does not.
     #[test]

crates/pdfs-core/src/config.rs

@@ -3,7 +3,7 @@
 use std::path::{Path, PathBuf};
 
 use directories::ProjectDirs;
-use serde::{Deserialize, Serialize};
+use serde::{Deserialize, Deserializer, Serialize};
 
 use crate::error::{Error, Result};
 use crate::menu::PromptConfig;
@@ -12,8 +12,19 @@ use crate::syncignore::DEFAULT_IGNORE_PATTERNS;
 
 /// Proton requires `external-drive-{name}@{semver}-{channel}` (channel ∈
 /// stable/beta/alpha); a malformed value trips the 422 anti-abuse path.
-pub const APP_VERSION: &str = "external-drive-linux@0.1.0-alpha";
-pub const USER_AGENT: &str = "proton-drive-linux/0.1.0";
+/// Follows the release so Proton can tell releases apart and retire old ones
+/// without retiring every one.
+pub const APP_VERSION: &str = concat!(
+    "external-drive-linux@",
+    env!("CARGO_PKG_VERSION"),
+    "-stable"
+);
+pub const USER_AGENT: &str = concat!("proton-drive-linux/", env!("CARGO_PKG_VERSION"));
+
+/// The fixed identity every release up to 3.1.0 wrote into `config.json`. Read
+/// back as "unset" so those configs follow the release instead of pinning it.
+const LEGACY_APP_VERSION: &str = "external-drive-linux@0.1.0-alpha";
+const LEGACY_USER_AGENT: &str = "proton-drive-linux/0.1.0";
 
 /// Keyring service name; one entry per credential kind keyed by username.
 pub const KEYRING_SERVICE: &str = "proton-drive-linux";
@@ -76,10 +87,24 @@ fn resolve_sweep_mode(env: Option<&str>, stored: Option<SweepMode>) -> SweepMode
 }
 
 /// Configuration structure allowing the user to customize client identification headers.
-#[derive(Serialize, Deserialize, Debug, Clone)]
+#[derive(Serialize, Deserialize, Debug, Clone, Default)]
 pub struct AppConfig {
-    pub app_version: String,
-    pub user_agent: String,
+    /// Override for [`APP_VERSION`]. `None` means "use the release's own";
+    /// the old fixed default reads as `None`, so it leaves the file on the
+    /// next save.
+    #[serde(
+        default,
+        deserialize_with = "identity_override",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub app_version: Option<String>,
+    /// Override for [`USER_AGENT`], handled like `app_version`.
+    #[serde(
+        default,
+        deserialize_with = "identity_override",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub user_agent: Option<String>,
     /// Soft cap on the on-disk content cache, in bytes (`0` = unlimited).
     /// `None` means "use [`DEFAULT_CACHE_BUDGET_BYTES`]"; the Settings page
     /// writes an explicit value here. Defaulted for configs predating the field.
@@ -138,6 +163,10 @@ pub struct AppConfig {
     /// Defaulted for configs predating the field.
     #[serde(default)]
     pub files_view: FilesView,
+    /// The desktop app's main window size, remembered between runs. Defaulted
+    /// for configs predating the field.
+    #[serde(default)]
+    pub window: WindowState,
     /// The user hid the tray icon from its own menu. The tray exits at start
     /// while this is set, and the app does not spawn it; Preferences turns it
     /// back on. Defaulted for configs predating the field.
@@ -154,6 +183,31 @@ pub struct AppConfig {
     /// configs predating the field.
     #[serde(default)]
     pub online_map: bool,
+    /// Record a new folder, a new file, a rename or a delete through the mount
+    /// locally and send it from the queue, instead of waiting for Drive in the
+    /// syscall. `None` means on. `false` brings back the old path for one
+    /// release (docs/ROADMAP.md). Defaulted for configs predating
+    /// the field.
+    #[serde(default)]
+    pub local_first: Option<bool>,
+    /// Ask GitHub once a day whether a newer release is out, and say so in the
+    /// desktop app. Off by default: GitHub then sees the address and version
+    /// asking. Never used where a package manager installs updates (see
+    /// [`crate::update::updates_managed`]). Defaulted for configs predating the
+    /// field.
+    #[serde(default)]
+    pub update_check: bool,
+    /// When the update check last asked GitHub, in Unix seconds, so a restart
+    /// does not ask again within [`crate::update::CHECK_INTERVAL`]. Defaulted
+    /// for configs predating the field.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub update_last_checked: Option<i64>,
+    /// The latest release that check found, such as `3.6.0`, so the app can
+    /// say so again after a restart without asking. Older than or equal to the
+    /// running version once the update is installed. Defaulted for configs
+    /// predating the field.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub update_latest: Option<String>,
 }
 
 /// The My Files page's view choices, remembered between runs.
@@ -179,6 +233,44 @@ impl Default for FilesView {
     }
 }
 
+/// The desktop app's main window, as it was when it last closed.
+#[derive(Serialize, Deserialize, Debug, Clone, Copy, PartialEq, Eq)]
+#[serde(default)]
+pub struct WindowState {
+    /// The unmaximised size, in logical pixels.
+    pub width: i32,
+    pub height: i32,
+    pub maximized: bool,
+}
+
+impl WindowState {
+    /// Below this the saved size is taken for damage and the default is used.
+    pub const MIN_WIDTH: i32 = 480;
+    pub const MIN_HEIGHT: i32 = 400;
+
+    /// This state, with a size too small to use replaced by the default.
+    pub fn usable(self) -> Self {
+        if self.width < Self::MIN_WIDTH || self.height < Self::MIN_HEIGHT {
+            Self {
+                maximized: self.maximized,
+                ..Self::default()
+            }
+        } else {
+            self
+        }
+    }
+}
+
+impl Default for WindowState {
+    fn default() -> Self {
+        Self {
+            width: 980,
+            height: 680,
+            maximized: false,
+        }
+    }
+}
+
 /// The key a My Files listing is ordered by.
 #[derive(Serialize, Deserialize, Debug, Clone, Copy, PartialEq, Eq, Default)]
 #[serde(rename_all = "lowercase")]
@@ -209,30 +301,28 @@ impl FileSort {
     }
 }
 
-impl Default for AppConfig {
-    fn default() -> Self {
-        Self {
-            app_version: APP_VERSION.to_string(),
-            user_agent: USER_AGENT.to_string(),
-            cache_budget: None,
-            upload_limit: None,
-            download_limit: None,
-            mountpoint: None,
-            ignore_patterns: None,
-            device_uid: None,
-            conflict_sweep: None,
-            open_with: None,
-            prompt: None,
-            proton_theme: None,
-            files_view: FilesView::default(),
-            tray_hidden: false,
-            language: None,
-            online_map: false,
-        }
-    }
+/// Reads an `app_version` or `user_agent` override, dropping the fixed
+/// identity older releases stored as the default.
+fn identity_override<'de, D: Deserializer<'de>>(
+    deserializer: D,
+) -> std::result::Result<Option<String>, D::Error> {
+    let value = Option::<String>::deserialize(deserializer)?;
+    Ok(value.filter(|v| v != LEGACY_APP_VERSION && v != LEGACY_USER_AGENT))
 }
 
 impl AppConfig {
+    /// The `x-pm-appversion` sent to Proton: the user's override, or
+    /// [`APP_VERSION`].
+    pub fn resolved_app_version(&self) -> &str {
+        self.app_version.as_deref().unwrap_or(APP_VERSION)
+    }
+
+    /// The `User-Agent` sent to Proton: the user's override, or
+    /// [`USER_AGENT`].
+    pub fn resolved_user_agent(&self) -> &str {
+        self.user_agent.as_deref().unwrap_or(USER_AGENT)
+    }
+
     /// The effective cache budget in bytes: the user's explicit choice, or
     /// [`DEFAULT_CACHE_BUDGET_BYTES`] when unset.
     pub fn resolved_cache_budget(&self) -> u64 {
@@ -280,6 +370,22 @@ impl AppConfig {
     }
 }
 
+/// Fail when the config file at `path` exists but does not parse, so that
+/// [`AppDirs::save_config`] never writes over settings it could not read.
+fn refuse_to_replace_unreadable(path: &Path) -> Result<()> {
+    match std::fs::read_to_string(path) {
+        Ok(content) => match serde_json::from_str::<AppConfig>(&content) {
+            Ok(_) => Ok(()),
+            Err(e) => Err(Error::Other(format!(
+                "{} cannot be read ({e}); fix it or move it aside before changing settings",
+                path.display()
+            ))),
+        },
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(()),
+        Err(e) => Err(e.into()),
+    }
+}
+
 /// Resolved XDG locations for state, cache, and the default mountpoint.
 pub struct AppDirs {
     dirs: ProjectDirs,
@@ -311,6 +417,7 @@ impl AppDirs {
                     // Preserve the original bytes for diagnosis/recovery.  In
                     // particular, never replace a truncated config with defaults
                     // and silently lose mount, device, or ignore settings.
+                    // `save_config` refuses to write over it for the same reason.
                     tracing::error!(path = %path.display(), error = %e, "config is unreadable; using in-memory defaults without overwriting it");
                     return AppConfig::default();
                 }
@@ -318,9 +425,8 @@ impl AppDirs {
         }
 
         let default_config = AppConfig::default();
-        if let Ok(content) = serde_json::to_string_pretty(&default_config) {
-            let _ = std::fs::create_dir_all(self.dirs.config_dir());
-            let _ = std::fs::write(&path, content);
+        if let Err(e) = self.save_config(&default_config) {
+            tracing::warn!(path = %path.display(), error = %e, "could not write the default config");
         }
         default_config
     }
@@ -328,8 +434,15 @@ impl AppDirs {
     /// Persist `config` to [`config_path`](Self::config_path), creating the
     /// config dir if missing. The Settings page calls this after editing the
     /// cache budget or mountpoint; the daemon re-reads the file on its next mount.
+    ///
+    /// Refuses while the file on disk does not parse. Every caller loads,
+    /// changes one field and saves, and [`load_config`](Self::load_config)
+    /// gives defaults for a file it cannot read, so the first change after
+    /// the file was damaged wrote defaults over the mountpoint, the device and
+    /// the ignore rules the user had (`docs/BUGS.md` B223).
     pub fn save_config(&self, config: &AppConfig) -> Result<()> {
         let path = self.config_path();
+        refuse_to_replace_unreadable(&path)?;
         let parent = path
             .parent()
             .ok_or_else(|| Error::Other("configuration path has no parent".into()))?;
@@ -353,6 +466,46 @@ impl AppDirs {
         Ok(())
     }
 
+    /// This machine's id (e.g. ~/.config/proton-drive-linux/machine-id). See
+    /// [`machine_id`](Self::machine_id).
+    pub fn machine_id_path(&self) -> PathBuf {
+        self.dirs.config_dir().join("machine-id")
+    }
+
+    /// A random id for this machine, made on first use and kept in
+    /// [`machine_id_path`](Self::machine_id_path).
+    ///
+    /// It names this machine's profile in a device it may share with other
+    /// computers. Random rather than `/etc/machine-id`, so nothing that
+    /// identifies the host goes to Drive. In a file of its own rather than
+    /// `config.json`, because the app saves the config from a copy it loaded
+    /// earlier, and that would drop an id the daemon had just added.
+    pub fn machine_id(&self) -> Result<String> {
+        let path = self.machine_id_path();
+        match std::fs::read_to_string(&path) {
+            Ok(id) if is_machine_id(id.trim()) => return Ok(id.trim().to_string()),
+            Ok(_) => {
+                tracing::warn!(path = %path.display(), "machine id is unusable; making a new one");
+            }
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+            Err(e) => return Err(e.into()),
+        }
+        let mut bytes = [0u8; 16];
+        use std::io::Read as _;
+        std::fs::File::open("/dev/urandom")?.read_exact(&mut bytes)?;
+        let id: String = bytes.iter().map(|b| format!("{b:02x}")).collect();
+        let parent = path
+            .parent()
+            .ok_or_else(|| Error::Other("machine id path has no parent".into()))?;
+        std::fs::create_dir_all(parent)?;
+        let tmp = path.with_extension(format!("tmp-{}", std::process::id()));
+        std::fs::write(&tmp, format!("{id}\n"))?;
+        std::fs::File::open(&tmp)?.sync_all()?;
+        std::fs::rename(&tmp, &path)?;
+        std::fs::File::open(parent)?.sync_all()?;
+        Ok(id)
+    }
+
     /// Persistent state: inode map / cache index DB lives here.
     pub fn state_dir(&self) -> PathBuf {
         // `state_dir` is Linux-only in `directories`; fall back to data dir.
@@ -424,7 +577,7 @@ impl AppDirs {
     /// typical umask makes them `0755`. Until this was fixed, the only thing
     /// keeping another local user out was `~/.cache` and `~/.local/state`
     /// happening to be `0700`, which is a convention of the user's system and
-    /// not something this client established (bugs.md B6).
+    /// not something this client established (`docs/BUGS.md` B6).
     ///
     /// Applied on every start, not just at creation: a directory that already
     /// exists with a permissive mode — restored from a backup that flattened
@@ -441,6 +594,12 @@ impl AppDirs {
     }
 }
 
+/// Whether `id` is what [`AppDirs::machine_id`] writes: 32 lowercase hex
+/// digits.
+fn is_machine_id(id: &str) -> bool {
+    id.len() == 32 && id.bytes().all(|b| matches!(b, b'0'..=b'9' | b'a'..=b'f'))
+}
+
 /// Make `dir` owner-only (`0700`). These directories contain decrypted bytes,
 /// plaintext names, and an authenticated control socket, so failure is fatal.
 fn restrict_dir(dir: &Path) -> Result<()> {
@@ -475,7 +634,7 @@ fn restrict_dir(dir: &Path) -> Result<()> {
 /// session — enumerate, read, upload, trash, share — without presenting any
 /// credential, since the daemon already holds one. It is an authority boundary,
 /// not merely private data, and `UnixListener::bind` applies the umask like any
-/// other file (bugs.md B6).
+/// other file (`docs/BUGS.md` B6).
 ///
 /// There is a window between `bind` and this call during which the socket
 /// carries the umask's mode. It is closed in practice by the containing
@@ -496,7 +655,29 @@ mod tests {
         std::fs::metadata(p).unwrap().permissions().mode() & 0o777
     }
 
-    /// bugs.md B6. A permissive mode here is not a cosmetic problem: these
+    /// A damaged config must not be replaced by defaults the next time a
+    /// setting changes (`docs/BUGS.md` B223).
+    #[test]
+    fn an_unreadable_config_is_never_written_over() {
+        let dir = std::env::temp_dir().join(format!(
+            "pdfs-cfg-guard-{}-{:?}",
+            std::process::id(),
+            std::thread::current().id()
+        ));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("config.json");
+
+        assert!(refuse_to_replace_unreadable(&path).is_ok(), "no file yet");
+        std::fs::write(&path, serde_json::to_vec(&AppConfig::default()).unwrap()).unwrap();
+        assert!(refuse_to_replace_unreadable(&path).is_ok());
+        std::fs::write(&path, br#"{"mountpoint": "/home/me/Pro"#).unwrap();
+        assert!(refuse_to_replace_unreadable(&path).is_err(), "truncated");
+
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// `docs/BUGS.md` B6. A permissive mode here is not a cosmetic problem: these
     /// directories hold decrypted content, a plaintext index of every node name,
     /// and the control socket that commands the daemon's session.
     #[test]
@@ -563,8 +744,8 @@ mod tests {
     #[test]
     fn test_app_config_serialization() {
         let config = AppConfig {
-            app_version: "external-drive-test-client@1.0.0".to_string(),
-            user_agent: "test-agent/1.0".to_string(),
+            app_version: Some("external-drive-test-client@1.0.0".to_string()),
+            user_agent: Some("test-agent/1.0".to_string()),
             cache_budget: Some(1234),
             upload_limit: Some(500_000),
             download_limit: None,
@@ -581,21 +762,69 @@ mod tests {
                 descending: true,
                 folders_first: false,
             },
+            window: WindowState {
+                width: 1200,
+                height: 800,
+                maximized: true,
+            },
             tray_hidden: true,
             language: Some("de".to_string()),
             online_map: true,
+            local_first: Some(false),
+            update_check: true,
+            update_last_checked: Some(1_760_000_000),
+            update_latest: Some("3.6.0".to_string()),
         };
         let json = serde_json::to_string(&config).unwrap();
         let decoded: AppConfig = serde_json::from_str(&json).unwrap();
-        assert_eq!(decoded.app_version, "external-drive-test-client@1.0.0");
-        assert_eq!(decoded.user_agent, "test-agent/1.0");
+        assert_eq!(
+            decoded.resolved_app_version(),
+            "external-drive-test-client@1.0.0"
+        );
+        assert_eq!(decoded.resolved_user_agent(), "test-agent/1.0");
         assert_eq!(decoded.proton_theme, Some(true));
         assert!(decoded.tray_hidden);
         assert!(decoded.online_map);
+        assert!(decoded.update_check);
+        assert_eq!(decoded.update_last_checked, Some(1_760_000_000));
+        assert_eq!(decoded.update_latest.as_deref(), Some("3.6.0"));
         assert_eq!(decoded.language.as_deref(), Some("de"));
         assert_eq!(decoded.upload_limit, Some(500_000));
         assert_eq!(decoded.download_limit, None);
         assert_eq!(decoded.files_view, config.files_view);
+        assert_eq!(decoded.window, config.window);
+    }
+
+    #[test]
+    fn a_config_without_a_window_opens_at_the_default_size() {
+        let decoded: AppConfig =
+            serde_json::from_str(r#"{"app_version":"a","user_agent":"b"}"#).unwrap();
+        assert_eq!(decoded.window, WindowState::default());
+        let partial: WindowState = serde_json::from_str(r#"{"maximized":true}"#).unwrap();
+        assert_eq!((partial.width, partial.height), (980, 680));
+        assert!(partial.maximized);
+    }
+
+    #[test]
+    fn a_window_saved_too_small_opens_at_the_default_size() {
+        let tiny = WindowState {
+            width: 0,
+            height: 500,
+            maximized: true,
+        };
+        assert_eq!(
+            tiny.usable(),
+            WindowState {
+                maximized: true,
+                ..WindowState::default()
+            }
+        );
+        let fine = WindowState {
+            width: 640,
+            height: 480,
+            maximized: false,
+        };
+        assert_eq!(fine.usable(), fine);
     }
 
     #[test]
@@ -619,8 +848,55 @@ mod tests {
     #[test]
     fn test_default_app_config() {
         let default_config = AppConfig::default();
-        assert_eq!(default_config.app_version, APP_VERSION);
-        assert_eq!(default_config.user_agent, USER_AGENT);
+        assert_eq!(default_config.resolved_app_version(), APP_VERSION);
+        assert_eq!(default_config.resolved_user_agent(), USER_AGENT);
+    }
+
+    #[test]
+    fn the_client_identity_follows_the_release() {
+        let version = env!("CARGO_PKG_VERSION");
+        assert_eq!(
+            APP_VERSION,
+            format!("external-drive-linux@{version}-stable")
+        );
+        assert_eq!(USER_AGENT, format!("proton-drive-linux/{version}"));
+    }
+
+    #[test]
+    fn an_old_config_with_the_fixed_identity_follows_the_release() {
+        // Every config written up to 3.1.0 holds these two values, so they must
+        // not pin the identity once Proton retires 0.1.0.
+        let json = format!(
+            r#"{{"app_version":"{LEGACY_APP_VERSION}","user_agent":"{LEGACY_USER_AGENT}","tray_hidden":true}}"#
+        );
+        let decoded: AppConfig = serde_json::from_str(&json).unwrap();
+        assert_eq!(decoded.resolved_app_version(), APP_VERSION);
+        assert_eq!(decoded.resolved_user_agent(), USER_AGENT);
+        assert!(decoded.tray_hidden, "the rest of the config survives");
+
+        let saved = serde_json::to_string(&decoded).unwrap();
+        assert!(!saved.contains("app_version"), "{saved}");
+        assert!(!saved.contains("user_agent"), "{saved}");
+    }
+
+    #[test]
+    fn a_hand_set_client_identity_is_kept() {
+        let json = r#"{"app_version":"external-drive-linux@9.9.9-beta","user_agent":"custom/1"}"#;
+        let decoded: AppConfig = serde_json::from_str(json).unwrap();
+        assert_eq!(
+            decoded.resolved_app_version(),
+            "external-drive-linux@9.9.9-beta"
+        );
+        assert_eq!(decoded.resolved_user_agent(), "custom/1");
+        let saved = serde_json::to_string(&decoded).unwrap();
+        assert!(saved.contains("external-drive-linux@9.9.9-beta"), "{saved}");
+    }
+
+    #[test]
+    fn a_config_without_a_client_identity_loads() {
+        let decoded: AppConfig = serde_json::from_str("{}").unwrap();
+        assert_eq!(decoded.resolved_app_version(), APP_VERSION);
+        assert_eq!(decoded.resolved_user_agent(), USER_AGENT);
     }
 
     #[test]
@@ -679,6 +955,15 @@ mod tests {
         assert_eq!(decoded.conflict_sweep, Some(SweepMode::Enforce));
     }
 
+    #[test]
+    fn a_machine_id_is_32_lowercase_hex_digits() {
+        assert!(is_machine_id("0123456789abcdef0123456789abcdef"));
+        assert!(!is_machine_id("0123456789ABCDEF0123456789ABCDEF"));
+        assert!(!is_machine_id("0123456789abcdef"));
+        assert!(!is_machine_id("../../../../etc/passwd/0123456789"));
+        assert!(!is_machine_id(""));
+    }
+
     #[test]
     fn a_config_predating_ignore_patterns_still_loads() {
         // Every installed config on disk looks like this; the field must not be

crates/pdfs-core/src/control.rs

@@ -344,6 +344,17 @@ pub enum Request {
     /// or a mirror synced folder), and the move is still made on Proton Drive
     /// without transferring content. Replies with [`Response::Ok`].
     Move { path: String, new_parent: String },
+    /// Copy a file or folder into a folder on Proton Drive, without
+    /// downloading or uploading it. Both `path` and `new_parent` are
+    /// mountpoint-relative, or absolute paths inside My files. A name already
+    /// taken in `new_parent` gets the next free ` (n)` suffix. Replies with
+    /// [`Response::Ok`].
+    Copy { path: String, new_parent: String },
+    /// Ask Proton Drive how much the folder at mountpoint-relative `path`
+    /// holds. Replies with [`Response::FolderSize`].
+    FolderSize { path: String },
+    /// The by-uid twin of [`Request::FolderSize`].
+    FolderSizeByUid { uid: String },
     /// Trash a file or folder. `path` is mountpoint-relative. Replies with
     /// [`Response::Ok`].
     Delete { path: String },
@@ -443,11 +454,18 @@ pub enum Request {
     DeleteDevice { uid: String },
     /// Adopt an existing device as this machine's, pinning its uid in
     /// `config.json` so a hostname change or reinstall re-attaches to it instead
-    /// of registering a duplicate (features.md 5.1). `uid: None` clears the pin.
+    /// of registering a duplicate. `uid: None` clears the pin.
     /// Replies with [`Response::Ok`].
     AdoptDevice { uid: Option<String> },
+    /// Move every folder another device backs up into this machine's own
+    /// device, as server-side moves on the main volume. The other device stays
+    /// registered, without those folders. Sync folders here that already track
+    /// one of them follow it to its new share. Nothing is downloaded: the moved
+    /// folders are then offered by [`Request::ListRestorableFolders`].
+    /// Replies with [`Response::Ok`].
+    MigrateDevice { uid: String },
 
-    // ---- device folder sync (devices.md) ----------------------------------
+    // ---- device folder sync ----------------------------------
     /// Add a local folder to this machine's device, uploading its tree and
     /// registering the device on first use. Replies with [`Response::Ok`].
     AddSyncFolder { local_path: String },
@@ -462,6 +480,11 @@ pub enum Request {
     /// Pause or resume one mirror folder's reconcile, independent of the
     /// global pause. Persisted until resumed. Replies with [`Response::Ok`].
     SetSyncFolderPaused { id: i64, paused: bool },
+    /// Forget what a mirror folder synced before, so its next pass compares
+    /// both sides afresh: what is on one side only is copied to the other, and
+    /// a file that differs keeps both versions. Nothing is deleted. Replies
+    /// with [`Response::Ok`].
+    ResetSyncFolder { id: i64 },
     /// Force a reconcile pass: one folder by id, or all when `id` is `None`.
     /// Replies with [`Response::Ok`].
     SyncNow { id: Option<i64> },
@@ -477,6 +500,15 @@ pub enum Request {
     /// Retry a backed-off queued op now instead of waiting out its backoff;
     /// every failed op when `id` is `None`. Replies with [`Response::Ok`].
     RetryPendingOp { id: Option<i64> },
+    /// Copy the content of a queued upload (`id` from
+    /// [`Request::ListPendingOps`]) to `dest`, an absolute path that must not
+    /// exist yet. The op stays queued. Replies with [`Response::Ok`].
+    ExportPendingOp { id: i64, dest: String },
+    /// Drop a queued change (`id` from [`Request::ListPendingOps`]) and undo
+    /// it locally: a node made here goes, a node Drive has goes back to what
+    /// Drive has, along with every other change queued on it. Its content is
+    /// lost unless it was exported first. Replies with [`Response::Ok`].
+    DiscardPendingOp { id: i64 },
     /// List the `(sync-conflict …)` copies under My Files and in synced
     /// folders. Replies with
     /// [`Response::Conflicts`].
@@ -487,7 +519,7 @@ pub enum Request {
     /// [`Response::Ok`].
     ResolveConflict { path: String, keep: ConflictKeep },
     /// List the folders under this machine's device that can be synced here,
-    /// each with a proposed local path (features.md 5.2). Replies with
+    /// each with a proposed local path. Replies with
     /// [`Response::RestorableFolders`].
     ListRestorableFolders,
     /// Attach the given remote device folders to local paths and sync them down.
@@ -580,6 +612,24 @@ pub enum Request {
     RemovePublicLink { path: String, id: String },
     /// The by-uid twin of [`Request::RemovePublicLink`].
     RemovePublicLinkByUid { uid: String, id: String },
+    /// Change the public link `id` on the node at `path`, keeping its URL.
+    /// `role` is "viewer" or "editor", or `None` to keep the current one.
+    /// Replies with [`Response::PublicLink`].
+    UpdatePublicLink {
+        path: String,
+        id: String,
+        role: Option<String>,
+        password: LinkChange<String>,
+        expires: LinkChange<i64>,
+    },
+    /// The by-uid twin of [`Request::UpdatePublicLink`].
+    UpdatePublicLinkByUid {
+        uid: String,
+        id: String,
+        role: Option<String>,
+        password: LinkChange<String>,
+        expires: LinkChange<i64>,
+    },
     /// Stop sharing the node at `path`: remove its public link, every pending
     /// invitation and every member. Each removal is attempted even if an
     /// earlier one fails. Replies with [`Response::Ok`], or an error naming
@@ -880,6 +930,59 @@ pub struct PendingOpInfo {
     pub parked: bool,
     /// Failed often enough to count as stuck.
     pub failing: bool,
+    /// Why Drive refused it, when it did; such an op needs attention at once.
+    #[serde(default)]
+    pub issue: Option<SyncIssue>,
+    /// Carries file content that [`Request::ExportPendingOp`] can save.
+    #[serde(default)]
+    pub exportable: bool,
+}
+
+/// Why Drive refused a queued change (in [`PendingOpInfo`]). The change stays
+/// queued and keeps being retried; nothing is deleted.
+#[derive(Serialize, Deserialize, Debug, Clone, Copy, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum SyncIssue {
+    /// The account's storage is full.
+    Quota,
+    /// The account may no longer change the file or its folder, for example
+    /// because a share was revoked.
+    Access,
+    /// The file or the folder it goes into is gone from Drive.
+    Missing,
+    /// The folder holds too many items, or is nested too deep.
+    Limit,
+    /// Drive rejected the change, for example a name it does not accept.
+    Rejected,
+    /// An issue from a newer daemon.
+    #[serde(other)]
+    Unknown,
+}
+
+impl SyncIssue {
+    /// The name stored in the database and sent on the wire.
+    pub fn as_str(self) -> &'static str {
+        match self {
+            SyncIssue::Quota => "quota",
+            SyncIssue::Access => "access",
+            SyncIssue::Missing => "missing",
+            SyncIssue::Limit => "limit",
+            SyncIssue::Rejected => "rejected",
+            SyncIssue::Unknown => "unknown",
+        }
+    }
+
+    /// The issue stored as `name`.
+    pub fn parse(name: &str) -> Self {
+        match name {
+            "quota" => SyncIssue::Quota,
+            "access" => SyncIssue::Access,
+            "missing" => SyncIssue::Missing,
+            "limit" => SyncIssue::Limit,
+            "rejected" => SyncIssue::Rejected,
+            _ => SyncIssue::Unknown,
+        }
+    }
 }
 
 /// One synced local folder on this machine's device (in [`Response::SyncFolders`]).
@@ -1006,6 +1109,18 @@ pub struct PublicLinkInfo {
     pub created: i64,
 }
 
+/// What [`Request::UpdatePublicLink`] does with one option of a link: its
+/// custom password or its expiry.
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq)]
+pub enum LinkChange<T> {
+    /// Leave the option as it is.
+    Keep,
+    /// Remove the option: no custom password, or no expiry.
+    Remove,
+    /// Set the option to this value.
+    Set(T),
+}
+
 /// One invitation addressed to me (in [`Response::Invitations`]).
 #[derive(Serialize, Deserialize, Debug, Clone)]
 pub struct InvitationInfo {
@@ -1100,6 +1215,7 @@ pub enum ActivityKind {
     Sync,
     Rename,
     Move,
+    Copy,
     CreateFolder,
     Trash,
     Restore,
@@ -1156,6 +1272,12 @@ pub struct JobItem {
     /// Steps known to need doing, or `0` when unknown (indeterminate progress).
     /// May *grow* mid-job as more work is discovered.
     pub total: u64,
+    /// Housekeeping that changes nothing in the user's files: a mirror folder
+    /// scan that finds nothing to do yet, an index rebuild, a cache check. Front
+    /// ends may show it, but should not report the drive as busy over it. Absent
+    /// from older daemons, which never set it.
+    #[serde(default)]
+    pub background: bool,
 }
 
 /// One in-flight transfer in a [`Response::Transfers`] snapshot.
@@ -1185,8 +1307,15 @@ pub struct DirEntry {
     pub size: u64,
     /// Modification time, epoch seconds.
     pub modified: i64,
-    /// Whether the file is pinned to this device.
+    /// Whether the node is pinned to this device, on its own or through a
+    /// pinned folder above it.
     pub pinned: bool,
+    /// Whether the node is kept on this device because a folder above it is
+    /// pinned. Such a node cannot be unpinned on its own. Set in
+    /// [`Request::ListDir`] listings only. Defaulted for wire-compat with
+    /// daemons predating the field.
+    #[serde(default)]
+    pub pinned_by_folder: bool,
     /// Whether the file's full content is present in the local cache (a current,
     /// non-stale blob). Always false for folders. Defaulted for wire-compat with
     /// clients/daemons predating the field.
@@ -1234,6 +1363,10 @@ pub struct DirEntry {
     /// not known, and for anything not in the trash.
     #[serde(default)]
     pub trashed_from: Option<String>,
+    /// Why Drive refused a change queued on the node, for a [`Request::ListDir`]
+    /// entry; `None` otherwise.
+    #[serde(default)]
+    pub issue: Option<SyncIssue>,
 }
 
 /// One hit in a [`Request::Search`] result. Like [`DirEntry`] but carries the
@@ -1505,6 +1638,10 @@ pub struct RedateSummary {
     /// name implies)` — what a dry run is read for.
     #[serde(default)]
     pub samples: Vec<(String, i64, i64)>,
+    /// Why the run as a whole failed, when it did. The counts are then
+    /// empty: the run never got to the photos.
+    #[serde(default)]
+    pub error: Option<String>,
 }
 
 /// How a Google Photos Takeout import is going, or how the last one ended
@@ -1534,6 +1671,10 @@ pub struct ImportSummary {
     pub bytes: u64,
     /// True when the run stopped early because it was cancelled.
     pub cancelled: bool,
+    /// Why the run as a whole failed, when it did, such as an archive that
+    /// is not a zip. The counts are then empty.
+    #[serde(default)]
+    pub error: Option<String>,
 }
 
 /// One album in a [`Response::Albums`] listing.
@@ -1771,6 +1912,27 @@ pub fn pending_summary(uploads: u64, changes: u64) -> Option<String> {
     }
 }
 
+/// Whether the daemon that reported `version` in a [`Response::Status`] is an
+/// older release than this build. Installing a package replaces the binaries
+/// but leaves the running user service on the old one, which keeps its bugs
+/// until it restarts, while the app and the CLI already describe the new
+/// release (#33). Empty means a daemon from before the field, so older too.
+///
+/// Only older counts. A newer daemon means this front-end is the one still
+/// running from before the upgrade, and restarting the service would not help.
+pub fn daemon_outdated(version: &str) -> bool {
+    fn parse(v: &str) -> Option<(u64, u64, u64)> {
+        let mut parts = v.split('.').map(|p| p.parse().ok());
+        let parsed = (parts.next()??, parts.next()??, parts.next()??);
+        parts.next().is_none().then_some(parsed)
+    }
+    match (parse(version), parse(env!("CARGO_PKG_VERSION"))) {
+        (Some(running), Some(this)) => running < this,
+        (None, _) => version.is_empty(),
+        (Some(_), None) => false,
+    }
+}
+
 /// One worker thread in a [`Diagnostics`] report.
 #[derive(Serialize, Deserialize, Debug, Clone)]
 pub struct WorkerState {
@@ -1837,17 +1999,17 @@ pub enum Response {
         /// The pin registry.
         pins: Vec<Pin>,
         /// False when the daemon is serving the cached tree because the API is
-        /// unreachable (offline.md Phase 1). Cached and pinned content still
+        /// unreachable. Cached and pinned content still
         /// reads; anything else fails until the network is back.
         #[serde(default = "default_online")]
         online: bool,
-        /// Writes accepted locally but not yet uploaded (offline.md Phase 3).
+        /// Writes accepted locally but not yet uploaded.
         /// Non-zero means the mount is ahead of the remote — either a copy is
         /// still draining, or it cannot drain because we are offline.
         #[serde(default)]
         pending_uploads: u64,
-        /// Queued mutations that carry no bytes: `mkdir`, `rename`, `trash`
-        /// (offline.md Phase 3b). Counted apart from `pending_uploads` because
+        /// Queued mutations that carry no bytes: `mkdir`, `rename`, `trash`.
+        /// Counted apart from `pending_uploads` because
         /// calling a queued `mkdir` an upload is a lie.
         #[serde(default)]
         pending_changes: u64,
@@ -1880,6 +2042,21 @@ pub enum Response {
         /// resumed, or not paused.
         #[serde(default)]
         paused_until: Option<i64>,
+        /// True when Proton refused the session itself (refresh token refused,
+        /// account deleted or disabled). `online` is false then too, but no
+        /// connection brings it back: only signing in again does.
+        #[serde(default)]
+        session_expired: bool,
+        /// True while the keyring refuses the session's refreshed tokens. The
+        /// daemon keeps retrying; until it succeeds, a reboot signs the user
+        /// out.
+        #[serde(default)]
+        tokens_unsaved: bool,
+        /// The release of the daemon that answered. A package upgrade does not
+        /// restart the user service, so it can be older than the front-end
+        /// asking; daemons before 3.3.0 omit it, which reads as empty.
+        #[serde(default)]
+        version: String,
     },
     /// A human-readable success message.
     Ok { message: String },
@@ -2055,9 +2232,14 @@ pub enum Response {
         entries: Vec<ShareEntry>,
         link: Option<PublicLinkInfo>,
     },
-    /// A freshly created public link, carrying the shareable URL (reply to
-    /// [`Request::CreatePublicLink`]).
+    /// A freshly created or changed public link, carrying the shareable URL
+    /// (reply to [`Request::CreatePublicLink`] and
+    /// [`Request::UpdatePublicLink`]).
     PublicLink { link: PublicLinkInfo },
+    /// What a folder holds on Proton Drive (reply to [`Request::FolderSize`]):
+    /// the bytes on storage and the number of items below it, folders and
+    /// trashed items included.
+    FolderSize { size: u64, items: u64 },
     /// Invitations addressed to me (reply to [`Request::ListInvitations`]).
     Invitations { items: Vec<InvitationInfo> },
     /// Saved public links (reply to [`Request::ListBookmarks`]).
@@ -2523,6 +2705,27 @@ mod tests {
         );
     }
 
+    /// #33: a daemon left running over an upgrade is named as older, also when
+    /// it predates the version field, but a newer one is not, since restarting
+    /// the service cannot bring it closer to this build.
+    #[test]
+    fn only_an_older_daemon_is_outdated() {
+        assert!(!daemon_outdated(env!("CARGO_PKG_VERSION")));
+        assert!(daemon_outdated(""));
+        assert!(daemon_outdated("0.9.9"));
+        assert!(!daemon_outdated("999.0.0"));
+        assert!(!daemon_outdated("not-a-version"));
+        let old: Response = serde_json::from_str(
+            r#"{"Status":{"username":"u","mountpoint":"/m","pinned":0,
+                "used":0,"budget":0,"pins":[]}}"#,
+        )
+        .unwrap();
+        let Response::Status { version, .. } = old else {
+            panic!("not a status: {old:?}");
+        };
+        assert!(daemon_outdated(&version));
+    }
+
     /// The mutation requests must survive a line-delimited JSON round-trip, since
     /// that is exactly how they cross the control socket.
     #[test]
@@ -2536,6 +2739,10 @@ mod tests {
                 path: "a/b.txt".into(),
                 new_parent: "d".into(),
             },
+            Request::Copy {
+                path: "a/b.txt".into(),
+                new_parent: "d".into(),
+            },
             Request::Delete {
                 path: "a/b.txt".into(),
             },
@@ -3007,6 +3214,7 @@ mod tests {
                 id: 3,
                 paused: true,
             },
+            Request::ResetSyncFolder { id: 3 },
             Request::SetBandwidthLimits {
                 upload: 1_000_000,
                 download: 0,
@@ -3016,6 +3224,9 @@ mod tests {
                 uid: Some("dev-1".into()),
             },
             Request::AdoptDevice { uid: None },
+            Request::MigrateDevice {
+                uid: "dev-2".into(),
+            },
             Request::ListRestorableFolders,
             Request::RestoreSyncFolders {
                 items: vec![RestoreItem {
@@ -3093,6 +3304,24 @@ mod tests {
                 uid: "vol~link".into(),
                 id: "url-1".into(),
             },
+            Request::UpdatePublicLink {
+                path: "a/b".into(),
+                id: "url-1".into(),
+                role: Some("editor".into()),
+                password: LinkChange::Set("pw".into()),
+                expires: LinkChange::Remove,
+            },
+            Request::UpdatePublicLinkByUid {
+                uid: "vol~link".into(),
+                id: "url-1".into(),
+                role: None,
+                password: LinkChange::Keep,
+                expires: LinkChange::Set(1_700_000_000),
+            },
+            Request::FolderSize { path: "a".into() },
+            Request::FolderSizeByUid {
+                uid: "vol~link".into(),
+            },
             Request::ListSharedByMe,
             Request::ListActivity { limit: 100 },
             Request::ListSharedWithMe,
@@ -3290,6 +3519,17 @@ mod tests {
                 },
                 r#"{"SaveRevisionAsByUid":{"uid":"vol~link","revision_id":"rev-3","dest":"/tmp/out.bin"}}"#,
             ),
+            (
+                Request::ExportPendingOp {
+                    id: 7,
+                    dest: "/tmp/out.bin".into(),
+                },
+                r#"{"ExportPendingOp":{"id":7,"dest":"/tmp/out.bin"}}"#,
+            ),
+            (
+                Request::DiscardPendingOp { id: 7 },
+                r#"{"DiscardPendingOp":{"id":7}}"#,
+            ),
         ];
         for (request, wire) in cases {
             assert_eq!(serde_json::to_string(&request).unwrap(), wire);
@@ -3298,6 +3538,25 @@ mod tests {
         }
     }
 
+    /// A daemon that predates sync issues sends neither field, and a newer one
+    /// may send an issue this build does not know.
+    #[test]
+    fn a_queued_op_from_another_daemon_version_still_decodes() {
+        let old = r#"{"id":1,"kind":"create","path":"a.txt","attempts":0,"last_error":null,
+            "queued_at":5,"next_attempt_at":5,"parked":false,"failing":false}"#;
+        let op: PendingOpInfo = serde_json::from_str(old).unwrap();
+        assert_eq!(op.issue, None);
+        assert!(!op.exportable);
+
+        let newer = old.replace(r#""failing":false"#, r#""failing":true,"issue":"embargo""#);
+        let op: PendingOpInfo = serde_json::from_str(&newer).unwrap();
+        assert_eq!(op.issue, Some(SyncIssue::Unknown));
+        assert_eq!(
+            SyncIssue::parse(SyncIssue::Quota.as_str()),
+            SyncIssue::Quota
+        );
+    }
+
     /// A front-end that predates the favorites filter sends no `favorites`
     /// field, and must keep getting the whole timeline rather than an empty page.
     #[test]
@@ -3437,6 +3696,16 @@ mod tests {
                 },
                 "RemovePublicLinkByUid",
             ),
+            (
+                Request::UpdatePublicLinkByUid {
+                    uid: "vol~link".into(),
+                    id: "link".into(),
+                    role: None,
+                    password: LinkChange::Keep,
+                    expires: LinkChange::Keep,
+                },
+                "UpdatePublicLinkByUid",
+            ),
             (
                 Request::StopSharingByUid {
                     uid: "vol~link".into(),
@@ -3462,6 +3731,7 @@ mod tests {
                 | Request::RemoveShareEntryByUid { uid, .. }
                 | Request::CreatePublicLinkByUid { uid, .. }
                 | Request::RemovePublicLinkByUid { uid, .. }
+                | Request::UpdatePublicLinkByUid { uid, .. }
                 | Request::StopSharingByUid { uid } => uid,
                 other => panic!("decoded into the wrong dispatch variant: {other:?}"),
             };
@@ -3470,6 +3740,25 @@ mod tests {
         }
     }
 
+    #[test]
+    fn a_link_update_names_what_it_keeps_removes_and_sets() {
+        let request = Request::UpdatePublicLink {
+            path: "a/b".into(),
+            id: "url-1".into(),
+            role: None,
+            password: LinkChange::Keep,
+            expires: LinkChange::Set(1_700_000_000),
+        };
+        assert_eq!(
+            serde_json::to_string(&request).unwrap(),
+            r#"{"UpdatePublicLink":{"path":"a/b","id":"url-1","role":null,"password":"Keep","expires":{"Set":1700000000}}}"#
+        );
+        assert_eq!(
+            serde_json::to_string(&LinkChange::<String>::Remove).unwrap(),
+            r#""Remove""#
+        );
+    }
+
     #[test]
     fn open_file_accepts_a_request_from_a_client_predating_the_uid_field() {
         let legacy = r#"{"OpenFile":{"path":"Documents/ONBOARDING.md"}}"#;

crates/pdfs-core/src/db/fixtures/v2.8.2.sql

@@ -0,0 +1,249 @@
+/* WARNING: Script requires that SQLITE_DBCONFIG_DEFENSIVE be disabled */
+PRAGMA foreign_keys=OFF;
+BEGIN TRANSACTION;
+CREATE TABLE sync_state (key TEXT PRIMARY KEY, value TEXT);
+INSERT INTO sync_state VALUES('schema_version','35');
+CREATE TABLE nodes (
+  uid           TEXT PRIMARY KEY,
+  parent_uid    TEXT,
+  name          TEXT NOT NULL,
+  is_dir        INTEGER NOT NULL,
+  size          INTEGER,
+  mtime         INTEGER NOT NULL,
+  revision_hash TEXT,
+  trashed       INTEGER NOT NULL DEFAULT 0
+, node_json TEXT, listed INTEGER NOT NULL DEFAULT 0, path TEXT);
+INSERT INTO nodes VALUES('vol~root',NULL,'My Files',1,0,200,NULL,0,'{"uid":{"volume_id":"vol","link_id":"root"},"parent_uid":null,"kind":"Folder","name":"My Files","creation_time":100,"modification_time":200,"trashed":false,"is_shared":false,"is_shared_publicly":false,"signature_email":null,"membership":null,"direct_role":null,"share_id":null,"photo":null,"album":null,"verification":{"name":"NotSigned","passphrase":"NotSigned","content_key":null,"extended_attributes":null}}',0,'');
+INSERT INTO nodes VALUES('vol~docs','vol~root','Docs',1,0,200,NULL,0,'{"uid":{"volume_id":"vol","link_id":"docs"},"parent_uid":{"volume_id":"vol","link_id":"root"},"kind":"Folder","name":"Docs","creation_time":100,"modification_time":200,"trashed":false,"is_shared":false,"is_shared_publicly":false,"signature_email":null,"membership":null,"direct_role":null,"share_id":null,"photo":null,"album":null,"verification":{"name":"NotSigned","passphrase":"NotSigned","content_key":null,"extended_attributes":null}}',0,'Docs');
+INSERT INTO nodes VALUES('vol~report','vol~docs','report.txt',0,10,200,NULL,0,'{"uid":{"volume_id":"vol","link_id":"report"},"parent_uid":{"volume_id":"vol","link_id":"docs"},"kind":{"File":{"media_type":"text/plain","total_size_on_storage":20,"active_revision_state":null,"active_revision_id":null,"claimed_size":10,"claimed_modification_time":null,"content_sha1":null}},"name":"report.txt","creation_time":100,"modification_time":200,"trashed":false,"is_shared":false,"is_shared_publicly":false,"signature_email":null,"membership":null,"direct_role":null,"share_id":null,"photo":null,"album":null,"verification":{"name":"NotSigned","passphrase":"NotSigned","content_key":null,"extended_attributes":null}}',0,'Docs/report.txt');
+INSERT INTO nodes VALUES('vol~old','vol~docs','old.txt',0,3,200,NULL,0,'{"uid":{"volume_id":"vol","link_id":"old"},"parent_uid":{"volume_id":"vol","link_id":"docs"},"kind":{"File":{"media_type":"text/plain","total_size_on_storage":13,"active_revision_state":null,"active_revision_id":null,"claimed_size":3,"claimed_modification_time":null,"content_sha1":null}},"name":"old.txt","creation_time":100,"modification_time":200,"trashed":false,"is_shared":false,"is_shared_publicly":false,"signature_email":null,"membership":null,"direct_role":null,"share_id":null,"photo":null,"album":null,"verification":{"name":"NotSigned","passphrase":"NotSigned","content_key":null,"extended_attributes":null}}',0,'Docs/old.txt');
+INSERT INTO nodes VALUES('vol~shared','vol~docs','shared.txt',0,4,200,NULL,0,'{"uid":{"volume_id":"vol","link_id":"shared"},"parent_uid":{"volume_id":"vol","link_id":"docs"},"kind":{"File":{"media_type":"text/plain","total_size_on_storage":14,"active_revision_state":null,"active_revision_id":null,"claimed_size":4,"claimed_modification_time":null,"content_sha1":null}},"name":"shared.txt","creation_time":100,"modification_time":200,"trashed":false,"is_shared":false,"is_shared_publicly":false,"signature_email":null,"membership":null,"direct_role":null,"share_id":null,"photo":null,"album":null,"verification":{"name":"NotSigned","passphrase":"NotSigned","content_key":null,"extended_attributes":null}}',0,'Docs/shared.txt');
+INSERT INTO nodes VALUES('local~dir','vol~root','Offline folder',1,0,200,NULL,0,'{"uid":{"volume_id":"local","link_id":"dir"},"parent_uid":{"volume_id":"vol","link_id":"root"},"kind":"Folder","name":"Offline folder","creation_time":100,"modification_time":200,"trashed":false,"is_shared":false,"is_shared_publicly":false,"signature_email":null,"membership":null,"direct_role":null,"share_id":null,"photo":null,"album":null,"verification":{"name":"NotSigned","passphrase":"NotSigned","content_key":null,"extended_attributes":null}}',1,'Offline folder');
+INSERT INTO nodes VALUES('local~inner','local~dir','inner.txt',0,5,200,NULL,0,'{"uid":{"volume_id":"local","link_id":"inner"},"parent_uid":{"volume_id":"local","link_id":"dir"},"kind":{"File":{"media_type":"text/plain","total_size_on_storage":15,"active_revision_state":null,"active_revision_id":null,"claimed_size":5,"claimed_modification_time":null,"content_sha1":null}},"name":"inner.txt","creation_time":100,"modification_time":200,"trashed":false,"is_shared":false,"is_shared_publicly":false,"signature_email":null,"membership":null,"direct_role":null,"share_id":null,"photo":null,"album":null,"verification":{"name":"NotSigned","passphrase":"NotSigned","content_key":null,"extended_attributes":null}}',0,'Offline folder/inner.txt');
+INSERT INTO nodes VALUES('local~part','vol~root','movie.part',0,7,200,NULL,0,'{"uid":{"volume_id":"local","link_id":"part"},"parent_uid":{"volume_id":"vol","link_id":"root"},"kind":{"File":{"media_type":"text/plain","total_size_on_storage":17,"active_revision_state":null,"active_revision_id":null,"claimed_size":7,"claimed_modification_time":null,"content_sha1":null}},"name":"movie.part","creation_time":100,"modification_time":200,"trashed":false,"is_shared":false,"is_shared_publicly":false,"signature_email":null,"membership":null,"direct_role":null,"share_id":null,"photo":null,"album":null,"verification":{"name":"NotSigned","passphrase":"NotSigned","content_key":null,"extended_attributes":null}}',0,'movie.part');
+CREATE TABLE cache_entries (
+  cache_key     TEXT PRIMARY KEY,
+  size_bytes    INTEGER,
+  last_accessed INTEGER,
+  is_pinned     INTEGER NOT NULL DEFAULT 0
+, kind TEXT NOT NULL DEFAULT 'blob');
+CREATE TABLE pins (
+  uid       TEXT PRIMARY KEY,
+  path      TEXT NOT NULL,
+  recursive INTEGER NOT NULL DEFAULT 0
+);
+CREATE TABLE local_files (
+  id       INTEGER PRIMARY KEY,
+  path     TEXT NOT NULL UNIQUE,
+  name     TEXT NOT NULL,
+  is_dir   INTEGER NOT NULL,
+  size     INTEGER NOT NULL DEFAULT 0,
+  mtime    INTEGER NOT NULL DEFAULT 0,
+  scan_gen INTEGER NOT NULL DEFAULT 0
+);
+CREATE TABLE photos (
+  uid          TEXT PRIMARY KEY,
+  capture_time INTEGER NOT NULL,
+  name         TEXT,
+  ratio        REAL,
+  thumb_state  INTEGER NOT NULL DEFAULT 0,
+  seq          INTEGER NOT NULL
+, media_type TEXT, kind INTEGER NOT NULL DEFAULT 0, favorite INTEGER NOT NULL DEFAULT 0, content_hash TEXT, main_uid TEXT, group_key TEXT, resolved_at INTEGER, latitude REAL, longitude REAL, place_id INTEGER, similar_hash INTEGER);
+CREATE TABLE trash (
+  uid    TEXT PRIMARY KEY,
+  name   TEXT NOT NULL,
+  is_dir INTEGER NOT NULL,
+  size   INTEGER NOT NULL DEFAULT 0,
+  mtime  INTEGER NOT NULL DEFAULT 0
+, parent_uid TEXT, trashed_at INTEGER);
+CREATE TABLE device (
+  uid      TEXT PRIMARY KEY,
+  share_id TEXT NOT NULL,
+  root_uid TEXT NOT NULL,
+  name     TEXT NOT NULL,
+  created  INTEGER NOT NULL DEFAULT 0
+);
+CREATE TABLE sync_folder (
+  id              INTEGER PRIMARY KEY,
+  local_path      TEXT NOT NULL UNIQUE,
+  remote_uid      TEXT NOT NULL,
+  remote_share_id TEXT NOT NULL,
+  mode            TEXT NOT NULL DEFAULT 'mirror',
+  state           TEXT NOT NULL DEFAULT 'idle',
+  last_sync       INTEGER NOT NULL DEFAULT 0
+, pending_mode TEXT);
+CREATE TABLE sync_entry (
+  folder_id   INTEGER NOT NULL,
+  rel_path    TEXT NOT NULL,
+  remote_uid  TEXT,
+  local_mtime INTEGER NOT NULL DEFAULT 0,
+  local_size  INTEGER NOT NULL DEFAULT 0,
+  remote_hash TEXT,
+  remote_rev  TEXT, local_mtime_ns INTEGER,
+  PRIMARY KEY (folder_id, rel_path)
+);
+CREATE TABLE activity (
+  id     INTEGER PRIMARY KEY,
+  time   INTEGER NOT NULL,
+  kind   TEXT NOT NULL,
+  target TEXT NOT NULL,
+  detail TEXT NOT NULL DEFAULT '',
+  ok     INTEGER NOT NULL DEFAULT 1
+);
+CREATE TABLE pending_op (
+  id              INTEGER PRIMARY KEY,
+  kind            TEXT NOT NULL,
+  uid             TEXT NOT NULL,
+  blob_path       TEXT,
+  meta_json       TEXT,
+  created_at      INTEGER NOT NULL,
+  attempts        INTEGER NOT NULL DEFAULT 0,
+  last_error      TEXT,
+  next_attempt_at INTEGER NOT NULL DEFAULT 0
+, parent_uid TEXT, name TEXT, claimed_at INTEGER NOT NULL DEFAULT 0, access_deferred_since INTEGER NOT NULL DEFAULT 0);
+INSERT INTO pending_op VALUES(1,'mkdir','local~dir',NULL,NULL,1700000000000,0,NULL,0,'vol~root','Offline folder',4611686018427387903,0);
+INSERT INTO pending_op VALUES(2,'create','local~inner','/blobs/inner','{"len":5,"mtime":1700000000,"based_on":null}',1700000000000,0,NULL,0,'local~dir','inner.txt',0,0);
+INSERT INTO pending_op VALUES(3,'create','local~part','/blobs/part','{"len":5,"mtime":1700000000,"based_on":null}',1700000000000,0,NULL,8000000000000,'vol~root','movie.part',0,0);
+INSERT INTO pending_op VALUES(4,'revision','vol~report','/blobs/report','{"len":5,"mtime":1700000000,"based_on":null}',1700000000000,2,'network unreachable',1700000900000,NULL,NULL,0,0);
+INSERT INTO pending_op VALUES(5,'rename','vol~shared',NULL,'{"original_parent_uid":"vol~docs","original_name":"shared.txt"}',1700000000000,0,NULL,1700000700000,'vol~root','shared-moved.txt',0,1700000100000);
+INSERT INTO pending_op VALUES(6,'trash','vol~old',NULL,NULL,1700000000000,0,NULL,0,NULL,NULL,0,0);
+CREATE TABLE IF NOT EXISTS 'local_fts_data'(id INTEGER PRIMARY KEY, block BLOB);
+INSERT INTO local_fts_data VALUES(1,x'000000');
+INSERT INTO local_fts_data VALUES(10,x'00000000000000');
+CREATE TABLE IF NOT EXISTS 'local_fts_idx'(segid, term, pgno, PRIMARY KEY(segid, term)) WITHOUT ROWID;
+CREATE TABLE IF NOT EXISTS 'local_fts_docsize'(id INTEGER PRIMARY KEY, sz BLOB);
+CREATE TABLE IF NOT EXISTS 'local_fts_config'(k PRIMARY KEY, v) WITHOUT ROWID;
+INSERT INTO local_fts_config VALUES('version',4);
+CREATE TABLE share_access (
+  root_uid TEXT PRIMARY KEY,
+  access   TEXT NOT NULL
+           CHECK (access IN ('owner', 'editor', 'viewer', 'unknown'))
+);
+CREATE TABLE mount (
+  id              INTEGER PRIMARY KEY,
+  kind            TEXT NOT NULL
+                  CHECK (kind IN ('myfiles', 'device', 'shared')),
+  sync_folder_id  INTEGER REFERENCES sync_folder(id) ON DELETE CASCADE,
+  share_root_uid  TEXT,
+  local_path      TEXT NOT NULL DEFAULT '',
+  root_uid        TEXT NOT NULL DEFAULT '',
+  root_share_id   TEXT NOT NULL DEFAULT '',
+  mode            TEXT NOT NULL DEFAULT 'unknown',
+  access          TEXT NOT NULL DEFAULT 'rw'
+                  CHECK (access IN ('rw', 'ro')),
+  CHECK (
+    (kind = 'myfiles' AND sync_folder_id IS NULL AND share_root_uid IS NULL)
+    OR
+    (kind = 'device' AND sync_folder_id IS NOT NULL AND share_root_uid IS NULL)
+    OR
+    (kind = 'shared' AND sync_folder_id IS NULL AND share_root_uid IS NOT NULL)
+  )
+);
+CREATE TABLE albums (
+  uid           TEXT PRIMARY KEY,
+  name          TEXT NOT NULL,
+  photo_count   INTEGER NOT NULL DEFAULT 0,
+  cover_uid     TEXT,
+  last_activity INTEGER,
+  shared        INTEGER NOT NULL DEFAULT 0,
+  seq           INTEGER NOT NULL
+);
+CREATE TABLE album_photos (
+  album_uid    TEXT NOT NULL,
+  uid          TEXT NOT NULL,
+  capture_time INTEGER NOT NULL,
+  name         TEXT,
+  media_type   TEXT,
+  kind         INTEGER NOT NULL DEFAULT 0,
+  ratio        REAL,
+  thumb_state  INTEGER NOT NULL DEFAULT 0,
+  seq          INTEGER NOT NULL,
+  PRIMARY KEY (album_uid, uid)
+);
+CREATE TABLE IF NOT EXISTS 'nodes_fts_data'(id INTEGER PRIMARY KEY, block BLOB);
+INSERT INTO nodes_fts_data VALUES(1,x'083850');
+INSERT INTO nodes_fts_data VALUES(10,x'000000000108080008010101020101030101040101050101060101070101080101');
+INSERT INTO nodes_fts_data VALUES(137438953473,x'000000340430206669010204010366696c0102050103696c6501020601036c657301020701036d79200102020103792066010203040808080808');
+INSERT INTO nodes_fts_data VALUES(274877906945,x'0000001a0430646f6302080201010201036f6373020803010103040b');
+INSERT INTO nodes_fts_data VALUES(412316860417,x'0000008b04302e747803080801010d01032f72650306010106010363732f03060101040103646f630306010102010365706f03080301010801036f637303060101030202727403080501010a0103706f7203080401010901037265700308020101070202742e03080601010b0103732f7203060101050103742e7403080701010c0202787403080901010e040b0a0a0a0b0a0a0b0b0a0a0b');
+INSERT INTO nodes_fts_data VALUES(549755813889,x'0000006b04302e747804080501010a01032f6f6c0406010106010363732f04060101040103642e7404080401010902026f63040601010201036c642e04080301010801036f6373040601010302026c640408020101070103732f6f0406010105010374787404080601010b040b0a0a0b090b0a0a0a');
+INSERT INTO nodes_fts_data VALUES(687194767361,x'0000008c04302e747805080801010d01032f736805060101060103617265050804010109010363732f05060101040103642e7405080701010c02026f630506010102010365642e05080601010b010368617205080301010801036f63730506010103010372656405080501010a0103732f73050601010502026861050802010107010374787405080901010e040b0a0b0a0b090b0b0a0b0a0a');
+INSERT INTO nodes_fts_data VALUES(824633720833,x'00000084043020666f060809010109010364657206080d01010d0103652066060808010108010366666c06080301010302026c6906080401010402026f6c06080a01010a0103696e6506080601010601036c646506080c01010c0202696e06080501010501036e652006080701010701036f666606080201010202026c6406080b01010b040b0b0b0b0a0a0b0b0a0b0b');
+INSERT INTO nodes_fts_data VALUES(962072674305,x'000000da043020666f070601010901032e747807080701011601032f696e07060101100103646572070601010d010365206607060101080202722e07080501011403012f070601010e010366666c070601010302026c69070601010402026f6c070601010a0103696e65070601010603016e07080201011101036c6465070601010c0202696e070601010501036e6520070601010703017207080401011302026e6507080301011201036f6666070601010202026c64070601010b0103722e7407080601011502022f69070601010f0103747874070808010117040a0b0a0a0a0a080a09090a090a090a090a0a090b09');
+INSERT INTO nodes_fts_data VALUES(1099511627777,x'0000005c04302e706108080701010701036172740808090101090103652e70080806010106010369652e08080501010501036d6f7608080201010201036f766908080301010301037061720808080101080103766965080804010104040b0b0b0b0b0b0b');
+CREATE TABLE IF NOT EXISTS 'nodes_fts_idx'(segid, term, pgno, PRIMARY KEY(segid, term)) WITHOUT ROWID;
+INSERT INTO nodes_fts_idx VALUES(1,x'',2);
+INSERT INTO nodes_fts_idx VALUES(2,x'',2);
+INSERT INTO nodes_fts_idx VALUES(3,x'',2);
+INSERT INTO nodes_fts_idx VALUES(4,x'',2);
+INSERT INTO nodes_fts_idx VALUES(5,x'',2);
+INSERT INTO nodes_fts_idx VALUES(6,x'',2);
+INSERT INTO nodes_fts_idx VALUES(7,x'',2);
+INSERT INTO nodes_fts_idx VALUES(8,x'',2);
+CREATE TABLE IF NOT EXISTS 'nodes_fts_content'(id INTEGER PRIMARY KEY, c0, c1);
+INSERT INTO nodes_fts_content VALUES(1,'My Files','');
+INSERT INTO nodes_fts_content VALUES(2,'Docs','Docs');
+INSERT INTO nodes_fts_content VALUES(3,'report.txt','Docs/report.txt');
+INSERT INTO nodes_fts_content VALUES(4,'old.txt','Docs/old.txt');
+INSERT INTO nodes_fts_content VALUES(5,'shared.txt','Docs/shared.txt');
+INSERT INTO nodes_fts_content VALUES(6,'Offline folder','Offline folder');
+INSERT INTO nodes_fts_content VALUES(7,'inner.txt','Offline folder/inner.txt');
+INSERT INTO nodes_fts_content VALUES(8,'movie.part','movie.part');
+CREATE TABLE IF NOT EXISTS 'nodes_fts_docsize'(id INTEGER PRIMARY KEY, sz BLOB);
+INSERT INTO nodes_fts_docsize VALUES(1,x'0600');
+INSERT INTO nodes_fts_docsize VALUES(2,x'0202');
+INSERT INTO nodes_fts_docsize VALUES(3,x'080d');
+INSERT INTO nodes_fts_docsize VALUES(4,x'050a');
+INSERT INTO nodes_fts_docsize VALUES(5,x'080d');
+INSERT INTO nodes_fts_docsize VALUES(6,x'0c0c');
+INSERT INTO nodes_fts_docsize VALUES(7,x'0716');
+INSERT INTO nodes_fts_docsize VALUES(8,x'0808');
+CREATE TABLE IF NOT EXISTS 'nodes_fts_config'(k PRIMARY KEY, v) WITHOUT ROWID;
+INSERT INTO nodes_fts_config VALUES('version',4);
+CREATE TABLE own_sealed_rev (
+  uid         TEXT PRIMARY KEY,
+  revision_id TEXT NOT NULL,
+  sealed_at   INTEGER NOT NULL
+);
+INSERT INTO own_sealed_rev VALUES('vol~report','rev-1',1700000000000);
+PRAGMA writable_schema=ON;
+INSERT INTO sqlite_schema(type,name,tbl_name,rootpage,sql)VALUES('table','local_fts','local_fts',0,'CREATE VIRTUAL TABLE local_fts USING fts5(
+  name, path, content=''local_files'', content_rowid=''id'', tokenize=''trigram''
+)');
+INSERT INTO sqlite_schema(type,name,tbl_name,rootpage,sql)VALUES('table','nodes_fts','nodes_fts',0,'CREATE VIRTUAL TABLE nodes_fts USING fts5(
+  name, path, tokenize=''trigram''
+)');
+CREATE TRIGGER mount_sync_folder_insert
+AFTER INSERT ON sync_folder
+BEGIN
+  INSERT OR IGNORE INTO mount (kind, sync_folder_id)
+  VALUES ('device', NEW.id);
+END;
+CREATE INDEX idx_nodes_parent ON nodes(parent_uid);
+CREATE INDEX idx_photos_seq ON photos(seq);
+CREATE INDEX pending_op_uid ON pending_op(uid);
+CREATE INDEX pending_op_parent ON pending_op(parent_uid);
+CREATE INDEX cache_entries_lru ON cache_entries(kind, last_accessed);
+CREATE INDEX idx_nodes_name_nocase ON nodes(name COLLATE NOCASE);
+CREATE INDEX idx_local_files_name_nocase
+  ON local_files(name COLLATE NOCASE);
+CREATE UNIQUE INDEX mount_myfiles
+  ON mount(kind) WHERE kind = 'myfiles';
+CREATE UNIQUE INDEX mount_device
+  ON mount(sync_folder_id) WHERE kind = 'device';
+CREATE UNIQUE INDEX mount_shared
+  ON mount(share_root_uid) WHERE kind = 'shared';
+CREATE INDEX idx_album_photos_seq ON album_photos(album_uid, seq);
+CREATE INDEX idx_album_photos_uid ON album_photos(uid);
+CREATE INDEX idx_photos_favorite ON photos(favorite, seq);
+CREATE INDEX idx_sync_entry_remote_uid ON sync_entry(remote_uid);
+CREATE INDEX idx_local_files_scan_gen ON local_files(scan_gen);
+CREATE INDEX idx_nodes_parent_live ON nodes(parent_uid) WHERE trashed = 0;
+CREATE INDEX idx_pending_op_claimed
+    ON pending_op(uid) WHERE claimed_at <> 0;
+CREATE INDEX idx_trash_parent ON trash(parent_uid);
+CREATE INDEX idx_photos_group ON photos(group_key);
+CREATE INDEX idx_photos_unresolved ON photos(resolved_at);
+CREATE INDEX idx_photos_place ON photos(place_id);
+PRAGMA writable_schema=OFF;
+COMMIT;

crates/pdfs-core/src/db/local.rs

@@ -111,9 +111,80 @@ impl Db {
         )?;
         let count: i64 = tx.query_row("SELECT COUNT(*) FROM local_files", [], |r| r.get(0))?;
         tx.commit()?;
+        drop(conn);
+        self.compact_search_indexes_if_due(finished_at)?;
         Ok(count)
     }
 
+    /// Close a scan that did not see everything: it stopped at the entry cap,
+    /// or a batch failed to write. Nothing is pruned, since a path it missed is
+    /// not a path that is gone; the next complete scan prunes. Returns the
+    /// number of indexed entries.
+    ///
+    /// Pruning after such a scan dropped every entry it had not reached, and
+    /// the next scan put them back. That churn is most of what grew
+    /// `local_fts` to 16 times its size (`docs/BUGS.md` B217).
+    pub fn local_finish_partial_scan(&self, finished_at: i64) -> Result<i64> {
+        let conn = self.conn.lock();
+        conn.execute(
+            "INSERT INTO sync_state (key, value) VALUES ('local_indexed_at', ?1)
+             ON CONFLICT(key) DO UPDATE SET value = excluded.value",
+            [finished_at.to_string()],
+        )?;
+        let count: i64 = conn.query_row("SELECT COUNT(*) FROM local_files", [], |r| r.get(0))?;
+        Ok(count)
+    }
+
+    /// Compact both full-text indexes, at most once a day.
+    ///
+    /// FTS5 keeps a deleted entry's data until the segments holding it are
+    /// merged, and with the few large segments these indexes settle into that
+    /// is close to never. Every file the local scan sees disappear or appear
+    /// leaves some behind, and every node row the tree replaces does too: on
+    /// one machine `local_fts` held 317 MiB for 40,000 paths, against 20 MiB
+    /// rebuilt, and a search took four times as long (`docs/BUGS.md` B217).
+    ///
+    /// `local_fts` is rebuilt from `local_files`, which also drops anything
+    /// left over, and `nodes_fts`, which has no content table to rebuild from,
+    /// is merged into one segment. Each runs in its own transaction on the
+    /// write connection, about half a second on an index that size; once a
+    /// day keeps the leftovers small without paying that at every scan.
+    pub fn compact_search_indexes_if_due(&self, now: i64) -> Result<()> {
+        const EVERY_SECS: i64 = 24 * 60 * 60;
+        let last: i64 = self
+            .read()
+            .query_row(
+                "SELECT value FROM sync_state WHERE key = 'fts_compacted_at'",
+                [],
+                |row| row.get::<_, String>(0),
+            )
+            .optional()?
+            .and_then(|v| v.parse().ok())
+            .unwrap_or(0);
+        if now - last < EVERY_SECS {
+            return Ok(());
+        }
+        let started = std::time::Instant::now();
+        {
+            let conn = self.conn.lock();
+            conn.execute("INSERT INTO local_fts(local_fts) VALUES('rebuild')", [])?;
+        }
+        {
+            let conn = self.conn.lock();
+            conn.execute("INSERT INTO nodes_fts(nodes_fts) VALUES('optimize')", [])?;
+            conn.execute(
+                "INSERT INTO sync_state (key, value) VALUES ('fts_compacted_at', ?1)
+                 ON CONFLICT(key) DO UPDATE SET value = excluded.value",
+                [now.to_string()],
+            )?;
+        }
+        tracing::info!(
+            elapsed_ms = started.elapsed().as_millis() as u64,
+            "compacted the search indexes"
+        );
+        Ok(())
+    }
+
     /// When the last local scan completed (epoch seconds), or `None` if the index
     /// has never been built. The daemon uses this to decide whether a fresh mount
     /// needs an immediate rescan or can serve the existing index.

crates/pdfs-core/src/db/maintenance.rs

@@ -1,4 +1,4 @@
-//! Database health reporting and repair (features.md 4.3).
+//! Database health reporting and repair.
 //!
 //! Everything here exists for the case where something has already gone wrong:
 //! a crash mid-write, a full disk, a cache that has grown out of proportion to
@@ -91,8 +91,13 @@ impl Db {
     /// Returns an empty vector when the database is sound; otherwise each entry
     /// is one problem SQLite found. Read-only and safe against a live daemon,
     /// though it reads every page, so it is not free on a large file.
+    ///
+    /// Runs on a read connection: it reads every page, which took 34 s on a
+    /// 567 MiB file, and on the write connection every write in the daemon
+    /// waited that long behind it (`docs/BUGS.md` B218). WAL lets it read a
+    /// consistent snapshot while the writer goes on.
     pub fn integrity_check(&self) -> Result<Vec<String>> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let mut stmt = conn.prepare("PRAGMA integrity_check")?;
         let rows = stmt.query_map([], |r| r.get::<_, String>(0))?;
         let mut problems = Vec::new();
@@ -107,9 +112,11 @@ impl Db {
         Ok(problems)
     }
 
-    /// Size and row-count snapshot for `pdfs cache inspect`.
+    /// Size and row-count snapshot for `pdfs cache inspect`. On a read
+    /// connection, for the reason [`integrity_check`](Self::integrity_check)
+    /// gives: counting the rows of every table reads most of the file.
     pub fn stats(&self) -> Result<DbStats> {
-        let conn = self.conn.lock();
+        let conn = self.read();
         let page_count: i64 = conn.query_row("PRAGMA page_count", [], |r| r.get(0))?;
         let free_pages: i64 = conn.query_row("PRAGMA freelist_count", [], |r| r.get(0))?;
         let page_size: i64 = conn.query_row("PRAGMA page_size", [], |r| r.get(0))?;
@@ -218,6 +225,40 @@ mod tests {
         assert!(db.integrity_check().unwrap().is_empty());
     }
 
+    /// `pdfs diagnose` and `pdfs cache inspect` read the whole file. Behind the
+    /// write lock they froze every write in the daemon for as long as that
+    /// took (`docs/BUGS.md` B218).
+    #[test]
+    fn the_integrity_check_and_stats_do_not_wait_for_the_writer() {
+        let path = std::env::temp_dir().join(format!(
+            "pdfs-check-{}-{}.db",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .unwrap()
+                .as_nanos()
+        ));
+        let db = std::sync::Arc::new(Db::open(&path).unwrap());
+        let writer = db.conn.lock();
+        let (tx, rx) = std::sync::mpsc::channel();
+        let reader = std::sync::Arc::clone(&db);
+        std::thread::spawn(move || {
+            let checked = reader.integrity_check().map(|p| p.is_empty());
+            let counted = reader.stats().map(|s| s.page_count > 0);
+            let _ = tx.send((checked.ok(), counted.ok()));
+        });
+        let answer = rx.recv_timeout(std::time::Duration::from_secs(10));
+        drop(writer);
+        assert_eq!(answer.ok(), Some((Some(true), Some(true))));
+        drop(db);
+        for suffix in ["", "-wal", "-shm"] {
+            let mut file = path.as_os_str().to_owned();
+            file.push(suffix);
+            let _ = std::fs::remove_file(std::path::PathBuf::from(file));
+        }
+        let _ = std::fs::remove_file(path.with_extension("db.lock"));
+    }
+
     #[test]
     fn stats_report_the_schema_and_the_known_tables() {
         let db = Db::open_in_memory().unwrap();

crates/pdfs-core/src/db/migrations.rs

@@ -5,11 +5,13 @@
 //! is already on disk somewhere, so a change here would silently diverge from
 //! what an existing install actually has. Add a new one instead.
 
+use rusqlite::OptionalExtension;
+
 use super::Db;
 use crate::Result;
 
 /// Current schema version. Bump on every forward migration added below.
-pub(super) const SCHEMA_VERSION: i64 = 35;
+pub(super) const SCHEMA_VERSION: i64 = 44;
 
 impl Db {
     pub(super) fn migrate(&self) -> Result<()> {
@@ -332,6 +334,139 @@ impl Db {
                 tx.execute_batch(MIGRATION_V35)?;
             }
         }
+        if current < 36 {
+            // Same guards as V26-V35.
+            let has_column: bool = tx.query_row(
+                "SELECT COUNT(*) FROM pragma_table_info('nodes') WHERE name = 'lid'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            let has_nodes: bool = tx.query_row(
+                "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = 'nodes'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            if has_nodes && !has_column {
+                tx.execute_batch(MIGRATION_V36)?;
+            }
+        }
+        if current < 37 {
+            // Same guards as V26-V36.
+            let sql: Option<String> = tx
+                .query_row(
+                    "SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'pending_op'",
+                    [],
+                    |row| row.get(0),
+                )
+                .optional()?;
+            if sql.is_some_and(|sql| !sql.contains("AUTOINCREMENT")) {
+                tx.execute_batch(MIGRATION_V37)?;
+            }
+        }
+        if current < 38 {
+            // Same guards as V26-V37.
+            let has_column: bool = tx.query_row(
+                "SELECT COUNT(*) FROM pragma_table_info('pending_op') WHERE name = 'issue'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            let has_ops: bool = tx.query_row(
+                "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = 'pending_op'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            if has_ops && !has_column {
+                tx.execute_batch(MIGRATION_V38)?;
+            }
+        }
+        if current < 39 {
+            // Same guards as V26-V38.
+            let has_column: bool = tx.query_row(
+                "SELECT COUNT(*) FROM pragma_table_info('pending_op') WHERE name = 'lid'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            let has_ops: bool = tx.query_row(
+                "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = 'pending_op'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            if has_ops && !has_column {
+                tx.execute_batch(MIGRATION_V39)?;
+            }
+        }
+        if current < 40 {
+            // Same guards as V26-V39.
+            let has_column: bool = tx.query_row(
+                "SELECT COUNT(*) FROM pragma_table_info('nodes') WHERE name = 'parent_lid'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            let has_nodes: bool = tx.query_row(
+                "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = 'nodes'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            if has_nodes && !has_column {
+                tx.execute_batch(MIGRATION_V40)?;
+            }
+        }
+        if current < 41 {
+            // Needs both tables; on a database that never had them there is
+            // nothing to rewrite.
+            let tables: i64 = tx.query_row(
+                "SELECT COUNT(*) FROM sqlite_master
+                 WHERE type = 'table' AND name IN ('nodes', 'pending_op', 'pins')",
+                [],
+                |row| row.get(0),
+            )?;
+            if tables == 3 {
+                tx.execute_batch(MIGRATION_V41)?;
+            }
+        }
+        if current < 42 {
+            // Same guards as V26-V40.
+            let has_column: bool = tx.query_row(
+                "SELECT COUNT(*) FROM pragma_table_info('pending_op') WHERE name = 'sent_sha1'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            let has_ops: bool = tx.query_row(
+                "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = 'pending_op'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            if has_ops && !has_column {
+                tx.execute_batch(MIGRATION_V42)?;
+            }
+        }
+        if current < 43 {
+            let has_ops: bool = tx.query_row(
+                "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = 'pending_op'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            if has_ops {
+                tx.execute_batch(MIGRATION_V43)?;
+            }
+        }
+        if current < 44 {
+            // Same guards as V26-V42.
+            let has_column: bool = tx.query_row(
+                "SELECT COUNT(*) FROM pragma_table_info('sync_entry') \
+                 WHERE name = 'remote_revision_id'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            let has_entries: bool = tx.query_row(
+                "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = 'sync_entry'",
+                [],
+                |row| row.get::<_, i64>(0),
+            )? > 0;
+            if has_entries && !has_column {
+                tx.execute_batch(MIGRATION_V44)?;
+            }
+        }
         tx.execute(
             "INSERT INTO sync_state (key, value) VALUES ('schema_version', ?1)
              ON CONFLICT(key) DO UPDATE SET value = excluded.value",
@@ -469,7 +604,7 @@ CREATE TABLE trash (
 );
 ";
 
-/// Schema v8: device sync (devices.md). This machine registers as one Proton Drive
+/// Schema v8: device sync. This machine registers as one Proton Drive
 /// **Device** (a share + root folder on the main volume); `device` is a singleton
 /// row cached so we reuse the same device across restarts instead of creating a
 /// new one each run. `sync_folder` is one row per local folder the user added,
@@ -530,8 +665,8 @@ ALTER TABLE sync_folder ADD COLUMN pending_mode TEXT;
 ";
 
 /// Schema v11: writes no longer upload inside the FUSE handler. `release` stages
-/// the bytes and records the intended upload here, and a drain worker performs it
-/// (offline.md Phase 3). The row outlives the process, so a write survives both a
+/// the bytes and records the intended upload here, and a drain worker performs it.
+/// The row outlives the process, so a write survives both a
 /// dead network and a restart.
 ///
 /// `blob_path` points into the content cache's `staging/` dir and `meta_json` is
@@ -558,7 +693,7 @@ CREATE INDEX pending_op_uid ON pending_op(uid);
 
 /// Schema v12: `pending_op` also carries mutations that *create* a node, which a
 /// revision op never had to describe — it always addressed a node the server had
-/// already minted a uid for (offline.md Phase 3b).
+/// already minted a uid for.
 ///
 /// An offline `create`/`mkdir` cannot get a real uid, so the node is invented
 /// locally under a `local~<uuid>` placeholder and the op records where it goes
@@ -948,7 +1083,7 @@ ALTER TABLE pending_op ADD COLUMN access_deferred_since INTEGER NOT NULL DEFAULT
 /// as the last sync and left the file the same length — a fixed-size record
 /// rewritten, an image re-exported, a database page updated in place — read as
 /// *unchanged* and was never uploaded. The remote copy silently stayed at the
-/// older content until something else about the file moved (bugs.md B25).
+/// older content until something else about the file moved (`docs/BUGS.md` B25).
 ///
 /// Nullable rather than a converted `local_mtime * 1_000_000_000`: the
 /// nanosecond part of an existing baseline is genuinely unknown, and inventing
@@ -1059,3 +1194,191 @@ ALTER TABLE photos ADD COLUMN similar_hash INTEGER;
 const MIGRATION_V35: &str = "
 ALTER TABLE trash ADD COLUMN trashed_at INTEGER;
 ";
+
+/// Schema v36: every node row has a local id (`lid`); see
+/// docs/ARCHITECTURE.md §2.
+///
+/// The `uid` was the row's key, so a node had no identity until Drive minted
+/// one, and a create that landed moved its row to a new key. The `lid` is given
+/// when the row is first written and never changes or comes back, which is what
+/// `AUTOINCREMENT` adds over a plain rowid. It takes the old rowid, so the
+/// search index, keyed by rowid since v15, stays valid. The `uid` becomes
+/// nullable for a node that is not on Drive yet.
+const MIGRATION_V36: &str = "
+CREATE TABLE nodes_v36 (
+  lid           INTEGER PRIMARY KEY AUTOINCREMENT,
+  uid           TEXT UNIQUE,
+  parent_uid    TEXT,
+  name          TEXT NOT NULL,
+  is_dir        INTEGER NOT NULL,
+  size          INTEGER,
+  mtime         INTEGER NOT NULL,
+  revision_hash TEXT,
+  trashed       INTEGER NOT NULL DEFAULT 0,
+  node_json     TEXT,
+  listed        INTEGER NOT NULL DEFAULT 0,
+  path          TEXT
+);
+INSERT INTO nodes_v36
+  (lid, uid, parent_uid, name, is_dir, size, mtime, revision_hash, trashed, node_json, listed,
+   path)
+  SELECT rowid, uid, parent_uid, name, is_dir, size, mtime, revision_hash, trashed, node_json,
+         listed, path
+    FROM nodes;
+DROP TABLE nodes;
+ALTER TABLE nodes_v36 RENAME TO nodes;
+CREATE INDEX idx_nodes_parent ON nodes(parent_uid);
+CREATE INDEX idx_nodes_name_nocase ON nodes(name COLLATE NOCASE);
+CREATE INDEX idx_nodes_parent_live ON nodes(parent_uid) WHERE trashed = 0;
+";
+
+/// Schema v37: a `pending_op` id is never given out twice.
+///
+/// A plain rowid is the largest one plus one, so an op queued right after the
+/// newest one was dropped took its id. The drain retires the op it is
+/// working on by id, and so deleted the new op: a trash queued over a rename
+/// on the wire was lost when the rename landed. `AUTOINCREMENT` never reuses
+/// an id. Ids are kept, as is every index.
+const MIGRATION_V37: &str = "
+CREATE TABLE pending_op_v37 (
+  id                    INTEGER PRIMARY KEY AUTOINCREMENT,
+  kind                  TEXT NOT NULL,
+  uid                   TEXT NOT NULL,
+  blob_path             TEXT,
+  meta_json             TEXT,
+  created_at            INTEGER NOT NULL,
+  attempts              INTEGER NOT NULL DEFAULT 0,
+  last_error            TEXT,
+  next_attempt_at       INTEGER NOT NULL DEFAULT 0,
+  parent_uid            TEXT,
+  name                  TEXT,
+  claimed_at            INTEGER NOT NULL DEFAULT 0,
+  access_deferred_since INTEGER NOT NULL DEFAULT 0
+);
+INSERT INTO pending_op_v37
+  (id, kind, uid, blob_path, meta_json, created_at, attempts, last_error, next_attempt_at,
+   parent_uid, name, claimed_at, access_deferred_since)
+  SELECT id, kind, uid, blob_path, meta_json, created_at, attempts, last_error,
+         next_attempt_at, parent_uid, name, claimed_at, access_deferred_since
+    FROM pending_op;
+DROP TABLE pending_op;
+ALTER TABLE pending_op_v37 RENAME TO pending_op;
+CREATE INDEX pending_op_uid ON pending_op(uid);
+CREATE INDEX pending_op_parent ON pending_op(parent_uid);
+CREATE INDEX idx_pending_op_claimed
+    ON pending_op(uid) WHERE claimed_at <> 0;
+";
+
+/// Schema v38: why Drive refused a queued op, when it did (a sync issue).
+/// `NULL` for an op that has not been refused, which is every op migrated.
+const MIGRATION_V38: &str = "
+ALTER TABLE pending_op ADD COLUMN issue TEXT;
+";
+
+/// Schema v39: a queued op names its node and its parent by local id too.
+///
+/// A create made inside a folder that had not landed named the folder by its
+/// placeholder uid, and every landing had to find and rewrite those strings.
+/// The local id stays the same when the folder lands. An op whose node has no
+/// row keeps `NULL` and is matched by uid, as before.
+const MIGRATION_V39: &str = "
+ALTER TABLE pending_op ADD COLUMN lid INTEGER;
+ALTER TABLE pending_op ADD COLUMN parent_lid INTEGER;
+UPDATE pending_op
+   SET lid = (SELECT lid FROM nodes WHERE nodes.uid = pending_op.uid),
+       parent_lid = (SELECT lid FROM nodes WHERE nodes.uid = pending_op.parent_uid);
+CREATE INDEX pending_op_lid ON pending_op(lid);
+CREATE INDEX pending_op_parent_lid ON pending_op(parent_lid);
+";
+
+/// Schema v40: a node row names its parent by local id too.
+///
+/// The local id stays when a folder made here lands and its row takes the uid
+/// Drive gave it, so a child linked by it needs no rewrite. `NULL` while the
+/// parent has no row, as `parent_uid` then names nothing either.
+const MIGRATION_V40: &str = "
+ALTER TABLE nodes ADD COLUMN parent_lid INTEGER;
+UPDATE nodes SET parent_lid = (SELECT p.lid FROM nodes p WHERE p.uid = nodes.parent_uid);
+CREATE INDEX idx_nodes_parent_lid ON nodes(parent_lid);
+";
+
+/// Schema v41: a node made on this machine goes by `local~<lid>` until it
+/// lands, a function of its row, where it used to get a `local~<ms>-<n>`
+/// placeholder. Every placeholder still stored is rewritten to its row's
+/// stand-in: the row itself and its `node_json`, its children, the ops on it
+/// or into it, and its pins. A placeholder op with no row keeps its uid and
+/// drains as before.
+const MIGRATION_V41: &str = "
+CREATE TEMP TABLE local_v41 AS
+  SELECT uid AS old, 'local~' || lid AS new, lid FROM nodes
+   WHERE uid LIKE 'local~%' AND uid <> 'local~' || lid;
+UPDATE pending_op SET uid = (SELECT new FROM local_v41 WHERE old = pending_op.uid)
+ WHERE uid IN (SELECT old FROM local_v41);
+UPDATE pending_op SET parent_uid = (SELECT new FROM local_v41 WHERE old = pending_op.parent_uid)
+ WHERE parent_uid IN (SELECT old FROM local_v41);
+UPDATE pending_op
+   SET meta_json = json_set(meta_json, '$.uid',
+         (SELECT new FROM local_v41 WHERE old = json_extract(pending_op.meta_json, '$.uid')))
+ WHERE json_valid(meta_json)
+   AND json_extract(meta_json, '$.uid') IN (SELECT old FROM local_v41);
+UPDATE pending_op
+   SET meta_json = json_set(meta_json, '$.original_parent_uid',
+         (SELECT new FROM local_v41
+           WHERE old = json_extract(pending_op.meta_json, '$.original_parent_uid')))
+ WHERE json_valid(meta_json)
+   AND json_extract(meta_json, '$.original_parent_uid') IN (SELECT old FROM local_v41);
+UPDATE pins SET uid = (SELECT new FROM local_v41 WHERE old = pins.uid)
+ WHERE uid IN (SELECT old FROM local_v41);
+UPDATE nodes
+   SET node_json = json_set(node_json, '$.parent_uid.link_id',
+         (SELECT CAST(lid AS TEXT) FROM local_v41 WHERE old = nodes.parent_uid))
+ WHERE parent_uid IN (SELECT old FROM local_v41)
+   AND json_valid(node_json)
+   AND json_extract(node_json, '$.parent_uid.volume_id') = 'local';
+UPDATE nodes SET parent_uid = (SELECT new FROM local_v41 WHERE old = nodes.parent_uid)
+ WHERE parent_uid IN (SELECT old FROM local_v41);
+UPDATE nodes
+   SET node_json = json_set(node_json, '$.uid.link_id', CAST(lid AS TEXT))
+ WHERE lid IN (SELECT lid FROM local_v41)
+   AND json_valid(node_json)
+   AND json_extract(node_json, '$.uid.volume_id') = 'local';
+UPDATE nodes SET uid = 'local~' || lid WHERE lid IN (SELECT lid FROM local_v41);
+DROP TABLE local_v41;
+";
+
+/// Schema v42: the SHA-1 of each blob a queued create sent, space-separated.
+/// A create whose answer was lost may have made its file with any of them,
+/// and the op that finds that file again may run after a restart. `NULL` for
+/// an op that has sent nothing, which is every op migrated: what the daemon
+/// that wrote it sent is not known. Likewise the parent and name each attempt
+/// was sent under, as a JSON list of pairs: a rename since then moves the op
+/// but not the file Drive may have made.
+const MIGRATION_V42: &str = "
+ALTER TABLE pending_op ADD COLUMN sent_sha1 TEXT;
+ALTER TABLE pending_op ADD COLUMN sent_to TEXT;
+";
+
+/// Schema v43: queued ops by kind and name.
+///
+/// Before each create, rename and trash the drain asks whether a queued trash
+/// or rename holds the name it wants, and a released name wakes the ops
+/// waiting for it. Each of those scanned the whole queue, so a large offline
+/// batch made draining it quadratic. The kind leads, so a lookup of every
+/// queued rename uses the index too.
+const MIGRATION_V43: &str = "
+CREATE INDEX IF NOT EXISTS pending_op_kind_name ON pending_op(kind, name);
+";
+
+/// Schema v44: a synced file's baseline remembers the revision it was synced
+/// at.
+///
+/// A mirrored file edited here is uploaded as a new revision of whatever is
+/// current on Drive, and another computer syncing the same folder may have
+/// committed one since this pass looked. The revision id is what the upload
+/// checks first, so that edit becomes a conflict copy instead of being
+/// replaced (B249). `NULL` means "this row predates the column", and the check
+/// falls back to the modification time and size; each row gains a real value
+/// the next time its path is synced.
+const MIGRATION_V44: &str = "
+ALTER TABLE sync_entry ADD COLUMN remote_revision_id TEXT;
+";

crates/pdfs-core/src/db/mod.rs

@@ -56,8 +56,9 @@ pub use local::LocalFileHit;
 pub use maintenance::{DbStats, VacuumOutcome};
 pub use nodes::{PublishedSharedRoot, SearchHit, StoredNode};
 pub use ops::{
-    AttachedBlob, FAILING_ATTEMPTS, LOCAL_VOLUME, OP_CREATE, OP_MKDIR, OP_RENAME, OP_REVISION,
-    OP_TRASH, PARK_EXPIRY_MS, PARK_UNTIL, PendingCounts, PendingOp, RenameMeta, op_supersedes,
+    AttachedBlob, CreateLanding, CreateRetired, FAILING_ATTEMPTS, LOCAL_VOLUME, OP_CREATE,
+    OP_MKDIR, OP_RENAME, OP_REVISION, OP_TRASH, PARK_EXPIRY_MS, PARK_UNTIL, PendingCounts,
+    PendingOp, RenameMeta, local_lid, local_uid, op_supersedes,
 };
 pub use photos::{StoredPhoto, StoredPlace, THUMB_HAVE, THUMB_NONE, THUMB_UNKNOWN, TimelineRow};
 pub use pins::PinRow;
@@ -178,6 +179,45 @@ impl Drop for Reader<'_> {
     }
 }
 
+/// The write connection with `synchronous=FULL`, back to NORMAL on drop.
+///
+/// NORMAL in WAL mode keeps a commit across a crash of the process but not
+/// across a power loss: the WAL is synced only at checkpoints. That is fine for
+/// metadata the next listing re-fetches, and not for the queue. A staged blob
+/// is synced before its op is queued, and the op row is what makes it
+/// reachable; losing that row loses a write `close()` already reported as
+/// done. A FULL commit syncs the WAL, which covers every NORMAL commit before
+/// it as well.
+pub(super) struct Durable<'a>(parking_lot::MutexGuard<'a, Connection>);
+
+impl<'a> Durable<'a> {
+    pub(super) fn new(conn: parking_lot::MutexGuard<'a, Connection>) -> Result<Self> {
+        conn.pragma_update(None, "synchronous", "FULL")?;
+        Ok(Self(conn))
+    }
+}
+
+impl std::ops::Deref for Durable<'_> {
+    type Target = Connection;
+
+    fn deref(&self) -> &Connection {
+        &self.0
+    }
+}
+
+impl std::ops::DerefMut for Durable<'_> {
+    fn deref_mut(&mut self) -> &mut Connection {
+        &mut self.0
+    }
+}
+
+impl Drop for Durable<'_> {
+    fn drop(&mut self) {
+        // A failure leaves the writer at FULL: slower, never less safe.
+        let _ = self.0.pragma_update(None, "synchronous", "NORMAL");
+    }
+}
+
 /// Open a second connection to the same file for reads only.
 ///
 /// `SQLITE_OPEN_READ_ONLY` plus `query_only` is belt and braces: the flag stops
@@ -215,18 +255,34 @@ impl Db {
         let conn = match Self::open_configured(path) {
             Ok(conn) => conn,
             Err(e) if is_corrupt(&e) => {
-                // Every byte in here is derived from the account or from the
-                // content cache directory, so the recovery is to start over —
-                // loudly, and keeping the damaged file for a post-mortem rather
-                // than deleting evidence.
+                // Most of what is in here is derived from the account and is
+                // fetched again. The queue is not: it holds writes accepted
+                // here that Drive does not have yet, and the mirror baselines
+                // and pins are this machine's alone. So the damaged file is
+                // moved aside, kept as evidence, and those tables are copied
+                // out of it into the new one as far as SQLite can still read
+                // them (`docs/BUGS.md` B216).
                 tracing::error!(
                     db = %path.display(),
                     error = %e,
-                    "cache database is corrupt — moving it aside and rebuilding \
-                     (metadata will be re-fetched; no user data is stored here)"
+                    "cache database is corrupt; moving it aside, rebuilding, and \
+                     copying the upload queue, sync baselines and pins out of it"
                 );
-                quarantine_corrupt_db(path)?;
-                Self::open_configured(path)?
+                let damaged = quarantine_corrupt_db(path)?;
+                let conn = Self::open_configured(path)?;
+                for (table, result) in salvage(&conn, &damaged) {
+                    match result {
+                        Ok(rows) => {
+                            tracing::warn!(table, rows, "salvaged from the damaged database")
+                        }
+                        Err(error) => tracing::error!(
+                            table,
+                            %error,
+                            "could not salvage from the damaged database"
+                        ),
+                    }
+                }
+                conn
             }
             Err(e) => return Err(e),
         };
@@ -253,6 +309,12 @@ impl Db {
         Ok(db)
     }
 
+    /// The write connection for a commit that accepts a user's change into
+    /// the queue. See [`Durable`].
+    pub(super) fn durable(&self) -> Result<Durable<'_>> {
+        Durable::new(self.conn.lock())
+    }
+
     /// A connection for a `SELECT`-only method.
     ///
     /// Reads see the last committed state, which is the same thing they saw
@@ -280,7 +342,8 @@ impl Db {
     fn open_configured(path: &Path) -> Result<Connection> {
         let conn = Connection::open(path)?;
         // WAL: readers never block the single writer. NORMAL sync is the
-        // standard durability/throughput tradeoff for WAL.
+        // standard durability/throughput tradeoff for WAL; the queue commits
+        // that need more raise it to FULL for themselves (`Durable`).
         conn.pragma_update(None, "journal_mode", "WAL")?;
         conn.pragma_update(None, "synchronous", "NORMAL")?;
         conn.pragma_update(None, "foreign_keys", "ON")?;
@@ -427,12 +490,96 @@ fn is_corrupt(e: &Error) -> bool {
     )
 }
 
-/// Move a damaged database (and its WAL sidecars) out of the way so the next
-/// open starts from empty.
+/// The tables [`salvage`] copies out of a damaged database, in order, each
+/// with the rows it keeps.
 ///
-/// Renamed rather than deleted: this is a cache, but it is also the only
-/// evidence of what went wrong, and it costs one file the user can remove.
-fn quarantine_corrupt_db(path: &Path) -> Result<()> {
+/// The queue goes with the node rows it names by local id: a create made here
+/// has no other record of its node, and a real node keeps its local id when its
+/// folder is listed again. Those rows come back unlisted, so their folders are
+/// fetched again rather than trusted. Claims are cleared by [`Db::open`] as
+/// after any other crash.
+const SALVAGE: &[(&str, &str)] = &[
+    (
+        "nodes",
+        "lid IN (SELECT lid FROM old.pending_op WHERE lid IS NOT NULL
+                 UNION SELECT parent_lid FROM old.pending_op WHERE parent_lid IS NOT NULL)
+         OR uid LIKE 'local~%'",
+    ),
+    ("pending_op", "1"),
+    ("sync_folder", "1"),
+    ("sync_entry", "1"),
+    ("pins", "1"),
+    ("own_sealed_rev", "1"),
+];
+
+/// Copy what only this machine has out of the damaged database at `damaged`
+/// into the fresh one `conn` just created. Returns how each table went.
+///
+/// Each table is copied in its own transaction, so a table SQLite cannot read
+/// to the end is left out whole rather than half copied, and does not stop
+/// the others. Only the columns both files have are copied, which covers a
+/// file that broke in the middle of an upgrade. The damaged file is opened read
+/// only and left as it was.
+fn salvage(conn: &Connection, damaged: &Path) -> Vec<(&'static str, Result<usize>)> {
+    let uri = format!(
+        "file:{}?mode=ro",
+        damaged
+            .to_string_lossy()
+            .replace('%', "%25")
+            .replace('?', "%3f")
+            .replace('#', "%23")
+    );
+    if let Err(e) = conn.execute("ATTACH DATABASE ?1 AS old", [&uri]) {
+        let e = Error::Db(e);
+        tracing::error!(error = %e, "could not open the damaged database to salvage it");
+        return Vec::new();
+    }
+    let results = SALVAGE
+        .iter()
+        .map(|&(table, rows)| (table, salvage_table(conn, table, rows)))
+        .collect();
+    let _ = conn.execute("UPDATE nodes SET listed = 0", []);
+    if let Err(e) = conn.execute("DETACH DATABASE old", []) {
+        tracing::warn!(error = %e, "could not detach the damaged database");
+    }
+    results
+}
+
+fn salvage_table(conn: &Connection, table: &str, rows: &str) -> Result<usize> {
+    let columns = |schema: &str| -> Result<Vec<String>> {
+        let mut stmt = conn.prepare(&format!("PRAGMA {schema}.table_info({table})"))?;
+        let names = stmt
+            .query_map([], |r| r.get::<_, String>(1))?
+            .collect::<rusqlite::Result<Vec<_>>>()?;
+        Ok(names)
+    };
+    let new = columns("main")?;
+    let shared: Vec<String> = columns("old")?
+        .into_iter()
+        .filter(|c| new.contains(c))
+        .map(|c| format!("\"{c}\""))
+        .collect();
+    if shared.is_empty() {
+        return Ok(0);
+    }
+    let shared = shared.join(", ");
+    let tx = conn.unchecked_transaction()?;
+    let copied = tx.execute(
+        &format!(
+            "INSERT OR IGNORE INTO main.{table} ({shared}) SELECT {shared} FROM old.{table} WHERE {rows}"
+        ),
+        [],
+    )?;
+    tx.commit()?;
+    Ok(copied)
+}
+
+/// Move a damaged database (and its WAL sidecars) out of the way so the next
+/// open starts from empty. Returns where the database itself went.
+///
+/// Renamed rather than deleted: it is the only evidence of what went wrong,
+/// and [`salvage`] reads what only this machine has back out of it.
+fn quarantine_corrupt_db(path: &Path) -> Result<PathBuf> {
     let stamp = std::time::SystemTime::now()
         .duration_since(std::time::UNIX_EPOCH)
         .map(|d| d.as_secs())
@@ -456,7 +603,9 @@ fn quarantine_corrupt_db(path: &Path) -> Result<()> {
             Err(e) => tracing::warn!(file = %from.display(), error = %e, "could not quarantine"),
         }
     }
-    Ok(())
+    let mut kept = path.as_os_str().to_owned();
+    kept.push(format!(".corrupt-{stamp}"));
+    Ok(PathBuf::from(kept))
 }
 
 #[cfg(test)]

crates/pdfs-core/src/db/nodes.rs

@@ -3,9 +3,11 @@
 
 use std::collections::HashSet;
 
+use rusqlite::types::Value;
 use rusqlite::{OptionalExtension, Transaction, params};
 
 use super::Db;
+use super::ops::{OP_CREATE, OP_MKDIR, OP_RENAME, local_lid, local_uid, wake_ops_waiting_for_tx};
 use crate::{Access, Result};
 use proton_drive_rs::proton_sdk::ids::{LinkId, NodeUid, VolumeId};
 use proton_drive_rs::{Node, NodeKind};
@@ -17,6 +19,8 @@ use super::utils::{
 pub struct StoredNode {
     pub node: Node,
     pub listed: bool,
+    /// The row's local id ([`Db::lid_of`]).
+    pub lid: i64,
 }
 
 /// One full-text search match: the stored [`Node`] plus its mountpoint-relative
@@ -62,12 +66,13 @@ impl Db {
     /// snapshot while offline, including after a live event expired its TTL.
     pub fn visible_children(&self, parent: &NodeUid) -> Result<Vec<Node>> {
         let conn = self.read();
-        let mut stmt = conn.prepare(
-            "SELECT node_json FROM nodes
-              WHERE parent_uid = ?1 AND trashed = 0 AND node_json IS NOT NULL
-              ORDER BY name, uid",
-        )?;
-        let rows = stmt.query_map([parent.to_string()], |row| row.get::<_, String>(0))?;
+        let (key, parent) = parent_key(&conn, &parent.to_string())?;
+        let mut stmt = conn.prepare(&format!(
+            "SELECT {NODE_NOW} FROM nodes n LEFT JOIN nodes p ON p.lid = n.parent_lid
+              WHERE n.{key} = ?1 AND n.trashed = 0 AND n.node_json IS NOT NULL
+              ORDER BY n.name, n.uid"
+        ))?;
+        let rows = stmt.query_map([parent], |row| row.get::<_, String>(0))?;
         let mut nodes = Vec::new();
         for row in rows {
             nodes.push(serde_json::from_str(&row?)?);
@@ -264,10 +269,25 @@ impl Db {
     /// resolve its shared-tree access. Removing the op first could resurrect
     /// that row after a crash; removing the row first could strand a now
     /// unauthorizable op. One transaction closes both windows.
-    pub fn complete_trash_op(&self, op_id: i64, uid: &NodeUid) -> Result<()> {
+    ///
+    /// An op that found the name still held by this trash failed with a
+    /// backoff, and the name is free now. It is made due at once
+    /// ([`Db::wake_ops_waiting_for`]).
+    ///
+    /// Returns the staged blob of the create the trash withdrew, if it kept
+    /// one, for the caller to discard.
+    pub fn complete_trash_op(&self, op_id: i64, uid: &NodeUid) -> Result<Option<String>> {
         let uid = uid.to_string();
         let mut conn = self.conn.lock();
         let tx = conn.transaction()?;
+        let (name, blob): (Option<String>, Option<String>) = tx
+            .query_row(
+                "SELECT name, blob_path FROM pending_op WHERE id = ?1",
+                params![op_id],
+                |row| Ok((row.get(0)?, row.get(1)?)),
+            )
+            .optional()?
+            .unwrap_or_default();
         let rowid: Option<i64> = tx
             .query_row(
                 "SELECT rowid FROM nodes WHERE uid = ?1",
@@ -280,17 +300,23 @@ impl Db {
             tx.execute("DELETE FROM nodes_fts WHERE rowid = ?1", params![rowid])?;
         }
         tx.execute("DELETE FROM pending_op WHERE id = ?1", params![op_id])?;
+        if let Some(name) = name {
+            wake_ops_waiting_for_tx(&tx, &name)?;
+        }
         tx.commit()?;
-        Ok(())
+        Ok(blob)
     }
 
     /// Check if a folder node has any non-trashed children in the database.
     pub fn has_children(&self, parent_uid: &NodeUid) -> Result<bool> {
-        let uid_str = parent_uid.to_string();
         let conn = self.read();
+        let (key, parent) = parent_key(&conn, &parent_uid.to_string())?;
         let count: i64 = conn.query_row(
-            "SELECT COUNT(*) FROM nodes WHERE parent_uid = ?1 AND trashed = 0",
-            params![uid_str],
+            &format!(
+                "SELECT COUNT(*) FROM nodes
+                 WHERE {key} = ?1 AND trashed = 0 AND node_json IS NOT NULL"
+            ),
+            params![parent],
             |row| row.get(0),
         )?;
         Ok(count > 0)
@@ -305,9 +331,11 @@ impl Db {
     pub fn node_path(&self, uid: &str) -> Result<Option<String>> {
         let conn = self.read();
         let exists: Option<i64> = conn
-            .query_row("SELECT 1 FROM nodes WHERE uid = ?1", params![uid], |r| {
-                r.get(0)
-            })
+            .query_row(
+                "SELECT 1 FROM nodes WHERE uid = ?1 AND node_json IS NOT NULL",
+                params![uid],
+                |r| r.get(0),
+            )
             .optional()?;
         if exists.is_none() {
             return Ok(None);
@@ -325,11 +353,11 @@ impl Db {
     pub fn path_relative_to(&self, ancestor_uid: &str, uid: &str) -> Result<Option<String>> {
         let conn = self.read();
         let mut stmt = conn.prepare(
-            "WITH RECURSIVE anc(uid, parent_uid, name, depth) AS (
-               SELECT uid, parent_uid, name, 0 FROM nodes WHERE uid = ?1
+            "WITH RECURSIVE anc(uid, parent_lid, name, depth) AS (
+               SELECT uid, parent_lid, name, 0 FROM nodes WHERE uid = ?1
                UNION ALL
-               SELECT n.uid, n.parent_uid, n.name, anc.depth + 1
-               FROM nodes n JOIN anc ON n.uid = anc.parent_uid
+               SELECT n.uid, n.parent_lid, n.name, anc.depth + 1
+               FROM nodes n JOIN anc ON n.lid = anc.parent_lid
                WHERE anc.depth < 1024
              )
              SELECT uid, name FROM anc ORDER BY depth",
@@ -378,12 +406,13 @@ impl Db {
         let conn = self.read();
         let rows: Vec<HitRow> = if query.chars().count() < TRIGRAM_MIN {
             let pat = format!("%{}%", like_escape(query));
-            let mut stmt = conn.prepare(
-                "SELECT node_json, uid, path FROM nodes
-                 WHERE name LIKE ?1 ESCAPE '\\' AND trashed = 0 AND node_json IS NOT NULL
-                   AND (?3 IS NULL OR path IS NULL OR path LIKE ?3 ESCAPE '\\')
-                 ORDER BY name LIMIT ?2",
-            )?;
+            let mut stmt = conn.prepare(&format!(
+                "SELECT {NODE_NOW}, n.uid, n.path
+                 FROM nodes n LEFT JOIN nodes p ON p.lid = n.parent_lid
+                 WHERE n.name LIKE ?1 ESCAPE '\\' AND n.trashed = 0 AND n.node_json IS NOT NULL
+                   AND (?3 IS NULL OR n.path IS NULL OR n.path LIKE ?3 ESCAPE '\\')
+                 ORDER BY n.name LIMIT ?2"
+            ))?;
             collect_hits(stmt.query_map(params![pat, limit as i64, scope_pat], hit_row)?)?
         } else {
             // Escape double quotes and quote each term, then combine with AND so
@@ -393,13 +422,14 @@ impl Db {
                 .map(|word| format!("\"{}\"", word.replace('"', "\"\"")))
                 .collect::<Vec<_>>()
                 .join(" AND ");
-            let mut stmt = conn.prepare(
-                "SELECT n.node_json, n.uid, n.path
+            let mut stmt = conn.prepare(&format!(
+                "SELECT {NODE_NOW}, n.uid, n.path
                  FROM nodes_fts f JOIN nodes n ON n.rowid = f.rowid
+                 LEFT JOIN nodes p ON p.lid = n.parent_lid
                  WHERE f.name MATCH ?1 AND n.trashed = 0 AND n.node_json IS NOT NULL
                    AND (?3 IS NULL OR n.path IS NULL OR n.path LIKE ?3 ESCAPE '\\')
-                 ORDER BY f.rank LIMIT ?2",
-            )?;
+                 ORDER BY f.rank LIMIT ?2"
+            ))?;
             collect_hits(stmt.query_map(params![phrase, limit as i64, scope_pat], hit_row)?)?
         };
 
@@ -436,20 +466,22 @@ impl Db {
         let lane_limit = limit.div_ceil(2);
         let mut rows: Vec<HitRow> = if terms.is_empty() {
             let pat = format!("%{}%", like_escape(query));
-            let mut stmt = conn.prepare(
-                "SELECT node_json, uid, path FROM nodes
-                 WHERE name LIKE ?1 ESCAPE '\\' AND trashed = 0 AND node_json IS NOT NULL
-                 ORDER BY name LIMIT ?2",
-            )?;
+            let mut stmt = conn.prepare(&format!(
+                "SELECT {NODE_NOW}, n.uid, n.path
+                 FROM nodes n LEFT JOIN nodes p ON p.lid = n.parent_lid
+                 WHERE n.name LIKE ?1 ESCAPE '\\' AND n.trashed = 0 AND n.node_json IS NOT NULL
+                 ORDER BY n.name LIMIT ?2"
+            ))?;
             collect_hits(stmt.query_map(params![pat, limit as i64], hit_row)?)?
         } else {
             let expression = terms.join(" OR ");
-            let mut stmt = conn.prepare(
-                "SELECT n.node_json, n.uid, n.path
+            let mut stmt = conn.prepare(&format!(
+                "SELECT {NODE_NOW}, n.uid, n.path
                    FROM nodes_fts f JOIN nodes n ON n.rowid = f.rowid
+                   LEFT JOIN nodes p ON p.lid = n.parent_lid
                   WHERE nodes_fts MATCH ?1 AND n.trashed = 0 AND n.node_json IS NOT NULL
-                  ORDER BY f.rank LIMIT ?2",
-            )?;
+                  ORDER BY f.rank LIMIT ?2"
+            ))?;
             collect_hits(stmt.query_map(params![expression, lane_limit as i64], hit_row)?)?
         };
         // Trigram rank does not know that a name *starts* with the query, and a
@@ -459,12 +491,13 @@ impl Db {
         if !terms.is_empty()
             && let Some(first) = query.chars().next()
         {
-            let mut stmt = conn.prepare(
-                "SELECT node_json, uid, path FROM nodes
-                 WHERE name COLLATE NOCASE LIKE ?1 ESCAPE '\\'
-                   AND trashed = 0 AND node_json IS NOT NULL
-                 ORDER BY name COLLATE NOCASE LIMIT ?2",
-            )?;
+            let mut stmt = conn.prepare(&format!(
+                "SELECT {NODE_NOW}, n.uid, n.path
+                 FROM nodes n LEFT JOIN nodes p ON p.lid = n.parent_lid
+                 WHERE n.name COLLATE NOCASE LIKE ?1 ESCAPE '\\'
+                   AND n.trashed = 0 AND n.node_json IS NOT NULL
+                 ORDER BY n.name COLLATE NOCASE LIMIT ?2"
+            ))?;
             let mut extra = Vec::new();
             for pattern in [
                 format!("{}%", like_escape(query)),
@@ -500,40 +533,50 @@ impl Db {
     /// re-enumerates from the remote on next access.
     pub fn set_listed(&self, uid: &NodeUid, listed: bool) -> Result<()> {
         let conn = self.conn.lock();
+        let (key, uid) = row_key(&uid.to_string());
         conn.execute(
-            "UPDATE nodes SET listed = ?2 WHERE uid = ?1",
-            params![uid.to_string(), listed as i64],
+            &format!("UPDATE nodes SET listed = ?2 WHERE {key} = ?1"),
+            params![uid, listed as i64],
         )?;
         Ok(())
     }
 
     /// Load every persisted node for cold-start hydration of the `State` maps.
+    ///
+    /// Each node names its parent as the parent's row has it now, found by
+    /// local id: a folder that landed has its new uid there, while the node
+    /// stored below it may still hold the placeholder.
     pub fn load_all(&self) -> Result<Vec<StoredNode>> {
         let conn = self.read();
-        let mut stmt =
-            conn.prepare("SELECT node_json, listed FROM nodes WHERE node_json IS NOT NULL")?;
+        let mut stmt = conn.prepare(&format!(
+            "SELECT {NODE_NOW}, n.listed, n.lid
+             FROM nodes n LEFT JOIN nodes p ON p.lid = n.parent_lid
+             WHERE n.node_json IS NOT NULL"
+        ))?;
         let rows = stmt.query_map([], |row| {
             let json: String = row.get(0)?;
             let listed: i64 = row.get(1)?;
-            Ok((json, listed != 0))
+            Ok((json, listed != 0, row.get(2)?))
         })?;
         let mut out = Vec::new();
         for row in rows {
-            let (json, listed) = row?;
+            let (json, listed, lid) = row?;
             let node: Node = serde_json::from_str(&json)?;
-            out.push(StoredNode { node, listed });
+            out.push(StoredNode { node, listed, lid });
         }
         Ok(out)
     }
 
     /// Load one persisted node back by uid. Used to recover the My Files root
-    /// when the API is unreachable, so the mount can still serve the cached tree
-    /// (offline.md Phase 1).
+    /// when the API is unreachable, so the mount can still serve the cached tree.
     pub fn node_by_uid(&self, uid: &str) -> Result<Option<Node>> {
         let conn = self.read();
         let json: Option<String> = conn
             .query_row(
-                "SELECT node_json FROM nodes WHERE uid = ?1 AND node_json IS NOT NULL",
+                &format!(
+                    "SELECT {NODE_NOW} FROM nodes n LEFT JOIN nodes p ON p.lid = n.parent_lid
+                     WHERE n.uid = ?1 AND n.node_json IS NOT NULL"
+                ),
                 params![uid],
                 |r| r.get(0),
             )
@@ -544,15 +587,118 @@ impl Db {
         }
     }
 
+    /// The uid of the node with local id `lid`: `None` when it has no row, or
+    /// is not on Drive yet.
+    pub fn uid_of_lid(&self, lid: i64) -> Result<Option<String>> {
+        let conn = self.read();
+        Ok(conn
+            .query_row("SELECT uid FROM nodes WHERE lid = ?1", params![lid], |r| {
+                r.get(0)
+            })
+            .optional()?
+            .flatten())
+    }
+
+    /// The local id of the node stored under `uid`, or `None` when it has no
+    /// row. It stays the same for as long as the row exists, including when a
+    /// create lands and the row takes the uid Drive gave it: a node made on
+    /// this machine is found by its stand-in ([`local_uid`]) before and after.
+    pub fn lid_of(&self, uid: &str) -> Result<Option<i64>> {
+        node_lid(&self.read(), uid)
+    }
+
+    /// The local id of each node, in order, giving a row to each that has none.
+    ///
+    /// A new row is only a stub: it has no `node_json`, so no listing or search
+    /// returns it until the node is upserted, which the caller still owes. That
+    /// keeps this cheap enough to call with the inode lock held, which is
+    /// where an inode number is first needed.
+    pub fn lids_for(&self, nodes: &[&Node]) -> Result<Vec<i64>> {
+        let mut conn = self.conn.lock();
+        let tx = conn.transaction()?;
+        let mut lids = Vec::with_capacity(nodes.len());
+        {
+            let mut known = tx.prepare_cached("SELECT lid FROM nodes WHERE uid = ?1")?;
+            let mut stub = tx.prepare_cached(
+                "INSERT INTO nodes (uid, parent_uid, name, is_dir, mtime, trashed, parent_lid)
+                 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)",
+            )?;
+            for node in nodes {
+                let uid = node.uid.to_string();
+                let lid = match known.query_row(params![uid], |r| r.get(0)).optional()? {
+                    Some(lid) => lid,
+                    None => {
+                        let parent = node.parent_uid.as_ref().map(ToString::to_string);
+                        let parent_lid = match &parent {
+                            Some(parent) => node_lid(&tx, parent)?,
+                            None => None,
+                        };
+                        stub.execute(params![
+                            uid,
+                            parent,
+                            node.name,
+                            node.is_folder() as i64,
+                            node.modification_time,
+                            node.trashed as i64,
+                            parent_lid,
+                        ])?;
+                        let lid = tx.last_insert_rowid();
+                        adopt_children_tx(&tx, &uid, lid)?;
+                        lid
+                    }
+                };
+                lids.push(lid);
+            }
+        }
+        tx.commit()?;
+        Ok(lids)
+    }
+
+    /// Give a node being made on this machine its row under `parent_uid`, and
+    /// return its local id. The row goes by [`local_uid`] of that id until
+    /// the node lands.
+    ///
+    /// Like [`Db::lids_for`], only a stub: the caller upserts the node.
+    pub fn add_local_row(
+        &self,
+        parent_uid: &str,
+        name: &str,
+        is_dir: bool,
+        mtime: i64,
+    ) -> Result<i64> {
+        let mut conn = self.conn.lock();
+        let tx = conn.transaction()?;
+        tx.execute(
+            "INSERT INTO nodes (uid, parent_uid, name, is_dir, mtime, trashed, parent_lid)
+             VALUES (NULL, ?1, ?2, ?3, ?4, 0,
+                     COALESCE(?5, (SELECT lid FROM nodes WHERE uid = ?1)))",
+            params![
+                parent_uid,
+                name,
+                is_dir as i64,
+                mtime,
+                local_lid(parent_uid)
+            ],
+        )?;
+        let lid = tx.last_insert_rowid();
+        tx.execute(
+            "UPDATE nodes SET uid = ?2 WHERE lid = ?1",
+            params![lid, local_uid(lid)],
+        )?;
+        tx.commit()?;
+        Ok(lid)
+    }
+
     /// Read the persisted incremental-sync cursor (a `DriveEventId`), if any.
     /// The daemon resumes from this on restart instead of reseeding to the
     /// server head, so changes made while unmounted are still applied (P2).
     pub fn children_if_listed(&self, parent: &NodeUid) -> Result<Option<Vec<Node>>> {
         let conn = self.read();
+        let (key, folder) = row_key(&parent.to_string());
         let listed: Option<i64> = conn
             .query_row(
-                "SELECT listed FROM nodes WHERE uid = ?1",
-                params![parent.to_string()],
+                &format!("SELECT listed FROM nodes WHERE {key} = ?1"),
+                params![folder],
                 |r| r.get(0),
             )
             .optional()?;
@@ -568,11 +714,12 @@ impl Db {
     /// had: a listing dropped as stale may miss or keep a child.
     pub fn known_children(&self, parent: &NodeUid) -> Result<Vec<Node>> {
         let conn = self.read();
-        let mut stmt = conn.prepare(
-            "SELECT node_json FROM nodes
-             WHERE parent_uid = ?1 AND node_json IS NOT NULL AND trashed = 0",
-        )?;
-        let rows = stmt.query_map(params![parent.to_string()], |r| r.get::<_, String>(0))?;
+        let (key, parent) = parent_key(&conn, &parent.to_string())?;
+        let mut stmt = conn.prepare(&format!(
+            "SELECT {NODE_NOW} FROM nodes n LEFT JOIN nodes p ON p.lid = n.parent_lid
+             WHERE n.{key} = ?1 AND n.node_json IS NOT NULL AND n.trashed = 0"
+        ))?;
+        let rows = stmt.query_map(params![parent], |r| r.get::<_, String>(0))?;
         let mut out = Vec::new();
         for json in rows {
             out.push(serde_json::from_str(&json?)?);
@@ -580,6 +727,40 @@ impl Db {
         Ok(out)
     }
 
+    /// What a queued change does to `parent`'s listing, which Drive does not
+    /// show until it lands: the children made or moved in by a queued create,
+    /// mkdir or rename, as the DB holds them, and the nodes a queued rename
+    /// moves elsewhere.
+    ///
+    /// A listing read from Drive is laid over with these, or a folder listed
+    /// while a create in it is queued, after a restart say, loses the file
+    /// until the create lands (`docs/BUGS.md` B132).
+    pub fn queued_children(&self, parent: &NodeUid) -> Result<(Vec<Node>, HashSet<String>)> {
+        let conn = self.read();
+        let (key, parent) = parent_key(&conn, &parent.to_string())?;
+        let mut stmt = conn.prepare(&format!(
+            "SELECT {NODE_NOW} FROM nodes n LEFT JOIN nodes p ON p.lid = n.parent_lid
+             WHERE n.{key} = ?1 AND n.node_json IS NOT NULL AND n.trashed = 0
+               AND EXISTS (SELECT 1 FROM pending_op o
+                           WHERE (o.lid = n.lid OR o.uid = n.uid) AND o.kind IN (?2, ?3, ?4))"
+        ))?;
+        let rows = stmt.query_map(params![parent, OP_CREATE, OP_MKDIR, OP_RENAME], |r| {
+            r.get::<_, String>(0)
+        })?;
+        let mut here = Vec::new();
+        for json in rows {
+            here.push(serde_json::from_str(&json?)?);
+        }
+        let mut stmt = conn.prepare(&format!(
+            "SELECT DISTINCT n.uid FROM pending_op p JOIN nodes n ON n.lid = p.lid OR n.uid = p.uid
+             WHERE p.kind = ?2 AND n.{key} IS NOT ?1"
+        ))?;
+        let gone = stmt
+            .query_map(params![parent, OP_RENAME], |r| r.get::<_, String>(0))?
+            .collect::<std::result::Result<HashSet<_>, _>>()?;
+        Ok((here, gone))
+    }
+
     // --- Content-cache LRU index (P4) -------------------------------------
     //
     // Replaces the per-eviction `read_dir` scans in `ContentCache`. Each cached
@@ -599,9 +780,157 @@ struct PriorRow {
     trashed: bool,
 }
 
+/// [`Db::lid_of`] on `conn`, which may be a transaction.
+pub(super) fn node_lid(conn: &rusqlite::Connection, uid: &str) -> Result<Option<i64>> {
+    let row = match local_lid(uid) {
+        Some(lid) => conn.query_row("SELECT lid FROM nodes WHERE lid = ?1", params![lid], |r| {
+            r.get(0)
+        }),
+        None => conn.query_row("SELECT lid FROM nodes WHERE uid = ?1", params![uid], |r| {
+            r.get(0)
+        }),
+    };
+    Ok(row.optional()?)
+}
+
+/// The column and value that find `uid`'s own row. A stand-in is found by its
+/// local id: a create that lands gives the row the uid Drive made before the
+/// tree has it, and the tree asks by the stand-in until then (`docs/BUGS.md`
+/// B177).
+fn row_key(uid: &str) -> (&'static str, Value) {
+    match local_lid(uid) {
+        Some(lid) => ("lid", Value::Integer(lid)),
+        None => ("uid", Value::Text(uid.to_owned())),
+    }
+}
+
+/// The column and value a row names `parent` by: its local id when it has a
+/// row, which the children keep when it lands, or its uid when it has none,
+/// as a device folder's root does.
+fn parent_key(conn: &rusqlite::Connection, parent: &str) -> Result<(&'static str, Value)> {
+    Ok(match node_lid(conn, parent)? {
+        Some(lid) => ("parent_lid", Value::Integer(lid)),
+        None => ("parent_uid", Value::Text(parent.to_owned())),
+    })
+}
+
+/// `n.node_json` naming its parent as the parent's row `p`, joined by
+/// `n.parent_lid`, has it now. A folder that lands takes its real uid in its
+/// own row only, so a node stored below it still names the stand-in.
+const NODE_NOW: &str = "CASE WHEN p.uid IS NULL OR p.uid = n.parent_uid THEN n.node_json
+     ELSE json_set(n.node_json, '$.parent_uid', json_object(
+            'volume_id', substr(p.uid, 1, instr(p.uid, '~') - 1),
+            'link_id', substr(p.uid, instr(p.uid, '~') + 1))) END";
+
+/// Hand a drained placeholder's row to the real uid it landed as.
+///
+/// Nothing else is rewritten. The rows below it and the ops made inside it
+/// name it by its local id, which stays; what reads them for a uid takes the
+/// one the row has now ([`NODE_NOW`], `PARENT_NOW` in `ops.rs`).
+///
+/// Dropping the placeholder row and waiting for the server's copy of the real
+/// node left a window with no row for either uid. A queued child drained in
+/// that window found no authority for its parent, re-read it over the network
+/// and was deferred five seconds behind a folder that had just landed
+/// (`docs/BUGS.md` B120). The placeholder's own node, readdressed, stands in
+/// until the server's copy is upserted over it. A row the real uid already
+/// has is newer than the placeholder, so its node is kept, under the
+/// placeholder's `lid`: the node was known by that one first.
+pub(super) fn adopt_placeholder_row_tx(
+    tx: &Transaction<'_>,
+    local: &str,
+    real: &str,
+) -> Result<()> {
+    // A folder pinned before it landed stays pinned: the pin keyed by the
+    // placeholder was dropped with it (`docs/BUGS.md` B148).
+    tx.execute(
+        "UPDATE OR IGNORE pins SET uid = ?2 WHERE uid = ?1",
+        params![local, real],
+    )?;
+    tx.execute("DELETE FROM pins WHERE uid = ?1", params![local])?;
+    let row: Option<(i64, Option<String>)> = tx
+        .query_row(
+            "SELECT lid, node_json FROM nodes WHERE uid = ?1",
+            params![local],
+            |row| Ok((row.get(0)?, row.get(1)?)),
+        )
+        .optional()?;
+    // Ops queued before schema 39 have no `parent_lid`, nor do ops made
+    // under a placeholder that never had a row.
+    tx.execute(
+        "UPDATE pending_op SET parent_uid = ?2 WHERE parent_lid IS NULL AND parent_uid = ?1",
+        params![local, real],
+    )?;
+    let Some((lid, json)) = row else {
+        return Ok(());
+    };
+    let known: Option<(i64, Option<String>)> = tx
+        .query_row(
+            "SELECT lid, node_json FROM nodes WHERE uid = ?1",
+            params![real],
+            |row| Ok((row.get(0)?, row.get(1)?)),
+        )
+        .optional()?;
+    if let Some((known_lid, _)) = known {
+        // Ops queued against the row Drive listed now name the landing one.
+        tx.execute(
+            "UPDATE pending_op SET lid = ?2 WHERE lid = ?1",
+            params![known_lid, lid],
+        )?;
+        tx.execute(
+            "UPDATE pending_op SET parent_lid = ?2 WHERE parent_lid = ?1",
+            params![known_lid, lid],
+        )?;
+        tx.execute(
+            "UPDATE nodes SET parent_lid = ?2 WHERE parent_lid = ?1",
+            params![known_lid, lid],
+        )?;
+        tx.execute("DELETE FROM nodes WHERE lid = ?1", params![known_lid])?;
+        tx.execute("DELETE FROM nodes_fts WHERE rowid = ?1", params![known_lid])?;
+    }
+    tx.execute(
+        "UPDATE nodes SET uid = ?2 WHERE lid = ?1",
+        params![lid, real],
+    )?;
+    let json = known.and_then(|(_, known_json)| known_json).or(json);
+    let (Some(json), Some(real)) = (json, parse_node_uid(real)) else {
+        return Ok(());
+    };
+    let mut node: Node = serde_json::from_str(&json)?;
+    node.uid = real;
+    upsert_node_tx(tx, &node)
+}
+
+/// Link the rows that name `uid` as their parent to its new row `lid`: they
+/// were stored before it, or under a row of the same uid since dropped.
+fn adopt_children_tx(tx: &Transaction<'_>, uid: &str, lid: i64) -> Result<()> {
+    tx.execute(
+        "UPDATE nodes SET parent_lid = ?2 WHERE parent_uid = ?1 AND parent_lid IS NOT ?2",
+        params![uid, lid],
+    )?;
+    Ok(())
+}
+
 fn upsert_node_tx(tx: &Transaction<'_>, node: &Node) -> Result<()> {
-    let json = serde_json::to_string(node)?;
     let uid = node.uid.to_string();
+    // A node written under its stand-in after it landed is its row, which has
+    // the uid Drive gave it by now: written under the stand-in, it would bring
+    // the placeholder row back beside it.
+    if let Some(lid) = local_lid(&uid) {
+        let landed: Option<String> = tx
+            .query_row(
+                "SELECT uid FROM nodes WHERE lid = ?1 AND uid IS NOT ?2",
+                params![lid, uid],
+                |row| row.get(0),
+            )
+            .optional()?;
+        if let Some(real) = landed.as_deref().and_then(parse_node_uid) {
+            let mut node = node.clone();
+            node.uid = real;
+            return upsert_node_tx(tx, &node);
+        }
+    }
+    let json = serde_json::to_string(node)?;
     let parent_uid = node.parent_uid.as_ref().map(|u| u.to_string());
 
     let prior: Option<PriorRow> = tx
@@ -623,26 +952,34 @@ fn upsert_node_tx(tx: &Transaction<'_>, node: &Node) -> Result<()> {
     // where resolving it from scratch is a recursive walk to the root. A node
     // whose parent is not cached (a device folder's root lives in `device`, never
     // in `nodes`) starts a path of its own, which is what the walk did too.
-    let path = match &parent_uid {
-        None => String::new(),
+    let (parent_lid, path) = match &parent_uid {
+        None => (None, String::new()),
         Some(parent) => {
-            let parent_path: Option<Option<String>> = tx
-                .query_row(
-                    "SELECT path FROM nodes WHERE uid = ?1",
-                    params![parent],
-                    |row| row.get(0),
-                )
-                .optional()?;
-            join_path(parent_path.flatten().as_deref().unwrap_or(""), &node.name)
+            let parent_row: Option<(i64, Option<String>)> = match node_lid(tx, parent)? {
+                Some(lid) => tx
+                    .query_row(
+                        "SELECT lid, path FROM nodes WHERE lid = ?1",
+                        params![lid],
+                        |row| Ok((row.get(0)?, row.get(1)?)),
+                    )
+                    .optional()?,
+                None => None,
+            };
+            let (lid, parent_path) = parent_row.unzip();
+            (
+                lid,
+                join_path(parent_path.flatten().as_deref().unwrap_or(""), &node.name),
+            )
         }
     };
 
     tx.execute(
         "INSERT INTO nodes
-           (uid, parent_uid, name, is_dir, size, mtime, trashed, node_json, path)
-         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)
+           (uid, parent_uid, name, is_dir, size, mtime, trashed, node_json, path, parent_lid)
+         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10)
          ON CONFLICT(uid) DO UPDATE SET
            parent_uid = excluded.parent_uid,
+           parent_lid = excluded.parent_lid,
            name       = excluded.name,
            is_dir     = excluded.is_dir,
            size       = excluded.size,
@@ -660,6 +997,7 @@ fn upsert_node_tx(tx: &Transaction<'_>, node: &Node) -> Result<()> {
             node.trashed as i64,
             json,
             path,
+            parent_lid,
         ],
     )?;
     let rowid: i64 = tx.query_row(
@@ -667,6 +1005,9 @@ fn upsert_node_tx(tx: &Transaction<'_>, node: &Node) -> Result<()> {
         params![uid],
         |row| row.get(0),
     )?;
+    if prior.is_none() {
+        adopt_children_tx(tx, &uid, rowid)?;
+    }
 
     // FTS5 has no UPSERT, so the node's own row is always replaced.
     let indexable = node_is_indexable_tx(tx, &uid)?;
@@ -689,7 +1030,7 @@ fn upsert_node_tx(tx: &Transaction<'_>, node: &Node) -> Result<()> {
             || prior.trashed != node.trashed
     });
     if node.is_folder() && subtree_moved {
-        reindex_subtree_tx(tx, &uid, &path, indexable)?;
+        reindex_subtree_tx(tx, rowid, &path, indexable)?;
     }
     Ok(())
 }
@@ -710,22 +1051,22 @@ fn upsert_node_tx(tx: &Transaction<'_>, node: &Node) -> Result<()> {
 /// this deep.
 fn reindex_subtree_tx(
     tx: &Transaction<'_>,
-    folder: &str,
+    folder: i64,
     folder_path: &str,
     folder_indexable: bool,
 ) -> Result<()> {
     let descendants: Vec<(i64, String, bool)> = {
         let mut stmt = tx.prepare(
-            "WITH RECURSIVE sub(rowid, uid, name, path, blocked, depth) AS (
-               SELECT n.rowid, n.uid, n.name,
+            "WITH RECURSIVE sub(rowid, name, path, blocked, depth) AS (
+               SELECT n.rowid, n.name,
                       CASE WHEN ?2 = '' THEN n.name ELSE ?2 || '/' || n.name END,
                       n.trashed, 0
-                 FROM nodes n WHERE n.parent_uid = ?1
+                 FROM nodes n WHERE n.parent_lid = ?1
                UNION ALL
-               SELECT n.rowid, n.uid, n.name,
+               SELECT n.rowid, n.name,
                       sub.path || '/' || n.name,
                       MAX(sub.blocked, n.trashed), sub.depth + 1
-                 FROM nodes n JOIN sub ON n.parent_uid = sub.uid
+                 FROM nodes n JOIN sub ON n.parent_lid = sub.rowid
                 WHERE sub.depth < 256
              )
              SELECT rowid, path, blocked FROM sub",
@@ -750,8 +1091,10 @@ fn reindex_subtree_tx(
     let mut set_path = tx.prepare("UPDATE nodes SET path = ?2 WHERE rowid = ?1")?;
     let mut unindex = tx.prepare("DELETE FROM nodes_fts WHERE rowid = ?1")?;
     let mut index = tx.prepare(
+        // Not a stub row (`Db::lids_for`): it is indexed when its node is
+        // written.
         "INSERT INTO nodes_fts (rowid, name, path)
-         SELECT rowid, name, ?2 FROM nodes WHERE rowid = ?1",
+         SELECT rowid, name, ?2 FROM nodes WHERE rowid = ?1 AND node_json IS NOT NULL",
     )?;
     for (rowid, path, blocked) in descendants {
         set_path.execute(params![rowid, path])?;
@@ -764,7 +1107,8 @@ fn reindex_subtree_tx(
 }
 
 fn direct_child_uids_tx(tx: &Transaction<'_>, parent: &str) -> Result<Vec<String>> {
-    let mut stmt = tx.prepare("SELECT uid FROM nodes WHERE parent_uid = ?1")?;
+    let (key, parent) = parent_key(tx, parent)?;
+    let mut stmt = tx.prepare(&format!("SELECT uid FROM nodes WHERE {key} = ?1"))?;
     let rows = stmt.query_map([parent], |row| row.get::<_, String>(0))?;
     let mut uids = Vec::new();
     for row in rows {
@@ -789,14 +1133,14 @@ fn direct_child_uids_tx(tx: &Transaction<'_>, parent: &str) -> Result<Vec<String
 /// ends at one whose parent is a row we have already visited.
 fn node_is_indexable_tx(tx: &Transaction<'_>, uid: &str) -> Result<bool> {
     let indexable: i64 = tx.query_row(
-        "WITH RECURSIVE ancestors(uid, parent_uid, trashed, depth, path) AS (
-           SELECT uid, parent_uid, trashed, 0, char(31) || uid || char(31)
+        "WITH RECURSIVE ancestors(lid, parent_lid, trashed, depth, path) AS (
+           SELECT lid, parent_lid, trashed, 0, ',' || lid || ','
              FROM nodes WHERE uid = ?1
            UNION ALL
-           SELECT n.uid, n.parent_uid, n.trashed, a.depth + 1,
-                  a.path || n.uid || char(31)
-             FROM ancestors a JOIN nodes n ON n.uid = a.parent_uid
-            WHERE instr(a.path, char(31) || n.uid || char(31)) = 0
+           SELECT n.lid, n.parent_lid, n.trashed, a.depth + 1,
+                  a.path || n.lid || ','
+             FROM ancestors a JOIN nodes n ON n.lid = a.parent_lid
+            WHERE instr(a.path, ',' || n.lid || ',') = 0
          )
          SELECT CASE
            WHEN COUNT(*) = 0 THEN 0
@@ -804,8 +1148,7 @@ fn node_is_indexable_tx(tx: &Transaction<'_>, uid: &str) -> Result<bool> {
            WHEN EXISTS (
              SELECT 1 FROM ancestors a
               WHERE a.depth = (SELECT MAX(depth) FROM ancestors)
-                AND a.parent_uid IS NOT NULL
-                AND EXISTS (SELECT 1 FROM nodes p WHERE p.uid = a.parent_uid)
+                AND EXISTS (SELECT 1 FROM nodes p WHERE p.lid = a.parent_lid)
            ) THEN 0
            ELSE 1
          END
@@ -823,7 +1166,7 @@ fn tombstone_subtree_tx(tx: &Transaction<'_>, root_uid: &str) -> Result<()> {
                SELECT rowid, uid, node_json FROM nodes WHERE uid = ?1
                UNION
                SELECT n.rowid, n.uid, n.node_json FROM nodes n
-                 JOIN subtree s ON n.parent_uid = s.uid
+                 JOIN subtree s ON n.parent_lid = s.rowid
              )
              SELECT rowid, uid, node_json FROM subtree",
         )?;

crates/pdfs-core/src/db/pins.rs

@@ -64,11 +64,11 @@ impl Db {
     }
 
     /// Whether `uid` is pinned — directly, or because a strict ancestor folder
-    /// is pinned recursively. The ancestor check walks `parent_uid` to the root
+    /// is pinned recursively. The ancestor check walks `parent_lid` to the root
     /// via a CTE; a direct pin is honoured even when the node has no `nodes` row
     /// yet (e.g. a CLI that never hydrates the node cache).
     ///
-    /// The walk is depth-capped like [`super::utils::path_of`]: a `parent_uid`
+    /// The walk is depth-capped like [`super::utils::path_of`]: a parent
     /// cycle is corrupt data the API can hand us, and `UNION ALL` over one never
     /// terminates — while holding the daemon's only SQLite connection, on a path
     /// that runs per cached read.
@@ -85,11 +85,11 @@ impl Db {
         let anc: Option<i64> = conn
             .query_row(
                 &format!(
-                    "WITH RECURSIVE anc(uid, parent_uid, depth) AS (
-                       SELECT uid, parent_uid, 0 FROM nodes WHERE uid = ?1
+                    "WITH RECURSIVE anc(uid, parent_lid, depth) AS (
+                       SELECT uid, parent_lid, 0 FROM nodes WHERE uid = ?1
                        UNION ALL
-                       SELECT n.uid, n.parent_uid, anc.depth + 1
-                       FROM nodes n JOIN anc ON n.uid = anc.parent_uid
+                       SELECT n.uid, n.parent_lid, anc.depth + 1
+                       FROM nodes n JOIN anc ON n.lid = anc.parent_lid
                        WHERE anc.depth < {MAX_PATH_DEPTH}
                      )
                      SELECT 1 FROM anc a JOIN pins p ON p.uid = a.uid
@@ -109,10 +109,11 @@ impl Db {
     pub fn pinned_uids(&self) -> Result<Vec<String>> {
         let conn = self.read();
         let mut stmt = conn.prepare(
-            "WITH RECURSIVE sub(uid) AS (
-               SELECT uid FROM pins WHERE recursive = 1
+            "WITH RECURSIVE sub(uid, lid) AS (
+               SELECT p.uid, n.lid FROM pins p LEFT JOIN nodes n ON n.uid = p.uid
+                WHERE p.recursive = 1
                UNION
-               SELECT n.uid FROM nodes n JOIN sub ON n.parent_uid = sub.uid
+               SELECT n.uid, n.lid FROM nodes n JOIN sub ON n.parent_lid = sub.lid
              )
              SELECT uid FROM sub
              UNION
@@ -126,15 +127,16 @@ impl Db {
         Ok(out)
     }
 
-    /// Every descendant uid of `folder` (all depths), via a `parent_uid` CTE.
+    /// Every descendant uid of `folder` (all depths), via a `parent_lid` CTE.
     /// Used to evict a recursively-pinned subtree's cached blobs on unpin.
     pub fn descendants(&self, folder: &str) -> Result<Vec<String>> {
         let conn = self.read();
         let mut stmt = conn.prepare(
-            "WITH RECURSIVE sub(uid) AS (
-               SELECT uid FROM nodes WHERE parent_uid = ?1
+            "WITH RECURSIVE sub(uid, lid) AS (
+               SELECT c.uid, c.lid FROM nodes c JOIN nodes f ON c.parent_lid = f.lid
+                WHERE f.uid = ?1
                UNION
-               SELECT n.uid FROM nodes n JOIN sub ON n.parent_uid = sub.uid
+               SELECT n.uid, n.lid FROM nodes n JOIN sub ON n.parent_lid = sub.lid
              )
              SELECT uid FROM sub",
         )?;

crates/pdfs-core/src/db/share_access.rs

@@ -95,11 +95,27 @@ impl Db {
     /// Resolve a persisted node's effective access through its nearest recorded
     /// share root. `None` means the node itself is not persisted, which callers
     /// must not treat as owned: stale handles need to fail closed.
+    ///
+    /// A stand-in ([`local_uid`](super::local_uid)) finds its row by local id,
+    /// so it still does once its create has landed and the row has the uid
+    /// Drive gave it. The tree learns that uid a moment later, and a rename in
+    /// between was refused (`docs/BUGS.md` B174).
     pub fn effective_node_access(&self, uid: &NodeUid) -> Result<Option<Access>> {
         let conn = self.read();
+        let key = uid.to_string();
+        let key = match super::local_lid(&key) {
+            Some(lid) => conn
+                .query_row("SELECT uid FROM nodes WHERE lid = ?1", [lid], |row| {
+                    row.get::<_, Option<String>>(0)
+                })
+                .optional()?
+                .flatten()
+                .unwrap_or(key),
+            None => key,
+        };
         let exists: bool = conn.query_row(
-            "SELECT EXISTS(SELECT 1 FROM nodes WHERE uid = ?1)",
-            [uid.to_string()],
+            "SELECT EXISTS(SELECT 1 FROM nodes WHERE uid = ?1 AND node_json IS NOT NULL)",
+            [&key],
             |row| row.get(0),
         )?;
         if !exists {
@@ -107,25 +123,26 @@ impl Db {
         }
         let value = conn
             .query_row(
-                "WITH RECURSIVE ancestors(uid, parent_uid, depth, path) AS (
-                   SELECT uid, parent_uid, 0, char(31) || uid || char(31)
+                "WITH RECURSIVE ancestors(uid, parent_uid, parent_lid, depth, path) AS (
+                   SELECT uid, parent_uid, parent_lid, 0, char(31) || uid || char(31)
                      FROM nodes WHERE uid = ?1
                    UNION ALL
-                   SELECT a.parent_uid, n.parent_uid, a.depth + 1,
-                          a.path || a.parent_uid || char(31)
+                   SELECT COALESCE(n.uid, a.parent_uid), n.parent_uid, n.parent_lid,
+                          a.depth + 1,
+                          a.path || COALESCE(n.uid, a.parent_uid) || char(31)
                      FROM ancestors a
-                     LEFT JOIN nodes n ON n.uid = a.parent_uid
+                     LEFT JOIN nodes n ON n.lid = a.parent_lid
                     WHERE a.parent_uid IS NOT NULL
                       AND instr(
                             a.path,
-                            char(31) || a.parent_uid || char(31)
+                            char(31) || COALESCE(n.uid, a.parent_uid) || char(31)
                           ) = 0
                  )
                  SELECT sa.access
                    FROM ancestors a JOIN share_access sa ON sa.root_uid = a.uid
                   ORDER BY a.depth ASC
                   LIMIT 1",
-                [uid.to_string()],
+                [&key],
                 |row| row.get::<_, String>(0),
             )
             .optional()?;

crates/pdfs-core/src/db/sync.rs

@@ -25,8 +25,8 @@ pub struct StoredSyncFolder {
 }
 
 /// One per-file sync baseline row: what a path looked like on both sides at the
-/// last successful sync, so the next reconcile can tell which side changed
-/// (devices.md Phase 2). `remote_rev`/`remote_hash` hold the remote signature —
+/// last successful sync, so the next reconcile can tell which side changed.
+/// `remote_rev`/`remote_hash` hold the remote signature —
 /// its modification time and size as strings — since no cheap content hash is
 /// exposed; change detection is `(mtime, size)` on each side.
 #[derive(Clone, Debug, PartialEq)]
@@ -39,12 +39,18 @@ pub struct StoredSyncEntry {
     ///
     /// `local_mtime` alone cannot tell an edit that landed inside the same
     /// second as the last sync — and left the file the same length — from no
-    /// edit at all, so those never uploaded (bugs.md B25). `None` on a row
+    /// edit at all, so those never uploaded (`docs/BUGS.md` B25). `None` on a row
     /// written before schema 28, which the comparison reads as "compare whole
     /// seconds", so upgrading does not make an entire mirror look changed.
     pub local_mtime_ns: Option<i64>,
     pub remote_rev: Option<String>,
     pub remote_hash: Option<String>,
+    /// The id of the remote revision this row was synced at. A mirror upload
+    /// checks it before it supersedes what Drive holds, because another client
+    /// may have committed a revision since (`docs/BUGS.md` B249). `None` on a
+    /// row written before schema 44, or by a pass that did not learn it; the
+    /// check then falls back to `remote_rev` and `remote_hash`.
+    pub remote_revision_id: Option<String>,
 }
 
 impl Db {
@@ -139,6 +145,17 @@ impl Db {
         Ok(())
     }
 
+    /// Re-point a synced folder at the share that now holds its remote folder,
+    /// after the folder moved to another device without changing its uid.
+    pub fn sync_folder_set_share(&self, id: i64, share_id: &str) -> Result<()> {
+        let conn = self.conn.lock();
+        conn.execute(
+            "UPDATE sync_folder SET remote_share_id = ?2 WHERE id = ?1",
+            params![id, share_id],
+        )?;
+        Ok(())
+    }
+
     /// Queue (or, with `None`, withdraw) a mode the folder should move to once it
     /// is safe to switch.
     pub fn sync_folder_set_pending_mode(&self, id: i64, mode: Option<&str>) -> Result<()> {
@@ -177,7 +194,7 @@ impl Db {
         let conn = self.read();
         let mut stmt = conn.prepare(
             "SELECT rel_path, remote_uid, local_mtime, local_size, remote_rev, remote_hash,
-                    local_mtime_ns
+                    local_mtime_ns, remote_revision_id
              FROM sync_entry WHERE folder_id = ?1",
         )?;
         let rows = stmt.query_map(params![folder_id], |r| {
@@ -189,6 +206,7 @@ impl Db {
                 remote_rev: r.get(4)?,
                 remote_hash: r.get(5)?,
                 local_mtime_ns: r.get(6)?,
+                remote_revision_id: r.get(7)?,
             })
         })?;
         let mut map = HashMap::new();
@@ -227,15 +245,16 @@ impl Db {
         conn.execute(
             "INSERT INTO sync_entry
                (folder_id, rel_path, remote_uid, local_mtime, local_size, remote_rev,
-                remote_hash, local_mtime_ns)
-             VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)
+                remote_hash, local_mtime_ns, remote_revision_id)
+             VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)
              ON CONFLICT(folder_id, rel_path) DO UPDATE SET
-               remote_uid     = excluded.remote_uid,
-               local_mtime    = excluded.local_mtime,
-               local_size     = excluded.local_size,
-               remote_rev     = excluded.remote_rev,
-               remote_hash    = excluded.remote_hash,
-               local_mtime_ns = excluded.local_mtime_ns",
+               remote_uid         = excluded.remote_uid,
+               local_mtime        = excluded.local_mtime,
+               local_size         = excluded.local_size,
+               remote_rev         = excluded.remote_rev,
+               remote_hash        = excluded.remote_hash,
+               local_mtime_ns     = excluded.local_mtime_ns,
+               remote_revision_id = excluded.remote_revision_id",
             params![
                 folder_id,
                 e.rel_path,
@@ -245,6 +264,7 @@ impl Db {
                 e.remote_rev,
                 e.remote_hash,
                 e.local_mtime_ns,
+                e.remote_revision_id,
             ],
         )?;
         Ok(())
@@ -295,7 +315,7 @@ impl Db {
         {
             let mut select = tx.prepare(
                 "SELECT rel_path, remote_uid, local_mtime, local_size, remote_rev, remote_hash,
-                        local_mtime_ns
+                        local_mtime_ns, remote_revision_id
                    FROM sync_entry
                   WHERE folder_id = ?1
                     AND (rel_path = ?2 OR substr(rel_path, 1, length(?2) + 1) = ?2 || '/')",
@@ -310,6 +330,7 @@ impl Db {
                         remote_rev: r.get(4)?,
                         remote_hash: r.get(5)?,
                         local_mtime_ns: r.get(6)?,
+                        remote_revision_id: r.get(7)?,
                     })
                 })?
                 .collect::<rusqlite::Result<Vec<_>>>()?;
@@ -321,8 +342,8 @@ impl Db {
             let mut insert = tx.prepare(
                 "INSERT OR REPLACE INTO sync_entry
                    (folder_id, rel_path, remote_uid, local_mtime, local_size, remote_rev,
-                    remote_hash, local_mtime_ns)
-                 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)",
+                    remote_hash, local_mtime_ns, remote_revision_id)
+                 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)",
             )?;
             for row in rows {
                 let rel = format!("{to_rel}{}", &row.rel_path[from_rel.len()..]);
@@ -335,6 +356,7 @@ impl Db {
                     row.remote_rev,
                     row.remote_hash,
                     row.local_mtime_ns,
+                    row.remote_revision_id,
                 ])?;
             }
         }
@@ -345,7 +367,7 @@ impl Db {
     /// Drop the entire baseline for a folder. Used when flipping ondemand→mirror:
     /// the local tree was evicted, so the old baseline is stale and would make the
     /// next reconcile mistake "locally deleted" for "must re-download". Clearing it
-    /// leaves an empty baseline + full remote = pure download (devices.md P3).
+    /// leaves an empty baseline + full remote = pure download.
     pub fn sync_entries_clear(&self, folder_id: i64) -> Result<()> {
         let conn = self.conn.lock();
         conn.execute(

crates/pdfs-core/src/db/trash.rs

@@ -102,5 +102,5 @@ impl Db {
         Ok(seen)
     }
 
-    // ---- device sync (devices.md) -----------------------------------------
+    // ---- device sync -----------------------------------------
 }

crates/pdfs-core/src/db/utils.rs

@@ -72,18 +72,18 @@ pub(super) fn path_of(conn: &Connection, uid: &str) -> Result<String> {
     }
 }
 
-/// Resolve a path by walking `parent_uid` to the root via a recursive CTE.
+/// Resolve a path by walking `parent_lid` to the root via a recursive CTE.
 ///
-/// A cycle in `parent_uid` is corrupt data the API can still hand us, and
+/// A cycle in the parents is corrupt data the API can still hand us, and
 /// `UNION ALL` over one never terminates — the walk is therefore depth-capped
 /// and returns the truncated path rather than hanging the caller.
 pub(super) fn walk_path_of(conn: &Connection, uid: &str) -> Result<String> {
     let mut stmt = conn.prepare(&format!(
-        "WITH RECURSIVE anc(uid, parent_uid, name, depth) AS (
-           SELECT uid, parent_uid, name, 0 FROM nodes WHERE uid = ?1
+        "WITH RECURSIVE anc(parent_lid, parent_uid, name, depth) AS (
+           SELECT parent_lid, parent_uid, name, 0 FROM nodes WHERE uid = ?1
            UNION ALL
-           SELECT n.uid, n.parent_uid, n.name, anc.depth + 1
-           FROM nodes n JOIN anc ON n.uid = anc.parent_uid
+           SELECT n.parent_lid, n.parent_uid, n.name, anc.depth + 1
+           FROM nodes n JOIN anc ON n.lid = anc.parent_lid
            WHERE anc.depth < {MAX_PATH_DEPTH}
          )
          SELECT name, parent_uid FROM anc ORDER BY depth DESC"

crates/pdfs-core/src/error.rs

@@ -32,6 +32,16 @@ pub enum Error {
     #[error("saved session can no longer unlock your keys — run `pdfs login` again")]
     ReloginRequired,
 
+    /// The account has a separate mailbox password that has not been entered
+    /// since login, so its keys cannot be unlocked. The fix is
+    /// [`auth::unlock`](crate::auth::unlock), not a new login.
+    #[error("account is locked — enter the mailbox password with `pdfs unlock`")]
+    Locked,
+
+    /// The mailbox password was checked against the account and is wrong.
+    #[error("that mailbox password does not unlock your account")]
+    WrongMailboxPassword,
+
     /// The login was gated behind human verification. Not a failure the user can
     /// fix by retrying: the challenge has to be solved and the login restarted
     /// with the resulting token (see [`auth::login_verified`](crate::auth::login_verified)).
@@ -144,17 +154,17 @@ impl CoreError {
     /// through the boxes the drain deals in, where the concrete type survives
     /// but the static one does not.
     ///
-    /// A failure that is not an API response at all — a transport error, a
-    /// timeout, a TLS failure — is what being offline looks like from here, so
-    /// it classifies as [`ErrorKind::Offline`] rather than
-    /// [`ErrorKind::Remote`]: the request never reached Proton, and telling the
-    /// user their connection is down beats telling them the server refused.
+    /// A transport error, a timeout or a TLS failure is what being offline
+    /// looks like from here, so it classifies as [`ErrorKind::Offline`] rather
+    /// than [`ErrorKind::Remote`]: the request never reached Proton, and
+    /// telling the user their connection is down beats telling them the
+    /// server refused. The SDK's other failures say what went wrong instead
+    /// (see [`proton_kind`]).
     pub fn from_api(e: &(dyn std::error::Error + 'static), what: &str) -> Self {
         let kind = match e.downcast_ref::<proton_sdk::ProtonError>() {
-            Some(proton_sdk::ProtonError::Api(api)) => api_kind(api.code),
-            // A `ProtonError` that is not an `Api` variant never reached the
-            // API; so does anything that is not a `ProtonError` at all.
-            _ => ErrorKind::Offline,
+            Some(proton) => proton_kind(proton),
+            // Not the SDK's at all: a timeout around the call, or the socket.
+            None => ErrorKind::Offline,
         };
         Self::new(kind, format!("{what}: {e}"))
     }
@@ -199,18 +209,38 @@ impl From<serde_json::Error> for CoreError {
 impl From<Error> for CoreError {
     fn from(e: Error) -> Self {
         let kind = match &e {
-            Error::NotLoggedIn | Error::ReloginRequired | Error::HumanVerificationRequired(_) => {
-                ErrorKind::Denied
-            }
-            Error::Proton(proton_sdk::ProtonError::Api(api)) => api_kind(api.code),
-            // A `ProtonError` that never reached the API is a transport failure.
-            Error::Proton(_) => ErrorKind::Offline,
+            Error::NotLoggedIn
+            | Error::ReloginRequired
+            | Error::Locked
+            | Error::WrongMailboxPassword
+            | Error::HumanVerificationRequired(_) => ErrorKind::Denied,
+            Error::Proton(proton) => proton_kind(proton),
             _ => ErrorKind::Internal,
         };
         Self::new(kind, e.to_string())
     }
 }
 
+/// What a failed SDK call means to a front-end.
+///
+/// Only a transport failure is the connection. The rest happened on this
+/// machine, and calling them "offline" sent the user to check a network that
+/// worked (issue #38: a photo upload on an account without a photo library
+/// read "You're offline").
+fn proton_kind(e: &proton_sdk::ProtonError) -> ErrorKind {
+    use proton_sdk::ProtonError as P;
+    match e {
+        P::Api(api) => api_kind(api.code),
+        P::Transport(_) => ErrorKind::Offline,
+        // Proton answered, but not with anything this client can read.
+        P::Serialization(_) => ErrorKind::Remote,
+        // The SDK refused the call before sending it, such as an upload to a
+        // photo library the account does not have.
+        P::InvalidOperation(_) => ErrorKind::Invalid,
+        P::Crypto(_) | P::KeysLocked => ErrorKind::Internal,
+    }
+}
+
 /// What an API response code means to a front-end.
 ///
 /// The grouping is by *what the user can do about it*, which is what
@@ -266,6 +296,32 @@ fn api_kind(code: proton_sdk::api::ResponseCode) -> ErrorKind {
     }
 }
 
+/// Whether `e` says the session itself is gone: its refresh token was refused,
+/// or the account was deleted or disabled.
+///
+/// Nothing but a new login helps then, and no retry will ever succeed, so a
+/// caller must not take it for a lost connection and wait for it to come back
+/// (issue #35: a revoked session was shown as "offline" for good).
+pub fn session_revoked(e: &proton_sdk::ProtonError) -> bool {
+    use proton_sdk::api::ResponseCode as C;
+    match e {
+        proton_sdk::ProtonError::Api(api) => {
+            api.is_invalid_refresh_token()
+                || matches!(api.code, C::AccountDeleted | C::AccountDisabled)
+        }
+        _ => false,
+    }
+}
+
+/// Whether `e` is Proton's temporary block on a sign-in (code 2028).
+///
+/// Its message says the app version is no longer supported, which is not what
+/// happened: the release is current and only waiting helps (issues #28, #39).
+/// A front-end must say that instead of passing the message through.
+pub fn sign_in_blocked(e: &proton_sdk::ProtonError) -> bool {
+    matches!(e, proton_sdk::ProtonError::Api(api) if api.code == proton_sdk::api::ResponseCode::Blocked)
+}
+
 /// The result every request-serving method in the daemon returns.
 pub type CoreResult<T> = std::result::Result<T, CoreError>;
 
@@ -297,6 +353,25 @@ mod tests {
         assert_eq!(api_kind(C::ProtonDriveUnknown), ErrorKind::Remote);
     }
 
+    #[test]
+    fn only_a_refused_refresh_or_a_closed_account_revokes_the_session() {
+        assert!(session_revoked(&api(C::InvalidRefreshToken)));
+        assert!(session_revoked(&api(C::AccountDeleted)));
+        assert!(session_revoked(&api(C::AccountDisabled)));
+        // One file the account may not touch says nothing about the session.
+        assert!(!session_revoked(&api(C::Forbidden)));
+        assert!(!session_revoked(&api(C::Timeout)));
+        assert!(!session_revoked(&ProtonError::KeysLocked));
+    }
+
+    #[test]
+    fn only_code_2028_is_a_blocked_sign_in() {
+        assert!(sign_in_blocked(&api(C::Blocked)));
+        assert!(!sign_in_blocked(&api(C::OutdatedApp)));
+        assert!(!sign_in_blocked(&api(C::TooManyRequests)));
+        assert!(!sign_in_blocked(&ProtonError::KeysLocked));
+    }
+
     /// The regression this whole pass exists to prevent: before it, every SDK
     /// failure was hardcoded to `Remote`, so a 403 asked the user to retry a
     /// request that could never succeed.
@@ -327,6 +402,18 @@ mod tests {
         assert_eq!(CoreError::from_api(&io, "list").kind, ErrorKind::Offline);
     }
 
+    /// Issue #38: the SDK refused a photo upload before sending it, and the
+    /// app said "You're offline" while every other call went through.
+    #[test]
+    fn a_call_the_sdk_refuses_to_send_is_not_offline() {
+        let refused = ProtonError::invalid_operation("account has no photos volume");
+        let e = CoreError::from_api(&refused, "upload photo failed");
+        assert_eq!(e.kind, ErrorKind::Invalid);
+        assert!(e.message.ends_with("account has no photos volume"));
+        let e: CoreError = Error::Proton(ProtonError::KeysLocked).into();
+        assert_ne!(e.kind, ErrorKind::Offline);
+    }
+
     /// `Error` is the plumbing type; converting it must classify as sharply as
     /// the direct path, or the two disagree about the same failure.
     #[test]

crates/pdfs-core/src/exiftime.rs

@@ -0,0 +1,133 @@
+//! When a photo was taken, as its own EXIF tags say.
+//!
+//! The fallback for a photo nothing else dates: a Takeout photo without a
+//! sidecar or a date in its name, and a photo uploaded from the app. Without
+//! it the first was filed under the moment of the import and the second under
+//! the file's modification time, which a copy resets.
+
+use std::io::{BufRead, Seek};
+use std::path::Path;
+
+use crate::takeout::days_from_civil;
+
+/// The capture time in the EXIF of the file at `path`, in epoch seconds.
+pub fn capture_time_of(path: &Path) -> Option<i64> {
+    let file = std::fs::File::open(path).ok()?;
+    capture_time(&mut std::io::BufReader::new(file))
+}
+
+/// The capture time in the EXIF `reader` holds: `DateTimeOriginal`, then
+/// `DateTimeDigitized`, each adjusted by its `OffsetTime…` tag when the camera
+/// wrote one. Without an offset the time is read as UTC, as a date in a file
+/// name is (`takeout::capture_time_from_name`).
+pub fn capture_time(reader: &mut (impl BufRead + Seek)) -> Option<i64> {
+    let exif = exif::Reader::new().read_from_container(reader).ok()?;
+    let ascii = |tag: exif::Tag| -> Option<String> {
+        let field = exif.get_field(tag, exif::In::PRIMARY)?;
+        match &field.value {
+            exif::Value::Ascii(parts) => parts.first().map(|part| {
+                String::from_utf8_lossy(part)
+                    .trim_matches('\0')
+                    .trim()
+                    .to_string()
+            }),
+            _ => None,
+        }
+    };
+    [
+        (exif::Tag::DateTimeOriginal, exif::Tag::OffsetTimeOriginal),
+        (exif::Tag::DateTimeDigitized, exif::Tag::OffsetTimeDigitized),
+    ]
+    .into_iter()
+    .find_map(|(time, offset)| {
+        let local = parse_exif_time(&ascii(time)?)?;
+        let offset = ascii(offset).and_then(|o| parse_offset(&o)).unwrap_or(0);
+        Some(local - offset)
+    })
+}
+
+/// `YYYY:MM:DD HH:MM:SS` as epoch seconds, read as UTC. `None` for the
+/// all-zero or blank value cameras write when they do not know.
+fn parse_exif_time(text: &str) -> Option<i64> {
+    let bytes = text.as_bytes();
+    if bytes.len() < 19 || bytes[4] != b':' || bytes[7] != b':' || bytes[13] != b':' {
+        return None;
+    }
+    let number = |range: std::ops::Range<usize>| text.get(range)?.parse::<i64>().ok();
+    let (year, month, day) = (number(0..4)?, number(5..7)?, number(8..10)?);
+    let (hour, minute, second) = (number(11..13)?, number(14..16)?, number(17..19)?);
+    if !(1800..=9999).contains(&year)
+        || !(1..=12).contains(&month)
+        || !(1..=31).contains(&day)
+        || hour > 23
+        || minute > 59
+        || second > 60
+    {
+        return None;
+    }
+    Some(days_from_civil(year, month, day) * 86_400 + hour * 3600 + minute * 60 + second)
+}
+
+/// `+HH:MM` or `-HH:MM` as seconds east of UTC.
+fn parse_offset(text: &str) -> Option<i64> {
+    let sign = match text.as_bytes().first()? {
+        b'+' => 1,
+        b'-' => -1,
+        _ => return None,
+    };
+    let (hours, minutes) = text.get(1..)?.split_once(':')?;
+    let (hours, minutes) = (hours.parse::<i64>().ok()?, minutes.parse::<i64>().ok()?);
+    (hours <= 14 && minutes < 60).then_some(sign * (hours * 3600 + minutes * 60))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn an_exif_time_reads_as_utc_and_its_offset_moves_it() {
+        // 2023-06-01 12:00:00 UTC.
+        let noon = 1_685_620_800;
+        assert_eq!(parse_exif_time("2023:06:01 12:00:00"), Some(noon));
+        assert_eq!(parse_offset("+02:00"), Some(7200));
+        assert_eq!(parse_offset("-05:30"), Some(-19_800));
+        assert_eq!(
+            parse_exif_time("2023:06:01 14:00:00").map(|t| t - parse_offset("+02:00").unwrap()),
+            Some(noon)
+        );
+    }
+
+    #[test]
+    fn an_unknown_exif_time_is_no_time() {
+        assert_eq!(parse_exif_time("0000:00:00 00:00:00"), None);
+        assert_eq!(parse_exif_time("    :  :     :  :  "), None);
+        assert_eq!(parse_exif_time(""), None);
+        assert_eq!(parse_offset("02:00"), None);
+    }
+
+    #[test]
+    fn a_photo_is_dated_by_its_original_time_and_offset() {
+        let ascii = |tag, text: &str| exif::Field {
+            tag,
+            ifd_num: exif::In::PRIMARY,
+            value: exif::Value::Ascii(vec![text.as_bytes().to_vec()]),
+        };
+        let taken = ascii(exif::Tag::DateTimeOriginal, "2023:06:01 14:00:00");
+        let offset = ascii(exif::Tag::OffsetTimeOriginal, "+02:00");
+        let digitized = ascii(exif::Tag::DateTimeDigitized, "2024:01:01 00:00:00");
+        let mut writer = exif::experimental::Writer::new();
+        writer.push_field(&taken);
+        writer.push_field(&offset);
+        writer.push_field(&digitized);
+        let mut tiff = std::io::Cursor::new(Vec::new());
+        writer.write(&mut tiff, false).unwrap();
+        tiff.set_position(0);
+        assert_eq!(capture_time(&mut tiff), Some(1_685_620_800));
+    }
+
+    #[test]
+    fn a_file_without_exif_has_no_capture_time() {
+        let mut png = std::io::Cursor::new(b"\x89PNG\r\n\x1a\n".to_vec());
+        assert_eq!(capture_time(&mut png), None);
+    }
+}

crates/pdfs-core/src/kernelkey.rs

@@ -0,0 +1,233 @@
+//! A secret held in the Linux kernel keyring, for as long as the user is logged in.
+//!
+//! This is where the key passphrases of a two-password account live by default:
+//! the mailbox password is never stored, and the secrets derived from it are
+//! kept in kernel memory — not on disk, not in the Secret Service — and vanish
+//! when the user's last session ends or the machine reboots. Both the daemon and
+//! `pdfs unlock` reach the same entry because it hangs off the *user* keyring.
+//! It is also where session tokens wait while the Secret Service refuses them
+//! ([`UNSAVED_TOKENS`]), so they outlive the process that holds them.
+//!
+//! Kernel keys are not paged to swap, are invisible to other users, and are
+//! wiped by [`clear`] (`KEYCTL_REVOKE`), which makes them a better home than a
+//! process's heap. Processes of the same user can still read them, exactly as
+//! they could ptrace the daemon: this protects against disk, backup and other
+//! users, not against code already running as you.
+//!
+//! The keyring may be unavailable (a container, a kernel built without
+//! `CONFIG_KEYS`); every operation then reports it as an error and the caller
+//! falls back to asking again, never to storing the secret somewhere weaker.
+
+use std::io;
+
+use zeroize::Zeroizing;
+
+/// One secret in the user keyring, by its description. Descriptions are
+/// namespaced so they cannot collide with another program's keys.
+pub struct Key {
+    description: &'static [u8],
+}
+
+/// The account's key passphrases (see the module docs).
+#[cfg(not(test))]
+pub const PASSPHRASES: Key = Key {
+    description: b"pdfs:key-passphrases\0",
+};
+/// Tests must never touch a real unlock.
+#[cfg(test)]
+pub const PASSPHRASES: Key = Key {
+    description: b"pdfs:key-passphrases:test\0",
+};
+
+/// Session tokens the Secret Service refused to store, until it takes them.
+/// A refresh token held only in a process's memory dies with the process.
+#[cfg(not(test))]
+pub const UNSAVED_TOKENS: Key = Key {
+    description: b"pdfs:unsaved-tokens\0",
+};
+#[cfg(test)]
+pub const UNSAVED_TOKENS: Key = Key {
+    description: b"pdfs:unsaved-tokens:test\0",
+};
+
+const KEY_TYPE: &[u8] = b"user\0";
+
+const KEY_SPEC_USER_KEYRING: i32 = -4;
+const KEYCTL_REVOKE: libc::c_long = 3;
+const KEYCTL_SETPERM: libc::c_long = 5;
+const KEYCTL_SEARCH: libc::c_long = 10;
+const KEYCTL_READ: libc::c_long = 11;
+
+/// Possessor and owner may view, read, write, search, link and set attributes;
+/// group and others get nothing.
+///
+/// A new key's default grants the owner only *view*, and read access to the
+/// possessor. A process possesses the user keyring only when its session
+/// keyring links to it, which a systemd user service or a container does not
+/// guarantee — so with the default, the daemon could store a key it then
+/// cannot read back. The owner is the same user that could ptrace the daemon
+/// anyway, so granting it read access gives up nothing.
+const PERM_OWNER_AND_POSSESSOR: u32 = 0x3f3f_0000;
+
+fn last_error<T>() -> io::Result<T> {
+    Err(io::Error::last_os_error())
+}
+
+fn find(description: &[u8]) -> io::Result<Option<libc::c_long>> {
+    // SAFETY: both strings are NUL-terminated and outlive the call.
+    let id = unsafe {
+        libc::syscall(
+            libc::SYS_keyctl,
+            KEYCTL_SEARCH,
+            KEY_SPEC_USER_KEYRING,
+            KEY_TYPE.as_ptr(),
+            description.as_ptr(),
+            0,
+        )
+    };
+    if id >= 0 {
+        return Ok(Some(id));
+    }
+    let err = io::Error::last_os_error();
+    match err.raw_os_error() {
+        // ENOKEY: not stored. EKEYREVOKED/EKEYEXPIRED: stored once, now gone.
+        Some(libc::ENOKEY | libc::EKEYREVOKED | libc::EKEYEXPIRED) => Ok(None),
+        _ => Err(err),
+    }
+}
+
+/// Stop this process from being core-dumped or ptraced by an unprivileged
+/// process of the same user, so the secrets in its memory stay out of crash
+/// reports. Call once at start of a long-lived process that holds them.
+pub fn forbid_dumps() {
+    // SAFETY: `PR_SET_DUMPABLE` takes plain integers and only affects this process.
+    let rc = unsafe { libc::prctl(libc::PR_SET_DUMPABLE, 0, 0, 0, 0) };
+    if rc != 0 {
+        tracing::warn!(error = %io::Error::last_os_error(), "could not mark the process non-dumpable");
+    }
+}
+
+impl Key {
+    /// Store `secret`, replacing any earlier one.
+    pub fn store(&self, secret: &[u8]) -> io::Result<()> {
+        // SAFETY: strings are NUL-terminated; the payload pointer/length pair
+        // describes `secret`, which outlives the call.
+        let id = unsafe {
+            libc::syscall(
+                libc::SYS_add_key,
+                KEY_TYPE.as_ptr(),
+                self.description.as_ptr(),
+                secret.as_ptr(),
+                secret.len(),
+                KEY_SPEC_USER_KEYRING,
+            )
+        };
+        if id < 0 {
+            return last_error();
+        }
+        // SAFETY: plain integer arguments.
+        let rc = unsafe {
+            libc::syscall(
+                libc::SYS_keyctl,
+                KEYCTL_SETPERM,
+                id,
+                PERM_OWNER_AND_POSSESSOR,
+            )
+        };
+        if rc < 0 {
+            // A key whose permissions are unknown is not one to leave behind.
+            let err = io::Error::last_os_error();
+            let _ = self.clear();
+            return Err(err);
+        }
+        Ok(())
+    }
+
+    /// Read the stored secret, or `None` when there is none.
+    pub fn load(&self) -> io::Result<Option<Zeroizing<Vec<u8>>>> {
+        let Some(id) = find(self.description)? else {
+            return Ok(None);
+        };
+        // Size first, then read; retry if the key was replaced in between.
+        for _ in 0..3 {
+            // SAFETY: a null buffer asks the kernel only for the payload length.
+            let len = unsafe {
+                libc::syscall(
+                    libc::SYS_keyctl,
+                    KEYCTL_READ,
+                    id,
+                    std::ptr::null_mut::<u8>(),
+                    0usize,
+                )
+            };
+            if len < 0 {
+                return match io::Error::last_os_error().raw_os_error() {
+                    Some(libc::ENOKEY | libc::EKEYREVOKED | libc::EKEYEXPIRED) => Ok(None),
+                    _ => last_error(),
+                };
+            }
+            let mut buf = Zeroizing::new(vec![0u8; len as usize]);
+            // SAFETY: `buf` is `len` writable bytes.
+            let read = unsafe {
+                libc::syscall(
+                    libc::SYS_keyctl,
+                    KEYCTL_READ,
+                    id,
+                    buf.as_mut_ptr(),
+                    buf.len(),
+                )
+            };
+            if read < 0 {
+                return last_error();
+            }
+            if read as usize <= buf.len() {
+                buf.truncate(read as usize);
+                return Ok(Some(buf));
+            }
+        }
+        Err(io::Error::other("the key changed while it was being read"))
+    }
+
+    /// Remove the stored secret. Succeeds when there is none.
+    pub fn clear(&self) -> io::Result<()> {
+        let Some(id) = find(self.description)? else {
+            return Ok(());
+        };
+        // SAFETY: plain integer arguments.
+        let rc = unsafe { libc::syscall(libc::SYS_keyctl, KEYCTL_REVOKE, id) };
+        if rc < 0 {
+            return match io::Error::last_os_error().raw_os_error() {
+                Some(libc::ENOKEY | libc::EKEYREVOKED) => Ok(()),
+                _ => last_error(),
+            };
+        }
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // The kernel keyring is process-wide state and a sandbox may not offer it,
+    // so one test covers the whole round trip and skips when it is unavailable.
+    #[test]
+    fn stored_secret_round_trips_and_clears() {
+        if PASSPHRASES.store(b"probe").is_err() {
+            eprintln!("kernel keyring unavailable; skipping");
+            return;
+        }
+        let saved = PASSPHRASES
+            .load()
+            .unwrap()
+            .expect("stored secret is readable");
+        assert_eq!(saved.as_slice(), b"probe");
+
+        PASSPHRASES.store(b"replaced").unwrap();
+        assert_eq!(PASSPHRASES.load().unwrap().unwrap().as_slice(), b"replaced");
+
+        PASSPHRASES.clear().unwrap();
+        assert!(PASSPHRASES.load().unwrap().is_none());
+        PASSPHRASES.clear().unwrap();
+    }
+}

crates/pdfs-core/src/keycheck.rs

@@ -0,0 +1,294 @@
+//! Trace the key chain that opens My Files, for `pdfs diagnose`.
+//!
+//! The daemon only says "missing key" when the My Files share does not open
+//! (#40). This walks the chain the other way and names the link that breaks:
+//! the share's passphrase is encrypted to an address key, whose token is
+//! encrypted to an account key, which opens with the stored passphrase. Every
+//! finding holds key IDs and flags only, never key material, so the output is
+//! safe to post in an issue.
+
+use proton_sdk::account::{AddressKeyReport, KeyReport, UserKeyReport};
+use proton_sdk::ids::AddressId;
+
+use crate::auth;
+use crate::error::Result;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Level {
+    Ok,
+    Warn,
+    Fail,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Finding {
+    pub level: Level,
+    pub label: String,
+    pub detail: String,
+}
+
+/// The address and recipients of the My Files share passphrase, or why they
+/// could not be read.
+pub type ShareRecipients = std::result::Result<(AddressId, Vec<Option<String>>), String>;
+
+/// Resume the stored session and ask Proton for the account's keys and the
+/// My Files share. Fails when there is no session, the keys are locked, or
+/// Proton cannot be reached; reading the share is allowed to fail on its own.
+///
+/// The session's tokens are the daemon's too. A refresh here spends the
+/// refresh token the daemon holds, which it recovers from by resuming the
+/// stored session (see [`auth::stored_session_is_newer`]).
+pub async fn run() -> Result<(KeyReport, ShareRecipients)> {
+    let (client, _session) = auth::resume_client().await?;
+    let report = client.account().key_report().await?;
+    let share = client
+        .my_files_share_recipients()
+        .await
+        .map_err(|e| e.to_string());
+    Ok((report, share))
+}
+
+/// One finding per key, then one for the My Files share.
+pub fn findings(report: &KeyReport, share: &ShareRecipients) -> Vec<Finding> {
+    let mut findings = Vec::new();
+    for key in &report.user_keys {
+        findings.push(user_key_finding(key));
+    }
+    for address in &report.addresses {
+        for key in &address.keys {
+            findings.push(address_key_finding(report, &address.email, key));
+        }
+    }
+    findings.push(share_finding(report, share));
+    findings
+}
+
+fn user_key_finding(key: &UserKeyReport) -> Finding {
+    let label = format!("account key {}", short(key.id.as_str()));
+    let (level, detail) = match (key.active, key.unlocks) {
+        (true, true) => (Level::Ok, "opens".to_string()),
+        (true, false) => (
+            Level::Fail,
+            format!(
+                "does not open: {}",
+                key.error.as_deref().unwrap_or("unknown")
+            ),
+        ),
+        (false, true) => (Level::Ok, "inactive, opens with your password".to_string()),
+        (false, false) => (Level::Ok, "inactive, does not open".to_string()),
+    };
+    Finding {
+        level,
+        label,
+        detail: with_primary(key.primary, detail),
+    }
+}
+
+fn address_key_finding(report: &KeyReport, email: &str, key: &AddressKeyReport) -> Finding {
+    let label = format!("{email} key {}", short(key.id.as_str()));
+    let (level, detail) = if !key.active {
+        (Level::Ok, "inactive, not used".to_string())
+    } else if key.unlocks {
+        (Level::Ok, "opens".to_string())
+    } else {
+        // A non-primary key matters only for what was encrypted to it; the
+        // share finding says whether My Files is.
+        let level = if key.primary {
+            Level::Fail
+        } else {
+            Level::Warn
+        };
+        (level, format!("does not open: {}", why_closed(report, key)))
+    };
+    Finding {
+        level,
+        label,
+        detail: with_primary(key.primary, detail),
+    }
+}
+
+/// Why an active address key does not open, named by the account key its
+/// token was meant for when the token has one.
+fn why_closed(report: &KeyReport, key: &AddressKeyReport) -> String {
+    let error = key.error.as_deref().unwrap_or("unknown");
+    let Some(recipients) = &key.token_recipients else {
+        return error.to_string();
+    };
+    let named: Vec<&str> = recipients.iter().flatten().map(String::as_str).collect();
+    if let Some(user_key) = named.iter().find_map(|r| report.user_key_named(r)) {
+        let id = short(user_key.id.as_str());
+        return match (user_key.active, user_key.unlocks) {
+            (false, true) => {
+                format!(
+                    "its token is for inactive account key {id}, which opens with your password"
+                )
+            }
+            (false, false) => {
+                format!("its token is for inactive account key {id}, which does not open either")
+            }
+            (true, false) => format!("its token is for account key {id}, which does not open"),
+            // The token opened; the key itself refused its passphrase.
+            (true, true) => error.to_string(),
+        };
+    }
+    match named.first() {
+        Some(recipient) => {
+            format!("its token is for key {recipient}, which is none of your account keys")
+        }
+        None if recipients.is_empty() => error.to_string(),
+        None => "its token does not name the key it is for".to_string(),
+    }
+}
+
+fn share_finding(report: &KeyReport, share: &ShareRecipients) -> Finding {
+    let label = "My Files share".to_string();
+    let (level, detail) = match share {
+        Err(e) => (Level::Warn, format!("could not be read: {e}")),
+        Ok((address_id, recipients)) => {
+            let named: Vec<&str> = recipients.iter().flatten().map(String::as_str).collect();
+            match named.iter().find_map(|r| report.address_key_named(r)) {
+                Some((address, key)) => {
+                    let name = format!("{} key {}", address.email, short(key.id.as_str()));
+                    if key.unlocks {
+                        (Level::Ok, format!("encrypted to {name}, which opens"))
+                    } else {
+                        (
+                            Level::Fail,
+                            format!("encrypted to {name}, which does not open"),
+                        )
+                    }
+                }
+                None => (
+                    Level::Fail,
+                    match named.first() {
+                        Some(recipient) => format!(
+                            "encrypted to key {recipient}, which is none of the keys of address {address_id}"
+                        ),
+                        None => "its passphrase does not name the key it is for".to_string(),
+                    },
+                ),
+            }
+        }
+    };
+    Finding {
+        level,
+        label,
+        detail,
+    }
+}
+
+fn with_primary(primary: bool, detail: String) -> String {
+    if primary {
+        format!("primary, {detail}")
+    } else {
+        detail
+    }
+}
+
+/// The start of a Proton key ID: enough to tell keys apart and to find them
+/// in the daemon log, which prints the whole ID.
+fn short(id: &str) -> String {
+    match id.char_indices().nth(8) {
+        Some((end, _)) => format!("{}…", &id[..end]),
+        None => id.to_string(),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use proton_sdk::account::AddressReport;
+    use proton_sdk::ids::{AddressKeyId, UserKeyId};
+
+    fn user_key(id: &str, active: bool, unlocks: bool, pgp: &str) -> UserKeyReport {
+        UserKeyReport {
+            id: UserKeyId::new(id),
+            primary: active,
+            active,
+            unlocks,
+            error: (!unlocks).then(|| "unlock: wrong passphrase".to_string()),
+            key_ids: vec![pgp.to_string()],
+        }
+    }
+
+    fn address_key(id: &str, primary: bool, token_for: &str, pgp: &str) -> AddressKeyReport {
+        AddressKeyReport {
+            id: AddressKeyId::new(id),
+            primary,
+            active: true,
+            token_recipients: Some(vec![Some(token_for.to_string())]),
+            unlocks: token_for == "u1",
+            error: (token_for != "u1").then(|| "token: failed to decrypt: missing key".to_string()),
+            key_ids: vec![pgp.to_string()],
+        }
+    }
+
+    /// The account in #40, as far as its log shows: the primary address key
+    /// opens, an older one does not, and My Files is encrypted to the older one.
+    fn report(stranded_token_for: &str) -> KeyReport {
+        KeyReport {
+            user_keys: vec![
+                user_key("UserKeyOne-123", true, true, "u1"),
+                user_key("UserKeyTwo-456", false, true, "u2"),
+            ],
+            addresses: vec![AddressReport {
+                id: AddressId::new("address-1"),
+                email: "user@proton.me".to_string(),
+                keys: vec![
+                    address_key("AddrKeyNew-789", true, "u1", "a1"),
+                    address_key("AddrKeyOld-000", false, stranded_token_for, "a2"),
+                ],
+            }],
+        }
+    }
+
+    #[test]
+    fn a_stranded_address_key_is_traced_to_the_inactive_account_key() {
+        let report = report("u2");
+        let share = Ok((AddressId::new("address-1"), vec![Some("a2".to_string())]));
+        let findings = findings(&report, &share);
+
+        assert_eq!(findings[0].detail, "primary, opens");
+        assert_eq!(findings[1].detail, "inactive, opens with your password");
+        assert_eq!(findings[2].level, Level::Ok);
+        assert_eq!(findings[3].level, Level::Warn);
+        assert_eq!(findings[3].label, "user@proton.me key AddrKeyO…");
+        assert_eq!(
+            findings[3].detail,
+            "does not open: its token is for inactive account key UserKeyT…, which opens with your password"
+        );
+        assert_eq!(findings[4].level, Level::Fail);
+        assert_eq!(
+            findings[4].detail,
+            "encrypted to user@proton.me key AddrKeyO…, which does not open"
+        );
+    }
+
+    #[test]
+    fn a_token_for_a_key_the_account_does_not_list_says_so() {
+        let report = report("ffff");
+        let detail = &findings(&report, &Err("offline".to_string()))[3].detail;
+        assert_eq!(
+            detail,
+            "does not open: its token is for key ffff, which is none of your account keys"
+        );
+    }
+
+    #[test]
+    fn a_share_that_opens_and_one_that_cannot_be_read() {
+        let report = report("u2");
+        let open = Ok((AddressId::new("address-1"), vec![Some("a1".to_string())]));
+        let last = findings(&report, &open).pop().unwrap();
+        assert_eq!(last.level, Level::Ok);
+        assert_eq!(
+            last.detail,
+            "encrypted to user@proton.me key AddrKeyN…, which opens"
+        );
+
+        let last = findings(&report, &Err("offline".to_string()))
+            .pop()
+            .unwrap();
+        assert_eq!(last.level, Level::Warn);
+        assert_eq!(last.detail, "could not be read: offline");
+    }
+}

crates/pdfs-core/src/lib.rs

@@ -10,6 +10,9 @@ pub mod config;
 pub mod control;
 pub mod db;
 pub mod error;
+pub mod exiftime;
+pub mod kernelkey;
+pub mod keycheck;
 pub mod localindex;
 pub mod menu;
 pub mod mounts;
@@ -22,8 +25,10 @@ pub mod service;
 pub mod shell;
 pub mod similar;
 pub mod syncignore;
+pub mod syncroot;
 pub mod takeout;
 pub mod tray;
+pub mod update;
 
 pub use access::{Access, access_for, perm_bits};
 pub use error::{CoreError, CoreResult, Error, Result};

crates/pdfs-core/src/localindex.rs

@@ -42,7 +42,7 @@ const SKIP_PATH_SUFFIXES: &[&str] = &["go/pkg/mod"];
 
 /// Hard cap on indexed entries, so a pathological home directory cannot grow the
 /// database without bound. Reaching it stops the walk early.
-const MAX_ENTRIES: usize = 400_000;
+pub const MAX_ENTRIES: usize = 400_000;
 
 /// Rows handed to the sink at a time. Large enough that the per-transaction cost
 /// amortises, small enough that the writer lock is released often (FUSE

crates/pdfs-core/src/opener.rs

@@ -189,11 +189,21 @@ fn spawn(argv: &[String], path: &Path) {
         .stderr(Stdio::null())
         .process_group(0)
         .spawn();
-    if let Err(e) = spawned {
-        tracing::error!(command = ?argv, "open failed: {e}");
+    match spawned {
+        Ok(child) => reap(child),
+        Err(e) => tracing::error!(command = ?argv, "open failed: {e}"),
     }
 }
 
+/// Wait for `child` on a thread of its own. A child nobody waits for stays a
+/// zombie for as long as its parent lives, which for the app and the tray is
+/// the whole session.
+pub fn reap(mut child: std::process::Child) {
+    std::thread::spawn(move || {
+        let _ = child.wait();
+    });
+}
+
 /// [`open`] with the policy from the user's `config.json`, read once per
 /// process. For callers that open the occasional path and have no reason to
 /// carry a policy around; long-lived windows should hold their own copy.
@@ -472,6 +482,21 @@ fn glob_match(pattern: &str, name: &str) -> bool {
 mod tests {
     use super::*;
 
+    #[test]
+    fn a_reaped_child_does_not_stay_a_zombie() {
+        let child = std::process::Command::new("true").spawn().unwrap();
+        let proc_entry = std::path::PathBuf::from(format!("/proc/{}", child.id()));
+        reap(child);
+        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(5);
+        while proc_entry.exists() && std::time::Instant::now() < deadline {
+            std::thread::sleep(std::time::Duration::from_millis(10));
+        }
+        assert!(
+            !proc_entry.exists(),
+            "the child is still in the process table"
+        );
+    }
+
     fn rule(patterns: &[&str], command: &[&str], terminal: bool) -> OpenRule {
         OpenRule {
             patterns: patterns.iter().map(|p| (*p).to_string()).collect(),

crates/pdfs-core/src/profile.rs

@@ -1,4 +1,4 @@
-//! The machine profile that travels with a device (features.md 5.3).
+//! The machine profile that travels with a device.
 //!
 //! Sync folder mappings, pins, and the settings that shape them live in
 //! `cache.db` and `config.json` — both on the local disk. When that disk dies,
@@ -19,9 +19,31 @@ use serde::{Deserialize, Serialize};
 
 use crate::mounts::MountMode;
 
-/// File name of the profile.
+/// File name of the profile clients before 3.5.0 wrote, one per device.
+///
+/// Read, never written: two computers sharing a device each overwrote the
+/// other's. See [`profile_file_name`].
 pub const PROFILE_FILE_NAME: &str = "profile.json";
 
+/// File name of one machine's profile: `profile-<machine id>.json`.
+///
+/// One per machine, because several computers may sync into one device, and
+/// each describes its own arrangement. A single shared file went to whichever
+/// computer saved last.
+pub fn profile_file_name(machine_id: &str) -> String {
+    format!("profile-{machine_id}.json")
+}
+
+/// Whether `name` is a profile: [`PROFILE_FILE_NAME`] or one machine's
+/// [`profile_file_name`].
+pub fn is_profile_file_name(name: &str) -> bool {
+    name == PROFILE_FILE_NAME
+        || name
+            .strip_prefix("profile-")
+            .and_then(|rest| rest.strip_suffix(".json"))
+            .is_some_and(|id| !id.is_empty() && id.bytes().all(|b| b.is_ascii_alphanumeric()))
+}
+
 /// Folder, directly under the device root, that holds the profile.
 ///
 /// The API refuses `Cannot create file at the root of a device` (HTTP 422), so
@@ -74,6 +96,10 @@ pub struct Profile {
     /// Hostname of the machine that wrote it, so a restore prompt can say
     /// *"restore settings from laptop-xyz?"* rather than quoting a uid.
     pub hostname: String,
+    /// The writing machine's id, as in its [`profile_file_name`]. `None` in a
+    /// profile written before 3.5.0.
+    #[serde(default)]
+    pub machine_id: Option<String>,
     /// When it was written, epoch seconds.
     pub saved_at: i64,
     #[serde(default)]
@@ -92,6 +118,25 @@ pub struct Profile {
     pub mountpoint: Option<String>,
 }
 
+/// The saved arrangement of the folder with uid `remote_uid`, from the
+/// profiles of every computer that syncs the device.
+///
+/// The profile of the machine named `hostname` wins, since it describes this
+/// computer; otherwise the most recently saved one that has the folder.
+pub fn saved_folder<'a>(
+    profiles: &'a [Profile],
+    remote_uid: &str,
+    hostname: &str,
+) -> Option<&'a ProfileFolder> {
+    let holding = |p: &&'a Profile| p.folders.iter().any(|f| f.remote_uid == remote_uid);
+    let profile = profiles
+        .iter()
+        .filter(holding)
+        .find(|p| p.hostname == hostname)
+        .or_else(|| profiles.iter().filter(holding).max_by_key(|p| p.saved_at))?;
+    profile.folders.iter().find(|f| f.remote_uid == remote_uid)
+}
+
 impl Profile {
     /// Parse a profile document, refusing one written by a newer client.
     pub fn parse(bytes: &[u8]) -> Result<Self, String> {
@@ -122,6 +167,7 @@ mod tests {
             version: PROFILE_VERSION,
             device_uid: "dev-1".to_string(),
             hostname: "laptop-xyz".to_string(),
+            machine_id: Some("0123456789abcdef0123456789abcdef".to_string()),
             saved_at: 1_700_000_000,
             folders: vec![ProfileFolder {
                 remote_uid: "vol~link".to_string(),
@@ -219,6 +265,52 @@ mod tests {
         assert!(p.ignore_patterns.is_none());
     }
 
+    #[test]
+    fn a_profile_name_is_the_legacy_one_or_one_per_machine() {
+        assert!(is_profile_file_name(PROFILE_FILE_NAME));
+        let name = profile_file_name("0123456789abcdef0123456789abcdef");
+        assert_eq!(name, "profile-0123456789abcdef0123456789abcdef.json");
+        assert!(is_profile_file_name(&name));
+        assert!(!is_profile_file_name("profile-.json"));
+        assert!(!is_profile_file_name("profile-a/b.json"));
+        assert!(!is_profile_file_name("profile (1).json"));
+        assert!(!is_profile_file_name("notes.json"));
+    }
+
+    /// A profile written before 3.5.0 has no machine id and still parses.
+    #[test]
+    fn a_profile_without_a_machine_id_parses() {
+        let json = br#"{"version":1,"device_uid":"d","hostname":"h","saved_at":0}"#;
+        assert_eq!(Profile::parse(json).unwrap().machine_id, None);
+    }
+
+    /// Several computers sync one device, each with its own profile. This
+    /// computer's own wins, then the newest that has the folder.
+    #[test]
+    fn the_saved_folder_comes_from_this_computer_then_the_newest_profile() {
+        let profile = |hostname: &str, saved_at: i64, path: &str| Profile {
+            hostname: hostname.to_string(),
+            saved_at,
+            folders: vec![ProfileFolder {
+                remote_uid: "vol~docs".to_string(),
+                local_path: path.to_string(),
+                mode: MountMode::Mirror,
+            }],
+            ..sample()
+        };
+        let profiles = vec![
+            profile("desktop", 10, "/home/a/Docs"),
+            profile("laptop", 5, "/home/b/Docs"),
+            profile("old", 1, "/home/c/Docs"),
+        ];
+        let path =
+            |host: &str| saved_folder(&profiles, "vol~docs", host).map(|f| f.local_path.as_str());
+        assert_eq!(path("laptop"), Some("/home/b/Docs"));
+        assert_eq!(path("new-machine"), Some("/home/a/Docs"));
+        assert_eq!(saved_folder(&profiles, "vol~other", "laptop"), None);
+        assert_eq!(saved_folder(&[], "vol~docs", "laptop"), None);
+    }
+
     #[test]
     fn future_version_is_refused() {
         let mut p = sample();

crates/pdfs-core/src/service.rs

@@ -55,9 +55,10 @@ fn systemctl_query(args: &[&str]) -> bool {
 /// keyring checks). `--now` is a no-op on an active unit, so the daemon would
 /// keep sleeping and the mount would not appear until the next poll fired.
 /// Restarting makes the new session take effect immediately, and starts the
-/// unit when it is not running at all.
+/// unit when it is not running at all. `reenable` for the reason given on
+/// [`enable`].
 pub fn enable_start() -> bool {
-    let enabled = systemctl(&["enable"]);
+    let enabled = systemctl(&["reenable"]);
     systemctl(&["restart"]) && enabled
 }
 
@@ -97,8 +98,14 @@ pub fn is_enabled() -> bool {
 /// Enable the service so it auto-starts on future logins, without necessarily
 /// starting it now beyond what `enable` does. Used by the Settings "Start on
 /// login" switch; pairs with [`disable`](disable).
+///
+/// `reenable` rather than `enable`: older installs were enabled
+/// into `default.target.wants`, and a plain `enable` would add the new
+/// `graphical-session.target.wants` link while leaving the old one to start the
+/// unit too early. `reenable` drops every existing link and recreates them from
+/// the current `[Install]` section.
 pub fn enable() -> bool {
-    systemctl(&["enable"])
+    systemctl(&["reenable"])
 }
 
 /// Disable auto-start without stopping the running mount. Used by the Settings

crates/pdfs-core/src/shell.rs

@@ -23,6 +23,11 @@ const SCRIPTS: [(&str, &str); 2] = [
 /// `NAUTILUS_SCRIPT_SELECTED_FILE_PATHS`; the positional args carry the same
 /// selection when the script runs on a local (non-URI) folder, so we prefer the
 /// environment and fall back to `"$@"` for the Nemo/Caja variants.
+///
+/// The `--` keeps a file named like an option, such as `--json`, a path. A
+/// name with a newline in it still arrives split in two from Nautilus, whose
+/// list is newline-separated; `pdfs` then fails on both halves, which touches
+/// nothing.
 fn script_body(subcommand: &str) -> String {
     format!(
         "#!/bin/sh\n\
@@ -41,7 +46,7 @@ fn script_body(subcommand: &str) -> String {
          \n\
          printf '%s' \"$paths\" | while IFS= read -r path; do\n\
          \x20   [ -n \"$path\" ] || continue\n\
-         \x20   pdfs {subcommand} \"$path\" || exit 1\n\
+         \x20   pdfs {subcommand} -- \"$path\" || exit 1\n\
          done\n"
     )
 }
@@ -95,3 +100,13 @@ fn write_scripts(dir: &PathBuf) -> io::Result<()> {
     tracing::debug!("installed file-manager scripts in {dir:?}");
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::script_body;
+
+    #[test]
+    fn the_script_ends_options_before_each_path() {
+        assert!(script_body("pin").contains(r#"pdfs pin -- "$path""#));
+    }
+}

crates/pdfs-core/src/syncignore.rs

@@ -1,4 +1,4 @@
-//! Selective-sync ignore rules for mirror folders (features.md 1.1).
+//! Selective-sync ignore rules for mirror folders.
 //!
 //! A mirror folder otherwise uploads every path beneath its root, which for a
 //! project directory means `node_modules/`, `.git/`, and `target/` — quota

crates/pdfs-core/src/syncroot.rs

@@ -0,0 +1,209 @@
+//! Which local folders may become a sync root.
+//!
+//! A mirror uploads everything under its root and deletes what Drive deleted,
+//! so a root that holds more than the user meant is dangerous. `$HOME` takes
+//! the decrypted content cache, `cache.db` and `~/.ssh` up to Drive, and walks
+//! into the mount, which downloads the whole Drive only to upload it again.
+//! Every place a root is added or restored goes through [`problem`].
+
+use std::path::{Component, Path, PathBuf};
+
+use crate::config::{AppConfig, AppDirs};
+
+/// The paths a sync root must stay clear of.
+#[derive(Debug, Clone, Default)]
+pub struct Reserved {
+    /// The user's home folder. A root may sit inside it, not be it or above it.
+    pub home: Option<PathBuf>,
+    /// The Proton Drive mount.
+    pub mountpoint: Option<PathBuf>,
+    /// This app's own configuration, state and cache folders.
+    pub app_dirs: Vec<PathBuf>,
+}
+
+impl Reserved {
+    /// The reserved paths of this user and `config`, resolved like a root.
+    pub fn current(config: &AppConfig) -> Self {
+        let Ok(dirs) = AppDirs::new() else {
+            return Self::default();
+        };
+        let resolved = |path: PathBuf| resolve(&path).unwrap_or(path);
+        let mut app_dirs = vec![dirs.state_dir(), dirs.cache_dir()];
+        if let Some(config_dir) = dirs.config_path().parent() {
+            app_dirs.push(config_dir.to_path_buf());
+        }
+        Self {
+            home: dirs.home_dir().map(resolved),
+            mountpoint: Some(resolved(dirs.resolved_mountpoint(config))),
+            app_dirs: app_dirs.into_iter().map(resolved).collect(),
+        }
+    }
+}
+
+/// `path` as a root is compared: absolute, with symlinks resolved as far as the
+/// path exists. A folder a restore is about to create does not exist yet, so
+/// the part past the deepest existing folder is kept as written.
+///
+/// A `..` is refused rather than resolved: before a symlink it means something
+/// else than after it, and a path recorded on another machine has no business
+/// holding one.
+pub fn resolve(path: &Path) -> Result<PathBuf, String> {
+    if !path.is_absolute() {
+        return Err(format!("{} is not an absolute path", path.display()));
+    }
+    if path.components().any(|c| c == Component::ParentDir) {
+        return Err(format!("{} goes up with `..`", path.display()));
+    }
+    let mut existing = path.to_path_buf();
+    let mut rest = Vec::new();
+    loop {
+        match existing.canonicalize() {
+            Ok(canonical) => {
+                return Ok(rest
+                    .into_iter()
+                    .rev()
+                    .fold(canonical, |path: PathBuf, part| path.join(part)));
+            }
+            Err(_) => {
+                let Some(name) = existing.file_name().map(|n| n.to_os_string()) else {
+                    return Ok(path.to_path_buf());
+                };
+                rest.push(name);
+                if !existing.pop() {
+                    return Ok(path.to_path_buf());
+                }
+            }
+        }
+    }
+}
+
+/// Why `root` cannot be synced, or `None` when it can. `root` is resolved
+/// ([`resolve`]); `others` are the roots already synced.
+pub fn problem(root: &Path, others: &[PathBuf], reserved: &Reserved) -> Option<String> {
+    let shown = root.display();
+    if root.parent().is_none() {
+        return Some(format!("{shown} is the root of the file system"));
+    }
+    if let Some(home) = &reserved.home {
+        if root == home {
+            return Some(format!(
+                "{shown} is your home folder; pick a folder inside it"
+            ));
+        }
+        if home.starts_with(root) {
+            return Some(format!("{shown} holds your home folder"));
+        }
+    }
+    if let Some(mountpoint) = &reserved.mountpoint
+        && overlaps(root, mountpoint)
+    {
+        return Some(format!(
+            "{shown} overlaps the Proton Drive folder {}",
+            mountpoint.display()
+        ));
+    }
+    if let Some(dir) = reserved.app_dirs.iter().find(|dir| overlaps(root, dir)) {
+        return Some(format!(
+            "{shown} overlaps this app's own data in {}",
+            dir.display()
+        ));
+    }
+    if others.iter().any(|other| other == root) {
+        return Some(format!("{shown} is already synced"));
+    }
+    if let Some(other) = others.iter().find(|other| overlaps(root, other)) {
+        return Some(format!(
+            "{shown} overlaps the synced folder {}",
+            other.display()
+        ));
+    }
+    None
+}
+
+/// Whether one of `a` and `b` is the other or inside it.
+fn overlaps(a: &Path, b: &Path) -> bool {
+    a.starts_with(b) || b.starts_with(a)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn reserved() -> Reserved {
+        Reserved {
+            home: Some("/home/u".into()),
+            mountpoint: Some("/home/u/ProtonDrive".into()),
+            app_dirs: vec![
+                "/home/u/.local/state/proton-drive-linux".into(),
+                "/home/u/.cache/proton-drive-linux".into(),
+                "/home/u/.config/proton-drive-linux".into(),
+            ],
+        }
+    }
+
+    fn refused(root: &str, others: &[&str]) -> bool {
+        let others: Vec<PathBuf> = others.iter().map(PathBuf::from).collect();
+        problem(Path::new(root), &others, &reserved()).is_some()
+    }
+
+    #[test]
+    fn a_folder_inside_home_can_be_synced() {
+        assert!(!refused("/home/u/Documents", &[]));
+        assert!(!refused("/home/u/Pictures", &["/home/u/Documents"]));
+        assert!(!refused("/mnt/data/photos", &[]));
+    }
+
+    #[test]
+    fn the_file_system_root_home_and_its_parents_are_refused() {
+        assert!(refused("/", &[]));
+        assert!(refused("/home/u", &[]));
+        assert!(refused("/home", &[]));
+    }
+
+    #[test]
+    fn the_mount_and_the_apps_own_data_are_refused_either_way_round() {
+        assert!(refused("/home/u/ProtonDrive", &[]));
+        assert!(refused("/home/u/ProtonDrive/Documents", &[]));
+        assert!(refused("/home/u/.cache", &[]));
+        assert!(refused(
+            "/home/u/.local/state/proton-drive-linux/staging",
+            &[]
+        ));
+        assert!(refused("/home/u/.config", &[]));
+    }
+
+    #[test]
+    fn a_root_inside_or_around_another_root_is_refused() {
+        assert!(refused("/home/u/Documents", &["/home/u/Documents"]));
+        assert!(refused("/home/u/Documents/Work", &["/home/u/Documents"]));
+        assert!(refused("/home/u/stuff", &["/home/u/stuff/Documents"]));
+        // A shared prefix of characters is not a shared folder.
+        assert!(!refused("/home/u/Documents2", &["/home/u/Documents"]));
+    }
+
+    #[test]
+    fn a_path_that_goes_up_or_is_relative_does_not_resolve() {
+        assert!(resolve(Path::new("/home/u/../../etc")).is_err());
+        assert!(resolve(Path::new("Documents")).is_err());
+    }
+
+    #[test]
+    fn a_folder_still_to_be_created_resolves_under_its_existing_parent() {
+        let base = std::env::temp_dir().join(format!("pdfs-syncroot-{}", std::process::id()));
+        std::fs::create_dir_all(&base).unwrap();
+        let canonical = base.canonicalize().unwrap();
+        assert_eq!(
+            resolve(&base.join("new/inner")).unwrap(),
+            canonical.join("new/inner")
+        );
+        let link = base.join("link");
+        let _ = std::fs::remove_file(&link);
+        std::os::unix::fs::symlink(&canonical, &link).unwrap();
+        assert_eq!(
+            resolve(&link.join("later")).unwrap(),
+            canonical.join("later"),
+            "a symlink is followed to where it points"
+        );
+        std::fs::remove_dir_all(&base).unwrap();
+    }
+}

crates/pdfs-core/src/takeout.rs

@@ -346,6 +346,11 @@ fn assemble(entries: Vec<RawEntry>, sidecars: &HashMap<String, Vec<u8>>) -> Take
             .insert(file.to_string(), body);
     }
 
+    let indexes: HashMap<&str, SidecarIndex<'_>> = per_folder_sidecars
+        .iter()
+        .map(|(folder, in_folder)| (folder.as_str(), SidecarIndex::new(in_folder)))
+        .collect();
+
     let mut scan = TakeoutScan::default();
     let mut seen_albums: HashMap<String, ()> = HashMap::new();
 
@@ -364,9 +369,13 @@ fn assemble(entries: Vec<RawEntry>, sidecars: &HashMap<String, Vec<u8>>) -> Take
             continue;
         };
 
-        let sidecar = per_folder_sidecars
-            .get(&folder)
-            .and_then(|in_folder| find_sidecar(&file_name, in_folder))
+        let found = indexes
+            .get(folder.as_str())
+            .and_then(|index| find_sidecar(&file_name, index));
+        // An edited copy keeps its own name: the title is its original's.
+        let title_is_ours = found.is_some_and(|((rule, _), _)| rule != EDITED_COPY);
+        let sidecar = found
+            .map(|(_, body)| body)
             .and_then(|body| serde_json::from_slice::<PhotoSidecar>(body).ok())
             .unwrap_or_default();
 
@@ -388,6 +397,7 @@ fn assemble(entries: Vec<RawEntry>, sidecars: &HashMap<String, Vec<u8>>) -> Take
         let name = sidecar
             .title
             .as_deref()
+            .filter(|_| title_is_ours)
             .map(str::trim)
             .filter(|title| !title.is_empty() && same_extension(title, &file_name))
             .unwrap_or(&file_name)
@@ -598,7 +608,7 @@ pub fn capture_time_from_name(name: &str) -> Option<i64> {
 
 /// Days between 1970-01-01 and a proleptic-Gregorian date (Howard Hinnant's
 /// `days_from_civil`). Avoids pulling a date crate in for one conversion.
-fn days_from_civil(year: i64, month: i64, day: i64) -> i64 {
+pub(crate) fn days_from_civil(year: i64, month: i64, day: i64) -> i64 {
     let year = year - i64::from(month <= 2);
     let era = if year >= 0 { year } else { year - 399 } / 400;
     let year_of_era = year - era * 400;
@@ -627,17 +637,106 @@ fn swap_duplicate_marker(file_name: &str) -> Option<String> {
     Some(format!("{}{}{}", &file_name[..marker_start], tail, marker))
 }
 
-/// Find the sidecar belonging to `file_name` among the JSON files of its folder.
+/// How long Google lets a sidecar's file name get, `.json` included. A longer
+/// one is cut, into its suffix first and then into the photo name.
+const SIDECAR_NAME_CAP: usize = 51;
+
+/// The rank [`sidecar_rank`] gives an edited copy that shares its original's
+/// sidecar. Its date is the original's, but its name is its own.
+const EDITED_COPY: u8 = 4;
+
+/// The sidecars of one folder by their `.json`-stripped stem, so a photo is
+/// ranked only against those that can match it.
+///
+/// Every rule in [`sidecar_rank`] needs the stem to start with a prefix of the
+/// photo name that the name itself determines, and a sorted map finds the
+/// stems with a given prefix as one range. Ranking every photo against every
+/// sidecar instead took 27 s for a folder of 10,000 photos.
+struct SidecarIndex<'a> {
+    by_stem: BTreeMap<&'a str, Vec<(&'a str, &'a Vec<u8>)>>,
+}
+
+impl<'a> SidecarIndex<'a> {
+    fn new(in_folder: &'a BTreeMap<String, &'a Vec<u8>>) -> Self {
+        let mut by_stem: BTreeMap<&'a str, Vec<(&'a str, &'a Vec<u8>)>> = BTreeMap::new();
+        for (name, body) in in_folder {
+            by_stem
+                .entry(strip_json_suffix(name))
+                .or_default()
+                .push((name.as_str(), *body));
+        }
+        Self { by_stem }
+    }
+
+    /// Add every sidecar whose stem starts with `prefix` to `out`.
+    fn starting_with(&self, prefix: &str, out: &mut BTreeMap<&'a str, &'a Vec<u8>>) {
+        let from = (
+            std::ops::Bound::Included(prefix),
+            std::ops::Bound::Unbounded,
+        );
+        for (stem, sidecars) in self.by_stem.range::<str, _>(from) {
+            if !stem.starts_with(prefix) {
+                break;
+            }
+            out.extend(sidecars.iter().copied());
+        }
+    }
+
+    /// Add every sidecar whose stem is `head`, or starts with `head` and a `.`:
+    /// those that have `head` as a boundary ([`suffix_boundaries`]).
+    fn bounded_by(&self, head: &str, out: &mut BTreeMap<&'a str, &'a Vec<u8>>) {
+        if let Some(sidecars) = self.by_stem.get(head) {
+            out.extend(sidecars.iter().copied());
+        }
+        self.starting_with(&format!("{head}."), out);
+    }
+
+    /// Every sidecar [`sidecar_rank`] could match `file_name` to, by name. A
+    /// superset: each one is still ranked.
+    fn candidates(&self, file_name: &str) -> BTreeMap<&'a str, &'a Vec<u8>> {
+        let mut out = BTreeMap::new();
+        // Rules 0 and 2: the stem starts with the name, or with its swapped form.
+        self.starting_with(file_name, &mut out);
+        if let Some(swapped) = swap_duplicate_marker(file_name) {
+            self.starting_with(&swapped, &mut out);
+        }
+        // Rule 1: the stem of `A(N).B` starts with `A.B(N)`, so with `A.`.
+        for (paren, _) in file_name.match_indices('(') {
+            self.starting_with(&format!("{}.", &file_name[..paren]), &mut out);
+        }
+        // Rule 3: a boundary of the stem is a prefix of the name.
+        for end in file_name
+            .char_indices()
+            .map(|(index, _)| index)
+            .skip(1)
+            .chain([file_name.len()])
+        {
+            self.bounded_by(&file_name[..end], &mut out);
+        }
+        // Rule 4: `<original>-<word>.<ext>` has `<original>.<ext>` as a boundary.
+        if let Some((_, extension)) = file_name.rsplit_once('.') {
+            for (dash, _) in file_name.match_indices('-') {
+                self.bounded_by(&format!("{}.{extension}", &file_name[..dash]), &mut out);
+            }
+        }
+        out
+    }
+}
+
+/// Find the sidecar belonging to `file_name` among the JSON files of its folder,
+/// with the rank it matched at.
 ///
 /// Tried in order of confidence: the exact name, the `(N)`-swapped name, an
-/// unknown trailing suffix, then a prefix match for the case where truncation
-/// cut into the photo name itself. The best-ranked candidate in the folder wins.
+/// unknown trailing suffix, a prefix match for the case where truncation cut
+/// into the photo name itself, and last an edited copy's original. The
+/// best-ranked candidate in the folder wins; of equal ranks, the first by
+/// sidecar name.
 fn find_sidecar<'a>(
     file_name: &str,
-    in_folder: &BTreeMap<String, &'a Vec<u8>>,
-) -> Option<&'a Vec<u8>> {
+    index: &SidecarIndex<'a>,
+) -> Option<((u8, usize), &'a Vec<u8>)> {
     let mut best: Option<((u8, usize), &'a Vec<u8>)> = None;
-    for (sidecar_name, body) in in_folder {
+    for (sidecar_name, body) in index.candidates(file_name) {
         let Some(rank) = sidecar_rank(strip_json_suffix(sidecar_name), file_name) else {
             continue;
         };
@@ -645,7 +744,7 @@ fn find_sidecar<'a>(
             best = Some((rank, body));
         }
     }
-    best.map(|(_, body)| body)
+    best
 }
 
 /// How well a sidecar's `.json`-stripped `stem` matches `file_name`, as a sort
@@ -683,19 +782,44 @@ fn sidecar_rank(stem: &str, file_name: &str) -> Option<(u8, usize)> {
     }
     // 3 — truncation ate into the photo name itself, leaving only a prefix of
     // it. Every suffix boundary in the stem is tried, so this holds for a
-    // localized suffix too; the longest surviving prefix wins, because a folder
-    // with `IMG_1.jpg` and `IMG_12.jpg` must not let the shorter stem claim the
-    // longer photo.
-    let mut longest: Option<usize> = None;
-    for head in suffix_boundaries(stem) {
-        if !head.is_empty()
-            && file_name.starts_with(head)
-            && longest.is_none_or(|len| head.len() > len)
-        {
-            longest = Some(head.len());
+    // localized suffix too; the longest surviving prefix wins.
+    //
+    // Only for a sidecar whose name is as long as Google lets one get: a name
+    // that short of the cap was not cut, so a prefix of it is the name of a
+    // different photo. Without this, `IMG_1.jpg`'s sidecar gave its name and
+    // date to an `IMG_12.jpg` that had none (`docs/BUGS.md` B225).
+    if stem.chars().count() + ".json".len() >= SIDECAR_NAME_CAP - 4 {
+        let mut longest: Option<usize> = None;
+        for head in suffix_boundaries(stem) {
+            if !head.is_empty()
+                && file_name.starts_with(head)
+                && longest.is_none_or(|len| head.len() > len)
+            {
+                longest = Some(head.len());
+            }
+        }
+        if let Some(len) = longest {
+            return Some((3, usize::MAX - len));
         }
     }
-    longest.map(|len| (3, usize::MAX - len))
+    // 4 — an edited copy, `IMG_1-edited.jpg` (the word is localized), which
+    // Google exports without a sidecar of its own next to `IMG_1.jpg`'s.
+    suffix_boundaries(stem)
+        .filter_map(|head| head.rsplit_once('.'))
+        .any(|(original, extension)| is_edited_copy_of(file_name, original, extension))
+        .then_some((EDITED_COPY, 0))
+}
+
+/// Whether `file_name` is `<original>-<word>.<extension>`, the name Google
+/// gives an edited copy of `<original>.<extension>`.
+fn is_edited_copy_of(file_name: &str, original: &str, extension: &str) -> bool {
+    !original.is_empty()
+        && file_name
+            .strip_prefix(original)
+            .and_then(|rest| rest.strip_prefix('-'))
+            .and_then(|rest| rest.strip_suffix(extension))
+            .and_then(|rest| rest.strip_suffix('.'))
+            .is_some_and(|word| !word.is_empty() && word.chars().all(char::is_alphabetic))
 }
 
 /// The stem plus each of its prefixes ending before a `.`, longest first — the
@@ -994,21 +1118,25 @@ mod tests {
 
     #[test]
     fn longest_prefix_wins_when_the_photo_name_itself_was_truncated() {
+        // Both sidecar names are at Google's cap, so both were cut into the
+        // photo name; the longer surviving prefix is the better claim.
+        let short = "Takeout/Google Photos/Photos from 2019/PXL_20190101_120000000.PORTRAIT_ORIGINAL_E.json";
+        let long = "Takeout/Google Photos/Photos from 2019/PXL_20190101_120000000.PORTRAIT_ORIGINAL_EXPO.json";
         let mut sidecars = HashMap::new();
         sidecar(
             &mut sidecars,
-            "Takeout/Google Photos/Photos from 2019/IMG_1.json",
+            short,
             r#"{"photoTakenTime":{"timestamp":"1"}}"#,
         );
         sidecar(
             &mut sidecars,
-            "Takeout/Google Photos/Photos from 2019/IMG_12.json",
+            long,
             r#"{"photoTakenTime":{"timestamp":"2"}}"#,
         );
         let scan = assemble(
             vec![entry(
                 0,
-                "Takeout/Google Photos/Photos from 2019/IMG_12345.jpg",
+                "Takeout/Google Photos/Photos from 2019/PXL_20190101_120000000.PORTRAIT_ORIGINAL_EXPOSURE.jpg",
                 10,
             )],
             &sidecars,
@@ -1017,6 +1145,104 @@ mod tests {
         assert_eq!(scan.photos[0].capture_time, Some(2));
     }
 
+    /// A short sidecar name was not cut, so a prefix of it names another photo:
+    /// `IMG_1.jpg`'s sidecar gave its title and date to `IMG_12.jpg`
+    /// (`docs/BUGS.md` B225).
+    #[test]
+    fn a_photo_without_a_sidecar_does_not_take_a_shorter_named_siblings() {
+        let mut sidecars = HashMap::new();
+        sidecar(
+            &mut sidecars,
+            "Takeout/Google Photos/Photos from 2019/IMG_1.jpg.supplemental-metadata.json",
+            r#"{"title":"IMG_1.jpg","photoTakenTime":{"timestamp":"1"}}"#,
+        );
+        let scan = assemble(
+            vec![
+                entry(0, "Takeout/Google Photos/Photos from 2019/IMG_1.jpg", 10),
+                entry(0, "Takeout/Google Photos/Photos from 2019/IMG_12.jpg", 10),
+            ],
+            &sidecars,
+        );
+
+        assert_eq!(scan.photos[0].capture_time, Some(1));
+        assert_eq!(scan.photos[1].name, "IMG_12.jpg");
+        assert_eq!(scan.photos[1].capture_time, None);
+    }
+
+    /// An edited copy has no sidecar of its own. It takes its original's date,
+    /// but keeps its own name rather than the original's title.
+    #[test]
+    fn an_edited_copy_takes_its_originals_date_and_keeps_its_name() {
+        let mut sidecars = HashMap::new();
+        sidecar(
+            &mut sidecars,
+            "Takeout/Google Fotos/Urlaub/IMG_2.jpg.ergänzende-Metadaten.json",
+            r#"{"title":"Holiday.jpg","photoTakenTime":{"timestamp":"7"}}"#,
+        );
+        let scan = assemble(
+            vec![
+                entry(0, "Takeout/Google Fotos/Urlaub/IMG_2.jpg", 10),
+                entry(0, "Takeout/Google Fotos/Urlaub/IMG_2-bearbeitet.jpg", 10),
+            ],
+            &sidecars,
+        );
+
+        assert_eq!(scan.photos[0].name, "Holiday.jpg");
+        assert_eq!(scan.photos[1].name, "IMG_2-bearbeitet.jpg");
+        assert_eq!(scan.photos[1].capture_time, Some(7));
+    }
+
+    /// The index looks only at the sidecars that can match, and must find the
+    /// same one that ranking every sidecar in the folder finds.
+    #[test]
+    fn the_sidecar_index_finds_what_ranking_every_sidecar_finds() {
+        let long = "A_very_long_holiday_photo_name_from_the_beach_2019";
+        let names = [
+            "IMG_1.jpg".to_string(),
+            "IMG_12.jpg".to_string(),
+            "IMG_1(1).jpg".to_string(),
+            "IMG_1-edited.jpg".to_string(),
+            "IMG_1-bearbeitet.jpg".to_string(),
+            "my.photo(2).jpg".to_string(),
+            "x(1).jpg".to_string(),
+            "Ölbild.png".to_string(),
+            "PXL_20230101_101010.mp4".to_string(),
+            format!("{long}.jpg"),
+            format!("{long}_2.jpg"),
+            "nothing.heic".to_string(),
+        ];
+        let sidecar_names = [
+            "IMG_1.jpg.supplemental-metadata.json".to_string(),
+            "IMG_1.jpg(1).supplemental-metadata.json".to_string(),
+            "IMG_12.jpg.ergänzende-Metadaten.json".to_string(),
+            "my.photo.jpg(2).json".to_string(),
+            "x.jpg(1).json".to_string(),
+            "Ölbild.png.suppl.json".to_string(),
+            "PXL_20230101_101010.mp4.JSON".to_string(),
+            format!("{}.json", &long[..44]),
+            format!("{long}.jp.json"),
+            "IMG.json".to_string(),
+            "unrelated.json".to_string(),
+        ];
+        let bodies: Vec<Vec<u8>> = (0..sidecar_names.len())
+            .map(|i| i.to_string().into_bytes())
+            .collect();
+        let in_folder: BTreeMap<String, &Vec<u8>> =
+            sidecar_names.iter().cloned().zip(bodies.iter()).collect();
+        let index = SidecarIndex::new(&in_folder);
+        for name in &names {
+            let mut every: Option<((u8, usize), &Vec<u8>)> = None;
+            for (sidecar_name, body) in &in_folder {
+                if let Some(rank) = sidecar_rank(strip_json_suffix(sidecar_name), name)
+                    && every.as_ref().is_none_or(|(current, _)| rank < *current)
+                {
+                    every = Some((rank, *body));
+                }
+            }
+            assert_eq!(find_sidecar(name, &index), every, "{name}");
+        }
+    }
+
     #[test]
     fn sidecar_title_replaces_a_mangled_on_disk_name() {
         let mut sidecars = HashMap::new();

crates/pdfs-core/src/update.rs

@@ -0,0 +1,178 @@
+//! The opt-in check for a newer release ([`crate::config::AppConfig::update_check`]).
+//!
+//! Only the decisions live here: what GitHub's answer says, which version is
+//! newer, when to ask again, and whether a package manager already owns
+//! updates. The desktop app does the request itself.
+
+use std::path::Path;
+use std::time::Duration;
+
+/// GitHub's latest published release. Drafts and pre-releases never show up
+/// here, so a tagged release candidate does not reach anyone.
+pub const RELEASES_LATEST_API: &str =
+    "https://api.github.com/repos/narrrl/proton-drive-linux/releases/latest";
+
+/// How often the app asks, across restarts.
+pub const CHECK_INTERVAL: Duration = Duration::from_secs(24 * 60 * 60);
+
+/// Installed next to the binaries' `share/` by packages whose package manager
+/// brings new releases (COPR, the AUR, Nix). The release `.deb`, `.rpm` and
+/// `.tar.gz` do not ship it, since nothing updates them.
+pub const MANAGED_MARKER: &str = "share/proton-drive-linux/managed-updates";
+
+/// The version of the release in a `/releases/latest` answer, without the
+/// tag's `v`. `None` for an answer that does not parse or a tag that is not
+/// `X.Y.Z`, so a changed API can never claim an update.
+pub fn latest_version(body: &[u8]) -> Option<String> {
+    let json: serde_json::Value = serde_json::from_slice(body).ok()?;
+    let tag = json.get("tag_name")?.as_str()?;
+    let version = tag.strip_prefix('v').unwrap_or(tag);
+    parse(version).map(|_| version.to_owned())
+}
+
+/// Whether `version` is a later release than `current`. Anything that is not
+/// `X.Y.Z` on either side is not.
+pub fn is_newer(version: &str, current: &str) -> bool {
+    matches!((parse(version), parse(current)), (Some(v), Some(c)) if v > c)
+}
+
+/// The release page of `version` on GitHub.
+pub fn release_url(version: &str) -> String {
+    format!("https://github.com/narrrl/proton-drive-linux/releases/tag/v{version}")
+}
+
+/// `X.Y.Z` as numbers, so `3.10.0` sorts after `3.9.0`.
+fn parse(version: &str) -> Option<(u64, u64, u64)> {
+    let mut parts = version.split('.').map(|p| p.parse::<u64>().ok());
+    let triple = (parts.next()??, parts.next()??, parts.next()??);
+    parts.next().is_none().then_some(triple)
+}
+
+/// How long until the next check is due, given the last one in Unix seconds.
+/// Zero when it is due now. A clock set back past the last check counts as
+/// due, so a wrong clock cannot stop checks.
+pub fn next_check_in(last_checked: Option<i64>, now: i64) -> Duration {
+    let interval = CHECK_INTERVAL.as_secs() as i64;
+    match last_checked {
+        Some(last) if (0..interval).contains(&(now - last)) => {
+            Duration::from_secs((interval - (now - last)) as u64)
+        }
+        _ => Duration::ZERO,
+    }
+}
+
+/// Whether the binary at `exe` was installed by a package manager that updates
+/// it, which [`MANAGED_MARKER`] next to its `bin/` says.
+pub fn updates_managed(exe: &Path) -> bool {
+    exe.parent()
+        .and_then(Path::parent)
+        .is_some_and(|prefix| prefix.join(MANAGED_MARKER).exists())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn latest(tag: &str) -> Vec<u8> {
+        format!(
+            r#"{{"tag_name":"{tag}","html_url":"https://github.com/narrrl/proton-drive-linux/releases/tag/{tag}","draft":false}}"#
+        )
+        .into_bytes()
+    }
+
+    #[test]
+    fn the_latest_release_is_read_without_its_v() {
+        assert_eq!(latest_version(&latest("v3.6.0")).as_deref(), Some("3.6.0"));
+        assert_eq!(latest_version(&latest("3.6.0")).as_deref(), Some("3.6.0"));
+    }
+
+    #[test]
+    fn an_answer_that_does_not_parse_has_no_version() {
+        assert_eq!(latest_version(b"not json"), None);
+        assert_eq!(latest_version(b"{}"), None);
+        assert_eq!(latest_version(br#"{"tag_name":7}"#), None);
+        assert_eq!(latest_version(&latest("nightly")), None);
+        assert_eq!(latest_version(&latest("v4.0.0-rc1")), None);
+        assert_eq!(latest_version(&latest("v4.0")), None);
+        assert_eq!(latest_version(&latest("v4.0.0.1")), None);
+    }
+
+    #[test]
+    fn only_a_later_release_is_newer() {
+        assert!(is_newer("3.6.0", "3.5.0"));
+        assert!(!is_newer("3.5.0", "3.5.0"));
+        assert!(!is_newer("3.4.1", "3.5.0"));
+        assert!(!is_newer("2.99.99", "3.0.0"));
+    }
+
+    #[test]
+    fn versions_compare_as_numbers() {
+        assert!(is_newer("3.10.0", "3.9.0"));
+        assert!(is_newer("3.5.10", "3.5.9"));
+        assert!(is_newer("4.0.0", "3.99.99"));
+    }
+
+    #[test]
+    fn a_version_that_is_not_x_y_z_is_never_newer() {
+        assert!(!is_newer("4.0.0", "3.5.0-dev"));
+        assert!(!is_newer("garbage", "3.5.0"));
+    }
+
+    #[test]
+    fn the_release_page_uses_the_tag() {
+        assert_eq!(
+            release_url("3.6.0"),
+            "https://github.com/narrrl/proton-drive-linux/releases/tag/v3.6.0"
+        );
+    }
+
+    #[test]
+    fn a_check_is_due_once_a_day() {
+        let day = CHECK_INTERVAL.as_secs() as i64;
+        assert_eq!(next_check_in(None, 1_000), Duration::ZERO);
+        assert_eq!(next_check_in(Some(1_000), 1_000), CHECK_INTERVAL);
+        assert_eq!(
+            next_check_in(Some(1_000), 1_000 + day - 1),
+            Duration::from_secs(1)
+        );
+        assert_eq!(next_check_in(Some(1_000), 1_000 + day), Duration::ZERO);
+        assert_eq!(
+            next_check_in(Some(1_000), 999),
+            Duration::ZERO,
+            "a clock set back must not stop checks"
+        );
+    }
+
+    /// A unique temp directory removed on drop; avoids a dev-dependency, as in
+    /// [`crate::syncignore`]'s tests.
+    struct TempDir(std::path::PathBuf);
+    impl TempDir {
+        fn new() -> Self {
+            use std::sync::atomic::{AtomicU64, Ordering};
+            static N: AtomicU64 = AtomicU64::new(0);
+            let p = std::env::temp_dir().join(format!(
+                "pdfs-update-{}-{}",
+                std::process::id(),
+                N.fetch_add(1, Ordering::Relaxed)
+            ));
+            std::fs::create_dir_all(&p).unwrap();
+            TempDir(p)
+        }
+    }
+    impl Drop for TempDir {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
+    #[test]
+    fn the_marker_next_to_bin_means_a_package_manager_updates() {
+        let prefix = TempDir::new();
+        let exe = prefix.0.join("bin/pdfs-app");
+        assert!(!updates_managed(&exe));
+        let marker = prefix.0.join(MANAGED_MARKER);
+        std::fs::create_dir_all(marker.parent().unwrap()).unwrap();
+        std::fs::write(&marker, "").unwrap();
+        assert!(updates_managed(&exe));
+    }
+}

crates/pdfs-fuse/Cargo.toml

@@ -15,6 +15,7 @@ zip.workspace = true
 sha1.workspace = true
 proton-drive-rs.workspace = true
 futures.workspace = true
+async-trait.workspace = true
 tokio.workspace = true
 tracing.workspace = true
 fuser.workspace = true
@@ -24,3 +25,6 @@ base64.workspace = true
 image.workspace = true
 notify = "8"
 parking_lot.workspace = true
+
+[dev-dependencies]
+tracing-subscriber.workspace = true

crates/pdfs-fuse/src/background.rs

@@ -2,6 +2,7 @@
 
 use super::*;
 use crate::shutdown::Shutdown;
+use pdfs_core::error::session_revoked;
 
 /// Drop `uid` from one mount's tree and tell that mount's kernel session the
 /// entry is gone. Shared by the trash and delete paths, which differ only in
@@ -97,15 +98,13 @@ fn event_serializes_shared_publication(event: &DriveEvent, own_volume: &VolumeId
 /// entry forces the next `lookup`/`readdir` to re-enumerate from the remote, so
 /// most events only need to invalidate listings rather than re-fetch eagerly.
 ///
-/// Applied to **every** mounted inode space, not just the primary one. This task
-/// is per-daemon while node state is per-mount, and a `DriveEvent` names a uid,
-/// not a mount — so a file trashed from another device has to be withdrawn from
-/// whichever of our sessions is showing it, which for anything under a sync
-/// folder is a [`Core::fork_state`] fork rather than `core.state`. Reaching for
-/// the primary state alone left forks serving a deleted file indefinitely, the
-/// read-side twin of `docs/BUGS.md` B74. Inode numbers are per-mount, so each
-/// mount must be notified through its **own** channel; that pairing is what
-/// [`Core::for_each_mount`] exists to preserve.
+/// Applied to the tree every mount shares, and told to **every** mounted
+/// session. A `DriveEvent` names a uid, not a mount, so a file trashed from
+/// another device has to be withdrawn from whichever of our sessions is showing
+/// it — which for anything under a sync folder is a [`Core::fork_state`] fork.
+/// Telling the primary session alone left forks serving a deleted file, the
+/// read-side twin of `docs/BUGS.md` B74. [`Core::for_each_mount`] sends what
+/// the kernel needs to hear to every session.
 fn apply_event(core: &Core, event: &DriveEvent, dirty: &mut DirtyParents) -> pdfs_core::Result<()> {
     let foreign_delete = is_foreign_node_delete(event, &core.primary_root_uid.volume_id);
     let serializes_shared_publication =
@@ -145,7 +144,7 @@ fn apply_event(core: &Core, event: &DriveEvent, dirty: &mut DirtyParents) -> pdf
             // create, and re-fetching would replace the size and mtime of the
             // write we just accepted with the stale revision's — making a file
             // that was copied in seconds ago read as empty until its upload
-            // lands (offline.md Phase 3).
+            // lands.
             //
             // A write that has already drained is the same story one step later:
             // the drain brought the tree level with the revision it sealed, so
@@ -233,6 +232,48 @@ fn acknowledge_applied_event(
     Ok(id)
 }
 
+/// How many applied node-update ids [`RecentEvents`] remembers. Far more than a
+/// replay can reach back: one comes from a batch whose last event was not its
+/// newest, so it repeats at most what that batch held.
+const RECENT_EVENTS: usize = 4096;
+
+/// The node updates applied lately, by event id, so one that comes round again
+/// is skipped rather than applied twice.
+///
+/// The feed can deliver the same event twice in a batch, and a batch whose
+/// events come out of order leaves the cursor short of its newest event, so the
+/// next poll replays what lay past it. An update applied twice is not harmless:
+/// the first copy of our own change claims the echo [`Core::note_self_change`]
+/// recorded, and the second, unclaimed, reads as someone else's edit and evicts
+/// the bytes a partial write is about to gap-fill from (docs/BUGS.md B123).
+///
+/// Only node updates: a delete is idempotent, and a continuity loss names the
+/// cursor it lost, which is an id already applied.
+#[derive(Default)]
+struct RecentEvents {
+    ids: HashSet<DriveEventId>,
+    order: VecDeque<DriveEventId>,
+}
+
+impl RecentEvents {
+    /// Record `event` as applied, reporting whether it was already.
+    fn repeat(&mut self, event: &DriveEvent) -> bool {
+        let DriveEvent::NodeUpdated { id, .. } = event else {
+            return false;
+        };
+        if !self.ids.insert(id.clone()) {
+            return true;
+        }
+        self.order.push_back(id.clone());
+        if self.order.len() > RECENT_EVENTS
+            && let Some(old) = self.order.pop_front()
+        {
+            self.ids.remove(&old);
+        }
+        false
+    }
+}
+
 /// The folders one batch of events changed, collected so the listings are
 /// dropped once at the end of the batch rather than once per event.
 ///
@@ -320,10 +361,10 @@ fn flush_dirty_parents(core: &Core, dirty: &DirtyParents) {
 /// only on fatal error.
 ///
 /// Takes the whole `Core` rather than the primary mount's pieces: an event has
-/// to be applied to every mounted inode space, and the registry that enumerates
-/// them lives on the `Core` (see [`apply_event`]).
+/// to reach every mounted session, and the registry that enumerates them lives
+/// on the `Core` (see [`apply_event`]).
 pub(super) async fn run_event_sync(
-    client: ProtonDriveClient,
+    client: Arc<dyn DriveApi>,
     scope: DriveEventScopeId,
     core: Core,
 ) {
@@ -335,7 +376,7 @@ pub(super) async fn run_event_sync(
         // server head; persist it so the next restart resumes instead of
         // reseeding (which would skip everything that changed offline).
         // Seeding needs the network, and this task also runs on mounts that
-        // started offline (offline.md Phase 1) — so retry rather than giving up,
+        // started offline — so retry rather than giving up,
         // which used to disable live sync for the life of the daemon.
         Ok(None) => {
             // Nothing says what changed before this cursor, so a persisted SDK
@@ -362,6 +403,12 @@ pub(super) async fn run_event_sync(
                         }
                         break Some(c.clone());
                     }
+                    // Refused for good: retrying would be refused the same way
+                    // for the life of the daemon. The next login restarts it.
+                    Err(e) if session_revoked(&e) => {
+                        core.mark_session_expired("seed event cursor", &e);
+                        return;
+                    }
                     Err(e) => {
                         warn!(error = %e, ?delay, "seed event cursor failed; retrying");
                         tokio::time::sleep(delay).await;
@@ -377,6 +424,7 @@ pub(super) async fn run_event_sync(
     };
     info!(?cursor, "event sync started");
 
+    let mut recent = RecentEvents::default();
     loop {
         core.next_poll(POLL_INTERVAL).await;
         let events = match link::bounded(client.enumerate_events(&scope, cursor.as_ref())).await {
@@ -397,6 +445,11 @@ pub(super) async fn run_event_sync(
         // did apply.
         let mut dirty = DirtyParents::default();
         for event in &events {
+            if recent.repeat(event) {
+                debug!(id = %event.id().as_str(), "skipping an event already applied");
+                cursor = Some(event.id().clone());
+                continue;
+            }
             // Converge the SDK's own caches (folder keys, entity cache) on the
             // server before applying the event to our tree. Without this, a node
             // re-keyed/moved by another client keeps a stale key in the SDK for
@@ -456,6 +509,10 @@ pub(super) async fn run_photos_event_sync(core: Core) {
                 debug!("no photos volume; photo event sync not started");
                 return;
             }
+            Err(error) if session_revoked(&error) => {
+                core.mark_session_expired("read the photos root", &error);
+                return;
+            }
             Err(error) => {
                 warn!(%error, "reading the photos root failed; retrying");
                 tokio::time::sleep(ONLINE_PROBE_MAX).await;
@@ -614,7 +671,7 @@ pub(super) fn run_local_index(
             scan_local_once(&db, &indexing, &transfers, &mountpoint);
         }
         // Interruptible, so teardown joins this thread instead of leaving it to
-        // keep rewriting the index for a mount that is gone (bugs.md B44).
+        // keep rewriting the index for a mount that is gone (`docs/BUGS.md` B44).
         if !shutdown.sleep(LOCAL_INDEX_CHECK) {
             return;
         }
@@ -664,18 +721,26 @@ fn scan_local_once(
 
     // The walk has no idea how many files it will find, so the job counts what it
     // has seen and stays indeterminate.
-    let job = transfers.begin_job("Indexing this computer");
+    let job = transfers.begin_background_job("Indexing this computer");
     job.detail("Scanning your files");
+    let mut failed = false;
     let walked = localindex::scan(&[home], &excludes, |batch| {
         if let Err(e) = db.local_upsert_batch(generation, &batch) {
             warn!(error = %e, "local index: batch write failed");
+            failed = true;
         }
     });
 
-    // Prune what this scan did not see and rebuild the FTS index over the rest,
-    // even if some batches failed — a partial index still beats none.
+    // Prune what this scan did not see, unless it did not see everything:
+    // a path it never reached, or one whose batch failed to write, is not a
+    // path that is gone (`docs/BUGS.md` B217).
     job.detail("Building the search index");
-    match db.local_finish_scan(generation, now_secs()) {
+    let finished = if failed || walked >= localindex::MAX_ENTRIES {
+        db.local_finish_partial_scan(now_secs())
+    } else {
+        db.local_finish_scan(generation, now_secs())
+    };
+    match finished {
         Ok(indexed) => info!(
             walked,
             indexed,
@@ -717,6 +782,43 @@ mod tests {
         }
     }
 
+    #[test]
+    fn a_node_update_seen_again_is_skipped_but_other_events_are_not() {
+        let update = |id: &str| DriveEvent::NodeUpdated {
+            id: DriveEventId::from(id),
+            node_uid: uid("file"),
+            parent_node_uid: None,
+            is_trashed: false,
+            is_shared: false,
+        };
+        let mut recent = RecentEvents::default();
+        assert!(!recent.repeat(&update("e1")));
+        assert!(!recent.repeat(&update("e2")));
+        assert!(recent.repeat(&update("e1")), "a duplicate or replay");
+        let lost = DriveEvent::ContinuityLost {
+            id: DriveEventId::from("e2"),
+        };
+        assert!(!recent.repeat(&lost), "names the cursor, which was applied");
+    }
+
+    #[test]
+    fn recent_events_forget_the_oldest_past_their_bound() {
+        let update = |n: usize| DriveEvent::NodeUpdated {
+            id: DriveEventId::from(format!("e{n}")),
+            node_uid: uid("file"),
+            parent_node_uid: None,
+            is_trashed: false,
+            is_shared: false,
+        };
+        let mut recent = RecentEvents::default();
+        for n in 0..=RECENT_EVENTS {
+            assert!(!recent.repeat(&update(n)));
+        }
+        assert_eq!(recent.ids.len(), RECENT_EVENTS);
+        assert!(!recent.repeat(&update(0)), "the oldest was forgotten");
+        assert!(recent.repeat(&update(RECENT_EVENTS)));
+    }
+
     #[test]
     fn foreign_delete_invalidates_an_earlier_refresh_generation() {
         let own_volume = VolumeId::from("own");

crates/pdfs-fuse/src/control.rs

@@ -29,6 +29,17 @@ use super::{Core, count_noun, human_bytes, human_duration, parse_uid};
 
 const MAX_CONTROL_REQUEST_BYTES: u64 = 1024 * 1024;
 const CONTROL_READ_TIMEOUT: Duration = Duration::from_secs(10);
+/// Answer a [`CtlRequest::FolderSize`].
+fn folder_size_reply(size: CoreResult<proton_drive_rs::FolderSize>) -> CtlResponse {
+    match size {
+        Ok(size) => CtlResponse::FolderSize {
+            size: size.size,
+            items: size.descendants,
+        },
+        Err(e) => CtlResponse::error(e),
+    }
+}
+
 /// Answer a [`CtlRequest::StopSharing`]: log it, and turn a partial removal
 /// into an error that names what is still shared.
 fn stop_sharing_reply(
@@ -163,8 +174,8 @@ fn read_request_line(reader: &mut impl BufRead) -> std::io::Result<Option<String
 /// Turn a CLI-supplied path into the mount that owns it and the path relative
 /// to *that* mount's root.
 ///
-/// [`rel_to_mount`] is the older, primary-only reading, and it is what every
-/// mutating request still uses. It rejects anything outside the primary
+/// [`rel_to_mount`] is the older, primary-only reading, and it is what most
+/// requests still use. It rejects anything outside the primary
 /// mountpoint, which leaves a secondary on-demand mount — a synced folder
 /// switched out of mirror mode — with no way to be named at all: `pdfs ls` and
 /// `pdfs refresh` both answered "is not under the mountpoint", so a folder
@@ -185,11 +196,14 @@ fn route_to_mount(core: &Core, mountpoint: &Path, path: &str) -> CoreResult<(Cor
     rel_to_mount(mountpoint, path).map(|rel| (core.clone(), rel))
 }
 
-/// [`route_to_mount`] for a conflict copy. The listing names a copy inside a
-/// synced folder by its absolute local path (`docs/BUGS.md` B99), so the
-/// resolve has to run against the on-demand mount serving it. A mirror folder
-/// has no mount to run against: its copy is an ordinary local file.
-fn route_conflict(core: &Core, mountpoint: &Path, path: &str) -> CoreResult<(Core, PathBuf)> {
+/// [`route_to_mount`] for a request that changes what it names: trash, rename,
+/// create a folder, resolve a conflict. Each has to run against the on-demand
+/// mount serving the path, and `pdfs rm ~/Downloads/x` answered "is not under
+/// the mountpoint" while `pdfs move` took the same path. The conflict listing
+/// names a copy in a synced folder by its absolute local path (`docs/BUGS.md`
+/// B99), so resolving one needs this too. A mirror folder has no mount to run
+/// against: a file there is an ordinary local file.
+fn route_change(core: &Core, mountpoint: &Path, path: &str) -> CoreResult<(Core, PathBuf)> {
     let routed = route_to_mount(core, mountpoint, path).map_err(|e| {
         let p = Path::new(path);
         let mirrored = core
@@ -200,7 +214,7 @@ fn route_conflict(core: &Core, mountpoint: &Path, path: &str) -> CoreResult<(Cor
             .any(|folder| folder.mode == "mirror" && p.starts_with(&folder.local_path));
         if mirrored {
             CoreError::invalid(format!(
-                "{path} is in a mirrored folder; rename or delete the local file there"
+                "{path} is in a mirrored folder; change the local file there instead"
             ))
         } else {
             e
@@ -217,6 +231,27 @@ fn route_conflict(core: &Core, mountpoint: &Path, path: &str) -> CoreResult<(Cor
     }
 }
 
+/// [`route_change`] for a request that trashes or renames the node it names.
+/// A mount's root is My files or a whole synced folder. An on-demand folder's
+/// root has a parent on Drive, so nothing further down would stop `pdfs rm
+/// ~/Downloads` from trashing the folder out from under its own mount.
+fn route_node(core: &Core, mountpoint: &Path, path: &str) -> CoreResult<(Core, PathBuf)> {
+    let routed = route_change(core, mountpoint, path)?;
+    if below_root(&routed.1) {
+        Ok(routed)
+    } else {
+        Err(CoreError::invalid(format!(
+            "{path} is the root of a synced location and cannot be changed"
+        )))
+    }
+}
+
+/// Whether a mount-relative path names something below the mount's root.
+fn below_root(rel: &Path) -> bool {
+    rel.components()
+        .any(|component| matches!(component, Component::Normal(_)))
+}
+
 /// Turn a CLI-supplied path into a mountpoint-relative path. An absolute path
 /// must live under `mountpoint`; a relative path is taken as already relative to
 /// the mount root.
@@ -291,6 +326,9 @@ impl Drop for RefreshGuard {
 pub(crate) fn status_response(core: &Core, username: &str, mountpoint: &Path) -> CtlResponse {
     let pins = core.cache.list_pins();
     let queued = core.db.pending_op_counts().unwrap_or_default();
+    // Read after the queue: the drain counts an upload as landing before it
+    // retires the op, so one of the two always has it (B119).
+    let landing = core.landing_uploads.load(Ordering::SeqCst);
     let staging = core.cache.staging_usage();
     CtlResponse::Status {
         parked_uploads: queued.parked.max(0) as u64,
@@ -307,7 +345,10 @@ pub(crate) fn status_response(core: &Core, username: &str, mountpoint: &Path) ->
         budget: core.cache.budget(),
         pins,
         online: core.online.load(Ordering::Relaxed),
-        pending_uploads: queued.uploads.max(0) as u64,
+        session_expired: core.session_expired(),
+        tokens_unsaved: pdfs_core::auth::tokens_unsaved(),
+        version: env!("CARGO_PKG_VERSION").to_string(),
+        pending_uploads: queued.uploads.max(0) as u64 + landing,
         pending_changes: queued.changes.max(0) as u64,
     }
 }
@@ -342,14 +383,16 @@ fn touched_topics(request: &CtlRequest) -> &'static [Topic] {
             RefreshScope::Photos { .. } => &[],
         },
         R::RenameDevice { .. } | R::DeleteDevice { .. } => &[Topic::Devices],
-        R::AdoptDevice { .. } => &[Topic::Devices, Topic::Locations],
+        R::AdoptDevice { .. } | R::MigrateDevice { .. } => &[Topic::Devices, Topic::Locations],
         R::AddSyncFolder { .. }
         | R::RemoveSyncFolder { .. }
         | R::SetSyncFolderMode { .. }
         | R::SetSyncFolderPaused { .. }
+        | R::ResetSyncFolder { .. }
         | R::RestoreSyncFolders { .. }
         | R::RestoreDeviceFolders { .. } => &[Topic::Locations, Topic::Devices],
         R::RetryPendingOp { .. } => &[Topic::Queue],
+        R::DiscardPendingOp { .. } => &[Topic::Queue, Topic::Files],
         R::ResolveConflict { .. } => &[Topic::Files, Topic::Trash, Topic::Conflicts],
         R::ShareNode { .. }
         | R::ShareNodeByUid { .. }
@@ -361,6 +404,8 @@ fn touched_topics(request: &CtlRequest) -> &'static [Topic] {
         | R::CreatePublicLinkByUid { .. }
         | R::RemovePublicLink { .. }
         | R::RemovePublicLinkByUid { .. }
+        | R::UpdatePublicLink { .. }
+        | R::UpdatePublicLinkByUid { .. }
         | R::StopSharing { .. }
         | R::StopSharingByUid { .. } => &[Topic::Shares, Topic::Files],
         R::LeaveShared { .. }
@@ -880,10 +925,22 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
                 ))),
                 Ok((file, len)) => {
                     let photos = core.photos();
+                    // Unless the caller knows better: the photo's own EXIF,
+                    // then the file's modification time, which a copy resets.
+                    let capture_time = capture_time.or_else(|| {
+                        let path = Path::new(&source_path);
+                        pdfs_core::exiftime::capture_time_of(path).or_else(|| {
+                            let modified =
+                                std::fs::metadata(path).and_then(|m| m.modified()).ok()?;
+                            let since = modified.duration_since(std::time::UNIX_EPOCH).ok()?;
+                            Some(since.as_secs() as i64)
+                        })
+                    });
                     let metadata = proton_drive_rs::PhotoUploadMetadata {
                         capture_time,
                         ..Default::default()
                     };
+                    let thumbnails = core.upload_thumbnails(Path::new(&source_path), &name);
                     let guard =
                         core.transfers
                             .begin(name.clone(), "", TransferDirection::Upload, len);
@@ -893,7 +950,7 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
                         &media_type,
                         reader,
                         len as i64,
-                        Vec::new(),
+                        thumbnails,
                         metadata,
                         false,
                     )) {
@@ -910,6 +967,9 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
                             }
                         }
                         Err(e) => {
+                            // The reply goes to the app's toast only; without
+                            // this the journal shows a failure and no reason.
+                            warn!(error = %e, "photo upload failed");
                             CtlResponse::error(CoreError::from_api(&e, "upload photo failed"))
                         }
                     }
@@ -959,8 +1019,8 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
             },
             Err(e) => CtlResponse::error(e),
         },
-        Ok(CtlRequest::Rename { path, new_name }) => match rel_to_mount(mountpoint, &path) {
-            Ok(rel) => match core.rename(&rel, &new_name) {
+        Ok(CtlRequest::Rename { path, new_name }) => match route_node(core, mountpoint, &path) {
+            Ok((core, rel)) => match core.rename(&rel, &new_name) {
                 Ok(name) => {
                     core.log_activity(ActivityKind::Rename, &name, format!("was {path}"), true);
                     CtlResponse::Ok {
@@ -1017,8 +1077,38 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
                 (Err(e), _) | (_, Err(e)) => CtlResponse::error(e),
             }
         }
-        Ok(CtlRequest::Delete { path }) => match rel_to_mount(mountpoint, &path) {
-            Ok(rel) => match core.delete(&rel) {
+        Ok(CtlRequest::Copy { path, new_parent }) => {
+            match (
+                rel_to_mount(mountpoint, &path),
+                rel_to_mount(mountpoint, &new_parent),
+            ) {
+                (Ok(rel), Ok(parent_rel)) => match core.copy_to(&rel, &parent_rel) {
+                    Ok(name) => {
+                        let dest = if new_parent.is_empty() {
+                            "My files".to_string()
+                        } else {
+                            new_parent.clone()
+                        };
+                        core.log_activity(ActivityKind::Copy, &name, format!("to {dest}"), true);
+                        CtlResponse::Ok {
+                            message: format!("copied to {name}"),
+                        }
+                    }
+                    Err(e) => {
+                        core.log_activity(ActivityKind::Copy, &path, &e, false);
+                        CtlResponse::error(e)
+                    }
+                },
+                (Err(e), _) | (_, Err(e)) => CtlResponse::error(e),
+            }
+        }
+        Ok(CtlRequest::FolderSize { path }) => match rel_to_mount(mountpoint, &path) {
+            Ok(rel) => folder_size_reply(core.folder_size(&rel)),
+            Err(e) => CtlResponse::error(e),
+        },
+        Ok(CtlRequest::FolderSizeByUid { uid }) => folder_size_reply(core.folder_size_by_uid(&uid)),
+        Ok(CtlRequest::Delete { path }) => match route_node(core, mountpoint, &path) {
+            Ok((core, rel)) => match core.delete(&rel) {
                 Ok(name) => {
                     core.log_activity(ActivityKind::Trash, &name, "", true);
                     CtlResponse::Ok {
@@ -1032,21 +1122,23 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
             },
             Err(e) => CtlResponse::error(e),
         },
-        Ok(CtlRequest::CreateFolder { parent, name }) => match rel_to_mount(mountpoint, &parent) {
-            Ok(parent_rel) => match core.create_folder(&parent_rel, &name) {
-                Ok(name) => {
-                    core.log_activity(ActivityKind::CreateFolder, &name, "", true);
-                    CtlResponse::Ok {
-                        message: format!("created folder {name}"),
+        Ok(CtlRequest::CreateFolder { parent, name }) => {
+            match route_change(core, mountpoint, &parent) {
+                Ok((core, parent_rel)) => match core.create_folder(&parent_rel, &name) {
+                    Ok(name) => {
+                        core.log_activity(ActivityKind::CreateFolder, &name, "", true);
+                        CtlResponse::Ok {
+                            message: format!("created folder {name}"),
+                        }
                     }
-                }
-                Err(e) => {
-                    core.log_activity(ActivityKind::CreateFolder, &name, &e, false);
-                    CtlResponse::error(e)
-                }
-            },
-            Err(e) => CtlResponse::error(e),
-        },
+                    Err(e) => {
+                        core.log_activity(ActivityKind::CreateFolder, &name, &e, false);
+                        CtlResponse::error(e)
+                    }
+                },
+                Err(e) => CtlResponse::error(e),
+            }
+        }
         Ok(CtlRequest::UploadPaths { parent, sources }) => {
             match rel_to_mount(mountpoint, &parent) {
                 // Ack immediately and upload on a background thread: a directory tree
@@ -1267,6 +1359,10 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
             Ok(message) => CtlResponse::Ok { message },
             Err(e) => CtlResponse::error(e),
         },
+        Ok(CtlRequest::MigrateDevice { uid }) => match core.migrate_device(&uid) {
+            Ok(message) => CtlResponse::Ok { message },
+            Err(e) => CtlResponse::error(e),
+        },
         Ok(CtlRequest::AddSyncFolder { local_path }) => {
             // Registering the device and uploading a folder tree far outlasts the
             // socket read timeout, so ack immediately and work on a background
@@ -1337,6 +1433,13 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
                 Err(e) => CtlResponse::error(e),
             }
         }
+        Ok(CtlRequest::ResetSyncFolder { id }) => match core.reset_sync_folder(id) {
+            Ok(message) => {
+                core.log_activity(ActivityKind::Sync, &message, "", true);
+                CtlResponse::Ok { message }
+            }
+            Err(e) => CtlResponse::error(e),
+        },
         Ok(CtlRequest::SyncNow { id }) => {
             core.sync_now(id);
             CtlResponse::Ok {
@@ -1363,7 +1466,7 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
             Err(e) => CtlResponse::error(e),
         },
         Ok(CtlRequest::ResolveConflict { path, keep }) => {
-            match route_conflict(core, mountpoint, &path) {
+            match route_change(core, mountpoint, &path) {
                 Ok((core, rel)) => match core.resolve_conflict(&rel, &keep) {
                     Ok(message) => CtlResponse::Ok { message },
                     Err(e) => CtlResponse::error(e),
@@ -1375,6 +1478,20 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
             Ok(items) => CtlResponse::PendingOps { items },
             Err(e) => CtlResponse::error(e),
         },
+        Ok(CtlRequest::ExportPendingOp { id, dest }) => {
+            match core.export_pending_op(id, Path::new(&dest)) {
+                Ok(written) => CtlResponse::Ok {
+                    message: format!("wrote {} to {dest}", human_bytes(written)),
+                },
+                Err(e) => CtlResponse::error(e),
+            }
+        }
+        Ok(CtlRequest::DiscardPendingOp { id }) => match core.discard_pending_op(id) {
+            Ok(path) => CtlResponse::Ok {
+                message: format!("discarded the queued change to {path}"),
+            },
+            Err(e) => CtlResponse::error(e),
+        },
         Ok(CtlRequest::RetryPendingOp { id }) => match core.retry_pending_ops(id) {
             Ok(0) if id.is_some() => CtlResponse::Ok {
                 message: "nothing to retry: the operation is already due or waiting for a rename"
@@ -1564,6 +1681,31 @@ fn handle_control_conn(core: &Core, username: &str, mountpoint: &Path, stream: U
                 CtlResponse::error(e)
             }
         },
+        Ok(CtlRequest::UpdatePublicLink {
+            path,
+            id,
+            role,
+            password,
+            expires,
+        }) => match rel_to_mount(mountpoint, &path) {
+            Ok(rel) => {
+                match core.update_public_link(&rel, &id, role.as_deref(), password, expires) {
+                    Ok(link) => CtlResponse::PublicLink { link },
+                    Err(e) => CtlResponse::error(e),
+                }
+            }
+            Err(e) => CtlResponse::error(e),
+        },
+        Ok(CtlRequest::UpdatePublicLinkByUid {
+            uid,
+            id,
+            role,
+            password,
+            expires,
+        }) => match core.update_public_link_by_uid(&uid, &id, role.as_deref(), password, expires) {
+            Ok(link) => CtlResponse::PublicLink { link },
+            Err(e) => CtlResponse::error(e),
+        },
         Ok(CtlRequest::RemovePublicLink { path, id }) => match rel_to_mount(mountpoint, &path) {
             Ok(rel) => match core.remove_public_link(&rel, &id) {
                 Ok(()) => {
@@ -1772,7 +1914,7 @@ pub(crate) fn run_control_socket(
     info!("control socket listening");
     for conn in listener.incoming() {
         // Checked on every accept, including the deliberate poke teardown sends
-        // to wake this thread out of a blocking accept (bugs.md B44).
+        // to wake this thread out of a blocking accept (`docs/BUGS.md` B44).
         if core.shutdown.is_stopping() {
             info!("control socket closing");
             return;
@@ -1864,6 +2006,18 @@ mod request_limit_tests {
         assert!(rel_to_mount(mountpoint, "Photos/../../escape").is_err());
         assert!(rel_to_mount(mountpoint, "/mnt/elsewhere").is_err());
     }
+
+    /// `pdfs rm` and `pdfs rename` reach on-demand mounts, whose root is a whole
+    /// synced folder with a parent on Drive. Only a path below a root may get
+    /// through to the trash or rename call.
+    #[test]
+    fn only_a_path_below_a_mount_root_names_a_node() {
+        assert!(below_root(Path::new("Photos")));
+        assert!(below_root(Path::new("./Photos/2026")));
+        assert!(!below_root(Path::new("")));
+        assert!(!below_root(Path::new(".")));
+        assert!(!below_root(Path::new("./.")));
+    }
 }
 
 #[cfg(test)]

crates/pdfs-fuse/src/devices.rs

@@ -1,5 +1,5 @@
 //! This machine as a Proton Drive Device, and the local folders it keeps in
-//! step with the remote (devices.md).
+//! step with the remote.
 //!
 //! A sync folder runs in one of two modes. `mirror` keeps a real local tree that
 //! the engine in [`super::sync`] reconciles both ways; `ondemand` evicts that
@@ -19,6 +19,7 @@ use pdfs_core::control::{
 };
 use pdfs_core::db::{StoredDevice, StoredSyncFolder};
 use pdfs_core::mounts::MountMode;
+use pdfs_core::profile::PROFILE_DIR_NAME;
 use pdfs_core::{CoreError, CoreResult};
 use proton_drive_rs::proton_sdk::ids::{DeviceUid, NodeUid};
 use proton_drive_rs::{DeviceType, Node};
@@ -27,7 +28,7 @@ use tracing::{info, warn};
 
 use super::sync::{self, base_name};
 use super::{
-    Core, SecondaryInsertRejection, SecondaryMount, State, SwitchBlocked, clear_stale_mount,
+    Core, SecondaryInsertRejection, SecondaryMount, SwitchBlocked, clear_stale_mount,
     device_type_str, dir_is_empty, evict_dir_contents, fuse_connection_id, is_stale_mount,
     now_secs, parse_uid, spawn_session, sync_folder_info, this_hostname,
 };
@@ -104,6 +105,15 @@ pub(crate) fn adopted_device_uid() -> Option<String> {
     (!uid.is_empty()).then_some(uid)
 }
 
+/// The paths no sync root may overlap, with the mountpoint as the config says
+/// now.
+pub(crate) fn sync_root_reserved() -> pdfs_core::syncroot::Reserved {
+    let config = pdfs_core::config::AppDirs::new()
+        .map(|dirs| dirs.load_config())
+        .unwrap_or_default();
+    pdfs_core::syncroot::Reserved::current(&config)
+}
+
 /// Pin (or, with `None`, unpin) the adopted device uid in `config.json`.
 pub(crate) fn set_adopted_device_uid(uid: Option<&str>) -> CoreResult<()> {
     let dirs = pdfs_core::config::AppDirs::new()
@@ -114,6 +124,22 @@ pub(crate) fn set_adopted_device_uid(uid: Option<&str>) -> CoreResult<()> {
         .map_err(|e| CoreError::internal(format!("write config: {e}")))
 }
 
+/// The name a folder moved in from `device` takes when `name` is already
+/// taken under this device's root, or `None` when it can keep its own.
+fn migrated_name(name: &str, device: &str, taken: &[String]) -> Option<String> {
+    let free = |candidate: &str| !taken.iter().any(|t| t == candidate);
+    if free(name) {
+        return None;
+    }
+    let base = format!("{name} ({device})");
+    if free(&base) {
+        return Some(base);
+    }
+    (2..)
+        .map(|n| format!("{base} {n}"))
+        .find(|candidate| free(candidate))
+}
+
 impl Core {
     // ---- devices ----------------------------------------------------------
 
@@ -140,7 +166,7 @@ impl Core {
     pub(crate) fn list_devices(&self) -> CoreResult<Vec<DeviceInfo>> {
         let devices = self
             .rt
-            .block_on(self.client.enumerate_devices())
+            .block_on(self.drive.enumerate_devices())
             .map_err(|e| CoreError::from_api(&e, "list devices"))?;
         // No cached device row yet means this machine syncs nothing, so none of
         // the listed devices is ours.
@@ -184,8 +210,8 @@ impl Core {
     }
 
     /// Adopt an existing device as *this* machine's, pinning it in `config.json`
-    /// so hostname changes and reinstalls stop registering duplicates
-    /// (features.md 5.1). `None` clears the pin and returns to hostname matching.
+    /// so hostname changes and reinstalls stop registering duplicates.
+    /// `None` clears the pin and returns to hostname matching.
     ///
     /// Refuses a uid that is not in the account: the whole point of the pin is
     /// that it is authoritative, so accepting a bad one would defer the failure
@@ -197,7 +223,7 @@ impl Core {
         };
         let remote = self
             .rt
-            .block_on(self.client.enumerate_devices())
+            .block_on(self.drive.enumerate_devices())
             .map_err(|e| CoreError::from_api(&e, "enumerate devices"))?;
         let dev = remote
             .into_iter()
@@ -240,7 +266,7 @@ impl Core {
         };
         let remote = self
             .rt
-            .block_on(self.client.enumerate_devices())
+            .block_on(self.drive.enumerate_devices())
             .map_err(|e| CoreError::from_api(&e, "enumerate devices"))?;
         let d = remote
             .into_iter()
@@ -260,7 +286,108 @@ impl Core {
         })
     }
 
-    // ---- device folder sync (devices.md, Phase 1) -------------------------
+    /// Move every folder another device backs up into this machine's own
+    /// device, so this machine carries on backing them up as itself. The other
+    /// device stays registered, without those folders.
+    ///
+    /// Device roots all live on the main volume, so each folder is one
+    /// server-side move: nothing is downloaded or uploaded, and no quota is
+    /// used twice. A folder whose name is taken here keeps its content under
+    /// "<name> (<device>)". A failed folder does not stop the others, and a
+    /// second run picks up whatever is still left on the other device.
+    ///
+    /// Nothing is synced to this disk here. The moved folders are now this
+    /// device's, so the ordinary restore offers them. Only folders that were
+    /// already synced here from the other device are touched: their uid
+    /// survives the move but their share does not.
+    pub(crate) fn migrate_device(&self, uid: &str) -> CoreResult<String> {
+        let source = self.restore_source(Some(uid))?;
+        let target = self.ensure_device()?;
+        if source.uid == target.uid {
+            return Err(CoreError::invalid(format!(
+                "{} is this computer's own device",
+                source.name
+            )));
+        }
+        let bad_root = |d: &StoredDevice| {
+            parse_uid(&d.root_uid)
+                .ok_or_else(|| CoreError::internal(format!("bad device root uid: {}", d.root_uid)))
+        };
+        let (source_root, target_root) = (bad_root(&source)?, bad_root(&target)?);
+        if source_root.volume_id != target_root.volume_id {
+            return Err(CoreError::invalid(
+                "the two devices are on different Proton Drive volumes; copy it instead",
+            ));
+        }
+
+        let mut taken: Vec<String> = self
+            .device_root_nodes(&target_root)?
+            .into_iter()
+            .filter(|n| !n.trashed)
+            .map(|n| n.name)
+            .collect();
+        let synced = self
+            .db
+            .sync_folder_list()
+            .map_err(|e| CoreError::internal(format!("db: {e:?}")))?;
+
+        let mut moved = 0usize;
+        let mut renamed: Vec<String> = Vec::new();
+        let mut left: Vec<String> = Vec::new();
+        let mut failed: Vec<String> = Vec::new();
+        for node in self.device_root_nodes(&source_root)? {
+            if node.trashed || node.name == PROFILE_DIR_NAME {
+                continue;
+            }
+            // A device root only ever holds folders (B68); anything else was
+            // put there by hand and is left for the user to deal with.
+            if !node.is_folder() {
+                left.push(node.name);
+                continue;
+            }
+            let new_name = migrated_name(&node.name, &source.name, &taken);
+            if let Err(e) = self.move_rename_remote(&node.uid, &target_root, new_name.as_deref()) {
+                warn!(name = %node.name, error = %e, "migrate: could not move folder");
+                failed.push(format!("{}: {e}", node.name));
+                continue;
+            }
+            let landed = new_name.clone().unwrap_or_else(|| node.name.clone());
+            if new_name.is_some() {
+                renamed.push(format!("{} -> {landed}", node.name));
+            }
+            taken.push(landed);
+            moved += 1;
+
+            let uid = node.uid.to_string();
+            for folder in synced.iter().filter(|f| f.remote_uid == uid) {
+                if let Err(e) = self.db.sync_folder_set_share(folder.id, &target.share_id) {
+                    warn!(id = folder.id, error = ?e, "migrate: could not re-point sync folder");
+                }
+                self.sync_now(Some(folder.id));
+            }
+        }
+        self.invalidate_children_of(&source_root);
+        self.invalidate_children_of(&target_root);
+
+        let mut message = format!("moved {moved} folder(s) from {}", source.name);
+        if !renamed.is_empty() {
+            message.push_str(&format!("; renamed: {}", renamed.join(", ")));
+        }
+        if !left.is_empty() {
+            message.push_str(&format!("; left behind: {}", left.join(", ")));
+        }
+        if !failed.is_empty() {
+            message.push_str(&format!("; failed: {}", failed.join(", ")));
+        }
+        info!(from = %source.name, to = %target.name, moved, failed = failed.len(),
+            "device migrated");
+        if moved == 0 && !failed.is_empty() {
+            return Err(CoreError::conflict(message));
+        }
+        Ok(message)
+    }
+
+    // ---- device folder sync -------------------------
 
     /// Auto-register (or recover) this machine as a Proton Drive Device, caching
     /// it so restarts reuse the same device. Recovery matches an existing remote
@@ -270,15 +397,14 @@ impl Core {
     /// Resolution order: the *adopted* uid pinned in `config.json`, then the
     /// cached DB row (validated remotely), then a hostname match, then create.
     /// The pin exists because the hostname heuristic silently registers a second
-    /// device after a rename or reinstall, orphaning the first one's folders
-    /// (features.md 5.1).
+    /// device after a rename or reinstall, orphaning the first one's folders.
     pub(crate) fn ensure_device(&self) -> CoreResult<StoredDevice> {
         let name = this_hostname();
         // Enumerate the remote devices once: used to validate the pin, validate
         // any cached record, and recover an existing device by name.
         let remote = self
             .rt
-            .block_on(self.client.enumerate_devices())
+            .block_on(self.drive.enumerate_devices())
             .map_err(|e| CoreError::from_api(&e, "enumerate devices"))?;
 
         // An adopted uid is an explicit instruction, so it outranks everything
@@ -337,7 +463,7 @@ impl Core {
             None => {
                 let d = self
                     .rt
-                    .block_on(self.client.create_device(&name, DeviceType::Linux))
+                    .block_on(self.drive.create_device(&name, DeviceType::Linux))
                     .map_err(|e| CoreError::from_api(&e, "create device"))?;
                 StoredDevice {
                     uid: d.uid.to_string(),
@@ -361,23 +487,27 @@ impl Core {
         root_uid: &NodeUid,
         name: &str,
     ) -> CoreResult<Option<NodeUid>> {
-        let uids = self
-            .rt
-            .block_on(self.client.enumerate_folder_children_node_uids(root_uid))
-            .map_err(|e| CoreError::from_api(&e, "list device root"))?;
-        if uids.is_empty() {
-            return Ok(None);
-        }
-        let nodes = self
-            .rt
-            .block_on(self.client.enumerate_nodes(&uids))
-            .map_err(|e| CoreError::from_api(&e, "resolve device root children"))?;
-        Ok(nodes
+        Ok(self
+            .device_root_nodes(root_uid)?
             .into_iter()
             .find(|n| n.is_folder() && !n.trashed && n.name == name)
             .map(|n| n.uid))
     }
 
+    /// Everything directly under a device root, trashed nodes included.
+    fn device_root_nodes(&self, root_uid: &NodeUid) -> CoreResult<Vec<Node>> {
+        let uids = self
+            .rt
+            .block_on(self.drive.enumerate_folder_children_node_uids(root_uid))
+            .map_err(|e| CoreError::from_api(&e, "list device root"))?;
+        if uids.is_empty() {
+            return Ok(Vec::new());
+        }
+        self.rt
+            .block_on(self.drive.enumerate_nodes(&uids))
+            .map_err(|e| CoreError::from_api(&e, "resolve device root children"))
+    }
+
     /// Add a local folder to this device's sync set: register the device if
     /// needed, create a matching folder under the device root, upload the local
     /// tree into it once, and record the mapping. Phase 1 is a one-shot upload —
@@ -396,18 +526,20 @@ impl Core {
             .map_err(|e| CoreError::internal(format!("canonicalize {}: {e}", local.display())))?;
         let local_str = local.to_string_lossy().to_string();
 
-        // Reject duplicates up front for a clear error (UNIQUE would also catch it).
-        if self
+        // `/`, the home folder, the mount, this app's own data, and a folder
+        // inside or around another root are refused (`syncroot::problem`). A
+        // duplicate is one of those, refused here for a clear error before
+        // the UNIQUE constraint would catch it.
+        let others = self
             .db
             .sync_folder_list()
             .map_err(|e| CoreError::internal(format!("db: {e:?}")))?
             .iter()
-            .any(|f| f.local_path == local_str)
-        {
-            return Err(CoreError::invalid(format!(
-                "{} is already synced",
-                local.display()
-            )));
+            .map(|f| PathBuf::from(&f.local_path))
+            .collect::<Vec<_>>();
+        let reserved = sync_root_reserved();
+        if let Some(problem) = pdfs_core::syncroot::problem(&local, &others, &reserved) {
+            return Err(CoreError::invalid(problem));
         }
 
         let name = local
@@ -446,10 +578,7 @@ impl Core {
             }
             None => self
                 .rt
-                .block_on(
-                    self.client
-                        .create_folder(&root_uid, &name, Some(now_secs())),
-                )
+                .block_on(self.drive.create_folder(&root_uid, &name, Some(now_secs())))
                 .map_err(|e| CoreError::from_api(&e, &format!("create device folder {name}")))?,
         };
 
@@ -539,12 +668,16 @@ impl Core {
                     } else {
                         p.total.max(p.done) as u64
                     },
+                    // Most passes find nothing; only one that queues work is
+                    // the drive syncing.
+                    background: true,
                 },
                 SyncPhase::Applying => JobItem {
                     title: format!("Syncing {folder}"),
                     detail: p.current.clone(),
                     done: p.done as u64,
                     total: p.total.max(p.done) as u64,
+                    background: false,
                 },
             });
         }
@@ -603,7 +736,7 @@ impl Core {
             && let Some(uid) = parse_uid(&folder.remote_uid)
             && let Err(e) = self
                 .rt
-                .block_on(self.client.trash_nodes(&[uid]))
+                .block_on(self.drive.trash_nodes(&[uid]))
                 .and_then(batch::into_unit)
         {
             warn!(id, error = %e, "delete remote device folder failed");
@@ -619,23 +752,16 @@ impl Core {
         };
     }
 
-    /// A sibling Core that shares this one's client/rt/cache/db (and transfer,
-    /// activity, mount registries) but gets a **fresh, empty `State`** — its own
-    /// inode space starting at [`ROOT_INO`]. Used to root a secondary FUSE session
-    /// at an `ondemand` sync folder without colliding with the main mount's inodes
-    /// (devices.md Phase 3).
+    /// A sibling Core for a secondary FUSE session rooted at an `ondemand` sync
+    /// folder. It shares everything with this one,
+    /// the tree included, except what belongs to a session: its root and its
+    /// kernel channel, both filled in when the session is built.
     pub(crate) fn fork_state(&self) -> Core {
         let mut fork = self.clone();
         fork.primary = false;
-        let share_access = self.state().share_access.clone();
-        fork.state = Arc::new(Mutex::new(State::new(self.db.clone(), share_access, 2)));
-        // A fresh inode space needs a fresh notification channel: this fork's
-        // session is the only one that knows these inodes, so it must be the one
-        // notified about them. Filled in by `spawn_ondemand_mount`.
+        fork.root = Arc::new(OnceLock::new());
         fork.notifier = Arc::new(OnceLock::new());
         fork.session_live = Arc::new(std::sync::atomic::AtomicBool::new(false));
-        // Size upgrades are keyed by inode, which is per-fork too.
-        fork.size_upgrades = Arc::new(Mutex::new(HashMap::new()));
         fork
     }
 
@@ -853,12 +979,29 @@ impl Core {
                 if folder.state != "idle" {
                     return Err(SwitchBlocked::NotNow);
                 }
+                // `idle` only says the last pass applied everything it tried.
+                // It never tries an ignored path, a symlink or a folder it
+                // cannot read, it defers a file open for writing, and a file can
+                // change after it ends. The eviction below deletes all of those
+                // for good, so it waits until nothing here is missing from Drive
+                // (B198).
+                let baseline = self
+                    .db
+                    .sync_entries(id)
+                    .map_err(|e| SwitchBlocked::Failed(format!("db: {e:?}")))?;
+                if let Some(reason) =
+                    sync::mirror_tree_unsynced(&local, &baseline, &self.ignore_rules(&local))
+                {
+                    return Err(SwitchBlocked::Failed(format!(
+                        "going online-only would delete what is only on this computer: {reason}"
+                    )));
+                }
                 let root_uid = parse_uid(&folder.remote_uid).ok_or_else(|| {
                     SwitchBlocked::Failed(format!("bad remote uid: {}", folder.remote_uid))
                 })?;
                 let root = self
                     .rt
-                    .block_on(self.client.enumerate_nodes(std::slice::from_ref(&root_uid)))
+                    .block_on(self.drive.enumerate_nodes(std::slice::from_ref(&root_uid)))
                     .map_err(|e| SwitchBlocked::Failed(format!("fetch remote root: {e}")))?
                     .into_iter()
                     .next()
@@ -937,8 +1080,52 @@ impl Core {
         }
     }
 
-    /// Spawn a secondary FUSE session rooted at `root` over `local` on a forked
-    /// inode space. Clears any stale kernel mount first (a crashed run can leave
+    /// Forget what a mirror folder synced before, so its next pass compares the
+    /// two sides as on the first sync: what one side has alone is copied to the
+    /// other, and a file that differs is kept twice as a conflict. Nothing is
+    /// deleted on either side.
+    ///
+    /// This is the way out for a folder whose passes refuse to run because its
+    /// whole local copy, or its whole copy on Drive, is gone (#46). The baseline
+    /// is what makes that read as "delete everything", and it is what this
+    /// drops. A queued switch to on-demand is dropped with it: the push pass
+    /// that switch runs reads an unrecorded local file as new and would upload
+    /// a second copy of every file Drive already has.
+    pub(crate) fn reset_sync_folder(&self, id: i64) -> CoreResult<String> {
+        let lock = self.sync_lock(id);
+        let Some(_guard) = lock.try_lock() else {
+            return Err(CoreError::conflict(
+                "this folder is syncing; try again when the pass ends",
+            ));
+        };
+        let folder = self
+            .db
+            .sync_folder_get(id)
+            .map_err(|e| CoreError::internal(format!("db: {e:?}")))?
+            .ok_or_else(|| CoreError::not_found(format!("no synced folder with id {id}")))?;
+        if folder.mode != "mirror" {
+            return Err(CoreError::invalid(
+                "an online-only folder keeps nothing on this computer to sync from scratch",
+            ));
+        }
+        self.db
+            .sync_entries_clear(id)
+            .map_err(|e| CoreError::internal(format!("db: {e:?}")))?;
+        if folder.pending_mode.as_deref() == Some("ondemand") {
+            self.db
+                .sync_folder_set_pending_mode(id, None)
+                .map_err(|e| CoreError::internal(format!("db: {e:?}")))?;
+        }
+        let _ = self.sync_tx.send(sync::SyncMsg::Reconcile(id));
+        info!(id, path = %folder.local_path, "sync folder reset");
+        Ok(format!(
+            "{} will sync from scratch",
+            base_name(&folder.local_path)
+        ))
+    }
+
+    /// Spawn a secondary FUSE session rooted at `root` over `local` from a
+    /// [`Core::fork_state`] sibling. Clears any stale kernel mount first (a crashed run can leave
     /// one, which would fail the fresh mount with EBUSY).
     pub(crate) fn spawn_ondemand_mount(
         &self,
@@ -996,8 +1183,7 @@ impl Core {
     /// restart (their local dirs are empty on disk — the files live in the cloud).
     /// Best-effort per folder: a missing local path or a failed remote fetch marks
     /// the folder `error` and moves on rather than aborting the rest. Runs on its
-    /// own thread from `mount` so the network fetches never block startup
-    /// (devices.md Phase 4).
+    /// own thread from `mount` so the network fetches never block startup.
     pub(crate) fn restore_ondemand_mounts(&self) {
         let folders = match self.db.sync_folder_list() {
             Ok(f) => f,
@@ -1017,7 +1203,7 @@ impl Core {
             };
             let root = match self
                 .rt
-                .block_on(self.client.enumerate_nodes(std::slice::from_ref(&root_uid)))
+                .block_on(self.drive.enumerate_nodes(std::slice::from_ref(&root_uid)))
             {
                 Ok(v) => match v.into_iter().next() {
                     Some(n) => n,
@@ -1119,10 +1305,38 @@ mod tests {
     use pdfs_core::db::StoredSyncFolder;
 
     use super::{
-        ApplicableMountMode, commit_after_teardown, pending_intent_matches,
+        ApplicableMountMode, commit_after_teardown, migrated_name, pending_intent_matches,
         restore_snapshot_matches, select_mode_transition,
     };
 
+    #[test]
+    fn migrated_folder_keeps_its_name_when_it_is_free() {
+        let taken = vec!["Pictures".to_string()];
+        assert_eq!(migrated_name("Documents", "DESKTOP-1", &taken), None);
+    }
+
+    #[test]
+    fn migrated_folder_is_named_after_its_device_on_a_clash() {
+        let taken = vec!["Documents".to_string()];
+        assert_eq!(
+            migrated_name("Documents", "DESKTOP-1", &taken).as_deref(),
+            Some("Documents (DESKTOP-1)")
+        );
+    }
+
+    #[test]
+    fn migrated_folder_is_numbered_when_the_device_name_is_taken_too() {
+        let taken = vec![
+            "Documents".to_string(),
+            "Documents (DESKTOP-1)".to_string(),
+            "Documents (DESKTOP-1) 2".to_string(),
+        ];
+        assert_eq!(
+            migrated_name("Documents", "DESKTOP-1", &taken).as_deref(),
+            Some("Documents (DESKTOP-1) 3")
+        );
+    }
+
     #[test]
     fn unknown_mode_cannot_select_a_destructive_transition() {
         let mut unmounts = 0;

crates/pdfs-fuse/src/drive.rs

@@ -0,0 +1,524 @@
+//! The calls the sync core makes to Drive, behind a trait.
+//!
+//! `Core` used to hold a concrete [`ProtonDriveClient`], so no test could make
+//! Drive answer late, answer stale, or not answer at all, and the interleavings
+//! behind most recent bugs could only be found on a real account over a slow
+//! link. [`DriveApi`] is the part of the
+//! client the mount, the drain, the event feed and the mirror engine use; the
+//! real client implements it by forwarding, and the simulation tests implement
+//! it with an in-memory Drive that injects Drive's known faults.
+//!
+//! Sharing, Photos, invitations, public links and the rest of the device calls
+//! stay on the concrete client (`Core::client`) until a test needs them faked.
+//! Listing and registering devices are here, so a simulated daemon can sync a
+//! local folder.
+//!
+//! The method names match the client's own, so a call site reads the same
+//! whichever it goes through. The client's generic methods (a reader or writer
+//! of any type) cannot be part of an object-safe trait, so the trait takes them
+//! as trait objects and `impl dyn DriveApi` puts the generic signatures back.
+
+use std::io::{Read, Write};
+use std::sync::Arc;
+
+use async_trait::async_trait;
+use futures::StreamExt as _;
+use futures::stream::BoxStream;
+use proton_drive_rs::proton_sdk::account::Quota;
+use proton_drive_rs::proton_sdk::error::Result;
+use proton_drive_rs::proton_sdk::ids::{DriveEventId, NodeUid};
+use proton_drive_rs::{
+    AvailableNameTarget, Device, DeviceType, DriveEvent, DriveEventScopeId, Node, NodeMoveItem,
+    ProtonDriveClient, RevisionReader, Thumbnail,
+};
+
+/// One outcome per node of a batch request; see [`ProtonDriveClient::trash_nodes`].
+pub(crate) type NodeOutcomes = Vec<(NodeUid, Result<()>)>;
+
+/// The outcomes of a streaming batch request, one item per node as it lands.
+pub(crate) type OutcomeStream<'a> = BoxStream<'a, Result<(NodeUid, Result<()>)>>;
+
+/// Drive as the sync core sees it. See the module documentation.
+#[async_trait]
+pub(crate) trait DriveApi: Send + Sync {
+    async fn get_my_files_folder(&self) -> Result<Node>;
+
+    async fn get_node(&self, uid: &NodeUid) -> Result<Option<Node>>;
+
+    async fn enumerate_nodes(&self, uids: &[NodeUid]) -> Result<Vec<Node>>;
+
+    /// As [`DriveApi::enumerate_nodes`], but files carry no claimed size or
+    /// modification time; see [`ProtonDriveClient::enumerate_nodes_light`].
+    async fn enumerate_nodes_light(&self, uids: &[NodeUid]) -> Result<Vec<Node>>;
+
+    async fn enumerate_folder_children_node_uids(
+        &self,
+        folder_uid: &NodeUid,
+    ) -> Result<Vec<NodeUid>>;
+
+    async fn enumerate_events(
+        &self,
+        scope: &DriveEventScopeId,
+        cursor: Option<&DriveEventId>,
+    ) -> Result<Vec<DriveEvent>>;
+
+    async fn invalidate_caches_for_event(&self, event: &DriveEvent) -> Result<()>;
+
+    async fn create_folder(
+        &self,
+        parent_uid: &NodeUid,
+        name: &str,
+        last_modification_time: Option<i64>,
+    ) -> Result<NodeUid>;
+
+    async fn upload_file(
+        &self,
+        parent_uid: &NodeUid,
+        name: &str,
+        media_type: &str,
+        contents: &[u8],
+    ) -> Result<NodeUid>;
+
+    #[allow(clippy::too_many_arguments)]
+    async fn upload_file_from_dyn(
+        &self,
+        parent_uid: &NodeUid,
+        name: &str,
+        media_type: &str,
+        reader: &mut (dyn Read + Send),
+        intended_size: i64,
+        thumbnails: Vec<Thumbnail>,
+        last_modification_time: Option<i64>,
+        aead: bool,
+    ) -> Result<NodeUid>;
+
+    #[allow(clippy::too_many_arguments)]
+    async fn upload_file_replacing_draft_from_dyn(
+        &self,
+        parent_uid: &NodeUid,
+        name: &str,
+        media_type: &str,
+        reader: &mut (dyn Read + Send),
+        intended_size: i64,
+        thumbnails: Vec<Thumbnail>,
+        last_modification_time: Option<i64>,
+        aead: bool,
+    ) -> Result<NodeUid>;
+
+    async fn upload_new_revision_from_dyn(
+        &self,
+        file_uid: &NodeUid,
+        reader: &mut (dyn Read + Send),
+        intended_size: i64,
+        thumbnails: Vec<Thumbnail>,
+        last_modification_time: Option<i64>,
+    ) -> Result<()>;
+
+    async fn open_revision(&self, uid: &NodeUid) -> Result<Arc<dyn RevisionRead>>;
+
+    async fn download_file_to_dyn(
+        &self,
+        uid: &NodeUid,
+        output: &mut (dyn Write + Send),
+    ) -> Result<()>;
+
+    async fn download_revision_to_dyn(
+        &self,
+        file_uid: &NodeUid,
+        revision_id: &str,
+        writer: &mut (dyn Write + Send),
+    ) -> Result<()>;
+
+    async fn rename_node(
+        &self,
+        uid: &NodeUid,
+        new_name: &str,
+        new_media_type: Option<&str>,
+    ) -> Result<()>;
+
+    async fn move_node(&self, uid: &NodeUid, new_parent: &NodeUid) -> Result<()>;
+
+    /// See [`ProtonDriveClient::copy_node`].
+    async fn copy_node(
+        &self,
+        uid: &NodeUid,
+        new_parent: &NodeUid,
+        name: Option<&str>,
+    ) -> Result<NodeUid>;
+
+    /// See [`ProtonDriveClient::get_available_name`].
+    async fn get_available_name(
+        &self,
+        parent_uid: &NodeUid,
+        name: &str,
+        target: AvailableNameTarget,
+    ) -> Result<String>;
+
+    fn move_nodes_streaming<'a>(
+        &'a self,
+        items: Vec<NodeMoveItem>,
+        new_parent: NodeUid,
+    ) -> OutcomeStream<'a>;
+
+    async fn trash_nodes(&self, uids: &[NodeUid]) -> Result<NodeOutcomes>;
+
+    async fn restore_nodes(&self, uids: &[NodeUid]) -> Result<NodeOutcomes>;
+
+    fn restore_nodes_streaming<'a>(&'a self, uids: &[NodeUid]) -> OutcomeStream<'a>;
+
+    fn delete_nodes_streaming<'a>(&'a self, uids: &[NodeUid]) -> OutcomeStream<'a>;
+
+    async fn enumerate_trash_node_uids(&self) -> Result<Vec<NodeUid>>;
+
+    /// The account's storage, across every Proton product.
+    async fn quota(&self) -> Result<Quota>;
+
+    /// Every computer that backs up to the account.
+    async fn enumerate_devices(&self) -> Result<Vec<Device>>;
+
+    /// Register a computer, with a root folder of its own named `name`.
+    async fn create_device(&self, name: &str, device_type: DeviceType) -> Result<Device>;
+
+    /// Called by the drain once it has let go of the blob of an upload to
+    /// `uid` that landed, or retired the create that made `uid`, before the
+    /// tree has the node, so a simulation can hold it there. Blocks the drain
+    /// worker it is called on.
+    #[cfg(test)]
+    fn landing(&self, _uid: &NodeUid) {}
+}
+
+/// The generic signatures of the client, over the object-safe ones above.
+impl dyn DriveApi {
+    #[allow(clippy::too_many_arguments)]
+    pub(crate) async fn upload_file_from<R: Read + Send>(
+        &self,
+        parent_uid: &NodeUid,
+        name: &str,
+        media_type: &str,
+        mut reader: R,
+        intended_size: i64,
+        thumbnails: Vec<Thumbnail>,
+        last_modification_time: Option<i64>,
+        aead: bool,
+    ) -> Result<NodeUid> {
+        self.upload_file_from_dyn(
+            parent_uid,
+            name,
+            media_type,
+            &mut reader,
+            intended_size,
+            thumbnails,
+            last_modification_time,
+            aead,
+        )
+        .await
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    pub(crate) async fn upload_file_replacing_draft_from<R: Read + Send>(
+        &self,
+        parent_uid: &NodeUid,
+        name: &str,
+        media_type: &str,
+        mut reader: R,
+        intended_size: i64,
+        thumbnails: Vec<Thumbnail>,
+        last_modification_time: Option<i64>,
+        aead: bool,
+    ) -> Result<NodeUid> {
+        self.upload_file_replacing_draft_from_dyn(
+            parent_uid,
+            name,
+            media_type,
+            &mut reader,
+            intended_size,
+            thumbnails,
+            last_modification_time,
+            aead,
+        )
+        .await
+    }
+
+    pub(crate) async fn upload_new_revision_from<R: Read + Send>(
+        &self,
+        file_uid: &NodeUid,
+        mut reader: R,
+        intended_size: i64,
+        thumbnails: Vec<Thumbnail>,
+        last_modification_time: Option<i64>,
+    ) -> Result<()> {
+        self.upload_new_revision_from_dyn(
+            file_uid,
+            &mut reader,
+            intended_size,
+            thumbnails,
+            last_modification_time,
+        )
+        .await
+    }
+
+    pub(crate) async fn download_file_to<W: Write + Send>(
+        &self,
+        uid: &NodeUid,
+        output: &mut W,
+    ) -> Result<()> {
+        self.download_file_to_dyn(uid, output).await
+    }
+
+    pub(crate) async fn download_revision_to<W: Write + Send>(
+        &self,
+        file_uid: &NodeUid,
+        revision_id: &str,
+        writer: &mut W,
+    ) -> Result<()> {
+        self.download_revision_to_dyn(file_uid, revision_id, writer)
+            .await
+    }
+}
+
+/// An open revision that block reads are served from; see [`RevisionReader`].
+#[async_trait]
+pub(crate) trait RevisionRead: Send + Sync {
+    /// Plaintext size of the revision.
+    fn size(&self) -> u64;
+
+    /// Plaintext size of each block, in block order.
+    fn block_sizes(&self) -> &[u64];
+
+    async fn read_at(&self, offset: u64, length: u64) -> Result<Vec<u8>>;
+}
+
+#[async_trait]
+impl RevisionRead for RevisionReader {
+    fn size(&self) -> u64 {
+        RevisionReader::size(self)
+    }
+
+    fn block_sizes(&self) -> &[u64] {
+        RevisionReader::block_sizes(self)
+    }
+
+    async fn read_at(&self, offset: u64, length: u64) -> Result<Vec<u8>> {
+        RevisionReader::read_at(self, offset, length).await
+    }
+}
+
+#[async_trait]
+impl DriveApi for ProtonDriveClient {
+    async fn get_my_files_folder(&self) -> Result<Node> {
+        ProtonDriveClient::get_my_files_folder(self).await
+    }
+
+    async fn get_node(&self, uid: &NodeUid) -> Result<Option<Node>> {
+        ProtonDriveClient::get_node(self, uid).await
+    }
+
+    async fn enumerate_nodes(&self, uids: &[NodeUid]) -> Result<Vec<Node>> {
+        ProtonDriveClient::enumerate_nodes(self, uids).await
+    }
+
+    async fn enumerate_nodes_light(&self, uids: &[NodeUid]) -> Result<Vec<Node>> {
+        ProtonDriveClient::enumerate_nodes_light(self, uids).await
+    }
+
+    async fn enumerate_folder_children_node_uids(
+        &self,
+        folder_uid: &NodeUid,
+    ) -> Result<Vec<NodeUid>> {
+        ProtonDriveClient::enumerate_folder_children_node_uids(self, folder_uid).await
+    }
+
+    async fn enumerate_events(
+        &self,
+        scope: &DriveEventScopeId,
+        cursor: Option<&DriveEventId>,
+    ) -> Result<Vec<DriveEvent>> {
+        ProtonDriveClient::enumerate_events(self, scope, cursor).await
+    }
+
+    async fn invalidate_caches_for_event(&self, event: &DriveEvent) -> Result<()> {
+        ProtonDriveClient::invalidate_caches_for_event(self, event).await
+    }
+
+    async fn create_folder(
+        &self,
+        parent_uid: &NodeUid,
+        name: &str,
+        last_modification_time: Option<i64>,
+    ) -> Result<NodeUid> {
+        ProtonDriveClient::create_folder(self, parent_uid, name, last_modification_time).await
+    }
+
+    async fn upload_file(
+        &self,
+        parent_uid: &NodeUid,
+        name: &str,
+        media_type: &str,
+        contents: &[u8],
+    ) -> Result<NodeUid> {
+        ProtonDriveClient::upload_file(self, parent_uid, name, media_type, contents).await
+    }
+
+    async fn upload_file_from_dyn(
+        &self,
+        parent_uid: &NodeUid,
+        name: &str,
+        media_type: &str,
+        reader: &mut (dyn Read + Send),
+        intended_size: i64,
+        thumbnails: Vec<Thumbnail>,
+        last_modification_time: Option<i64>,
+        aead: bool,
+    ) -> Result<NodeUid> {
+        ProtonDriveClient::upload_file_from(
+            self,
+            parent_uid,
+            name,
+            media_type,
+            reader,
+            intended_size,
+            thumbnails,
+            last_modification_time,
+            aead,
+        )
+        .await
+    }
+
+    async fn upload_file_replacing_draft_from_dyn(
+        &self,
+        parent_uid: &NodeUid,
+        name: &str,
+        media_type: &str,
+        reader: &mut (dyn Read + Send),
+        intended_size: i64,
+        thumbnails: Vec<Thumbnail>,
+        last_modification_time: Option<i64>,
+        aead: bool,
+    ) -> Result<NodeUid> {
+        ProtonDriveClient::upload_file_replacing_draft_from(
+            self,
+            parent_uid,
+            name,
+            media_type,
+            reader,
+            intended_size,
+            thumbnails,
+            last_modification_time,
+            aead,
+        )
+        .await
+    }
+
+    async fn upload_new_revision_from_dyn(
+        &self,
+        file_uid: &NodeUid,
+        reader: &mut (dyn Read + Send),
+        intended_size: i64,
+        thumbnails: Vec<Thumbnail>,
+        last_modification_time: Option<i64>,
+    ) -> Result<()> {
+        ProtonDriveClient::upload_new_revision_from(
+            self,
+            file_uid,
+            reader,
+            intended_size,
+            thumbnails,
+            last_modification_time,
+        )
+        .await
+    }
+
+    async fn open_revision(&self, uid: &NodeUid) -> Result<Arc<dyn RevisionRead>> {
+        let reader = ProtonDriveClient::open_revision(self, uid).await?;
+        Ok(Arc::new(reader))
+    }
+
+    async fn download_file_to_dyn(
+        &self,
+        uid: &NodeUid,
+        output: &mut (dyn Write + Send),
+    ) -> Result<()> {
+        ProtonDriveClient::download_file_to(self, uid, &mut &mut *output).await
+    }
+
+    async fn download_revision_to_dyn(
+        &self,
+        file_uid: &NodeUid,
+        revision_id: &str,
+        writer: &mut (dyn Write + Send),
+    ) -> Result<()> {
+        ProtonDriveClient::download_revision_to(self, file_uid, revision_id, &mut &mut *writer)
+            .await
+    }
+
+    async fn rename_node(
+        &self,
+        uid: &NodeUid,
+        new_name: &str,
+        new_media_type: Option<&str>,
+    ) -> Result<()> {
+        ProtonDriveClient::rename_node(self, uid, new_name, new_media_type).await
+    }
+
+    async fn move_node(&self, uid: &NodeUid, new_parent: &NodeUid) -> Result<()> {
+        ProtonDriveClient::move_node(self, uid, new_parent).await
+    }
+
+    async fn copy_node(
+        &self,
+        uid: &NodeUid,
+        new_parent: &NodeUid,
+        name: Option<&str>,
+    ) -> Result<NodeUid> {
+        ProtonDriveClient::copy_node(self, uid, new_parent, name).await
+    }
+
+    async fn get_available_name(
+        &self,
+        parent_uid: &NodeUid,
+        name: &str,
+        target: AvailableNameTarget,
+    ) -> Result<String> {
+        ProtonDriveClient::get_available_name(self, parent_uid, name, target).await
+    }
+
+    fn move_nodes_streaming<'a>(
+        &'a self,
+        items: Vec<NodeMoveItem>,
+        new_parent: NodeUid,
+    ) -> OutcomeStream<'a> {
+        ProtonDriveClient::move_nodes_streaming(self, items, new_parent).boxed()
+    }
+
+    async fn trash_nodes(&self, uids: &[NodeUid]) -> Result<NodeOutcomes> {
+        ProtonDriveClient::trash_nodes(self, uids).await
+    }
+
+    async fn restore_nodes(&self, uids: &[NodeUid]) -> Result<NodeOutcomes> {
+        ProtonDriveClient::restore_nodes(self, uids).await
+    }
+
+    fn restore_nodes_streaming<'a>(&'a self, uids: &[NodeUid]) -> OutcomeStream<'a> {
+        ProtonDriveClient::restore_nodes_streaming(self, uids).boxed()
+    }
+
+    fn delete_nodes_streaming<'a>(&'a self, uids: &[NodeUid]) -> OutcomeStream<'a> {
+        ProtonDriveClient::delete_nodes_streaming(self, uids).boxed()
+    }
+
+    async fn enumerate_trash_node_uids(&self) -> Result<Vec<NodeUid>> {
+        ProtonDriveClient::enumerate_trash_node_uids(self).await
+    }
+
+    async fn quota(&self) -> Result<Quota> {
+        ProtonDriveClient::quota(self).await
+    }
+
+    async fn enumerate_devices(&self) -> Result<Vec<Device>> {
+        ProtonDriveClient::enumerate_devices(self).await
+    }
+
+    async fn create_device(&self, name: &str, device_type: DeviceType) -> Result<Device> {
+        ProtonDriveClient::create_device(self, name, device_type).await
+    }
+}

crates/pdfs-fuse/src/events.rs

@@ -9,7 +9,7 @@
 //! through one place (the status, transfers, sync progress) and publishes them
 //! when they differ.
 
-use std::collections::BTreeSet;
+use std::collections::{BTreeSet, HashMap};
 use std::sync::Arc;
 use std::time::Duration;
 
@@ -153,13 +153,15 @@ pub(crate) fn transfers_line(items: Vec<TransferItem>, jobs: Vec<JobItem>) -> Op
 
 /// Watch what changes without a single place to publish it from, and publish it
 /// when it differs from the last look: the status (queue counts, cache use,
-/// online, pause), the transfers snapshot, and the synced folders with their
-/// live progress. Looks only while someone is subscribed.
+/// online, pause), the transfers snapshot, the synced folders with their
+/// live progress, and which nodes have a sync issue. Looks only while someone
+/// is subscribed.
 pub(crate) fn run_event_sampler(core: Core, username: String, mountpoint: std::path::PathBuf) {
     let mut transfers: Option<Arc<str>> = None;
     let mut status: Option<String> = None;
     let mut queue: Option<String> = None;
     let mut locations: Option<String> = None;
+    let mut issues: Option<HashMap<i64, String>> = None;
     let mut tick = 0u32;
     while core.shutdown.sleep(SAMPLE_INTERVAL) {
         if !core.events.has_subscribers() {
@@ -169,6 +171,7 @@ pub(crate) fn run_event_sampler(core: Core, username: String, mountpoint: std::p
             status = None;
             queue = None;
             locations = None;
+            issues = None;
             continue;
         }
         let line = transfers_line(core.transfers.snapshot(), core.jobs_snapshot());
@@ -196,6 +199,15 @@ pub(crate) fn run_event_sampler(core: Core, username: String, mountpoint: std::p
         }
         queue = Some(queue_key);
 
+        // An issue shows on its node in the file browser: raised, cleared,
+        // landed or discarded, the listing is out of date.
+        if let Ok(now) = core.db.node_issues() {
+            if issues.as_ref().is_some_and(|last| *last != now) {
+                core.events.publish(&[Topic::Files]);
+            }
+            issues = Some(now);
+        }
+
         if let Ok(now) = core.list_locations() {
             let key = serde_json::to_string(&now).unwrap_or_default();
             if locations.as_ref().is_some_and(|last| *last != key) {
@@ -223,6 +235,8 @@ fn status_keys(status: &CtlResponse) -> (String, String) {
         used,
         budget,
         online,
+        session_expired,
+        tokens_unsaved,
         pending_uploads,
         pending_changes,
         ..
@@ -235,7 +249,7 @@ fn status_keys(status: &CtlResponse) -> (String, String) {
     );
     let key = format!(
         "{queue}/{staged_bytes}/{paused}/{paused_until:?}/{username}/{mountpoint}/{pinned}/\
-         {used}/{budget}/{online}"
+         {used}/{budget}/{online}/{session_expired}/{tokens_unsaved}"
     );
     (key, queue)
 }
@@ -313,6 +327,9 @@ mod tests {
             budget: 0,
             pins: Vec::new(),
             online: true,
+            session_expired: false,
+            tokens_unsaved: false,
+            version: "3.3.0".into(),
             pending_uploads: 1,
             pending_changes: 0,
         };

crates/pdfs-fuse/src/link.rs

@@ -9,15 +9,16 @@
 //! queued path, and the probe thread here flips it back when Proton answers.
 
 use std::future::Future;
-use std::sync::atomic::Ordering;
+use std::sync::atomic::{AtomicBool, Ordering};
 use std::time::{Duration, Instant};
 
 use parking_lot::{Condvar, Mutex};
+use pdfs_core::error::session_revoked;
 use proton_drive_rs::proton_sdk::api::ResponseCode;
 use proton_drive_rs::proton_sdk::error::{ProtonApiError, ProtonError};
 use tracing::{debug, info, warn};
 
-use crate::{Core, ONLINE_PROBE_MAX, ONLINE_PROBE_MIN, ROOT_INO};
+use crate::{Core, ONLINE_PROBE_MAX, ONLINE_PROBE_MIN};
 
 /// How long a remote call a FUSE handler is waiting on may take before the link
 /// is treated as down.
@@ -28,6 +29,13 @@ use crate::{Core, ONLINE_PROBE_MAX, ONLINE_PROBE_MIN, ROOT_INO};
 /// keep waiting for; queueing the change is the better answer.
 pub(crate) const INTERACTIVE_CALL_TIMEOUT: Duration = Duration::from_secs(20);
 
+/// How long a mount thread waits on a remote read that answers a batch: a
+/// chunk of file sizes, or the list of shares. Longer than an interactive call,
+/// since its answer grows with the batch, but well short of the SDK's own retry
+/// budget, which held a worker for minutes on a stalled link
+/// (`docs/BUGS.md` B220).
+pub(crate) const BATCH_CALL_TIMEOUT: Duration = Duration::from_secs(60);
+
 /// How long one probe may wait for an answer. A probe is a single small request,
 /// and a probe stuck in the SDK's retry budget would delay noticing the link is
 /// back by as long as it waits.
@@ -54,6 +62,26 @@ pub(crate) struct Link {
     changed: Condvar,
     /// Folders listed from the DB alone while offline, to relist once back.
     pub(crate) stale_listings: Mutex<std::collections::HashSet<u64>>,
+    /// Proton refused the session itself ([`session_revoked`]). The mount is
+    /// offline then, but no probe brings it back: only a new login does, and
+    /// that restarts the daemon. Read by front-ends through `Response::Status`,
+    /// so they can ask the user to sign in again rather than say "offline".
+    pub(crate) session_expired: AtomicBool,
+    /// Proton refused the session, but only because another process rotated
+    /// it (`pdfs unlock`): the keyring holds the live tokens. The mount loop
+    /// ends the mount for the daemon to mount again from the keyring.
+    pub(crate) resume_stored: AtomicBool,
+}
+
+impl Link {
+    /// The link of a mount that comes up with Proton refusing its session, or
+    /// not.
+    pub(crate) fn starting(session_expired: bool) -> Self {
+        Self {
+            session_expired: AtomicBool::new(session_expired),
+            ..Default::default()
+        }
+    }
 }
 
 /// Whether a failed call failed because Proton could not be reached, rather
@@ -86,13 +114,47 @@ pub(crate) fn no_answer(after: Duration) -> ProtonError {
     })
 }
 
+/// The slowest upload rate an upload's deadline allows for, past the
+/// metadata budget it starts with. Far below any link that works, so only a
+/// transfer that has stopped moving runs into it.
+const SLOWEST_UPLOAD: u64 = 32 * 1024;
+
+/// How many uploads can share the upload cap at once: one per drain worker
+/// and one per mirror sync task.
+const UPLOAD_SLOTS: u64 = (crate::DRAIN_WORKERS + crate::sync::SYNC_CONCURRENCY) as u64;
+
+/// How long an upload of `len` bytes may take before the link is treated as
+/// down: the budget of a metadata call, plus the bytes at [`SLOWEST_UPLOAD`].
+///
+/// An upload cap of `cap` bytes per second (`0` for none) is shared by every
+/// upload running, so each may get as little as its share of it. Below
+/// [`SLOWEST_UPLOAD`] a share counts as the slowest rate instead: measured
+/// against the fixed rate, a large file under a low cap ran out of time on
+/// every attempt, took the mount offline each time, and started over from
+/// its first byte.
+pub(crate) fn upload_deadline(len: u64, cap: u64) -> Duration {
+    let slowest = match cap {
+        0 => SLOWEST_UPLOAD,
+        cap => SLOWEST_UPLOAD.min((cap / UPLOAD_SLOTS).max(1)),
+    };
+    INTERACTIVE_CALL_TIMEOUT + Duration::from_secs(len / slowest)
+}
+
 /// Run a remote call, giving up after [`INTERACTIVE_CALL_TIMEOUT`].
 pub(crate) async fn bounded<T>(
     call: impl Future<Output = Result<T, ProtonError>>,
 ) -> Result<T, ProtonError> {
-    match tokio::time::timeout(INTERACTIVE_CALL_TIMEOUT, call).await {
+    bounded_by(INTERACTIVE_CALL_TIMEOUT, call).await
+}
+
+/// Run a remote call, giving up after `limit`.
+pub(crate) async fn bounded_by<T>(
+    limit: Duration,
+    call: impl Future<Output = Result<T, ProtonError>>,
+) -> Result<T, ProtonError> {
+    match tokio::time::timeout(limit, call).await {
         Ok(result) => result,
-        Err(_) => Err(no_answer(INTERACTIVE_CALL_TIMEOUT)),
+        Err(_) => Err(no_answer(limit)),
     }
 }
 
@@ -113,6 +175,15 @@ impl Core {
         self.online.load(Ordering::Relaxed)
     }
 
+    /// Whether a namespace change through the mount goes to Drive inside the
+    /// syscall. Only with [`AppConfig::local_first`] off, and only online;
+    /// otherwise it is queued and the drain sends it.
+    ///
+    /// [`AppConfig::local_first`]: pdfs_core::config::AppConfig::local_first
+    pub(crate) fn sends_inline(&self) -> bool {
+        !self.local_first && self.is_online()
+    }
+
     /// Run a remote call a caller is waiting on, giving up after
     /// [`INTERACTIVE_CALL_TIMEOUT`]. The timer is built inside the runtime: a
     /// FUSE worker has no reactor of its own.
@@ -123,10 +194,30 @@ impl Core {
         self.rt.block_on(bounded(call))
     }
 
+    /// Run a remote call, giving up after `limit`: an upload, whose budget
+    /// grows with its size ([`upload_deadline`]).
+    pub(crate) fn block_on_within<T>(
+        &self,
+        limit: Duration,
+        call: impl Future<Output = Result<T, ProtonError>>,
+    ) -> Result<T, ProtonError> {
+        self.rt.block_on(bounded_by(limit, call))
+    }
+
+    /// Whether Proton refused the session itself, so nothing reaches it until
+    /// the user signs in again.
+    pub(crate) fn session_expired(&self) -> bool {
+        self.link.session_expired.load(Ordering::Relaxed)
+    }
+
     /// Report a failed remote call. Returns whether it failed for want of a
-    /// network, in which case the mount is now offline and the caller should
-    /// take its queued path instead of failing.
+    /// network, or of a session, in which case the mount is now offline and the
+    /// caller should take its queued path instead of failing.
     pub(crate) fn lost_link(&self, e: &ProtonError, what: &str) -> bool {
+        if session_revoked(e) {
+            self.mark_session_expired(what, e);
+            return true;
+        }
         if !is_network_error(e) {
             return false;
         }
@@ -134,6 +225,29 @@ impl Core {
         true
     }
 
+    /// Flip the mount offline for good: Proton refused the session, and only a
+    /// new login brings it back. Changes stay queued for the daemon that login
+    /// starts. Only the first caller logs it.
+    ///
+    /// Unless the keyring holds a newer session than the refused one: then
+    /// the mount ends, for the daemon to mount again on that one.
+    pub(crate) fn mark_session_expired(&self, what: &str, error: &dyn std::fmt::Display) {
+        if self.link.resume_stored.load(Ordering::Relaxed) {
+            return self.mark_offline(what, error);
+        }
+        if pdfs_core::auth::stored_session_is_newer() {
+            info!(during = what, %error,
+                  "Proton refused a session another process has since refreshed; resuming it");
+            self.link.resume_stored.store(true, Ordering::Relaxed);
+            return self.mark_offline(what, error);
+        }
+        if !self.link.session_expired.swap(true, Ordering::Relaxed) {
+            warn!(during = what, %error,
+                  "Proton refused the session; run `pdfs login` to sign in again");
+        }
+        self.mark_offline(what, error);
+    }
+
     /// Flip the mount offline and wake the probe. Only the first caller of an
     /// outage logs it; the rest are the same outage.
     pub(crate) fn mark_offline(&self, what: &str, error: &dyn std::fmt::Display) {
@@ -166,8 +280,9 @@ impl Core {
         self.relist_offline_listings();
         // Anything written while offline is queued and waiting on exactly this,
         // including ops that failed on the way down and are sitting out a
-        // backoff sized for a server that keeps refusing.
-        if let Err(e) = self.db.retry_failed_ops_now(crate::now_millis()) {
+        // backoff sized for a server that keeps refusing. Ops Drive refused
+        // keep theirs: the link was not why.
+        if let Err(e) = self.db.retry_unrefused_ops_now(crate::now_millis()) {
             warn!(error = %e, "moving backed-off ops up after a reconnect failed");
         }
         self.wake_drain();
@@ -210,7 +325,7 @@ impl Core {
     }
 
     /// Watch the link for the life of the mount: sleep while it is up, and
-    /// probe it back while it is down (offline.md Phase 1).
+    /// probe it back while it is down.
     ///
     /// A mount that started from the cache is down from the first moment; one
     /// that started online goes down when [`Core::mark_offline`] says so.
@@ -238,6 +353,9 @@ impl Core {
 
     /// Probe until Proton answers, then flip the mount online. Returns `false`
     /// if the daemon is stopping.
+    ///
+    /// A refused session is not probed: every probe would be refused the same
+    /// way, forever (issue #35). The thread waits for the stop instead.
     fn probe_until_online(&self) -> bool {
         let started = self.link.lost_at.lock().unwrap_or_else(Instant::now);
         let mut delay = if started.elapsed() < YOUNG_OUTAGE {
@@ -249,8 +367,12 @@ impl Core {
             if !self.shutdown.sleep(delay) {
                 return false;
             }
+            if self.session_expired() {
+                delay = ONLINE_PROBE_MAX;
+                continue;
+            }
             let probe = self.rt.block_on(async {
-                match tokio::time::timeout(PROBE_TIMEOUT, self.client.get_my_files_folder()).await {
+                match tokio::time::timeout(PROBE_TIMEOUT, self.drive.get_my_files_folder()).await {
                     Ok(result) => result,
                     Err(_) => Err(no_answer(PROBE_TIMEOUT)),
                 }
@@ -258,8 +380,9 @@ impl Core {
             match probe {
                 Ok(root) => {
                     {
+                        let root_ino = self.root_ino();
                         let mut st = self.state();
-                        if let Some(e) = st.entries.get_mut(&ROOT_INO) {
+                        if let Some(e) = st.entries.get_mut(&root_ino) {
                             e.node = root.clone();
                         }
                     }
@@ -269,6 +392,7 @@ impl Core {
                     self.mark_online();
                     return true;
                 }
+                Err(e) if session_revoked(&e) => self.mark_session_expired("online probe", &e),
                 Err(e) => {
                     debug!(error = %e, ?delay, "online probe failed; still offline");
                     delay = next_probe_delay(delay, started.elapsed());
@@ -300,6 +424,44 @@ mod tests {
         assert!(!is_network_error(&ProtonError::invalid_operation("bug")));
     }
 
+    #[test]
+    fn an_upload_gets_longer_the_bigger_it_is() {
+        assert_eq!(upload_deadline(0, 0), INTERACTIVE_CALL_TIMEOUT);
+        assert_eq!(
+            upload_deadline(1 << 30, 0),
+            INTERACTIVE_CALL_TIMEOUT + Duration::from_secs(32_768)
+        );
+    }
+
+    #[test]
+    fn an_upload_under_a_low_cap_gets_the_time_its_share_of_the_cap_needs() {
+        // A generous cap leaves the deadline as it was.
+        assert_eq!(
+            upload_deadline(1 << 30, 100 << 20),
+            upload_deadline(1 << 30, 0)
+        );
+        // 512 KiB/s shared by every upload slot is below the slowest rate.
+        let share = (512 << 10) / UPLOAD_SLOTS;
+        assert!(share < SLOWEST_UPLOAD);
+        assert_eq!(
+            upload_deadline(1 << 30, 512 << 10),
+            INTERACTIVE_CALL_TIMEOUT + Duration::from_secs((1 << 30) / share)
+        );
+        // A cap below one byte per slot still gives a finite deadline.
+        assert!(upload_deadline(1 << 20, 1) > upload_deadline(1 << 20, 512 << 10));
+    }
+
+    #[test]
+    fn a_call_past_its_deadline_reads_as_a_lost_link() {
+        let rt = tokio::runtime::Builder::new_current_thread()
+            .enable_time()
+            .build()
+            .unwrap();
+        let limit = Duration::from_millis(20);
+        let result: Result<(), _> = rt.block_on(bounded_by(limit, std::future::pending()));
+        assert!(result.is_err_and(|e| is_network_error(&e)));
+    }
+
     #[test]
     fn a_young_outage_is_probed_often_and_an_old_one_rarely() {
         let young = Duration::from_secs(60);

crates/pdfs-fuse/src/mount.rs

@@ -12,6 +12,10 @@ pub enum MountOutcome {
     /// The kernel mount ended on its own (e.g. an external `fusermount -u`).
     /// The caller may want to remount.
     Unmounted,
+    /// Proton refused the session, and the keyring holds a newer one: another
+    /// process (`pdfs unlock`) refreshed it, or a new login replaced it. We
+    /// unmounted ourselves; the caller should mount again, which resumes it.
+    ResumeStored,
 }
 
 /// Whether `path` is a mountpoint whose FUSE connection is dead — the state a
@@ -193,7 +197,7 @@ pub(super) fn clear_stale_mount(mountpoint: &Path) {
 }
 
 /// `sync_state` key holding the uid of the My Files root, so a later run can
-/// recover it from `nodes` without the API (offline.md Phase 1).
+/// recover it from `nodes` without the API.
 const ROOT_UID_KEY: &str = "root_uid";
 
 /// The My Files root, and whether we got it from the API (`true`) or from the
@@ -207,33 +211,63 @@ const ROOT_UID_KEY: &str = "root_uid";
 /// means an empty tree, and mounting that would show the user an empty Drive
 /// rather than an honest error.
 fn fetch_or_recall_root(
-    client: &ProtonDriveClient,
+    drive: &dyn DriveApi,
     rt: &tokio::runtime::Handle,
     db: &Db,
-) -> std::io::Result<(Node, bool)> {
-    let err = match rt.block_on(client.get_my_files_folder()) {
+) -> std::io::Result<(Node, Start)> {
+    let err = match rt.block_on(drive.get_my_files_folder()) {
         Ok(root) => {
             if let Err(e) = db.set_state_str(ROOT_UID_KEY, &root.uid.to_string()) {
                 warn!(error = %e, "persist root uid failed");
             }
-            return Ok((root, true));
+            return Ok((root, Start::Online));
         }
         Err(e) => e,
     };
+    // Still mounted from the cache, so cached files stay readable and changes
+    // queue for the daemon the next login starts.
+    let start = if pdfs_core::error::session_revoked(&err) {
+        Start::SessionExpired
+    } else {
+        Start::Offline
+    };
+    if start == Start::SessionExpired && pdfs_core::auth::stored_session_is_newer() {
+        return Err(std::io::Error::other(format!(
+            "Proton refused a session another process has since refreshed ({err}); resuming it"
+        )));
+    }
     let cached = db
         .state_str(ROOT_UID_KEY)
         .ok()
         .flatten()
         .and_then(|uid| db.node_by_uid(&uid).ok().flatten());
     match cached {
+        Some(root) if start == Start::SessionExpired => {
+            warn!(error = %err,
+                  "Proton refused the session; mounting from cache until `pdfs login`");
+            Ok((root, start))
+        }
         Some(root) => {
             warn!(error = %err, "fetch My Files root failed; mounting from cache (offline)");
-            Ok((root, false))
+            Ok((root, start))
         }
+        None if start == Start::SessionExpired => Err(std::io::Error::other(format!(
+            "Proton refused the session ({err}); run `pdfs login`"
+        ))),
         None => Err(std::io::Error::other(format!("fetch My Files root: {err}"))),
     }
 }
 
+/// How a mount comes up, from what fetching its root said.
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum Start {
+    Online,
+    /// Proton could not be reached: serve the cache and probe for the link.
+    Offline,
+    /// Proton refused the session: serve the cache until a new login.
+    SessionExpired,
+}
+
 /// Per-mount settings resolved from [`pdfs_core::config::AppConfig`] by the
 /// caller, so `mount` itself never reads config or the environment.
 pub struct MountOptions {
@@ -244,6 +278,9 @@ pub struct MountOptions {
     /// Upload and download caps in bytes per second (`0` = no cap).
     pub upload_limit: u64,
     pub download_limit: u64,
+    /// Namespace changes through the mount are queued, not sent in the
+    /// syscall. See [`pdfs_core::config::AppConfig::local_first`].
+    pub local_first: bool,
 }
 
 /// Spawn one FUSE session rooted at an arbitrary remote node.
@@ -276,13 +313,14 @@ pub(super) fn spawn_session(
     info!(mountpoint = %mountpoint.display(), "mounting Proton Drive location");
     let fs = ProtonFs::new(core.clone(), root);
     if core.primary {
-        // Only My Files rehydrates the daemon-wide node cache. A secondary
-        // inode space is rooted at one device subtree and must not import every
-        // unrelated persisted node.
+        // Only My Files rehydrates the daemon-wide node cache, once. A
+        // secondary mount shares the tree it fills.
         core.hydrate();
     }
     let session = Session::new(fs, mountpoint, &config)?.spawn()?;
-    let _ = core.notifier.set(session.notifier());
+    let _ = core
+        .notifier
+        .set(KernelChannel::new(session.notifier(), core.root_ino()));
     core.session_live.store(true, Ordering::Release);
     Ok(session)
 }
@@ -339,17 +377,58 @@ pub fn mount(
     control_socket: &Path,
     db: Arc<Db>,
     options: MountOptions,
+) -> std::io::Result<MountOutcome> {
+    let drive = Arc::new(client.clone());
+    mount_with(
+        client,
+        drive,
+        rt,
+        mountpoint,
+        cache,
+        control_socket,
+        db,
+        options,
+        Host::Daemon,
+    )
+}
+
+/// What a mount runs in.
+pub(crate) enum Host {
+    /// The daemon: stopped by SIGTERM or SIGINT, and indexing the user's home
+    /// for the launcher prompt.
+    Daemon,
+    /// One of several simulated daemons in a test process (`sim`): stopped by
+    /// a message on this channel, and with no home to index.
+    #[cfg(test)]
+    Simulation(std::sync::mpsc::Receiver<()>),
+}
+
+/// [`mount`], reaching Drive through `drive` and hosted by `host`; `client`
+/// serves only what [`DriveApi`] does not cover.
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn mount_with(
+    client: ProtonDriveClient,
+    drive: Arc<dyn DriveApi>,
+    rt: tokio::runtime::Handle,
+    mountpoint: &Path,
+    cache: ContentCache,
+    control_socket: &Path,
+    db: Arc<Db>,
+    options: MountOptions,
+    host: Host,
 ) -> std::io::Result<MountOutcome> {
     let MountOptions {
         username,
         sweep_mode,
         upload_limit,
         download_limit,
+        local_first,
     } = options;
     // Start the uptime clock here rather than at the first `pdfs diagnostics`,
     // so the age it reports is the daemon's own.
     super::diagnostics::start_clock();
-    let (root, online) = fetch_or_recall_root(&client, &rt, &db)?;
+    let (root, start) = fetch_or_recall_root(drive.as_ref(), &rt, &db)?;
+    let online = start == Start::Online;
     let scope = root.tree_event_scope_id();
     db.mount_upsert_my_files(&mountpoint.to_string_lossy(), &root.uid.to_string(), None)
         .map_err(|error| std::io::Error::other(format!("project My Files mount: {error}")))?;
@@ -357,19 +436,21 @@ pub fn mount(
         .all_share_access()
         .map_err(|error| std::io::Error::other(format!("load shared access: {error}")))?;
 
-    // The folder-sync engine (devices.md Phase 2) runs on its own thread and is
+    // The folder-sync engine runs on its own thread and is
     // nudged over this channel; the sender lives in Core so control-socket
     // handlers can trigger reconciles.
     let (sync_tx, sync_rx) = std::sync::mpsc::channel::<sync::SyncMsg>();
 
     let paused_until = pause::load_paused_until(&db);
     let core = Core {
-        client: client.clone(),
+        drive,
+        client,
         rt: rt.clone(),
         maintenance: Arc::new(Mutex::new(Default::default())),
         primary_root_uid: root.uid.clone(),
         primary: true,
-        state: Arc::new(Mutex::new(State::new(db.clone(), share_access, 2))),
+        state: Arc::new(Mutex::new(State::new(db.clone(), share_access))),
+        root: Arc::new(OnceLock::new()),
         cache: Arc::new(cache),
         readers: Arc::new(Mutex::new(HashMap::new())),
         block_ring: Arc::new(Mutex::new(BlockRing::default())),
@@ -383,14 +464,19 @@ pub fn mount(
         shared_generation: Arc::new(AtomicU64::new(0)),
         shared_refresh_deadlines: Arc::new(Mutex::new(SharedRefreshDeadlines::default())),
         online: Arc::new(AtomicBool::new(online)),
-        link: Arc::new(Default::default()),
+        link: Arc::new(link::Link::starting(start == Start::SessionExpired)),
         sync_paused_until: Arc::new(AtomicI64::new(paused_until)),
         pending: Arc::new(Mutex::new(HashMap::new())),
         hidden: Arc::new(Mutex::new(HashSet::new())),
+        creating: Arc::new(Mutex::new(HashMap::new())),
+        sealed_unread: Arc::new(Mutex::new(HashMap::new())),
+        landed: Arc::new(Mutex::new(HashMap::new())),
+        unadopted: Arc::new(Mutex::new(HashMap::new())),
         drain_wake: Arc::new((Mutex::new(false), Condvar::new())),
         shutdown: Arc::new(crate::shutdown::Shutdown::default()),
         upload_times: Arc::new(Mutex::new(HashMap::new())),
         upload_cancel: Arc::new(Mutex::new(HashMap::new())),
+        landing_uploads: Arc::new(AtomicU64::new(0)),
         timeline_refreshing: Arc::new(AtomicBool::new(false)),
         timeline_progress: Arc::new(Mutex::new(None)),
         similar_hashing: Arc::new(AtomicBool::new(false)),
@@ -399,7 +485,7 @@ pub fn mount(
         trash_progress: Arc::new(tokio::sync::Notify::new()),
         conflict_notified: Arc::new(Mutex::new(HashSet::new())),
         sweep_mode,
-        own_sealed_revs: Arc::new(Mutex::new(HashMap::new())),
+        local_first,
         self_changes: Arc::new(Mutex::new(HashMap::new())),
         thumb_gen: Arc::new(Mutex::new(HashSet::new())),
         thumb_gen_budget: Arc::new(tokio::sync::Semaphore::new(
@@ -424,10 +510,11 @@ pub fn mount(
         sync_tx,
         mounts: Arc::new(Mutex::new(SecondaryMountRegistry::default())),
         sync_locks: Arc::new(Mutex::new(HashMap::new())),
+        sync_unscanned: Arc::new(Mutex::new(HashMap::new())),
         states: Arc::new(StateRegistry::default()),
     };
     // Before anything can queue work against it: the drain thread below reaches
-    // every mount's inode space through this registry, not through `core.state`.
+    // every mount's session through this registry.
     core.register_state(mountpoint);
     core.transfers.set_limits(upload_limit, download_limit);
 
@@ -450,7 +537,7 @@ pub fn mount(
     // Every long-lived thread started from here on is kept in `workers` and
     // joined at the end of this function. Leaving them running turned an
     // in-process remount into a second generation of drain workers, sync engines
-    // and sweeps all operating on a mount that no longer exists (bugs.md B44).
+    // and sweeps all operating on a mount that no longer exists (`docs/BUGS.md` B44).
     let mut workers: Vec<std::thread::JoinHandle<()>> = Vec::new();
     for worker in 0..DRAIN_WORKERS {
         let core = core.clone();
@@ -500,7 +587,7 @@ pub fn mount(
 
     // Keep the launcher prompt's "This computer" index fresh. Its own thread:
     // the walk is I/O-heavy and must never sit in front of a FUSE callback.
-    {
+    if matches!(host, Host::Daemon) {
         let db = core.db.clone();
         let indexing = core.indexing.clone();
         let transfers = core.transfers.clone();
@@ -624,11 +711,13 @@ pub fn mount(
             }
         }
     };
-    rt.spawn(run_event_sync(client, scope, core.clone()));
+    rt.spawn(run_event_sync(core.drive.clone(), scope, core.clone()));
     // The photos volume has its own event stream; without it the gallery only
     // learns about a phone-side deletion when the timeline goes stale.
     rt.spawn(run_photos_event_sync(core.clone()));
-    if online {
+    // Not in a simulation: `client` there reaches no API, and the thread, still
+    // waiting on it after the stop, held the database a test opens next.
+    if online && matches!(host, Host::Daemon) {
         let repair_core = core.clone();
         let root_uid = core.primary_root_uid.clone();
         if let Err(error) = std::thread::Builder::new()
@@ -643,6 +732,82 @@ pub fn mount(
     // are delivered onto the async runtime; bridge them onto a sync channel so
     // the loop below can react without blocking a worker thread. A bounded
     // channel of 1 is enough — we only need to know that *a* stop arrived.
+    let sig_rx = match host {
+        Host::Daemon => signal_stop(&rt),
+        #[cfg(test)]
+        Host::Simulation(rx) => rx,
+    };
+
+    // Wait for whichever happens first: a stop signal (→ we unmount ourselves
+    // via the lazy MNT_DETACH path, clean even mid-download), or the kernel
+    // mount ending on its own (→ the session thread finishes). Poll instead of
+    // blocking on `join` so we can also notice the signal.
+    let outcome = loop {
+        match sig_rx.recv_timeout(Duration::from_millis(500)) {
+            Ok(()) => {
+                info!("stop requested; unmounting");
+                core.mounts.lock().close();
+                if let Err(e) = teardown_session(&core.session_live, || {
+                    umount_session_unblocked(bg, main_conn)
+                }) {
+                    warn!(error = %e, "umount_and_join failed");
+                }
+                break MountOutcome::Shutdown;
+            }
+            Err(std::sync::mpsc::RecvTimeoutError::Timeout)
+                if core.link.resume_stored.load(Ordering::Relaxed) =>
+            {
+                info!("unmounting to resume the stored session");
+                core.mounts.lock().close();
+                if let Err(e) = teardown_session(&core.session_live, || {
+                    umount_session_unblocked(bg, main_conn)
+                }) {
+                    warn!(error = %e, "umount_and_join failed");
+                }
+                break MountOutcome::ResumeStored;
+            }
+            Err(std::sync::mpsc::RecvTimeoutError::Timeout) => {
+                if bg.guard.is_finished() {
+                    info!("mount ended externally");
+                    core.mounts.lock().close();
+                    if let Err(e) = teardown_session(&core.session_live, || bg.join()) {
+                        warn!(error = %e, "session join failed");
+                    }
+                    break MountOutcome::Unmounted;
+                }
+            }
+            Err(std::sync::mpsc::RecvTimeoutError::Disconnected) => {
+                // Signal task gone (failed to install); fall back to join.
+                core.mounts.lock().close();
+                let _ = teardown_session(&core.session_live, || bg.join());
+                break MountOutcome::Unmounted;
+            }
+        }
+    };
+
+    // Unmount every on-demand sync folder too, or the kernel mounts linger as
+    // stale and the next start fails with EBUSY.
+    if let Some(worker) = restore_worker
+        && worker.join().is_err()
+    {
+        warn!("on-demand restore worker panicked");
+    }
+    let secondaries = core.mounts.lock().close_and_drain();
+    for (id, mount) in secondaries {
+        if let Err(e) = mount.teardown() {
+            warn!(id, error = %e, "unmount on-demand folder failed");
+        }
+    }
+    core.queue_unreleased_writes();
+
+    // Last, because the workers may legitimately be finishing an upload, and
+    // nothing they can still do is harmful once the mounts are down.
+    stop_workers(&core, control_socket, workers);
+    Ok(outcome)
+}
+
+/// A channel that receives once SIGTERM or SIGINT arrives.
+fn signal_stop(rt: &tokio::runtime::Handle) -> std::sync::mpsc::Receiver<()> {
     let (sig_tx, sig_rx) = std::sync::mpsc::sync_channel::<()>(1);
     rt.spawn(async move {
         let mut sigterm =
@@ -667,65 +832,13 @@ pub fn mount(
         }
         let _ = sig_tx.try_send(());
     });
-
-    // Wait for whichever happens first: a stop signal (→ we unmount ourselves
-    // via the lazy MNT_DETACH path, clean even mid-download), or the kernel
-    // mount ending on its own (→ the session thread finishes). Poll instead of
-    // blocking on `join` so we can also notice the signal.
-    let outcome = loop {
-        match sig_rx.recv_timeout(Duration::from_millis(500)) {
-            Ok(()) => {
-                info!("stop requested; unmounting");
-                core.mounts.lock().close();
-                if let Err(e) = teardown_session(&core.session_live, || {
-                    umount_session_unblocked(bg, main_conn)
-                }) {
-                    warn!(error = %e, "umount_and_join failed");
-                }
-                break MountOutcome::Shutdown;
-            }
-            Err(std::sync::mpsc::RecvTimeoutError::Timeout) => {
-                if bg.guard.is_finished() {
-                    info!("mount ended externally");
-                    core.mounts.lock().close();
-                    if let Err(e) = teardown_session(&core.session_live, || bg.join()) {
-                        warn!(error = %e, "session join failed");
-                    }
-                    break MountOutcome::Unmounted;
-                }
-            }
-            Err(std::sync::mpsc::RecvTimeoutError::Disconnected) => {
-                // Signal task gone (failed to install); fall back to join.
-                core.mounts.lock().close();
-                let _ = teardown_session(&core.session_live, || bg.join());
-                break MountOutcome::Unmounted;
-            }
-        }
-    };
-
-    // Unmount every on-demand sync folder too, or the kernel mounts linger as
-    // stale and the next start fails with EBUSY (devices.md Phase 3).
-    if let Some(worker) = restore_worker
-        && worker.join().is_err()
-    {
-        warn!("on-demand restore worker panicked");
-    }
-    let secondaries = core.mounts.lock().close_and_drain();
-    for (id, mount) in secondaries {
-        if let Err(e) = mount.teardown() {
-            warn!(id, error = %e, "unmount on-demand folder failed");
-        }
-    }
-
-    // Last, because the workers may legitimately be finishing an upload, and
-    // nothing they can still do is harmful once the mounts are down.
-    stop_workers(&core, control_socket, workers);
-    Ok(outcome)
+    sig_rx
 }
 
-/// How long teardown waits for the FUSE worker pool before proceeding without
-/// it. Long enough for an in-flight block to finish, short enough that
-/// `systemctl --user stop` still returns inside `TimeoutStopSec`.
+/// How long teardown waits for the background workers and then the FUSE worker
+/// pool before proceeding without them. Long enough for an in-flight block to
+/// finish, short enough that `systemctl --user stop` still returns inside
+/// `TimeoutStopSec`.
 const WORKER_JOIN_DEADLINE: Duration = Duration::from_secs(10);
 
 /// Signal every background loop, wake the ones that are blocked, and join them.
@@ -733,14 +846,15 @@ const WORKER_JOIN_DEADLINE: Duration = Duration::from_secs(10);
 /// The mount used to return with its drain workers, sync engine, sweep, online
 /// probe, indexer and control listener all still running on `Core` clones. The
 /// process usually exited straight afterwards and hid it; an in-process remount
-/// did not, and started a second full set on top of the first (bugs.md B44).
+/// did not, and started a second full set on top of the first (`docs/BUGS.md` B44).
 ///
 /// Two of the waits need waking rather than merely flagging: the drain workers
 /// block on their own condvar (`wake_drain`), and the control listener blocks
 /// inside `accept`, which only returns when a connection arrives — so it gets
 /// one, from us, after the flag is already set. A join that takes a while is
 /// expected and correct: a worker part-way through an upload finishes it rather
-/// than abandoning the user's bytes mid-flight.
+/// than abandoning the user's bytes mid-flight. Up to [`WORKER_JOIN_DEADLINE`]:
+/// past it, systemd kills the daemon anyway, and a queued op is sent again.
 fn stop_workers(core: &Core, control_socket: &Path, workers: Vec<std::thread::JoinHandle<()>>) {
     // Say so before the joins: a teardown that takes a while must not be read as
     // a missed watchdog ping and turned into a kill.
@@ -754,25 +868,71 @@ fn stop_workers(core: &Core, control_socket: &Path, workers: Vec<std::thread::Jo
     // unlink cannot put it back to sleep.
     let _ = std::os::unix::net::UnixStream::connect(control_socket);
     let _ = std::fs::remove_file(control_socket);
-    for worker in workers {
-        if worker.join().is_err() {
-            warn!("a background worker panicked before shutdown");
-        }
+    let deadline = Instant::now() + WORKER_JOIN_DEADLINE;
+    let running = join_until(workers, deadline);
+    if !running.is_empty() {
+        warn!(
+            running = running.join(","),
+            "background workers did not finish in time; shutting down around them"
+        );
     }
     // The FUSE worker pool last, and *before* the caller drops the tokio
     // runtime: a worker still inside a job when the runtime goes away panics on
     // its next timer with "A Tokio 1.x context was found, but it is being
     // shutdown" (seen 2026-09-18 09:58:35). Bounded, so a worker wedged on the
     // network cannot hold the stop the user asked for.
-    core.workers.stop_and_join(WORKER_JOIN_DEADLINE);
+    core.workers
+        .stop_and_join(deadline.saturating_duration_since(Instant::now()));
     debug!("background workers stopped");
 }
 
+/// Join `workers` until `deadline`, and name the ones still running then.
+///
+/// A stop used to wait for each one however long it took. The sync engine's
+/// mirror pass waits on Drive with no deadline, and a stop that waited for it
+/// was killed by systemd (`docs/BUGS.md` B165).
+fn join_until(workers: Vec<std::thread::JoinHandle<()>>, deadline: Instant) -> Vec<String> {
+    let mut running = Vec::new();
+    for worker in workers {
+        while !worker.is_finished() && Instant::now() < deadline {
+            std::thread::sleep(Duration::from_millis(10));
+        }
+        if !worker.is_finished() {
+            running.push(worker.thread().name().unwrap_or("unnamed").to_string());
+        } else if worker.join().is_err() {
+            warn!("a background worker panicked before shutdown");
+        }
+    }
+    running
+}
+
 #[cfg(test)]
 mod tests {
     use std::sync::atomic::{AtomicBool, Ordering};
+    use std::time::{Duration, Instant};
 
-    use super::{SecondaryInsertRejection, SecondaryMountRegistry, teardown_session};
+    use super::{SecondaryInsertRejection, SecondaryMountRegistry, join_until, teardown_session};
+
+    #[test]
+    fn a_stop_names_the_workers_still_running_at_its_deadline() {
+        let (release, wait) = std::sync::mpsc::channel::<()>();
+        let done = std::thread::Builder::new()
+            .name("done".into())
+            .spawn(|| {})
+            .unwrap();
+        let stuck = std::thread::Builder::new()
+            .name("stuck".into())
+            .spawn(move || {
+                let _ = wait.recv();
+            })
+            .unwrap();
+        let running = join_until(
+            vec![done, stuck],
+            Instant::now() + Duration::from_millis(100),
+        );
+        assert_eq!(running, ["stuck"]);
+        drop(release);
+    }
 
     #[test]
     fn session_is_unroutable_before_teardown_starts() {

crates/pdfs-fuse/src/photos.rs

@@ -226,11 +226,7 @@ fn scale_thumbnail_with_exiftool(
     exiftool: &OsStr,
     timeout: Duration,
 ) -> ScaleAttempt {
-    let direct = image::ImageReader::new(std::io::Cursor::new(bytes))
-        .with_guessed_format()
-        .ok()
-        .and_then(|reader| reader.decode().ok());
-    let image = match direct {
+    let image = match decode_upright(bytes) {
         Some(image) => image,
         None if is_raw_image_name(name) => {
             let (preview, orientation) =
@@ -256,6 +252,27 @@ fn scale_thumbnail_with_exiftool(
     encode_thumb(&image)
 }
 
+/// Decode `bytes` and turn the picture the way its EXIF orientation says.
+///
+/// `ImageReader::decode` does not: a phone stores a portrait photo as landscape
+/// pixels plus an orientation tag, so every such thumbnail came out on its
+/// side, and the drain uploaded it to Drive that way for every client to show
+/// (`docs/BUGS.md` B226).
+fn decode_upright(bytes: &[u8]) -> Option<image::DynamicImage> {
+    use image::ImageDecoder as _;
+    let mut decoder = image::ImageReader::new(std::io::Cursor::new(bytes))
+        .with_guessed_format()
+        .ok()?
+        .into_decoder()
+        .ok()?;
+    let orientation = decoder
+        .orientation()
+        .unwrap_or(image::metadata::Orientation::NoTransforms);
+    let mut image = image::DynamicImage::from_decoder(decoder).ok()?;
+    image.apply_orientation(orientation);
+    Some(image)
+}
+
 /// Shrink a decoded image to a [`THUMB_EDGE`] JPEG, keeping its aspect ratio.
 fn encode_thumb(image: &image::DynamicImage) -> ScaleAttempt {
     let (width, height) = (image.width(), image.height());
@@ -417,6 +434,16 @@ fn exiftool_query(
     serde_json::from_slice(&output).map_err(|_| RawPreviewUnavailable)
 }
 
+/// Whether [`upload_thumbnails`] can make a thumbnail for a file `name` of
+/// `size` bytes, asked before the file is on disk: an image small enough to
+/// decode, or a video while ffmpeg is installed.
+pub(crate) fn can_make_thumbnail(name: &str, size: u64) -> bool {
+    if is_video_name(name) {
+        return ffmpeg_available();
+    }
+    is_thumbnail_image_name(name) && size <= UPLOAD_IMAGE_MAX_BYTES
+}
+
 /// Whether `name` is a video, whose thumbnail is a frame ffmpeg grabs rather
 /// than a picture the image decoder can scale.
 fn is_video_name(name: &str) -> bool {
@@ -1038,7 +1065,7 @@ impl Core {
         }
         let outcomes = self
             .rt
-            .block_on(self.client.trash_nodes(uids))
+            .block_on(self.drive.trash_nodes(uids))
             .map_err(|e| CoreError::from_api(&e, "trash"))?;
         let (trashed, failed) = pdfs_core::batch::split(outcomes);
 
@@ -2092,9 +2119,10 @@ impl Core {
 #[cfg(test)]
 mod thumb_tests {
     use super::{
-        RawTempFile, ScaleAttempt, THUMB_EDGE, UPLOAD_THUMB_MAX_BYTES, exiftool_binary,
-        fit_upload_thumb, is_video_name, ratio_of, scale_thumbnail, scale_thumbnail_with_exiftool,
-        similar_hashes, thumbnail_build_may_start, upload_thumbnails_with, video_thumbnail,
+        RawTempFile, ScaleAttempt, THUMB_EDGE, UPLOAD_IMAGE_MAX_BYTES, UPLOAD_THUMB_MAX_BYTES,
+        can_make_thumbnail, exiftool_binary, ffmpeg_available, fit_upload_thumb, is_video_name,
+        ratio_of, scale_thumbnail, scale_thumbnail_with_exiftool, similar_hashes,
+        thumbnail_build_may_start, upload_thumbnails_with, video_thumbnail,
     };
     use pdfs_core::control::{ThumbnailBuildStatus, is_thumbnail_image_name};
     use proton_drive_rs::ThumbnailType;
@@ -2149,6 +2177,64 @@ mod thumb_tests {
         assert_eq!(ratio_of(&thumb.bytes).map(|r| r < 1.0), Some(true));
     }
 
+    /// `jpeg` with an EXIF APP1 segment that carries only `orientation`.
+    fn jpeg_with_orientation(width: u32, height: u32, orientation: u16) -> Vec<u8> {
+        let plain = jpeg(width, height);
+        let mut tiff = Vec::new();
+        tiff.extend_from_slice(b"II*\0");
+        tiff.extend_from_slice(&8u32.to_le_bytes());
+        tiff.extend_from_slice(&1u16.to_le_bytes());
+        tiff.extend_from_slice(&0x0112u16.to_le_bytes());
+        tiff.extend_from_slice(&3u16.to_le_bytes());
+        tiff.extend_from_slice(&1u32.to_le_bytes());
+        tiff.extend_from_slice(&orientation.to_le_bytes());
+        tiff.extend_from_slice(&[0, 0]);
+        tiff.extend_from_slice(&0u32.to_le_bytes());
+        let mut app1 = b"Exif\0\0".to_vec();
+        app1.extend_from_slice(&tiff);
+        let mut out = plain[..2].to_vec();
+        out.extend_from_slice(&[0xFF, 0xE1]);
+        out.extend_from_slice(&u16::try_from(app1.len() + 2).unwrap().to_be_bytes());
+        out.extend_from_slice(&app1);
+        out.extend_from_slice(&plain[2..]);
+        out
+    }
+
+    /// A phone stores a portrait photo as landscape pixels and an EXIF
+    /// orientation; its thumbnail came out on its side (`docs/BUGS.md` B226).
+    /// A Takeout photo is copied out of its archive only when a thumbnail can
+    /// be made from the copy.
+    #[test]
+    fn only_a_photo_that_can_have_a_thumbnail_is_worth_copying_out() {
+        assert!(can_make_thumbnail("IMG_1.jpg", 4 << 20));
+        assert!(can_make_thumbnail("Screenshot.png", 4 << 20));
+        assert!(!can_make_thumbnail("IMG_1.jpg", UPLOAD_IMAGE_MAX_BYTES + 1));
+        assert!(!can_make_thumbnail("notes.txt", 10));
+        assert_eq!(can_make_thumbnail("clip.mp4", 1 << 30), ffmpeg_available());
+    }
+
+    #[test]
+    fn a_thumbnail_is_turned_the_way_its_exif_says() {
+        let ScaleAttempt::Made(thumb) = scale_thumbnail(
+            &jpeg_with_orientation(2000, 1000, 6),
+            "portrait.jpg",
+            &std::env::temp_dir(),
+        ) else {
+            panic!("a JPEG scales");
+        };
+        assert!(thumb.ratio < 1.0, "turned upright: {}", thumb.ratio);
+        assert_eq!(ratio_of(&thumb.bytes).map(|r| r < 1.0), Some(true));
+
+        let ScaleAttempt::Made(level) = scale_thumbnail(
+            &jpeg_with_orientation(2000, 1000, 1),
+            "landscape.jpg",
+            &std::env::temp_dir(),
+        ) else {
+            panic!("a JPEG scales");
+        };
+        assert!(level.ratio > 1.0);
+    }
+
     #[test]
     fn undecodable_bytes_are_not_a_thumbnail() {
         // What a photo in a format this build has no decoder for looks like: the

crates/pdfs-fuse/src/profile.rs

@@ -1,5 +1,5 @@
 //! Reading and writing this machine's `profile.json` in its device root, and
-//! the restore that rebuilds a machine from one (features.md 5.2 and 5.3).
+//! the restore that rebuilds a machine from one.
 //!
 //! The document itself is defined in [`pdfs_core::profile`]; this is the half
 //! that talks to Drive. Saving is best-effort and never blocks a user action:
@@ -15,6 +15,7 @@ use pdfs_core::control::RestorableFolder;
 use pdfs_core::mounts::MountMode;
 use pdfs_core::profile::{
     PROFILE_DIR_NAME, PROFILE_FILE_NAME, PROFILE_VERSION, Profile, ProfileFolder, ProfilePin,
+    is_profile_file_name, profile_file_name, saved_folder,
 };
 use pdfs_core::{CoreError, CoreResult};
 use proton_drive_rs::proton_sdk::ids::NodeUid;
@@ -66,9 +67,14 @@ impl Core {
         });
     }
 
-    /// Serialize this machine's arrangement and upload it to `profile.json`
-    /// inside the device's `.proton-drive-linux` folder, replacing any existing
-    /// one.
+    /// Serialize this machine's arrangement and upload it to its own
+    /// `profile-<machine id>.json` inside the device's `.proton-drive-linux`
+    /// folder, replacing any existing one.
+    ///
+    /// Each machine writes its own file because several computers may sync
+    /// into one device. They used to share `profile.json`, and each save
+    /// replaced the other computers' folders with its own (B252). That file is
+    /// left as it is, so a client before 3.5.0 still finds it.
     ///
     /// Does nothing when no device is registered: a machine that has never
     /// synced a folder has nothing to describe, and registering a device just to
@@ -85,7 +91,11 @@ impl Core {
             CoreError::internal(format!("bad device root uid: {}", device.root_uid))
         })?;
 
-        let profile = self.build_profile(&device.uid)?;
+        let machine_id = pdfs_core::config::AppDirs::new()
+            .and_then(|dirs| dirs.machine_id())
+            .map_err(|e| CoreError::internal(format!("machine id: {e}")))?;
+        let file_name = profile_file_name(&machine_id);
+        let profile = self.build_profile(&device.uid, &machine_id)?;
         let bytes = profile.to_bytes().map_err(CoreError::internal)?;
         let len = bytes.len() as i64;
 
@@ -97,11 +107,11 @@ impl Core {
         // same name: the profile is a single mutable record, and a folder with
         // `profile.json` and `profile (1).json` in it teaches the restore
         // nothing about which to trust.
-        let existing = self.find_device_child_file(&dir_uid, PROFILE_FILE_NAME)?;
+        let existing = self.find_device_child_file(&dir_uid, &file_name)?;
         match existing {
             Some(uid) => self
                 .rt
-                .block_on(self.client.upload_new_revision_from(
+                .block_on(self.drive.upload_new_revision_from(
                     &uid,
                     Cursor::new(bytes),
                     len,
@@ -112,9 +122,9 @@ impl Core {
                 .map_err(|e| CoreError::from_api(&e, "upload profile revision"))?,
             None => {
                 self.rt
-                    .block_on(self.client.upload_file_replacing_draft_from(
+                    .block_on(self.drive.upload_file_replacing_draft_from(
                         &dir_uid,
-                        PROFILE_FILE_NAME,
+                        &file_name,
                         "application/json",
                         Cursor::new(bytes),
                         len,
@@ -130,7 +140,7 @@ impl Core {
     }
 
     /// Snapshot the local arrangement into a [`Profile`].
-    fn build_profile(&self, device_uid: &str) -> CoreResult<Profile> {
+    fn build_profile(&self, device_uid: &str, machine_id: &str) -> CoreResult<Profile> {
         let folders = self
             .db
             .sync_folder_list()
@@ -162,6 +172,7 @@ impl Core {
             version: PROFILE_VERSION,
             device_uid: device_uid.to_string(),
             hostname: this_hostname(),
+            machine_id: Some(machine_id.to_string()),
             saved_at: now_secs(),
             folders,
             pins,
@@ -182,14 +193,14 @@ impl Core {
     ) -> CoreResult<Option<NodeUid>> {
         let uids = self
             .rt
-            .block_on(self.client.enumerate_folder_children_node_uids(parent_uid))
+            .block_on(self.drive.enumerate_folder_children_node_uids(parent_uid))
             .map_err(|e| CoreError::from_api(&e, "list device root"))?;
         if uids.is_empty() {
             return Ok(None);
         }
         let nodes = self
             .rt
-            .block_on(self.client.enumerate_nodes(&uids))
+            .block_on(self.drive.enumerate_nodes(&uids))
             .map_err(|e| CoreError::from_api(&e, "resolve device root children"))?;
         Ok(nodes
             .into_iter()
@@ -197,6 +208,31 @@ impl Core {
             .map(|n| n.uid))
     }
 
+    /// The untrashed files directly under `parent_uid` whose name passes
+    /// `keep`.
+    fn device_child_files(
+        &self,
+        parent_uid: &NodeUid,
+        keep: impl Fn(&str) -> bool,
+    ) -> CoreResult<Vec<NodeUid>> {
+        let uids = self
+            .rt
+            .block_on(self.drive.enumerate_folder_children_node_uids(parent_uid))
+            .map_err(|e| CoreError::from_api(&e, "list device root"))?;
+        if uids.is_empty() {
+            return Ok(Vec::new());
+        }
+        let nodes = self
+            .rt
+            .block_on(self.drive.enumerate_nodes(&uids))
+            .map_err(|e| CoreError::from_api(&e, "resolve device root children"))?;
+        Ok(nodes
+            .into_iter()
+            .filter(|n| !n.is_folder() && !n.trashed && keep(&n.name))
+            .map(|n| n.uid)
+            .collect())
+    }
+
     /// The device's `.proton-drive-linux` folder, creating it if this is the
     /// first save on this device.
     ///
@@ -210,7 +246,7 @@ impl Core {
         let uid = self
             .rt
             .block_on(
-                self.client
+                self.drive
                     .create_folder(root_uid, PROFILE_DIR_NAME, Some(now_secs())),
             )
             .map_err(|e| CoreError::from_api(&e, "create profile folder"))?;
@@ -218,35 +254,46 @@ impl Core {
         Ok(uid)
     }
 
-    /// Download and parse this device's profile, if there is one.
+    /// Download and parse the profiles of every computer that syncs this
+    /// device.
     ///
-    /// Looks in `.proton-drive-linux/` first and falls back to the device root,
-    /// where clients before the B78 fix wrote it. The fallback is read-only: the
-    /// next save writes to the folder, and the legacy document is left alone
-    /// rather than trashed, so an older client on another machine keeps working.
-    fn load_profile(&self, root_uid: &NodeUid) -> CoreResult<Option<Profile>> {
-        let current = match self.find_device_child_folder(root_uid, PROFILE_DIR_NAME)? {
-            Some(dir_uid) => self.find_device_child_file(&dir_uid, PROFILE_FILE_NAME)?,
-            None => None,
+    /// Reads every profile in `.proton-drive-linux/`: one per machine, and the
+    /// shared `profile.json` of clients before 3.5.0. Falls back to the device
+    /// root, where clients before the B78 fix wrote it. The fallback is
+    /// read-only: the next save writes to the folder, and the legacy document
+    /// is left alone rather than trashed, so an older client on another
+    /// machine keeps working. A profile that cannot be read is left out and
+    /// logged; the others still count.
+    fn load_profiles(&self, root_uid: &NodeUid) -> CoreResult<Vec<Profile>> {
+        let mut uids = match self.find_device_child_folder(root_uid, PROFILE_DIR_NAME)? {
+            Some(dir_uid) => self.device_child_files(&dir_uid, is_profile_file_name)?,
+            None => Vec::new(),
         };
-        let uid = match current {
-            Some(uid) => uid,
-            None => match self.find_device_child_file(root_uid, PROFILE_FILE_NAME)? {
-                Some(uid) => {
-                    info!("reading legacy profile from the device root");
-                    uid
+        if uids.is_empty() {
+            uids = self.device_child_files(root_uid, |name| name == PROFILE_FILE_NAME)?;
+            if !uids.is_empty() {
+                info!("reading legacy profile from the device root");
+            }
+        }
+        let mut profiles = Vec::new();
+        for uid in uids {
+            let mut buf: Vec<u8> = Vec::new();
+            let parsed = self
+                .rt
+                .block_on(self.drive.download_file_to(&uid, &mut buf))
+                .map_err(|e| CoreError::from_api(&e, "download profile"))
+                .and_then(|()| Profile::parse(&buf).map_err(CoreError::invalid));
+            match parsed {
+                Ok(profile) => profiles.push(profile),
+                Err(e) => {
+                    warn!(%uid, error = %e.message, "could not read a profile; leaving it out")
                 }
-                None => return Ok(None),
-            },
-        };
-        let mut buf: Vec<u8> = Vec::new();
-        self.rt
-            .block_on(self.client.download_file_to(&uid, &mut buf))
-            .map_err(|e| CoreError::from_api(&e, "download profile"))?;
-        Profile::parse(&buf).map(Some).map_err(CoreError::invalid)
+            }
+        }
+        Ok(profiles)
     }
 
-    // ---- restore (features.md 5.2) ----------------------------------------
+    // ---- restore ----------------------------------------
 
     /// The folders under a device that could be synced here, each carrying a
     /// proposed local path. `device` names another registered device by uid;
@@ -265,25 +312,26 @@ impl Core {
             CoreError::internal(format!("bad device root uid: {}", device.root_uid))
         })?;
 
-        let profile = match self.load_profile(&root_uid) {
+        let profiles = match self.load_profiles(&root_uid) {
             Ok(p) => p,
             // A missing or unreadable profile is not fatal: the remote tree
             // alone is enough to offer a restore, just with plainer defaults.
             Err(e) => {
-                warn!(error = %e.message, "could not read profile; proposing defaults");
-                None
+                warn!(error = %e.message, "could not read profiles; proposing defaults");
+                Vec::new()
             }
         };
+        let hostname = this_hostname();
 
         let uids = self
             .rt
-            .block_on(self.client.enumerate_folder_children_node_uids(&root_uid))
+            .block_on(self.drive.enumerate_folder_children_node_uids(&root_uid))
             .map_err(|e| CoreError::from_api(&e, "list device root"))?;
         let nodes = if uids.is_empty() {
             Vec::new()
         } else {
             self.rt
-                .block_on(self.client.enumerate_nodes(&uids))
+                .block_on(self.drive.enumerate_nodes(&uids))
                 .map_err(|e| CoreError::from_api(&e, "resolve device root children"))?
         };
 
@@ -304,11 +352,12 @@ impl Core {
             // offering it as a restorable folder would sync the bookkeeping
             // back onto the machine it describes.
             .filter(|n| n.is_folder() && !n.trashed && n.name != PROFILE_DIR_NAME)
+            // The name becomes a folder under the home folder: one with a `/`
+            // or a `..` in it would put the restore somewhere else.
+            .filter(|n| crate::remote_name_is_safe(&n.name))
             .map(|n| {
                 let uid = n.uid.to_string();
-                let saved = profile
-                    .as_ref()
-                    .and_then(|p| p.folders.iter().find(|f| f.remote_uid == uid));
+                let saved = saved_folder(&profiles, &uid, &hostname);
                 let proposed = saved
                     .map(|f| PathBuf::from(&f.local_path))
                     .filter(|p| path_is_usable_here(p))
@@ -349,23 +398,29 @@ impl Core {
             .sync_folder_list()
             .map_err(|e| CoreError::internal(format!("db: {e:?}")))?;
 
+        let reserved = crate::devices::sync_root_reserved();
+        let mut roots: Vec<PathBuf> = existing
+            .iter()
+            .map(|f| PathBuf::from(&f.local_path))
+            .collect();
         let mut restored = 0usize;
         let mut skipped: Vec<String> = Vec::new();
         for item in items {
-            let local = PathBuf::from(&item.local_path);
-            if !local.is_absolute() {
-                skipped.push(format!("{}: local path must be absolute", item.local_path));
-                continue;
-            }
+            // The path is proposed from the profile another machine wrote, and
+            // may hold a folder name from Drive: checked like any new root.
+            let local = match pdfs_core::syncroot::resolve(Path::new(&item.local_path)) {
+                Ok(local) => local,
+                Err(e) => {
+                    skipped.push(format!("{}: {e}", item.local_path));
+                    continue;
+                }
+            };
             if existing.iter().any(|f| f.remote_uid == item.remote_uid) {
                 skipped.push(format!("{}: already synced", item.local_path));
                 continue;
             }
-            if existing
-                .iter()
-                .any(|f| Path::new(&f.local_path) == local.as_path())
-            {
-                skipped.push(format!("{}: path already in use", item.local_path));
+            if let Some(problem) = pdfs_core::syncroot::problem(&local, &roots, &reserved) {
+                skipped.push(format!("{}: {problem}", item.local_path));
                 continue;
             }
             if let Err(e) = std::fs::create_dir_all(&local) {
@@ -390,10 +445,15 @@ impl Core {
                 let _ = self.request_sync_folder_mode(id, "ondemand");
             }
             let _ = self.sync_tx.send(sync::SyncMsg::Reconcile(id));
+            roots.push(local);
             restored += 1;
         }
         let _ = self.sync_tx.send(sync::SyncMsg::Rewatch);
 
+        // The reply is gone once the app has shown it; the log keeps why.
+        for reason in &skipped {
+            info!(reason, "restore skipped a folder");
+        }
         let mut message = format!("restored {restored} folder(s)");
         if !skipped.is_empty() {
             message.push_str(&format!("; skipped: {}", skipped.join(", ")));
@@ -482,7 +542,7 @@ mod tests {
     #[test]
     fn loading_falls_back_to_a_legacy_device_root_profile() {
         let source = include_str!("profile.rs");
-        let load = function_source(source, "fn load_profile(");
+        let load = function_source(source, "fn load_profiles(");
         assert!(load.contains("PROFILE_DIR_NAME"), "prefers the folder");
         assert!(
             load.find("PROFILE_DIR_NAME").unwrap()
@@ -491,6 +551,16 @@ mod tests {
         );
     }
 
+    /// Several computers may share a device, so each saves to a file named
+    /// after its own machine id and never to the shared `profile.json`
+    /// (B252).
+    #[test]
+    fn each_machine_saves_its_own_profile() {
+        let save = function_source(include_str!("profile.rs"), "fn save_profile(");
+        assert!(save.contains("profile_file_name(&machine_id)"));
+        assert!(!save.contains("PROFILE_FILE_NAME"));
+    }
+
     /// The profile folder is the client's own bookkeeping: neither the restore
     /// picker nor `add_sync_folder` may treat it as a user folder.
     #[test]

crates/pdfs-fuse/src/queue.rs

@@ -1,12 +1,16 @@
 //! The user's view of the pending-op queue: what has not reached the remote
 //! yet, why, and a way to stop waiting out a backoff.
 //!
-//! Read-only apart from "retry now", which only moves a row's next-attempt time.
-//! Nothing here drops a queued op: its staged blob is the only copy of the
-//! user's write (see `docs/RECOVERY.md`).
+//! Read-only apart from "retry now", which only moves a row's next-attempt time,
+//! "export", which copies a staged blob out, and "discard". Only a discard the
+//! user asks for drops a queued op: its staged blob is the only copy of the
+//! user's write (see `docs/RECOVERY.md`), so it is the user's call, made after
+//! an export or for a change with no content.
 
 use super::*;
-use pdfs_core::control::PendingOpInfo;
+use std::io::Write;
+
+use pdfs_core::control::{PendingOpInfo, SyncIssue};
 use pdfs_core::db::{FAILING_ATTEMPTS, PARK_UNTIL};
 
 impl Core {
@@ -16,10 +20,15 @@ impl Core {
             .db
             .pending_ops()
             .map_err(|e| CoreError::internal(format!("listing the queue: {e}")))?;
+        let issues = self
+            .db
+            .op_issues()
+            .map_err(|e| CoreError::internal(format!("listing sync issues: {e}")))?;
         Ok(ops
             .into_iter()
             .map(|op| {
                 let parked = op.next_attempt_at >= PARK_UNTIL;
+                let exportable = exportable(&op).is_some();
                 let path = self
                     .db
                     .node_path(&op.uid)
@@ -37,7 +46,9 @@ impl Core {
                     queued_at: op.created_at / 1000,
                     next_attempt_at: (!parked).then_some(op.next_attempt_at / 1000),
                     parked,
-                    failing: op.attempts >= FAILING_ATTEMPTS,
+                    failing: op.attempts >= FAILING_ATTEMPTS || issues.contains_key(&op.id),
+                    issue: issues.get(&op.id).map(|issue| SyncIssue::parse(issue)),
+                    exportable,
                 }
             })
             .collect())
@@ -57,4 +68,235 @@ impl Core {
         }
         Ok(moved)
     }
+
+    /// Copy the content of queued op `id` to `dest`, which must not exist yet.
+    /// The op stays queued. Returns the bytes written.
+    pub(crate) fn export_pending_op(&self, id: i64, dest: &Path) -> CoreResult<u64> {
+        if !dest.is_absolute() {
+            return Err(CoreError::invalid(format!(
+                "destination must be an absolute path: {}",
+                dest.display()
+            )));
+        }
+        let ops = self
+            .db
+            .pending_ops()
+            .map_err(|e| CoreError::internal(format!("listing the queue: {e}")))?;
+        let op = ops
+            .iter()
+            .find(|op| op.id == id)
+            .ok_or_else(|| CoreError::not_found(format!("no queued change {id}")))?;
+        let blob = exportable(op).ok_or_else(|| {
+            CoreError::invalid(format!("queued change {id} carries no file content"))
+        })?;
+        let written = copy_to_new_file(blob, dest)?;
+        info!(id, dest = %dest.display(), written, "exported a queued change's content");
+        Ok(written)
+    }
+
+    /// Drop queued op `id` and undo the local change it stood for. Returns the
+    /// node's path.
+    ///
+    /// A node only made here goes, as if it had been deleted before it was
+    /// sent. A node Drive has goes back to what Drive has: every change queued
+    /// on it goes, since each was made on top of the one before. What is queued
+    /// below it stays.
+    pub(crate) fn discard_pending_op(&self, id: i64) -> CoreResult<String> {
+        let ops = self
+            .db
+            .pending_ops()
+            .map_err(|e| CoreError::internal(format!("listing the queue: {e}")))?;
+        let op = ops
+            .into_iter()
+            .find(|op| op.id == id)
+            .ok_or_else(|| CoreError::not_found(format!("no queued change {id}")))?;
+        let uid = parse_node_uid(&op.uid)
+            .ok_or_else(|| CoreError::internal(format!("queued change {id} names {}", op.uid)))?;
+        let path = self
+            .db
+            .node_path(&op.uid)
+            .ok()
+            .flatten()
+            .filter(|path| !path.is_empty())
+            .or(op.name)
+            .unwrap_or_else(|| op.uid.clone());
+        if self.is_open_anywhere(&uid) {
+            return Err(CoreError::conflict(format!(
+                "{path} is open; close it first"
+            )));
+        }
+        if is_local_uid(&uid) {
+            self.discard_local_node(&uid, &path)?;
+        } else {
+            self.discard_remote_change(&uid, &path)?;
+        }
+        info!(id, %uid, path, "discarded a queued change");
+        Ok(path)
+    }
+
+    /// Forget a node made here, and the ops that would have sent it.
+    fn discard_local_node(&self, uid: &NodeUid, path: &str) -> CoreResult<()> {
+        // Its children's ops go with its own, and their content with them.
+        if self
+            .db
+            .has_children(uid)
+            .map_err(|e| CoreError::internal(format!("listing {path}: {e}")))?
+        {
+            return Err(CoreError::conflict(format!(
+                "{path} is not empty; discard what is in it first"
+            )));
+        }
+        self.discard_queued_ops(uid)
+            .map_err(|_| CoreError::internal(format!("dropping the changes to {path}")))?;
+        self.for_each_mount(|st, notify| {
+            background::forget_and_notify(st, notify, uid);
+        });
+        self.cache.evict(uid);
+        self.evict_reader(uid);
+        Ok(())
+    }
+
+    /// Put a node Drive has back as Drive has it.
+    fn discard_remote_change(&self, uid: &NodeUid, path: &str) -> CoreResult<()> {
+        // Asked first: the change is only dropped once what replaces it is known.
+        let node = self
+            .fetch_node_remote(uid)
+            .map_err(|e| CoreError::from_api(&e, "reading the node from Drive"))?
+            .filter(|node| !node.trashed);
+        self.cancel_upload(uid);
+        let blobs = self
+            .db
+            .discard_ops_on_node(&uid.to_string())
+            .map_err(|e| CoreError::internal(format!("dropping the changes to {path}: {e}")))?
+            .ok_or_else(|| {
+                CoreError::conflict(format!("{path} is being sent right now; try again"))
+            })?;
+        self.release_dropped_ops(uid, blobs);
+        self.hidden.lock().remove(uid);
+        match node {
+            Some(node) => self.for_each_mount(|st, notify| {
+                put_back(st, notify, node);
+            }),
+            None => self.for_each_mount(|st, notify| {
+                background::forget_and_notify(st, notify, uid);
+            }),
+        }
+        self.cache.evict(uid);
+        self.evict_reader(uid);
+        Ok(())
+    }
+}
+
+/// Show `node` as Drive has it, where Drive has it, under the inode it has.
+fn put_back(st: &mut State, notify: &mut NotifyBatch, node: Node) {
+    let parent = node.parent_uid.as_ref().and_then(|parent| {
+        st.by_uid
+            .get(parent)
+            .copied()
+            .map(|ino| (ino, parent.clone()))
+    });
+    let here = st.by_uid.get(&node.uid).and_then(|ino| {
+        st.entries
+            .get(ino)
+            .map(|entry| (*ino, entry.parent, entry.node.name.clone()))
+    });
+    match (here, parent) {
+        (Some((ino, from, name)), Some((to, to_uid))) => {
+            st.relocate(ino, from, to, &to_uid, &node.name);
+            st.write_through(node.clone());
+            st.intern_mem(to, node);
+            notify.inval_entry(from, name);
+            notify.inval_inode(ino);
+        }
+        (here, parent) => {
+            if let Some((_, from, name)) = here {
+                st.forget_mem(&node.uid);
+                st.invalidate_listing(from);
+                notify.inval_entry(from, name);
+            }
+            if let Some((to, _)) = parent {
+                st.invalidate_listing(to);
+                notify.inval_entry(to, node.name.clone());
+            }
+            st.write_through(node);
+        }
+    }
+}
+
+/// Copy `blob` to `dest`, which must not exist: never replace something the
+/// user already has.
+fn copy_to_new_file(blob: &Path, dest: &Path) -> CoreResult<u64> {
+    let mut source = File::open(blob)
+        .map_err(|e| CoreError::internal(format!("open {}: {e}", blob.display())))?;
+    let mut out = std::fs::OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .open(dest)
+        .map_err(|e| match e.kind() {
+            std::io::ErrorKind::AlreadyExists => {
+                CoreError::invalid(format!("{} already exists", dest.display()))
+            }
+            _ => CoreError::internal(format!("create {}: {e}", dest.display())),
+        })?;
+    std::io::copy(&mut source, &mut out)
+        .and_then(|written| out.flush().and(out.sync_all()).map(|()| written))
+        .map_err(|e| CoreError::internal(format!("write {}: {e}", dest.display())))
+}
+
+/// The staged blob of an op that carries file content.
+fn exportable(op: &PendingOp) -> Option<&Path> {
+    matches!(op.kind.as_str(), OP_CREATE | OP_REVISION)
+        .then_some(op.blob_path.as_deref())
+        .flatten()
+        .map(Path::new)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn op(kind: &str, blob: Option<&str>) -> PendingOp {
+        PendingOp {
+            id: 1,
+            kind: kind.to_string(),
+            uid: "vol~a".to_string(),
+            parent_uid: None,
+            name: None,
+            blob_path: blob.map(str::to_string),
+            meta_json: None,
+            created_at: 0,
+            attempts: 0,
+            last_error: None,
+            next_attempt_at: 0,
+        }
+    }
+
+    #[test]
+    fn only_a_change_that_carries_file_content_can_be_exported() {
+        assert!(exportable(&op(OP_CREATE, Some("/staging/a"))).is_some());
+        assert!(exportable(&op(OP_REVISION, Some("/staging/a"))).is_some());
+        assert!(exportable(&op(OP_CREATE, None)).is_none());
+        assert!(exportable(&op(OP_RENAME, None)).is_none());
+        assert!(exportable(&op(OP_TRASH, None)).is_none());
+    }
+
+    #[test]
+    fn an_export_copies_the_bytes_and_never_replaces_a_file() {
+        let dir = std::env::temp_dir().join(format!("pdfs-export-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let blob = dir.join("blob");
+        std::fs::write(&blob, b"queued bytes").unwrap();
+
+        let dest = dir.join("copy.txt");
+        assert_eq!(copy_to_new_file(&blob, &dest).unwrap(), 12);
+        assert_eq!(std::fs::read(&dest).unwrap(), b"queued bytes");
+
+        std::fs::write(&dest, b"the user's own").unwrap();
+        assert!(copy_to_new_file(&blob, &dest).is_err());
+        assert_eq!(std::fs::read(&dest).unwrap(), b"the user's own");
+        // The staged blob is the only copy of the change: an export leaves it.
+        assert_eq!(std::fs::read(&blob).unwrap(), b"queued bytes");
+
+        let _ = std::fs::remove_dir_all(&dir);
+    }
 }

crates/pdfs-fuse/src/reads.rs

@@ -70,7 +70,7 @@ const MAX_OPEN_READERS: usize = 64;
 /// `(mtime, size)` — the same validity pair the content cache uses (a new
 /// revision bumps mtime). On a mismatch the reader is dropped and reopened.
 pub(super) struct CachedReader {
-    reader: Arc<RevisionReader>,
+    reader: Arc<dyn RevisionRead>,
     mtime: i64,
     size: u64,
     /// For LRU eviction.
@@ -101,7 +101,7 @@ pub(super) struct PendingOpen {
     /// must not join this open — it would get a reader for the wrong bytes.
     mtime: i64,
     size: u64,
-    rx: tokio::sync::watch::Receiver<Option<Result<Arc<RevisionReader>, Errno>>>,
+    rx: tokio::sync::watch::Receiver<Option<Result<Arc<dyn RevisionRead>, Errno>>>,
 }
 
 /// Distinguishes `PendingOpen`s. Only uniqueness matters, so a plain counter
@@ -313,16 +313,16 @@ impl Core {
         uid: &NodeUid,
         mtime: i64,
         fsize: u64,
-    ) -> Result<Arc<RevisionReader>, Errno> {
+    ) -> Result<Arc<dyn RevisionRead>, Errno> {
         loop {
             // Decide under the lock, act outside it — network I/O must never run
             // under a std `Mutex`, and an await must never hold one.
             enum Act {
-                Hit(Arc<RevisionReader>),
-                Join(tokio::sync::watch::Receiver<Option<Result<Arc<RevisionReader>, Errno>>>),
+                Hit(Arc<dyn RevisionRead>),
+                Join(tokio::sync::watch::Receiver<Option<Result<Arc<dyn RevisionRead>, Errno>>>),
                 Lead(
                     u64,
-                    tokio::sync::watch::Sender<Option<Result<Arc<RevisionReader>, Errno>>>,
+                    tokio::sync::watch::Sender<Option<Result<Arc<dyn RevisionRead>, Errno>>>,
                 ),
             }
             let act = {
@@ -376,8 +376,8 @@ impl Core {
                 }
                 Act::Lead(id, tx) => {
                     debug!(%uid, mtime, fsize, "opening revision");
-                    let result = match self.client.open_revision(uid).await {
-                        Ok(reader) => Ok(Arc::new(reader)),
+                    let result = match self.drive.open_revision(uid).await {
+                        Ok(reader) => Ok(reader),
                         Err(e) => {
                             self.lost_link(&e, "open a revision");
                             warn!(%uid, error = %e, "open_revision failed");
@@ -464,7 +464,7 @@ impl Core {
     /// it, and the [`BLOCK_SIZE`] assumption when it has not — which is every
     /// first read, because learning it means opening a `RevisionReader`, and
     /// opening one per read is precisely the per-file key derivation the block
-    /// cache exists to avoid (bugs.md B12, B85).
+    /// cache exists to avoid (`docs/BUGS.md` B12, B85).
     ///
     /// Being wrong here is not a correctness problem: `read_at` plans over the
     /// real sizes and clamps to what was asked for either way. It costs a
@@ -493,15 +493,20 @@ impl Core {
     ) -> Result<Vec<u8>, Errno> {
         // A queued write has not reached the remote yet, so the remote's current
         // revision is stale and the staged blob is the truth. Serve from it until
-        // the drain worker lands the upload (offline.md Phase 3).
+        // the drain worker lands the upload.
         if let Some(pending) = self.pending.lock().get(uid).cloned() {
             return self.read_pending(&pending, offset, len);
         }
         // A node created offline and never written has no blob and no remote: it
         // is an empty file, and asking the API about a `local~` uid would only
-        // earn a 404 (offline.md Phase 3b).
+        // earn a 404. Unless its create landed since the
+        // read looked: the landing moved the queued write to the uid Drive
+        // gave it, and the row says which (`docs/BUGS.md` B179).
         if is_local_uid(uid) {
-            return Ok(Vec::new());
+            return match self.landed_stand_in_uid(uid) {
+                Some(real) => self.read_range(&real, mtime, fsize, offset, len, cache_blocks),
+                None => Ok(Vec::new()),
+            };
         }
         self.read_range_remote(uid, mtime, fsize, offset, len, cache_blocks)
     }
@@ -568,7 +573,7 @@ impl Core {
     /// leader's claim is gone by then, so this cannot recurse.
     async fn fetch_block(
         &self,
-        reader: &Arc<RevisionReader>,
+        reader: &Arc<dyn RevisionRead>,
         uid: &NodeUid,
         mtime: i64,
         fsize: u64,
@@ -631,10 +636,10 @@ impl Core {
     ///
     /// A block that comes back shorter than the file's size says it must be is
     /// never served, cached or promoted: it is repaired from the whole-file
-    /// download, or the read fails. See [`Core::repair_block`] (bugs.md B84).
+    /// download, or the read fails. See [`Core::repair_block`] (`docs/BUGS.md` B84).
     async fn read_block(
         &self,
-        reader: &Arc<RevisionReader>,
+        reader: &Arc<dyn RevisionRead>,
         uid: &NodeUid,
         mtime: i64,
         fsize: u64,
@@ -646,7 +651,7 @@ impl Core {
         // file's boundaries are wrong, and the failure is not confined to short
         // reads: sizes that *overstate* a block shift every block after it and
         // return full-length reads of the wrong bytes. So a disagreement of any
-        // kind takes the file off the range path entirely (bugs.md B84).
+        // kind takes the file off the range path entirely (`docs/BUGS.md` B84).
         let bytes = if reader.size() != fsize {
             warn!(
                 %uid, bidx = span.idx, fsize,
@@ -659,7 +664,7 @@ impl Core {
             // Learned here rather than on a path of its own: this is where a
             // reader is open anyway, and recording the real geometry is what
             // lets the *next* read plan its blocks on the revision's own
-            // boundaries instead of the 4 MiB fallback (bugs.md B85).
+            // boundaries instead of the 4 MiB fallback (`docs/BUGS.md` B85).
             if cache_blocks {
                 self.cache
                     .store_block_geometry(uid, mtime, fsize, reader.block_sizes());
@@ -701,7 +706,7 @@ impl Core {
     /// The range path derives every block boundary from the revision's recorded
     /// block sizes. When those understate the file, reads come back short with
     /// no error anywhere, and the caller hands userspace a truncated file that
-    /// looks like a clean EOF (bugs.md B84). `download_file_to` does not do that
+    /// looks like a clean EOF (`docs/BUGS.md` B84). `download_file_to` does not do that
     /// arithmetic — it streams the block list — so it returns the whole file
     /// where the range path cannot, which is why pinning was the workaround.
     /// This does the same thing on the user's behalf, once, and the resulting
@@ -778,7 +783,7 @@ impl Core {
             error!(%uid, %error, "creating a scratch file for a repair download failed");
             Errno::EIO
         })?;
-        let outcome = self.client.download_file_to(uid, &mut file).await;
+        let outcome = self.drive.download_file_to(uid, &mut file).await;
         let stored = (|| {
             outcome.map_err(|error| {
                 warn!(%uid, %error, "repair download failed");
@@ -913,7 +918,7 @@ impl Core {
         let end = offset.saturating_add(len).min(fsize);
         let mut out = Vec::with_capacity((end - offset) as usize);
         // On the revision's own boundaries where they are known, and on the
-        // 4 MiB fallback where they are not (bugs.md B85).
+        // 4 MiB fallback where they are not (`docs/BUGS.md` B85).
         let wanted = self.block_geometry(uid, mtime, fsize).spans(offset, end);
         let (Some(&head), Some(&tail)) = (wanted.first(), wanted.last()) else {
             return Ok(out);
@@ -1033,7 +1038,7 @@ impl Core {
             // — the cache validates it on read, the network path in `read_block`
             // — so this refuses rather than quietly contributing fewer bytes
             // than the range covers, which is what turned a bad block into a
-            // truncated file (bugs.md B84).
+            // truncated file (`docs/BUGS.md` B84).
             if block.len() as u64 != span.len {
                 error!(
                     %uid, bidx = span.idx, len = block.len(), expected = span.len, fsize,
@@ -1065,37 +1070,121 @@ impl Core {
         offset: u64,
         size: u64,
     ) -> Result<Vec<u8>, Errno> {
-        if offset >= len || size == 0 {
-            return Ok(Vec::new());
+        let read = assemble_open_read(file, len, uid, base_size, written, offset, size, |s, n| {
+            self.read_range(uid, base_mtime, base_size, s, n, true)
+                .map(Some)
+        })?;
+        Ok(read.unwrap_or_default())
+    }
+
+    /// [`Core::serve_open_read`] from bytes already on this machine only:
+    /// `Ok(None)` the moment a range of the base would have to be downloaded.
+    ///
+    /// The dispatch loop answers a read on a write handle with this, and hands
+    /// it to a worker only when it says `None`. Fetching the base there held
+    /// every request of the mount for as long as the download took, up to the
+    /// read deadline (`docs/BUGS.md` B227).
+    #[allow(clippy::too_many_arguments)]
+    pub(super) fn serve_open_read_local(
+        &self,
+        file: &Arc<File>,
+        len: u64,
+        uid: &NodeUid,
+        base_mtime: i64,
+        base_size: u64,
+        written: &Intervals,
+        offset: u64,
+        size: u64,
+    ) -> Result<Option<Vec<u8>>, Errno> {
+        assemble_open_read(file, len, uid, base_size, written, offset, size, |s, n| {
+            Ok(self.cached_range(uid, base_mtime, base_size, s, n))
+        })
+    }
+
+    /// Bytes `[offset, offset + size)` of file `ino` as `read` would serve
+    /// them, but only from this machine: an open write handle, a queued write,
+    /// or the caches. `Ok(None)` the moment any of it would have to be
+    /// downloaded, and for a size still provisional (B100), which only the
+    /// network settles. Short or empty past the end of the file.
+    ///
+    /// `copy_file_range` answers with this and leaves anything else to the
+    /// kernel's read/write copy.
+    pub(super) fn read_local(
+        &self,
+        ino: u64,
+        offset: u64,
+        size: u64,
+    ) -> Result<Option<Vec<u8>>, Errno> {
+        let handle = self.state().active_writes.get(&ino).map(|h| {
+            (
+                h.file.clone(),
+                h.len,
+                h.uid.clone(),
+                h.base_mtime,
+                h.base_size,
+                h.written.clone(),
+            )
+        });
+        if let Some((file, len, uid, base_mtime, base_size, written)) = handle {
+            return self.serve_open_read_local(
+                &file, len, &uid, base_mtime, base_size, &written, offset, size,
+            );
         }
-        let end = offset.saturating_add(size).min(len);
-        let mut out = Vec::with_capacity((end - offset) as usize);
-        for (s, e, authored) in written.segments(offset, end) {
-            if authored {
-                let mut buf = vec![0u8; (e - s) as usize];
-                file.read_exact_at(&mut buf, s).map_err(|err| {
-                    warn!(%uid, error = %err, "scratch read failed");
-                    Errno::EIO
-                })?;
-                out.extend_from_slice(&buf);
-            } else {
-                let bend = e.min(base_size);
-                if s < bend {
-                    out.extend_from_slice(&self.read_range(
-                        uid,
-                        base_mtime,
-                        base_size,
-                        s,
-                        bend - s,
-                        true,
-                    )?);
-                }
-                // Anything past the base is a hole: zero-fill.
-                let zeros = e.saturating_sub(s.max(base_size));
-                out.resize(out.len() + zeros as usize, 0);
+        let (uid, mtime, fsize, provisional) = {
+            let st = self.state();
+            match st.entries.get(&ino) {
+                Some(e) if e.node.is_file() => (
+                    e.uid.clone(),
+                    e.node.modification_time,
+                    node_size(&e.node),
+                    matches!(
+                        &e.node.kind,
+                        NodeKind::File {
+                            claimed_size: None,
+                            ..
+                        }
+                    ),
+                ),
+                Some(_) => return Err(Errno::EISDIR),
+                None => return Err(Errno::ENOENT),
             }
+        };
+        let uid = match is_local_uid(&uid) {
+            true => self.landed_stand_in_uid(&uid).unwrap_or(uid),
+            false => uid,
+        };
+        if let Some(pending) = self.pending.lock().get(&uid).cloned() {
+            let m = &pending.meta;
+            let file = File::open(&pending.path).map_err(|e| {
+                error!(%uid, path = %pending.path.display(), error = %e, "open staged blob failed");
+                Errno::EIO
+            })?;
+            let mut written = Intervals::default();
+            for &(s, e) in &m.authored {
+                written.add(s, e);
+            }
+            return self.serve_open_read_local(
+                &Arc::new(file),
+                m.len,
+                &uid,
+                m.base_mtime,
+                m.base_size,
+                &written,
+                offset,
+                size,
+            );
         }
-        Ok(out)
+        // Created here and never written: an empty file.
+        if is_local_uid(&uid) {
+            return Ok(Some(Vec::new()));
+        }
+        if provisional {
+            return Ok(None);
+        }
+        if offset >= fsize || size == 0 {
+            return Ok(Some(Vec::new()));
+        }
+        Ok(self.cached_range(&uid, mtime, fsize, offset, size.min(fsize - offset)))
     }
 
     /// The largest amount [`Core::fill_gaps_cached`] will copy out of the local
@@ -1237,6 +1326,49 @@ impl Core {
     }
 }
 
+/// The bytes `[offset, offset + size)` of a file open for writing: authored
+/// ranges from its scratch `file`, the rest from its base through `base`,
+/// and zeros past the base. `Ok(None)` when `base` says it cannot answer.
+#[allow(clippy::too_many_arguments)]
+fn assemble_open_read(
+    file: &File,
+    len: u64,
+    uid: &NodeUid,
+    base_size: u64,
+    written: &Intervals,
+    offset: u64,
+    size: u64,
+    mut base: impl FnMut(u64, u64) -> Result<Option<Vec<u8>>, Errno>,
+) -> Result<Option<Vec<u8>>, Errno> {
+    if offset >= len || size == 0 {
+        return Ok(Some(Vec::new()));
+    }
+    let end = offset.saturating_add(size).min(len);
+    let mut out = Vec::with_capacity((end - offset) as usize);
+    for (s, e, authored) in written.segments(offset, end) {
+        if authored {
+            let mut buf = vec![0u8; (e - s) as usize];
+            file.read_exact_at(&mut buf, s).map_err(|err| {
+                warn!(%uid, error = %err, "scratch read failed");
+                Errno::EIO
+            })?;
+            out.extend_from_slice(&buf);
+        } else {
+            let bend = e.min(base_size);
+            if s < bend {
+                match base(s, bend - s)? {
+                    Some(bytes) => out.extend_from_slice(&bytes),
+                    None => return Ok(None),
+                }
+            }
+            // Anything past the base is a hole: zero-fill.
+            let zeros = e.saturating_sub(s.max(base_size));
+            out.resize(out.len() + zeros as usize, 0);
+        }
+    }
+    Ok(Some(out))
+}
+
 #[cfg(test)]
 mod block_ring_tests {
     use super::*;
@@ -1389,3 +1521,54 @@ mod prefetch_tests {
         assert!(prefetch.streams.lock().len() <= MAX_PREFETCH_STREAMS + 1);
     }
 }
+
+#[cfg(test)]
+mod open_read_tests {
+    use super::*;
+    use proton_drive_rs::proton_sdk::ids::{LinkId, VolumeId};
+
+    fn scratch(bytes: &[u8]) -> (File, PathBuf) {
+        let path = std::env::temp_dir().join(format!(
+            "pdfs-open-read-{}-{}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .unwrap()
+                .as_nanos()
+        ));
+        let mut file = File::options()
+            .create_new(true)
+            .read(true)
+            .write(true)
+            .open(&path)
+            .unwrap();
+        file.write_all(bytes).unwrap();
+        (file, path)
+    }
+
+    /// The dispatch loop answers from what is on this machine and says so
+    /// when the base would have to be downloaded, for a worker to do it
+    /// (`docs/BUGS.md` B227).
+    #[test]
+    fn a_read_needing_the_base_says_so_instead_of_fetching() {
+        let uid = NodeUid::new(VolumeId::from("v"), LinkId::from("f"));
+        let (file, path) = scratch(b"ABCDEFGH");
+        let mut written = Intervals::default();
+        written.add(0, 4);
+
+        let authored = assemble_open_read(&file, 8, &uid, 8, &written, 0, 4, |_, _| {
+            panic!("an authored range never asks the base")
+        });
+        assert_eq!(authored.unwrap().as_deref(), Some(&b"ABCD"[..]));
+
+        let missing = assemble_open_read(&file, 8, &uid, 8, &written, 2, 6, |_, _| Ok(None));
+        assert_eq!(missing.unwrap(), None);
+
+        let base = assemble_open_read(&file, 10, &uid, 8, &written, 2, 8, |s, n| {
+            assert_eq!((s, n), (4, 4));
+            Ok(Some(b"efgh".to_vec()))
+        });
+        assert_eq!(base.unwrap().as_deref(), Some(&b"CDefgh\0\0"[..]));
+        let _ = std::fs::remove_file(path);
+    }
+}

crates/pdfs-fuse/src/redate.rs

@@ -190,6 +190,7 @@ impl Core {
             .map_err(|e| CoreError::internal(format!("stat {}: {e}", path.display())))?
             .len();
         let media_type = media_type_of(&candidate.name).unwrap_or("application/octet-stream");
+        let thumbnails = self.upload_thumbnails(&path, &candidate.name);
 
         let guard =
             self.transfers
@@ -206,7 +207,7 @@ impl Core {
             media_type,
             reader,
             size as i64,
-            Vec::new(),
+            thumbnails,
             metadata,
             false,
         ));
@@ -248,10 +249,7 @@ impl Core {
 
         let outcomes = self
             .rt
-            .block_on(
-                self.client
-                    .trash_nodes(std::slice::from_ref(&candidate.uid)),
-            )
+            .block_on(self.drive.trash_nodes(std::slice::from_ref(&candidate.uid)))
             .map_err(|e| CoreError::from_api(&e, "trash the mis-dated original"))?;
         if let Some((_, Err(e))) = outcomes.into_iter().next() {
             return Err(CoreError::from_api(&e, "trash the mis-dated original"));
@@ -294,7 +292,14 @@ impl Core {
             let mut state = REDATE.lock();
             state.running = false;
             state.cancel = None;
-            state.last = outcome.as_ref().ok().cloned();
+            state.last = Some(match &outcome {
+                Ok(summary) => summary.clone(),
+                Err(e) => RedateSummary {
+                    error: Some(e.to_string()),
+                    dry_run,
+                    ..Default::default()
+                },
+            });
             match &outcome {
                 Ok(summary) => info!(
                     candidates = summary.candidates,

crates/pdfs-fuse/src/relocate.rs

@@ -25,7 +25,7 @@ use proton_drive_rs::NodeKind;
 use proton_drive_rs::proton_sdk::ids::NodeUid;
 use tracing::{info, warn};
 
-use super::background::forget_and_notify;
+use super::state::State;
 use super::sync::mirror_subtree_unsynced;
 use super::{Core, is_local_uid, parse_uid};
 
@@ -36,7 +36,7 @@ const MIRROR_LOCK_WAIT: Duration = Duration::from_secs(5);
 
 /// Where one side of a move lives.
 enum Place {
-    /// My files or an on-demand folder: a live inode space. `core` is rooted at
+    /// My files or an on-demand folder: a live FUSE mount. `core` is rooted at
     /// that mount and `rel` is relative to its mountpoint.
     Mounted { core: Box<Core>, rel: PathBuf },
     /// A mirror folder: a local directory kept in step by the sync engine.
@@ -131,6 +131,24 @@ fn rename_noreplace(from: &Path, to: &Path) -> std::io::Result<()> {
     }
 }
 
+/// Whether inode `ino` is `root` or lies under it in the tree. Bounded, so a
+/// parent cycle in corrupt data cannot hang the caller.
+pub(crate) fn ino_is_under(st: &State, mut ino: u64, root: u64) -> bool {
+    for _ in 0..MAX_TREE_DEPTH {
+        if ino == root {
+            return true;
+        }
+        match st.entries.get(&ino) {
+            Some(entry) if entry.parent != ino => ino = entry.parent,
+            _ => return false,
+        }
+    }
+    false
+}
+
+/// How deep [`ino_is_under`] walks before it gives up.
+const MAX_TREE_DEPTH: usize = 1024;
+
 /// Whether `uid` is `root` or lies under it, as far as the nodes table knows.
 fn under(core: &Core, root: &NodeUid, uid: &str) -> bool {
     let root = root.to_string();
@@ -142,7 +160,7 @@ impl Core {
     /// are absolute local paths and may be in different locations: My files,
     /// an on-demand folder, or a mirror folder. Returns the moved name.
     ///
-    /// Within one inode space this is [`Core::move_to`]. Across locations it
+    /// Within one mount this is [`Core::move_to`]. Across locations it
     /// is a server-side move followed by local bookkeeping; see the module
     /// documentation. Anything the move could lose is refused up front.
     pub(crate) fn move_between(&self, src: &Path, dest_parent: &Path) -> CoreResult<String> {
@@ -155,7 +173,7 @@ impl Core {
                 rel: dest_rel,
             },
         ) = (&source, &dest)
-            && Arc::ptr_eq(&core.state, &dest_core.state)
+            && Arc::ptr_eq(&core.root, &dest_core.root)
         {
             return core.move_to(rel, dest_rel);
         }
@@ -255,7 +273,7 @@ impl Core {
             )));
         }
 
-        if let Err(e) = self.rt.block_on(self.client.move_node(&src_uid, &dest_uid)) {
+        if let Err(e) = self.move_remote(&src_uid, &dest_uid) {
             if let Some((from, to)) = &renamed
                 && let Err(back) = std::fs::rename(to, from)
             {
@@ -265,7 +283,15 @@ impl Core {
             return Err(CoreError::from_api(&e, "move"));
         }
 
-        self.settle_source(&source, &src_uid, renamed.is_some(), &dest, &name, src);
+        self.settle_source(
+            &source,
+            &src_uid,
+            renamed.is_some(),
+            &dest,
+            &dest_uid,
+            &name,
+            src,
+        );
         self.settle_dest(&dest, &dest_uid, &name);
         drop(guards);
         if renamed.is_none()
@@ -329,7 +355,7 @@ impl Core {
                     core.require_uid_writable(authority)
                         .map_err(|e| core.errno_error(e, "move access"))?;
                 }
-                if self.has_pending_work_under(&uid)? {
+                if self.has_pending_work_under(ino, &uid)? {
                     return Err(CoreError::conflict(
                         "it has changes that are not uploaded yet; wait for the upload to finish",
                     ));
@@ -403,10 +429,11 @@ impl Core {
         Ok(uid)
     }
 
-    /// Whether the queue owes Drive anything for `uid` or a node under it, or a
-    /// file under it is open for writing. Moving such a node away would strand
-    /// the pending change against a path that no longer leads to it.
-    fn has_pending_work_under(&self, uid: &NodeUid) -> CoreResult<bool> {
+    /// Whether the queue owes Drive anything for `uid` (inode `ino`) or a node
+    /// under it, or a file under it is open for writing. Moving such a node away
+    /// would strand the pending change against a path that no longer leads to
+    /// it.
+    fn has_pending_work_under(&self, ino: u64, uid: &NodeUid) -> CoreResult<bool> {
         let ops = self
             .db
             .pending_ops()
@@ -420,31 +447,39 @@ impl Core {
         }) {
             return Ok(true);
         }
-        // Collected first so no State lock is held across the nodes-table reads.
-        let mut writing = Vec::new();
+        // Open handles are placed in the tree by inode, not by uid in the nodes
+        // table. A file opened just after its create landed holds the
+        // placeholder uid until the tree catches up, and the nodes table no
+        // longer has that uid, so the move went ahead under an open write.
+        let mut writing = false;
         self.for_each_state(|st| {
-            writing.extend(st.active_writes.values().map(|w| w.uid.to_string()));
+            writing = st
+                .active_writes
+                .keys()
+                .chain(&st.releasing)
+                .any(|&open| ino_is_under(st, open, ino));
         });
-        Ok(writing.iter().any(|w| under(self, uid, w)))
+        Ok(writing)
     }
 
     /// Bring the source location level with a move Drive has made.
+    #[allow(clippy::too_many_arguments)]
     fn settle_source(
         &self,
         source: &Place,
         uid: &NodeUid,
         renamed: bool,
         dest: &Place,
+        dest_uid: &NodeUid,
         name: &str,
         src: &Path,
     ) {
         match source {
             Place::Mounted { core, rel } => {
-                // Forget it everywhere, so no mount keeps serving it under the
-                // old path. The content cache is keyed by uid and stays valid.
-                self.for_each_mount(|st, notify| {
-                    forget_and_notify(st, notify, uid);
-                });
+                // Moved everywhere, so no mount keeps serving it under the old
+                // path and its row stays (`docs/BUGS.md` B117). The content
+                // cache is keyed by uid and stays valid.
+                self.relocate_everywhere(uid, dest_uid, name);
                 core.invalidate_parent_listing(rel);
             }
             Place::Mirror { folder, rel } if renamed => {

crates/pdfs-fuse/src/revisions.rs

@@ -232,7 +232,7 @@ impl Core {
         let mut out = std::io::BufWriter::new(file);
         let written = match self
             .rt
-            .block_on(self.client.download_revision_to(uid, revision_id, &mut out))
+            .block_on(self.drive.download_revision_to(uid, revision_id, &mut out))
             .map_err(|e| CoreError::from_api(&e, "download revision"))
             .and_then(|()| {
                 use std::io::Write as _;

crates/pdfs-fuse/src/sharing.rs

@@ -9,7 +9,8 @@
 use std::path::Path;
 
 use pdfs_core::control::{
-    BookmarkInfo, DirEntry, InvitationInfo, PublicLinkInfo, ShareEntry, ShareEntryKind, SharedItem,
+    BookmarkInfo, DirEntry, InvitationInfo, LinkChange, PublicLinkInfo, ShareEntry, ShareEntryKind,
+    SharedItem,
 };
 use pdfs_core::{CoreError, CoreResult};
 use tracing::debug;
@@ -21,7 +22,7 @@ use proton_drive_rs::{MemberRole, NodeKind};
 
 use proton_drive_rs::Node;
 
-use super::{Core, ROOT_INO, node_size, parse_uid, public_link_info, role_from_str, role_to_str};
+use super::{Core, node_size, parse_uid, public_link_info, role_from_str, role_to_str};
 
 /// A node from a *shared* listing as a [`DirEntry`].
 ///
@@ -66,6 +67,7 @@ fn shared_entry_of(core: &Core, n: Node) -> DirEntry {
         size,
         modified: n.modification_time,
         pinned: false,
+        pinned_by_folder: false,
         cached: false,
         path: core.rel_path_for_uid(&n.uid).unwrap_or_default(),
         uid: n.uid.to_string(),
@@ -75,6 +77,7 @@ fn shared_entry_of(core: &Core, n: Node) -> DirEntry {
         shared_by_unverified,
         trashed_at: 0,
         trashed_from: None,
+        issue: None,
     }
 }
 
@@ -365,6 +368,89 @@ impl Core {
         Ok(public_link_info(link))
     }
 
+    /// Change the public link `id` on the node at `rel`, keeping its URL.
+    pub(crate) fn update_public_link(
+        &self,
+        rel: &Path,
+        id: &str,
+        role: Option<&str>,
+        password: LinkChange<String>,
+        expires: LinkChange<i64>,
+    ) -> CoreResult<PublicLinkInfo> {
+        let (_ino, uid) = self.resolve(rel)?;
+        self.update_public_link_for_uid(&uid, id, role, password, expires)
+    }
+
+    /// [`Core::update_public_link`] for a node addressed through any daemon
+    /// location.
+    pub(crate) fn update_public_link_by_uid(
+        &self,
+        uid: &str,
+        id: &str,
+        role: Option<&str>,
+        password: LinkChange<String>,
+        expires: LinkChange<i64>,
+    ) -> CoreResult<PublicLinkInfo> {
+        let uid = self.resolve_anywhere(uid)?;
+        self.update_public_link_for_uid(&uid, id, role, password, expires)
+    }
+
+    /// The SDK sets all three options on every update, so each `Keep` is
+    /// filled in from the link as it stands.
+    fn update_public_link_for_uid(
+        &self,
+        uid: &NodeUid,
+        id: &str,
+        role: Option<&str>,
+        password: LinkChange<String>,
+        expires: LinkChange<i64>,
+    ) -> CoreResult<PublicLinkInfo> {
+        let link = self
+            .rt
+            .block_on(self.client.get_public_link(uid))
+            .map_err(|e| CoreError::from_api(&e, "get public link"))?
+            .filter(|l| l.public_link_id == id)
+            .ok_or_else(|| CoreError::not_found("public link not found"))?;
+        let role = match role {
+            Some(role) => role_from_str(role)?,
+            None => link.role,
+        };
+        let unchanged = role == link.role
+            && matches!(password, LinkChange::Keep)
+            && matches!(expires, LinkChange::Keep);
+        if unchanged {
+            return Ok(public_link_info(link));
+        }
+        let password = match password {
+            LinkChange::Keep if link.has_custom_password => {
+                // Sending `None` here would quietly remove the password.
+                Some(link.custom_password.clone().ok_or_else(|| {
+                    CoreError::conflict(
+                        "the link's password could not be read; set a new one or remove it",
+                    )
+                })?)
+            }
+            LinkChange::Keep | LinkChange::Remove => None,
+            LinkChange::Set(password) if password.is_empty() => {
+                return Err(CoreError::invalid("the new password is empty"));
+            }
+            LinkChange::Set(password) => Some(password),
+        };
+        let expires = match expires {
+            LinkChange::Keep => link.expiration_time,
+            LinkChange::Remove => None,
+            LinkChange::Set(at) => Some(at),
+        };
+        let link = self
+            .rt
+            .block_on(
+                self.client
+                    .update_public_link(uid, role, password.as_deref(), expires),
+            )
+            .map_err(|e| CoreError::from_api(&e, "update public link"))?;
+        Ok(public_link_info(link))
+    }
+
     /// Remove the public link `id` from the node at `rel`.
     pub(crate) fn remove_public_link(&self, rel: &Path, id: &str) -> CoreResult<()> {
         let (_ino, uid) = self.resolve(rel)?;
@@ -463,7 +549,7 @@ impl Core {
         }
         let nodes = self
             .rt
-            .block_on(self.client.enumerate_nodes(&uids))
+            .block_on(self.drive.enumerate_nodes(&uids))
             .map_err(|e| CoreError::from_api(&e, "enumerate nodes"))?;
         Ok(nodes
             .into_iter()
@@ -481,14 +567,14 @@ impl Core {
             parse_uid(uid).ok_or_else(|| CoreError::invalid(format!("invalid uid: {uid}")))?;
         let child_uids = self
             .rt
-            .block_on(self.client.enumerate_folder_children_node_uids(&uid))
+            .block_on(self.drive.enumerate_folder_children_node_uids(&uid))
             .map_err(|e| CoreError::from_api(&e, "enumerate shared children"))?;
         if child_uids.is_empty() {
             return Ok(Vec::new());
         }
         let nodes = self
             .rt
-            .block_on(self.client.enumerate_nodes(&child_uids))
+            .block_on(self.drive.enumerate_nodes(&child_uids))
             .map_err(|e| CoreError::from_api(&e, "enumerate nodes"))?;
         Ok(nodes
             .into_iter()
@@ -509,7 +595,7 @@ impl Core {
             parse_uid(uid).ok_or_else(|| CoreError::invalid(format!("invalid uid: {uid}")))?;
         let node = self
             .rt
-            .block_on(self.client.get_node(&uid))
+            .block_on(self.drive.get_node(&uid))
             .map_err(|e| CoreError::from_api(&e, "get shared node"))?
             .ok_or_else(|| CoreError::not_found("shared node not found"))?;
         if !node.is_file() {
@@ -610,7 +696,7 @@ impl Core {
     /// Proton products (not Drive-only). A remote round-trip; nothing here is
     /// cached.
     pub(crate) fn account_quota(&self) -> CoreResult<(i64, i64)> {
-        let q = self.block_on_bounded(self.client.quota()).map_err(|e| {
+        let q = self.block_on_bounded(self.drive.quota()).map_err(|e| {
             self.lost_link(&e, "account quota");
             CoreError::from_api(&e, "account quota")
         })?;
@@ -659,6 +745,12 @@ impl Core {
     /// the shared uids; the per-node detail is then gathered best-effort — a single
     /// node racing with an unshare drops from the list rather than failing the whole
     /// request.
+    ///
+    /// A share with no member, no invitation and no link is left out: it is
+    /// shared with no one. Stop Sharing leaves exactly that behind, since the SDK
+    /// cannot delete a share, and Drive keeps listing it until its backend gets
+    /// round to removing it, minutes later. A share whose details could not all
+    /// be read stays listed, so a failed lookup never hides a live share.
     pub(crate) fn list_shared_by_me(&self) -> CoreResult<Vec<SharedItem>> {
         let uids = self
             .rt
@@ -669,7 +761,7 @@ impl Core {
         }
         let nodes = self
             .rt
-            .block_on(self.client.enumerate_nodes(&uids))
+            .block_on(self.drive.enumerate_nodes(&uids))
             .map_err(|e| CoreError::from_api(&e, "enumerate nodes"))?;
         let mut items = Vec::with_capacity(nodes.len());
         for n in nodes {
@@ -677,24 +769,26 @@ impl Core {
             let members = self
                 .rt
                 .block_on(self.client.list_share_members(&uid))
-                .map(|m| m.len())
-                .unwrap_or(0);
+                .map(|m| m.len());
             let proton_invites = self
                 .rt
                 .block_on(self.client.list_share_invitations(&uid))
-                .map(|i| i.len())
-                .unwrap_or(0);
+                .map(|i| i.len());
             let external_invites = self
                 .rt
                 .block_on(self.client.list_external_invitations(&uid))
-                .map(|i| i.len())
-                .unwrap_or(0);
-            let link = self
-                .rt
-                .block_on(self.client.get_public_link(&uid))
-                .ok()
-                .flatten()
-                .map(public_link_info);
+                .map(|i| i.len());
+            let link = self.rt.block_on(self.client.get_public_link(&uid));
+            if let (Ok(0), Ok(0), Ok(0), Ok(None)) =
+                (&members, &proton_invites, &external_invites, &link)
+            {
+                debug!(%uid, "shared by me: skipping an emptied share");
+                continue;
+            }
+            let members = members.unwrap_or(0);
+            let proton_invites = proton_invites.unwrap_or(0);
+            let external_invites = external_invites.unwrap_or(0);
+            let link = link.ok().flatten().map(public_link_info);
             items.push(SharedItem {
                 uid: uid.to_string(),
                 is_dir: n.is_folder(),
@@ -714,19 +808,10 @@ impl Core {
     /// been seen through the mount (e.g. shared but not browsed to this session) —
     /// the caller then leaves the path empty.
     pub(crate) fn rel_path_for_uid(&self, uid: &NodeUid) -> Option<String> {
-        // Searched across every mount: a node browsed through a sync folder is
-        // interned in that fork's inode space, so the primary state alone had no
-        // entry for it and the caller silently showed an empty path
-        // (`docs/BUGS.md` B74). The path is relative to whichever mount holds
-        // it, which is the one the user reached it through.
-        let mut path = None;
-        self.for_each_state(|st| {
-            if path.is_some() {
-                return;
-            }
-            path = walk_to_root(st, uid);
-        });
-        path
+        // Relative to whichever root the node sits under: a node browsed
+        // through a sync folder is under that fork's root, not My Files
+        // (`docs/BUGS.md` B74).
+        walk_to_root(&self.state(), uid)
     }
 }
 
@@ -771,14 +856,18 @@ impl StopSharingOutcome {
     }
 }
 
-/// Walk one inode space from `uid` up to its root, building the path. `None` if
-/// that mount has never interned the node, or if the chain breaks partway —
+/// Walk the tree from `uid` up to the root it sits under, building the path.
+/// `None` if the node has never been interned, or if the chain breaks partway —
 /// a broken chain is a missing path, never a partial one.
 fn walk_to_root(st: &super::State, uid: &NodeUid) -> Option<String> {
     let mut ino = *st.by_uid.get(uid)?;
     let mut parts = Vec::new();
-    while ino != ROOT_INO {
+    while !st.roots.contains(&ino) {
         let entry = st.entries.get(&ino)?;
+        // An orphan is its own parent without being a root.
+        if entry.parent == ino {
+            return None;
+        }
         parts.push(entry.node.name.clone());
         ino = entry.parent;
     }

crates/pdfs-fuse/src/shutdown.rs

@@ -6,7 +6,7 @@
 //! invisible; in an in-process remount — which is how the daemon recovers from a
 //! mount going away underneath it — it leaks a whole generation of threads that
 //! keep writing to the database and calling the API on behalf of a mount that no
-//! longer exists (bugs.md B44).
+//! longer exists (`docs/BUGS.md` B44).
 //!
 //! The primitive is deliberately small: a flag plus a condvar. Every loop that
 //! would otherwise call `thread::sleep` calls [`Shutdown::sleep`] instead, which

crates/pdfs-fuse/src/sim/mod.rs

@@ -0,0 +1,9 @@
+//! The simulation tests of `docs/TESTING.md`: a fake Drive with
+//! the faults the real one has, and the tools to drive daemons against it.
+
+pub(crate) mod daemon;
+pub(crate) mod fake_drive;
+pub(crate) mod model;
+pub(crate) mod rng;
+pub(crate) mod run;
+pub(crate) mod watchdog;

crates/pdfs-fuse/src/sim/model.rs

@@ -0,0 +1,445 @@
+//! The reference file system of the simulation (`docs/TESTING.md`,
+//! "Simulation runs", property 1): what each syscall a simulated client makes should
+//! answer, and the tree it should leave, on a POSIX file system.
+//!
+//! A [`Model`] covers one client's own folder; paths are relative to it. The
+//! same type is used for the trees read back from a mount and from Drive.
+
+use std::collections::BTreeMap;
+
+use super::rng::Rng;
+
+/// A tree by path: `None` is a folder, `Some` a file's content.
+pub(crate) type Tree = BTreeMap<String, Option<Vec<u8>>>;
+
+/// One file system call, or the few a program makes in a row.
+#[derive(Clone, Debug)]
+pub(crate) enum FsOp {
+    /// `open(O_CREAT | O_TRUNC)`, write `data`, close.
+    Create {
+        path: String,
+        data: Vec<u8>,
+    },
+    /// Open an existing file, write `data` at `offset` (past the end leaves
+    /// a hole), close.
+    Write {
+        path: String,
+        offset: u64,
+        data: Vec<u8>,
+    },
+    /// Open an existing file and `ftruncate` it to `len`.
+    Truncate {
+        path: String,
+        len: u64,
+    },
+    Mkdir {
+        path: String,
+    },
+    Rename {
+        from: String,
+        to: String,
+    },
+    Unlink {
+        path: String,
+    },
+    /// Open a file, unlink it, append `data`, read it all back, close.
+    UnlinkOpen {
+        path: String,
+        data: Vec<u8>,
+    },
+    Rmdir {
+        path: String,
+    },
+}
+
+impl FsOp {
+    /// The paths the op names, for the log.
+    pub(crate) fn describe(&self) -> String {
+        match self {
+            FsOp::Create { path, data } => format!("create {path} ({} bytes)", data.len()),
+            FsOp::Write { path, offset, data } => {
+                format!("write {path} at {offset} ({} bytes)", data.len())
+            }
+            FsOp::Truncate { path, len } => format!("truncate {path} to {len}"),
+            FsOp::Mkdir { path } => format!("mkdir {path}"),
+            FsOp::Rename { from, to } => format!("rename {from} -> {to}"),
+            FsOp::Unlink { path } => format!("unlink {path}"),
+            FsOp::UnlinkOpen { path, data } => {
+                format!("unlink {path} while open, then append {} bytes", data.len())
+            }
+            FsOp::Rmdir { path } => format!("rmdir {path}"),
+        }
+    }
+}
+
+/// The tree one client should have, and what its syscalls should answer.
+#[derive(Clone, Debug, Default)]
+pub(crate) struct Model {
+    tree: Tree,
+}
+
+/// Names are drawn from small pools, so ops collide: a create over an existing
+/// file, a rename over another, a mkdir of a name that is taken.
+const FILE_NAMES: [&str; 6] = ["a.txt", "b.txt", "c.bin", "d", "e.md", "f.txt"];
+const DIR_NAMES: [&str; 3] = ["x", "y", "z"];
+
+impl Model {
+    pub(crate) fn tree(&self) -> &Tree {
+        &self.tree
+    }
+
+    pub(crate) fn content(&self, path: &str) -> Option<&Vec<u8>> {
+        self.tree.get(path)?.as_ref()
+    }
+
+    /// What `op` should answer on a POSIX file system, applying it on success.
+    pub(crate) fn apply(&mut self, op: &FsOp) -> Result<(), i32> {
+        match op {
+            FsOp::Create { path, data } => {
+                self.check_parent(path)?;
+                match self.tree.get(path) {
+                    Some(None) => Err(libc::EISDIR),
+                    _ => {
+                        self.tree.insert(path.clone(), Some(data.clone()));
+                        Ok(())
+                    }
+                }
+            }
+            FsOp::Write { path, offset, data } => {
+                let content = self.file_mut(path)?;
+                // Writing nothing changes nothing, even past the end.
+                if data.is_empty() {
+                    return Ok(());
+                }
+                let end = *offset as usize + data.len();
+                if content.len() < end {
+                    content.resize(end, 0);
+                }
+                content[*offset as usize..end].copy_from_slice(data);
+                Ok(())
+            }
+            FsOp::Truncate { path, len } => {
+                self.file_mut(path)?.resize(*len as usize, 0);
+                Ok(())
+            }
+            FsOp::Mkdir { path } => {
+                self.check_parent(path)?;
+                if self.tree.contains_key(path) {
+                    return Err(libc::EEXIST);
+                }
+                self.tree.insert(path.clone(), None);
+                Ok(())
+            }
+            FsOp::Rename { from, to } => self.rename(from, to),
+            FsOp::Unlink { path } | FsOp::UnlinkOpen { path, .. } => {
+                self.check_parent(path)?;
+                match self.tree.get(path) {
+                    None => Err(libc::ENOENT),
+                    Some(None) => Err(libc::EISDIR),
+                    Some(Some(_)) => {
+                        self.tree.remove(path);
+                        Ok(())
+                    }
+                }
+            }
+            FsOp::Rmdir { path } => {
+                self.check_parent(path)?;
+                match self.tree.get(path) {
+                    None => Err(libc::ENOENT),
+                    Some(Some(_)) => Err(libc::ENOTDIR),
+                    Some(None) if self.has_children(path) => Err(libc::ENOTEMPTY),
+                    Some(None) => {
+                        self.tree.remove(path);
+                        Ok(())
+                    }
+                }
+            }
+        }
+    }
+
+    fn rename(&mut self, from: &str, to: &str) -> Result<(), i32> {
+        self.check_parent(from)?;
+        let Some(moving) = self.tree.get(from).cloned() else {
+            return Err(libc::ENOENT);
+        };
+        self.check_parent(to)?;
+        if from == to {
+            return Ok(());
+        }
+        if is_below(to, from) {
+            return Err(libc::EINVAL);
+        }
+        match (&moving, self.tree.get(to)) {
+            (None, Some(Some(_))) => return Err(libc::ENOTDIR),
+            (Some(_), Some(None)) => return Err(libc::EISDIR),
+            (None, Some(None)) if self.has_children(to) => return Err(libc::ENOTEMPTY),
+            _ => {}
+        }
+        let below: Vec<(String, Option<Vec<u8>>)> = self
+            .tree
+            .iter()
+            .filter(|(path, _)| is_below(path, from))
+            .map(|(path, entry)| (path.clone(), entry.clone()))
+            .collect();
+        self.tree.remove(from);
+        self.tree.insert(to.to_owned(), moving);
+        for (path, entry) in below {
+            self.tree.remove(&path);
+            self.tree
+                .insert(format!("{to}{}", &path[from.len()..]), entry);
+        }
+        Ok(())
+    }
+
+    fn file_mut(&mut self, path: &str) -> Result<&mut Vec<u8>, i32> {
+        self.check_parent(path)?;
+        match self.tree.get_mut(path) {
+            None => Err(libc::ENOENT),
+            Some(None) => Err(libc::EISDIR),
+            Some(Some(content)) => Ok(content),
+        }
+    }
+
+    fn check_parent(&self, path: &str) -> Result<(), i32> {
+        let mut at = String::new();
+        let mut names = path.split('/').peekable();
+        while let Some(name) = names.next() {
+            if names.peek().is_none() {
+                break;
+            }
+            if !at.is_empty() {
+                at.push('/');
+            }
+            at.push_str(name);
+            match self.tree.get(&at) {
+                None => return Err(libc::ENOENT),
+                Some(Some(_)) => return Err(libc::ENOTDIR),
+                Some(None) => {}
+            }
+        }
+        Ok(())
+    }
+
+    fn has_children(&self, path: &str) -> bool {
+        self.tree.keys().any(|other| is_below(other, path))
+    }
+
+    pub(crate) fn files(&self) -> Vec<&String> {
+        self.tree
+            .iter()
+            .filter(|(_, entry)| entry.is_some())
+            .map(|(path, _)| path)
+            .collect()
+    }
+
+    /// Folders, the client's own root (`""`) first.
+    fn dirs(&self) -> Vec<String> {
+        std::iter::once(String::new())
+            .chain(
+                self.tree
+                    .iter()
+                    .filter(|(_, entry)| entry.is_none())
+                    .map(|(path, _)| path.clone()),
+            )
+            .collect()
+    }
+
+    /// A random op, mostly one that should succeed.
+    pub(crate) fn next_op(&self, rng: &mut Rng) -> FsOp {
+        let dirs = self.dirs();
+        let files = self.files();
+        let in_dir = |rng: &mut Rng, names: &[&str]| {
+            let parent = rng.pick(&dirs).expect("the root is always there");
+            join(parent, rng.pick(names).expect("names"))
+        };
+        let a_file = |rng: &mut Rng| rng.pick(&files).map(|path| (*path).clone());
+        let roll = rng.below(100);
+        let op = match roll {
+            0..30 => Some(FsOp::Create {
+                path: in_dir(rng, &FILE_NAMES),
+                data: data(rng),
+            }),
+            30..45 => a_file(rng).map(|path| {
+                let len = self.content(&path).map_or(0, Vec::len) as u64;
+                FsOp::Write {
+                    offset: rng.below(len + 8),
+                    path,
+                    data: data(rng),
+                }
+            }),
+            45..50 => a_file(rng).map(|path| FsOp::Truncate {
+                len: rng.below(32),
+                path,
+            }),
+            50..60 => Some(FsOp::Mkdir {
+                path: in_dir(rng, &DIR_NAMES),
+            }),
+            // A rename in place, over another file as often as not.
+            60..72 => a_file(rng).map(|from| FsOp::Rename {
+                to: join(parent_of(&from), rng.pick(&FILE_NAMES).expect("names")),
+                from,
+            }),
+            // A move to another folder, renamed or not.
+            72..82 => a_file(rng).map(|from| {
+                let name = if rng.chance(0.5) {
+                    name_of(&from)
+                } else {
+                    rng.pick(&FILE_NAMES).expect("names")
+                };
+                let parent = rng.pick(&dirs).expect("the root is always there");
+                FsOp::Rename {
+                    to: join(parent, name),
+                    from,
+                }
+            }),
+            // A folder renamed or moved, with what is in it.
+            82..86 => {
+                let from = rng.pick(&dirs[1..]).cloned();
+                from.map(|from| FsOp::Rename {
+                    to: in_dir(rng, &DIR_NAMES),
+                    from,
+                })
+            }
+            86..94 => a_file(rng).map(|path| FsOp::Unlink { path }),
+            94..97 => a_file(rng).map(|path| FsOp::UnlinkOpen {
+                path,
+                data: data(rng),
+            }),
+            _ => rng
+                .pick(&dirs[1..])
+                .cloned()
+                .map(|path| FsOp::Rmdir { path }),
+        };
+        op.unwrap_or_else(|| FsOp::Create {
+            path: in_dir(rng, &FILE_NAMES),
+            data: data(rng),
+        })
+    }
+}
+
+/// Content for a write: short and recognisable, now and then empty.
+pub(crate) fn data(rng: &mut Rng) -> Vec<u8> {
+    let len = if rng.chance(0.1) {
+        0
+    } else {
+        rng.between(1, 48)
+    };
+    let tag = rng.next_u64();
+    (0..len).map(|i| b'a' + ((tag + i) % 26) as u8).collect()
+}
+
+pub(crate) fn join(parent: &str, name: &str) -> String {
+    if parent.is_empty() {
+        name.to_owned()
+    } else {
+        format!("{parent}/{name}")
+    }
+}
+
+pub(crate) fn parent_of(path: &str) -> &str {
+    path.rsplit_once('/').map_or("", |(parent, _)| parent)
+}
+
+pub(crate) fn name_of(path: &str) -> &str {
+    path.rsplit_once('/').map_or(path, |(_, name)| name)
+}
+
+fn is_below(path: &str, ancestor: &str) -> bool {
+    path.len() > ancestor.len() + 1
+        && path.starts_with(ancestor)
+        && path.as_bytes()[ancestor.len()] == b'/'
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn create(path: &str, data: &[u8]) -> FsOp {
+        FsOp::Create {
+            path: path.into(),
+            data: data.to_vec(),
+        }
+    }
+
+    #[test]
+    fn a_rename_over_a_file_replaces_it_and_a_folder_moves_with_its_contents() {
+        let mut model = Model::default();
+        model.apply(&FsOp::Mkdir { path: "x".into() }).unwrap();
+        model.apply(&create("x/a", b"1")).unwrap();
+        model.apply(&create("b", b"2")).unwrap();
+        model
+            .apply(&FsOp::Rename {
+                from: "b".into(),
+                to: "x/a".into(),
+            })
+            .unwrap();
+        assert_eq!(model.content("x/a"), Some(&b"2".to_vec()));
+        model
+            .apply(&FsOp::Rename {
+                from: "x".into(),
+                to: "y".into(),
+            })
+            .unwrap();
+        assert_eq!(model.tree().keys().collect::<Vec<_>>(), vec!["y", "y/a"]);
+    }
+
+    #[test]
+    fn calls_fail_the_way_posix_says() {
+        let mut model = Model::default();
+        model.apply(&FsOp::Mkdir { path: "x".into() }).unwrap();
+        model.apply(&create("x/a", b"1")).unwrap();
+        assert_eq!(
+            model.apply(&FsOp::Mkdir { path: "x".into() }),
+            Err(libc::EEXIST)
+        );
+        assert_eq!(model.apply(&create("x", b"")), Err(libc::EISDIR));
+        assert_eq!(model.apply(&create("x/a/b", b"")), Err(libc::ENOTDIR));
+        assert_eq!(model.apply(&create("q/a", b"")), Err(libc::ENOENT));
+        assert_eq!(
+            model.apply(&FsOp::Rmdir { path: "x".into() }),
+            Err(libc::ENOTEMPTY)
+        );
+        assert_eq!(
+            model.apply(&FsOp::Unlink { path: "x".into() }),
+            Err(libc::EISDIR)
+        );
+        let into_itself = FsOp::Rename {
+            from: "x".into(),
+            to: "x/y".into(),
+        };
+        assert_eq!(model.apply(&into_itself), Err(libc::EINVAL));
+    }
+
+    #[test]
+    fn a_write_past_the_end_leaves_a_hole() {
+        let mut model = Model::default();
+        model.apply(&create("a", b"ab")).unwrap();
+        let write = FsOp::Write {
+            path: "a".into(),
+            offset: 4,
+            data: b"z".to_vec(),
+        };
+        model.apply(&write).unwrap();
+        assert_eq!(model.content("a"), Some(&b"ab\0\0z".to_vec()));
+        let nothing = FsOp::Write {
+            path: "a".into(),
+            offset: 9,
+            data: Vec::new(),
+        };
+        model.apply(&nothing).unwrap();
+        assert_eq!(model.content("a"), Some(&b"ab\0\0z".to_vec()));
+    }
+
+    #[test]
+    fn generated_ops_mostly_succeed() {
+        let mut rng = Rng::new(9);
+        let mut model = Model::default();
+        let ok = (0..500)
+            .filter(|_| {
+                let op = model.next_op(&mut rng);
+                model.apply(&op).is_ok()
+            })
+            .count();
+        assert!(ok > 350, "{ok} of 500 succeeded");
+    }
+}

crates/pdfs-fuse/src/sim/rng.rs

@@ -0,0 +1,79 @@
+//! A small seeded random number generator, so a failing simulation is a seed
+//! that can be replayed. SplitMix64: fast, good enough for choosing operations
+//! and faults, and no dependency.
+
+#[derive(Clone, Debug)]
+pub(crate) struct Rng(u64);
+
+impl Rng {
+    pub(crate) fn new(seed: u64) -> Self {
+        Self(seed)
+    }
+
+    pub(crate) fn next_u64(&mut self) -> u64 {
+        self.0 = self.0.wrapping_add(0x9E37_79B9_7F4A_7C15);
+        let mut z = self.0;
+        z = (z ^ (z >> 30)).wrapping_mul(0xBF58_476D_1CE4_E5B9);
+        z = (z ^ (z >> 27)).wrapping_mul(0x94D0_49BB_1331_11EB);
+        z ^ (z >> 31)
+    }
+
+    /// A value in `0..n`; `0` when `n` is `0`.
+    pub(crate) fn below(&mut self, n: u64) -> u64 {
+        if n == 0 { 0 } else { self.next_u64() % n }
+    }
+
+    /// A value in `lo..=hi`.
+    pub(crate) fn between(&mut self, lo: u64, hi: u64) -> u64 {
+        lo + self.below(hi.saturating_sub(lo) + 1)
+    }
+
+    /// True with probability `p`.
+    pub(crate) fn chance(&mut self, p: f64) -> bool {
+        p > 0.0 && (self.next_u64() >> 11) as f64 / (1u64 << 53) as f64 <= p
+    }
+
+    pub(crate) fn pick<'a, T>(&mut self, items: &'a [T]) -> Option<&'a T> {
+        items.get(self.below(items.len() as u64) as usize)
+    }
+
+    /// A child generator, so one consumer's draws do not shift another's.
+    pub(crate) fn fork(&mut self) -> Self {
+        Self::new(self.next_u64())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::Rng;
+
+    #[test]
+    fn a_seed_replays_the_same_sequence() {
+        let (mut a, mut b) = (Rng::new(7), Rng::new(7));
+        for _ in 0..100 {
+            assert_eq!(a.next_u64(), b.next_u64());
+        }
+        assert_ne!(Rng::new(7).next_u64(), Rng::new(8).next_u64());
+    }
+
+    #[test]
+    fn bounded_draws_stay_in_range() {
+        let mut rng = Rng::new(1);
+        for _ in 0..1000 {
+            assert!(rng.below(5) < 5);
+            assert!((3..=9).contains(&rng.between(3, 9)));
+        }
+        assert_eq!(rng.below(0), 0);
+        assert!(!rng.chance(0.0));
+        assert!(rng.chance(1.0));
+        assert!([1, 2, 3].contains(rng.pick(&[1, 2, 3]).unwrap()));
+        assert_eq!(rng.pick::<u8>(&[]), None);
+    }
+
+    #[test]
+    fn a_fork_draws_apart_from_its_parent() {
+        let mut parent = Rng::new(3);
+        let mut child = parent.fork();
+        assert_ne!(parent.next_u64(), child.next_u64());
+    }
+}

crates/pdfs-fuse/src/sim/run.rs

@@ -0,0 +1,766 @@
+//! The simulation runs described in `docs/TESTING.md`.
+//!
+//! A run starts one or more daemons on a shared [`FakeDrive`], each owning a
+//! folder `c<n>` that only it writes, so there is one writer per file. A seed
+//! draws a sequence of steps: syscalls through a client's mount, the link of a
+//! client going down or up, a client restarting, a pause, a settle (every
+//! queue must drain within a budget), or a file deleted while the drain holds
+//! a write to it. Every syscall is checked against the
+//! client's [`Model`] as it happens. After the sequence every link comes up
+//! and the run checks:
+//!
+//! 1. **No loss** and **POSIX**: Drive's copy of each client's folder is what
+//!    its model says.
+//! 2. **No false conflicts**: no conflict copy anywhere, and the drain never
+//!    takes a client's own delete for another device's.
+//! 3. **Convergence**: each mount shows Drive's tree.
+//! 4. **Liveness**: no syscall took longer than its budget, settles drained in
+//!    theirs, and every queue drained once the links were up. A call that
+//!    never returns is caught by the [`Watchdog`], which keeps the stacks.
+//!
+//! A restart here is a stop and a start: the next run finds what the last
+//! one wrote down, but in-flight work is let finish rather than cut. A kill
+//! at an arbitrary point needs the daemon in a process of its own.
+//!
+//! Any of these fails the seed. No open bug is tolerated: the matchers that
+//! counted the ones still open instead (B125 to B134) went once a run on
+//! 812eb3d passed every profile without them.
+//!
+//! The runs are ignored by default because they mount FUSE; run them with
+//! `cargo test -p pdfs-fuse --lib sim::run -- --ignored --test-threads=1`.
+//! `PDFS_SIM_SEEDS=n` sets how many seeds each runs, `PDFS_SIM_SEED=s` replays
+//! one, and `RUST_LOG=pdfs_fuse=debug` with `--nocapture` shows the daemons'
+//! logs.
+
+use std::fs::OpenOptions;
+use std::io::{self, Read, Seek, SeekFrom, Write};
+use std::path::{Path, PathBuf};
+use std::time::{Duration, Instant};
+
+use super::daemon::{Daemon, scratch, take_logged, wait_until};
+use super::fake_drive::{Entry, FakeDrive, Faults};
+use super::model::{FsOp, Model, Tree, data, join};
+use super::rng::Rng;
+use super::watchdog::Watchdog;
+
+/// What a run looks like.
+pub(crate) struct Profile {
+    pub(crate) name: &'static str,
+    pub(crate) clients: usize,
+    pub(crate) steps: usize,
+    pub(crate) faults: fn() -> Faults,
+    /// Whether links go down and come back during the sequence.
+    pub(crate) link_flaps: bool,
+    pub(crate) restarts: bool,
+    /// Whether files are deleted while the drain holds a write to them.
+    pub(crate) deletes_mid_upload: bool,
+    /// How long a settle may take; `None` leaves settles out.
+    pub(crate) settle_budget: Option<Duration>,
+    /// How long one syscall may take.
+    pub(crate) syscall_budget: Duration,
+    /// How long the queues may take to drain at the end.
+    pub(crate) drain_budget: Duration,
+}
+
+/// How long the mounts may take to show Drive's tree at the end: one event
+/// poll (`POLL_INTERVAL`) and change.
+const CONVERGE_BUDGET: Duration = Duration::from_secs(30);
+
+/// How long the drain may take to pick up a write: its debounce, and then
+/// some.
+const PICKUP_BUDGET: Duration = Duration::from_secs(8);
+
+/// Steps shown before a failure. All of them are written to `steps.log` in
+/// the state the failure keeps.
+const LOG_TAIL: usize = 40;
+
+/// How long past its own budget a step, or the checks after the last one, may
+/// run before the watchdog takes it for hung. Longer than a restart may wait
+/// for the last run and the mount.
+const STALL: Duration = Duration::from_secs(120);
+
+struct Client {
+    daemon: Option<Daemon>,
+    model: Model,
+    online: bool,
+}
+
+impl Client {
+    fn daemon(&self) -> &Daemon {
+        self.daemon
+            .as_ref()
+            .expect("a client always has a daemon between steps")
+    }
+
+    fn root(&self, index: usize) -> PathBuf {
+        self.daemon().mountpoint.join(owned_folder(index))
+    }
+}
+
+struct Run {
+    seed: u64,
+    profile: &'static Profile,
+    drive: std::sync::Arc<FakeDrive>,
+    clients: Vec<Client>,
+    log: Vec<String>,
+    started: Instant,
+    /// What the daemons logged at `INFO` and above so far.
+    logged: Vec<String>,
+    watchdog: Watchdog,
+}
+
+/// Run `profile` on `seed`. It answers a report of what went wrong, if
+/// anything did.
+pub(crate) fn run(seed: u64, profile: &'static Profile) -> Result<(), String> {
+    let dir = scratch(&format!("{}-{seed}", profile.name));
+    let mut rng = Rng::new(seed);
+    let drive = FakeDrive::new();
+    let mut run = Run {
+        seed,
+        profile,
+        drive: drive.clone(),
+        clients: Vec::new(),
+        log: Vec::new(),
+        started: Instant::now(),
+        logged: Vec::new(),
+        watchdog: Watchdog::new(&dir),
+    };
+    let outcome = run.execute(&dir, &mut rng);
+    run.watchdog.stop();
+    // A hang is what failed, whatever the aborted call answered.
+    let outcome = match run.watchdog.fired() {
+        Some(hung) => Err(format!("liveness: {}", hung.what)),
+        None => outcome,
+    };
+    for client in &mut run.clients {
+        if let Some(daemon) = client.daemon.take() {
+            let _ = daemon.stop();
+        }
+    }
+    match outcome {
+        Ok(()) => {
+            let _ = std::fs::remove_dir_all(&dir);
+            Ok(())
+        }
+        Err(failure) => Err(run.report(&failure, &dir)),
+    }
+}
+
+impl Run {
+    fn execute(&mut self, dir: &Path, rng: &mut Rng) -> Result<(), String> {
+        for index in 0..self.profile.clients {
+            let client = self.drive.client(rng.next_u64(), (self.profile.faults)());
+            let daemon = Daemon::start(&dir.join(format!("client{index}")), client)
+                .map_err(|error| format!("client {index} did not mount: {error}"))?;
+            let folder = daemon.mountpoint.join(owned_folder(index));
+            std::fs::create_dir(&folder)
+                .map_err(|error| format!("client {index}: mkdir {}: {error}", folder.display()))?;
+            self.clients.push(Client {
+                daemon: Some(daemon),
+                model: Model::default(),
+                online: true,
+            });
+        }
+        for step in 0..self.profile.steps {
+            let _watching = self.watchdog.arm(self.step_limit(), format!("step {step}"));
+            self.step(rng)?;
+        }
+        let _watching = self.watchdog.arm(
+            self.profile.drain_budget + STALL,
+            "the checks after the last step",
+        );
+        self.finish()
+    }
+
+    /// How long a step may run before the watchdog takes it for hung.
+    fn step_limit(&self) -> Duration {
+        let budget = self.profile.settle_budget.unwrap_or_default();
+        budget.max(self.profile.syscall_budget) + STALL
+    }
+
+    fn step(&mut self, rng: &mut Rng) -> Result<(), String> {
+        let index = rng.below(self.clients.len() as u64) as usize;
+        let roll = rng.below(100);
+        match roll {
+            0..4 if self.profile.link_flaps => {
+                let client = &mut self.clients[index];
+                client.online = !client.online;
+                client.daemon().client.set_online(client.online);
+                let state = if client.online { "up" } else { "down" };
+                self.note(format!("client {index}: link {state}"));
+            }
+            4..6 if self.profile.restarts => {
+                self.note(format!("client {index}: restart"));
+                let daemon = self.clients[index].daemon.take().expect("daemon");
+                let daemon = daemon
+                    .restart()
+                    .map_err(|error| format!("client {index} did not come back: {error}"))?;
+                self.clients[index].daemon = Some(daemon);
+            }
+            6..12 => {
+                let ms = rng.below(400);
+                self.note(format!("pause {ms} ms"));
+                std::thread::sleep(Duration::from_millis(ms));
+            }
+            12..15 => {
+                if let Some(budget) = self.profile.settle_budget
+                    && self.clients.iter().all(|client| client.online)
+                {
+                    self.settle(budget)?;
+                }
+            }
+            15..25 if self.profile.deletes_mid_upload => self.delete_mid_upload(index, rng)?,
+            _ => {
+                let op = self.clients[index].model.next_op(rng);
+                self.syscall(index, op)?;
+            }
+        }
+        Ok(())
+    }
+
+    /// Wait until every queue is empty and Drive holds what the models say.
+    fn settle(&mut self, budget: Duration) -> Result<(), String> {
+        self.note("settle".into());
+        let start = Instant::now();
+        // What the drain logs meanwhile is what explains a known bug's damage.
+        if !wait_until(budget, || {
+            self.logged.extend(take_logged());
+            self.landed()
+        }) {
+            return Err(format!(
+                "liveness: the queues did not drain within {budget:?}\n{}",
+                self.difference()
+            ));
+        }
+        self.note(format!("settled in {:?}", start.elapsed()));
+        Ok(())
+    }
+
+    /// Write a file Drive holds and delete it once the drain has picked the
+    /// write up. The drain's read of the node is held until the delete has
+    /// landed and a read shows it, so the drain finds the file trashed while
+    /// it holds a write that is no longer queued (B105). Half the time the
+    /// file is made again meanwhile, which queues a write under the op id the
+    /// delete freed (B133).
+    fn delete_mid_upload(&mut self, index: usize, rng: &mut Rng) -> Result<(), String> {
+        let file = rng
+            .pick(&self.clients[index].model.files())
+            .map(|path| (*path).clone());
+        let (Some(path), Some(budget), true) = (
+            file,
+            self.profile.settle_budget,
+            self.clients.iter().all(|client| client.online),
+        ) else {
+            let op = self.clients[index].model.next_op(rng);
+            return self.syscall(index, op);
+        };
+        self.settle(budget)?;
+        let Some(uid) = self.drive.lookup(&join(&owned_folder(index), &path)) else {
+            return Err(format!(
+                "no loss: client {index}'s {path} is not on Drive after a settle"
+            ));
+        };
+        let held = self.clients[index].daemon().client.hold_next_read(&uid);
+        self.note(format!("client {index}: hold the next read of {path}"));
+        let mut bytes = data(rng);
+        bytes.push(b'.');
+        self.syscall(
+            index,
+            FsOp::Write {
+                path: path.clone(),
+                offset: 0,
+                data: bytes,
+            },
+        )?;
+        if !wait_until(PICKUP_BUDGET, || held.reached()) {
+            self.note(format!("client {index}: nothing read {path} back"));
+            return Ok(());
+        }
+        self.syscall(index, FsOp::Unlink { path: path.clone() })?;
+        if rng.chance(0.5) {
+            self.syscall(
+                index,
+                FsOp::Create {
+                    path: path.clone(),
+                    data: data(rng),
+                },
+            )?;
+        }
+        let faults = (self.profile.faults)();
+        let latency = Duration::from_millis(faults.latency_ms.1);
+        std::thread::sleep(faults.listing_lag + latency);
+        drop(held);
+        self.note(format!("client {index}: the read of {path} goes on"));
+        // Nothing else is queued before the drain has answered.
+        std::thread::sleep(2 * latency + Duration::from_millis(50));
+        Ok(())
+    }
+
+    fn syscall(&mut self, index: usize, op: FsOp) -> Result<(), String> {
+        let client = &mut self.clients[index];
+        let root = client.root(index);
+        let before = client.model.content(target(&op)).cloned();
+        let expected = client.model.apply(&op);
+        self.logged.extend(take_logged());
+        let start = Instant::now();
+        let actual = perform(&root, &op, before.as_deref());
+        let took = start.elapsed();
+        self.note(format!(
+            "client {index}: {} = {} in {took:?}",
+            op.describe(),
+            outcome(&actual)
+        ));
+        let actual = actual?;
+        self.logged.extend(take_logged());
+        if actual != expected {
+            return Err(format!(
+                "posix: client {index}: {} answered {}, expected {}",
+                op.describe(),
+                errno(actual),
+                errno(expected)
+            ));
+        }
+        if took > self.profile.syscall_budget {
+            return Err(format!(
+                "liveness: client {index}: {} took {took:?}, over {:?}",
+                op.describe(),
+                self.profile.syscall_budget
+            ));
+        }
+        Ok(())
+    }
+
+    fn finish(&mut self) -> Result<(), String> {
+        for client in &mut self.clients {
+            client.online = true;
+            client.daemon().client.set_online(true);
+        }
+        self.note("every link up; waiting for the queues".into());
+        if !wait_until(self.profile.drain_budget, || {
+            self.logged.extend(take_logged());
+            self.landed()
+        }) {
+            return Err(format!(
+                "no loss: Drive does not hold what the clients wrote, {:?} after the links came up\n{}",
+                self.profile.drain_budget,
+                self.difference()
+            ));
+        }
+        // Each client's folder is its own, so a file of it gone from Drive was
+        // deleted by the client.
+        if let Some(line) = self.logged.iter().find(|line| is_own_delete_kept(line)) {
+            return Err(format!(
+                "no false conflicts: the drain took a client's own delete for another device's: {line}"
+            ));
+        }
+        let drive = self.drive_tree();
+        let conflicts: Vec<String> = drive
+            .into_keys()
+            .filter(|path| is_conflict_copy(path))
+            .collect();
+        if !conflicts.is_empty() {
+            return Err(format!("no false conflicts: {conflicts:?}"));
+        }
+        for index in 0..self.clients.len() {
+            let mut last = Tree::new();
+            let converged = wait_until(CONVERGE_BUDGET, || {
+                last = read_tree(&self.clients[index].daemon().mountpoint);
+                last == self.drive_tree()
+            });
+            if !converged {
+                return Err(format!(
+                    "convergence: client {index}'s mount differs from Drive\n{}",
+                    diff(&last, &self.drive_tree(), "mount", "Drive")
+                ));
+            }
+        }
+        Ok(())
+    }
+
+    /// Whether every client's queue is empty and Drive holds what its model
+    /// says.
+    fn landed(&self) -> bool {
+        let drive = self.drive_tree();
+        self.clients.iter().enumerate().all(|(index, client)| {
+            client
+                .daemon()
+                .pending()
+                .is_ok_and(|items| items.is_empty())
+                && subtree(&drive, &owned_folder(index)) == *client.model.tree()
+        })
+    }
+
+    fn difference(&self) -> String {
+        let drive = self.drive_tree();
+        let mut out = String::new();
+        for (index, client) in self.clients.iter().enumerate() {
+            let pending = client.daemon().pending().unwrap_or_default();
+            for item in pending {
+                out.push_str(&format!(
+                    "  client {index} still owes: {} {} (attempts {}, last error {:?})\n",
+                    item.kind, item.path, item.attempts, item.last_error
+                ));
+            }
+            out.push_str(&diff(
+                client.model.tree(),
+                &subtree(&drive, &owned_folder(index)),
+                &format!("client {index}'s model"),
+                "Drive",
+            ));
+        }
+        out
+    }
+
+    fn drive_tree(&self) -> Tree {
+        self.drive
+            .tree()
+            .into_iter()
+            .map(|(path, entry)| {
+                let content = match entry {
+                    Entry::Folder => None,
+                    Entry::File(content) => Some(content.as_ref().clone()),
+                };
+                (path, content)
+            })
+            .collect()
+    }
+
+    fn note(&mut self, line: String) {
+        let line = format!("{:>8.3}s {line}", self.started.elapsed().as_secs_f64());
+        self.log.push(line);
+    }
+
+    fn report(&self, failure: &str, dir: &Path) -> String {
+        let _ = std::fs::write(dir.join("steps.log"), self.log.join("\n") + "\n");
+        let tail = &self.log[self.log.len().saturating_sub(LOG_TAIL)..];
+        format!(
+            "{} seed {} failed: {failure}\nreplay with PDFS_SIM_SEED={}; state kept in {}\nlast steps:\n{}",
+            self.profile.name,
+            self.seed,
+            self.seed,
+            dir.display(),
+            tail.join("\n")
+        )
+    }
+}
+
+/// Make `op` under `root`. The outer error is a check that failed on the
+/// way (the content an open file reads back), the inner one the errno.
+fn perform(root: &Path, op: &FsOp, before: Option<&[u8]>) -> Result<Result<(), i32>, String> {
+    let at = |path: &str| root.join(path);
+    let result: io::Result<()> = match op {
+        FsOp::Create { path, data } => std::fs::write(at(path), data),
+        FsOp::Write { path, offset, data } => OpenOptions::new()
+            .write(true)
+            .open(at(path))
+            .and_then(|mut file| {
+                file.seek(SeekFrom::Start(*offset))?;
+                file.write_all(data)
+            }),
+        FsOp::Truncate { path, len } => OpenOptions::new()
+            .write(true)
+            .open(at(path))
+            .and_then(|file| file.set_len(*len)),
+        FsOp::Mkdir { path } => std::fs::create_dir(at(path)),
+        FsOp::Rename { from, to } => std::fs::rename(at(from), at(to)),
+        FsOp::Unlink { path } => std::fs::remove_file(at(path)),
+        FsOp::Rmdir { path } => std::fs::remove_dir(at(path)),
+        FsOp::UnlinkOpen { path, data } => {
+            let mut read = Vec::new();
+            let result = OpenOptions::new()
+                .read(true)
+                .write(true)
+                .open(at(path))
+                .and_then(|mut file| {
+                    std::fs::remove_file(at(path))?;
+                    file.seek(SeekFrom::End(0))?;
+                    file.write_all(data)?;
+                    file.seek(SeekFrom::Start(0))?;
+                    file.read_to_end(&mut read).map(|_| ())
+                });
+            if result.is_ok() {
+                let expected = [before.unwrap_or_default(), data].concat();
+                if read != expected {
+                    return Err(format!(
+                        "posix: {} read back {:?}, expected {:?}",
+                        op.describe(),
+                        String::from_utf8_lossy(&read),
+                        String::from_utf8_lossy(&expected)
+                    ));
+                }
+            }
+            result
+        }
+    };
+    Ok(result.map_err(|error| error.raw_os_error().unwrap_or(libc::EIO)))
+}
+
+fn target(op: &FsOp) -> &str {
+    match op {
+        FsOp::Create { path, .. }
+        | FsOp::Write { path, .. }
+        | FsOp::Truncate { path, .. }
+        | FsOp::Mkdir { path }
+        | FsOp::Unlink { path }
+        | FsOp::UnlinkOpen { path, .. }
+        | FsOp::Rmdir { path } => path,
+        FsOp::Rename { from, .. } => from,
+    }
+}
+
+/// The tree a mount shows, read through it, without the folders it makes up
+/// that are not on Drive.
+fn read_tree(mountpoint: &Path) -> Tree {
+    fn walk(dir: &Path, prefix: &str, tree: &mut Tree) {
+        let Ok(entries) = std::fs::read_dir(dir) else {
+            return;
+        };
+        for entry in entries.flatten() {
+            let name = entry.file_name().to_string_lossy().into_owned();
+            if prefix.is_empty() && name == crate::r#virtual::SHARED_WITH_ME_BASE {
+                continue;
+            }
+            let path = super::model::join(prefix, &name);
+            if entry.file_type().is_ok_and(|kind| kind.is_dir()) {
+                tree.insert(path.clone(), None);
+                walk(&entry.path(), &path, tree);
+            } else {
+                tree.insert(path, std::fs::read(entry.path()).ok());
+            }
+        }
+    }
+    let mut tree = Tree::new();
+    walk(mountpoint, "", &mut tree);
+    tree
+}
+
+/// The part of `tree` below `folder`, relative to it.
+fn subtree(tree: &Tree, folder: &str) -> Tree {
+    let prefix = format!("{folder}/");
+    tree.iter()
+        .filter_map(|(path, entry)| Some((path.strip_prefix(&prefix)?.to_owned(), entry.clone())))
+        .collect()
+}
+
+fn owned_folder(index: usize) -> String {
+    format!("c{index}")
+}
+
+/// Whether `line` is the drain keeping a queued write as a conflict copy
+/// because Drive no longer holds the file, or holds it in the trash.
+fn is_own_delete_kept(line: &str) -> bool {
+    line.starts_with("queued write conflicts; keeping a conflict copy")
+        && (line.contains(" reason=\"the file was trashed remotely\"")
+            || line.contains(" reason=\"the file no longer exists remotely\""))
+}
+
+fn is_conflict_copy(path: &str) -> bool {
+    path.split('/')
+        .any(|name| name.contains("(sync-conflict") || name.starts_with("recovered-"))
+}
+
+fn diff(left: &Tree, right: &Tree, left_name: &str, right_name: &str) -> String {
+    let show = |entry: &Option<Vec<u8>>| match entry {
+        None => "folder".to_owned(),
+        Some(content) => format!("{:?}", String::from_utf8_lossy(content)),
+    };
+    let mut out = String::new();
+    for (path, entry) in left {
+        match right.get(path) {
+            None => out.push_str(&format!(
+                "  {path}: only in {left_name} ({})\n",
+                show(entry)
+            )),
+            Some(other) if other != entry => out.push_str(&format!(
+                "  {path}: {left_name} has {}, {right_name} has {}\n",
+                show(entry),
+                show(other)
+            )),
+            Some(_) => {}
+        }
+    }
+    for (path, entry) in right {
+        if !left.contains_key(path) {
+            out.push_str(&format!(
+                "  {path}: only in {right_name} ({})\n",
+                show(entry)
+            ));
+        }
+    }
+    out
+}
+
+fn errno(outcome: Result<(), i32>) -> String {
+    match outcome {
+        Ok(()) => "ok".into(),
+        Err(code) => io::Error::from_raw_os_error(code).to_string(),
+    }
+}
+
+fn outcome(actual: &Result<Result<(), i32>, String>) -> String {
+    match actual {
+        Ok(result) => errno(*result),
+        Err(check) => check.clone(),
+    }
+}
+
+/// Run `profile` over the seeds the environment asks for: `PDFS_SIM_SEED`
+/// alone, or `PDFS_SIM_SEEDS` of them (default `default_seeds`) from 1.
+pub(crate) fn run_seeds(profile: &'static Profile, default_seeds: u64) {
+    let seeds: Vec<u64> = match std::env::var("PDFS_SIM_SEED") {
+        Ok(seed) => vec![seed.parse().expect("PDFS_SIM_SEED is a number")],
+        Err(_) => {
+            let count = std::env::var("PDFS_SIM_SEEDS")
+                .ok()
+                .and_then(|count| count.parse().ok())
+                .unwrap_or(default_seeds);
+            (1..=count).collect()
+        }
+    };
+    let failures: Vec<String> = seeds
+        .into_iter()
+        .filter_map(|seed| run(seed, profile).err())
+        .collect();
+    assert!(failures.is_empty(), "\n{}", failures.join("\n\n"));
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    static ONE_CLIENT_LAN: Profile = Profile {
+        name: "one-client-lan",
+        clients: 1,
+        steps: 80,
+        faults: Faults::lan,
+        link_flaps: false,
+        restarts: false,
+        deletes_mid_upload: false,
+        settle_budget: Some(Duration::from_secs(4)),
+        syscall_budget: Duration::from_secs(2),
+        drain_budget: Duration::from_secs(20),
+    };
+
+    static ONE_CLIENT_DELETES: Profile = Profile {
+        name: "one-client-deletes",
+        clients: 1,
+        steps: 30,
+        faults: Faults::lan,
+        link_flaps: false,
+        restarts: false,
+        deletes_mid_upload: true,
+        settle_budget: Some(Duration::from_secs(4)),
+        syscall_budget: Duration::from_secs(2),
+        drain_budget: Duration::from_secs(20),
+    };
+
+    static ONE_CLIENT_ECHOES: Profile = Profile {
+        name: "one-client-echoes",
+        clients: 1,
+        steps: 60,
+        faults: Faults::echoes,
+        link_flaps: false,
+        restarts: false,
+        deletes_mid_upload: false,
+        settle_budget: Some(Duration::from_secs(6)),
+        syscall_budget: Duration::from_secs(2),
+        drain_budget: Duration::from_secs(20),
+    };
+
+    static ONE_CLIENT_FLAKY: Profile = Profile {
+        name: "one-client-flaky",
+        clients: 1,
+        steps: 80,
+        faults: Faults::wifi,
+        link_flaps: true,
+        restarts: true,
+        deletes_mid_upload: false,
+        settle_budget: None,
+        syscall_budget: Duration::from_secs(10),
+        drain_budget: Duration::from_secs(120),
+    };
+
+    /// Wi-Fi's latency, lag and lost replies without the outages: the queue
+    /// has to drain within a settle, not merely by the end.
+    static ONE_CLIENT_WIFI: Profile = Profile {
+        name: "one-client-wifi",
+        clients: 1,
+        steps: 80,
+        faults: Faults::wifi,
+        link_flaps: false,
+        restarts: false,
+        deletes_mid_upload: false,
+        settle_budget: Some(Duration::from_secs(30)),
+        syscall_budget: Duration::from_secs(10),
+        drain_budget: Duration::from_secs(120),
+    };
+
+    static THREE_CLIENTS: Profile = Profile {
+        name: "three-clients",
+        clients: 3,
+        steps: 90,
+        faults: Faults::lan,
+        link_flaps: true,
+        restarts: true,
+        deletes_mid_upload: false,
+        settle_budget: Some(Duration::from_secs(4)),
+        syscall_budget: Duration::from_secs(2),
+        drain_budget: Duration::from_secs(60),
+    };
+
+    #[test]
+    #[ignore = "mounts FUSE: run with `cargo test -p pdfs-fuse --lib sim::run -- --ignored`"]
+    fn one_client_on_a_good_link() {
+        run_seeds(&ONE_CLIENT_LAN, 12);
+    }
+
+    #[test]
+    #[ignore = "mounts FUSE: run with `cargo test -p pdfs-fuse --lib sim::run -- --ignored`"]
+    fn one_client_deleting_files_as_they_upload() {
+        run_seeds(&ONE_CLIENT_DELETES, 3);
+    }
+
+    #[test]
+    #[ignore = "mounts FUSE: run with `cargo test -p pdfs-fuse --lib sim::run -- --ignored`"]
+    fn one_client_with_stale_hashes_and_reordered_echoes() {
+        run_seeds(&ONE_CLIENT_ECHOES, 6);
+    }
+
+    #[test]
+    #[ignore = "mounts FUSE: run with `cargo test -p pdfs-fuse --lib sim::run -- --ignored`"]
+    fn one_client_on_a_flaky_link() {
+        run_seeds(&ONE_CLIENT_FLAKY, 4);
+    }
+
+    #[test]
+    #[ignore = "mounts FUSE: run with `cargo test -p pdfs-fuse --lib sim::run -- --ignored`"]
+    fn one_client_on_a_slow_link() {
+        run_seeds(&ONE_CLIENT_WIFI, 4);
+    }
+
+    #[test]
+    #[ignore = "mounts FUSE: run with `cargo test -p pdfs-fuse --lib sim::run -- --ignored`"]
+    fn three_clients_one_writer_each() {
+        run_seeds(&THREE_CLIENTS, 3);
+    }
+
+    #[test]
+    fn conflict_copies_are_recognised_by_name() {
+        assert!(is_conflict_copy("c0/x/a (sync-conflict 1790000000).txt"));
+        assert!(is_conflict_copy("recovered-XrPUSW5W"));
+        assert!(!is_conflict_copy("c0/x/a.txt"));
+    }
+
+    #[test]
+    fn a_write_kept_because_its_file_is_gone_is_recognised() {
+        let kept = "queued write conflicts; keeping a conflict copy uid=simvol~L10 \
+                    name=\"f.txt\" reason=\"the file was trashed remotely\"";
+        assert!(is_own_delete_kept(kept));
+        assert!(is_own_delete_kept(
+            &kept.replace("was trashed", "no longer exists")
+        ));
+        assert!(!is_own_delete_kept(
+            &kept.replace("the file was trashed remotely", "revision changed")
+        ));
+    }
+}

crates/pdfs-fuse/src/sim/watchdog.rs

@@ -0,0 +1,322 @@
+//! Turns a call through a mount that never returns into a failed seed.
+//!
+//! A deadlock in a daemon leaves the run's own thread blocked in the kernel,
+//! where no budget check is reached, and a CI job then waits for its timeout.
+//! The watchdog runs beside the run. When what it was armed for outlives its
+//! limit, it aborts the FUSE connections of the run's mounts, so the blocked
+//! call fails and the run reports the hang, and writes where every thread was
+//! to `stacks.txt`.
+//!
+//! The stacks are taken in the process: no tracer can stop a thread that
+//! waits on a FUSE request, so `gdb` and `eu-stack` wait as long as the hang.
+//! Each thread is sent [`stack_signal`] and captures its own backtrace in the
+//! handler. A thread in the kernel takes the signal only once it leaves, so
+//! the mounts are aborted after the others have answered, and its backtrace
+//! is the call it was blocked in. Its kernel wait channel is recorded first.
+
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::thread::JoinHandle;
+use std::time::{Duration, Instant};
+
+use parking_lot::Mutex;
+
+use super::daemon::wait_until;
+
+/// How long the threads that are not blocked in the kernel have to answer,
+/// and the blocked ones once the mounts are aborted.
+const ANSWER: Duration = Duration::from_secs(5);
+
+pub(crate) struct Watchdog {
+    shared: Arc<Shared>,
+    thread: Option<JoinHandle<()>>,
+}
+
+struct Shared {
+    /// The run's directory: its mounts are below it, and the stacks go in it.
+    dir: PathBuf,
+    armed: Mutex<Option<Armed>>,
+    /// What hung, once something has.
+    fired: Mutex<Option<Hung>>,
+    stop: AtomicBool,
+}
+
+struct Armed {
+    what: String,
+    limit: Duration,
+    since: Instant,
+}
+
+/// What hung, and where every thread was then.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct Hung {
+    pub(crate) what: String,
+    pub(crate) stacks: String,
+}
+
+/// Disarms the watchdog when dropped.
+pub(crate) struct Watching(Arc<Shared>);
+
+impl Watchdog {
+    pub(crate) fn new(dir: &Path) -> Self {
+        let shared = Arc::new(Shared {
+            dir: dir.to_path_buf(),
+            armed: Mutex::new(None),
+            fired: Mutex::new(None),
+            stop: AtomicBool::new(false),
+        });
+        let thread = {
+            let shared = shared.clone();
+            std::thread::Builder::new()
+                .name("sim-watchdog".into())
+                .spawn(move || watch(&shared))
+                .expect("spawn the simulation watchdog")
+        };
+        Self {
+            shared,
+            thread: Some(thread),
+        }
+    }
+
+    /// Watch `what` until the guard is dropped, and abort the mounts if it is
+    /// still going after `limit`.
+    pub(crate) fn arm(&self, limit: Duration, what: impl Into<String>) -> Watching {
+        *self.shared.armed.lock() = Some(Armed {
+            what: what.into(),
+            limit,
+            since: Instant::now(),
+        });
+        Watching(self.shared.clone())
+    }
+
+    /// What hung, if something did. Call [`Watchdog::stop`] first, or the
+    /// stacks may still be on their way.
+    pub(crate) fn fired(&self) -> Option<Hung> {
+        self.shared.fired.lock().clone()
+    }
+
+    /// Stop watching, once the stacks of a hang that was caught are taken.
+    pub(crate) fn stop(&mut self) {
+        self.shared.stop.store(true, Ordering::Relaxed);
+        if let Some(thread) = self.thread.take() {
+            let _ = thread.join();
+        }
+    }
+}
+
+impl Drop for Watching {
+    fn drop(&mut self) {
+        *self.0.armed.lock() = None;
+    }
+}
+
+impl Drop for Watchdog {
+    fn drop(&mut self) {
+        self.stop();
+    }
+}
+
+fn watch(shared: &Shared) {
+    while !shared.stop.load(Ordering::Relaxed) {
+        std::thread::sleep(Duration::from_millis(200));
+        let hung = shared
+            .armed
+            .lock()
+            .as_ref()
+            .filter(|armed| armed.since.elapsed() > armed.limit)
+            .map(|armed| format!("{} has not returned after {:?}", armed.what, armed.limit));
+        let Some(hung) = hung else { continue };
+        *shared.armed.lock() = None;
+        let path = shared.dir.join("stacks.txt");
+        // Before anything is let go: the run reports the hang, not whatever
+        // the aborted call answers.
+        *shared.fired.lock() = Some(Hung {
+            what: format!("{hung}; the stacks are in {}", path.display()),
+            stacks: String::new(),
+        });
+        let stacks = take_stacks(|| abort_mounts_below(&shared.dir));
+        let what = match std::fs::write(&path, &stacks) {
+            Ok(()) => format!("{hung}; the stacks are in {}", path.display()),
+            Err(error) => format!("{hung}; the stacks could not be kept: {error}"),
+        };
+        *shared.fired.lock() = Some(Hung { what, stacks });
+    }
+}
+
+/// One thread of this process as the kernel sees it.
+struct Task {
+    tid: i32,
+    name: String,
+    /// `D` while it waits in the kernel uninterruptibly.
+    state: String,
+    wchan: String,
+}
+
+/// Where every other thread of this process is, with `release` called once
+/// those not blocked in the kernel have answered.
+fn take_stacks(release: impl FnOnce()) -> String {
+    let own = gettid();
+    let tasks = tasks();
+    STACKS.lock().clear();
+    install_stack_handler();
+    for task in &tasks {
+        if task.tid != own {
+            // SAFETY: tgkill only sends a signal, whose handler is installed.
+            unsafe {
+                libc::syscall(
+                    libc::SYS_tgkill,
+                    std::process::id() as i32,
+                    task.tid,
+                    stack_signal(),
+                )
+            };
+        }
+    }
+    let answered = |blocked: bool| {
+        let stacks = STACKS.lock();
+        tasks
+            .iter()
+            .filter(|task| task.tid != own && (blocked || task.state != "D"))
+            .all(|task| stacks.contains_key(&task.tid))
+    };
+    wait_until(ANSWER, || answered(false));
+    release();
+    wait_until(ANSWER, || answered(true));
+    let stacks = std::mem::take(&mut *STACKS.lock());
+    let mut out = String::new();
+    for task in tasks.iter().filter(|task| task.tid != own) {
+        out.push_str(&format!(
+            "thread {} {:?}, state {}, waiting in {}\n",
+            task.tid, task.name, task.state, task.wchan
+        ));
+        match stacks.get(&task.tid) {
+            Some(stack) => out.push_str(&format!("{stack}\n")),
+            None => out.push_str("  (no answer)\n\n"),
+        }
+    }
+    out
+}
+
+fn tasks() -> Vec<Task> {
+    let Ok(entries) = std::fs::read_dir("/proc/self/task") else {
+        return Vec::new();
+    };
+    let read = |dir: &Path, file: &str| {
+        std::fs::read_to_string(dir.join(file))
+            .unwrap_or_default()
+            .trim()
+            .to_owned()
+    };
+    entries
+        .flatten()
+        .filter_map(|entry| {
+            let tid = entry.file_name().to_str()?.parse().ok()?;
+            let dir = entry.path();
+            // The state follows the name in parentheses, which may hold spaces.
+            let stat = read(&dir, "stat");
+            let state = stat.rsplit_once(") ")?.1.split(' ').next()?.to_owned();
+            Some(Task {
+                tid,
+                name: read(&dir, "comm"),
+                state,
+                wchan: read(&dir, "wchan"),
+            })
+        })
+        .collect()
+}
+
+/// The backtraces the threads captured, by thread id.
+static STACKS: Mutex<BTreeMap<i32, std::backtrace::Backtrace>> = Mutex::new(BTreeMap::new());
+
+/// The signal that asks a thread for its stack: one of the real-time signals
+/// that nothing in the daemon uses.
+fn stack_signal() -> i32 {
+    libc::SIGRTMIN() + 7
+}
+
+fn install_stack_handler() {
+    static INSTALLED: std::sync::Once = std::sync::Once::new();
+    extern "C" fn handler(_: i32) {
+        // Not async-signal-safe: the capture allocates. The process is being
+        // taken down for a hang anyway, and a thread interrupted inside the
+        // allocator only fails to answer.
+        let stack = std::backtrace::Backtrace::force_capture();
+        STACKS.lock().insert(gettid(), stack);
+    }
+    INSTALLED.call_once(|| {
+        // SAFETY: a zeroed sigaction with a handler and SA_RESTART is valid,
+        // and the handler only touches `STACKS`.
+        unsafe {
+            let mut action: libc::sigaction = std::mem::zeroed();
+            action.sa_sigaction = handler as extern "C" fn(i32) as usize;
+            action.sa_flags = libc::SA_RESTART;
+            libc::sigemptyset(&mut action.sa_mask);
+            libc::sigaction(stack_signal(), &action, std::ptr::null_mut());
+        }
+    });
+}
+
+fn gettid() -> i32 {
+    // SAFETY: gettid has no arguments and cannot fail.
+    unsafe { libc::gettid() }
+}
+
+/// Abort the FUSE connection of every mount below `dir`. Its connection is
+/// named by the mount's device minor, and the mount's owner may abort it.
+fn abort_mounts_below(dir: &Path) {
+    let Ok(mountinfo) = std::fs::read_to_string("/proc/self/mountinfo") else {
+        return;
+    };
+    for line in mountinfo.lines() {
+        let fields: Vec<&str> = line.split(' ').collect();
+        let (Some(device), Some(mountpoint)) = (fields.get(2), fields.get(4)) else {
+            continue;
+        };
+        if !Path::new(mountpoint).starts_with(dir) {
+            continue;
+        }
+        if let Some((_, minor)) = device.split_once(':') {
+            let _ = std::fs::write(format!("/sys/fs/fuse/connections/{minor}/abort"), "1");
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::sim::daemon::scratch;
+
+    #[test]
+    #[ignore = "signals every thread of the test process: run with `cargo test -p pdfs-fuse sim:: -- --ignored`"]
+    fn a_call_past_its_limit_is_reported_with_the_stacks() {
+        let dir = scratch("watchdog");
+        let mut watchdog = Watchdog::new(&dir);
+        {
+            let _watching = watchdog.arm(Duration::from_millis(100), "a nap");
+            std::thread::sleep(Duration::from_secs(1));
+        }
+        watchdog.stop();
+        let hung = watchdog.fired().expect("the watchdog fired");
+        assert!(
+            hung.what.starts_with("a nap has not returned after"),
+            "{hung:?}"
+        );
+        assert!(hung.stacks.contains("a_call_past_its_limit"), "{hung:?}");
+        let kept = std::fs::read_to_string(dir.join("stacks.txt")).unwrap_or_default();
+        assert_eq!(kept, hung.stacks);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn a_call_within_its_limit_is_not() {
+        let dir = scratch("watchdog-quiet");
+        let watchdog = Watchdog::new(&dir);
+        drop(watchdog.arm(Duration::from_millis(100), "a quick call"));
+        std::thread::sleep(Duration::from_millis(500));
+        assert_eq!(watchdog.fired(), None);
+        drop(watchdog);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}

crates/pdfs-fuse/src/state.rs

@@ -129,6 +129,44 @@ pub(crate) struct WriteHandle {
 }
 
 impl WriteHandle {
+    /// A handle on a file `create` just made: an empty base, so everything
+    /// written through it is authored.
+    ///
+    /// The base is `node` as it actually exists — the empty file the server just
+    /// minted, or a queued create's placeholder — never the local clock or a
+    /// blank. `queue_revision` turns it into `StagedWrite::based_on` and the
+    /// drain compares the remote against that. A `now_secs()` mtime differs from
+    /// the server's stamp by the create round-trip. A missing revision id drops
+    /// the check to `(mtime, size)`, and moving or renaming the file advances
+    /// its mtime on the server. Either way the first write to a brand-new file
+    /// lands as a conflict copy of its own empty create (`docs/BUGS.md` B113).
+    pub(crate) fn created(ino: u64, node: &Node, file: File, path: PathBuf) -> Self {
+        Self {
+            ino,
+            uid: node.uid.clone(),
+            file: Arc::new(file),
+            path,
+            written: Intervals::default(),
+            len: 0,
+            base_size: 0,
+            base_mtime: node.modification_time,
+            base_revision_id: crate::node_revision_id(node),
+            dirty: false,
+            open_count: 0,
+        }
+    }
+
+    /// Write over `node` from now on: a revision this daemon has just put on the
+    /// server under the handle, by sealing an upload or by landing the queued
+    /// create the handle was opened on. The base the handle opened over is gone,
+    /// and keeping it would make the drain read our own revision as another
+    /// device's edit.
+    pub(crate) fn rebase_onto(&mut self, node: &Node) {
+        self.base_mtime = node.modification_time;
+        self.base_size = crate::node_size(node);
+        self.base_revision_id = crate::node_revision_id(node);
+    }
+
     /// Account for `[offset, end)` having been written through this handle.
     ///
     /// A write past the end leaves a hole that reads as zeros, exactly like a
@@ -145,7 +183,7 @@ impl WriteHandle {
     }
 }
 
-/// A released write whose upload has not happened yet (offline.md Phase 3).
+/// A released write whose upload has not happened yet.
 ///
 /// The bytes live in the content cache's staging dir and the intent lives in the
 /// `pending_op` table; this pairs them in memory so a read can be served without
@@ -163,8 +201,54 @@ pub(crate) struct PendingRevision {
 /// time so this module stays free of `fuser`.
 pub(crate) type DirListing = Vec<(u64, bool, String)>;
 
+/// Where [`State::next_ino`] starts: far above any local id a database hands
+/// out, so a fallback inode never names a node that has a row.
+pub(crate) const FALLBACK_INO: u64 = 1 << 48;
+
+/// The inode of the node with local id `lid` ([`Db::lids_for`]). One above the
+/// lid, so no node takes [`crate::ROOT_INO`], which each session uses for its
+/// own root. The same in every mount and after a restart.
+pub(crate) fn lid_ino(lid: i64) -> u64 {
+    lid.unsigned_abs() + crate::ROOT_INO
+}
+
+/// The inodes of the stored nodes among `nodes`, from their local ids, for
+/// [`State::intern_batch_with_inos`]. Called before the state lock is taken;
+/// a node that already has a row keeps its id. Empty when the database fails,
+/// which leaves the allocation to the lock holder, as before.
+pub(crate) fn inos_for(db: &Db, nodes: &[Node]) -> HashMap<NodeUid, u64> {
+    let stored: Vec<&Node> = nodes
+        .iter()
+        .filter(|node| !crate::r#virtual::is_virtual_uid(&node.uid))
+        .collect();
+    if stored.is_empty() {
+        return HashMap::new();
+    }
+    match db.lids_for(&stored) {
+        Ok(lids) => stored
+            .iter()
+            .zip(lids)
+            .map(|(node, lid)| (node.uid.clone(), lid_ino(lid)))
+            .collect(),
+        Err(error) => {
+            warn!(%error, "no local ids before the listing; allocating them under the lock");
+            HashMap::new()
+        }
+    }
+}
+
+/// The local id of the node at inode `ino`, the inverse of [`lid_ino`]:
+/// `None` for the root and a fallback inode.
+pub(crate) fn ino_lid(ino: u64) -> Option<i64> {
+    (ino > crate::ROOT_INO && ino < FALLBACK_INO).then(|| (ino - crate::ROOT_INO) as i64)
+}
+
 /// Mutable inode bookkeeping, guarded by a mutex because fuser drives the
 /// `Filesystem` trait through `&self`.
+///
+/// One tree for every mount of the daemon. Each FUSE session sees it from its
+/// own root ([`State::roots`]) and calls that root inode 1; `ProtonFs`
+/// translates at the kernel boundary.
 pub(crate) struct State {
     /// inode -> node metadata.
     pub(crate) entries: HashMap<u64, Entry>,
@@ -173,9 +257,20 @@ pub(crate) struct State {
     /// Cached directory listings: parent inode -> child inodes. Presence of a
     /// key means the directory has been enumerated.
     pub(crate) children: HashMap<u64, Vec<u64>>,
+    /// The inodes some session has been rooted at ([`State::install_root`]).
+    /// A root is its own parent. Kept after its session unmounts: the node is
+    /// still one of ours.
+    pub(crate) roots: HashSet<u64>,
+    /// The next inode for a node the database could not give a local id, from
+    /// a range lids never reach ([`FALLBACK_INO`]).
     pub(crate) next_ino: u64,
     /// Shared write state keyed by inode. Concurrent writers share the scratch file.
     pub(crate) active_writes: HashMap<u64, WriteHandle>,
+    /// Inodes whose last write handle `release` has taken out of
+    /// [`State::active_writes`] and is still queueing. `close(2)` returns
+    /// before that, and in between the edit is in neither the handles nor the
+    /// queue, so a check for changes not on Drive yet looks here too.
+    pub(crate) releasing: HashSet<u64>,
     /// Maps file handle id (fh) to inode (ino). Read-only opens use fh 0 and
     /// have no entry here.
     pub(crate) handles: HashMap<u64, u64>,
@@ -188,13 +283,13 @@ pub(crate) struct State {
     /// two pages shifted every later entry, and the caller silently skipped or
     /// repeated whatever crossed the page boundary. Each entry is
     /// `(ino, is_dir, name)` — the kernel type is mapped at reply time so this
-    /// module stays free of `fuser` (bugs.md B43).
+    /// module stays free of `fuser` (`docs/BUGS.md` B43).
     pub(crate) dir_snapshots: HashMap<u64, Arc<DirListing>>,
     /// Resident inode attributes whose effective access changed during an
     /// intern/root refresh. Core drains this set and notifies the matching
     /// kernel only after releasing the State lock.
     pub(crate) access_changes: HashSet<u64>,
-    /// Persisted shared-root authority, loaded once per inode space and updated
+    /// Persisted shared-root authority, loaded once and updated
     /// on every explicit role/tombstone change. Descendant inheritance reads
     /// this map instead of issuing one SQLite query per interned inode.
     pub(crate) share_access: HashMap<NodeUid, Access>,
@@ -262,15 +357,6 @@ pub(crate) struct StateGuard<'a> {
     db: &'a Arc<Db>,
 }
 
-/// Take a mount's inode lock through a [`StateGuard`], for the loops that walk
-/// every live mount rather than this `Core`'s own.
-pub(crate) fn lock_state<'a>(
-    state: &'a parking_lot::Mutex<State>,
-    db: &'a Arc<Db>,
-) -> StateGuard<'a> {
-    StateGuard::new(state.lock(), db)
-}
-
 impl<'a> StateGuard<'a> {
     pub(crate) fn new(guard: parking_lot::MutexGuard<'a, State>, db: &'a Arc<Db>) -> Self {
         Self {
@@ -311,9 +397,6 @@ impl Drop for StateGuard<'_> {
 impl State {
     /// A fresh, empty inode space over `db`.
     ///
-    /// `next_ino` differs by caller: a real mount hands out [`crate::ROOT_INO`]
-    /// to its root and starts allocating above it, while a bare state under test
-    /// has no root and starts at 1.
     /// Apply the write-throughs this state owes SQLite, here and now.
     ///
     /// Production code never calls this: [`StateGuard`] releases the inode lock
@@ -340,13 +423,17 @@ impl State {
         self.db.clone()
     }
 
-    pub(crate) fn new(db: Arc<Db>, share_access: HashMap<NodeUid, Access>, next_ino: u64) -> Self {
+    /// A fresh, empty tree over `db`. A node's inode comes from its local id
+    /// ([`lid_ino`]).
+    pub(crate) fn new(db: Arc<Db>, share_access: HashMap<NodeUid, Access>) -> Self {
         Self {
             entries: HashMap::new(),
             by_uid: HashMap::new(),
             children: HashMap::new(),
-            next_ino,
+            roots: HashSet::new(),
+            next_ino: FALLBACK_INO,
             active_writes: HashMap::new(),
+            releasing: HashSet::new(),
             handles: HashMap::new(),
             next_fh: 1,
             dir_snapshots: HashMap::new(),
@@ -356,18 +443,55 @@ impl State {
             outbox: Vec::new(),
         }
     }
-    /// Whether `uid` names an owned node currently reachable from this mount's
-    /// root. Resident entries can outlive their dentries for open-handle and
-    /// access-revocation semantics, so `by_uid` membership alone is not proof
-    /// that a control-socket operation may address the node.
-    pub(crate) fn owns_visible_uid(&self, uid: &NodeUid) -> bool {
-        let Some(root) = self.entries.get(&crate::ROOT_INO) else {
-            return false;
-        };
-        if uid.volume_id != root.uid.volume_id {
-            return false;
+    /// Make `root` the root of a session and return its inode, which comes
+    /// from its local id like any other node's.
+    ///
+    /// The root is always owned. It must never be classified as a shared root,
+    /// even when the API returns membership data (which happens when the owner
+    /// shares the folder with someone else), so a stale share row a downgrade
+    /// may have left for it is dropped. A node already in the tree keeps its
+    /// inode and its lookups, and stops naming a parent: a session's `..` at
+    /// its root is the root.
+    pub(crate) fn install_root(&mut self, root: Node) -> u64 {
+        if let Err(e) = self.db.upsert_node(&root) {
+            warn!(uid = %root.uid, error = %e, "db upsert root failed");
         }
+        self.share_access.remove(&root.uid);
+        let _ = self.db.delete_share_access(&root.uid);
+        let ino = match self.by_uid.get(&root.uid) {
+            Some(&ino) => ino,
+            None => self.new_inos(&[&root])[&root.uid],
+        };
+        if let Some(old) = self.entries.get(&ino).map(|e| e.parent)
+            && old != ino
+            && let Some(kids) = self.children.get_mut(&old)
+        {
+            kids.retain(|&k| k != ino);
+        }
+        self.by_uid.insert(root.uid.clone(), ino);
+        let lookup_count = self.entries.get(&ino).map_or(1, |e| e.lookup_count.max(1));
+        self.entries.insert(
+            ino,
+            Entry {
+                uid: root.uid.clone(),
+                parent: ino,
+                node: root,
+                access: Access::Owner,
+                lookup_count,
+                open_count: 0,
+                unlinked: false,
+            },
+        );
+        self.roots.insert(ino);
+        ino
+    }
 
+    /// Whether `uid` names an owned node currently reachable from one of
+    /// `roots`, the roots of the sessions that are mounted. Resident entries
+    /// can outlive their dentries for open-handle and access-revocation
+    /// semantics, so `by_uid` membership alone is not proof that a
+    /// control-socket operation may address the node.
+    pub(crate) fn owns_visible_uid(&self, uid: &NodeUid, roots: &[u64]) -> bool {
         let Some(&target) = self.by_uid.get(uid) else {
             return false;
         };
@@ -380,7 +504,9 @@ impl State {
             let Some(entry) = self.entries.get(&current) else {
                 return false;
             };
-            if entry.uid.volume_id != root.uid.volume_id
+            // The node's root scopes it to its own volume, excluding foreign
+            // shared-with-me residents from uid-addressed sharing.
+            if entry.uid.volume_id != uid.volume_id
                 || entry.unlinked
                 || entry.node.trashed
                 || entry.uid != entry.node.uid
@@ -388,7 +514,7 @@ impl State {
             {
                 return false;
             }
-            if current == crate::ROOT_INO {
+            if roots.contains(&current) {
                 return true;
             }
 
@@ -430,15 +556,17 @@ impl State {
         self.access_changes.drain().collect()
     }
 
-    /// Whether `uid` lives on the volume this mount is rooted in.
+    /// Whether `uid` lives on a volume some mount is rooted in.
     ///
     /// Used to decide how a node with no resolvable parent is classified:
     /// our own volume fails open (it is owned content), a foreign volume
     /// fails closed (it can only be there because of a share).
     pub(crate) fn is_own_volume(&self, uid: &NodeUid) -> bool {
-        self.entries
-            .get(&crate::ROOT_INO)
-            .is_some_and(|root| root.uid.volume_id == uid.volume_id)
+        self.roots.iter().any(|ino| {
+            self.entries
+                .get(ino)
+                .is_some_and(|root| root.uid.volume_id == uid.volume_id)
+        })
     }
 
     fn stored_share_access(&self, uid: &NodeUid) -> Option<Access> {
@@ -787,11 +915,59 @@ impl State {
         }
     }
 
-    pub(crate) fn intern(&mut self, parent: u64, node: Node) -> u64 {
+    /// Write `node` through as it is, in order with the tree's other changes.
+    pub(crate) fn write_through(&mut self, node: Node) {
+        self.outbox.push(DbWrite::Upsert(vec![node]));
+    }
+
+    pub(crate) fn intern(&mut self, parent: u64, mut node: Node) -> u64 {
+        self.keep_revision_mtime(&mut node);
         self.outbox.push(DbWrite::Upsert(vec![node.clone()]));
         self.intern_mem(parent, node)
     }
 
+    /// Keep what is already known of a file whose content has not changed.
+    ///
+    /// Drive stamps a link's `ModifyTime` on a rename or a move as well, while
+    /// POSIX leaves a file's mtime alone there. The content cache is keyed by
+    /// it, too: taking the new stamp made the cached bytes unreachable, so the
+    /// next partial write could not fill its gaps (docs/BUGS.md B123). The
+    /// active revision id says whether the content is still the same, and so
+    /// whether the size and digest a listing left out are still the ones known.
+    fn keep_revision_mtime(&self, node: &mut Node) {
+        let Some(entry) = self
+            .by_uid
+            .get(&node.uid)
+            .and_then(|ino| self.entries.get(ino))
+        else {
+            return;
+        };
+        if let (
+            NodeKind::File {
+                active_revision_id: Some(now),
+                claimed_size,
+                content_sha1,
+                ..
+            },
+            NodeKind::File {
+                active_revision_id: Some(was),
+                claimed_size: size_was,
+                content_sha1: sha1_was,
+                ..
+            },
+        ) = (&mut node.kind, &entry.node.kind)
+            && now == was
+        {
+            node.modification_time = entry.node.modification_time;
+            if claimed_size.is_none() {
+                *claimed_size = *size_was;
+            }
+            if content_sha1.is_none() {
+                content_sha1.clone_from(sha1_was);
+            }
+        }
+    }
+
     /// Allocate (or reuse) a stable inode for a node, updating the hot-cache maps
     /// only. Every caller owes the DB a write-through — see the callers below;
     /// the split exists so a batch can pay for one transaction instead of `n`.
@@ -800,7 +976,19 @@ impl State {
         self.intern_mem_with_access(parent, node, access)
     }
 
-    fn intern_mem_with_access(&mut self, parent: u64, mut node: Node, access: Access) -> u64 {
+    fn intern_mem_with_access(&mut self, parent: u64, node: Node, access: Access) -> u64 {
+        self.intern_mem_at(parent, node, access, None)
+    }
+
+    /// [`State::intern_mem_with_access`], with the inode a new entry takes when
+    /// the caller already has it ([`State::new_inos`]).
+    fn intern_mem_at(
+        &mut self,
+        parent: u64,
+        mut node: Node,
+        access: Access,
+        ino: Option<u64>,
+    ) -> u64 {
         if let Some(&ino) = self.by_uid.get(&node.uid) {
             let changed = self
                 .entries
@@ -819,8 +1007,13 @@ impl State {
             }
             return ino;
         }
-        let ino = self.next_ino;
-        self.next_ino += 1;
+        let ino = match ino {
+            Some(ino) => ino,
+            None => self
+                .new_inos(&[&node])
+                .remove(&node.uid)
+                .unwrap_or_default(),
+        };
         self.by_uid.insert(node.uid.clone(), ino);
         self.entries.insert(
             ino,
@@ -837,6 +1030,41 @@ impl State {
         ino
     }
 
+    /// The inodes for nodes that have no entry yet, from their local ids, in
+    /// one transaction. Should the database fail, they come from
+    /// [`State::next_ino`] instead, so the mount keeps working, with inodes
+    /// that last only this run. So do the inodes of virtual folders, which are
+    /// never stored.
+    fn new_inos(&mut self, nodes: &[&Node]) -> HashMap<NodeUid, u64> {
+        let (virtual_nodes, stored): (Vec<&Node>, Vec<&Node>) = nodes
+            .iter()
+            .partition(|node| crate::r#virtual::is_virtual_uid(&node.uid));
+        let mut inos = match self.db.lids_for(&stored) {
+            Ok(lids) => stored
+                .iter()
+                .zip(lids)
+                .map(|(node, lid)| (node.uid.clone(), lid_ino(lid)))
+                .collect(),
+            Err(error) => {
+                warn!(%error, "no local ids for new inodes; numbering them for this run");
+                self.run_inos(&stored)
+            }
+        };
+        inos.extend(self.run_inos(&virtual_nodes));
+        inos
+    }
+
+    fn run_inos(&mut self, nodes: &[&Node]) -> HashMap<NodeUid, u64> {
+        nodes
+            .iter()
+            .map(|node| {
+                let ino = self.next_ino;
+                self.next_ino += 1;
+                (node.uid.clone(), ino)
+            })
+            .collect()
+    }
+
     /// Decrement lookup count for an inode and prune if lookup_count == 0 && open_count == 0 && unlinked.
     pub(crate) fn forget_lookup(&mut self, ino: u64, nlookup: u64) -> Option<(u64, String)> {
         if let Some(entry) = self.entries.get_mut(&ino) {
@@ -877,14 +1105,51 @@ impl State {
     ///
     /// This is what keeps `ls` on a large folder quick: one commit for the
     /// listing, rather than one autocommit — and one fsync — per child.
+    #[cfg(test)]
     pub(crate) fn intern_batch(&mut self, parent: u64, nodes: Vec<Node>) -> Vec<u64> {
+        self.intern_batch_with_inos(parent, nodes, HashMap::new())
+    }
+
+    /// [`State::intern_batch`], with inodes for new entries that the caller
+    /// allocated before it took the lock, from [`inos_for`]. Allocating them
+    /// is a write transaction, and under the lock every inline handler of
+    /// every mount waited for it (`docs/BUGS.md` B221). A node missing from
+    /// `inos` still gets one here.
+    pub(crate) fn intern_batch_with_inos(
+        &mut self,
+        parent: u64,
+        mut nodes: Vec<Node>,
+        mut inos: HashMap<NodeUid, u64>,
+    ) -> Vec<u64> {
+        for node in &mut nodes {
+            self.keep_revision_mtime(node);
+        }
         self.outbox.push(DbWrite::Upsert(nodes.clone()));
+        let fresh: Vec<&Node> = nodes
+            .iter()
+            .filter(|node| !self.by_uid.contains_key(&node.uid) && !inos.contains_key(&node.uid))
+            .collect();
+        if !fresh.is_empty() {
+            let allocated = self.new_inos(&fresh);
+            inos.extend(allocated);
+        }
         nodes
             .into_iter()
-            .map(|node| self.intern_mem(parent, node))
+            .map(|node| {
+                let access = self.access_for_node(parent, &node);
+                let ino = inos.remove(&node.uid);
+                self.intern_mem_at(parent, node, access, ino)
+            })
             .collect()
     }
 
+    /// Record `uid`'s listing as complete once the lock is released, after the
+    /// rows of its children: written the other way round, a crash between the
+    /// two left a folder marked complete with no children to show.
+    pub(crate) fn record_listed(&mut self, uid: NodeUid) {
+        self.outbox.push(DbWrite::SetListed(uid, true));
+    }
+
     /// Check if a directory inode has any child nodes in memory or in the database.
     pub(crate) fn has_children(&self, parent: u64) -> bool {
         // A resident listing is authoritative even when empty. Falling through
@@ -985,7 +1250,7 @@ impl State {
     /// re-enumerate, which is the cheaper way to stay honest about what the
     /// server did. A queued rename cannot: re-enumerating needs the network, and
     /// the server has not been told yet in any case — so this *is* the tree's
-    /// new truth until the op drains (offline.md Phase 3b).
+    /// new truth until the op drains.
     pub(crate) fn rename_in_place(
         &mut self,
         ino: u64,
@@ -1104,7 +1369,7 @@ impl State {
     /// created offline, nothing at all), so this row is the only record that the
     /// file is as long as the caller was told it is. Without it a restart serves
     /// the stale size and the file reads as truncated — or empty — while its
-    /// bytes sit safely in staging (offline.md Phase 3).
+    /// bytes sit safely in staging.
     /// Returns the node to persist rather than queueing it in the outbox, and is
     /// the one mutation here whose write-through the caller must do itself:
     /// failure has to be reported, not logged. Dropping the row silently means
@@ -1123,6 +1388,13 @@ mod tests {
     use proton_drive_rs::ShareMembership;
     use proton_drive_rs::proton_sdk::ids::{LinkId, ShareId, ShareMembershipId, VolumeId};
 
+    #[test]
+    fn an_inode_gives_back_the_lid_it_was_made_from() {
+        assert_eq!(ino_lid(lid_ino(7)), Some(7));
+        assert_eq!(ino_lid(crate::ROOT_INO), None);
+        assert_eq!(ino_lid(FALLBACK_INO + 3), None);
+    }
+
     fn uid(link: &str) -> NodeUid {
         NodeUid::new(VolumeId::from("vol"), LinkId::from(link))
     }
@@ -1199,7 +1471,7 @@ mod tests {
         let dir = TempDir::new();
         let db = Db::open(&dir.0.join("cache.db")).unwrap();
         let share_access = db.all_share_access().unwrap();
-        let st = State::new(Arc::new(db), share_access, 1);
+        let st = State::new(Arc::new(db), share_access);
         (st, dir)
     }
 
@@ -1217,6 +1489,74 @@ mod tests {
         (st, dir, src, dst)
     }
 
+    /// A node's inode comes from its row's local id, so it is the same in
+    /// every mount, after the hot cache drops it, and after a restart.
+    #[test]
+    fn a_node_keeps_its_inode_across_mounts_evictions_and_restarts() {
+        let (mut st, _dir) = state();
+        let inos = st.intern_batch(
+            0,
+            vec![
+                node("a", "root", "a.txt", false),
+                node("b", "root", "b.txt", false),
+            ],
+        );
+        st.flush_outbox();
+        let db = st.db.clone();
+        assert_ne!(inos[0], inos[1]);
+        assert!(!inos.contains(&crate::ROOT_INO));
+
+        let mut other = State::new(db.clone(), HashMap::new());
+        assert_eq!(other.intern(0, node("b", "root", "b.txt", false)), inos[1]);
+
+        st.forget_mem(&uid("a"));
+        assert_eq!(st.intern(0, node("a", "root", "a.txt", false)), inos[0]);
+
+        let mut restarted = State::new(db, HashMap::new());
+        assert_eq!(
+            restarted.intern_batch(0, vec![node("a", "root", "a.txt", false)]),
+            [inos[0]]
+        );
+    }
+
+    /// A listing's inodes are allocated before the lock is taken, and are the
+    /// ones a node would get under it (`docs/BUGS.md` B221).
+    #[test]
+    fn inodes_allocated_before_the_lock_are_the_ones_the_node_keeps() {
+        let (mut st, _dir) = state();
+        let db = st.db.clone();
+        let listing = vec![
+            node("a", "root", "a.txt", false),
+            node("b", "root", "b.txt", false),
+        ];
+        let early = inos_for(&db, &listing);
+        assert_eq!(early.len(), 2);
+        let inos = st.intern_batch_with_inos(0, listing, early.clone());
+        assert_eq!(inos, [early[&uid("a")], early[&uid("b")]]);
+        st.flush_outbox();
+
+        let mut restarted = State::new(db, HashMap::new());
+        assert_eq!(
+            restarted.intern(0, node("b", "root", "b.txt", false)),
+            early[&uid("b")]
+        );
+    }
+
+    /// The listing is recorded complete with its children's rows, when the
+    /// lock goes, never ahead of them.
+    #[test]
+    fn a_listing_is_recorded_complete_after_its_children() {
+        let (mut st, _dir) = state();
+        let root = st.intern(0, node("root", "none", "root", true));
+        st.flush_outbox();
+        st.intern_batch(root, vec![node("a", "root", "a.txt", false)]);
+        st.record_listed(uid("root"));
+        assert!(st.db.children_if_listed(&uid("root")).unwrap().is_none());
+        st.flush_outbox();
+        let kids = st.db.children_if_listed(&uid("root")).unwrap().unwrap();
+        assert_eq!(kids.len(), 1);
+    }
+
     /// Audit A5. Moving a file out of a folder leaves that folder's DB row
     /// claiming a complete listing, so once the hot cache drops it, remote
     /// changes under it stop being seen. `relocate` has to clear both sides.
@@ -1282,7 +1622,7 @@ mod tests {
         let root = uid("root").to_string();
         let state = parking_lot::Mutex::new(st);
         {
-            let mut guard = lock_state(&state, &db);
+            let mut guard = StateGuard::new(state.lock(), &db);
             guard.intern(0, node("root", "none", "My Files", true));
             assert!(
                 db.node_by_uid(&root).unwrap().is_none(),
@@ -1525,6 +1865,7 @@ mod tests {
             })
             .collect();
         st.next_ino = crate::ROOT_INO + nodes.len() as u64;
+        st.roots.insert(crate::ROOT_INO);
         // Reverse order so entries are inserted before their parents, matching
         // the hydration path's non-topological materialization.
         for (i, node) in nodes.iter().enumerate().rev() {
@@ -1899,6 +2240,51 @@ mod tests {
         assert_eq!(st.entries[&shared].access, Access::Viewer);
     }
 
+    fn at_revision(mut node: Node, revision: &str, mtime: i64) -> Node {
+        node.modification_time = mtime;
+        if let NodeKind::File {
+            active_revision_id, ..
+        } = &mut node.kind
+        {
+            *active_revision_id = Some(revision.into());
+        }
+        node
+    }
+
+    #[test]
+    fn a_renamed_file_keeps_its_mtime_until_its_content_changes() {
+        let (mut st, _dir) = state();
+        let root = st.intern(0, node("root", "none", "My Files", true));
+        let mut file = node("file", "root", "a.txt", false);
+        if let NodeKind::File {
+            claimed_size,
+            total_size_on_storage,
+            ..
+        } = &mut file.kind
+        {
+            *claimed_size = Some(7);
+            *total_size_on_storage = 519;
+        }
+        let ino = st.intern(root, at_revision(file.clone(), "r1", 100));
+        // Drive stamps the link on a rename; the content is still r1.
+        let mut renamed = at_revision(file.clone(), "r1", 160);
+        renamed.name = "b.txt".into();
+        st.intern_batch(root, vec![renamed]);
+        assert_eq!(st.entries[&ino].node.modification_time, 100);
+        assert_eq!(st.entries[&ino].node.name, "b.txt");
+        // A listing that leaves the size out still describes revision r1.
+        let mut bare = at_revision(file.clone(), "r1", 170);
+        assert_eq!(crate::node_size(&st.entries[&ino].node), 7);
+        if let NodeKind::File { claimed_size, .. } = &mut bare.kind {
+            *claimed_size = None;
+        }
+        st.intern(root, bare);
+        assert_eq!(st.entries[&ino].node.modification_time, 100);
+        assert_eq!(crate::node_size(&st.entries[&ino].node), 7);
+        st.intern(root, at_revision(file, "r2", 200));
+        assert_eq!(st.entries[&ino].node.modification_time, 200);
+    }
+
     fn handle(len: u64, base_size: u64) -> WriteHandle {
         let path = std::env::temp_dir().join(format!("pdfs-handle-test-{}", std::process::id()));
         let file = File::create(&path).unwrap();
@@ -1918,6 +2304,27 @@ mod tests {
         }
     }
 
+    /// A file created offline is written while its queued create lands. The
+    /// placeholder had no revision, so the handle takes the empty file the
+    /// create made as its base (docs/BUGS.md B113).
+    #[test]
+    fn a_handle_on_a_placeholder_is_based_on_the_create_that_landed() {
+        let mut h = handle(0, 0);
+        assert_eq!(h.base_revision_id, None);
+        let mut landed = node("real", "root", "f.mkv", false);
+        landed.modification_time = 160;
+        if let NodeKind::File {
+            active_revision_id, ..
+        } = &mut landed.kind
+        {
+            *active_revision_id = Some("empty".into());
+        }
+        h.rebase_onto(&landed);
+        assert_eq!(h.base_mtime, 160);
+        assert_eq!(h.base_size, 0);
+        assert_eq!(h.base_revision_id.as_deref(), Some("empty"));
+    }
+
     #[test]
     fn a_listing_does_not_shrink_a_file_open_for_writing() {
         let (mut st, _dir) = state();

crates/pdfs-fuse/src/sweep.rs

@@ -37,10 +37,12 @@ const CONFLICT_SWEEP_INTERVAL: Duration = Duration::from_secs(300);
 /// fresh mount does at startup (hydrate, recover, initial enumeration).
 const CONFLICT_SWEEP_WARMUP: Duration = Duration::from_secs(30);
 
-/// Strip a ` (sync-conflict <stamp>)` (optionally `-<n>`) marker from `name`,
-/// returning the original file name it was a copy of. `None` when `name` is not a
-/// conflict copy. Inverse of the `conflict_name` / `conflict_path_with_suffix`
-/// formats, so the two halves of the product agree on what a conflict is.
+/// Strip a ` (sync-conflict <label> <stamp>)` (optionally `-<n>`) marker from
+/// `name`, returning the original file name it was a copy of. The label names
+/// the computer that made the copy (B251); copies made before it have the bare
+/// stamp. `None` when `name` is not a conflict copy. Inverse of the
+/// `conflict_name` / `conflict_path_with_suffix` formats, so the two halves of
+/// the product agree on what a conflict is.
 pub(crate) fn conflict_base_name(name: &str) -> Option<String> {
     const MARKER: &str = " (sync-conflict ";
     let start = name.find(MARKER)?;
@@ -48,6 +50,20 @@ pub(crate) fn conflict_base_name(name: &str) -> Option<String> {
     let close_rel = name[after..].find(')')?;
     let close = after + close_rel;
     let inner = &name[after..close];
+    // A label is one token of the characters `conflict_label_of` keeps.
+    let inner = match inner.rsplit_once(' ') {
+        Some((label, token)) => {
+            let label_ok = !label.is_empty()
+                && label
+                    .chars()
+                    .all(|c| c.is_ascii_alphanumeric() || matches!(c, '-' | '_' | '.'));
+            if !label_ok {
+                return None;
+            }
+            token
+        }
+        None => inner,
+    };
     // The token is `<digits>` or `<digits>-<digits>`; reject anything else so a
     // file that merely happens to contain the phrase is not mistaken for a copy.
     let mut parts = inner.splitn(2, '-');
@@ -68,7 +84,7 @@ impl Core {
     /// docs for the identical/divergent policy.
     pub(crate) fn run_conflict_sweep_loop(&self) {
         // Both waits are interruptible, so teardown does not have to sit out a
-        // five-minute interval to join this thread (bugs.md B44).
+        // five-minute interval to join this thread (`docs/BUGS.md` B44).
         if !self.shutdown.sleep(CONFLICT_SWEEP_WARMUP) {
             return;
         }
@@ -165,7 +181,7 @@ impl Core {
         }
         match self
             .rt
-            .block_on(self.client.trash_nodes(std::slice::from_ref(uid)))
+            .block_on(self.drive.trash_nodes(std::slice::from_ref(uid)))
             .and_then(batch::into_unit)
         {
             Ok(()) => {}
@@ -175,10 +191,9 @@ impl Core {
                 return;
             }
         }
-        // Every mount, not just the primary: a conflict copy inside a sync
-        // folder lives in that fork's inode space, and leaving it hooked up
-        // there keeps a node we have just trashed remotely visible and
-        // readable there (`docs/BUGS.md` B74).
+        // Leaving a conflict copy hooked up in the tree keeps a node we have
+        // just trashed remotely visible and readable in whichever mount shows
+        // it (`docs/BUGS.md` B74).
         self.for_each_state(|st| {
             st.forget_or_unlink(uid);
         });
@@ -487,6 +502,24 @@ mod tests {
             conflict_base_name("notes (sync-conflict 1700-3).txt").as_deref(),
             Some("notes.txt")
         );
+        // Named after the computer that made it (B251).
+        assert_eq!(
+            conflict_base_name("notes (sync-conflict laptop 1700).txt").as_deref(),
+            Some("notes.txt")
+        );
+        assert_eq!(
+            conflict_base_name("notes (sync-conflict my-pc.local 1700-2).txt").as_deref(),
+            Some("notes.txt")
+        );
+        assert_eq!(
+            conflict_base_name(&crate::conflict_name("notes.txt", 1700)).as_deref(),
+            Some("notes.txt")
+        );
+        assert_eq!(
+            conflict_base_name("x (sync-conflict two words 1).txt"),
+            None
+        );
+        assert_eq!(conflict_base_name("x (sync-conflict  1).txt"), None);
         // Not a conflict copy.
         assert_eq!(conflict_base_name("report.xml"), None);
         // Looks close but the token is not a stamp.

crates/pdfs-fuse/src/sync/engine.rs

@@ -22,7 +22,7 @@ const POLL_INTERVAL: Duration = Duration::from_secs(120);
 /// per-item work is a network round-trip, so a folder with thousands of files is
 /// unusable done one-at-a-time; this bounds concurrency like the bulk-upload
 /// engine does.
-pub(super) const SYNC_CONCURRENCY: usize = 8;
+pub(crate) const SYNC_CONCURRENCY: usize = 8;
 
 /// A message to the sync engine's control thread.
 pub(crate) enum SyncMsg {
@@ -33,7 +33,7 @@ pub(crate) enum SyncMsg {
     /// Re-read the folder set and adjust the filesystem watches (after add/remove).
     Rewatch,
     /// The daemon is tearing down: finish the current pass and end the engine
-    /// thread, so the mount can join it (bugs.md B44).
+    /// thread, so the mount can join it (`docs/BUGS.md` B44).
     Stop,
 }
 
@@ -57,9 +57,10 @@ pub(crate) fn spawn(core: Core, rx: Receiver<SyncMsg>) -> Option<std::thread::Jo
 fn engine_loop(core: Core, rx: Receiver<SyncMsg>) {
     // Paths the watcher currently covers, mapped to their folder id, so an event
     // path can be resolved back to the folder it belongs to.
-    let watched: Mutex<Vec<(PathBuf, i64)>> = Mutex::new(Vec::new());
+    let watched: Arc<Mutex<Vec<(PathBuf, i64)>>> = Arc::new(Mutex::new(Vec::new()));
 
     let tx_events = core.sync_tx.clone();
+    let watched_events = watched.clone();
     let mut watcher =
         match notify::recommended_watcher(move |res: notify::Result<notify::Event>| {
             let Ok(event) = res else { return };
@@ -67,7 +68,8 @@ fn engine_loop(core: Core, rx: Receiver<SyncMsg>) {
             if matches!(event.kind, notify::EventKind::Access(_)) {
                 return;
             }
-            let _ = tx_events.send(SyncMsg::ReconcileAll);
+            let msg = event_target(&watched_events.lock(), &event.paths);
+            let _ = tx_events.send(msg);
         }) {
             Ok(w) => w,
             Err(e) => {
@@ -256,8 +258,31 @@ fn reconcile_all(core: &Core) {
     }
 }
 
+/// The reconcile a watcher event asks for: the one mirror folder all its paths
+/// lie in, so an edit in one folder does not walk every other one too. An event
+/// that spans folders, or that no watched folder claims (a watch list a moment
+/// out of date), falls back to every folder.
+pub(super) fn event_target(watched: &[(PathBuf, i64)], paths: &[PathBuf]) -> SyncMsg {
+    let mut ids = paths.iter().map(|path| {
+        watched
+            .iter()
+            .filter(|(root, _)| path.starts_with(root))
+            // The deepest root, should one mirror folder sit inside another.
+            .max_by_key(|(root, _)| root.components().count())
+            .map(|(_, id)| *id)
+    });
+    match ids.next() {
+        Some(Some(first)) if ids.all(|id| id == Some(first)) => SyncMsg::Reconcile(first),
+        _ => SyncMsg::ReconcileAll,
+    }
+}
+
 /// Bring the filesystem watches in line with the current mirror-folder set:
 /// watch newly-added folders, drop removed ones.
+///
+/// The watch calls run on a copy, outside the lock: the watcher's event
+/// callback takes the same lock, and a backend that hands a watch request to
+/// its event thread and waits for the answer would deadlock against it.
 fn rewatch(
     core: &Core,
     watcher: &mut notify::RecommendedWatcher,
@@ -274,7 +299,7 @@ fn rewatch(
             return;
         }
     };
-    let mut have = watched.lock();
+    let mut have = watched.lock().clone();
     // Drop watches no longer wanted.
     have.retain(|(path, _)| {
         if want.iter().any(|(p, _)| p == path) {
@@ -294,6 +319,7 @@ fn rewatch(
             Err(e) => warn!(path = %path.display(), error = %e, "sync: watch failed"),
         }
     }
+    *watched.lock() = have;
 }
 
 // ---- reconcile ------------------------------------------------------------

crates/pdfs-fuse/src/sync/model.rs

@@ -20,7 +20,7 @@ impl LocalSig {
     /// Nanoseconds decide it when both sides have them; otherwise the comparison
     /// falls back to whole seconds, which is what a baseline row written before
     /// schema 28 — or a filesystem that reports no sub-second time — can support
-    /// (bugs.md B25).
+    /// (`docs/BUGS.md` B25).
     pub(super) fn same_content(&self, other: &Self) -> bool {
         if self.size != other.size {
             return false;
@@ -83,6 +83,46 @@ pub(super) struct RemoteItem {
     pub(super) is_dir: bool,
     pub(super) mtime: i64,
     pub(super) size: i64,
+    /// The active revision's id. The light walk carries it for every file, so
+    /// it is the signal that tells another client's new revision from a link
+    /// merely re-stamped.
+    pub(super) revision: Option<String>,
+    /// The active revision's content SHA-1, read only for files the walk
+    /// enumerated in full (no baseline, or a moved mtime). `None` is never
+    /// proof of anything.
+    pub(super) sha1: Option<String>,
+}
+
+/// What a pass saw of a remote file: the signature its baseline records once
+/// the file is synced, and what an upload checks Drive still holds before it
+/// supersedes it.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(super) struct RemoteSeen {
+    pub(super) mtime: i64,
+    pub(super) size: i64,
+    pub(super) revision: Option<String>,
+}
+
+impl RemoteSeen {
+    /// Whether `node` is still the revision this was taken from. The revision
+    /// id decides it when both sides have one; otherwise the modification time
+    /// and size, which is all a baseline row from before schema 44 holds.
+    pub(super) fn still_current(&self, node: &Node) -> bool {
+        match (&self.revision, crate::node_revision_id(node)) {
+            (Some(seen), Some(now)) => *seen == now,
+            _ => (self.mtime, self.size) == remote_file_sig(node),
+        }
+    }
+}
+
+impl From<&RemoteItem> for RemoteSeen {
+    fn from(item: &RemoteItem) -> Self {
+        Self {
+            mtime: item.mtime,
+            size: item.size,
+            revision: item.revision.clone(),
+        }
+    }
 }
 
 /// The result of a reconcile pass: what it moved, how many paths were kept as
@@ -98,6 +138,11 @@ pub(super) struct Outcome {
     pub(super) errors: usize,
     /// Files skipped because another process held them open for writing.
     pub(super) deferred: usize,
+    /// Paths the local scan could not read, left out of the pass. Not part of
+    /// [`is_empty`](Self::is_empty) or the summary: an unreadable folder stays
+    /// unreadable from one poll to the next, so the pass reports it once, when
+    /// the set changes, rather than on every poll.
+    pub(super) unscanned: Vec<String>,
 }
 
 impl Outcome {
@@ -108,7 +153,7 @@ impl Outcome {
             Applied::Uploaded => self.uploaded += 1,
             Applied::Downloaded => self.downloaded += 1,
             Applied::Conflict => self.conflicts += 1,
-            Applied::Vanished => {}
+            Applied::Vanished | Applied::Adopted => {}
         }
     }
 
@@ -152,29 +197,45 @@ pub(super) enum Pending {
     CreateDir { rel: String, parent: NodeUid },
     /// Upload a brand-new local file into `parent`.
     UploadNew { rel: String, parent: NodeUid },
-    /// Upload a changed local file as a new revision of `uid`.
-    UploadRevision { rel: String, uid: NodeUid },
-    /// Download remote `uid` to the local path, stamping `mtime`. `size` is the
-    /// remote's reported size, used as the transfer's expected total.
+    /// Upload a changed local file as a new revision of `uid`, if Drive still
+    /// holds the revision `seen` describes (B249).
+    UploadRevision {
+        rel: String,
+        uid: NodeUid,
+        seen: RemoteSeen,
+    },
+    /// Download remote `uid` to the local path, stamping `seen.mtime`.
+    /// `seen.size` is the remote's reported size, used as the transfer's
+    /// expected total.
     ///
     /// `local` is what the planning walk saw at this path, or `None` if nothing
     /// was there. A download can run for minutes, so the apply step revalidates
     /// against it immediately before it renames over the destination: a writer
     /// that finished an edit in the meantime must not be overwritten without a
-    /// conflict copy (bugs.md B39).
+    /// conflict copy (`docs/BUGS.md` B39).
     Download {
         rel: String,
         uid: NodeUid,
-        mtime: i64,
-        size: i64,
+        seen: RemoteSeen,
         local: Option<LocalSig>,
     },
+    /// First sync of a path present on both sides at the same size, with a
+    /// digest on Drive: hash the local file, and record the baseline if it holds
+    /// the same bytes. A different file of the same size goes the way of
+    /// [`Pending::Conflict`]: two machines syncing one folder must not read as
+    /// in step while they hold different content.
+    Adopt {
+        rel: String,
+        uid: NodeUid,
+        seen: RemoteSeen,
+        sha1: String,
+        local: LocalSig,
+    },
     /// Both sides changed: set the local copy aside, then download remote `uid`.
     Conflict {
         rel: String,
         uid: NodeUid,
-        mtime: i64,
-        size: i64,
+        seen: RemoteSeen,
     },
     /// Both sides changed during a [`push pass`](Core::push_pass): upload the local
     /// copy into `parent` under a conflict name, leaving the remote file as it is.
@@ -189,6 +250,7 @@ impl Pending {
             | Pending::UploadNew { rel, .. }
             | Pending::UploadRevision { rel, .. }
             | Pending::Download { rel, .. }
+            | Pending::Adopt { rel, .. }
             | Pending::Conflict { rel, .. }
             | Pending::PushConflict { rel, .. } => rel,
         }
@@ -201,7 +263,9 @@ impl Pending {
             Pending::UploadNew { .. }
             | Pending::UploadRevision { .. }
             | Pending::PushConflict { .. } => ActivityKind::Upload,
-            Pending::Download { .. } | Pending::Conflict { .. } => ActivityKind::Download,
+            Pending::Download { .. } | Pending::Adopt { .. } | Pending::Conflict { .. } => {
+                ActivityKind::Download
+            }
         }
     }
 
@@ -212,6 +276,7 @@ impl Pending {
             Pending::UploadNew { .. } => "new file",
             Pending::UploadRevision { .. } => "new version",
             Pending::Download { .. } => "from Drive",
+            Pending::Adopt { .. } => "already the same on Drive",
             Pending::Conflict { .. } => "local changes kept as a conflict copy",
             Pending::PushConflict { .. } => "local changes uploaded as a conflict copy",
         }
@@ -227,6 +292,10 @@ pub(super) enum PassAbort {
     Interrupted,
     /// The pass could not establish its diff (a walk or the baseline load failed).
     Failed(String),
+    /// The daemon is stopping. What the pass sent before the stop has landed or
+    /// will be cancelled with the runtime; nothing more is sent, and the next
+    /// start's pass picks up from the baseline.
+    Stopped,
 }
 
 impl From<String> for PassAbort {

crates/pdfs-fuse/src/sync/planner.rs

@@ -90,6 +90,96 @@ pub(super) fn filter_baseline<'a, B>(
         .collect()
 }
 
+/// The paths a local scan left out because it could not read them: a folder
+/// it has no permission for, an entry that vanished between the listing and
+/// its `stat`, a name that is not UTF-8.
+///
+/// A left-out path is not a deleted one. A pass drops everything an entry
+/// covers from classification, exactly as it drops ignored paths, so a
+/// baseline row under an unreadable folder is neither read as a local deletion
+/// nor answered with a download into a folder the pass cannot write. Failing
+/// the whole pass instead is what B55 did, and it left one root-owned folder
+/// stopping every other file in the tree from syncing (B196).
+#[derive(Default)]
+pub(super) struct Unscanned {
+    covered: HashSet<String>,
+    /// The subset worth telling the user about, with why: an entry that only
+    /// vanished mid-scan is not, since the next pass sees it settled.
+    unreadable: Vec<String>,
+}
+
+impl Unscanned {
+    /// Leave out `rel`, which vanished while the scan looked at it.
+    pub(super) fn vanished(&mut self, rel: String) {
+        self.covered.insert(rel);
+    }
+
+    /// Leave out `rel`, which cannot be read for `reason`.
+    pub(super) fn unreadable(&mut self, rel: String, reason: &str) {
+        self.unreadable.push(format!("{rel} ({reason})"));
+        self.covered.insert(rel);
+    }
+
+    /// Whether `rel` is a left-out path or lies under one.
+    pub(super) fn covers(&self, rel: &str) -> bool {
+        if self.covered.is_empty() {
+            return false;
+        }
+        let mut at = rel;
+        loop {
+            if self.covered.contains(at) {
+                return true;
+            }
+            match at.rfind('/') {
+                Some(i) => at = &at[..i],
+                None => return false,
+            }
+        }
+    }
+
+    /// The unreadable paths with their reasons, sorted, for the activity feed.
+    pub(super) fn report(&self) -> Vec<String> {
+        let mut lines = self.unreadable.clone();
+        lines.sort_unstable();
+        lines
+    }
+}
+
+/// The baseline paths a pass can see: [`filter_baseline`], minus everything
+/// under a path the scan could not read. This is the set [`guard_local_wipe`]
+/// checks and the set a push pass reads deletions from, since a path outside
+/// it is absent from the local walk by rule or by failure, never by loss.
+pub(super) fn tracked_baseline<'a, B>(
+    baseline: &'a HashMap<String, B>,
+    rules: &IgnoreRules,
+    unscanned: &Unscanned,
+) -> HashMap<String, &'a B> {
+    let mut tracked = filter_baseline(baseline, rules);
+    tracked.retain(|rel, _| !unscanned.covers(rel));
+    tracked
+}
+
+/// The baseline paths a push pass has to trash on Drive: tracked, and gone
+/// from the local walk. Shallowest first, so a trashed folder takes its
+/// children with it.
+///
+/// Built from [`tracked_baseline`] rather than from the raw baseline. Reading
+/// it raw trashed every synced path that later became ignored, because the walk
+/// skips those, and the switch to on-demand that the push pass runs for then
+/// deleted the local copy too (B197).
+pub(super) fn local_deletions<B, L>(
+    tracked: &HashMap<String, &B>,
+    local: &HashMap<String, L>,
+) -> Vec<String> {
+    let mut missing: Vec<String> = tracked
+        .keys()
+        .filter(|rel| !local.contains_key(*rel))
+        .cloned()
+        .collect();
+    missing.sort_by_key(|p| p.matches('/').count());
+    missing
+}
+
 /// Refuse to run a pass whose local side has vanished in its entirety.
 ///
 /// When every baseline path is absent locally, the likely cause is an unavailable
@@ -102,21 +192,169 @@ pub(super) fn guard_local_wipe<B, L>(
     if !baseline.is_empty() && baseline.keys().all(|rel| !local.contains_key(rel)) {
         return Err(format!(
             "every one of the {} synced paths is missing locally; refusing to trash \
-             them on Drive. Check that the folder is mounted and readable.",
+             them on Drive. Check that the folder is mounted and readable; to download \
+             them again, sync the folder from scratch.",
             baseline.len()
         ));
     }
     Ok(())
 }
 
+/// Refuse to run a pass whose remote side has vanished in its entirety: the
+/// remote twin of [`guard_local_wipe`].
+///
+/// An empty or truncated remote walk reads to the planner as "Drive deleted
+/// everything", which a pass answers by deleting the local copies. When not
+/// one synced path is left on Drive, a failed listing is far likelier than a
+/// deliberate wipe of the whole folder, so the pass stops instead.
+pub(super) fn guard_remote_wipe<B, R>(
+    baseline: &HashMap<String, B>,
+    remote: &HashMap<String, R>,
+) -> Result<(), String> {
+    if !baseline.is_empty() && baseline.keys().all(|rel| !remote.contains_key(rel)) {
+        return Err(format!(
+            "every one of the {} synced paths is missing on Proton Drive; refusing to \
+             delete them here. If they were deleted on purpose, remove the folder from sync; \
+             to upload them again, sync the folder from scratch.",
+            baseline.len()
+        ));
+    }
+    Ok(())
+}
+
+/// What a remote walk saw but could not read: a node the SDK left out because
+/// it would not decrypt, or a file whose size could not be read.
+///
+/// A path missing from the walk is read as deleted on Drive, so a pass must
+/// not classify one it only failed to read. Since a node that failed to decrypt
+/// has no name, all a walk can say is that a folder's listing came back short;
+/// every path under that folder that the walk did not return is then left out,
+/// as [`Unscanned`] leaves out what the local scan could not read.
+#[derive(Default)]
+pub(super) struct RemoteGaps {
+    /// Folders whose listing came back with fewer nodes than it named.
+    short: HashSet<String>,
+    /// Paths seen, but whose entry could not be read.
+    unread: HashSet<String>,
+}
+
+impl RemoteGaps {
+    /// The listing of `folder` named nodes that did not come back.
+    pub(super) fn short_listing(&mut self, folder: &str) {
+        self.short.insert(folder.to_string());
+    }
+
+    /// `rel` is on Drive, but the walk could not read what it needs of it.
+    pub(super) fn unread(&mut self, rel: String) {
+        self.unread.insert(rel);
+    }
+
+    pub(super) fn is_empty(&self) -> bool {
+        self.short.is_empty() && self.unread.is_empty()
+    }
+
+    /// Whether `rel` may be missing from `remote` only because the walk could
+    /// not read it. A path the walk returned is never hidden.
+    pub(super) fn hides<R>(
+        &self,
+        rel: &str,
+        remote: &HashMap<String, R>,
+        remote_dirs: &HashMap<String, NodeUid>,
+    ) -> bool {
+        if self.is_empty() || remote.contains_key(rel) {
+            return false;
+        }
+        if self.unread.contains(rel) {
+            return true;
+        }
+        // The deepest folder the walk did list decides: under a short listing,
+        // anything not returned may be one of the nodes it could not read.
+        let mut at = parent_rel(rel);
+        loop {
+            if remote_dirs.contains_key(at) {
+                return self.short.contains(at);
+            }
+            if at.is_empty() {
+                return false;
+            }
+            at = parent_rel(at);
+        }
+    }
+
+    /// The folders to name to the user, sorted.
+    pub(super) fn report(&self) -> Vec<String> {
+        let mut lines: Vec<String> = self
+            .short
+            .iter()
+            .map(|rel| {
+                let shown = if rel.is_empty() { "the folder" } else { rel };
+                format!("{shown} (items on Proton Drive that cannot be read)")
+            })
+            .chain(
+                self.unread
+                    .iter()
+                    .map(|rel| format!("{rel} (cannot be read on Proton Drive)")),
+            )
+            .collect();
+        lines.sort_unstable();
+        lines
+    }
+}
+
+/// Why the remote folder at `rel` must not be trashed although it was deleted
+/// here: something under it is new or changed on Drive since the last sync,
+/// so it is another device's work that this computer has never had.
+///
+/// Trashing the folder would take that work with it, and the next pass would
+/// then delete the copy this pass just downloaded. `None` when everything under
+/// it is exactly what the baseline recorded.
+pub(super) fn remote_subtree_changed(
+    rel: &str,
+    remote: &HashMap<String, RemoteItem>,
+    baseline: &HashMap<String, StoredSyncEntry>,
+) -> Option<String> {
+    let prefix = format!("{rel}/");
+    let mut changed: Vec<&String> = remote
+        .iter()
+        .filter(|(path, _)| path.starts_with(&prefix))
+        .filter(|(path, item)| match baseline.get(*path) {
+            None => true,
+            Some(_) if item.is_dir => false,
+            Some(base) => {
+                remote_sig(base) != Some((item.mtime, item.size))
+                    || revision_moved(Some(base), item.revision.as_deref())
+            }
+        })
+        .map(|(path, _)| path)
+        .collect();
+    changed.sort_unstable();
+    changed
+        .first()
+        .map(|path| format!("{path} is new or changed on Proton Drive"))
+}
+
 /// The size the baseline recorded for `rel`, if its remote signature's mtime
-/// still matches `mtime`.
+/// still matches `mtime` and its revision is still `revision`.
+///
+/// A row without a revision id, while Drive reports one, cannot vouch for the
+/// revision, so the size is read for real. Such a row comes from before
+/// schema 44, or from an upload Drive did not list yet when it was read back.
+/// Another computer's revision in the same second as that upload kept the
+/// modification time, and only the size could show it (B254). The pass then
+/// records the id on the row, so this costs one read per row.
 pub(super) fn unchanged_remote_size(
     baseline: &HashMap<String, StoredSyncEntry>,
     rel: &str,
     mtime: i64,
+    revision: Option<&str>,
 ) -> Option<i64> {
-    match baseline.get(rel).and_then(remote_sig) {
+    let base = baseline.get(rel)?;
+    if revision_moved(Some(base), revision)
+        || (base.remote_revision_id.is_none() && revision.is_some())
+    {
+        return None;
+    }
+    match remote_sig(base) {
         Some((recorded, size)) if recorded == mtime => Some(size),
         _ => None,
     }
@@ -131,6 +369,17 @@ pub(super) fn join_rel(prefix: &str, name: &str) -> String {
     }
 }
 
+/// Whether Drive's active revision `now` is not the one the baseline row was
+/// synced at. Only a revision id on both sides can say so; a row from before
+/// schema 44, or a node read without one, leaves it to the modification time
+/// and size.
+pub(super) fn revision_moved(base: Option<&StoredSyncEntry>, now: Option<&str>) -> bool {
+    match (base.and_then(|b| b.remote_revision_id.as_deref()), now) {
+        (Some(recorded), Some(now)) => recorded != now,
+        _ => false,
+    }
+}
+
 /// The stored remote signature of a baseline row, if it has one.
 pub(super) fn remote_sig(e: &StoredSyncEntry) -> Option<(i64, i64)> {
     match (&e.remote_rev, &e.remote_hash) {
@@ -161,7 +410,8 @@ pub(super) fn rel_to_path(rel: &str) -> PathBuf {
     rel.split('/').collect()
 }
 
-/// The name for a conflict copy of `path`, e.g. `notes (sync-conflict 1700000000).txt`.
+/// The name for a conflict copy of `path`, e.g.
+/// `notes (sync-conflict laptop 1700000000).txt`.
 #[cfg(test)]
 pub(super) fn conflict_path(path: &Path, stamp: i64) -> PathBuf {
     conflict_path_with_suffix(path, stamp, 0)
@@ -170,16 +420,17 @@ pub(super) fn conflict_path(path: &Path, stamp: i64) -> PathBuf {
 /// As [`conflict_path`], with a deterministic suffix used when that name already
 /// exists. This keeps conflict preservation from ever replacing an older copy.
 pub(super) fn conflict_path_with_suffix(path: &Path, stamp: i64, suffix: u32) -> PathBuf {
+    conflict_path_as(path, crate::conflict_label(), stamp, suffix)
+}
+
+/// [`conflict_path_with_suffix`] with the machine's label given.
+pub(super) fn conflict_path_as(path: &Path, label: &str, stamp: i64, suffix: u32) -> PathBuf {
     let stem = path.file_stem().and_then(|s| s.to_str()).unwrap_or("file");
     let ext = path.extension().and_then(|s| s.to_str());
-    let suffix = if suffix == 0 {
-        String::new()
-    } else {
-        format!("-{suffix}")
-    };
+    let tag = crate::conflict_tag(label, stamp, suffix);
     let name = match ext {
-        Some(ext) => format!("{stem} (sync-conflict {stamp}{suffix}).{ext}"),
-        None => format!("{stem} (sync-conflict {stamp}{suffix})"),
+        Some(ext) => format!("{stem} (sync-conflict {tag}).{ext}"),
+        None => format!("{stem} (sync-conflict {tag})"),
     };
     match path.parent() {
         Some(dir) => dir.join(name),
@@ -200,11 +451,14 @@ pub(super) enum FilePlan {
     DeleteLocal,
     DeleteRemote,
     ForgetBaseline,
-    /// First sync of a file that already exists on both sides with identical
-    /// content: record the baseline without transferring anything. Without this,
+    /// First sync of a file that exists on both sides at the same size, with a
+    /// digest on Drive: record the baseline without transferring anything if
+    /// the local file hashes the same, else keep a conflict copy. Without this,
     /// a folder synced for the first time cuts a `(sync-conflict)` copy of every
     /// pre-existing file, because a missing baseline makes both sides read as
-    /// "changed" (see the mass first-sync conflict storm in docs/BUGS.md).
+    /// "changed" (see the mass first-sync conflict storm in docs/BUGS.md). Size
+    /// alone is not enough: a second machine joining the folder would read a
+    /// different file of the same size as in step (B248).
     AdoptBaseline,
 }
 
@@ -218,13 +472,18 @@ pub(super) fn plan_file(
     }
 
     let local_changed = local.is_some_and(|item| {
-        // Nanoseconds where both sides have them (bugs.md B25): whole seconds
+        // Nanoseconds where both sides have them (`docs/BUGS.md` B25): whole seconds
         // could not see an edit made in the same second as the last sync that
         // left the file the same length, so it was never uploaded.
         baseline.is_none_or(|base| !LocalSig::from(item).same_content(&LocalSig::from(base)))
     });
+    // Another client's new revision shows in its id even when the link's
+    // modification time and the size come out the same.
     let remote_changed = remote.is_some_and(|item| {
-        baseline.is_none_or(|base| remote_sig(base) != Some((item.mtime, item.size)))
+        baseline.is_none_or(|base| {
+            remote_sig(base) != Some((item.mtime, item.size))
+                || revision_moved(Some(base), item.revision.as_deref())
+        })
     });
 
     match (local, remote) {
@@ -234,10 +493,13 @@ pub(super) fn plan_file(
             (false, true) => FilePlan::Download,
             // With a baseline, both-changed is a genuine concurrent edit and must
             // be preserved as a conflict. Without one, "both changed" only means
-            // this is the first sync and there was nothing to compare to: adopt
-            // the baseline when the sizes already match rather than conflict-copy
-            // an already-identical file. Divergent sizes stay a real conflict.
-            (true, true) if baseline.is_none() && l.size == r.size => FilePlan::AdoptBaseline,
+            // this is the first sync and there was nothing to compare to: when the
+            // sizes match and Drive has a digest to compare against, the apply
+            // step hashes the local file before adopting it. Divergent sizes, or
+            // no digest, stay a real conflict: a missing digest proves nothing.
+            (true, true) if baseline.is_none() && l.size == r.size && r.sha1.is_some() => {
+                FilePlan::AdoptBaseline
+            }
             (true, true) => FilePlan::Conflict,
         },
         (Some(_), None) if baseline.is_none() || local_changed => FilePlan::UploadNew,
@@ -269,6 +531,8 @@ mod file_plan_tests {
             is_dir: false,
             mtime,
             size,
+            revision: None,
+            sha1: None,
         }
     }
 
@@ -286,12 +550,13 @@ mod file_plan_tests {
             local_size,
             remote_rev: Some(remote_mtime.to_string()),
             remote_hash: Some(remote_size.to_string()),
+            remote_revision_id: None,
         }
     }
 
     /// Whole seconds cannot see an edit made inside the same second that leaves the
     /// file the same length, so a mirror silently stopped uploading it. With a
-    /// nanosecond time on both sides it is an ordinary local change (bugs.md B25).
+    /// nanosecond time on both sides it is an ordinary local change (`docs/BUGS.md` B25).
     #[test]
     fn a_same_second_same_size_edit_is_still_a_local_change() {
         let mut base = baseline(10, 20, 30, 40);
@@ -407,12 +672,28 @@ mod file_plan_tests {
     fn first_sync_of_an_identical_file_adopts_the_baseline_not_a_conflict() {
         // No baseline yet (first sync). Same size on both sides is a pre-existing
         // identical file, not a concurrent edit: adopt it rather than cut a
-        // conflict copy of every file in the folder.
+        // conflict copy of every file in the folder. The apply step still
+        // hashes the local file before it records anything.
+        let local = local(10, 40);
+        let remote = RemoteItem {
+            sha1: Some("da39a3ee".into()),
+            ..remote(30, 40)
+        };
+        assert_eq!(
+            plan_file(Some(&local), Some(&remote), None),
+            FilePlan::AdoptBaseline
+        );
+    }
+
+    /// A file on Drive without a digest cannot be compared without a download,
+    /// and the same size is not the same content (B248).
+    #[test]
+    fn first_sync_without_a_remote_digest_is_a_conflict() {
         let local = local(10, 40);
         let remote = remote(30, 40);
         assert_eq!(
             plan_file(Some(&local), Some(&remote), None),
-            FilePlan::AdoptBaseline
+            FilePlan::Conflict
         );
     }
 
@@ -428,6 +709,73 @@ mod file_plan_tests {
         );
     }
 
+    /// Another computer's new revision can leave the modification time and
+    /// the size as they were. The revision id still tells it apart (B249).
+    #[test]
+    fn a_new_remote_revision_is_a_change_even_at_the_same_mtime_and_size() {
+        let mut base = baseline(10, 20, 30, 40);
+        base.remote_revision_id = Some("r1".into());
+        let unedited = local(10, 20);
+        let same = RemoteItem {
+            revision: Some("r1".into()),
+            ..remote(30, 40)
+        };
+        let newer = RemoteItem {
+            revision: Some("r2".into()),
+            ..remote(30, 40)
+        };
+        assert_eq!(
+            plan_file(Some(&unedited), Some(&same), Some(&base)),
+            FilePlan::Unchanged
+        );
+        assert_eq!(
+            plan_file(Some(&unedited), Some(&newer), Some(&base)),
+            FilePlan::Download
+        );
+        let edited = local(11, 20);
+        assert_eq!(
+            plan_file(Some(&edited), Some(&newer), Some(&base)),
+            FilePlan::Conflict
+        );
+
+        // A row from before schema 44 has no id to compare, and a node read
+        // without one says nothing: both fall back to the signature.
+        let old = baseline(10, 20, 30, 40);
+        assert_eq!(
+            plan_file(Some(&unedited), Some(&newer), Some(&old)),
+            FilePlan::Unchanged
+        );
+        assert_eq!(
+            plan_file(Some(&unedited), Some(&remote(30, 40)), Some(&base)),
+            FilePlan::Unchanged
+        );
+    }
+
+    /// The walk reuses the recorded size only while the revision is the one
+    /// the baseline holds.
+    #[test]
+    fn a_moved_revision_makes_the_walk_read_the_size_again() {
+        let mut base = baseline(10, 20, 30, 40);
+        base.remote_revision_id = Some("r1".into());
+        let rows = HashMap::from([("file".to_string(), base)]);
+        assert_eq!(
+            unchanged_remote_size(&rows, "file", 30, Some("r1")),
+            Some(40)
+        );
+        assert_eq!(unchanged_remote_size(&rows, "file", 30, None), Some(40));
+        assert_eq!(unchanged_remote_size(&rows, "file", 30, Some("r2")), None);
+        assert_eq!(unchanged_remote_size(&rows, "file", 31, Some("r1")), None);
+    }
+
+    /// A row without a revision id reuses its size only while Drive gives no
+    /// id either (B254).
+    #[test]
+    fn a_row_without_a_revision_makes_the_walk_read_the_size_again() {
+        let rows = HashMap::from([("file".to_string(), baseline(10, 20, 30, 40))]);
+        assert_eq!(unchanged_remote_size(&rows, "file", 30, Some("r1")), None);
+        assert_eq!(unchanged_remote_size(&rows, "file", 30, None), Some(40));
+    }
+
     #[test]
     fn a_missing_remote_signature_is_treated_as_changed() {
         let local = local(10, 20);
@@ -440,4 +788,96 @@ mod file_plan_tests {
             FilePlan::Download
         );
     }
+
+    fn uid(id: &str) -> NodeUid {
+        NodeUid::new(VolumeId::from("v"), LinkId::from(id))
+    }
+
+    fn folder() -> RemoteItem {
+        RemoteItem {
+            is_dir: true,
+            mtime: 0,
+            size: 0,
+            ..remote(0, 0)
+        }
+    }
+
+    /// An empty or failed remote listing must not read as "Drive deleted
+    /// everything" and delete the local copies.
+    #[test]
+    fn the_remote_wipe_guard_blocks_only_a_total_disappearance() {
+        let base = HashMap::from([("a".to_string(), ()), ("b".to_string(), ())]);
+        let none: HashMap<String, RemoteItem> = HashMap::new();
+        assert!(guard_remote_wipe(&base, &none).is_err());
+        let one = HashMap::from([("b".to_string(), remote(1, 1))]);
+        assert!(guard_remote_wipe(&base, &one).is_ok());
+        let empty: HashMap<String, ()> = HashMap::new();
+        assert!(guard_remote_wipe(&empty, &none).is_ok());
+    }
+
+    /// A node that failed to decrypt has no name, so everything a short
+    /// listing did not return is left out, and nothing else.
+    #[test]
+    fn a_short_remote_listing_hides_what_it_did_not_return() {
+        let remote = HashMap::from([
+            ("docs".to_string(), folder()),
+            ("docs/a.txt".to_string(), remote(1, 1)),
+            ("pics".to_string(), folder()),
+        ]);
+        let dirs = HashMap::from([
+            (String::new(), uid("root")),
+            ("docs".to_string(), uid("docs")),
+            ("pics".to_string(), uid("pics")),
+        ]);
+        let mut gaps = RemoteGaps::default();
+        assert!(!gaps.hides("docs/b.txt", &remote, &dirs));
+        gaps.short_listing("docs");
+        // Returned paths stand; unreturned ones under the short folder hide,
+        // and so does anything under a subfolder it failed to return.
+        assert!(!gaps.hides("docs/a.txt", &remote, &dirs));
+        assert!(gaps.hides("docs/b.txt", &remote, &dirs));
+        assert!(gaps.hides("docs/sub/deep.txt", &remote, &dirs));
+        // A complete sibling listing still reads deletions as deletions.
+        assert!(!gaps.hides("pics/gone.jpg", &remote, &dirs));
+        assert!(!gaps.hides("top.txt", &remote, &dirs));
+        gaps.short_listing("");
+        assert!(gaps.hides("top.txt", &remote, &dirs));
+    }
+
+    #[test]
+    fn a_file_whose_size_could_not_be_read_is_hidden() {
+        let remote: HashMap<String, RemoteItem> = HashMap::new();
+        let dirs = HashMap::from([(String::new(), uid("root"))]);
+        let mut gaps = RemoteGaps::default();
+        gaps.unread("a.txt".to_string());
+        assert!(gaps.hides("a.txt", &remote, &dirs));
+        assert!(!gaps.hides("b.txt", &remote, &dirs));
+        assert_eq!(gaps.report(), ["a.txt (cannot be read on Proton Drive)"]);
+    }
+
+    /// A folder deleted here holds another device's new work on Drive, so
+    /// trashing it would lose that work.
+    #[test]
+    fn a_remote_folder_with_new_or_changed_files_is_not_trashed() {
+        let mut base = HashMap::from([
+            ("x".to_string(), baseline(0, 0, 0, 0)),
+            ("x/old.txt".to_string(), baseline(1, 1, 5, 6)),
+        ]);
+        let mut remote_tree = HashMap::from([
+            ("x".to_string(), folder()),
+            ("x/old.txt".to_string(), remote(5, 6)),
+            ("xy/new.txt".to_string(), remote(1, 1)),
+        ]);
+        // Unchanged under x; a name-prefixed sibling does not count.
+        assert_eq!(remote_subtree_changed("x", &remote_tree, &base), None);
+
+        remote_tree.insert("x/old.txt".to_string(), remote(9, 6));
+        assert!(remote_subtree_changed("x", &remote_tree, &base).is_some());
+
+        remote_tree.insert("x/old.txt".to_string(), remote(5, 6));
+        remote_tree.insert("x/sub".to_string(), folder());
+        assert!(remote_subtree_changed("x", &remote_tree, &base).is_some());
+        base.insert("x/sub".to_string(), baseline(0, 0, 0, 0));
+        assert_eq!(remote_subtree_changed("x", &remote_tree, &base), None);
+    }
 }

crates/pdfs-fuse/src/systemd.rs

@@ -74,6 +74,26 @@ pub(crate) fn watchdog_ping() {
     let _ = notify("WATCHDOG=1\n");
 }
 
+/// Sleep for `duration`, pinging the watchdog on the way.
+///
+/// For the stretches where the daemon is alive but has no mount, and so no
+/// supervisor: waiting for a login, or backing off after a failed mount. The
+/// manager arms the watchdog when the process starts, so without these pings a
+/// daemon that is merely retrying is aborted after `WatchdogSec` and leaves a
+/// coredump instead of the error it was logging. Never use this while mounted:
+/// there the ping must prove the control socket answers.
+pub fn idle_sleep(duration: Duration) {
+    const CHUNK: Duration = Duration::from_secs(10);
+    let mut left = duration;
+    watchdog_ping();
+    while !left.is_zero() {
+        let step = left.min(CHUNK);
+        std::thread::sleep(step);
+        left -= step;
+        watchdog_ping();
+    }
+}
+
 /// Tell the manager the daemon is stopping, so a slow teardown is not mistaken
 /// for a hang by the watchdog it is racing.
 pub(crate) fn stopping() {

crates/pdfs-fuse/src/takeout.rs

@@ -25,7 +25,7 @@ use std::collections::{BTreeMap, HashMap};
 use std::io::Read;
 use std::path::PathBuf;
 use std::sync::Arc;
-use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
 
 use pdfs_core::control::{ActivityKind, ImportSummary, TransferDirection};
 use pdfs_core::takeout::{Bucket, TakeoutPhoto, TakeoutScan, scan_archives};
@@ -36,6 +36,7 @@ use sha1::{Digest, Sha1};
 use tracing::{info, warn};
 
 use super::Core;
+use crate::photos::can_make_thumbnail;
 use crate::transfers::CountingReader;
 
 /// The one import this daemon may be running, and how the last one ended.
@@ -136,6 +137,30 @@ fn read_entry<R>(
 }
 
 impl Core {
+    /// Copy archive entry `entry` into the thumbnail staging folder and return
+    /// its path. The caller removes it.
+    fn stage_takeout_entry(
+        &self,
+        archive: &mut zip::ZipArchive<std::io::BufReader<std::fs::File>>,
+        entry: &str,
+    ) -> CoreResult<PathBuf> {
+        static STAGED: AtomicU64 = AtomicU64::new(0);
+        let path = self.cache.raw_thumbnail_staging_dir().join(format!(
+            "takeout-{}-{}",
+            std::process::id(),
+            STAGED.fetch_add(1, Ordering::Relaxed)
+        ));
+        let copied = read_entry(archive, entry, |reader| {
+            let mut file = std::fs::File::create(&path)?;
+            std::io::copy(reader, &mut file)
+        })?;
+        if let Err(e) = copied {
+            let _ = std::fs::remove_file(&path);
+            return Err(CoreError::internal(format!("copy {entry}: {e}")));
+        }
+        Ok(path)
+    }
+
     /// Import Google Photos Takeout archives. Blocking; run on its own thread.
     ///
     /// `cancel` stops the run at the next photo boundary — an upload already on
@@ -321,18 +346,65 @@ impl Core {
                     capture_time: photo.capture_time,
                     ..Default::default()
                 };
-                let uploaded = read_entry(&mut archive, &photo.entry, |reader| {
-                    let counting = CountingReader::new(reader, &guard);
-                    self.rt.block_on(photos.upload_photo_from(
-                        &photo.name,
-                        &photo.media_type,
-                        counting,
-                        photo.size as i64,
-                        Vec::new(),
-                        metadata,
-                        false,
-                    ))
-                });
+                // A thumbnail is made from a file, so a photo that can have one
+                // is copied out of the archive first and uploaded from the copy.
+                // Without one, Proton's apps show a blank tile until they make
+                // their own.
+                let staged = can_make_thumbnail(&photo.name, photo.size)
+                    .then(|| self.stage_takeout_entry(&mut archive, &photo.entry))
+                    .and_then(|staged| {
+                        staged
+                            .inspect_err(|e| {
+                                warn!(name = photo.name, error = %e,
+                                      "copying a takeout photo out failed; uploading it without a thumbnail")
+                            })
+                            .ok()
+                    });
+                let uploaded = match &staged {
+                    Some(path) => {
+                        let thumbnails = self.upload_thumbnails(path, &photo.name);
+                        // No sidecar and no date in the name: the photo's own
+                        // EXIF, before Drive files it under today.
+                        let metadata = PhotoUploadMetadata {
+                            capture_time: metadata
+                                .capture_time
+                                .or_else(|| pdfs_core::exiftime::capture_time_of(path)),
+                            ..metadata
+                        };
+                        std::fs::File::open(path)
+                            .map_err(|e| {
+                                CoreError::internal(format!("open {}: {e}", path.display()))
+                            })
+                            .map(|file| {
+                                let counting =
+                                    CountingReader::new(std::io::BufReader::new(file), &guard);
+                                self.rt.block_on(photos.upload_photo_from(
+                                    &photo.name,
+                                    &photo.media_type,
+                                    counting,
+                                    photo.size as i64,
+                                    thumbnails,
+                                    metadata,
+                                    false,
+                                ))
+                            })
+                    }
+                    None => read_entry(&mut archive, &photo.entry, |reader| {
+                        let counting = CountingReader::new(reader, &guard);
+                        self.rt.block_on(photos.upload_photo_from(
+                            &photo.name,
+                            &photo.media_type,
+                            counting,
+                            photo.size as i64,
+                            Vec::new(),
+                            metadata,
+                            false,
+                        ))
+                    }),
+                };
+                if let Some(path) = staged {
+                    let _ = std::fs::remove_file(path);
+                }
                 drop(guard);
                 job.step();
 
@@ -480,7 +552,15 @@ impl Core {
                 let mut state = IMPORT.lock();
                 state.running = false;
                 state.cancel = None;
-                state.last = outcome.as_ref().ok().cloned();
+                // A failed run is reported too: without it, `--wait` read
+                // "no import has run" and exited as if all was well.
+                state.last = Some(match &outcome {
+                    Ok(summary) => summary.clone(),
+                    Err(e) => ImportSummary {
+                        error: Some(e.to_string()),
+                        ..Default::default()
+                    },
+                });
             }
             match outcome {
                 Ok(summary) => {
@@ -530,7 +610,7 @@ fn open_archive(
 
 /// The lowercase-hex SHA-1 of everything `reader` yields — the digest Proton's
 /// photo duplicate detection is keyed on.
-fn sha1_of(reader: &mut (dyn Read + Send)) -> CoreResult<String> {
+pub(crate) fn sha1_of(reader: &mut (dyn Read + Send)) -> CoreResult<String> {
     let mut hasher = Sha1::new();
     let mut buffer = vec![0u8; 256 * 1024];
     loop {
@@ -545,7 +625,7 @@ fn sha1_of(reader: &mut (dyn Read + Send)) -> CoreResult<String> {
     Ok(hex_lower(&hasher.finalize()))
 }
 
-fn hex_lower(bytes: &[u8]) -> String {
+pub(crate) fn hex_lower(bytes: &[u8]) -> String {
     let mut out = String::with_capacity(bytes.len() * 2);
     for byte in bytes {
         out.push_str(&format!("{byte:02x}"));

crates/pdfs-fuse/src/transfers.rs

@@ -46,6 +46,8 @@ struct JobEntry {
     detail: Mutex<String>,
     done: AtomicU64,
     total: AtomicU64,
+    /// Housekeeping that moves nothing; see [`JobItem::background`].
+    background: bool,
 }
 
 /// The set of transfers and jobs currently in flight. Cloned `Arc`-style across
@@ -123,6 +125,11 @@ impl TransferRegistry {
         self.download_limit.set(download);
     }
 
+    /// The upload cap in bytes per second, `0` when there is none.
+    pub fn upload_cap(&self) -> u64 {
+        self.upload_limit.rate.load(Ordering::Relaxed)
+    }
+
     fn limit(&self, direction: TransferDirection) -> &RateLimit {
         match direction {
             TransferDirection::Upload => &self.upload_limit,
@@ -160,12 +167,25 @@ impl TransferRegistry {
     /// that carries its progress and deregisters the job when dropped. The job
     /// starts indeterminate; give it a `total` once one is known.
     pub fn begin_job(self: &Arc<Self>, title: impl Into<String>) -> JobGuard {
+        self.register_job(title.into(), false)
+    }
+
+    /// [`TransferRegistry::begin_job`] for housekeeping the user did not ask
+    /// for and that changes nothing in their files, such as an index rebuild or
+    /// a cache check. It is reported, but front ends don't call the drive busy
+    /// over it.
+    pub fn begin_background_job(self: &Arc<Self>, title: impl Into<String>) -> JobGuard {
+        self.register_job(title.into(), true)
+    }
+
+    fn register_job(self: &Arc<Self>, title: String, background: bool) -> JobGuard {
         let id = self.next.fetch_add(1, Ordering::Relaxed);
         let entry = Arc::new(JobEntry {
-            title: title.into(),
+            title,
             detail: Mutex::new(String::new()),
             done: AtomicU64::new(0),
             total: AtomicU64::new(0),
+            background,
         });
         self.jobs.lock().insert(id, entry.clone());
         JobGuard {
@@ -191,6 +211,7 @@ impl TransferRegistry {
                     detail: e.detail.lock().clone(),
                     done: e.done.load(Ordering::Relaxed),
                     total: e.total.load(Ordering::Relaxed),
+                    background: e.background,
                 }
             })
             .collect()

crates/pdfs-fuse/src/upload.rs

@@ -73,7 +73,7 @@ async fn run_uploads(
                 .upload_thumbnails_async(t.path.clone(), t.name.clone())
                 .await;
             match core
-                .client
+                .drive
                 .upload_file_from(
                     &t.parent_uid,
                     &t.name,
@@ -238,14 +238,11 @@ impl Core {
             .map_err(|error| self.errno_error(error, "upload destination"))?;
         let new_uid = self
             .rt
-            .block_on(
-                self.client
-                    .create_folder(parent_uid, name, Some(now_secs())),
-            )
+            .block_on(self.drive.create_folder(parent_uid, name, Some(now_secs())))
             .map_err(|e| CoreError::from_api(&e, &format!("create folder {name}")))?;
         let node = self
-            .fetch_node(&new_uid)
-            .map_err(|e| self.errno_error(e, "fetch node"))?;
+            .fetch_minted_node(&new_uid, name)
+            .ok_or_else(|| minted_but_unlisted(name))?;
         let mut st = self.state();
         let ino = st.intern(pino, node);
         if let Some(kids) = st.children.get_mut(&pino)

crates/pdfs-gui/resources/icons/scalable/actions/pdfs-menu-symbolic.svg

@@ -1,5 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16">
-  <!-- Main menu: three bars. Bundled because themes such as Papirus draw
-       open-menu-symbolic as three dots, the same as every row's "more" menu. -->
-  <path fill="#222222" d="M 2,2.5 H 14 A 1,1 0 0 1 14,4.5 H 2 A 1,1 0 0 1 2,2.5 Z M 2,7 H 14 A 1,1 0 0 1 14,9 H 2 A 1,1 0 0 1 2,7 Z M 2,11.5 H 14 A 1,1 0 0 1 14,13.5 H 2 A 1,1 0 0 1 2,11.5 Z"/>
-</svg>

crates/pdfs-gui/resources/pdfs.gresource.xml

@@ -14,7 +14,6 @@
     <file preprocess="xml-stripblanks">scalable/actions/pdfs-details-pane-symbolic.svg</file>
     <file preprocess="xml-stripblanks">scalable/actions/pdfs-link-symbolic.svg</file>
     <file preprocess="xml-stripblanks">scalable/actions/pdfs-map-symbolic.svg</file>
-    <file preprocess="xml-stripblanks">scalable/actions/pdfs-menu-symbolic.svg</file>
     <file preprocess="xml-stripblanks">scalable/actions/pdfs-people-symbolic.svg</file>
     <file preprocess="xml-stripblanks">scalable/actions/pdfs-share-symbolic.svg</file>
     <file preprocess="xml-stripblanks">scalable/actions/pdfs-sync-symbolic.svg</file>

crates/pdfs-gui/resources/style.css

@@ -18,7 +18,9 @@
 .sidebar-status image.warning { color: var(--warning-color); }
 .sidebar-status image.error { color: var(--error-color); }
 .sidebar-quota progressbar trough, .sidebar-quota progressbar progress { min-height: 4px; }
-.sidebar-account { padding: 4px 4px 4px 8px; }
+/* The account row is the main menu's button: a row, not a pushbutton, so
+ * the name keeps the text weight. */
+button.sidebar-account { padding: 4px 8px; font-weight: normal; }
 /* A count of what waits on a page, at the end of its sidebar row */
 .sidebar-badge {
   min-width: 10px;
@@ -46,7 +48,11 @@
 .badge-pinned { color: var(--success-color); }
 .badge-cached { color: var(--success-color); }
 .badge-cloud { color: color-mix(in srgb, currentColor 55%, transparent); }
+.badge-issue { color: var(--error-color); }
 .browser-statusbar { background-color: alpha(currentColor, 0.025); }
+/* The folder on screen, last in the breadcrumb trail: a flat button's side
+ * padding, so the "›" before it is spaced like the ones between buttons. */
+.crumb-current { padding: 0 10px; }
 scale.browser-status-meter trough { min-width: 104px; min-height: 6px; }
 .bulk-bar { padding: 6px 8px; border-radius: 12px; background: color-mix(in srgb, var(--accent-bg-color) 12%, transparent); }
 .dropzone { border: 2px dashed alpha(currentColor, 0.25); border-radius: 16px; padding: 28px 18px; transition: background 160ms ease, border-color 160ms ease; }

crates/pdfs-gui/src/activation.rs

@@ -10,9 +10,14 @@
 //! `dead_code` allowances below are for — not code nobody uses.
 
 use std::path::{Path, PathBuf};
+use std::time::Duration;
 
 use pdfs_core::control::{PhotoKind, SearchHit};
 
+/// How long a `stat` of the mount may take before the file counts as not
+/// there. A frozen mount never answers, and every caller has a fallback.
+const STAT_TIMEOUT: Duration = Duration::from_secs(2);
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub(crate) enum DriveActivation {
     Folder,
@@ -55,18 +60,32 @@ pub(crate) fn mounted_target(mountpoint: &Path, hit: &SearchHit) -> Option<PathB
     present(mounted_or_relative(mountpoint, hit))
 }
 
-/// [`mounted_target`] for callers holding a mountpoint-relative path rather
-/// than a search hit — the browser's listing entries, which are by definition
-/// paths in the primary mount's tree.
-#[allow(dead_code)] // browser only
-pub(crate) fn mounted_target_rel(mountpoint: &Path, relative_path: &str) -> Option<PathBuf> {
-    present(mounted_path(mountpoint, relative_path))
-}
-
 fn present(path: PathBuf) -> Option<PathBuf> {
     path.symlink_metadata().is_ok().then_some(path)
 }
 
+/// Whether anything is at `path`, asked on a thread of its own and given up
+/// on after [`STAT_TIMEOUT`]. `None` means "not there" or "no answer".
+///
+/// For the GTK binaries, whose main thread must not `stat` the mount: a
+/// mount that hangs hung the whole window with it. The thread of a `stat`
+/// that never returns is left behind; there is no way to cancel one.
+#[allow(dead_code)] // GTK binaries only
+pub(crate) async fn present_within(path: PathBuf) -> Option<PathBuf> {
+    let (tx, rx) = async_channel::bounded(1);
+    std::thread::spawn(move || {
+        let _ = tx.send_blocking(present(path));
+    });
+    match gtk4::glib::future_with_timeout(STAT_TIMEOUT, rx.recv()).await {
+        Ok(Ok(target)) => target,
+        Ok(Err(_)) => None,
+        Err(_) => {
+            tracing::warn!("the mount did not answer in time");
+            None
+        }
+    }
+}
+
 /// The mount path for a hit, whether or not anything is there — for callers
 /// that have no fallback (a folder cannot be materialised) or already know the
 /// entry came from a mount listing.

crates/pdfs-gui/src/app/main.rs

@@ -10,6 +10,7 @@ pub(crate) mod pages;
 pub(crate) mod reload;
 #[path = "../theme.rs"]
 pub(crate) mod theme;
+pub(crate) mod update;
 pub(crate) mod widgets;
 
 use compat::*;
@@ -33,7 +34,9 @@ use pages::trash::*;
 use pages::verify::*;
 use reload::{LoadTicket, Loader, replace_items};
 use theme::{load_resources, proton_theme_active, set_proton_theme};
+use update::*;
 use widgets::compat::*;
+use widgets::crumb::*;
 use widgets::details::*;
 use widgets::file_list::*;
 use widgets::menu::*;
@@ -68,15 +71,15 @@ use gtk4::glib::BoxedAnyObject;
 
 use pdfs_core::auth;
 
-use pdfs_core::config::{AppDirs, FileSort, FilesView};
+use pdfs_core::config::{AppDirs, FileSort, FilesView, WindowState};
 
 use pdfs_core::control::{
     ActivityEntry, ActivityKind, AlbumInfo, BookmarkInfo, ConflictInfo, ConflictKeep, DeviceInfo,
-    DirEntry, ErrorKind, ImportSummary, InvitationInfo, JobItem, MappingProgress, PendingOpInfo,
-    PhotoItem, PhotoKind, PhotoMonth, PlaceInfo, PublicLinkInfo, RefreshScope, Request, Response,
-    RestorableFolder, RestoreItem, RevisionInfo, SearchHit, ShareEntry, ShareEntryKind, SharedItem,
-    SyncFolderInfo, SyncPhase, SyncProgress, ThumbnailBuildStatus, Topic, TransferDirection,
-    TransferItem, send,
+    DirEntry, ErrorKind, ImportSummary, InvitationInfo, JobItem, LinkChange, MappingProgress,
+    PendingOpInfo, PhotoItem, PhotoKind, PhotoMonth, PlaceInfo, PublicLinkInfo, RefreshScope,
+    Request, Response, RestorableFolder, RestoreItem, RevisionInfo, SearchHit, ShareEntry,
+    ShareEntryKind, SharedItem, SyncFolderInfo, SyncIssue, SyncPhase, SyncProgress,
+    ThumbnailBuildStatus, Topic, TransferDirection, TransferItem, send,
 };
 
 use pdfs_core::mounts::{MountAccess, MountKind, MountMode, MountSpec};
@@ -119,6 +122,9 @@ struct Ui {
     /// keyring (a DBus round-trip). Populated at startup and updated only on
     /// login / logout. `None` = signed out.
     session: RefCell<Option<auth::StoredSession>>,
+    /// Whether this run already asked for the mailbox password of a locked
+    /// account, so a refresh never re-opens a dialog the user cancelled.
+    unlock_offered: Cell<bool>,
     /// Whether the last refresh saw a live mount daemon. Gates the unpin buttons
     /// (which need the daemon to evict + re-hydrate) and every mutating action.
     mounted: RefCell<bool>,
@@ -126,8 +132,12 @@ struct Ui {
     /// the page stack; [`sync_sidebar`] mirrors navigation that starts elsewhere.
     sidebar: gtk4::ListBox,
     /// The sidebar/content split. Collapsed while signed out, so the login page
-    /// owns the whole window and no destination is reachable without a session.
+    /// owns the whole window and no destination is reachable without a session,
+    /// and while the window is [`narrow`](Self::narrow).
     nav: adw::NavigationSplitView,
+    /// The window is too narrow for the sidebar beside a page, so the two take
+    /// turns. Set by the narrow breakpoint; [`refresh`] reads it.
+    narrow: Cell<bool>,
     /// Shared thumbnails for ordinary image files outside the Photos gallery.
     /// One cache and request queue serves Files, search, Shared and Trash, so
     /// the same image is downloaded and decoded only once.
@@ -147,6 +157,7 @@ struct Ui {
     pub(crate) locations: LocationsState,
     pub(crate) activity: ActivityState,
     pub(crate) takeout: TakeoutState,
+    pub(crate) update: UpdateState,
 }
 
 impl Ui {
@@ -199,12 +210,20 @@ impl Ui {
 }
 
 fn main() -> glib::ExitCode {
-    tracing_subscriber::fmt()
-        .with_env_filter(
-            tracing_subscriber::EnvFilter::try_from_default_env().unwrap_or_else(|_| "info".into()),
-        )
-        .init();
+    let verify = std::env::args().nth(1).as_deref() == Some(VERIFY_ARG);
+    let logs = tracing_subscriber::fmt().with_env_filter(
+        tracing_subscriber::EnvFilter::try_from_default_env().unwrap_or_else(|_| "info".into()),
+    );
+    // The verification window's stdout carries its token back to the app.
+    if verify {
+        logs.with_writer(std::io::stderr).init();
+    } else {
+        logs.init();
+    }
     i18n::init();
+    if verify {
+        return run_verification_window();
+    }
 
     // The tray launches the app with arguments ("--page locations",
     // "--confirm-stop"), which a running instance must receive too.
@@ -285,7 +304,10 @@ fn present_window(app: &adw::Application) {
 /// Spawn the tray icon process in the background.
 pub(crate) fn spawn_tray() {
     match Command::new("pdfs-tray").spawn() {
-        Ok(_) => tracing::info!("spawned `pdfs-tray`"),
+        Ok(child) => {
+            tracing::info!("spawned `pdfs-tray`");
+            pdfs_core::opener::reap(child);
+        }
         Err(e) => tracing::error!("failed to spawn `pdfs-tray`: {e}"),
     }
 }
@@ -300,8 +322,15 @@ fn build_window(app: &adw::Application) {
             return;
         }
     };
+    // On a fresh install the daemon has not run yet to make these, and the
+    // Takeout page keeps its staged archives in the state dir (B194).
+    if let Err(e) = dirs.ensure() {
+        tracing::warn!("cannot create the app's directories: {e}");
+    }
 
-    let stack = adw::ViewStack::new();
+    // Not homogeneous: each page sets the window's minimum width only while it
+    // is shown, so the widest page does not hold every other one wide.
+    let stack = adw::ViewStack::builder().hhomogeneous(false).build();
     let (login_page, login_widgets) = build_login_page();
     let main_widgets = build_main_page();
     let (browser_page, browser_widgets) = build_browser_page();
@@ -319,8 +348,12 @@ fn build_window(app: &adw::Application) {
     login_frame.add_top_bar(&{
         let header = adw::HeaderBar::new();
         header.set_show_title(false);
+        // The split is collapsed while signed out; going "back" would only
+        // uncover a sidebar with nowhere to go.
+        header.set_show_back_button(false);
         header
     });
+    login_frame.add_top_bar(&login_widgets.keyring_banner);
     login_frame.set_content(Some(&login_page));
     stack.add_named(&login_frame, Some("login"));
     stack.add_named(&browser_page, Some("browser"));
@@ -335,7 +368,8 @@ fn build_window(app: &adw::Application) {
     // Sidebar: the signed-in destinations. Selecting a row swaps the page stack;
     // `sync_sidebar` pushes the other way when navigation happens elsewhere (e.g.
     // login lands on Files).
-    let (sidebar_page, sidebar_list) = build_sidebar(&main_widgets.footer);
+    let update = UpdateState::new();
+    let (sidebar_page, sidebar_list) = build_sidebar(&main_widgets.footer, &update.banner);
 
     // Every page brings its own header bar (see `page_frame`), so the content
     // side is the bare stack.
@@ -348,6 +382,8 @@ fn build_window(app: &adw::Application) {
         .content(&content_page)
         .min_sidebar_width(200.0)
         .max_sidebar_width(240.0)
+        // A narrow window opens on the page, not the sidebar.
+        .show_content(true)
         .build();
 
     // Toasts float over everything, so a report from a background action reaches
@@ -355,16 +391,22 @@ fn build_window(app: &adw::Application) {
     let toasts = adw::ToastOverlay::new();
     toasts.set_child(Some(&split));
 
+    let (startup_session, keyring_error) = match read_session() {
+        Ok(session) => (session, None),
+        Err(e) => (None, Some(e)),
+    };
     let ui = Rc::new(Ui {
         dirs,
         stack: stack.clone(),
         toasts: toasts.clone(),
         busy: Cell::new(0),
         opening: RefCell::new(HashSet::new()),
-        session: RefCell::new(auth::load().ok()),
+        session: RefCell::new(startup_session),
+        unlock_offered: Cell::new(false),
         mounted: RefCell::new(false),
         sidebar: sidebar_list.clone(),
         nav: split.clone(),
+        narrow: Cell::new(false),
         file_thumbs: FileThumbnailState::new(),
         login: login_widgets,
         status: StatusState {
@@ -394,6 +436,7 @@ fn build_window(app: &adw::Application) {
             theme_row: main_widgets.theme_row.clone(),
             online_map_row: main_widgets.online_map_row.clone(),
             tray_row: main_widgets.tray_row.clone(),
+            update_row: main_widgets.update_row.clone(),
             language_row: main_widgets.language_row.clone(),
             settings_suppress: Cell::new(false),
             budget_source: RefCell::new(None),
@@ -520,6 +563,7 @@ fn build_window(app: &adw::Application) {
             reload_pending: Cell::new(false),
             loading: Cell::new(false),
             has_more: Cell::new(false),
+            library: Cell::new(true),
             page_waiters: RefCell::new(Vec::new()),
             width: Cell::new(0),
             photo_tex: RefCell::new(HashMap::new()),
@@ -561,6 +605,8 @@ fn build_window(app: &adw::Application) {
                 detail: locations_widgets.card_detail.clone(),
                 pause: locations_widgets.pause.clone(),
                 paused: Cell::new(false),
+                sign_in: locations_widgets.card_sign_in.clone(),
+                restart: locations_widgets.card_restart.clone(),
             },
             queue: QueueState {
                 group: locations_widgets.queue_group.clone(),
@@ -613,8 +659,12 @@ fn build_window(app: &adw::Application) {
             running: Cell::new(false),
             dry_run: Cell::new(false),
         },
+        update,
     });
     wire_login(&ui);
+    if let Some(e) = keyring_error {
+        keyring_unreadable(&ui, &e);
+    }
     let ui_status = ui.clone();
     main_widgets
         .status_button
@@ -656,6 +706,7 @@ fn build_window(app: &adw::Application) {
     wire_activity(&ui, &activity_widgets);
     wire_takeout(&ui, &takeout_widgets);
     wire_retry(&ui);
+    wire_update(&ui);
 
     // Lazily load the Files / Photos pages the first time they're shown, so the
     // network round-trip only happens on demand rather than on every refresh.
@@ -692,13 +743,18 @@ fn build_window(app: &adw::Application) {
         }
     });
 
+    let saved = ui.dirs.load_config().window.usable();
     let window = adw::ApplicationWindow::builder()
         .application(app)
         .title("Proton Drive")
-        .default_width(980)
-        .default_height(680)
+        .default_width(saved.width)
+        .default_height(saved.height)
+        .maximized(saved.maximized)
+        .width_request(WindowState::MIN_WIDTH)
+        .height_request(WindowState::MIN_HEIGHT)
         .content(&toasts)
         .build();
+    remember_window_state(&ui, app, &window);
     // A wide window docks the details pane beside the files instead of laying it
     // over them.
     let wide = adw::Breakpoint::new(
@@ -706,6 +762,18 @@ fn build_window(app: &adw::Application) {
     );
     wide.add_setter(&ui.browser.split, "collapsed", Some(&false.to_value()));
     window.add_breakpoint(wide);
+    // A narrow window shows the sidebar and the page in turn, so every header
+    // bar keeps room for the window buttons. Signals rather than a setter:
+    // `refresh` decides the collapse while signed out, and would undo one.
+    let narrow = adw::Breakpoint::new(
+        adw::BreakpointCondition::parse("max-width: 760sp").expect("static breakpoint"),
+    );
+    narrow.add_setter(&ui.browser.search, "width-chars", Some(&8.to_value()));
+    let ui_narrow = ui.clone();
+    narrow.connect_apply(move |_| set_narrow(&ui_narrow, true));
+    let ui_wide = ui.clone();
+    narrow.connect_unapply(move |_| set_narrow(&ui_wide, false));
+    window.add_breakpoint(narrow);
     install_shortcuts(&ui, &window);
     install_window_actions(&ui, &window);
     install_launch_actions(&ui, app, &window);
@@ -719,6 +787,51 @@ fn build_window(app: &adw::Application) {
     window.present();
 }
 
+/// Follow the narrow breakpoint. While signed out the login page keeps the
+/// split collapsed whatever the width.
+fn set_narrow(ui: &Ui, narrow: bool) {
+    ui.narrow.set(narrow);
+    if ui.session.borrow().is_some() {
+        ui.nav.set_collapsed(narrow);
+    }
+}
+
+/// Save the window's size when it closes, and when the app quits with the
+/// window still open (Ctrl+Q, the tray's Quit), which never asks it to close.
+fn remember_window_state(ui: &Rc<Ui>, app: &adw::Application, window: &adw::ApplicationWindow) {
+    let ui_close = ui.clone();
+    window.connect_close_request(move |window| {
+        save_window_state(&ui_close, window);
+        glib::Propagation::Proceed
+    });
+    let ui_quit = ui.clone();
+    let window_quit = window.downgrade();
+    app.connect_shutdown(move |_| {
+        if let Some(window) = window_quit.upgrade() {
+            save_window_state(&ui_quit, &window);
+        }
+    });
+}
+
+/// Write the window's unmaximised size and maximised state to the config, if
+/// either changed. Runs as the window goes away, so a failure is only logged.
+fn save_window_state(ui: &Ui, window: &adw::ApplicationWindow) {
+    let (width, height) = window.default_size();
+    let state = WindowState {
+        width,
+        height,
+        maximized: window.is_maximized(),
+    };
+    let mut config = ui.dirs.load_config();
+    if config.window == state {
+        return;
+    }
+    config.window = state;
+    if let Err(e) = ui.dirs.save_config(&config) {
+        tracing::warn!("cannot save the window size: {e}");
+    }
+}
+
 /// Whether `window` is minimised or otherwise out of sight (another workspace,
 /// fully covered), as far as the compositor tells us.
 fn window_hidden(window: &adw::ApplicationWindow) -> bool {
@@ -765,10 +878,13 @@ const DESTINATIONS: [(&str, &str, &str); 7] = [
 /// Index of the first row in the sidebar's sync section.
 const SIDEBAR_SYNC_SECTION: i32 = 6;
 
-/// The navigation sidebar: the destinations over a footer carrying the sync
-/// status, the account quota and the account menu. Returns the page (for the
+/// The navigation sidebar: the destinations under the update banner and over a
+/// footer carrying the sync status, the account quota and the account menu. Returns the page (for the
 /// split view) and the list (to drive + reflect the current page).
-fn build_sidebar(footer: &gtk4::Box) -> (adw::NavigationPage, gtk4::ListBox) {
+fn build_sidebar(
+    footer: &gtk4::Box,
+    update_banner: &adw::Banner,
+) -> (adw::NavigationPage, gtk4::ListBox) {
     let list = gtk4::ListBox::new();
     list.set_selection_mode(gtk4::SelectionMode::Single);
     list.add_css_class("navigation-sidebar");
@@ -813,7 +929,6 @@ fn build_sidebar(footer: &gtk4::Box) -> (adw::NavigationPage, gtk4::ListBox) {
 
     let header = adw::HeaderBar::new();
     header.set_title_widget(Some(&brand));
-    header.pack_end(&build_primary_menu());
 
     let scroll = gtk4::ScrolledWindow::builder()
         .hscrollbar_policy(gtk4::PolicyType::Never)
@@ -822,6 +937,7 @@ fn build_sidebar(footer: &gtk4::Box) -> (adw::NavigationPage, gtk4::ListBox) {
         .build();
     let toolbar = adw::ToolbarView::new();
     toolbar.add_top_bar(&header);
+    toolbar.add_top_bar(update_banner);
     toolbar.set_content(Some(&scroll));
     toolbar.add_bottom_bar(footer);
 
@@ -847,6 +963,18 @@ fn set_busy_spinners(visible: bool) {
     });
 }
 
+/// `row` in a frame that scrolls sideways once the window is too narrow for it,
+/// so a row of labelled buttons never sets the window's minimum width.
+fn scroll_sideways(row: &impl IsA<gtk4::Widget>) -> gtk4::ScrolledWindow {
+    gtk4::ScrolledWindow::builder()
+        .hscrollbar_policy(gtk4::PolicyType::Automatic)
+        .vscrollbar_policy(gtk4::PolicyType::Never)
+        .propagate_natural_width(true)
+        .propagate_natural_height(true)
+        .child(row)
+        .build()
+}
+
 /// A destination page's frame: its own header bar over the page content, the
 /// way GNOME apps lay a split view out. The title sits in the middle with the
 /// busy spinner beside it; the page packs its actions into the returned header
@@ -910,6 +1038,14 @@ fn wire_sidebar(ui: &Rc<Ui>) {
             ui_row.stack.set_visible_child_name(page);
         }
     });
+    // In a narrow window the sidebar covers the page, so picking a row, even
+    // the selected one, has to bring the page forward.
+    let ui_open = ui.clone();
+    ui.sidebar.connect_row_activated(move |_, _| {
+        if ui_open.nav.is_collapsed() {
+            ui_open.nav.set_show_content(true);
+        }
+    });
 }
 
 /// Re-fetch the visible page from the server, bypassing every layer of cache
@@ -1045,8 +1181,17 @@ pub(crate) fn set_sidebar_badge(ui: &Ui, page: &str, count: u64) {
 /// Show a transient toast. Non-blocking by design: an action's outcome is
 /// reported without stealing focus or forcing a click, so the user can keep
 /// working while a slow upload lands.
+///
+/// A toast's title is Pango markup unless told otherwise. Messages carry file
+/// names and daemon errors, and one with a `&` or `<` in it showed as an empty
+/// toast, so every toast here is plain text.
 fn toast(ui: &Rc<Ui>, message: &str) {
-    ui.toasts.add_toast(adw::Toast::new(message));
+    ui.toasts.add_toast(
+        adw::Toast::builder()
+            .title(message)
+            .use_markup(false)
+            .build(),
+    );
 }
 
 /// Show a toast that offers one follow-up action — an Undo, or a way to the page
@@ -1057,6 +1202,7 @@ fn toast(ui: &Rc<Ui>, message: &str) {
 fn toast_action(ui: &Rc<Ui>, message: &str, label: &str, action: impl Fn(&Rc<Ui>) + 'static) {
     let toast = adw::Toast::builder()
         .title(message)
+        .use_markup(false)
         .button_label(label)
         .timeout(8)
         .build();
@@ -1079,7 +1225,11 @@ fn toast_error(ui: &Rc<Ui>, what: &str, detail: &str) {
         gettext_f("{what}: {detail}", &[("what", what), ("detail", detail)])
     };
     tracing::warn!("{message}");
-    let toast = adw::Toast::builder().title(&message).timeout(6).build();
+    let toast = adw::Toast::builder()
+        .title(&message)
+        .use_markup(false)
+        .timeout(6)
+        .build();
     ui.toasts.add_toast(toast);
 }
 
@@ -1136,25 +1286,7 @@ fn toast_failure(ui: &Rc<Ui>, what: &str, message: &str, kind: ErrorKind) {
     }
 }
 
-/// The sidebar's primary (hamburger) menu: the app-level entries that don't
-/// belong on any one page.
-fn build_primary_menu() -> gtk4::MenuButton {
-    let menu = gio::Menu::new();
-    menu.append(Some(&gettext("Preferences")), Some("win.preferences"));
-    menu.append(Some(&gettext("Keyboard Shortcuts")), Some("win.shortcuts"));
-    menu.append(
-        Some(&gettext("About Proton Drive for Linux")),
-        Some("win.about"),
-    );
-    gtk4::MenuButton::builder()
-        .icon_name("pdfs-menu-symbolic")
-        .tooltip_text(gettext("Main menu"))
-        .primary(true)
-        .menu_model(&menu)
-        .build()
-}
-
-/// Back the primary and account menus' entries with window actions.
+/// Back the main menu's entries with window actions.
 fn install_window_actions(ui: &Rc<Ui>, window: &adw::ApplicationWindow) {
     let preferences = gio::SimpleAction::new("preferences", None);
     let ui_prefs = ui.clone();
@@ -1206,7 +1338,7 @@ fn install_window_actions(ui: &Rc<Ui>, window: &adw::ApplicationWindow) {
         let dialog = adw::AboutDialog::builder()
             .application_name(gettext("Proton Drive for Linux"))
             .application_icon("io.narl.proton-drive-linux")
-            .version(pdfs_core::config::APP_VERSION)
+            .version(env!("CARGO_PKG_VERSION"))
             .developer_name("Nils Pukropp")
             .website("https://proton-drive.narl.io")
             .issue_url("https://github.com/narrrl/proton-drive-linux/issues")
@@ -1291,6 +1423,12 @@ fn install_launch_actions(ui: &Rc<Ui>, app: &adw::Application, window: &adw::App
         if ui_page.session.borrow().is_none() {
             return;
         }
+        // Signed in, but Proton refused the session (the tray's "Sign In
+        // Again…"): the login page, with the rest of the app still reachable.
+        if page == "login" {
+            show_login(&ui_page);
+            return;
+        }
         // Activity lives on as the Sync page's History view.
         if page == "activity" {
             ui_page.locations.views.set_visible_child_name("history");
@@ -1346,8 +1484,8 @@ fn debug_info(ui: &Rc<Ui>) -> String {
     format!(
         "App version: {}\nUser agent: {}\nlibadwaita: {}.{}.{}\nGTK: {}.{}.{}\n\
          Mountpoint: {}\nControl socket: {}\nMount service running: {}\n",
-        pdfs_core::config::APP_VERSION,
-        pdfs_core::config::USER_AGENT,
+        config.resolved_app_version(),
+        config.resolved_user_agent(),
         adw::major_version(),
         adw::minor_version(),
         adw::micro_version(),
@@ -1691,9 +1829,12 @@ pub(crate) fn flash_copied(button: &gtk4::Button, icon: &'static str) {
 
 /// Open a local path with the handler the user configured — `xdg-open` unless
 /// `open_with` in `config.json` overrides it for this kind of file.
+///
+/// On a thread of its own: telling a folder from a file is a `stat`, and the
+/// path is often in the mount, which may hang.
 fn open_path(path: &str) {
-    let path = Path::new(path);
-    pdfs_core::opener::open_default(path, path.is_dir());
+    let path = PathBuf::from(path);
+    std::thread::spawn(move || pdfs_core::opener::open_default(&path, path.is_dir()));
 }
 
 /// [`open_path`] for a file the daemon materialised into the content cache,

crates/pdfs-gui/src/app/pages/activity.rs

@@ -378,7 +378,9 @@ pub(crate) fn activity_status(
 ) {
     ui.activity.status.set_icon_name(Some(icon));
     ui.activity.status.set_title(title);
-    ui.activity.status.set_description(Some(description));
+    ui.activity
+        .status
+        .set_description(Some(&gtk4::glib::markup_escape_text(description)));
     ui.activity.retry.set_visible(retry);
     ui.activity.content.set_visible_child_name("status");
 }
@@ -1041,6 +1043,7 @@ pub(crate) fn activity_icon(kind: ActivityKind) -> &'static str {
         ActivityKind::Sync => "pdfs-sync-symbolic",
         ActivityKind::Rename => "document-edit-symbolic",
         ActivityKind::Move => "go-jump-symbolic",
+        ActivityKind::Copy => "edit-copy-symbolic",
         ActivityKind::CreateFolder => "folder-new-symbolic",
         ActivityKind::Trash => "user-trash-symbolic",
         ActivityKind::DeleteForever | ActivityKind::EmptyTrash => "edit-delete-symbolic",

crates/pdfs-gui/src/app/pages/activity_text.rs

@@ -179,6 +179,10 @@ pub(crate) fn activity_title(kind: ActivityKind, ok: bool, name: &str) -> String
         (ActivityKind::Move, true) => gettext_f("Moved {name}", &args),
         // Translators: {name} is a file or folder name.
         (ActivityKind::Move, false) => gettext_f("Couldn't move {name}", &args),
+        // Translators: {name} is a file or folder name.
+        (ActivityKind::Copy, true) => gettext_f("Copied {name}", &args),
+        // Translators: {name} is a file or folder name.
+        (ActivityKind::Copy, false) => gettext_f("Couldn't copy {name}", &args),
         // Translators: {name} is a folder name.
         (ActivityKind::CreateFolder, true) => gettext_f("Created folder {name}", &args),
         // Translators: {name} is a folder name.
@@ -341,6 +345,59 @@ fn detail_label(entry: &ActivityEntry) -> Option<String> {
             &[("name", alt)],
         ));
     }
+    if let Some((reason, copy)) = detail.split_once("; local changes uploaded as ") {
+        let args = [("name", copy)];
+        return Some(match edit_conflict(reason) {
+            // Translators: {name} is the copy the changes made on this
+            // computer were uploaded as.
+            EditConflict::Gone => gettext_f(
+                "It no longer exists on Proton Drive, so your changes were uploaded as {name}",
+                &args,
+            ),
+            // Translators: {name} is the copy the changes made on this
+            // computer were uploaded as.
+            EditConflict::Trashed => gettext_f(
+                "It was moved to the Trash on Proton Drive, so your changes were uploaded as {name}",
+                &args,
+            ),
+            // Translators: {name} is the copy the changes made on this
+            // computer were uploaded as.
+            EditConflict::Changed => gettext_f(
+                "It was changed on Proton Drive, so your changes were uploaded as {name}",
+                &args,
+            ),
+            // Translators: {name} is the copy the changes made on this
+            // computer were uploaded as.
+            EditConflict::Other => gettext_f("Your changes were uploaded as {name}", &args),
+        });
+    }
+    if let Some((reason, path)) = detail.split_once("; local changes kept at ") {
+        let path = tilde_path(path);
+        let args = [("path", path.as_str())];
+        return Some(match edit_conflict(reason) {
+            // Translators: {path} is the file on this computer that holds the
+            // changes which could not be uploaded.
+            EditConflict::Gone => gettext_f(
+                "It no longer exists on Proton Drive, so your changes were kept in {path}",
+                &args,
+            ),
+            // Translators: {path} is the file on this computer that holds the
+            // changes which could not be uploaded.
+            EditConflict::Trashed => gettext_f(
+                "It was moved to the Trash on Proton Drive, so your changes were kept in {path}",
+                &args,
+            ),
+            // Translators: {path} is the file on this computer that holds the
+            // changes which could not be uploaded.
+            EditConflict::Changed => gettext_f(
+                "It was changed on Proton Drive, so your changes were kept in {path}",
+                &args,
+            ),
+            // Translators: {path} is the file on this computer that holds the
+            // changes which could not be uploaded.
+            EditConflict::Other => gettext_f("Your changes were kept in {path}", &args),
+        });
+    }
     if let Some(base) = detail.strip_prefix("differs from ") {
         // Translators: {name} is the file the conflicting copy was made from.
         return Some(gettext_f("Differs from {name}", &[("name", base)]));
@@ -388,6 +445,26 @@ fn detail_label(entry: &ActivityEntry) -> Option<String> {
     Some(capitalize(detail))
 }
 
+/// Why a queued edit could not land on its file, from the reason the daemon
+/// gives before "; local changes uploaded as" or "; local changes kept at".
+enum EditConflict {
+    Gone,
+    Trashed,
+    Changed,
+    Other,
+}
+
+fn edit_conflict(reason: &str) -> EditConflict {
+    match reason {
+        "the file no longer exists remotely" => EditConflict::Gone,
+        "the file was trashed remotely" => EditConflict::Trashed,
+        r if r.starts_with("the remote revision changed under the queued write") => {
+            EditConflict::Changed
+        }
+        _ => EditConflict::Other,
+    }
+}
+
 /// A sync pass summary such as "2 uploaded, 1 folder(s) created", as a
 /// list of counts. `None` when a part is not one the daemon writes.
 fn sync_summary(detail: &str) -> Option<String> {
@@ -596,6 +673,38 @@ mod tests {
         assert_eq!(d.details, vec!["1 person can view"]);
     }
 
+    #[test]
+    fn an_edit_kept_as_a_copy_says_why_in_words() {
+        let d = describe(&entry(
+            ActivityKind::Upload,
+            "notes.txt",
+            "the remote revision changed under the queued write \
+             (based on revision r1, remote now at r2); \
+             local changes uploaded as notes (sync-conflict 1700000000).txt",
+            false,
+        ));
+        assert_eq!(
+            d.details,
+            vec![
+                "It was changed on Proton Drive, so your changes were uploaded as \
+                 notes (sync-conflict 1700000000).txt"
+            ]
+        );
+        let d = describe(&entry(
+            ActivityKind::Upload,
+            "notes.txt",
+            "the file was trashed remotely; local changes kept at /var/staging/7",
+            false,
+        ));
+        assert_eq!(
+            d.details,
+            vec![
+                "It was moved to the Trash on Proton Drive, so your changes were kept in \
+                 /var/staging/7"
+            ]
+        );
+    }
+
     #[test]
     fn unknown_details_show_as_written() {
         let d = describe(&entry(

crates/pdfs-gui/src/app/pages/albums.rs

@@ -645,7 +645,9 @@ pub(crate) fn close_album(ui: &Rc<Ui>) {
 fn albums_status(ui: &Rc<Ui>, icon: &str, title: &str, description: &str) {
     ui.gallery.albums_status.set_icon_name(Some(icon));
     ui.gallery.albums_status.set_title(title);
-    ui.gallery.albums_status.set_description(Some(description));
+    ui.gallery
+        .albums_status
+        .set_description(Some(&gtk4::glib::markup_escape_text(description)));
     ui.gallery.albums_stack.set_visible_child_name("status");
 }
 

crates/pdfs-gui/src/app/pages/browser.rs

@@ -1,4 +1,4 @@
-use crate::activation::{DriveActivation, drive_activation, mounted_path, mounted_target_rel};
+use crate::activation::{DriveActivation, drive_activation, mounted_path, present_within};
 use crate::*;
 
 pub(crate) struct BrowserState {
@@ -376,7 +376,7 @@ pub(crate) fn build_browser_page() -> (gtk4::Widget, BrowserWidgets) {
     bulk_box.append(&bulk_clear);
     let bulk = gtk4::Revealer::builder()
         .transition_type(gtk4::RevealerTransitionType::SlideDown)
-        .child(&bulk_box)
+        .child(&scroll_sideways(&bulk_box))
         .build();
 
     // The status bar: contextual text (stretch 1), then the icon-size slider.
@@ -500,7 +500,9 @@ pub(crate) fn build_browser_page() -> (gtk4::Widget, BrowserWidgets) {
 pub(crate) fn browser_status(ui: &Rc<Ui>, icon: &str, title: &str, description: &str, retry: bool) {
     ui.browser.status.set_icon_name(Some(icon));
     ui.browser.status.set_title(title);
-    ui.browser.status.set_description(Some(description));
+    ui.browser
+        .status
+        .set_description(Some(&gtk4::glib::markup_escape_text(description)));
     ui.browser.retry.set_visible(retry);
     // Only the empty-folder state offers a way to fill the folder; every other
     // status (loading, offline, error) turns them back off.
@@ -520,9 +522,9 @@ pub(crate) fn clear_selection(ui: &Rc<Ui>) {
 }
 
 /// Reflect the current selection in the bulk bar: how many are selected, and
-/// which bulk actions apply to that mix. Offline state is a file-only notion, so
-/// a folder anywhere in the selection disables the two pin buttons rather than
-/// half-failing once pressed.
+/// which bulk actions apply to that mix. An entry kept offline through a pinned
+/// folder above it cannot be made online only on its own, so it does not count
+/// towards Make online only.
 pub(crate) fn sync_bulk_bar(ui: &Rc<Ui>) {
     let entries = selected_entries(ui);
     // One selected entry is the details pane's job; the bar is for a batch.
@@ -530,8 +532,7 @@ pub(crate) fn sync_bulk_bar(ui: &Rc<Ui>) {
         ui.browser.bulk.set_reveal_child(false);
         return;
     }
-    let files_only = entries.iter().all(|e| !e.is_dir);
-    let any_pinned = entries.iter().any(|e| e.pinned);
+    let any_pinned = entries.iter().any(|e| e.pinned && !e.pinned_by_folder);
     let any_unpinned = entries.iter().any(|e| !e.pinned);
     let mounted = *ui.mounted.borrow();
     ui.browser.bulk_label.set_label(&ngettext_f(
@@ -541,12 +542,8 @@ pub(crate) fn sync_bulk_bar(ui: &Rc<Ui>) {
         &[],
     ));
     ui.browser.bulk_trash.set_sensitive(mounted);
-    ui.browser
-        .bulk_pin
-        .set_sensitive(mounted && files_only && any_unpinned);
-    ui.browser
-        .bulk_unpin
-        .set_sensitive(mounted && files_only && any_pinned);
+    ui.browser.bulk_pin.set_sensitive(mounted && any_unpinned);
+    ui.browser.bulk_unpin.set_sensitive(mounted && any_pinned);
     ui.browser.bulk.set_reveal_child(true);
 }
 
@@ -652,16 +649,19 @@ pub(crate) fn restore_uids(ui: &Rc<Ui>, uids: Vec<String>, count: usize) {
     );
 }
 
-/// Pin or unpin every selected file, one request at a time.
+/// Pin or unpin every selected entry, one request at a time. A folder's files
+/// download in the background, so its request returns before they are there.
 pub(crate) fn run_bulk_pin(ui: &Rc<Ui>, entries: Vec<DirEntry>, pin: bool) {
     let socket = ui.dirs.control_socket();
     // Only the entries that need changing: re-pinning an already-pinned file is
-    // a wasted round-trip, and it would inflate the count the toast reports.
-    let paths: Vec<String> = entries
+    // a wasted round-trip, and it would inflate the count the toast reports. One
+    // kept through a pinned folder above it has no pin of its own to remove.
+    let changing: Vec<&DirEntry> = entries
         .iter()
-        .filter(|e| !e.is_dir && e.pinned != pin)
-        .map(|e| entry_rel(ui, e))
+        .filter(|e| !e.pinned_by_folder && e.pinned != pin)
         .collect();
+    let any_folder = changing.iter().any(|e| e.is_dir);
+    let paths: Vec<String> = changing.iter().map(|e| entry_rel(ui, e)).collect();
     if paths.is_empty() {
         return;
     }
@@ -698,13 +698,27 @@ pub(crate) fn run_bulk_pin(ui: &Rc<Ui>, entries: Vec<DirEntry>, pin: bool) {
             (0, None) => {}
             (n, _) => toast(
                 &ui,
-                &if pin {
+                &if pin && any_folder {
+                    ngettext_f(
+                        "Making {n} item available offline…",
+                        "Making {n} items available offline…",
+                        n as u64,
+                        &[],
+                    )
+                } else if pin {
                     ngettext_f(
                         "{n} file is now available offline",
                         "{n} files are now available offline",
                         n as u64,
                         &[],
                     )
+                } else if any_folder {
+                    ngettext_f(
+                        "{n} item is now online only",
+                        "{n} items are now online only",
+                        n as u64,
+                        &[],
+                    )
                 } else {
                     ngettext_f(
                         "{n} file is now online only",
@@ -832,8 +846,8 @@ fn show_location_column(ui: &Rc<Ui>, visible: bool) {
     }
 }
 
-/// The menu for one entry, in the order of `docs/UI_UX_PLAN.md` §6: open,
-/// offline, sharing, organising, and the destructive item last on its own.
+/// The menu for one entry, in a fixed order: open, offline, sharing,
+/// organising, and the destructive item last on its own.
 pub(crate) fn entry_context_menu(ui: &Rc<Ui>, entry: &DirEntry) -> ActionMenu {
     let mut menu = ActionMenu::new();
     let (ui_c, entry_c) = (ui.clone(), entry.clone());
@@ -860,13 +874,17 @@ pub(crate) fn entry_context_menu(ui: &Rc<Ui>, entry: &DirEntry) -> ActionMenu {
     }
     menu.section();
 
-    if !entry.is_dir {
+    // Kept through a pinned folder above it, the entry has no pin of its own
+    // to remove: the check shows that state without offering to change it.
+    if entry.pinned_by_folder {
+        menu.locked_toggle(&gettext("Available offline"), true);
+    } else {
         let (ui_c, entry_c) = (ui.clone(), entry.clone());
         menu.toggle(&gettext("Available offline"), entry.pinned, move |_| {
             toggle_pin(&ui_c, &entry_c)
         });
-        menu.section();
     }
+    menu.section();
 
     let (ui_c, entry_c) = (ui.clone(), entry.clone());
     menu.item(&gettext("Share…"), move || {
@@ -886,6 +904,12 @@ pub(crate) fn entry_context_menu(ui: &Rc<Ui>, entry: &DirEntry) -> ActionMenu {
     menu.item(&gettext("Move To…"), move || {
         prompt_move(&ui_c, vec![entry_c.clone()])
     });
+    let (ui_c, entry_c) = (ui.clone(), entry.clone());
+    menu.item(&gettext("Make a Copy"), move || make_copy(&ui_c, &entry_c));
+    let (ui_c, entry_c) = (ui.clone(), entry.clone());
+    menu.item(&gettext("Copy To…"), move || {
+        prompt_copy(&ui_c, vec![entry_c.clone()])
+    });
     if !entry.is_dir {
         let (ui_c, entry_c) = (ui.clone(), entry.clone());
         menu.item(&gettext("Versions…"), move || {
@@ -908,9 +932,8 @@ pub(crate) fn entry_context_menu(ui: &Rc<Ui>, entry: &DirEntry) -> ActionMenu {
 /// simply absent here rather than offered and then refused.
 pub(crate) fn bulk_context_menu(ui: &Rc<Ui>, entries: Vec<DirEntry>) -> ActionMenu {
     let mut menu = ActionMenu::new();
-    // Offline state is a file-only notion; the check shows whether the whole
-    // batch already is.
-    if entries.iter().all(|e| !e.is_dir) {
+    // The check shows whether the whole batch already is offline.
+    {
         let (ui_c, batch) = (ui.clone(), entries.clone());
         let all_pinned = entries.iter().all(|e| e.pinned);
         menu.toggle(&gettext("Available offline"), all_pinned, move |pin| {
@@ -921,6 +944,10 @@ pub(crate) fn bulk_context_menu(ui: &Rc<Ui>, entries: Vec<DirEntry>) -> ActionMe
     menu.item(&gettext("Move To…"), move || {
         prompt_move(&ui_c, batch.clone())
     });
+    let (ui_c, batch) = (ui.clone(), entries.clone());
+    menu.item(&gettext("Copy To…"), move || {
+        prompt_copy(&ui_c, batch.clone())
+    });
     menu.labelled_section(&ngettext_f(
         "{n} selected",
         "{n} selected",
@@ -966,28 +993,27 @@ pub(crate) fn background_context_menu(ui: &Rc<Ui>) -> ActionMenu {
 pub(crate) fn open_entry_with(ui: &Rc<Ui>, entry: &DirEntry) {
     let rel = entry_rel(ui, entry);
     let mountpoint = ui.dirs.resolved_mountpoint(&ui.dirs.load_config());
-    let Some(path) = mounted_target_rel(&mountpoint, &rel) else {
-        toast_error(
-            ui,
-            &gettext("Couldn't open file"),
-            &gettext("Open With needs the Proton Drive service to be running."),
-        );
-        return;
-    };
-    let launcher = gtk4::FileLauncher::new(Some(&gio::File::for_path(path)));
-    launcher.set_always_ask(true);
     let ui = ui.clone();
-    launcher.launch(
-        ui_window(&ui).as_ref(),
-        gio::Cancellable::NONE,
-        move |result| {
+    glib::spawn_future_local(async move {
+        let Some(path) = present_within(mounted_path(&mountpoint, &rel)).await else {
+            toast_error(
+                &ui,
+                &gettext("Couldn't open file"),
+                &gettext("Open With needs the Proton Drive service to be running."),
+            );
+            return;
+        };
+        let launcher = gtk4::FileLauncher::new(Some(&gio::File::for_path(path)));
+        launcher.set_always_ask(true);
+        let window = ui_window(&ui);
+        launcher.launch(window.as_ref(), gio::Cancellable::NONE, move |result| {
             if let Err(e) = result
                 && !e.matches(gtk4::DialogError::Dismissed)
             {
                 toast_error(&ui, &gettext("Couldn't open file"), &e.to_string());
             }
-        },
-    );
+        });
+    });
 }
 
 /// Copy the entry's public link, when it has one this client can read the
@@ -1095,27 +1121,29 @@ pub(crate) fn activate_entry(ui: &Rc<Ui>, entry: &DirEntry) {
 /// [`mounted_target`](crate::activation::mounted_target).
 pub(crate) fn download_and_open(ui: &Rc<Ui>, entry: &DirEntry) {
     let rel = entry_rel(ui, entry);
-    let mountpoint = ui.dirs.resolved_mountpoint(&ui.dirs.load_config());
-    if let Some(path) = mounted_target_rel(&mountpoint, &rel) {
-        open_path(&path.to_string_lossy());
-        return;
-    }
-    // Ignore a repeat activation of a file already downloading, so an impatient
-    // double-click doesn't kick off a second round-trip.
+    // Ignore a repeat activation of a file already opening, so an impatient
+    // double-click doesn't open it twice or kick off a second round-trip.
     if !ui.opening.borrow_mut().insert(rel.clone()) {
         return;
     }
-    ui.busy_begin();
-    let name = entry.name.clone();
-    let rx = spawn_request(
-        ui.dirs.control_socket(),
-        Request::OpenFile {
-            path: rel.clone(),
-            uid: Some(entry.uid.clone()),
-        },
-    );
+    let mountpoint = ui.dirs.resolved_mountpoint(&ui.dirs.load_config());
+    let (name, uid) = (entry.name.clone(), entry.uid.clone());
     let ui = ui.clone();
     glib::spawn_future_local(async move {
+        // Asked off the main thread: a mount that hangs used to hang the app.
+        if let Some(path) = present_within(mounted_path(&mountpoint, &rel)).await {
+            ui.opening.borrow_mut().remove(&rel);
+            open_path(&path.to_string_lossy());
+            return;
+        }
+        ui.busy_begin();
+        let rx = spawn_request(
+            ui.dirs.control_socket(),
+            Request::OpenFile {
+                path: rel.clone(),
+                uid: Some(uid),
+            },
+        );
         let result = rx.recv().await;
         ui.busy_end();
         ui.opening.borrow_mut().remove(&rel);
@@ -1147,6 +1175,7 @@ pub(crate) fn toggle_pin(ui: &Rc<Ui>, entry: &DirEntry) {
     let rx = spawn_request(ui.dirs.control_socket(), req);
     let name = entry.name.clone();
     let pinned = entry.pinned;
+    let is_dir = entry.is_dir;
     let ui = ui.clone();
     glib::spawn_future_local(async move {
         match rx.recv().await {
@@ -1166,6 +1195,9 @@ pub(crate) fn toggle_pin(ui: &Rc<Ui>, entry: &DirEntry) {
                     &ui,
                     &if pinned {
                         gettext_f("“{name}” is now online only", &[("name", &name)])
+                    } else if is_dir {
+                        // The daemon downloads a folder's files in the background.
+                        gettext_f("Making “{name}” available offline…", &[("name", &name)])
                     } else {
                         gettext_f("“{name}” is now available offline", &[("name", &name)])
                     },
@@ -1220,9 +1252,7 @@ pub(crate) fn repaint_crumb(ui: &Rc<Ui>, path: &str) {
     ));
     let mut acc = String::new();
     for (i, seg) in segments.iter().enumerate() {
-        let sep = gtk4::Label::new(Some("›"));
-        sep.add_css_class("dim-label");
-        ui.browser.crumb.append(&sep);
+        ui.browser.crumb.append(&crumb_separator());
         acc = if acc.is_empty() {
             seg.to_string()
         } else {
@@ -1237,12 +1267,7 @@ pub(crate) fn repaint_crumb(ui: &Rc<Ui>, path: &str) {
 /// flat button that navigates to `target` (clearing any active search first).
 pub(crate) fn crumb_node(ui: &Rc<Ui>, label: &str, target: &str, current: bool) -> gtk4::Widget {
     if current {
-        let l = gtk4::Label::builder()
-            .label(label)
-            .ellipsize(gtk4::pango::EllipsizeMode::Start)
-            .build();
-        l.add_css_class("heading");
-        return l.upcast();
+        return crumb_current(label);
     }
     let button = gtk4::Button::builder().label(label).build();
     button.add_css_class("flat");
@@ -1925,17 +1950,63 @@ pub(crate) fn prompt_rename(ui: &Rc<Ui>, entry: &DirEntry) {
 /// still made on Proton Drive, so nothing is downloaded or uploaded again; it
 /// is sent with absolute paths, which is how the daemon tells locations apart.
 pub(crate) fn prompt_move(ui: &Rc<Ui>, entries: Vec<DirEntry>) {
+    prompt_destination(ui, entries, PickerKind::Move);
+}
+
+/// Ask where to copy `entries`, then copy them there on Proton Drive. Only
+/// My files is offered: a copy is made on the server, inside the mount.
+pub(crate) fn prompt_copy(ui: &Rc<Ui>, entries: Vec<DirEntry>) {
+    prompt_destination(ui, entries, PickerKind::Copy);
+}
+
+/// Copy one entry into the folder it is in. The copy gets a free name, such
+/// as "report (1).pdf".
+pub(crate) fn make_copy(ui: &Rc<Ui>, entry: &DirEntry) {
+    let source = entry_rel(ui, entry);
+    let parent = source
+        .rfind('/')
+        .map(|i| source[..i].to_string())
+        .unwrap_or_default();
+    run_bulk_copy(ui, vec![source], parent);
+}
+
+/// What the folder picker chooses a destination for.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(crate) enum PickerKind {
+    Move,
+    Copy,
+}
+
+fn prompt_destination(ui: &Rc<Ui>, entries: Vec<DirEntry>, kind: PickerKind) {
     if entries.is_empty() {
         return;
     }
     let sources: Vec<String> = entries.iter().map(|e| entry_rel(ui, e)).collect();
-    let heading = match entries.as_slice() {
-        [one] => gettext_f("Move “{name}”", &[("name", &one.name)]),
-        many => ngettext_f("Move {n} item", "Move {n} items", many.len() as u64, &[]),
+    let (heading, body, confirm) = match (kind, entries.as_slice()) {
+        (PickerKind::Move, [one]) => (
+            gettext_f("Move “{name}”", &[("name", &one.name)]),
+            gettext("Choose the folder to move into."),
+            gettext("Move Here"),
+        ),
+        (PickerKind::Move, many) => (
+            ngettext_f("Move {n} item", "Move {n} items", many.len() as u64, &[]),
+            gettext("Choose the folder to move into."),
+            gettext("Move Here"),
+        ),
+        (PickerKind::Copy, [one]) => (
+            gettext_f("Copy “{name}”", &[("name", &one.name)]),
+            gettext("Choose the folder to copy into."),
+            gettext("Copy Here"),
+        ),
+        (PickerKind::Copy, many) => (
+            ngettext_f("Copy {n} item", "Copy {n} items", many.len() as u64, &[]),
+            gettext("Choose the folder to copy into."),
+            gettext("Copy Here"),
+        ),
     };
     let dialog = adw::AlertDialog::builder()
         .heading(heading)
-        .body(gettext("Choose the folder to move into."))
+        .body(body)
         .build();
 
     let up = gtk4::Button::builder()
@@ -1966,7 +2037,7 @@ pub(crate) fn prompt_move(ui: &Rc<Ui>, entries: Vec<DirEntry>) {
     body.append(&scroll);
     dialog.set_extra_child(Some(&body));
     dialog.add_response("cancel", &gettext("Cancel"));
-    dialog.add_response("move", &gettext("Move Here"));
+    dialog.add_response("move", &confirm);
     dialog.set_response_appearance("move", adw::ResponseAppearance::Suggested);
     dialog.set_default_response(Some("move"));
     dialog.set_close_response("cancel");
@@ -1979,6 +2050,7 @@ pub(crate) fn prompt_move(ui: &Rc<Ui>, entries: Vec<DirEntry>) {
         list,
         up: up.clone(),
         sources: sources.clone(),
+        kind,
         folder: RefCell::new(MoveTarget::Locations),
         generation: Cell::new(0),
     });
@@ -1998,6 +2070,10 @@ pub(crate) fn prompt_move(ui: &Rc<Ui>, entries: Vec<DirEntry>) {
         }
         match picker_done.folder.borrow().clone() {
             MoveTarget::Locations => {}
+            MoveTarget::Drive(folder) if kind == PickerKind::Copy => {
+                run_bulk_copy(&ui, sources.clone(), folder)
+            }
+            MoveTarget::Synced { .. } if kind == PickerKind::Copy => {}
             MoveTarget::Drive(folder) => run_bulk_move(&ui, sources.clone(), folder),
             MoveTarget::Synced { path, .. } => {
                 let absolute = sources
@@ -2073,8 +2149,9 @@ struct MovePicker {
     location: gtk4::Label,
     list: gtk4::ListBox,
     up: gtk4::Button,
-    /// What is being moved, mountpoint-relative.
+    /// What is being moved or copied, mountpoint-relative.
     sources: Vec<String>,
+    kind: PickerKind,
     /// The folder on show, and the destination if the user confirms now.
     folder: RefCell<MoveTarget>,
     /// Drops a listing that arrives after the user went elsewhere.
@@ -2095,11 +2172,13 @@ impl MovePicker {
         self.location.set_tooltip_text(Some(&tooltip));
         self.up
             .set_sensitive(!matches!(folder, MoveTarget::Locations));
-        let allowed = match &folder {
-            MoveTarget::Locations => false,
-            MoveTarget::Drive(rel) => move_target_allowed(&self.sources, rel),
+        let allowed = match (&folder, self.kind) {
+            (MoveTarget::Locations, _) => false,
+            (MoveTarget::Drive(rel), PickerKind::Move) => move_target_allowed(&self.sources, rel),
+            (MoveTarget::Drive(rel), PickerKind::Copy) => copy_target_allowed(&self.sources, rel),
             // What is moved is in My files, so it cannot be in a synced folder.
-            MoveTarget::Synced { .. } => true,
+            (MoveTarget::Synced { .. }, PickerKind::Move) => true,
+            (MoveTarget::Synced { .. }, PickerKind::Copy) => false,
         };
         self.dialog.set_response_enabled("move", allowed);
         *self.folder.borrow_mut() = folder.clone();
@@ -2165,6 +2244,10 @@ impl MovePicker {
     /// My files and every synced folder, as rows of the top level.
     async fn locations(&self) -> Option<Vec<PickerRow>> {
         let mut rows = vec![(gettext("My files"), None, MoveTarget::Drive(String::new()))];
+        // A copy is made on the server, so it can only land in My files.
+        if self.kind == PickerKind::Copy {
+            return Some(rows);
+        }
         let rx = spawn_request(self.ui.dirs.control_socket(), Request::ListSyncFolders);
         let Ok(Ok(Response::SyncFolders { mut items })) = rx.recv().await else {
             // My files alone is still somewhere to move to.
@@ -2271,11 +2354,16 @@ pub(crate) fn move_target_allowed(sources: &[String], target: &str) -> bool {
             .map(|i| path[..i].to_string())
             .unwrap_or_default()
     };
-    let inside = sources
-        .iter()
-        .any(|src| target == src || target.starts_with(&format!("{src}/")));
     let all_here = sources.iter().all(|src| parent(src) == target);
-    !inside && !all_here
+    copy_target_allowed(sources, target) && !all_here
+}
+
+/// Whether `target` is somewhere `sources` can be copied to: anywhere but into
+/// one of themselves. The folder they are in is fine; the copy gets a free name.
+pub(crate) fn copy_target_allowed(sources: &[String], target: &str) -> bool {
+    !sources
+        .iter()
+        .any(|src| target == src || target.starts_with(&format!("{src}/")))
 }
 
 /// Move each of `sources` into `target`, one request at a time, then report
@@ -2294,38 +2382,14 @@ pub(crate) fn run_bulk_move(ui: &Rc<Ui>, sources: Vec<String>, target: String) {
     clear_selection(ui);
     let ui = ui.clone();
     glib::spawn_future_local(async move {
-        let mut done = 0usize;
-        let mut failure: Option<(String, ErrorKind)> = None;
-        for path in sources {
-            let rx = spawn_request(
-                socket.clone(),
-                Request::Move {
-                    path,
-                    new_parent: target.clone(),
-                },
-            );
-            match rx.recv().await {
-                Ok(Ok(Response::Ok { .. })) => done += 1,
-                Ok(Ok(Response::Error { message, kind })) => {
-                    failure.get_or_insert((message, kind));
-                }
-                _ => {
-                    failure.get_or_insert_with(|| {
-                        (
-                            gettext("The Proton Drive service didn't respond."),
-                            ErrorKind::Internal,
-                        )
-                    });
-                }
-            }
-        }
+        let (done, failure) = send_each(&socket, sources, |path| Request::Move {
+            path,
+            new_parent: target.clone(),
+        })
+        .await;
         ui.busy_end();
         reload_listing(&ui);
-        let place = match target.rsplit('/').next() {
-            // Translators: a folder name in quotes, filled in as {place} in "Moved to {place}".
-            Some(name) if !name.is_empty() => gettext_f("“{name}”", &[("name", name)]),
-            _ => "Proton Drive".to_string(),
-        };
+        let place = quoted_place(&target);
         match (done, failure) {
             (0, Some((message, kind))) => {
                 toast_failure(&ui, &gettext("Couldn't move"), &message, kind)
@@ -2358,6 +2422,101 @@ pub(crate) fn run_bulk_move(ui: &Rc<Ui>, sources: Vec<String>, target: String) {
     });
 }
 
+/// Copy each of `sources` into `target` on Proton Drive, one request at a
+/// time, then report once for the lot.
+pub(crate) fn run_bulk_copy(ui: &Rc<Ui>, sources: Vec<String>, target: String) {
+    if !*ui.mounted.borrow() {
+        toast_error(
+            ui,
+            &gettext("Couldn't copy"),
+            &gettext("Proton Drive isn't connected."),
+        );
+        return;
+    }
+    let socket = ui.dirs.control_socket();
+    ui.busy_begin();
+    clear_selection(ui);
+    let ui = ui.clone();
+    glib::spawn_future_local(async move {
+        let (done, failure) = send_each(&socket, sources, |path| Request::Copy {
+            path,
+            new_parent: target.clone(),
+        })
+        .await;
+        ui.busy_end();
+        reload_listing(&ui);
+        let place = quoted_place(&target);
+        match (done, failure) {
+            (0, Some((message, kind))) => {
+                toast_failure(&ui, &gettext("Couldn't copy"), &message, kind)
+            }
+            (0, None) => {}
+            (n, Some((message, _))) => toast_error(
+                &ui,
+                // Translators: {place} is a quoted folder name or "Proton Drive".
+                &ngettext_f(
+                    "Copied {n} item to {place}, but not all",
+                    "Copied {n} items to {place}, but not all",
+                    n as u64,
+                    &[("place", &place)],
+                ),
+                &message,
+            ),
+            // Translators: {place} is a quoted folder name or "Proton Drive".
+            (1, None) => toast(&ui, &gettext_f("Copied to {place}", &[("place", &place)])),
+            (n, None) => toast(
+                &ui,
+                // Translators: {place} is a quoted folder name or "Proton Drive".
+                &ngettext_f(
+                    "Copied {n} item to {place}",
+                    "Copied {n} items to {place}",
+                    n as u64,
+                    &[("place", &place)],
+                ),
+            ),
+        }
+    });
+}
+
+/// Send one request per source, in order, and count how many succeeded. The
+/// first failure is kept for the report.
+async fn send_each(
+    socket: &Path,
+    sources: Vec<String>,
+    request: impl Fn(String) -> Request,
+) -> (usize, Option<(String, ErrorKind)>) {
+    let mut done = 0usize;
+    let mut failure: Option<(String, ErrorKind)> = None;
+    for path in sources {
+        let rx = spawn_request(socket.to_path_buf(), request(path));
+        match rx.recv().await {
+            Ok(Ok(Response::Ok { .. })) => done += 1,
+            Ok(Ok(Response::Error { message, kind })) => {
+                failure.get_or_insert((message, kind));
+            }
+            _ => {
+                failure.get_or_insert_with(|| {
+                    (
+                        gettext("The Proton Drive service didn't respond."),
+                        ErrorKind::Internal,
+                    )
+                });
+            }
+        }
+    }
+    (done, failure)
+}
+
+/// The destination folder for a report: its name in quotes, or "Proton Drive"
+/// for My files.
+fn quoted_place(target: &str) -> String {
+    match target.rsplit('/').next() {
+        // Translators: a folder name in quotes, filled in as {place} in "Moved to {place}".
+        Some(name) if !name.is_empty() => gettext_f("“{name}”", &[("name", name)]),
+        _ => "Proton Drive".to_string(),
+    }
+}
+
 /// Move one entry to Trash, through the batch path so it gets the same Undo.
 pub(crate) fn trash_entry(ui: &Rc<Ui>, entry: &DirEntry) {
     run_bulk_delete(ui, vec![entry.clone()]);
@@ -2494,12 +2653,19 @@ pub(crate) fn start_upload(ui: &Rc<Ui>, sources: Vec<String>) {
     });
 }
 
-/// The sync-state badge for an entry: `(icon, css-class)`, or `None` for folders
-/// (which carry no per-file cache state). Pinned (kept offline) ranks above merely
-/// cached (downloaded, evictable); everything else is online-only.
+/// The sync-state badge for an entry: `(icon, css-class)`. A folder carries no
+/// cache state of its own, so it has one only when kept offline. A sync issue
+/// ranks first, on folders too: the change waits for the user. Pinned (kept
+/// offline) ranks above merely cached (downloaded, evictable); everything else
+/// is online-only.
 pub(crate) fn badge_for(entry: &DirEntry) -> Option<(&'static str, &'static str)> {
+    if entry.issue.is_some() {
+        return Some(("dialog-warning-symbolic", "badge-issue"));
+    }
     if entry.is_dir {
-        return None;
+        return entry
+            .pinned
+            .then_some(("pdfs-offline-symbolic", "badge-pinned"));
     }
     Some(if entry.pinned {
         ("pdfs-offline-symbolic", "badge-pinned")
@@ -2513,9 +2679,11 @@ pub(crate) fn badge_for(entry: &DirEntry) -> Option<(&'static str, &'static str)
 /// Paint `badge` to reflect the entry's sync state (see [`badge_for`]). Clears any
 /// prior colour class first, since list factories recycle cells.
 pub(crate) fn apply_badge(badge: &gtk4::Image, entry: &DirEntry) {
-    for class in ["badge-pinned", "badge-cached", "badge-cloud"] {
+    for class in ["badge-pinned", "badge-cached", "badge-cloud", "badge-issue"] {
         badge.remove_css_class(class);
     }
+    let issue = entry.issue.map(super::locations::issue_text);
+    badge.set_tooltip_text(issue.as_deref());
     match badge_for(entry) {
         Some((icon, class)) => {
             badge.set_icon_name(Some(icon));
@@ -2906,6 +3074,7 @@ pub(crate) fn repaint_search(ui: &Rc<Ui>, hits: &[SearchHit]) {
             size: h.size,
             modified: h.modified,
             pinned: h.pinned,
+            pinned_by_folder: false,
             cached: h.cached,
             uid: h.uid.clone(),
             path: h.path.clone(),
@@ -2915,6 +3084,7 @@ pub(crate) fn repaint_search(ui: &Rc<Ui>, hits: &[SearchHit]) {
             shared_by_unverified: false,
             trashed_at: 0,
             trashed_from: None,
+            issue: None,
         })
         .collect();
     sort_entries(&mut entries, ui.browser.view.get());
@@ -2952,11 +3122,11 @@ fn listing_summary(files: usize, folders: usize, file_bytes: u64) -> String {
 #[cfg(test)]
 mod tests {
     use super::{
-        MoveTarget, hit_location, listing_summary, move_target_allowed,
-        show_thumbnail_build_progress, sort_entries,
+        MoveTarget, badge_for, copy_target_allowed, hit_location, listing_summary,
+        move_target_allowed, show_thumbnail_build_progress, sort_entries,
     };
     use pdfs_core::config::{FileSort, FilesView};
-    use pdfs_core::control::{DirEntry, ThumbnailBuildStatus};
+    use pdfs_core::control::{DirEntry, SyncIssue, ThumbnailBuildStatus};
 
     fn entry(name: &str, is_dir: bool, size: u64, modified: i64) -> DirEntry {
         DirEntry {
@@ -2965,6 +3135,7 @@ mod tests {
             size,
             modified,
             pinned: false,
+            pinned_by_folder: false,
             cached: false,
             uid: String::new(),
             path: String::new(),
@@ -2974,6 +3145,7 @@ mod tests {
             shared_by_unverified: false,
             trashed_at: 0,
             trashed_from: None,
+            issue: None,
         }
     }
 
@@ -2981,6 +3153,22 @@ mod tests {
         entries.iter().map(|e| e.name.as_str()).collect()
     }
 
+    #[test]
+    fn a_sync_issue_shows_on_the_node_before_its_cache_state() {
+        let mut file = entry("a.txt", false, 1, 0);
+        file.pinned = true;
+        assert_eq!(badge_for(&file).unwrap().1, "badge-pinned");
+        file.issue = Some(SyncIssue::Quota);
+        assert_eq!(badge_for(&file).unwrap().1, "badge-issue");
+
+        let mut folder = entry("d", true, 0, 0);
+        assert_eq!(badge_for(&folder), None);
+        folder.pinned = true;
+        assert_eq!(badge_for(&folder).unwrap().1, "badge-pinned");
+        folder.issue = Some(SyncIssue::Missing);
+        assert_eq!(badge_for(&folder).unwrap().1, "badge-issue");
+    }
+
     #[test]
     fn a_search_hit_location_is_its_parent_folder() {
         assert_eq!(hit_location("Work/Old/a.txt"), "Work/Old");
@@ -3023,6 +3211,16 @@ mod tests {
         assert!(move_target_allowed(&mixed, ""));
     }
 
+    #[test]
+    fn copy_refuses_its_own_subtree_but_not_the_folder_it_is_in() {
+        let sources = ["Docs/Work".to_string()];
+        assert!(!copy_target_allowed(&sources, "Docs/Work"));
+        assert!(!copy_target_allowed(&sources, "Docs/Work/Old"));
+        assert!(copy_target_allowed(&sources, "Docs"));
+        assert!(copy_target_allowed(&sources, ""));
+        assert!(copy_target_allowed(&sources, "Docs/Workshop"));
+    }
+
     #[test]
     fn listing_summary_matches_dolphin_order_and_wording() {
         assert_eq!(listing_summary(0, 0, 0), "0 folders, 0 files");

crates/pdfs-gui/src/app/pages/devices.rs

@@ -204,7 +204,9 @@ pub(crate) fn wire_devices(ui: &Rc<Ui>, widgets: &DevicesWidgets) {
 pub(crate) fn devices_status(ui: &Rc<Ui>, icon: &str, title: &str, description: &str, retry: bool) {
     ui.devices.status.set_icon_name(Some(icon));
     ui.devices.status.set_title(title);
-    ui.devices.status.set_description(Some(description));
+    ui.devices
+        .status
+        .set_description(Some(&gtk4::glib::markup_escape_text(description)));
     ui.devices.retry.set_visible(retry);
     ui.devices.content.set_visible_child_name("status");
 }
@@ -390,6 +392,7 @@ fn this_computer_row(
     let row = adw::ActionRow::builder()
         .title(me.map_or_else(|| gettext("This computer"), |d| d.name.clone()))
         .subtitle(this_computer_subtitle(folders))
+        .use_markup(false)
         .activatable(true)
         .build();
     row.add_prefix(&gtk4::Image::from_icon_name("computer-symbolic"));
@@ -426,6 +429,7 @@ fn other_computer_row(ui: &Rc<Ui>, dev: &DeviceInfo) -> adw::ActionRow {
     let row = adw::ActionRow::builder()
         .title(&dev.name)
         .subtitle(device_subtitle(dev))
+        .use_markup(false)
         .activatable(true)
         .build();
     row.add_prefix(&gtk4::Image::from_icon_name("computer-symbolic"));
@@ -439,6 +443,14 @@ fn other_computer_row(ui: &Rc<Ui>, dev: &DeviceInfo) -> adw::ActionRow {
     menu.item(&gettext("Restore to This Computer…"), move || {
         prompt_restore_folders(&ui_c, Some((uid_c.clone(), name_c.clone())))
     });
+    let (ui_c, uid_c, name_c) = (ui.clone(), uid.clone(), name.clone());
+    menu.item(&gettext("Sync With This Computer…"), move || {
+        prompt_join_device(&ui_c, &uid_c, &name_c)
+    });
+    let (ui_c, uid_c, name_c) = (ui.clone(), uid.clone(), name.clone());
+    menu.item(&gettext("Move to This Computer…"), move || {
+        prompt_migrate_device(&ui_c, &uid_c, &name_c)
+    });
     menu.section();
     let (ui_c, uid_c, name_c) = (ui.clone(), uid.clone(), name.clone());
     menu.item(&gettext("Rename…"), move || {
@@ -483,9 +495,7 @@ fn repaint_device_crumb(ui: &Rc<Ui>, nav: &[(String, String)]) {
         nav.is_empty(),
     ));
     for (i, (_, name)) in nav.iter().enumerate() {
-        let sep = gtk4::Label::new(Some("›"));
-        sep.add_css_class("dim-label");
-        crumb.append(&sep);
+        crumb.append(&crumb_separator());
         crumb.append(&device_crumb_node(ui, name, i + 1, i + 1 == nav.len()));
     }
 }
@@ -494,12 +504,7 @@ fn repaint_device_crumb(ui: &Rc<Ui>, nav: &[(String, String)]) {
 /// that goes back up to `depth` levels below the device list.
 fn device_crumb_node(ui: &Rc<Ui>, label: &str, depth: usize, current: bool) -> gtk4::Widget {
     if current {
-        let l = gtk4::Label::builder()
-            .label(label)
-            .ellipsize(gtk4::pango::EllipsizeMode::Start)
-            .build();
-        l.add_css_class("heading");
-        return l.upcast();
+        return crumb_current(label);
     }
     let button = gtk4::Button::builder().label(label).build();
     button.add_css_class("flat");
@@ -624,9 +629,17 @@ pub(crate) fn sync_state_label(state: &str) -> String {
 /// — so both read "12 of 40" rather than a percentage that could go backwards.
 pub(crate) fn sync_progress_label(p: &SyncProgress) -> String {
     match p.phase {
-        // Before the first pass finishes there is no estimate, so the count would
-        // be "checked 12 of 12" — worse than saying nothing.
-        SyncPhase::Scanning if p.total == 0 => gettext("checking for changes…"),
+        SyncPhase::Scanning if p.total == 0 && p.done == 0 => gettext("checking for changes…"),
+        // Before the first pass finishes there is no estimate, so "12 of 12" would
+        // say nothing. The count alone still shows a first scan of a large folder
+        // moving, which can take many minutes before anything downloads.
+        // Translators: {n} counts the folders and files checked so far.
+        SyncPhase::Scanning if p.total == 0 => ngettext_f(
+            "checking for changes — {n} item checked",
+            "checking for changes — {n} items checked",
+            p.done as u64,
+            &[],
+        ),
         // Translators: {done} and {total} count folders and files checked so far.
         SyncPhase::Scanning => gettext_f(
             "checking for changes — {done} of {total}",
@@ -766,7 +779,10 @@ fn show_restore_picker(
             .active(true)
             .valign(gtk4::Align::Center)
             .build();
-        let row = adw::EntryRow::builder().title(&f.name).build();
+        let row = adw::EntryRow::builder()
+            .title(&f.name)
+            .use_markup(false)
+            .build();
         row.set_text(&f.local_path);
         row.add_prefix(&check);
         group.add(&row);
@@ -1096,6 +1112,130 @@ pub(crate) fn prompt_adopt_device(ui: &Rc<Ui>, uid: &str, name: &str) {
     dialog.present(win.as_ref());
 }
 
+/// Ask before syncing into another computer's device alongside it, then offer
+/// its folders for syncing here.
+///
+/// The same adoption as "Continue This Backup Here", but the other computer
+/// goes on syncing, so the dialog says what that means: the two keep the same
+/// folders in step, deletions included.
+pub(crate) fn prompt_join_device(ui: &Rc<Ui>, uid: &str, name: &str) {
+    let win = ui_window(ui);
+    let dialog = adw::AlertDialog::builder()
+        .heading(gettext("Sync With This Computer?"))
+        // Translators: {name} is the name of the other computer this one syncs with.
+        .body(gettext_f(
+            "This computer and “{name}” keep the same folders in step. A change or a deletion on one reaches the other.\n\nNew synced folders on this computer go under “{name}” in Proton Drive. Folders already synced here stay where they are. Next you choose which of its folders to sync here.",
+            &[("name", name)],
+        ))
+        .build();
+    dialog.add_response("cancel", &gettext("Cancel"));
+    dialog.add_response("join", &gettext("Sync Here"));
+    dialog.set_response_appearance("join", adw::ResponseAppearance::Suggested);
+    dialog.set_default_response(Some("cancel"));
+    dialog.set_close_response("cancel");
+    let ui = ui.clone();
+    let uid = uid.to_string();
+    // Translators: {name} is the name of the other computer this one now syncs with.
+    let done = gettext_f("Now syncing with “{name}”", &[("name", name)]);
+    dialog.connect_response(None, move |_, resp| {
+        if resp != "join" {
+            return;
+        }
+        ui.busy_begin();
+        let rx = spawn_request(
+            ui.dirs.control_socket(),
+            Request::AdoptDevice {
+                uid: Some(uid.clone()),
+            },
+        );
+        let (ui, done) = (ui.clone(), done.clone());
+        glib::spawn_future_local(async move {
+            let result = rx.recv().await;
+            ui.busy_end();
+            let failed = gettext("Couldn't sync with that computer");
+            match result {
+                Ok(Ok(Response::Ok { .. })) => {
+                    reload_sync_pages(&ui);
+                    toast(&ui, &done);
+                    // The device is this computer's now, so its own restore
+                    // picker offers the folders.
+                    prompt_restore_folders(&ui, None);
+                }
+                Ok(Ok(Response::Error { message, kind })) => {
+                    toast_failure(&ui, &failed, &message, kind)
+                }
+                _ => toast_error(
+                    &ui,
+                    &failed,
+                    &gettext("The Proton Drive service didn't respond."),
+                ),
+            }
+        });
+    });
+    dialog.present(win.as_ref());
+}
+
+/// Ask before moving another computer's folders into this computer's backup,
+/// then offer them for syncing here.
+///
+/// Destructive-looking on purpose: the other computer keeps its device but
+/// loses its folders, and a copy of Proton Drive still running there would
+/// watch them vanish.
+pub(crate) fn prompt_migrate_device(ui: &Rc<Ui>, uid: &str, name: &str) {
+    let win = ui_window(ui);
+    let dialog = adw::AlertDialog::builder()
+        .heading(gettext("Move Backup to This Computer?"))
+        // Translators: {name} is the name of the other computer whose folders move to this one.
+        .body(gettext_f(
+            "The folders backed up by “{name}” move into this computer's backup in Proton Drive, and you choose where they go on this computer. “{name}” stays in your account, without those folders.\n\nStop Proton Drive on “{name}” first. Otherwise it sees its folders disappear.",
+            &[("name", name)],
+        ))
+        .build();
+    dialog.add_response("cancel", &gettext("Cancel"));
+    dialog.add_response("move", &gettext("Move Here"));
+    dialog.set_response_appearance("move", adw::ResponseAppearance::Destructive);
+    dialog.set_default_response(Some("cancel"));
+    dialog.set_close_response("cancel");
+    let ui = ui.clone();
+    let uid = uid.to_string();
+    // Translators: {name} is the name of the computer whose folders moved to this one.
+    let done = gettext_f("Moved the backup of “{name}”", &[("name", name)]);
+    dialog.connect_response(None, move |_, resp| {
+        if resp != "move" {
+            return;
+        }
+        ui.busy_begin();
+        let rx = spawn_request(
+            ui.dirs.control_socket(),
+            Request::MigrateDevice { uid: uid.clone() },
+        );
+        let (ui, done) = (ui.clone(), done.clone());
+        glib::spawn_future_local(async move {
+            let result = rx.recv().await;
+            ui.busy_end();
+            let failed = gettext("Couldn't move that backup");
+            match result {
+                Ok(Ok(Response::Ok { .. })) => {
+                    reload_sync_pages(&ui);
+                    toast(&ui, &done);
+                    // The folders are this computer's now, so its own restore
+                    // picker is where the user chooses their local paths.
+                    prompt_restore_folders(&ui, None);
+                }
+                Ok(Ok(Response::Error { message, kind })) => {
+                    toast_failure(&ui, &failed, &message, kind)
+                }
+                _ => toast_error(
+                    &ui,
+                    &failed,
+                    &gettext("The Proton Drive service didn't respond."),
+                ),
+            }
+        });
+    });
+    dialog.present(win.as_ref());
+}
+
 /// Run a mutation raised from Computers or Locations and reload the page on success.
 pub(crate) fn run_devices_mutation(ui: &Rc<Ui>, req: Request, done: &str, failed: &str) {
     ui.busy_begin();
@@ -1164,6 +1304,37 @@ mod tests {
         );
     }
 
+    fn scanning(done: usize, total: usize) -> SyncProgress {
+        SyncProgress {
+            phase: SyncPhase::Scanning,
+            done,
+            total,
+            current: String::new(),
+        }
+    }
+
+    #[test]
+    fn a_first_scan_counts_what_it_checked() {
+        // A first sync of a large folder scans for many minutes before anything
+        // downloads; without a count it reads as stuck (#46).
+        assert_eq!(
+            sync_progress_label(&scanning(0, 0)),
+            "checking for changes…"
+        );
+        assert_eq!(
+            sync_progress_label(&scanning(1, 0)),
+            "checking for changes — 1 item checked"
+        );
+        assert_eq!(
+            sync_progress_label(&scanning(1234, 0)),
+            "checking for changes — 1234 items checked"
+        );
+        assert_eq!(
+            sync_progress_label(&scanning(12, 40)),
+            "checking for changes — 12 of 40"
+        );
+    }
+
     #[test]
     fn the_restore_picker_names_the_computer_it_restores_from() {
         assert!(restore_picker_body(Some("laptop")).contains("“laptop”"));

crates/pdfs-gui/src/app/pages/duplicates.rs

@@ -209,7 +209,8 @@ fn ask(view: &Rc<FinderView>, finder: Finder, generation: u32) {
             Ok(Ok(Response::Error { message, .. })) => {
                 view.status.set_icon_name(Some("dialog-warning-symbolic"));
                 view.status.set_title(&failed);
-                view.status.set_description(Some(&message));
+                view.status
+                    .set_description(Some(&gtk4::glib::markup_escape_text(&message)));
                 view.progress.set_visible(false);
                 return;
             }

crates/pdfs-gui/src/app/pages/locations.rs

@@ -7,7 +7,7 @@
 //! `~/ProtonDrive` mount, plus each folder this computer backs up, whether it is
 //! a mirrored local directory or an on-demand FUSE session. The page is called
 //! *Locations* rather than *Mounts* because a mirror folder is a plain directory
-//! with no FUSE session behind it (mount-architecture.md §4).
+//! with no FUSE session behind it.
 //!
 //! The device rows drive the same control requests the Computers page used to:
 //! mode switch, sync now, remove. What is new here is that the primary mount is
@@ -46,6 +46,10 @@ pub(crate) struct SyncCard {
     pub(crate) pause: adw::SplitButton,
     /// Whether the last status said paused, so the button knows which way to go.
     pub(crate) paused: Cell<bool>,
+    /// Shown only while Proton refuses the session; opens the sign-in page.
+    pub(crate) sign_in: gtk4::Button,
+    /// Shown only while the daemon is older than the app; restarts it.
+    pub(crate) restart: gtk4::Button,
 }
 
 /// What a folder row's controls are built from. The subtitle and progress bar
@@ -70,8 +74,9 @@ pub(crate) struct LocationRow {
     progress: gtk4::ProgressBar,
 }
 
-/// What a queue row shows that can change: id, attempts, next attempt, parked.
-pub(crate) type QueueKey = (i64, i64, Option<i64>, bool);
+/// What a queue row shows that can change: id, attempts, next attempt, parked,
+/// issue.
+pub(crate) type QueueKey = (i64, i64, Option<i64>, bool, Option<SyncIssue>);
 
 /// The "Waiting to Upload" list: the daemon's pending-op queue.
 pub(crate) struct QueueState {
@@ -107,6 +112,8 @@ pub(crate) struct LocationsWidgets {
     pub(crate) card_icon: gtk4::Image,
     pub(crate) card_title: gtk4::Label,
     pub(crate) card_detail: gtk4::Label,
+    pub(crate) card_sign_in: gtk4::Button,
+    pub(crate) card_restart: gtk4::Button,
     pub(crate) pause: adw::SplitButton,
     pub(crate) queue_group: adw::PreferencesGroup,
     pub(crate) retry_all: gtk4::Button,
@@ -133,7 +140,7 @@ pub(crate) fn build_locations_page(history: &gtk4::Widget) -> (gtk4::Widget, Loc
         .build();
     add_folder.add_css_class("flat");
     let transfers_group = build_transfers_group();
-    let (card, card_icon, card_title, card_detail) = build_sync_card();
+    let (card, card_icon, card_title, card_detail, card_sign_in, card_restart) = build_sync_card();
     let pause = build_pause_button();
     let (queue_group, retry_all) = build_queue_group();
     let conflicts_group = adw::PreferencesGroup::builder()
@@ -252,6 +259,8 @@ pub(crate) fn build_locations_page(history: &gtk4::Widget) -> (gtk4::Widget, Loc
         card_icon,
         card_title,
         card_detail,
+        card_sign_in,
+        card_restart,
         pause,
         queue_group,
         retry_all,
@@ -289,6 +298,16 @@ pub(crate) fn wire_locations(ui: &Rc<Ui>, retry: &gtk4::Button, add_folder: &gtk
     let ui_add = ui.clone();
     add_folder.connect_clicked(move |_| prompt_add_sync_folder(&ui_add));
     wire_pause(ui);
+    let ui_sign_in = ui.clone();
+    ui.locations
+        .card
+        .sign_in
+        .connect_clicked(move |_| show_login(&ui_sign_in));
+    let ui_restart = ui.clone();
+    ui.locations
+        .card
+        .restart
+        .connect_clicked(move |_| restart_service_then(&ui_restart, |_| {}));
     let ui_retry = ui.clone();
     ui.locations
         .queue
@@ -378,9 +397,16 @@ pub(crate) fn paint_sync_banner(ui: &Rc<Ui>) {
     state.banner.set_revealed(away && title.is_some());
 }
 
-/// The status hero: a large state icon, the state in words, and what it
-/// means.
-fn build_sync_card() -> (gtk4::Box, gtk4::Image, gtk4::Label, gtk4::Label) {
+/// The status hero: a large state icon, the state in words, what it means,
+/// and the way out when there is one only the user can take.
+fn build_sync_card() -> (
+    gtk4::Box,
+    gtk4::Image,
+    gtk4::Label,
+    gtk4::Label,
+    gtk4::Button,
+    gtk4::Button,
+) {
     let icon = gtk4::Image::builder()
         .icon_name("pdfs-sync-symbolic")
         .pixel_size(48)
@@ -407,9 +433,25 @@ fn build_sync_card() -> (gtk4::Box, gtk4::Image, gtk4::Label, gtk4::Label) {
     let card = gtk4::Box::new(gtk4::Orientation::Horizontal, 18);
     card.add_css_class("card");
     card.add_css_class("sync-card");
+    let sign_in = gtk4::Button::builder()
+        .label(gettext("Sign In Again"))
+        .valign(gtk4::Align::Center)
+        .visible(false)
+        .build();
+    sign_in.add_css_class("pill");
+    sign_in.add_css_class("suggested-action");
+    let restart = gtk4::Button::builder()
+        .label(gettext("Restart"))
+        .valign(gtk4::Align::Center)
+        .visible(false)
+        .build();
+    restart.add_css_class("pill");
+    restart.add_css_class("suggested-action");
     card.append(&icon);
     card.append(&text);
-    (card, icon, title, detail)
+    card.append(&sign_in);
+    card.append(&restart);
+    (card, icon, title, detail, sign_in, restart)
 }
 
 /// Pause/Resume, with timed pauses in its menu.
@@ -591,7 +633,7 @@ fn repaint_queue(ui: &Rc<Ui>, items: &[PendingOpInfo]) {
     items.sort_by_key(|op| (!op.failing, op.attempts == 0, op.id));
     let key: Vec<QueueKey> = items
         .iter()
-        .map(|op| (op.id, op.attempts, op.next_attempt_at, op.parked))
+        .map(|op| (op.id, op.attempts, op.next_attempt_at, op.parked, op.issue))
         .collect();
     if *queue.painted.borrow() == key {
         return;
@@ -648,6 +690,10 @@ fn queue_row(ui: &Rc<Ui>, op: &PendingOpInfo, now: i64) -> adw::ActionRow {
         "{action} · {state}",
         &[("action", &action), ("state", &state)],
     );
+    if let Some(issue) = op.issue {
+        subtitle.push('\n');
+        subtitle.push_str(&issue_text(issue));
+    }
     if let Some(error) = &op.last_error {
         subtitle.push('\n');
         // Translators: {n} is how many attempts failed, {error} the last error message.
@@ -662,7 +708,7 @@ fn queue_row(ui: &Rc<Ui>, op: &PendingOpInfo, now: i64) -> adw::ActionRow {
         .title(glib::markup_escape_text(&op.path).as_str())
         .subtitle(glib::markup_escape_text(&subtitle).as_str())
         .title_lines(1)
-        .subtitle_lines(3)
+        .subtitle_lines(if op.issue.is_some() { 5 } else { 3 })
         .tooltip_text(&op.path)
         .build();
     let image = gtk4::Image::from_icon_name(if op.failing {
@@ -687,9 +733,157 @@ fn queue_row(ui: &Rc<Ui>, op: &PendingOpInfo, now: i64) -> adw::ActionRow {
         retry.connect_clicked(move |_| retry_queued(&ui, Some(id)));
         row.add_suffix(&retry);
     }
+    if op.failing && op.exportable {
+        let export = gtk4::Button::builder()
+            .label(gettext("Export"))
+            .tooltip_text(gettext("Save a copy of this file's content elsewhere"))
+            .valign(gtk4::Align::Center)
+            .build();
+        export.add_css_class("flat");
+        let ui = ui.clone();
+        let id = op.id;
+        let name = Path::new(&op.path)
+            .file_name()
+            .map(|name| name.to_string_lossy().into_owned())
+            .unwrap_or_default();
+        export.connect_clicked(move |_| prompt_export_queued(&ui, id, &name));
+        row.add_suffix(&export);
+    }
+    if op.failing {
+        let discard = gtk4::Button::builder()
+            .label(gettext("Discard"))
+            .tooltip_text(gettext("Undo this change here instead of sending it"))
+            .valign(gtk4::Align::Center)
+            .build();
+        discard.add_css_class("flat");
+        let ui = ui.clone();
+        let id = op.id;
+        let path = op.path.clone();
+        let exportable = op.exportable;
+        discard.connect_clicked(move |_| prompt_discard_queued(&ui, id, &path, exportable));
+        row.add_suffix(&discard);
+    }
     row
 }
 
+/// What a sync issue means and what the user can do about it. The change stays
+/// queued either way.
+pub(crate) fn issue_text(issue: SyncIssue) -> String {
+    match issue {
+        SyncIssue::Quota => gettext(
+            "Your Proton Drive storage is full. Free up space or upgrade your plan, and this change uploads on its own.",
+        ),
+        SyncIssue::Access => gettext(
+            "You can no longer change this on Proton Drive. Ask the owner for edit access, or export the file to keep your version.",
+        ),
+        SyncIssue::Missing => gettext(
+            "The folder this change belongs in is gone from Proton Drive. Export the file to keep your version.",
+        ),
+        SyncIssue::Limit => gettext(
+            "Proton Drive's limit on items in a folder or on folder depth is reached. Make room in the folder, then retry.",
+        ),
+        SyncIssue::Rejected | SyncIssue::Unknown => {
+            gettext("Proton Drive refused this change. It stays queued and is tried again.")
+        }
+    }
+}
+
+/// Ask where to save a copy of a queued file's content, then have the daemon
+/// write it there. The change itself stays queued.
+fn prompt_export_queued(ui: &Rc<Ui>, id: i64, name: &str) {
+    let window = ui_window(ui);
+    let dialog = gtk4::FileDialog::builder()
+        .title(gettext("Export File"))
+        .initial_name(name)
+        .build();
+    let ui = ui.clone();
+    dialog.save(window.as_ref(), gio::Cancellable::NONE, move |res| {
+        let Ok(file) = res else { return };
+        let Some(dest) = file.path().and_then(|p| p.to_str().map(str::to_string)) else {
+            toast_error(
+                &ui,
+                &gettext("Couldn't export the file"),
+                &gettext("That location isn't a local file."),
+            );
+            return;
+        };
+        let rx = spawn_request(
+            ui.dirs.control_socket(),
+            Request::ExportPendingOp { id, dest },
+        );
+        let ui = ui.clone();
+        glib::spawn_future_local(async move {
+            match rx.recv().await {
+                Ok(Ok(Response::Ok { .. })) => toast(&ui, &gettext("File exported")),
+                Ok(Ok(Response::Error { message, kind })) => {
+                    toast_failure(&ui, &gettext("Couldn't export the file"), &message, kind)
+                }
+                _ => toast_error(
+                    &ui,
+                    &gettext("Couldn't export the file"),
+                    &gettext("The Proton Drive service didn't respond."),
+                ),
+            }
+        });
+    });
+}
+
+/// Confirm, then have the daemon drop a queued change and undo it here.
+fn prompt_discard_queued(ui: &Rc<Ui>, id: i64, path: &str, exportable: bool) {
+    let body = if exportable {
+        // Translators: {path} is the file whose queued change would be dropped.
+        gettext_f(
+            "Your changes to {path} are undone here and never reach Proton Drive. Export the file first to keep your version.",
+            &[("path", path)],
+        )
+    } else {
+        // Translators: {path} is the file or folder whose queued change would be dropped.
+        gettext_f(
+            "The change to {path} is undone here and never reaches Proton Drive.",
+            &[("path", path)],
+        )
+    };
+    let dialog = adw::AlertDialog::builder()
+        .heading(gettext("Discard Change?"))
+        .body(body)
+        .build();
+    dialog.add_response("cancel", &gettext("Cancel"));
+    dialog.add_response("discard", &gettext("Discard"));
+    dialog.set_response_appearance("discard", adw::ResponseAppearance::Destructive);
+    dialog.set_default_response(Some("cancel"));
+    dialog.set_close_response("cancel");
+    let window = ui_window(ui);
+    let ui = ui.clone();
+    dialog.connect_response(None, move |_, resp| {
+        if resp == "discard" {
+            discard_queued(&ui, id);
+        }
+    });
+    dialog.present(window.as_ref());
+}
+
+fn discard_queued(ui: &Rc<Ui>, id: i64) {
+    let rx = spawn_request(ui.dirs.control_socket(), Request::DiscardPendingOp { id });
+    let ui = ui.clone();
+    glib::spawn_future_local(async move {
+        match rx.recv().await {
+            Ok(Ok(Response::Ok { .. })) => {
+                toast(&ui, &gettext("Change discarded"));
+                ui.locations.queue.painted.borrow_mut().clear();
+                refresh_queue(&ui);
+            }
+            Ok(Ok(Response::Error { message, kind })) => {
+                toast_failure(&ui, &gettext("Couldn't discard the change"), &message, kind)
+            }
+            _ => toast_error(
+                &ui,
+                &gettext("Couldn't discard the change"),
+                &gettext("The Proton Drive service didn't respond."),
+            ),
+        }
+    });
+}
+
 /// Ask the daemon to stop waiting out one op's backoff, or every failed op's.
 fn retry_queued(ui: &Rc<Ui>, id: Option<i64>) {
     let rx = spawn_request(ui.dirs.control_socket(), Request::RetryPendingOp { id });
@@ -951,7 +1145,9 @@ pub(crate) fn locations_status(
 ) {
     ui.locations.status.set_icon_name(Some(icon));
     ui.locations.status.set_title(title);
-    ui.locations.status.set_description(Some(description));
+    ui.locations
+        .status
+        .set_description(Some(&gtk4::glib::markup_escape_text(description)));
     ui.locations.retry.set_visible(retry);
     ui.locations.content.set_visible_child_name("status");
 }
@@ -1310,8 +1506,13 @@ fn add_device_items(ui: &Rc<Ui>, menu: &mut ActionMenu, spec: &MountSpec, id: i6
         } else {
             gettext("Pause Syncing")
         };
+        let ui_pause = ui.clone();
+        menu.item(&label, move || set_folder_paused(&ui_pause, id, !paused));
         let ui = ui.clone();
-        menu.item(&label, move || set_folder_paused(&ui, id, !paused));
+        let path = spec.local_path.clone();
+        menu.item(&gettext("Sync From Scratch…"), move || {
+            confirm_reset_sync_folder(&ui, id, &path)
+        });
         menu.section();
     }
     let ui = ui.clone();
@@ -1324,6 +1525,51 @@ fn add_device_items(ui: &Rc<Ui>, menu: &mut ActionMenu, spec: &MountSpec, id: i6
     });
 }
 
+/// Ask before syncing a folder from scratch. Nothing is deleted, but files
+/// that differ come back as conflict copies, so it is not a click to make by
+/// accident.
+fn confirm_reset_sync_folder(ui: &Rc<Ui>, id: i64, path: &str) {
+    let dialog = adw::AlertDialog::builder()
+        .heading(gettext("Sync From Scratch?"))
+        // Translators: {path} is a local folder path.
+        .body(gettext_f("This computer forgets what it synced in {path} before and compares the folder with Proton Drive again. Nothing is deleted: a file on one side only is copied to the other, and a file that differs keeps both versions.", &[("path", path)]))
+        .build();
+    dialog.add_response("cancel", &gettext("Cancel"));
+    dialog.add_response("reset", &gettext("Sync From Scratch"));
+    dialog.set_response_appearance("reset", adw::ResponseAppearance::Suggested);
+    dialog.set_default_response(Some("cancel"));
+    dialog.set_close_response("cancel");
+    let win = ui_window(ui);
+    let ui = ui.clone();
+    dialog.connect_response(None, move |_, response| {
+        if response == "reset" {
+            reset_sync_folder(&ui, id);
+        }
+    });
+    dialog.present(win.as_ref());
+}
+
+/// Forget a folder's sync records, then repaint so its row shows the new pass.
+fn reset_sync_folder(ui: &Rc<Ui>, id: i64) {
+    let rx = spawn_request(ui.dirs.control_socket(), Request::ResetSyncFolder { id });
+    let ui = ui.clone();
+    glib::spawn_future_local(async move {
+        let failed = gettext("Couldn't sync the folder from scratch");
+        match rx.recv().await {
+            Ok(Ok(Response::Ok { .. })) => toast(&ui, &gettext("Syncing folder…")),
+            Ok(Ok(Response::Error { message, kind })) => {
+                toast_failure(&ui, &failed, &message, kind)
+            }
+            _ => toast_error(
+                &ui,
+                &failed,
+                &gettext("The Proton Drive service didn't respond."),
+            ),
+        }
+        refresh_locations(&ui);
+    });
+}
+
 /// Ask before making a synced folder online only: the switch frees disk space
 /// by removing the local copies, which is not something to do by accident.
 fn confirm_online_only(ui: &Rc<Ui>, id: i64, path: &str) {

crates/pdfs-gui/src/app/pages/login.rs

@@ -1,5 +1,5 @@
 use crate::*;
-use pdfs_core::proton_sdk::api::HumanVerificationCredential;
+use pdfs_core::proton_sdk::api::{HumanVerification, HumanVerificationCredential};
 
 pub(crate) struct LoginState {
     // Login page.
@@ -9,6 +9,9 @@ pub(crate) struct LoginState {
     /// Spins inside the Sign in button while a sign-in is running.
     pub(crate) login_spinner: Spinner,
     pub(crate) login_status: gtk4::Label,
+    /// Shown over the form while a saved sign-in exists but the keyring would
+    /// not hand it over; see [`keyring_unreadable`].
+    pub(crate) keyring_banner: adw::Banner,
 }
 
 /// Where the login page's account links go.
@@ -87,6 +90,12 @@ pub(crate) fn build_login_page() -> (gtk4::Widget, LoginState) {
         .child(&inner)
         .build();
     let scroll = gtk4::ScrolledWindow::builder().child(&clamp).build();
+    let keyring_banner = adw::Banner::builder()
+        .title(gettext(
+            "Couldn't read your saved sign-in. Unlock the system keyring, then try again.",
+        ))
+        .button_label(gettext("Retry"))
+        .build();
 
     (
         scroll.upcast(),
@@ -96,10 +105,80 @@ pub(crate) fn build_login_page() -> (gtk4::Widget, LoginState) {
             login_button,
             login_spinner,
             login_status,
+            keyring_banner,
         },
     )
 }
 
+/// The stored session, `None` when there is none, or the keyring's error when
+/// it could not be read. A locked or absent keyring is not a sign-out: the
+/// session is still saved, and signing in again would only replace it.
+pub(crate) fn read_session() -> pdfs_core::Result<Option<auth::StoredSession>> {
+    match auth::load() {
+        Ok(session) => Ok(Some(session)),
+        Err(pdfs_core::Error::NotLoggedIn) => Ok(None),
+        Err(e) => Err(e),
+    }
+}
+
+/// How long to wait before each automatic retry of an unreadable keyring. A
+/// keyring daemon started with the session is usually up within seconds.
+const KEYRING_RETRIES: [u32; 4] = [2, 5, 10, 30];
+
+/// The keyring refused to hand over the saved session. Keep the login page up,
+/// but say why, and pick the session up as soon as the keyring answers: on its
+/// own a few times, and whenever the user presses Retry.
+pub(crate) fn keyring_unreadable(ui: &Rc<Ui>, error: &pdfs_core::Error) {
+    tracing::warn!("cannot read the saved session: {error}");
+    let banner = &ui.login.keyring_banner;
+    if banner.is_revealed() {
+        return;
+    }
+    banner.set_revealed(true);
+    let ui_retry = ui.clone();
+    let handler = banner.connect_button_clicked(move |_| retry_session(&ui_retry));
+    // Disconnected once the banner goes, so a later failure wires it afresh.
+    let handler = RefCell::new(Some(handler));
+    banner.connect_revealed_notify(move |banner| {
+        if !banner.is_revealed()
+            && let Some(handler) = handler.borrow_mut().take()
+        {
+            banner.disconnect(handler);
+        }
+    });
+    let ui = ui.clone();
+    glib::spawn_future_local(async move {
+        for seconds in KEYRING_RETRIES {
+            glib::timeout_future_seconds(seconds).await;
+            if !ui.login.keyring_banner.is_revealed() {
+                return;
+            }
+            retry_session(&ui);
+        }
+    });
+}
+
+/// Read the saved session again after [`keyring_unreadable`]. Found: show the
+/// signed-in window. Gone: the plain login page. Still unreadable: keep waiting.
+fn retry_session(ui: &Rc<Ui>) {
+    let ui = ui.clone();
+    glib::spawn_future_local(async move {
+        let Ok(result) = gio::spawn_blocking(read_session).await else {
+            return;
+        };
+        match result {
+            Ok(session) => {
+                ui.login.keyring_banner.set_revealed(false);
+                if session.is_some() && ui.session.borrow().is_none() {
+                    *ui.session.borrow_mut() = session;
+                    refresh(&ui);
+                }
+            }
+            Err(e) => tracing::debug!("the keyring still cannot be read: {e}"),
+        }
+    });
+}
+
 /// Connect the sign-in button: read the fields, run [`auth::login`] on a worker
 /// thread, and report the outcome back on the main loop.
 pub(crate) fn wire_login(ui: &Rc<Ui>) {
@@ -128,7 +207,12 @@ pub(crate) fn wire_login(ui: &Rc<Ui>) {
 
         set_signing_in(&ui, true);
         ui.login.login_status.set_text(&gettext("Signing in…"));
-        let (rx, totp_req_rx, hv_req_rx) = spawn_login(username, password);
+        let LoginChannels {
+            result: rx,
+            totp: totp_req_rx,
+            hv: hv_req_rx,
+            mailbox: mailbox_req_rx,
+        } = spawn_login(username, password);
 
         // Surface the 2FA dialog only if the SDK actually asks for a code (i.e.
         // the account has 2FA enabled). The worker blocks until the dialog feeds
@@ -145,15 +229,40 @@ pub(crate) fn wire_login(ui: &Rc<Ui>) {
         });
 
         // Same shape for human verification: only fires when the API gates the
-        // sign-in, and the worker is blocked on the token until it does.
+        // sign-in, and the worker is blocked on the credential until it does.
         let ui_hv = ui.clone();
         glib::spawn_future_local(async move {
-            if let Ok((url, token_tx)) = hv_req_rx.recv().await {
+            if let Ok((hv, credential_tx)) = hv_req_rx.recv().await {
                 ui_hv
                     .login
                     .login_status
                     .set_text(&gettext("Complete the verification to continue…"));
-                prompt_human_verification(&ui_hv, &url, token_tx);
+                // Anything but a credential drops the sender, which the worker
+                // reads as a cancelled sign-in.
+                match verify_human(hv.verification_url()).await {
+                    Verification::Solved(token) => {
+                        let _ = credential_tx.send(HumanVerificationCredential::captcha(token));
+                    }
+                    Verification::Cancelled => {}
+                    // The web view could not start, most likely its sandbox
+                    // (B195): the user's browser can show the page instead.
+                    Verification::Failed => verify_in_browser(&ui_hv, &hv, credential_tx),
+                }
+            }
+        });
+
+        // And for the mailbox password, which only a two-password account has.
+        // The worker asks again after a wrong answer, so this loops too.
+        let ui_mailbox = ui.clone();
+        glib::spawn_future_local(async move {
+            while let Ok((attempt, answer_tx)) = mailbox_req_rx.recv().await {
+                ask_mailbox(&ui_mailbox, attempt > 0, move |answer| {
+                    // A cancelled dialog drops the sender, which the worker
+                    // reads as a cancelled login.
+                    if let Some(answer) = answer {
+                        let _ = answer_tx.send(answer);
+                    }
+                });
             }
         });
 
@@ -169,7 +278,14 @@ pub(crate) fn wire_login(ui: &Rc<Ui>) {
                     ui.login.login_status.set_text("");
                     ui.login.password.set_text("");
                     // Cache the new identity so `refresh` never hits the keyring.
-                    *ui.session.borrow_mut() = auth::load().ok();
+                    // Read on a worker: a keyring that has to be unlocked first
+                    // answers only once the user has, and the window must not
+                    // freeze until then.
+                    match gio::spawn_blocking(read_session).await {
+                        Ok(Ok(session)) => *ui.session.borrow_mut() = session,
+                        Ok(Err(e)) => keyring_unreadable(&ui, &e),
+                        Err(_) => {}
+                    }
                     // Enable+start the mount service now that we have a session.
                     let _ = gio::spawn_blocking(service::enable_start).await;
                     refresh(&ui);
@@ -197,6 +313,11 @@ pub(crate) fn login_error_message(error: &pdfs_core::Error) -> String {
         pdfs_core::Error::Proton(ProtonError::Api(api)) if api.http_status == 429 => {
             gettext("Too many sign-in attempts. Wait a few minutes and try again.")
         }
+        // Proton's text for this one asks the user to update an app that is
+        // already current.
+        pdfs_core::Error::Proton(e) if pdfs_core::error::sign_in_blocked(e) => gettext(
+            "Proton is temporarily refusing sign-in from this device. Your app version is not the problem. Wait several hours, up to a day, without trying again, then sign in.",
+        ),
         pdfs_core::Error::Proton(ProtonError::Api(api)) if !api.message.is_empty() => {
             api.message.clone()
         }
@@ -209,6 +330,12 @@ pub(crate) fn login_error_message(error: &pdfs_core::Error) -> String {
         pdfs_core::Error::Other(message) if message.contains("two-factor") => {
             gettext("Sign-in cancelled: no two-factor code was entered.")
         }
+        pdfs_core::Error::Other(message) if message.contains("mailbox") => {
+            gettext("Sign-in cancelled: no mailbox password was entered.")
+        }
+        pdfs_core::Error::WrongMailboxPassword => {
+            gettext("That mailbox password didn't unlock your account.")
+        }
         pdfs_core::Error::Other(message) if message.contains("verification") => gettext(
             "Sign-in cancelled: the verification wasn't completed. Sign in again to get a new one.",
         ),
@@ -220,26 +347,34 @@ pub(crate) fn login_error_message(error: &pdfs_core::Error) -> String {
     }
 }
 
+/// What the login worker asks the UI for, and how it reports back.
+pub(crate) struct LoginChannels {
+    /// The final outcome, once.
+    pub(crate) result: async_channel::Receiver<Result<(), String>>,
+    /// Fires only if the account needs a 2FA code; carries the sender for it.
+    pub(crate) totp: async_channel::Receiver<std::sync::mpsc::Sender<String>>,
+    /// Fires only if the sign-in is gated: the challenge, and the sender for the
+    /// credential the user earns by solving it.
+    pub(crate) hv: async_channel::Receiver<(
+        HumanVerification,
+        std::sync::mpsc::Sender<HumanVerificationCredential>,
+    )>,
+    /// Fires only for a two-password account: how many answers were already
+    /// wrong, and the sender for the password and the "remember" choice.
+    pub(crate) mailbox: async_channel::Receiver<(u32, std::sync::mpsc::Sender<(String, bool)>)>,
+}
+
 /// Run the async SRP + optional 2FA login on a dedicated current-thread Tokio
-/// runtime. Returns two channels: the first yields the final login result once;
-/// the second fires *only if* the account needs a 2FA code, carrying a
-/// [`std::sync::mpsc::Sender`] the UI uses to feed the code back. The login
-/// closure blocks the worker on that sender until the dialog answers, so the
-/// code is requested lazily and can't expire before the password proof.
-#[allow(clippy::type_complexity)]
-pub(crate) fn spawn_login(
-    username: String,
-    password: String,
-) -> (
-    async_channel::Receiver<Result<(), String>>,
-    async_channel::Receiver<std::sync::mpsc::Sender<String>>,
-    async_channel::Receiver<(String, std::sync::mpsc::Sender<String>)>,
-) {
+/// runtime. The returned [`LoginChannels`] carry the final result and the lazy
+/// prompts. Each login closure blocks the worker on a sender the UI answers, so
+/// a code is requested lazily and can't expire before the password proof.
+pub(crate) fn spawn_login(username: String, password: String) -> LoginChannels {
     let (tx, rx) = async_channel::bounded(1);
     // Two, not one: a CAPTCHA-gated login restarts, so a 2FA account is asked
     // for a code on each attempt and a single slot would deadlock the worker.
     let (totp_req_tx, totp_req_rx) = async_channel::bounded(2);
     let (hv_req_tx, hv_req_rx) = async_channel::bounded(1);
+    let (mailbox_req_tx, mailbox_req_rx) = async_channel::bounded(1);
     std::thread::spawn(move || {
         let rt = match tokio::runtime::Builder::new_current_thread()
             .enable_all()
@@ -267,19 +402,30 @@ pub(crate) fn spawn_login(
                         .recv()
                         .map_err(|_| pdfs_core::Error::Other("two-factor entry cancelled".into()))
                 },
-                |hv| {
-                    // Gated: hand the UI the page to show, block on the token the
-                    // user earns by solving it.
-                    let (token_tx, token_rx) = std::sync::mpsc::channel::<String>();
-                    hv_req_tx
-                        .send_blocking((hv.verification_url(), token_tx))
-                        .map_err(|_| {
-                            pdfs_core::Error::Other("verification prompt closed".into())
-                        })?;
-                    let token = token_rx
+                |attempt| {
+                    let (answer_tx, answer_rx) = std::sync::mpsc::channel::<(String, bool)>();
+                    mailbox_req_tx
+                        .send_blocking((attempt, answer_tx))
+                        .map_err(|_| pdfs_core::Error::Other("mailbox prompt closed".into()))?;
+                    let (password, remember) = answer_rx
                         .recv()
-                        .map_err(|_| pdfs_core::Error::Other("verification cancelled".into()))?;
-                    Ok(HumanVerificationCredential::captcha(token))
+                        .map_err(|_| pdfs_core::Error::Other("mailbox entry cancelled".into()))?;
+                    Ok(auth::Mailbox {
+                        password: password.into(),
+                        remember,
+                    })
+                },
+                |hv| {
+                    // Gated: hand the UI the challenge, block on the credential
+                    // the user earns by solving it.
+                    let (credential_tx, credential_rx) =
+                        std::sync::mpsc::channel::<HumanVerificationCredential>();
+                    hv_req_tx.send_blocking((hv, credential_tx)).map_err(|_| {
+                        pdfs_core::Error::Other("verification prompt closed".into())
+                    })?;
+                    credential_rx
+                        .recv()
+                        .map_err(|_| pdfs_core::Error::Other("verification cancelled".into()))
                 },
             )
             .await
@@ -287,7 +433,143 @@ pub(crate) fn spawn_login(
         });
         let _ = tx.send_blocking(result);
     });
-    (rx, totp_req_rx, hv_req_rx)
+    LoginChannels {
+        result: rx,
+        totp: totp_req_rx,
+        hv: hv_req_rx,
+        mailbox: mailbox_req_rx,
+    }
+}
+
+/// Ask for the mailbox password of a two-password account.
+///
+/// `done` gets the password and the "keep unlocked" choice, or `None` when the
+/// dialog was cancelled. `retry` says the last answer was wrong. The choice
+/// defaults to off: storing the mailbox unlock in the keyring trades away what
+/// a separate mailbox password is for, so it is something to opt into.
+pub(crate) fn ask_mailbox(
+    ui: &Rc<Ui>,
+    retry: bool,
+    done: impl FnOnce(Option<(String, bool)>) + 'static,
+) {
+    let body = if retry {
+        gettext("That mailbox password didn't unlock your account. Try again.")
+    } else {
+        gettext("This account has a separate mailbox password. Enter it to unlock your files.")
+    };
+    let dialog = adw::AlertDialog::builder()
+        .heading(gettext("Mailbox Password"))
+        .body(body)
+        .build();
+
+    let group = adw::PreferencesGroup::new();
+    let entry = adw::PasswordEntryRow::builder()
+        .title(gettext("Mailbox password"))
+        .activates_default(true)
+        .build();
+    let remember = adw::SwitchRow::builder()
+        .title(gettext("Keep unlocked on this computer"))
+        .subtitle(gettext(
+            "Stores the unlock in the system keyring, so Proton Drive opens without asking after every login. Otherwise you enter the password once per session.",
+        ))
+        .build();
+    group.add(&entry);
+    group.add(&remember);
+    dialog.set_extra_child(Some(&group));
+
+    dialog.add_response("cancel", &gettext("Cancel"));
+    dialog.add_response("unlock", &gettext("Unlock"));
+    dialog.set_response_appearance("unlock", adw::ResponseAppearance::Suggested);
+    dialog.set_default_response(Some("unlock"));
+    dialog.set_close_response("cancel");
+
+    let done = RefCell::new(Some(done));
+    dialog.connect_response(None, move |_, resp| {
+        let Some(done) = done.borrow_mut().take() else {
+            return;
+        };
+        let password = entry.text().to_string();
+        if resp == "unlock" && !password.is_empty() {
+            done(Some((password, remember.is_active())));
+        } else {
+            done(None);
+        }
+    });
+
+    let parent = ui_window(ui).map(|w| w.upcast::<gtk4::Window>());
+    dialog.present(parent.as_ref());
+}
+
+/// If the signed-in account is locked, ask for its mailbox password — once per
+/// run; after a cancel, a toast keeps an Unlock button within reach.
+///
+/// The key state is a keyring and kernel-keyring read, so it runs on a worker.
+pub(crate) fn offer_unlock(ui: &Rc<Ui>) {
+    if ui.unlock_offered.get() {
+        return;
+    }
+    let ui = ui.clone();
+    glib::spawn_future_local(async move {
+        let state = gio::spawn_blocking(|| auth::key_state().ok()).await;
+        if matches!(state, Ok(Some(auth::KeyState::Locked))) && !ui.unlock_offered.replace(true) {
+            prompt_unlock(&ui, false);
+        }
+    });
+}
+
+enum UnlockOutcome {
+    Unlocked,
+    Wrong,
+    Failed(String),
+}
+
+/// Ask for the mailbox password and unlock the account with it.
+fn prompt_unlock(ui: &Rc<Ui>, retry: bool) {
+    let ui_done = ui.clone();
+    ask_mailbox(ui, retry, move |answer| {
+        let Some((password, remember)) = answer else {
+            toast_action(
+                &ui_done,
+                &gettext("Proton Drive is locked. Enter your mailbox password to unlock it."),
+                &gettext("Unlock"),
+                |ui| prompt_unlock(ui, false),
+            );
+            return;
+        };
+        glib::spawn_future_local(async move {
+            // Verifying talks to Proton and the restart talks to systemd, so
+            // both run on a worker, never on the main loop.
+            let outcome = gio::spawn_blocking(move || {
+                let rt = match tokio::runtime::Builder::new_current_thread()
+                    .enable_all()
+                    .build()
+                {
+                    Ok(rt) => rt,
+                    Err(e) => return UnlockOutcome::Failed(e.to_string()),
+                };
+                match rt.block_on(auth::unlock(&password, remember)) {
+                    Ok(()) => {
+                        service::restart();
+                        UnlockOutcome::Unlocked
+                    }
+                    Err(pdfs_core::Error::WrongMailboxPassword) => UnlockOutcome::Wrong,
+                    Err(e) => UnlockOutcome::Failed(login_error_message(&e)),
+                }
+            })
+            .await;
+            match outcome {
+                Ok(UnlockOutcome::Unlocked) => {
+                    toast(&ui_done, &gettext("Unlocked."));
+                    refresh(&ui_done);
+                }
+                Ok(UnlockOutcome::Wrong) => prompt_unlock(&ui_done, true),
+                Ok(UnlockOutcome::Failed(message)) => {
+                    toast_error(&ui_done, &gettext("Couldn't unlock"), &message)
+                }
+                Err(_) => {}
+            }
+        });
+    });
 }
 
 /// Show the lazy two-factor dialog and feed the entered code back to the waiting
@@ -330,6 +612,63 @@ pub(crate) fn prompt_2fa(ui: &Rc<Ui>, code_tx: std::sync::mpsc::Sender<String>)
     dialog.present(parent.as_ref());
 }
 
+/// Let the user solve the challenge in their own browser, for when the
+/// verification window could not come up. The page cannot hand its token back
+/// to us, so the user says when they are done, and the retry carries the
+/// challenge token, which the solved page made good (see
+/// [`auth::browser_verified`]).
+fn verify_in_browser(
+    ui: &Rc<Ui>,
+    hv: &HumanVerification,
+    credential_tx: std::sync::mpsc::Sender<HumanVerificationCredential>,
+) {
+    let dialog = adw::AlertDialog::builder()
+        .heading(gettext("Verify in Your Browser"))
+        .body(gettext(
+            "The verification page can't be shown in the app on this system. Open it in your browser, complete it there, then come back and choose Continue.",
+        ))
+        .build();
+
+    let url = auth::browser_verification_url(hv);
+    let open = gtk4::Button::builder()
+        .label(gettext("Open Verification Page"))
+        .halign(gtk4::Align::Center)
+        .build();
+    open.add_css_class("pill");
+    dialog.set_extra_child(Some(&open));
+
+    dialog.add_response("cancel", &gettext("Cancel"));
+    dialog.add_response("continue", &gettext("Continue"));
+    dialog.set_response_appearance("continue", adw::ResponseAppearance::Suggested);
+    // Continuing before the page was even opened would only fail the retry.
+    dialog.set_response_enabled("continue", false);
+    dialog.set_default_response(Some("continue"));
+    dialog.set_close_response("cancel");
+
+    let dialog_weak = dialog.downgrade();
+    open.connect_clicked(move |_| {
+        open_uri(&url);
+        if let Some(dialog) = dialog_weak.upgrade() {
+            dialog.set_response_enabled("continue", true);
+        }
+    });
+
+    let credential = auth::browser_verified(hv);
+    let credential_tx = RefCell::new(Some(credential_tx));
+    dialog.connect_response(None, move |_, resp| {
+        // On cancel/close we take + drop `tx` without sending, so the worker's
+        // recv errors out and the login is reported as cancelled.
+        if let Some(tx) = credential_tx.borrow_mut().take()
+            && resp == "continue"
+        {
+            let _ = tx.send(credential.clone());
+        }
+    });
+
+    let parent = ui.login.login_button.root().and_downcast::<gtk4::Window>();
+    dialog.present(parent.as_ref());
+}
+
 /// Sign out, after a confirmation: disable+stop the mount service (so the
 /// daemon isn't left running without credentials), forget the stored session,
 /// and drop back to the login page.
@@ -349,7 +688,7 @@ pub(crate) fn sign_out(ui: &Rc<Ui>) {
             glib::spawn_future_local(async move {
                 let result = gio::spawn_blocking(|| {
                     service::disable_stop();
-                    auth::logout().map_err(|e| e.to_string())
+                    auth::logout().map(|_| ()).map_err(|e| e.to_string())
                 })
                 .await;
                 if let Ok(Err(e)) = result {
@@ -374,6 +713,27 @@ mod tests {
         assert!(login_error_message(&hv).contains("verification wasn't completed"));
     }
 
+    #[test]
+    fn a_cancelled_mailbox_prompt_is_reported_as_such() {
+        let error = pdfs_core::Error::Other("mailbox entry cancelled".into());
+        assert!(login_error_message(&error).contains("no mailbox password"));
+    }
+
+    #[test]
+    fn a_blocked_sign_in_does_not_ask_for_an_update() {
+        use pdfs_core::proton_sdk::api::ResponseCode;
+        use pdfs_core::proton_sdk::{ProtonApiError, ProtonError};
+        let error = pdfs_core::Error::Proton(ProtonError::Api(ProtonApiError {
+            code: ResponseCode::Blocked,
+            http_status: 422,
+            message: "This version of the app is no longer supported, please update to continue using the app".into(),
+            details: None,
+        }));
+        let message = login_error_message(&error);
+        assert!(message.contains("temporarily refusing"), "{message}");
+        assert!(!message.contains("update"), "{message}");
+    }
+
     #[test]
     fn an_unmapped_error_keeps_its_text() {
         let error = pdfs_core::Error::Other("something odd".into());

crates/pdfs-gui/src/app/pages/photo_viewer.rs

@@ -275,14 +275,42 @@ pub(crate) fn load_photo(ui: &Rc<Ui>, viewer: &Rc<Viewer>, uid: String) {
             viewer.status.set_label(message);
             viewer.status.set_visible(true);
         };
-        match result {
-            Ok(Ok(Response::FilePath { path })) if is_video => {
+        let path = match result {
+            Ok(Ok(Response::FilePath { path })) => path,
+            Ok(Ok(Response::Error { message, .. })) => return fail(&message),
+            Ok(Ok(_)) => return fail(&gettext("Unexpected reply from the Proton Drive service.")),
+            Ok(Err(_)) | Err(_) => return fail(&gettext("Couldn't reach Proton Drive.")),
+        };
+        // Decoding a full-size photo and reading its EXIF take a good part of
+        // a second for a large one, which froze the whole app on the main
+        // thread. Done on a worker; a reply for a photo the user has since
+        // left is dropped like the request's own.
+        let loaded = {
+            let path = path.clone();
+            gio::spawn_blocking(move || {
+                let size = std::fs::metadata(&path).ok().map(|meta| meta.len());
+                if is_video {
+                    return (size, None, ExifInfo::default());
+                }
+                let texture = gtk4::gdk::Texture::from_filename(&path);
+                (size, Some(texture), read_exif(&path))
+            })
+            .await
+        };
+        if *viewer.uid.borrow() != uid {
+            return;
+        }
+        let Ok((size, texture, info)) = loaded else {
+            return fail(&gettext("Couldn't render this photo."));
+        };
+        match texture {
+            None => {
                 viewer.video.set_filename(Some(&path));
                 viewer.media.set_visible_child_name("video");
                 *viewer.path.borrow_mut() = Some(path.clone());
-                show_info(&viewer, &path, ExifInfo::default());
+                show_info(&viewer, size, ExifInfo::default());
             }
-            Ok(Ok(Response::FilePath { path })) => match gtk4::gdk::Texture::from_filename(&path) {
+            Some(texture) => match texture {
                 Ok(texture) => {
                     // Zoomed in on the thumbnail: keep the photo the size it is
                     // on screen, now drawn from the full-size pixels.
@@ -297,16 +325,13 @@ pub(crate) fn load_photo(ui: &Rc<Ui>, viewer: &Rc<Viewer>, uid: String) {
                         zoom_to(&viewer, Some(zoom), None);
                     }
                     *viewer.path.borrow_mut() = Some(path.clone());
-                    show_info(&viewer, &path, read_exif(&path));
+                    show_info(&viewer, size, info);
                 }
                 Err(e) => {
                     tracing::error!("Failed to load texture for {path}: {e}");
                     fail(&gettext("Couldn't render this photo."));
                 }
             },
-            Ok(Ok(Response::Error { message, .. })) => fail(&message),
-            Ok(Ok(_)) => fail(&gettext("Unexpected reply from the Proton Drive service.")),
-            Ok(Err(_)) | Err(_) => fail(&gettext("Couldn't reach Proton Drive.")),
         }
     });
 }
@@ -452,16 +477,16 @@ pub(crate) fn clear_info(viewer: &Rc<Viewer>) {
 }
 
 /// Fill the details drawer for the photo now on screen: its own file facts
-/// (size, dimensions) plus whatever EXIF it carries.
-pub(crate) fn show_info(viewer: &Rc<Viewer>, path: &str, info: ExifInfo) {
+/// (`size`, dimensions) plus whatever EXIF it carries.
+pub(crate) fn show_info(viewer: &Rc<Viewer>, size: Option<u64>, info: ExifInfo) {
     while let Some(row) = viewer.info_rows.first_child() {
         viewer.info_rows.remove(&row);
     }
 
     let mut fields: Vec<(String, String)> = Vec::new();
-    if let Ok(meta) = std::fs::metadata(path) {
+    if let Some(size) = size {
         // Translators: label of a photo's file size in the details panel.
-        fields.push((pgettext("property", "Size"), human_bytes(meta.len())));
+        fields.push((pgettext("property", "Size"), human_bytes(size)));
     }
     fields.extend(info.fields);
 
@@ -481,6 +506,7 @@ pub(crate) fn show_info(viewer: &Rc<Viewer>, path: &str, info: ExifInfo) {
             let row = adw::ActionRow::builder()
                 .title(label.as_str())
                 .subtitle(value)
+                .use_markup(false)
                 .subtitle_selectable(true)
                 .build();
             row.add_css_class("property");
@@ -1259,8 +1285,11 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
     // Any real pointer movement brings the controls back; resting over one of
     // them keeps them up.
     let motion = gtk4::EventControllerMotion::new();
-    let viewer_motion = viewer.clone();
+    let viewer_motion = Rc::downgrade(&viewer);
     motion.connect_motion(move |_, x, y| {
+        let Some(viewer_motion) = viewer_motion.upgrade() else {
+            return;
+        };
         let (last_x, last_y) = viewer_motion.pointer.get();
         viewer_motion.pointer.set((x, y));
         if (x - last_x).abs() > 1.0 || (y - last_y).abs() > 1.0 {
@@ -1270,10 +1299,17 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
     body.add_controller(motion);
     for revealer in [&top_reveal, &prev_reveal, &next_reveal] {
         let hover = gtk4::EventControllerMotion::new();
-        let viewer_enter = viewer.clone();
-        hover.connect_enter(move |_, _, _| viewer_enter.chrome_hover.set(true));
-        let viewer_leave = viewer.clone();
+        let viewer_enter = Rc::downgrade(&viewer);
+        hover.connect_enter(move |_, _, _| {
+            if let Some(viewer) = viewer_enter.upgrade() {
+                viewer.chrome_hover.set(true);
+            }
+        });
+        let viewer_leave = Rc::downgrade(&viewer);
         hover.connect_leave(move |_| {
+            let Some(viewer_leave) = viewer_leave.upgrade() else {
+                return;
+            };
             viewer_leave.chrome_hover.set(false);
             show_chrome(&viewer_leave);
         });
@@ -1283,8 +1319,11 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
     // Ctrl+scroll zooms around the pointer; a plain scroll pans a zoomed photo.
     let wheel = gtk4::EventControllerScroll::new(gtk4::EventControllerScrollFlags::VERTICAL);
     wheel.set_propagation_phase(gtk4::PropagationPhase::Capture);
-    let viewer_wheel = viewer.clone();
+    let viewer_wheel = Rc::downgrade(&viewer);
     wheel.connect_scroll(move |controller, _, dy| {
+        let Some(viewer_wheel) = viewer_wheel.upgrade() else {
+            return glib::Propagation::Proceed;
+        };
         if !controller
             .current_event_state()
             .contains(gtk4::gdk::ModifierType::CONTROL_MASK)
@@ -1304,14 +1343,20 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
     scroller.add_controller(wheel);
 
     let pinch = gtk4::GestureZoom::new();
-    let viewer_pinch = viewer.clone();
+    let viewer_pinch = Rc::downgrade(&viewer);
     pinch.connect_begin(move |_, _| {
+        let Some(viewer_pinch) = viewer_pinch.upgrade() else {
+            return;
+        };
         viewer_pinch
             .pinch_start
             .set(current_scale(&viewer_pinch).unwrap_or(1.0));
     });
-    let viewer_pinch = viewer.clone();
+    let viewer_pinch = Rc::downgrade(&viewer);
     pinch.connect_scale_changed(move |gesture, delta| {
+        let Some(viewer_pinch) = viewer_pinch.upgrade() else {
+            return;
+        };
         let start = viewer_pinch.pinch_start.get();
         zoom_to(
             &viewer_pinch,
@@ -1323,8 +1368,11 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
 
     // Dragging a zoomed photo pans it.
     let drag = gtk4::GestureDrag::new();
-    let viewer_drag = viewer.clone();
+    let viewer_drag = Rc::downgrade(&viewer);
     drag.connect_drag_begin(move |_, _, _| {
+        let Some(viewer_drag) = viewer_drag.upgrade() else {
+            return;
+        };
         let scroller = &viewer_drag.scroller;
         viewer_drag.drag_start.set((
             scroller.hadjustment().value(),
@@ -1334,8 +1382,11 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
             viewer_drag.picture.set_cursor_from_name(Some("grabbing"));
         }
     });
-    let viewer_drag = viewer.clone();
+    let viewer_drag = Rc::downgrade(&viewer);
     drag.connect_drag_update(move |_, dx, dy| {
+        let Some(viewer_drag) = viewer_drag.upgrade() else {
+            return;
+        };
         if viewer_drag.zoom.get().is_none() {
             return;
         }
@@ -1343,39 +1394,58 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
         viewer_drag.scroller.hadjustment().set_value(x - dx);
         viewer_drag.scroller.vadjustment().set_value(y - dy);
     });
-    let viewer_drag = viewer.clone();
+    let viewer_drag = Rc::downgrade(&viewer);
     drag.connect_drag_end(move |_, _, _| {
+        let Some(viewer_drag) = viewer_drag.upgrade() else {
+            return;
+        };
         if viewer_drag.zoom.get().is_some() {
             viewer_drag.picture.set_cursor_from_name(Some("grab"));
         }
     });
     scroller.add_controller(drag);
 
-    let w_close = window.clone();
+    let w_close = window.downgrade();
     close_btn.connect_clicked(move |_| {
+        let Some(w_close) = w_close.upgrade() else {
+            return;
+        };
         w_close.close();
     });
 
-    let viewer_closing = viewer.clone();
+    // The one strong handle on the viewer. Every handler holds a weak one: a
+    // strong one in a handler of a widget the viewer holds is a cycle, which
+    // kept every closed lightbox, its window and its full-size photo in memory
+    // for the life of the app.
+    let keep = RefCell::new(Some(viewer.clone()));
     window.connect_close_request(move |_| {
-        stop_video(&viewer_closing);
-        disarm_slide(&viewer_closing);
-        if let Some(source) = viewer_closing.chrome_source.borrow_mut().take() {
-            source.remove();
+        if let Some(viewer) = keep.borrow_mut().take() {
+            stop_video(&viewer);
+            disarm_slide(&viewer);
+            if let Some(source) = viewer.chrome_source.borrow_mut().take() {
+                source.remove();
+            }
+            viewer.picture.set_paintable(gtk4::gdk::Paintable::NONE);
         }
         glib::Propagation::Proceed
     });
 
-    let viewer_info = viewer.clone();
+    let viewer_info = Rc::downgrade(&viewer);
     info_toggle.connect_toggled(move |toggle| {
+        let Some(viewer_info) = viewer_info.upgrade() else {
+            return;
+        };
         viewer_info
             .info_revealer
             .set_reveal_child(toggle.is_active());
     });
 
     let ui_slides = ui.clone();
-    let viewer_slides = viewer.clone();
+    let viewer_slides = Rc::downgrade(&viewer);
     slideshow_btn.connect_toggled(move |toggle| {
+        let Some(viewer_slides) = viewer_slides.upgrade() else {
+            return;
+        };
         if toggle.is_active() {
             start_slideshow(&ui_slides, &viewer_slides);
         } else {
@@ -1387,9 +1457,15 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
     info_close.connect_clicked(move |_| toggle_off.set_active(false));
 
     let ui_map = ui.clone();
-    let viewer_map = viewer.clone();
-    let w_map = window.clone();
+    let viewer_map = Rc::downgrade(&viewer);
+    let w_map = window.downgrade();
     info_map.connect_clicked(move |_| {
+        let Some(w_map) = w_map.upgrade() else {
+            return;
+        };
+        let Some(viewer_map) = viewer_map.upgrade() else {
+            return;
+        };
         let coords = *viewer_map.coords.borrow();
         if let Some((lat, lon)) = coords {
             w_map.close();
@@ -1398,8 +1474,11 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
     });
 
     let ui_fav = ui.clone();
-    let viewer_fav = viewer.clone();
+    let viewer_fav = Rc::downgrade(&viewer);
     favorite_btn.connect_toggled(move |btn| {
+        let Some(viewer_fav) = viewer_fav.upgrade() else {
+            return;
+        };
         if viewer_fav.favorite_suppress.get() {
             return;
         }
@@ -1443,17 +1522,26 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
     // gone, and leaving it open on a trashed photo invites a second Delete on
     // something the user cannot see.
     let ui_delete = ui.clone();
-    let viewer_delete = viewer.clone();
-    let w_delete = window.clone();
+    let viewer_delete = Rc::downgrade(&viewer);
+    let w_delete = window.downgrade();
     delete_btn.connect_clicked(move |_| {
+        let Some(w_delete) = w_delete.upgrade() else {
+            return;
+        };
+        let Some(viewer_delete) = viewer_delete.upgrade() else {
+            return;
+        };
         let uid = viewer_delete.uid.borrow().clone();
         w_delete.close();
         trash_photos(&ui_delete, vec![uid], false);
     });
 
     let ui_group = ui.clone();
-    let viewer_group = viewer.clone();
+    let viewer_group = Rc::downgrade(&viewer);
     group_btn.connect_clicked(move |_| {
+        let Some(viewer_group) = viewer_group.upgrade() else {
+            return;
+        };
         let uid = viewer_group.uid.borrow().clone();
         let next =
             next_group_member(&viewer_group.group.borrow(), &uid).map(|item| item.uid.clone());
@@ -1464,9 +1552,15 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
     });
 
     let ui_download = ui.clone();
-    let w_download = window.clone();
-    let viewer_download = viewer.clone();
+    let w_download = window.downgrade();
+    let viewer_download = Rc::downgrade(&viewer);
     download_btn.connect_clicked(move |_| {
+        let Some(w_download) = w_download.upgrade() else {
+            return;
+        };
+        let Some(viewer_download) = viewer_download.upgrade() else {
+            return;
+        };
         if let Some(path) = viewer_download.path.borrow().as_deref() {
             let name = viewer_download.name.borrow();
             save_photo_to_disk(
@@ -1478,23 +1572,35 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
         }
     });
 
-    let w_ext = window.clone();
-    let viewer_ext = viewer.clone();
+    let w_ext = window.downgrade();
+    let viewer_ext = Rc::downgrade(&viewer);
     open_ext_btn.connect_clicked(move |_| {
+        let Some(w_ext) = w_ext.upgrade() else {
+            return;
+        };
+        let Some(viewer_ext) = viewer_ext.upgrade() else {
+            return;
+        };
         if let Some(path) = viewer_ext.path.borrow().as_deref() {
             open_with(&w_ext, path, viewer_ext.name.borrow().as_deref());
         }
     });
 
     let ui_prev = ui.clone();
-    let viewer_prev = viewer.clone();
+    let viewer_prev = Rc::downgrade(&viewer);
     prev_btn.connect_clicked(move |_| {
+        let Some(viewer_prev) = viewer_prev.upgrade() else {
+            return;
+        };
         navigate_photo(&ui_prev, &viewer_prev, -1);
     });
 
     let ui_next = ui.clone();
-    let viewer_next = viewer.clone();
+    let viewer_next = Rc::downgrade(&viewer);
     next_btn.connect_clicked(move |_| {
+        let Some(viewer_next) = viewer_next.upgrade() else {
+            return;
+        };
         navigate_photo(&ui_next, &viewer_next, 1);
     });
 
@@ -1503,8 +1609,11 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
     // reaching for the image doesn't fling the window shut; a zoomed photo has
     // no backdrop to speak of. Double-click toggles between fitted and 100 %.
     let backdrop = gtk4::GestureClick::new();
-    let viewer_click = viewer.clone();
+    let viewer_click = Rc::downgrade(&viewer);
     backdrop.connect_pressed(move |_, n_press, x, y| {
+        let Some(viewer_click) = viewer_click.upgrade() else {
+            return;
+        };
         if n_press != 2 {
             return;
         }
@@ -1521,9 +1630,15 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
             zoom_to(&viewer_click, Some((fit * 2.0).max(1.0)), Some(anchor));
         }
     });
-    let viewer_click = viewer.clone();
-    let w_click = window.clone();
+    let viewer_click = Rc::downgrade(&viewer);
+    let w_click = window.downgrade();
     backdrop.connect_released(move |_, n_press, x, y| {
+        let Some(w_click) = w_click.upgrade() else {
+            return;
+        };
+        let Some(viewer_click) = viewer_click.upgrade() else {
+            return;
+        };
         if n_press == 1
             && viewer_click.zoom.get().is_none()
             && !over_photo(&viewer_click.picture, x, y)
@@ -1535,9 +1650,15 @@ pub(crate) fn open_photo_viewer(ui: &Rc<Ui>, initial_uid: String) {
 
     let key_controller = gtk4::EventControllerKey::new();
     let ui_key = ui.clone();
-    let viewer_key = viewer.clone();
-    let w_key = window.clone();
+    let viewer_key = Rc::downgrade(&viewer);
+    let w_key = window.downgrade();
     key_controller.connect_key_pressed(move |_, key, _keycode, state| {
+        let Some(w_key) = w_key.upgrade() else {
+            return glib::Propagation::Proceed;
+        };
+        let Some(viewer_key) = viewer_key.upgrade() else {
+            return glib::Propagation::Proceed;
+        };
         let ctrl = state.contains(gtk4::gdk::ModifierType::CONTROL_MASK);
         let playing_video = viewer_key.media.visible_child_name().as_deref() == Some("video");
         match key.name().as_deref() {